darkgate | 8c4fa2e64e0bd3b3e162e6f74fab12efdb30df68db69c12506038c54ed601580

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
28-08-2023 14:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ais_binded_moderate_halt_vm_enabled_2840.msi
Size

23.8MB
MD5

a3ae369339bf6213f0015ce0cfe4c5ee
SHA1

20c4e81820d31cde4bdc1a345bca3f1f5bf6706a
SHA256

8c4fa2e64e0bd3b3e162e6f74fab12efdb30df68db69c12506038c54ed601580
SHA512

ac6e3e051c77b32ee2461318ec8427ffa97fa443c5a13f31fb584e21c2637d6afe89beef962340c1bc3d17b1f3841eeaaf27d0ed83b6eaf84b9a6444d1bebe13
SSDEEP

393216:nSkbejTCxIAOo9YJi4A8oJSjbXRHodGkWrZH6RjYqLZyh7gJQ104h2j3cLFZN0c:zbe6+A59YAcXRy7W9IMJ7gJ2HmKH

Score

10^/10

darkgate discovery stealer

Malware Config

Extracted

Family

darkgate

http://80.66.88.14

Signatures

DarkGate
DarkGate is an infostealer written in C++.
stealer darkgate

Executes dropped EXE 4 IoCs

pid	Process
4844	Autoit3.exe
3712	Autoit3.exe
3548	dataAdvanced_IP_Scanner_2.5.4594.1.exe
3704	dataAdvanced_IP_Scanner_2.5.4594.1.tmp

Loads dropped DLL 5 IoCs

pid	Process
2488	MsiExec.exe
2488	MsiExec.exe
4000	MsiExec.exe
4000	MsiExec.exe
3704	dataAdvanced_IP_Scanner_2.5.4594.1.tmp

Modifies file permissions 1 TTPs 4 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4008	ICACLS.EXE
4644	ICACLS.EXE
4380	ICACLS.EXE
1040	ICACLS.EXE

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e57dee7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2654.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2655.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE0EA.tmp	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	EXPAND.EXE
File created	C:\Windows\Installer\e57dee7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8D8.tmp	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	EXPAND.EXE
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	EXPAND.EXE
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFDE9.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{22513D63-7DD9-478D-81A1-048FD9D472F0}	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	EXPAND.EXE
File opened for modification	C:\Windows\Installer\MSIFDF9.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{838CDA9F-A0F3-47B1-92F3-431A0FB48B9C}	msiexec.exe
File created	C:\Windows\Installer\e57dee6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57dee6.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Local Settings	Autoit3.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1436	msiexec.exe
1436	msiexec.exe
1436	msiexec.exe
1436	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4936	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4936	msiexec.exe
Token: SeSecurityPrivilege	1436	msiexec.exe
Token: SeCreateTokenPrivilege	4936	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4936	msiexec.exe
Token: SeLockMemoryPrivilege	4936	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4936	msiexec.exe
Token: SeMachineAccountPrivilege	4936	msiexec.exe
Token: SeTcbPrivilege	4936	msiexec.exe
Token: SeSecurityPrivilege	4936	msiexec.exe
Token: SeTakeOwnershipPrivilege	4936	msiexec.exe
Token: SeLoadDriverPrivilege	4936	msiexec.exe
Token: SeSystemProfilePrivilege	4936	msiexec.exe
Token: SeSystemtimePrivilege	4936	msiexec.exe
Token: SeProfSingleProcessPrivilege	4936	msiexec.exe
Token: SeIncBasePriorityPrivilege	4936	msiexec.exe
Token: SeCreatePagefilePrivilege	4936	msiexec.exe
Token: SeCreatePermanentPrivilege	4936	msiexec.exe
Token: SeBackupPrivilege	4936	msiexec.exe
Token: SeRestorePrivilege	4936	msiexec.exe
Token: SeShutdownPrivilege	4936	msiexec.exe
Token: SeDebugPrivilege	4936	msiexec.exe
Token: SeAuditPrivilege	4936	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4936	msiexec.exe
Token: SeChangeNotifyPrivilege	4936	msiexec.exe
Token: SeRemoteShutdownPrivilege	4936	msiexec.exe
Token: SeUndockPrivilege	4936	msiexec.exe
Token: SeSyncAgentPrivilege	4936	msiexec.exe
Token: SeEnableDelegationPrivilege	4936	msiexec.exe
Token: SeManageVolumePrivilege	4936	msiexec.exe
Token: SeImpersonatePrivilege	4936	msiexec.exe
Token: SeCreateGlobalPrivilege	4936	msiexec.exe
Token: SeBackupPrivilege	4536	vssvc.exe
Token: SeRestorePrivilege	4536	vssvc.exe
Token: SeAuditPrivilege	4536	vssvc.exe
Token: SeBackupPrivilege	1436	msiexec.exe
Token: SeRestorePrivilege	1436	msiexec.exe
Token: SeRestorePrivilege	1436	msiexec.exe
Token: SeTakeOwnershipPrivilege	1436	msiexec.exe
Token: SeRestorePrivilege	1436	msiexec.exe
Token: SeTakeOwnershipPrivilege	1436	msiexec.exe
Token: SeShutdownPrivilege	700	msiexec.exe
Token: SeIncreaseQuotaPrivilege	700	msiexec.exe
Token: SeCreateTokenPrivilege	700	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	700	msiexec.exe
Token: SeLockMemoryPrivilege	700	msiexec.exe
Token: SeIncreaseQuotaPrivilege	700	msiexec.exe
Token: SeMachineAccountPrivilege	700	msiexec.exe
Token: SeTcbPrivilege	700	msiexec.exe
Token: SeSecurityPrivilege	700	msiexec.exe
Token: SeTakeOwnershipPrivilege	700	msiexec.exe
Token: SeLoadDriverPrivilege	700	msiexec.exe
Token: SeSystemProfilePrivilege	700	msiexec.exe
Token: SeSystemtimePrivilege	700	msiexec.exe
Token: SeProfSingleProcessPrivilege	700	msiexec.exe
Token: SeIncBasePriorityPrivilege	700	msiexec.exe
Token: SeCreatePagefilePrivilege	700	msiexec.exe
Token: SeCreatePermanentPrivilege	700	msiexec.exe
Token: SeBackupPrivilege	700	msiexec.exe
Token: SeRestorePrivilege	700	msiexec.exe
Token: SeShutdownPrivilege	700	msiexec.exe
Token: SeDebugPrivilege	700	msiexec.exe
Token: SeAuditPrivilege	700	msiexec.exe
Token: SeSystemEnvironmentPrivilege	700	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4936	msiexec.exe
700	msiexec.exe
4936	msiexec.exe
700	msiexec.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 2816	1436	msiexec.exe	93
PID 1436 wrote to memory of 2816	1436	msiexec.exe	93
PID 1436 wrote to memory of 2488	1436	msiexec.exe	95
PID 1436 wrote to memory of 2488	1436	msiexec.exe	95
PID 1436 wrote to memory of 2488	1436	msiexec.exe	95
PID 2488 wrote to memory of 4008	2488	MsiExec.exe	97
PID 2488 wrote to memory of 4008	2488	MsiExec.exe	97
PID 2488 wrote to memory of 4008	2488	MsiExec.exe	97
PID 2488 wrote to memory of 5108	2488	MsiExec.exe	99
PID 2488 wrote to memory of 5108	2488	MsiExec.exe	99
PID 2488 wrote to memory of 5108	2488	MsiExec.exe	99
PID 2488 wrote to memory of 4844	2488	MsiExec.exe	101
PID 2488 wrote to memory of 4844	2488	MsiExec.exe	101
PID 2488 wrote to memory of 4844	2488	MsiExec.exe	101
PID 4844 wrote to memory of 700	4844	Autoit3.exe	102
PID 4844 wrote to memory of 700	4844	Autoit3.exe	102
PID 4844 wrote to memory of 700	4844	Autoit3.exe	102
PID 2488 wrote to memory of 4644	2488	MsiExec.exe	104
PID 2488 wrote to memory of 4644	2488	MsiExec.exe	104
PID 2488 wrote to memory of 4644	2488	MsiExec.exe	104
PID 1436 wrote to memory of 4000	1436	msiexec.exe	105
PID 1436 wrote to memory of 4000	1436	msiexec.exe	105
PID 1436 wrote to memory of 4000	1436	msiexec.exe	105
PID 4000 wrote to memory of 4380	4000	MsiExec.exe	106
PID 4000 wrote to memory of 4380	4000	MsiExec.exe	106
PID 4000 wrote to memory of 4380	4000	MsiExec.exe	106
PID 4000 wrote to memory of 1736	4000	MsiExec.exe	108
PID 4000 wrote to memory of 1736	4000	MsiExec.exe	108
PID 4000 wrote to memory of 1736	4000	MsiExec.exe	108
PID 4000 wrote to memory of 3712	4000	MsiExec.exe	110
PID 4000 wrote to memory of 3712	4000	MsiExec.exe	110
PID 4000 wrote to memory of 3712	4000	MsiExec.exe	110
PID 3712 wrote to memory of 3548	3712	Autoit3.exe	111
PID 3712 wrote to memory of 3548	3712	Autoit3.exe	111
PID 3712 wrote to memory of 3548	3712	Autoit3.exe	111
PID 4000 wrote to memory of 1040	4000	MsiExec.exe	112
PID 4000 wrote to memory of 1040	4000	MsiExec.exe	112
PID 4000 wrote to memory of 1040	4000	MsiExec.exe	112
PID 3548 wrote to memory of 3704	3548	dataAdvanced_IP_Scanner_2.5.4594.1.exe	114
PID 3548 wrote to memory of 3704	3548	dataAdvanced_IP_Scanner_2.5.4594.1.exe	114
PID 3548 wrote to memory of 3704	3548	dataAdvanced_IP_Scanner_2.5.4594.1.exe	114

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ais_binded_moderate_halt_vm_enabled_2840.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4936

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2816
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3B06D5C397BFEC79622A702833FB4215
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2488
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-f0bc751d-8be2-4804-800a-b13459f87b6f\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    PID:4008
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    PID:5108
- - C:\Users\Admin\AppData\Local\Temp\MW-f0bc751d-8be2-4804-800a-b13459f87b6f\files\Autoit3.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-f0bc751d-8be2-4804-800a-b13459f87b6f\files\Autoit3.exe" HUnMaYsB.au3
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4844
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\MW-f0bc751d-8be2-4804-800a-b13459f87b6f\files\dataais_binded_moderate_halt_vm_enabled_2840.msi"
      4⤵
      Enumerates connected drives
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:700
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-f0bc751d-8be2-4804-800a-b13459f87b6f\." /SETINTEGRITYLEVEL (CI)(OI)LOW
    3⤵
    - Modifies file permissions
    PID:4644
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 362008B9A544C76011914EDAB6EFEE69
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4000
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-20c184b8-8578-4892-8785-a83e8505f6f9\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    PID:4380
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    PID:1736
- - C:\Users\Admin\AppData\Local\Temp\MW-20c184b8-8578-4892-8785-a83e8505f6f9\files\Autoit3.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-20c184b8-8578-4892-8785-a83e8505f6f9\files\Autoit3.exe" pqDBSYvs.au3
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3712
  - - C:\Users\Admin\AppData\Local\Temp\MW-20c184b8-8578-4892-8785-a83e8505f6f9\files\dataAdvanced_IP_Scanner_2.5.4594.1.exe
      "C:\Users\Admin\AppData\Local\Temp\MW-20c184b8-8578-4892-8785-a83e8505f6f9\files\dataAdvanced_IP_Scanner_2.5.4594.1.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3548
    - - C:\Users\Admin\AppData\Local\Temp\is-J6C4J.tmp\dataAdvanced_IP_Scanner_2.5.4594.1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-J6C4J.tmp\dataAdvanced_IP_Scanner_2.5.4594.1.tmp" /SL5="$E005C,20439558,139776,C:\Users\Admin\AppData\Local\Temp\MW-20c184b8-8578-4892-8785-a83e8505f6f9\files\dataAdvanced_IP_Scanner_2.5.4594.1.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3704
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-20c184b8-8578-4892-8785-a83e8505f6f9\." /SETINTEGRITYLEVEL (CI)(OI)LOW
    3⤵
    - Modifies file permissions
    PID:1040

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MW-20c184b8-8578-4892-8785-a83e8505f6f9\files.cab

Filesize
21.7MB

MD5
e0d8d9aae9ace7df1b8fb4c4b43eec53

SHA1
4aca9a7e90f2648c8ddcb91f62dbcb27c461c50e

SHA256
2d08809875f2cfcbe4538d11ee5537768beba0b7740e1785ac35fd90d32e5c25

SHA512
cfb9ed6c7d67cf5508fa9fe72b56b739587b161ae988dff23b835bfef5ce72a7586ee55e03e1b1bf7267ea3f99dc57044b9c1d3109621e9a2c6a0cc710aceb7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-20c184b8-8578-4892-8785-a83e8505f6f9\files\Autoit3.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-20c184b8-8578-4892-8785-a83e8505f6f9\files\Autoit3.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-20c184b8-8578-4892-8785-a83e8505f6f9\files\Autoit3.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-20c184b8-8578-4892-8785-a83e8505f6f9\files\dataAdvanced_IP_Scanner_2.5.4594.1.exe

Filesize
20.1MB

MD5
5537c708edb9a2c21f88e34e8a0f1744

SHA1
86233a285363c2a6863bf642deab7e20f062b8eb

SHA256
26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b

SHA512
35f44c0df4635a1020f52743d7cf3e4346d1bdf9010161326e572250ac93e0285b202532a07d2db8dbc67f6f0ced864083769e904bd5d82611244339ca8d31a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-20c184b8-8578-4892-8785-a83e8505f6f9\files\dataAdvanced_IP_Scanner_2.5.4594.1.exe

Filesize
20.1MB

MD5
5537c708edb9a2c21f88e34e8a0f1744

SHA1
86233a285363c2a6863bf642deab7e20f062b8eb

SHA256
26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b

SHA512
35f44c0df4635a1020f52743d7cf3e4346d1bdf9010161326e572250ac93e0285b202532a07d2db8dbc67f6f0ced864083769e904bd5d82611244339ca8d31a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-20c184b8-8578-4892-8785-a83e8505f6f9\files\pqDBSYvs.au3

Filesize
756KB

MD5
75a08e44ff4ce6d97237056f1bee2e03

SHA1
055b96c985b169e8f7520832a2a819eefd3cee4e

SHA256
f02928ec21ad8c600eef3e3a006581a3af858975cbc2ad29ba3dfdd1a78d3cb9

SHA512
22ed98d276413f6888d13afe8b7b651d7e2911012012470f6d6ee66565884115570858d77bb220e6038de0a5a10e4024d8a40f88b98e4b8ae75f5c283684fef2

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-20c184b8-8578-4892-8785-a83e8505f6f9\msiwrapper.ini

Filesize
1KB

MD5
e6ec976df6aee976fcd490531e9319f4

SHA1
14caeafdbba2ad82d2ac460556916b1fc7338228

SHA256
cbaeeaa29a042bcdd5aa6438d0925fc6a64e705b07b671780df56bcf31259730

SHA512
430d911401b54d0eb4bd7d203de9cb4f62cda8c1e6887d5f5561b598b57f1dd3796030d189daf201e0874d72e3555c27eec05ab707d941821051fbac5a3c8a02

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-20c184b8-8578-4892-8785-a83e8505f6f9\msiwrapper.ini

Filesize
1KB

MD5
e6ec976df6aee976fcd490531e9319f4

SHA1
14caeafdbba2ad82d2ac460556916b1fc7338228

SHA256
cbaeeaa29a042bcdd5aa6438d0925fc6a64e705b07b671780df56bcf31259730

SHA512
430d911401b54d0eb4bd7d203de9cb4f62cda8c1e6887d5f5561b598b57f1dd3796030d189daf201e0874d72e3555c27eec05ab707d941821051fbac5a3c8a02

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-20c184b8-8578-4892-8785-a83e8505f6f9\msiwrapper.ini

Filesize
1KB

MD5
08f0aba57bb0059edff5f7042e248073

SHA1
6d857f6d0ebe8a87d15aac271ba417d24cc8858b

SHA256
e3ebc6e1192be683f470f4f55cf4cf4482ee413057b43d9287dc03d48d8aae7b

SHA512
e6df120a1d99951b7d8958378b0c704d3f4281e80fe7af2d541d2ef82bcc33557e5ae9850731e85ca1b3c8a2280b1cc9960788e79cb523a5b3a6072fb55ba1e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-f0bc751d-8be2-4804-800a-b13459f87b6f\files.cab

Filesize
23.5MB

MD5
cea1e89553a921c50a4d267b6c1adf89

SHA1
7df98424268cdfd4b59e0e5b86f3b613453bba6c

SHA256
6a81b3d6606bd5c4f9d3484719ec35fc6d2dedb902a85553705a71a6e1273104

SHA512
f75e4af6a397f7e17629cdaa5cd1ed6c25a13bae112ad7ee9a9507bc0ee0da67e16c919497e831ce28f94791a29ff60f21af5ad763a267666ef9007d48e5e411

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-f0bc751d-8be2-4804-800a-b13459f87b6f\files\Autoit3.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-f0bc751d-8be2-4804-800a-b13459f87b6f\files\Autoit3.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-f0bc751d-8be2-4804-800a-b13459f87b6f\files\HUnMaYsB.au3

Filesize
766KB

MD5
8800e5a9b05e700c73ac3e6a0efa567b

SHA1
33257cf22db748155e57d475d21a7761eed2fa10

SHA256
1174858c9a541976c2aa2ef8d629a960dc8ea7e97852fc256aa1ba322c071478

SHA512
adea0c6960b60d241beb88115ade95a5535fff97e44b36845dcb9755a56664c15ce536f39c9e20e52b979e090e875eaf5a23466327fe3113c93dd9b3dbfd73fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-f0bc751d-8be2-4804-800a-b13459f87b6f\files\dataais_binded_moderate_halt_vm_enabled_2840.msi

Filesize
21.9MB

MD5
71ef4437d030db62aee415cb2e4ac7ab

SHA1
dfdbc16841197d1e1330cd14aadb48159fac60d9

SHA256
bde8e0c4bc687ea485fd4a00c86bd25ab14a04edf9b2bbc03808e9b86074717b

SHA512
1d9226d5b0f75d035ac9ac476bc58d3f885dc5800b28fbcd8a05914da8f569708d898baa70bef92102da6a8999c7d0af1e911625bc42a8047e2a7023557c50a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-f0bc751d-8be2-4804-800a-b13459f87b6f\msiwrapper.ini

Filesize
438B

MD5
733aa1bde7a745eaa93b0f45fa8121df

SHA1
f469fe8d7e740158c26a03dd69b38d992efa8081

SHA256
31b76d1e028d9fe0728a5449a555b368e340b97926cb9280faac3828be810cef

SHA512
00a2619b1c2442cd34565fb9ff89f5ec94ce8488c884af7510a16cab22fc26115655fd8ca8cbc41833726d85f305da2de4935fa9080f913c91dca7dc736cb6a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-f0bc751d-8be2-4804-800a-b13459f87b6f\msiwrapper.ini

Filesize
1KB

MD5
609e8ba444df4e69b1e96a94a8461791

SHA1
b9305cea41ab66d50bf10388e8e5a03f496d7b45

SHA256
9e864e4ae13cf6c2984f01660605a811ca1cc79b69a9f540c769c1f1b573e842

SHA512
0a81389201c35ccc70d25fbf72782a6735096666ab1f662b04fd295fe1ccc84056234637174ec66dbc4ce74a00c0db50d3c03724b403b3487fc5f1e53249b5ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-f0bc751d-8be2-4804-800a-b13459f87b6f\msiwrapper.ini

Filesize
1KB

MD5
609e8ba444df4e69b1e96a94a8461791

SHA1
b9305cea41ab66d50bf10388e8e5a03f496d7b45

SHA256
9e864e4ae13cf6c2984f01660605a811ca1cc79b69a9f540c769c1f1b573e842

SHA512
0a81389201c35ccc70d25fbf72782a6735096666ab1f662b04fd295fe1ccc84056234637174ec66dbc4ce74a00c0db50d3c03724b403b3487fc5f1e53249b5ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-f0bc751d-8be2-4804-800a-b13459f87b6f\msiwrapper.ini

Filesize
1KB

MD5
7f726d3562c036c5b7ddfeb4bf71c083

SHA1
6df0d53045d1abd40f9af592a5219a541fd51bab

SHA256
fb04757de842884eca4c9d5de5a93bee323bbef09bcb329bacc883cd0a2f84e0

SHA512
92758dbf0a505695eb79b163ed5c0153fc326414b5833a470780f6fc944011e55c0c02c52a3a69cbf9774b58f07a172d48d20bfdd00b1083c82d6b70c867c06a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-FHF4C.tmp\aips_is_install_dll.dll

Filesize
149KB

MD5
57e73855fad786a59893d6581e9fb5b9

SHA1
630e52b9e88a05add68401bd62790ed8e2c3282a

SHA256
3a7a8aa906c65124c4ee82aacb81d723ce69864ccaf041f631b8131de59e4a88

SHA512
be0cf0925535dd667488175f2eac660d1ebf8429ce6725252c59fb70b00fc2f21b1e0b7ce632eaa53337ae25e44c641e13a3df0b415724498d30daf00b296f4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-J6C4J.tmp\dataAdvanced_IP_Scanner_2.5.4594.1.tmp

Filesize
1.1MB

MD5
b87639f9a6cf5ba8c9e1f297c5745a67

SHA1
ce4758849b53af582d2d8a1bc0db20683e139fcc

SHA256
ec8252a333f68865160e26dc95607f2c49af00f78c657f7f8417ab9d86e90bf7

SHA512
9626fc4aa4604eee7ededa62b9dc78a3f6fe388eaf1fa6c916a3715b0dff65c417eede156d82398c2400977a36457122565e15e0ed0e435b28cb9f796005c1c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-J6C4J.tmp\dataAdvanced_IP_Scanner_2.5.4594.1.tmp

Filesize
1.1MB

MD5
b87639f9a6cf5ba8c9e1f297c5745a67

SHA1
ce4758849b53af582d2d8a1bc0db20683e139fcc

SHA256
ec8252a333f68865160e26dc95607f2c49af00f78c657f7f8417ab9d86e90bf7

SHA512
9626fc4aa4604eee7ededa62b9dc78a3f6fe388eaf1fa6c916a3715b0dff65c417eede156d82398c2400977a36457122565e15e0ed0e435b28cb9f796005c1c0

Download Submit
C:\Windows\Installer\MSI2655.tmp

Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
C:\Windows\Installer\MSI2655.tmp

Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
C:\Windows\Installer\MSI8D8.tmp

Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
C:\Windows\Installer\MSI8D8.tmp

Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
C:\Windows\Installer\MSI8D8.tmp

Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
C:\Windows\Installer\MSIE0EA.tmp

Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
C:\Windows\Installer\MSIE0EA.tmp

Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
C:\Windows\Installer\MSIFDF9.tmp

Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
C:\Windows\Installer\MSIFDF9.tmp

Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
C:\Windows\Installer\e57dee6.msi

Filesize
23.8MB

MD5
a3ae369339bf6213f0015ce0cfe4c5ee

SHA1
20c4e81820d31cde4bdc1a345bca3f1f5bf6706a

SHA256
8c4fa2e64e0bd3b3e162e6f74fab12efdb30df68db69c12506038c54ed601580

SHA512
ac6e3e051c77b32ee2461318ec8427ffa97fa443c5a13f31fb584e21c2637d6afe89beef962340c1bc3d17b1f3841eeaaf27d0ed83b6eaf84b9a6444d1bebe13

Download Submit
C:\Windows\LOGS\DPX\setupact.log

Filesize
168KB

MD5
2930d03b159ce1d50da0e36f0b6234e1

SHA1
1d1c2e81c62f5218794224f713e5a2331ef6f5f4

SHA256
fd7de10afaf5938bf2684800207dfd5e5e34574ef9d9bcd676baf6446524da51

SHA512
7225e0212d5ddfe9f007323ef1c7aa4b1854ebfc936621145dc6ceec9f323214f611e1b9e8432b56717faeaa8b38d4f96ac0b870c16873363aed5a41b2acb2ee

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.0MB

MD5
29ba5ede740acd602f7de9bda6368b29

SHA1
e11f85ee3092f404cd3aff820f463a8aee96e5d4

SHA256
291b987161aa533315381113b1ef8ef1e64af8ecfc46cf81259c89bccd7c5c4d

SHA512
fdf4b99009547a6e378f6d8e2de1e8171a69c8448c471a6e69a9e950d8b985dafd4e82ab9be816a268abf51312c4a63b5eee52440676ac11645acca1c77a5d15

Download Submit
\??\Volume{6cfc8904-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{4592b267-f8f8-4fb9-a755-67961cbf6115}_OnDiskSnapshotProp

Filesize
5KB

MD5
62689021a0398e38e96e194d4ff5cc10

SHA1
f0b8ac133deab22e9b688ef6cd85e720ba2c2ff2

SHA256
3c2305dfed4faddac8739907b25e6becf617c9d298f80424b67152f53107358f

SHA512
dd6f9d42569616a4287a460f98758663748ca63ad9ecda3efbb2af2319752b8eb85ecc2eb666bb6e9e89ace9aeaa2ae59d301316cd1b6f548e8b3b390bebc5e0

Download Submit
memory/3548-173-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/3548-197-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/3704-188-0x00000000006E0000-0x00000000006E1000-memory.dmp

Filesize
4KB

Download
memory/3704-202-0x0000000000400000-0x0000000000530000-memory.dmp

Filesize
1.2MB

Download
memory/3704-199-0x00000000006E0000-0x00000000006E1000-memory.dmp

Filesize
4KB

Download
memory/3704-198-0x0000000000400000-0x0000000000530000-memory.dmp

Filesize
1.2MB

Download
memory/3712-169-0x0000000004940000-0x0000000004B19000-memory.dmp

Filesize
1.8MB

Download
memory/3712-165-0x0000000001810000-0x0000000001C10000-memory.dmp

Filesize
4.0MB

Download
memory/3712-167-0x0000000004940000-0x0000000004B19000-memory.dmp

Filesize
1.8MB

Download
memory/3712-166-0x0000000004120000-0x0000000004215000-memory.dmp

Filesize
980KB

Download
memory/3712-171-0x0000000004940000-0x0000000004B19000-memory.dmp

Filesize
1.8MB

Download
memory/4844-81-0x0000000004980000-0x0000000004B59000-memory.dmp

Filesize
1.8MB

Download
memory/4844-80-0x0000000004980000-0x0000000004B59000-memory.dmp

Filesize
1.8MB

Download
memory/4844-78-0x0000000004980000-0x0000000004B59000-memory.dmp

Filesize
1.8MB

Download
memory/4844-76-0x0000000001300000-0x0000000001700000-memory.dmp

Filesize
4.0MB

Download
memory/4844-77-0x0000000004150000-0x0000000004245000-memory.dmp

Filesize
980KB

Download