darkgate | 80062d028573ccc1aa099bce4ace31aeb0f6e6410cdf32f13bbc54fa8bbb71d0

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 12:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08c31ed8f0574544769c024a57bc57daa9e444f57845ebd41b2a5213901d4667.msi
Size

1.8MB
MD5

d402f30e4f9bc2f6d470384591bf9b34
SHA1

37f73ff4f0bb88ddd5605cf696e8947d63a79c97
SHA256

08c31ed8f0574544769c024a57bc57daa9e444f57845ebd41b2a5213901d4667
SHA512

290a714cefa8ebf375ab439bf4e4083c93d49d843c39d9b83a2fe03e13619e425066becabadfb0491192ebd2b7bfad6fc6c407c40af8800293a2a4a59b011dba
SSDEEP

49152:epUPfjpSNeHaHGYayNId4pWL56Hq05vHjYL57CBN4/6sT:epeeHGKId+W1n6/01kN4ysT

Score

10^/10

darkgate aa11 discovery stealer

Malware Config

Extracted

Family

darkgate

Botnet

AA11

http://94.228.169.143

Attributes

alternative_c2_port
8080
anti_analysis
true
anti_debug
true
anti_vm
false
c2_port
2351
check_disk
false
check_ram
false
check_xeon
false
crypter_au3
true
crypter_dll
false
crypter_rawstub
false
crypto_key
bABouSDRyBocvj
internal_mutex
txtMut
minimum_disk
100
minimum_ram
4096
ping_interval
4
rootkit
true
startup_persistence
true
username
AA11

Signatures

DarkGate
DarkGate is an infostealer written in C++.
stealer darkgate

Executes dropped EXE 2 IoCs

pid	Process
2228	KeyScramblerLogon.exe
2328	Autoit3.exe

Loads dropped DLL 8 IoCs

pid	Process
1152	MsiExec.exe
1152	MsiExec.exe
1152	MsiExec.exe
1152	MsiExec.exe
1152	MsiExec.exe
2228	KeyScramblerLogon.exe
2228	KeyScramblerLogon.exe
1152	MsiExec.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
592	ICACLS.EXE
2872	ICACLS.EXE

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIDC2C.tmp	msiexec.exe
File opened for modification	C:\Windows\Logs\DPX\setuperr.log	EXPAND.EXE
File opened for modification	C:\Windows\Installer\MSIF46E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF836.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\Installer\f76d96e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f76d96e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\f76d96f.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f76d96f.ipi	msiexec.exe
File opened for modification	C:\Windows\Logs\DPX\setupact.log	EXPAND.EXE

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x000600000001754b-114.dat	nsis_installer_1
behavioral1/files/0x000600000001754b-114.dat	nsis_installer_2

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Autoit3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Autoit3.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3056	msiexec.exe
3056	msiexec.exe

Suspicious use of AdjustPrivilegeToken 57 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2220	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2220	msiexec.exe
Token: SeRestorePrivilege	3056	msiexec.exe
Token: SeTakeOwnershipPrivilege	3056	msiexec.exe
Token: SeSecurityPrivilege	3056	msiexec.exe
Token: SeCreateTokenPrivilege	2220	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2220	msiexec.exe
Token: SeLockMemoryPrivilege	2220	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2220	msiexec.exe
Token: SeMachineAccountPrivilege	2220	msiexec.exe
Token: SeTcbPrivilege	2220	msiexec.exe
Token: SeSecurityPrivilege	2220	msiexec.exe
Token: SeTakeOwnershipPrivilege	2220	msiexec.exe
Token: SeLoadDriverPrivilege	2220	msiexec.exe
Token: SeSystemProfilePrivilege	2220	msiexec.exe
Token: SeSystemtimePrivilege	2220	msiexec.exe
Token: SeProfSingleProcessPrivilege	2220	msiexec.exe
Token: SeIncBasePriorityPrivilege	2220	msiexec.exe
Token: SeCreatePagefilePrivilege	2220	msiexec.exe
Token: SeCreatePermanentPrivilege	2220	msiexec.exe
Token: SeBackupPrivilege	2220	msiexec.exe
Token: SeRestorePrivilege	2220	msiexec.exe
Token: SeShutdownPrivilege	2220	msiexec.exe
Token: SeDebugPrivilege	2220	msiexec.exe
Token: SeAuditPrivilege	2220	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2220	msiexec.exe
Token: SeChangeNotifyPrivilege	2220	msiexec.exe
Token: SeRemoteShutdownPrivilege	2220	msiexec.exe
Token: SeUndockPrivilege	2220	msiexec.exe
Token: SeSyncAgentPrivilege	2220	msiexec.exe
Token: SeEnableDelegationPrivilege	2220	msiexec.exe
Token: SeManageVolumePrivilege	2220	msiexec.exe
Token: SeImpersonatePrivilege	2220	msiexec.exe
Token: SeCreateGlobalPrivilege	2220	msiexec.exe
Token: SeBackupPrivilege	2732	vssvc.exe
Token: SeRestorePrivilege	2732	vssvc.exe
Token: SeAuditPrivilege	2732	vssvc.exe
Token: SeBackupPrivilege	3056	msiexec.exe
Token: SeRestorePrivilege	3056	msiexec.exe
Token: SeRestorePrivilege	2492	DrvInst.exe
Token: SeRestorePrivilege	2492	DrvInst.exe
Token: SeRestorePrivilege	2492	DrvInst.exe
Token: SeRestorePrivilege	2492	DrvInst.exe
Token: SeRestorePrivilege	2492	DrvInst.exe
Token: SeRestorePrivilege	2492	DrvInst.exe
Token: SeRestorePrivilege	2492	DrvInst.exe
Token: SeLoadDriverPrivilege	2492	DrvInst.exe
Token: SeLoadDriverPrivilege	2492	DrvInst.exe
Token: SeLoadDriverPrivilege	2492	DrvInst.exe
Token: SeRestorePrivilege	3056	msiexec.exe
Token: SeTakeOwnershipPrivilege	3056	msiexec.exe
Token: SeRestorePrivilege	3056	msiexec.exe
Token: SeTakeOwnershipPrivilege	3056	msiexec.exe
Token: SeRestorePrivilege	3056	msiexec.exe
Token: SeTakeOwnershipPrivilege	3056	msiexec.exe
Token: SeRestorePrivilege	3056	msiexec.exe
Token: SeTakeOwnershipPrivilege	3056	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2220	msiexec.exe
2220	msiexec.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 1152	3056	msiexec.exe	33
PID 3056 wrote to memory of 1152	3056	msiexec.exe	33
PID 3056 wrote to memory of 1152	3056	msiexec.exe	33
PID 3056 wrote to memory of 1152	3056	msiexec.exe	33
PID 3056 wrote to memory of 1152	3056	msiexec.exe	33
PID 3056 wrote to memory of 1152	3056	msiexec.exe	33
PID 3056 wrote to memory of 1152	3056	msiexec.exe	33
PID 1152 wrote to memory of 592	1152	MsiExec.exe	34
PID 1152 wrote to memory of 592	1152	MsiExec.exe	34
PID 1152 wrote to memory of 592	1152	MsiExec.exe	34
PID 1152 wrote to memory of 592	1152	MsiExec.exe	34
PID 1152 wrote to memory of 572	1152	MsiExec.exe	36
PID 1152 wrote to memory of 572	1152	MsiExec.exe	36
PID 1152 wrote to memory of 572	1152	MsiExec.exe	36
PID 1152 wrote to memory of 572	1152	MsiExec.exe	36
PID 1152 wrote to memory of 2228	1152	MsiExec.exe	38
PID 1152 wrote to memory of 2228	1152	MsiExec.exe	38
PID 1152 wrote to memory of 2228	1152	MsiExec.exe	38
PID 1152 wrote to memory of 2228	1152	MsiExec.exe	38
PID 2228 wrote to memory of 2328	2228	KeyScramblerLogon.exe	39
PID 2228 wrote to memory of 2328	2228	KeyScramblerLogon.exe	39
PID 2228 wrote to memory of 2328	2228	KeyScramblerLogon.exe	39
PID 2228 wrote to memory of 2328	2228	KeyScramblerLogon.exe	39
PID 1152 wrote to memory of 2872	1152	MsiExec.exe	40
PID 1152 wrote to memory of 2872	1152	MsiExec.exe	40
PID 1152 wrote to memory of 2872	1152	MsiExec.exe	40
PID 1152 wrote to memory of 2872	1152	MsiExec.exe	40

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\08c31ed8f0574544769c024a57bc57daa9e444f57845ebd41b2a5213901d4667.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2220

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9629E9CFA4B6BAE159AAFC46C2038153
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1152
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-67340cf7-000c-41f1-b606-eddf6d824481\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    PID:592
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    PID:572
- - C:\Users\Admin\AppData\Local\Temp\MW-67340cf7-000c-41f1-b606-eddf6d824481\files\KeyScramblerLogon.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-67340cf7-000c-41f1-b606-eddf6d824481\files\KeyScramblerLogon.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2228
  - - C:\Users\Admin\AppData\Local\Temp\MW-67340cf7-000c-41f1-b606-eddf6d824481\files\Autoit3.exe
      "C:\Users\Admin\AppData\Local\Temp\MW-67340cf7-000c-41f1-b606-eddf6d824481\files\Autoit3.exe" C:\Users\Admin\AppData\Local\Temp\MW-67340cf7-000c-41f1-b606-eddf6d824481\files\script.au3
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      PID:2328
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-67340cf7-000c-41f1-b606-eddf6d824481\." /SETINTEGRITYLEVEL (CI)(OI)LOW
    3⤵
    - Modifies file permissions
    PID:2872

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2732

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000300" "00000000000003AC"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MW-67340cf7-000c-41f1-b606-eddf6d824481\files.cab

Filesize
1.5MB

MD5
5db928e279f821e733a8e8a404c5fd5a

SHA1
c76a81b6632724d027611c5a78e2b233bdcf197c

SHA256
89231e4af7cf31fe0e57aef0b76f37db9f6f66b078c12e6d973825290a616ce1

SHA512
cd37952521969e791d94966ee4182b975a6153df79fe979bde625d993445338d1609cbfb4dc0d34ceea8ebc85cb58c2569523f8c50b6770e64431cb2b7e90354

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-67340cf7-000c-41f1-b606-eddf6d824481\files\Autoit3.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-67340cf7-000c-41f1-b606-eddf6d824481\files\Autoit3.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-67340cf7-000c-41f1-b606-eddf6d824481\files\KeyScramblerIE.DLL

Filesize
620KB

MD5
20f10fe9d17f9cf2d8e9772957b9ebe4

SHA1
dc8b8a023e31636719a7d88233aaf54cc80d2715

SHA256
2a637f0dc2136bd4241ec57bcf022e22e55eaf7f33be93495f1f1bea49d59988

SHA512
9b1306fa921167fdda1b0a6134c74ae676813c364e6e9de2c99dcefb6970a42339ecfe4f8e6140550a42067e8717900164ff046797c072971a8b51472c3f2269

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-67340cf7-000c-41f1-b606-eddf6d824481\files\KeyScramblerLogon.dll

Filesize
92KB

MD5
760aa6f15db378dda44f262e1349e28d

SHA1
9bb9a0caa54e8b2560245430f33985996b2d40f3

SHA256
ee04957d0010ca2134c4770b434b2fdec08a25400b474dd51f47d5d1dc8d574b

SHA512
c6cf081dc189d88c85d01832f5cb09ff42c1264d7d4c548a336a33b97ec0b0b24aeb25076fd24db7db2f7a7ced6eccc67d26497352f7eeb1d29bb9c0a59abce6

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-67340cf7-000c-41f1-b606-eddf6d824481\files\KeyScramblerLogon.exe

Filesize
500KB

MD5
c790ebfcb6a34953a371e32c9174fe46

SHA1
3ead08d8bbdb3afd851877cb50507b77ae18a4d8

SHA256
fa7ad2f45128120bccc33f996f87a81faa2e9c1236666dd69b943a755f332eb1

SHA512
74e3ab12b2a2d5c45c5248dd2225bfbcf237a01ef94fdca3fe99cfde11bd7d0ccd25dd7f26bd283997d951f4df7e8f4b35f9475a32bdb854d6cc8867b2c45554

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-67340cf7-000c-41f1-b606-eddf6d824481\files\KeyScramblerLogon.exe

Filesize
500KB

MD5
c790ebfcb6a34953a371e32c9174fe46

SHA1
3ead08d8bbdb3afd851877cb50507b77ae18a4d8

SHA256
fa7ad2f45128120bccc33f996f87a81faa2e9c1236666dd69b943a755f332eb1

SHA512
74e3ab12b2a2d5c45c5248dd2225bfbcf237a01ef94fdca3fe99cfde11bd7d0ccd25dd7f26bd283997d951f4df7e8f4b35f9475a32bdb854d6cc8867b2c45554

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-67340cf7-000c-41f1-b606-eddf6d824481\files\Uninstall.exe

Filesize
88KB

MD5
6de8cb9727907a59bcaf9871cc493c70

SHA1
a0ea933423c48d36718dca842994b83e5ffc4756

SHA256
408c0fbf2992f89b058bdb228670ff27a68ef0a7a3b648a33ff86ecc39139a11

SHA512
a48d97a7862eeda211a59d1023071641c91c3065a347ad060c40f86532db36010f5c89b0f6ab427a783ccce45485e42cf6443a14c72faa118c9b0a4c34b5c21e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-67340cf7-000c-41f1-b606-eddf6d824481\files\ipefxaxq

Filesize
1.8MB

MD5
5ebab6046d7b361b12c30f8f56197abc

SHA1
95f6bd06c917732da2663d7bd9aeedbbe112b520

SHA256
25eb89da04c22d6833d7aaf9b12f47b262c5fba0e7b1e7a5702d5ec5df4c3027

SHA512
041a10136c64b143c5c81492cc62b79719bf22596276cdc052875b08e80c185cc929009e2485695ddd1c8eaa4d442ecfa6709c7ad697950827e43cade6fecb0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-67340cf7-000c-41f1-b606-eddf6d824481\files\jnulzbm

Filesize
8B

MD5
7a27eee407959b2458f661d9cf3e367f

SHA1
e4174c47f0560507edd7a8bfa6de873f1c8ef86a

SHA256
b6a3433951f93ce9688489eaffa1b72a75be24f518ec7ec9c2c18053d7c7be1e

SHA512
61b7edc9351641f26bbca4eeef63d1a9e142efda440cedaf73780f5ebe8297ae56d74802d265fbca3984d5ecb0d38e4a1002979e53679e5fa1804d1b5bab10a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-67340cf7-000c-41f1-b606-eddf6d824481\files\keyscrambler.ico

Filesize
39KB

MD5
fde5504bbf7620aca9f3850511c13a45

SHA1
484382ecc232cedc1651fba5f9311e9164f43369

SHA256
932409eb2abfc31f2dd218240de70a150359ea8ab09fcceb1f076b9a17c844b7

SHA512
6d67be9398fcc2b85fe4fd7357f37d6cfc1d3e548f713319080707c750b66d2b1e631c79a7e745c56b1a72be91735156e3989eff8d0b84c3442c0fa548c2a6b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-67340cf7-000c-41f1-b606-eddf6d824481\files\keyscrambler.sys

Filesize
225KB

MD5
9baf5236d65a36ed2c388cf04108ab9f

SHA1
f5e28edea04a00b5e8806130cd2736336c6e3792

SHA256
9e79960a40797c11a007d9c8e6a4bce721baf603f5d651f5485eb5481c717b12

SHA512
1fc899c37e628adbe05a53812e6106332de7dbef83ce72094dd228067eefa71d09abe55d250b35d93f7454b9596073de95af6700e543c17bb5d43e7de0fcac1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-67340cf7-000c-41f1-b606-eddf6d824481\files\script.au3

Filesize
921KB

MD5
d27371f6316a8761d6e1fe90613c3365

SHA1
aaa7052ce6872e777615b0a52f76e2c20f11136c

SHA256
4525d1bdc7a55bfcae1b691e2dc333bcb97c03fc47c37f31656b0d9dcbb681a7

SHA512
000cb911c697179c3030436ebbe92de3406c6b318bb8653b7d3111293bca5a8a710e0f411c3b963f12c87cea5d7f3fa1befac5e13a2e94a77253f44f3383c9ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-67340cf7-000c-41f1-b606-eddf6d824481\msiwrapper.ini

Filesize
1KB

MD5
1699f4f8fea936adb628230b283f74d9

SHA1
78e14fddfc7f8932bb97020ddc7e88f1db531eed

SHA256
b904dc3196729be3084bed072863125bdc31f5b9528bf9d3bc3970a74dd0b088

SHA512
af906dfb397d2134286dd5a47d8a3581e29a964297201f9ed825c32c7ca22b0de6937360223565a19ea7e06c756a5b17d7ba04ba2520a50bde118a18186d7594

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-67340cf7-000c-41f1-b606-eddf6d824481\msiwrapper.ini

Filesize
458B

MD5
6b076f05582a1600f04907297ead0eac

SHA1
9d1a5ca373a06b6535f692aab9ab0b1c3482fa40

SHA256
6a68c00ebcd6cbc5a9c378506a985a7e550916eb9db3ae767473e53e0c224b16

SHA512
9cd0f513137bf9f4a86b599750a5731d2705c6a56931029f80a86b104ff93eac20fb6e5d872b1ce576c24812f54deb348836445222a43a1ca4abf1f1561303dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-67340cf7-000c-41f1-b606-eddf6d824481\msiwrapper.ini

Filesize
726B

MD5
e8646da07aec6439e661e7e271bec859

SHA1
954dc9f7e5e312df1a628e6a562b8dbea8481246

SHA256
9ed1689abf51815211867b089a29e95341f8c6759c5b92e0fea452e84040698c

SHA512
a62209f268ab40958bff92af055576429d93f16771e696f26274b613b005d7eb2c2f8e67baf936c224c4a0008c875c96bdfd40c637dd150dffaf57a5b7ff792b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-67340cf7-000c-41f1-b606-eddf6d824481\msiwrapper.ini

Filesize
1KB

MD5
cf562e34f89c30aec8d328e910be221a

SHA1
c0fbcc83d47d118be1281c953636af5a418da4a3

SHA256
fe5dbe068da3f4d1949750ed4838f86c11decbbc007b668b95095e381fd8f963

SHA512
352c4e91a48479e3e322836a6b4b18bc49aaa7de115b52a6a6ea24c59d0dfec5e9a9ea839cd64ee41bb23b4dab32a00c9761c980538e0babe3e8d0710dcbba07

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-67340cf7-000c-41f1-b606-eddf6d824481\msiwrapper.ini

Filesize
1KB

MD5
cf562e34f89c30aec8d328e910be221a

SHA1
c0fbcc83d47d118be1281c953636af5a418da4a3

SHA256
fe5dbe068da3f4d1949750ed4838f86c11decbbc007b668b95095e381fd8f963

SHA512
352c4e91a48479e3e322836a6b4b18bc49aaa7de115b52a6a6ea24c59d0dfec5e9a9ea839cd64ee41bb23b4dab32a00c9761c980538e0babe3e8d0710dcbba07

Download Submit
C:\Windows\Installer\MSIDC2C.tmp

Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
C:\Windows\Installer\MSIF836.tmp

Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
\Users\Admin\AppData\Local\Temp\MW-67340cf7-000c-41f1-b606-eddf6d824481\files\Autoit3.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\Users\Admin\AppData\Local\Temp\MW-67340cf7-000c-41f1-b606-eddf6d824481\files\KeyScramblerIE.dll

Filesize
620KB

MD5
20f10fe9d17f9cf2d8e9772957b9ebe4

SHA1
dc8b8a023e31636719a7d88233aaf54cc80d2715

SHA256
2a637f0dc2136bd4241ec57bcf022e22e55eaf7f33be93495f1f1bea49d59988

SHA512
9b1306fa921167fdda1b0a6134c74ae676813c364e6e9de2c99dcefb6970a42339ecfe4f8e6140550a42067e8717900164ff046797c072971a8b51472c3f2269

Download Submit
\Users\Admin\AppData\Local\Temp\MW-67340cf7-000c-41f1-b606-eddf6d824481\files\KeyScramblerLogon.exe

Filesize
500KB

MD5
c790ebfcb6a34953a371e32c9174fe46

SHA1
3ead08d8bbdb3afd851877cb50507b77ae18a4d8

SHA256
fa7ad2f45128120bccc33f996f87a81faa2e9c1236666dd69b943a755f332eb1

SHA512
74e3ab12b2a2d5c45c5248dd2225bfbcf237a01ef94fdca3fe99cfde11bd7d0ccd25dd7f26bd283997d951f4df7e8f4b35f9475a32bdb854d6cc8867b2c45554

Download Submit
\Users\Admin\AppData\Local\Temp\MW-67340cf7-000c-41f1-b606-eddf6d824481\files\KeyScramblerLogon.exe

Filesize
500KB

MD5
c790ebfcb6a34953a371e32c9174fe46

SHA1
3ead08d8bbdb3afd851877cb50507b77ae18a4d8

SHA256
fa7ad2f45128120bccc33f996f87a81faa2e9c1236666dd69b943a755f332eb1

SHA512
74e3ab12b2a2d5c45c5248dd2225bfbcf237a01ef94fdca3fe99cfde11bd7d0ccd25dd7f26bd283997d951f4df7e8f4b35f9475a32bdb854d6cc8867b2c45554

Download Submit
\Users\Admin\AppData\Local\Temp\MW-67340cf7-000c-41f1-b606-eddf6d824481\files\KeyScramblerLogon.exe

Filesize
500KB

MD5
c790ebfcb6a34953a371e32c9174fe46

SHA1
3ead08d8bbdb3afd851877cb50507b77ae18a4d8

SHA256
fa7ad2f45128120bccc33f996f87a81faa2e9c1236666dd69b943a755f332eb1

SHA512
74e3ab12b2a2d5c45c5248dd2225bfbcf237a01ef94fdca3fe99cfde11bd7d0ccd25dd7f26bd283997d951f4df7e8f4b35f9475a32bdb854d6cc8867b2c45554

Download Submit
\Users\Admin\AppData\Local\Temp\MW-67340cf7-000c-41f1-b606-eddf6d824481\files\KeyScramblerLogon.exe

Filesize
500KB

MD5
c790ebfcb6a34953a371e32c9174fe46

SHA1
3ead08d8bbdb3afd851877cb50507b77ae18a4d8

SHA256
fa7ad2f45128120bccc33f996f87a81faa2e9c1236666dd69b943a755f332eb1

SHA512
74e3ab12b2a2d5c45c5248dd2225bfbcf237a01ef94fdca3fe99cfde11bd7d0ccd25dd7f26bd283997d951f4df7e8f4b35f9475a32bdb854d6cc8867b2c45554

Download Submit
\Windows\Installer\MSIDC2C.tmp

Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
\Windows\Installer\MSIF836.tmp

Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
memory/2228-108-0x0000000002CD0000-0x0000000002DC5000-memory.dmp

Filesize
980KB

Download
memory/2228-107-0x0000000000460000-0x0000000000502000-memory.dmp

Filesize
648KB

Download
memory/2228-102-0x0000000002CD0000-0x0000000002DC5000-memory.dmp

Filesize
980KB

Download
memory/2228-101-0x00000000023D0000-0x0000000002B00000-memory.dmp

Filesize
7.2MB

Download
memory/2228-94-0x0000000000460000-0x0000000000502000-memory.dmp

Filesize
648KB

Download
memory/2328-122-0x0000000002950000-0x0000000002A45000-memory.dmp

Filesize
980KB

Download
memory/2328-121-0x0000000000CC0000-0x00000000010C0000-memory.dmp

Filesize
4.0MB

Download
memory/2328-123-0x0000000003270000-0x0000000003633000-memory.dmp

Filesize
3.8MB

Download
memory/2328-124-0x0000000002950000-0x0000000002A45000-memory.dmp

Filesize
980KB

Download
memory/2328-125-0x0000000003270000-0x0000000003633000-memory.dmp

Filesize
3.8MB

Download