darkgate | 38a7eb1e2b014b45fcf1b00c8b476f9c8c0b927694998c0c6bcb760162eaab88

Analysis

max time kernel
151s
max time network
157s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
19-10-2023 06:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

abb556b6e45931b1e27b40f9f5f610dea7c4e59c13a4299899b022d9.msi
Size

1.1MB
MD5

85fd43751333aa5d3b831d3d2fafebb7
SHA1

fd6e3b35b1059108d92d34660b0c54205d39529b
SHA256

a69719f8d5dd3a3725521d32e16623be5f39aa5731a12061cb3e08793c2c66ba
SHA512

d2b4f62f6e3e9cc65b741f150970431ebbdbd282cd4646c1f415ac5f8d995c90d79fca73b75f67d844d85f864f753fcd278e776b1df741532728398236582e07
SSDEEP

24576:+tncpVGPS3Hj74zrIbOCFd7m1+DfxQSSTooZVwn3/V4XCAXBv:DpUPS3D8zEbOw7m18ZptMCK

Score

10^/10

darkgate civilian1337 discovery spyware stealer

Malware Config

Extracted

Family

darkgate

Botnet

civilian1337

http://185.130.227.202

Attributes

alternative_c2_port
8080
anti_analysis
false
anti_debug
false
anti_vm
false
c2_port
2351
check_disk
false
check_ram
false
check_xeon
false
crypter_au3
false
crypter_dll
false
crypter_rawstub
true
crypto_key
kYQpinTbGbozah
internal_mutex
txtMut
minimum_disk
100
minimum_ram
4096
ping_interval
4
rootkit
true
startup_persistence
true
username
civilian1337

Signatures

DarkGate
DarkGate is an infostealer written in C++.
stealer darkgate

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 3008 created 1104	3008	Autoit3.exe	18
PID 1592 created 1104	1592	cmd.exe	18

Blocklisted process makes network request 29 IoCs

flow	pid	Process
5	1592	cmd.exe
6	1592	cmd.exe
7	1592	cmd.exe
8	1592	cmd.exe
9	1592	cmd.exe
10	1592	cmd.exe
11	1592	cmd.exe
12	1592	cmd.exe
13	1592	cmd.exe
14	1592	cmd.exe
15	1592	cmd.exe
16	1592	cmd.exe
17	1592	cmd.exe
18	1592	cmd.exe
19	1592	cmd.exe
20	1592	cmd.exe
21	1592	cmd.exe
22	1592	cmd.exe
23	1592	cmd.exe
24	1592	cmd.exe
25	1592	cmd.exe
26	1592	cmd.exe
27	1592	cmd.exe
28	1592	cmd.exe
29	1592	cmd.exe
30	1592	cmd.exe
31	1592	cmd.exe
32	1592	cmd.exe
33	1592	cmd.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ffdfabe.lnk	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
1688	KeyScramblerLogon.exe
3008	Autoit3.exe

Loads dropped DLL 9 IoCs

pid	Process
2576	MsiExec.exe
2576	MsiExec.exe
2576	MsiExec.exe
2576	MsiExec.exe
2576	MsiExec.exe
1688	KeyScramblerLogon.exe
1688	KeyScramblerLogon.exe
2576	MsiExec.exe
1592	cmd.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2008	ICACLS.EXE
2900	ICACLS.EXE

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3008 set thread context of 1592	3008	Autoit3.exe	47
PID 1592 set thread context of 1644	1592	cmd.exe	50

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\Installer\f770e34.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f770e34.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1084.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1E6A.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\Logs\DPX\setupact.log	EXPAND.EXE
File opened for modification	C:\Windows\Logs\DPX\setuperr.log	EXPAND.EXE
File opened for modification	C:\Windows\Installer\f770e35.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f770e35.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1F36.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	cmd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	cmd.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	cmd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	cmd.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Autoit3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Autoit3.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1860	PING.EXE

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2340	msiexec.exe
2340	msiexec.exe
3008	Autoit3.exe
3008	Autoit3.exe
1592	cmd.exe
1592	cmd.exe
1644	cmd.exe

Suspicious use of AdjustPrivilegeToken 57 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2972	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2972	msiexec.exe
Token: SeRestorePrivilege	2340	msiexec.exe
Token: SeTakeOwnershipPrivilege	2340	msiexec.exe
Token: SeSecurityPrivilege	2340	msiexec.exe
Token: SeCreateTokenPrivilege	2972	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2972	msiexec.exe
Token: SeLockMemoryPrivilege	2972	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2972	msiexec.exe
Token: SeMachineAccountPrivilege	2972	msiexec.exe
Token: SeTcbPrivilege	2972	msiexec.exe
Token: SeSecurityPrivilege	2972	msiexec.exe
Token: SeTakeOwnershipPrivilege	2972	msiexec.exe
Token: SeLoadDriverPrivilege	2972	msiexec.exe
Token: SeSystemProfilePrivilege	2972	msiexec.exe
Token: SeSystemtimePrivilege	2972	msiexec.exe
Token: SeProfSingleProcessPrivilege	2972	msiexec.exe
Token: SeIncBasePriorityPrivilege	2972	msiexec.exe
Token: SeCreatePagefilePrivilege	2972	msiexec.exe
Token: SeCreatePermanentPrivilege	2972	msiexec.exe
Token: SeBackupPrivilege	2972	msiexec.exe
Token: SeRestorePrivilege	2972	msiexec.exe
Token: SeShutdownPrivilege	2972	msiexec.exe
Token: SeDebugPrivilege	2972	msiexec.exe
Token: SeAuditPrivilege	2972	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2972	msiexec.exe
Token: SeChangeNotifyPrivilege	2972	msiexec.exe
Token: SeRemoteShutdownPrivilege	2972	msiexec.exe
Token: SeUndockPrivilege	2972	msiexec.exe
Token: SeSyncAgentPrivilege	2972	msiexec.exe
Token: SeEnableDelegationPrivilege	2972	msiexec.exe
Token: SeManageVolumePrivilege	2972	msiexec.exe
Token: SeImpersonatePrivilege	2972	msiexec.exe
Token: SeCreateGlobalPrivilege	2972	msiexec.exe
Token: SeBackupPrivilege	2760	vssvc.exe
Token: SeRestorePrivilege	2760	vssvc.exe
Token: SeAuditPrivilege	2760	vssvc.exe
Token: SeBackupPrivilege	2340	msiexec.exe
Token: SeRestorePrivilege	2340	msiexec.exe
Token: SeRestorePrivilege	268	DrvInst.exe
Token: SeRestorePrivilege	268	DrvInst.exe
Token: SeRestorePrivilege	268	DrvInst.exe
Token: SeRestorePrivilege	268	DrvInst.exe
Token: SeRestorePrivilege	268	DrvInst.exe
Token: SeRestorePrivilege	268	DrvInst.exe
Token: SeRestorePrivilege	268	DrvInst.exe
Token: SeLoadDriverPrivilege	268	DrvInst.exe
Token: SeLoadDriverPrivilege	268	DrvInst.exe
Token: SeLoadDriverPrivilege	268	DrvInst.exe
Token: SeRestorePrivilege	2340	msiexec.exe
Token: SeTakeOwnershipPrivilege	2340	msiexec.exe
Token: SeRestorePrivilege	2340	msiexec.exe
Token: SeTakeOwnershipPrivilege	2340	msiexec.exe
Token: SeRestorePrivilege	2340	msiexec.exe
Token: SeTakeOwnershipPrivilege	2340	msiexec.exe
Token: SeRestorePrivilege	2340	msiexec.exe
Token: SeTakeOwnershipPrivilege	2340	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2972	msiexec.exe
2972	msiexec.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2576	2340	msiexec.exe	34
PID 2340 wrote to memory of 2576	2340	msiexec.exe	34
PID 2340 wrote to memory of 2576	2340	msiexec.exe	34
PID 2340 wrote to memory of 2576	2340	msiexec.exe	34
PID 2340 wrote to memory of 2576	2340	msiexec.exe	34
PID 2340 wrote to memory of 2576	2340	msiexec.exe	34
PID 2340 wrote to memory of 2576	2340	msiexec.exe	34
PID 2576 wrote to memory of 2008	2576	MsiExec.exe	35
PID 2576 wrote to memory of 2008	2576	MsiExec.exe	35
PID 2576 wrote to memory of 2008	2576	MsiExec.exe	35
PID 2576 wrote to memory of 2008	2576	MsiExec.exe	35
PID 2576 wrote to memory of 1328	2576	MsiExec.exe	37
PID 2576 wrote to memory of 1328	2576	MsiExec.exe	37
PID 2576 wrote to memory of 1328	2576	MsiExec.exe	37
PID 2576 wrote to memory of 1328	2576	MsiExec.exe	37
PID 2576 wrote to memory of 1688	2576	MsiExec.exe	39
PID 2576 wrote to memory of 1688	2576	MsiExec.exe	39
PID 2576 wrote to memory of 1688	2576	MsiExec.exe	39
PID 2576 wrote to memory of 1688	2576	MsiExec.exe	39
PID 1688 wrote to memory of 3008	1688	KeyScramblerLogon.exe	40
PID 1688 wrote to memory of 3008	1688	KeyScramblerLogon.exe	40
PID 1688 wrote to memory of 3008	1688	KeyScramblerLogon.exe	40
PID 1688 wrote to memory of 3008	1688	KeyScramblerLogon.exe	40
PID 2576 wrote to memory of 2900	2576	MsiExec.exe	41
PID 2576 wrote to memory of 2900	2576	MsiExec.exe	41
PID 2576 wrote to memory of 2900	2576	MsiExec.exe	41
PID 2576 wrote to memory of 2900	2576	MsiExec.exe	41
PID 3008 wrote to memory of 1676	3008	Autoit3.exe	44
PID 3008 wrote to memory of 1676	3008	Autoit3.exe	44
PID 3008 wrote to memory of 1676	3008	Autoit3.exe	44
PID 3008 wrote to memory of 1676	3008	Autoit3.exe	44
PID 3008 wrote to memory of 968	3008	Autoit3.exe	46
PID 3008 wrote to memory of 968	3008	Autoit3.exe	46
PID 3008 wrote to memory of 968	3008	Autoit3.exe	46
PID 3008 wrote to memory of 968	3008	Autoit3.exe	46
PID 3008 wrote to memory of 1592	3008	Autoit3.exe	47
PID 3008 wrote to memory of 1592	3008	Autoit3.exe	47
PID 3008 wrote to memory of 1592	3008	Autoit3.exe	47
PID 3008 wrote to memory of 1592	3008	Autoit3.exe	47
PID 3008 wrote to memory of 1592	3008	Autoit3.exe	47
PID 3008 wrote to memory of 1592	3008	Autoit3.exe	47
PID 1676 wrote to memory of 1860	1676	cmd.exe	48
PID 1676 wrote to memory of 1860	1676	cmd.exe	48
PID 1676 wrote to memory of 1860	1676	cmd.exe	48
PID 1676 wrote to memory of 1860	1676	cmd.exe	48
PID 1592 wrote to memory of 1644	1592	cmd.exe	50
PID 1592 wrote to memory of 1644	1592	cmd.exe	50
PID 1592 wrote to memory of 1644	1592	cmd.exe	50
PID 1592 wrote to memory of 1644	1592	cmd.exe	50
PID 1592 wrote to memory of 1644	1592	cmd.exe	50
PID 1592 wrote to memory of 1644	1592	cmd.exe	50

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1104
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:968
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:1644

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\abb556b6e45931b1e27b40f9f5f610dea7c4e59c13a4299899b022d9.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2972

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2EC776B2DB331B24F1292475F499C9C0
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-56bfc680-f2d3-4b54-af24-1fb58f2d73de\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    PID:2008
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    PID:1328
- - C:\Users\Admin\AppData\Local\Temp\MW-56bfc680-f2d3-4b54-af24-1fb58f2d73de\files\KeyScramblerLogon.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-56bfc680-f2d3-4b54-af24-1fb58f2d73de\files\KeyScramblerLogon.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1688
  - - \??\c:\tmpp\Autoit3.exe
      c:\tmpp\Autoit3.exe c:\tmpp\script.au3
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3008
    - - \??\c:\windows\SysWOW64\cmd.exe
        
        "c:\windows\system32\cmd.exe" /c ping 127.0.0.1 & del /q /f c:\tmpp\* & rmdir /s /q c:\tmpp\ exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1676
      - \??\c:\windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        Runs ping.exe
        
        PID:1860
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Blocklisted process makes network request
        Drops startup file
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1592
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-56bfc680-f2d3-4b54-af24-1fb58f2d73de\." /SETINTEGRITYLEVEL (CI)(OI)LOW
    3⤵
    - Modifies file permissions
    PID:2900

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2760

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000002B8" "0000000000000594"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\kdahgbb\AutoIt3.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\ProgramData\kdahgbb\Autoit3.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\ProgramData\kdahgbb\bbheedc.au3

Filesize
12KB

MD5
76108f2aa9f06808a670d55f37147a2b

SHA1
ba7dd8d15b5a6e824678d7c49103069024e6ed45

SHA256
ad03d872649da555bd6bb6cb020ae9ea37a05c4c75f2a9eb4ad7e484a563e44a

SHA512
9292ef97f57a2361f75792c88f069b779e45b32982423de821df2889444ca8f651247b811fcdde704c1eaf507ffde1981afc09a296c8f8b7c0a6265be5dc4804

Download Submit
C:\ProgramData\kdahgbb\haghfhe\ddkecfa

Filesize
171B

MD5
b00fe54eb8ffaf79c0914ed9ac34db3f

SHA1
6e9d64928a9ffe164516cfe9ea288bd29933ca9b

SHA256
c6924806906caabf5153eade0e7749f3f67b205f54e3803728572cc1932498da

SHA512
8279ff1fd528ab0610630c06698b1c694337b5d435b67267ce41cb037f160cbffa61f70024faaf660ecae05aac45a567f0df14f4663c8b7730f6216a18ecde11

Download Submit
C:\ProgramData\kdahgbb\haghfhe\ddkecfa

Filesize
171B

MD5
b00fe54eb8ffaf79c0914ed9ac34db3f

SHA1
6e9d64928a9ffe164516cfe9ea288bd29933ca9b

SHA256
c6924806906caabf5153eade0e7749f3f67b205f54e3803728572cc1932498da

SHA512
8279ff1fd528ab0610630c06698b1c694337b5d435b67267ce41cb037f160cbffa61f70024faaf660ecae05aac45a567f0df14f4663c8b7730f6216a18ecde11

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-56bfc680-f2d3-4b54-af24-1fb58f2d73de\files.cab

Filesize
888KB

MD5
34413865c1a86d7d1edde84cf4f973f7

SHA1
d80b6d0dbdcfede9b117dc3fa8ea0dfc78a7d17a

SHA256
43502b012ccddd0aa791c3b15678314419b24b537779d662e433c8d63ee6e2e1

SHA512
84c95a20f22fdae2b261f23562f4bfe528d0e16480c9a632df53dbec83185a16fe7a3695ff9c98dec91cd4cd1085f58f43879cb6bf2d9f78328f15da59620b17

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-56bfc680-f2d3-4b54-af24-1fb58f2d73de\files\KeyScramblerIE.DLL

Filesize
355KB

MD5
7ee9f12ced52edd26d0d9852ab2082f2

SHA1
ecd188b96d55564842b46263efd61bfffd68c02b

SHA256
640a3b86b4327d77a4e27a36769cd6973400d30b582696f8edc7fcdb2ab46570

SHA512
3dae262f3198abab11e75e13438902d10d7791a9e7b278af84dc2c0b450e563480eaea2d3fda6e359f807c85b7607e957d1af4262542985a75f3d29a0a1734dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-56bfc680-f2d3-4b54-af24-1fb58f2d73de\files\KeyScramblerLogon.exe

Filesize
500KB

MD5
c790ebfcb6a34953a371e32c9174fe46

SHA1
3ead08d8bbdb3afd851877cb50507b77ae18a4d8

SHA256
fa7ad2f45128120bccc33f996f87a81faa2e9c1236666dd69b943a755f332eb1

SHA512
74e3ab12b2a2d5c45c5248dd2225bfbcf237a01ef94fdca3fe99cfde11bd7d0ccd25dd7f26bd283997d951f4df7e8f4b35f9475a32bdb854d6cc8867b2c45554

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-56bfc680-f2d3-4b54-af24-1fb58f2d73de\files\KeyScramblerLogon.exe

Filesize
500KB

MD5
c790ebfcb6a34953a371e32c9174fe46

SHA1
3ead08d8bbdb3afd851877cb50507b77ae18a4d8

SHA256
fa7ad2f45128120bccc33f996f87a81faa2e9c1236666dd69b943a755f332eb1

SHA512
74e3ab12b2a2d5c45c5248dd2225bfbcf237a01ef94fdca3fe99cfde11bd7d0ccd25dd7f26bd283997d951f4df7e8f4b35f9475a32bdb854d6cc8867b2c45554

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-56bfc680-f2d3-4b54-af24-1fb58f2d73de\files\sqlite3.dll

Filesize
884KB

MD5
bc73f7da4fb84539de7cead0a1025080

SHA1
1b2b24cf9f4f94d6ded5e4a0cbae2a98a35ae066

SHA256
3879dd8ea315895e504619dbda780c843dfdda2abf46f243268fd4ce8bb95d46

SHA512
87f52792fd1333c96b8f4d766a145981701a680d92a7609c3f22f365e9e48d9d3100cce392fa9dd4e4800ebbb8a7a613dc2a355635527dc7067217c51323d424

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-56bfc680-f2d3-4b54-af24-1fb58f2d73de\msiwrapper.ini

Filesize
1KB

MD5
6ca349fc78c0bf6ecd3b08b85ae12dd0

SHA1
9a143c6286a6f18ff78d5e18887aa6d386176d8a

SHA256
cf490d2f911ffe1b213879ff251b76f88e55a34c74ae398ad73b049d40be8981

SHA512
c7e2c8a7e19b81f36b890e6cc13a06289a6b6f8315ac40b6df533caad537752be0f3439060d87082d7536886d7127c7bea91848fd7d09f62de6e98cb2e99c417

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-56bfc680-f2d3-4b54-af24-1fb58f2d73de\msiwrapper.ini

Filesize
1KB

MD5
6ca349fc78c0bf6ecd3b08b85ae12dd0

SHA1
9a143c6286a6f18ff78d5e18887aa6d386176d8a

SHA256
cf490d2f911ffe1b213879ff251b76f88e55a34c74ae398ad73b049d40be8981

SHA512
c7e2c8a7e19b81f36b890e6cc13a06289a6b6f8315ac40b6df533caad537752be0f3439060d87082d7536886d7127c7bea91848fd7d09f62de6e98cb2e99c417

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-56bfc680-f2d3-4b54-af24-1fb58f2d73de\msiwrapper.ini

Filesize
1KB

MD5
597a9fb58fbbd72884ba7d067830c5da

SHA1
7c898440da3ff8febe815be7d6aeebe8c2bad56b

SHA256
99eeb4efd9a4707bf51f94540ac511a709054d7d3ab6f038f11a2974a6952ee9

SHA512
bd68f518f3bad502d31a10ade6e59ff256c96f05eb0fe8fb6fcb1c9f63797ed578962cbf9828554bdcc413a1f044ea97cf2388f4b4ed23a74ff8dd13a1bd2d1c

Download Submit
C:\Windows\Installer\MSI1084.tmp

Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
C:\Windows\Installer\MSI1F36.tmp

Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
C:\temp\AutoIt3.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\temp\dkcdhcc

Filesize
4B

MD5
c0237bc6f1967bf51f7a8892229e2fb5

SHA1
2128e8c626bc05e5e0a52ac6d9819632d9343d09

SHA256
ad4dd84c5ece2cde80b6b16781e370509211317498a703b7be38d8c0e3225fa3

SHA512
275544a21489753a86c901f8a7119770278ab69a3c5eed1f73e1f413a7934ecc48a2e2dc12c106f82ee52562a12bcbe68a6dd177388f5c26ad50c1e107b18075

Download Submit
C:\temp\ozffuu

Filesize
387KB

MD5
87cd6e254eaec733c85caf55354840e1

SHA1
2902f6d4aa74ce6387da210bad23e41ba3374200

SHA256
39232087108623d600c7304065dac7a36ab6f65925db060dbae0d15970364cb1

SHA512
0f3d65c6d5988c248c9422f0ad65ab5336b2d9b5deb1084281b3234bc7843c4d1e4464231589298e0751eba5c9119a1d98128cd77a8c3cc9b86b8fa9a5ad5325

Download Submit
C:\tmpp\Autoit3.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\??\c:\temp\a

Filesize
387KB

MD5
87cd6e254eaec733c85caf55354840e1

SHA1
2902f6d4aa74ce6387da210bad23e41ba3374200

SHA256
39232087108623d600c7304065dac7a36ab6f65925db060dbae0d15970364cb1

SHA512
0f3d65c6d5988c248c9422f0ad65ab5336b2d9b5deb1084281b3234bc7843c4d1e4464231589298e0751eba5c9119a1d98128cd77a8c3cc9b86b8fa9a5ad5325

Download Submit
\??\c:\temp\a

Filesize
387KB

MD5
87cd6e254eaec733c85caf55354840e1

SHA1
2902f6d4aa74ce6387da210bad23e41ba3374200

SHA256
39232087108623d600c7304065dac7a36ab6f65925db060dbae0d15970364cb1

SHA512
0f3d65c6d5988c248c9422f0ad65ab5336b2d9b5deb1084281b3234bc7843c4d1e4464231589298e0751eba5c9119a1d98128cd77a8c3cc9b86b8fa9a5ad5325

Download Submit
\??\c:\temp\bbheedc.au3

Filesize
12KB

MD5
76108f2aa9f06808a670d55f37147a2b

SHA1
ba7dd8d15b5a6e824678d7c49103069024e6ed45

SHA256
ad03d872649da555bd6bb6cb020ae9ea37a05c4c75f2a9eb4ad7e484a563e44a

SHA512
9292ef97f57a2361f75792c88f069b779e45b32982423de821df2889444ca8f651247b811fcdde704c1eaf507ffde1981afc09a296c8f8b7c0a6265be5dc4804

Download Submit
\??\c:\temp\ozffuu

Filesize
387KB

MD5
87cd6e254eaec733c85caf55354840e1

SHA1
2902f6d4aa74ce6387da210bad23e41ba3374200

SHA256
39232087108623d600c7304065dac7a36ab6f65925db060dbae0d15970364cb1

SHA512
0f3d65c6d5988c248c9422f0ad65ab5336b2d9b5deb1084281b3234bc7843c4d1e4464231589298e0751eba5c9119a1d98128cd77a8c3cc9b86b8fa9a5ad5325

Download Submit
\??\c:\tmpp\Autoit3.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\??\c:\tmpp\script.au3

Filesize
12KB

MD5
76108f2aa9f06808a670d55f37147a2b

SHA1
ba7dd8d15b5a6e824678d7c49103069024e6ed45

SHA256
ad03d872649da555bd6bb6cb020ae9ea37a05c4c75f2a9eb4ad7e484a563e44a

SHA512
9292ef97f57a2361f75792c88f069b779e45b32982423de821df2889444ca8f651247b811fcdde704c1eaf507ffde1981afc09a296c8f8b7c0a6265be5dc4804

Download Submit
\ProgramData\kdahgbb\Autoit3.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\Users\Admin\AppData\Local\Temp\MW-56bfc680-f2d3-4b54-af24-1fb58f2d73de\files\KeyScramblerIE.dll

Filesize
355KB

MD5
7ee9f12ced52edd26d0d9852ab2082f2

SHA1
ecd188b96d55564842b46263efd61bfffd68c02b

SHA256
640a3b86b4327d77a4e27a36769cd6973400d30b582696f8edc7fcdb2ab46570

SHA512
3dae262f3198abab11e75e13438902d10d7791a9e7b278af84dc2c0b450e563480eaea2d3fda6e359f807c85b7607e957d1af4262542985a75f3d29a0a1734dc

Download Submit
\Users\Admin\AppData\Local\Temp\MW-56bfc680-f2d3-4b54-af24-1fb58f2d73de\files\KeyScramblerLogon.exe

Filesize
500KB

MD5
c790ebfcb6a34953a371e32c9174fe46

SHA1
3ead08d8bbdb3afd851877cb50507b77ae18a4d8

SHA256
fa7ad2f45128120bccc33f996f87a81faa2e9c1236666dd69b943a755f332eb1

SHA512
74e3ab12b2a2d5c45c5248dd2225bfbcf237a01ef94fdca3fe99cfde11bd7d0ccd25dd7f26bd283997d951f4df7e8f4b35f9475a32bdb854d6cc8867b2c45554

Download Submit
\Users\Admin\AppData\Local\Temp\MW-56bfc680-f2d3-4b54-af24-1fb58f2d73de\files\KeyScramblerLogon.exe

Filesize
500KB

MD5
c790ebfcb6a34953a371e32c9174fe46

SHA1
3ead08d8bbdb3afd851877cb50507b77ae18a4d8

SHA256
fa7ad2f45128120bccc33f996f87a81faa2e9c1236666dd69b943a755f332eb1

SHA512
74e3ab12b2a2d5c45c5248dd2225bfbcf237a01ef94fdca3fe99cfde11bd7d0ccd25dd7f26bd283997d951f4df7e8f4b35f9475a32bdb854d6cc8867b2c45554

Download Submit
\Users\Admin\AppData\Local\Temp\MW-56bfc680-f2d3-4b54-af24-1fb58f2d73de\files\KeyScramblerLogon.exe

Filesize
500KB

MD5
c790ebfcb6a34953a371e32c9174fe46

SHA1
3ead08d8bbdb3afd851877cb50507b77ae18a4d8

SHA256
fa7ad2f45128120bccc33f996f87a81faa2e9c1236666dd69b943a755f332eb1

SHA512
74e3ab12b2a2d5c45c5248dd2225bfbcf237a01ef94fdca3fe99cfde11bd7d0ccd25dd7f26bd283997d951f4df7e8f4b35f9475a32bdb854d6cc8867b2c45554

Download Submit
\Users\Admin\AppData\Local\Temp\MW-56bfc680-f2d3-4b54-af24-1fb58f2d73de\files\KeyScramblerLogon.exe

Filesize
500KB

MD5
c790ebfcb6a34953a371e32c9174fe46

SHA1
3ead08d8bbdb3afd851877cb50507b77ae18a4d8

SHA256
fa7ad2f45128120bccc33f996f87a81faa2e9c1236666dd69b943a755f332eb1

SHA512
74e3ab12b2a2d5c45c5248dd2225bfbcf237a01ef94fdca3fe99cfde11bd7d0ccd25dd7f26bd283997d951f4df7e8f4b35f9475a32bdb854d6cc8867b2c45554

Download Submit
\Windows\Installer\MSI1084.tmp

Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
\Windows\Installer\MSI1F36.tmp

Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
\tmpp\Autoit3.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
memory/1592-117-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1592-140-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1592-120-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1592-129-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1592-154-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1592-118-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1592-137-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1592-138-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1592-139-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1592-128-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1592-141-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1592-116-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1644-145-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1644-142-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1644-155-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1688-88-0x0000000000460000-0x00000000004BE000-memory.dmp

Filesize
376KB

Download
memory/1688-80-0x0000000000460000-0x00000000004BE000-memory.dmp

Filesize
376KB

Download
memory/3008-107-0x0000000005C30000-0x0000000005E19000-memory.dmp

Filesize
1.9MB

Download
memory/3008-91-0x00000000006B0000-0x0000000000AB0000-memory.dmp

Filesize
4.0MB

Download
memory/3008-131-0x0000000005C30000-0x0000000005E19000-memory.dmp

Filesize
1.9MB

Download