darkgate | de3f49e68c45db2f31d1cc1d10ff09f8cfce302b92a1f5361c8f34c3d78544e5

Analysis

max time kernel
127s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
23/10/2023, 19:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de3f49e68c45db2f31d1cc1d10ff09f8cfce302b92a1f5361c8f34c3d78544e5.msi
Size

9.1MB
MD5

8ef6bc142843232614b092fac948562d
SHA1

0e532489d6c1f1abc59941e9cb41cb38dcf8ac6e
SHA256

de3f49e68c45db2f31d1cc1d10ff09f8cfce302b92a1f5361c8f34c3d78544e5
SHA512

47d0874993410954abd0957c06bdd8d9534218d766032fac6f35b9b2614615d46ae263a7eea5e3979ce57ee5790b78f39cb1278e44db19446ca1e62c29dfcb3a
SSDEEP

196608:5hbWzPMCeNrs0rczeuNr/QnMOsaB9QVuHSzdUupBqbHSDjs6cvUOzZx:PbWzPM5HCZNrgMVw6wyZUupkjSPcvXx

Score

10^/10

darkgate user_871236672 discovery stealer

Malware Config

Extracted

Family

darkgate

Botnet

user_871236672

http://voodmastrelinux.com

Attributes

alternative_c2_port
8080
anti_analysis
true
anti_debug
true
anti_vm
true
c2_port
2351
check_disk
true
check_ram
true
check_xeon
true
crypter_au3
false
crypter_dll
false
crypter_rawstub
true
crypto_key
vBojMjKiOxwdob
internal_mutex
txtMut
minimum_disk
35
minimum_ram
6000
ping_interval
4
rootkit
true
startup_persistence
true
username
user_871236672

Signatures

DarkGate
DarkGate is an infostealer written in C++.
stealer darkgate

Executes dropped EXE 2 IoCs

pid	Process
3640	windbg.exe
4976	Autoit3.exe

Loads dropped DLL 4 IoCs

pid	Process
4588	MsiExec.exe
3640	windbg.exe
3640	windbg.exe
4588	MsiExec.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4904	ICACLS.EXE
316	ICACLS.EXE

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e58396a.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{7DB89A0F-B539-404F-810B-918664499299}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3B3F.tmp	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	EXPAND.EXE
File opened for modification	C:\Windows\Installer\MSI4A74.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e58396a.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	EXPAND.EXE
File opened for modification	C:\Windows\Installer\MSI4A73.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000000299f28d78dcfadf0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800000299f28d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809000299f28d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d0299f28d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000299f28d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Autoit3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Autoit3.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings	Autoit3.exe
Key created	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5016	msiexec.exe
5016	msiexec.exe

Suspicious use of AdjustPrivilegeToken 53 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1228	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1228	msiexec.exe
Token: SeSecurityPrivilege	5016	msiexec.exe
Token: SeCreateTokenPrivilege	1228	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1228	msiexec.exe
Token: SeLockMemoryPrivilege	1228	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1228	msiexec.exe
Token: SeMachineAccountPrivilege	1228	msiexec.exe
Token: SeTcbPrivilege	1228	msiexec.exe
Token: SeSecurityPrivilege	1228	msiexec.exe
Token: SeTakeOwnershipPrivilege	1228	msiexec.exe
Token: SeLoadDriverPrivilege	1228	msiexec.exe
Token: SeSystemProfilePrivilege	1228	msiexec.exe
Token: SeSystemtimePrivilege	1228	msiexec.exe
Token: SeProfSingleProcessPrivilege	1228	msiexec.exe
Token: SeIncBasePriorityPrivilege	1228	msiexec.exe
Token: SeCreatePagefilePrivilege	1228	msiexec.exe
Token: SeCreatePermanentPrivilege	1228	msiexec.exe
Token: SeBackupPrivilege	1228	msiexec.exe
Token: SeRestorePrivilege	1228	msiexec.exe
Token: SeShutdownPrivilege	1228	msiexec.exe
Token: SeDebugPrivilege	1228	msiexec.exe
Token: SeAuditPrivilege	1228	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1228	msiexec.exe
Token: SeChangeNotifyPrivilege	1228	msiexec.exe
Token: SeRemoteShutdownPrivilege	1228	msiexec.exe
Token: SeUndockPrivilege	1228	msiexec.exe
Token: SeSyncAgentPrivilege	1228	msiexec.exe
Token: SeEnableDelegationPrivilege	1228	msiexec.exe
Token: SeManageVolumePrivilege	1228	msiexec.exe
Token: SeImpersonatePrivilege	1228	msiexec.exe
Token: SeCreateGlobalPrivilege	1228	msiexec.exe
Token: SeBackupPrivilege	988	vssvc.exe
Token: SeRestorePrivilege	988	vssvc.exe
Token: SeAuditPrivilege	988	vssvc.exe
Token: SeBackupPrivilege	5016	msiexec.exe
Token: SeRestorePrivilege	5016	msiexec.exe
Token: SeRestorePrivilege	5016	msiexec.exe
Token: SeTakeOwnershipPrivilege	5016	msiexec.exe
Token: SeRestorePrivilege	5016	msiexec.exe
Token: SeTakeOwnershipPrivilege	5016	msiexec.exe
Token: SeRestorePrivilege	5016	msiexec.exe
Token: SeTakeOwnershipPrivilege	5016	msiexec.exe
Token: SeRestorePrivilege	5016	msiexec.exe
Token: SeTakeOwnershipPrivilege	5016	msiexec.exe
Token: SeBackupPrivilege	1944	srtasks.exe
Token: SeRestorePrivilege	1944	srtasks.exe
Token: SeSecurityPrivilege	1944	srtasks.exe
Token: SeTakeOwnershipPrivilege	1944	srtasks.exe
Token: SeBackupPrivilege	1944	srtasks.exe
Token: SeRestorePrivilege	1944	srtasks.exe
Token: SeSecurityPrivilege	1944	srtasks.exe
Token: SeTakeOwnershipPrivilege	1944	srtasks.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1228	msiexec.exe
1228	msiexec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
904	OpenWith.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 1944	5016	msiexec.exe	96
PID 5016 wrote to memory of 1944	5016	msiexec.exe	96
PID 5016 wrote to memory of 4588	5016	msiexec.exe	100
PID 5016 wrote to memory of 4588	5016	msiexec.exe	100
PID 5016 wrote to memory of 4588	5016	msiexec.exe	100
PID 4588 wrote to memory of 4904	4588	MsiExec.exe	102
PID 4588 wrote to memory of 4904	4588	MsiExec.exe	102
PID 4588 wrote to memory of 4904	4588	MsiExec.exe	102
PID 4588 wrote to memory of 3828	4588	MsiExec.exe	104
PID 4588 wrote to memory of 3828	4588	MsiExec.exe	104
PID 4588 wrote to memory of 3828	4588	MsiExec.exe	104
PID 4588 wrote to memory of 3640	4588	MsiExec.exe	106
PID 4588 wrote to memory of 3640	4588	MsiExec.exe	106
PID 4588 wrote to memory of 3640	4588	MsiExec.exe	106
PID 3640 wrote to memory of 4976	3640	windbg.exe	107
PID 3640 wrote to memory of 4976	3640	windbg.exe	107
PID 3640 wrote to memory of 4976	3640	windbg.exe	107
PID 4588 wrote to memory of 316	4588	MsiExec.exe	108
PID 4588 wrote to memory of 316	4588	MsiExec.exe	108
PID 4588 wrote to memory of 316	4588	MsiExec.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\de3f49e68c45db2f31d1cc1d10ff09f8cfce302b92a1f5361c8f34c3d78544e5.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1228

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1944
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 17CF0112859CC2E0C0A3595A141EE301
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-ac77923b-353b-4983-a2fa-8deeabab6cf2\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    PID:4904
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    PID:3828
- - C:\Users\Admin\AppData\Local\Temp\MW-ac77923b-353b-4983-a2fa-8deeabab6cf2\files\windbg.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-ac77923b-353b-4983-a2fa-8deeabab6cf2\files\windbg.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3640
  - - \??\c:\tmpa\Autoit3.exe
      c:\tmpa\Autoit3.exe c:\tmpa\script.au3
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      Modifies registry class
      PID:4976
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-ac77923b-353b-4983-a2fa-8deeabab6cf2\." /SETINTEGRITYLEVEL (CI)(OI)LOW
    3⤵
    - Modifies file permissions
    PID:316

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:988

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MW-ac77923b-353b-4983-a2fa-8deeabab6cf2\files.cab

Filesize
8.8MB

MD5
a169cebb4009ecfb62bb8a1faf09182f

SHA1
fbee30fd43763c42f5ae3705d394758d39149941

SHA256
00427e8ec42a57a864d0414aa2481a53b0a20b8e9fb736dd938cd945392f2f02

SHA512
73951e7a2f4f72ce77aff8f9d06b22afe41b9725787c7d19babdbb93b9f4520709f0574467b5f6c910024a7af87d1705cf1c8df6bcd081a0d2f6e59a4b3024a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-ac77923b-353b-4983-a2fa-8deeabab6cf2\files\00001-337121377.png

Filesize
1.1MB

MD5
fd49f38e666f94abdbd9cc0bb842c29b

SHA1
36a00401a015d0719787d5a65c86784760ee93ff

SHA256
1f5620bf07b2c25dd18fea78288c48fb2f7b5f0a5cfc1ee6c8d8dbf6029c442f

SHA512
2fc40f776e84574f915e418c4b946097234faceb9902239015d2b80e683fe61d623035644055dddb6f7b92160b3c8663795f8a27bf16c5b137c7053cc9f4f612

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-ac77923b-353b-4983-a2fa-8deeabab6cf2\files\00002-337121378.png

Filesize
1.0MB

MD5
f68d2ca13e1268dd79e95591b976ec45

SHA1
588454301e3c25065349740573282145aa0a5c7b

SHA256
af008f94fe42c29b1c7da7abe02e5edaaf9b89b1c8383e646ccfc8e0e7a66460

SHA512
a34b648c8453df91b88d7143237e5decf84a979bfe19a98ae5cff2d37081683236502ad2f62b585409cefae98da89e92acfc8665af40d3f7c9ece4c90e32ebae

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-ac77923b-353b-4983-a2fa-8deeabab6cf2\files\00003-337121379.png

Filesize
1.1MB

MD5
7dbe5e4b98d7601585cfb9697f265e0f

SHA1
da8477a2494b1436664c535d7c854bf778942a76

SHA256
c3c4c040c61bbf8432d4450e34b7101110de26e5e4671736d64535b06189a288

SHA512
38e8d0e103096fee998aae33179ad15eee50acc57236bb75bf115f99bd7fa1e1d5fe386ab9a3adcced910f5114c36459c06b55b2218e8020832066eea3755d9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-ac77923b-353b-4983-a2fa-8deeabab6cf2\files\00004-337121380.png

Filesize
1.0MB

MD5
85da5b7fd4b6983fffe78853c5276c03

SHA1
49a68d92beabfdfce7b2939f35a7b3e4bdc2bc96

SHA256
ff2a43f449bf81510c74eee9cd867bef4226c9c909b698e636ca8c56135d57ba

SHA512
c1d19bde8f9d434e29322edb8ac8892a475385bf97b5afd2f655175f1da6ce3ebc9df196585f3ea6a2a1755a1ec0fba2b60f203408ceebbea7801f4d1ab92f5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-ac77923b-353b-4983-a2fa-8deeabab6cf2\files\00005-337121381.png

Filesize
1.0MB

MD5
602b44b5e0a94c61c7ae501966eb4fd5

SHA1
853f5c83bedd4523cb72ca127cc6c269ac99e2d9

SHA256
2e3feac0a21a7fa351458ef1fed86f6f7a282c15fbc7f21cac29f874db9da4f3

SHA512
e7fe6c8965a35faecb3ab7bf6a3f8ed7a58aba891c5d5a2addec6aeda4a6790cef78a7874a386d89327d6bcb1e90ad376444d37d44fd0c604d6905dbd7ac6c97

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-ac77923b-353b-4983-a2fa-8deeabab6cf2\files\00007-337121383.png

Filesize
1.1MB

MD5
9a40cf65a81a8f618a4f562e2494a557

SHA1
3b06e119cc017bbe99c06906779f40f2d04b08ad

SHA256
087b59e3bfe212a96303f20122e9b9636753956fedaf2e1c8336e2e08c39f4e6

SHA512
745722fdeeb9d5f9011825d4826fb3c7c0fdeb0751a156a396b537c458854c376aac60a4709036ebf78e6d2d27cfeb302ef52ecfb1bfa3a6c238240d98839920

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-ac77923b-353b-4983-a2fa-8deeabab6cf2\files\00008-337121384.png

Filesize
1.1MB

MD5
452b0afd9436be767a0ee61e98ef0356

SHA1
736f12f84f8af0bd04f5b207f31cba8dd359ae03

SHA256
0348e5297e8040b2cc3e83e2c6edf6ccbfa122af0b3880ebd079c0dda3286c9a

SHA512
2fc4deaadd35f691aca0af4fb2e36201a2f68e7f7dcda9fe4da01d0b72c4cb8e448ca69d90d1cb230abfc2dc795ff785c1a1b2e95b5ab8fc0833d86013660338

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-ac77923b-353b-4983-a2fa-8deeabab6cf2\files\data.bin

Filesize
92KB

MD5
8b305b67e45165844d2f8547a085d782

SHA1
92b8ed7652e61fdf3acb4ce74f48bcc9ed14b722

SHA256
776622a88a71b989ae022dae2bfbe52d5f00024970548a465046b742089aa50b

SHA512
2bd688ab072464ed54ea111a07e44f130a6db2c51e6f5ede1d8583b31791ad3eb2ea51114e6ac624a50118f17dfd3ec3d72c7df00d8be3b4ef4dcd7b72a0dfe6

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-ac77923b-353b-4983-a2fa-8deeabab6cf2\files\data2.bin

Filesize
1.8MB

MD5
67d9ff2c54906e6de543f0d0c0c02d24

SHA1
7d22a89a4502dd7c9106c00ff379aa516df00616

SHA256
aeae977f8a8f82fd520c74f3df4e817cc1d118c95a4183ec15116273236c8745

SHA512
ea4166c5ef0f5b213713b369e956e40bd05db4eff3d7cf1cd2eca5c342c2d5ea64bb1dc5af03a07848e72ca3b97a8894c43e5ab389e0f1ab8238a643e676d4ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-ac77923b-353b-4983-a2fa-8deeabab6cf2\files\dbgeng.dll

Filesize
542KB

MD5
a1defa998f5984c7819cffd68664e00a

SHA1
9b0b17a2d660a2a51c8188186f394f8fe1650552

SHA256
abbb1d098f8ee24b0881278bee4228a59bb021242aba16af593c944c489e829f

SHA512
792ef593f78ffc453500f413640dee030bcf2bdd383697b01dc343f5e02e2b0f31b75ad68860fd7cfcae355e450e0d532ba99d1a912de7b47ced76fbc68fea24

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-ac77923b-353b-4983-a2fa-8deeabab6cf2\files\dbgeng.dll

Filesize
542KB

MD5
a1defa998f5984c7819cffd68664e00a

SHA1
9b0b17a2d660a2a51c8188186f394f8fe1650552

SHA256
abbb1d098f8ee24b0881278bee4228a59bb021242aba16af593c944c489e829f

SHA512
792ef593f78ffc453500f413640dee030bcf2bdd383697b01dc343f5e02e2b0f31b75ad68860fd7cfcae355e450e0d532ba99d1a912de7b47ced76fbc68fea24

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-ac77923b-353b-4983-a2fa-8deeabab6cf2\files\dbgeng.dll

Filesize
542KB

MD5
a1defa998f5984c7819cffd68664e00a

SHA1
9b0b17a2d660a2a51c8188186f394f8fe1650552

SHA256
abbb1d098f8ee24b0881278bee4228a59bb021242aba16af593c944c489e829f

SHA512
792ef593f78ffc453500f413640dee030bcf2bdd383697b01dc343f5e02e2b0f31b75ad68860fd7cfcae355e450e0d532ba99d1a912de7b47ced76fbc68fea24

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-ac77923b-353b-4983-a2fa-8deeabab6cf2\files\windbg.exe

Filesize
474KB

MD5
04ec4f58a1f4a87b5eeb1f4b7afc48e0

SHA1
58dcb1cbbec071d036a07f0e8feb858e4c5b96e7

SHA256
bd1af3dba56b129e6c624297eeed40c898fa2981fce5caafe467d88a748988a4

SHA512
5b572a504fac599e7e3f726d391e8ffdc2d083745609315a203000e8dc79b94d777fc520eb6530444d84f1ac9aad51406b91b527d8434077a58524feeccbbd80

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-ac77923b-353b-4983-a2fa-8deeabab6cf2\files\windbg.exe

Filesize
474KB

MD5
04ec4f58a1f4a87b5eeb1f4b7afc48e0

SHA1
58dcb1cbbec071d036a07f0e8feb858e4c5b96e7

SHA256
bd1af3dba56b129e6c624297eeed40c898fa2981fce5caafe467d88a748988a4

SHA512
5b572a504fac599e7e3f726d391e8ffdc2d083745609315a203000e8dc79b94d777fc520eb6530444d84f1ac9aad51406b91b527d8434077a58524feeccbbd80

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-ac77923b-353b-4983-a2fa-8deeabab6cf2\msiwrapper.ini

Filesize
1KB

MD5
2e708e2d614be99590809e2e53aa5d1e

SHA1
79ff64347f7775d24afa8bbab00a643e31defffc

SHA256
77c68f581c4d394a26b5cb52fccb3017d4e592d987ca47507035061f58ea2baa

SHA512
3d35832954bd6222f334fa58a933cc3d2d9969786d7e0bf2a3417bf3c063adc05d0d6cd6975febc50249735379448620c7d8c837872f3f0a8825a9c1df64c8d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-ac77923b-353b-4983-a2fa-8deeabab6cf2\msiwrapper.ini

Filesize
1KB

MD5
cc6e36d6b3b4788508600c12f34d548f

SHA1
02cce85a2d131e5339c7b104f2aa85aaeb7c021f

SHA256
c75f1ed84cce3321b3de5e110474ddbb7c0b04c539369391ca00ac5b113488de

SHA512
57179274bb9ec17ae1c1d1b5a98b2d144ad71bb01f93332f052b67e456e74cddb6df3936a6a675b0e3d887de320ab50329ff58b42f6c56636500064b7b547b7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-ac77923b-353b-4983-a2fa-8deeabab6cf2\msiwrapper.ini

Filesize
1KB

MD5
cc6e36d6b3b4788508600c12f34d548f

SHA1
02cce85a2d131e5339c7b104f2aa85aaeb7c021f

SHA256
c75f1ed84cce3321b3de5e110474ddbb7c0b04c539369391ca00ac5b113488de

SHA512
57179274bb9ec17ae1c1d1b5a98b2d144ad71bb01f93332f052b67e456e74cddb6df3936a6a675b0e3d887de320ab50329ff58b42f6c56636500064b7b547b7c

Download Submit
C:\Windows\Installer\MSI3B3F.tmp

Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
C:\Windows\Installer\MSI3B3F.tmp

Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
C:\Windows\Installer\MSI4A74.tmp

Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
C:\Windows\Installer\MSI4A74.tmp

Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
C:\tmpa\Autoit3.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.0MB

MD5
e4005eeaf39d38bcde123d23a1fe1c7e

SHA1
b282932f325fa0905b6a7006af80f3d7556f7fb7

SHA256
08dd47a61e65b10deb5c7be8be1524f262713ec1fecad497b5847308d0bffe1f

SHA512
ed4fb6e9ff6696f6824c8eb76a40f05e67c5b7a4ee40636bc6c3dcf4e2df106cc91c84af215c6ccffa23397e6cb167f6a4b5391ea4dd8faae92cf8d17f9807a4

Download Submit
\??\Volume{8df29902-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{35c23ebe-5f26-4dc1-8949-46ac54b0d83e}_OnDiskSnapshotProp

Filesize
5KB

MD5
a6b6e2edce554fe52102f4c368ff1e2f

SHA1
7fd216ba385407593cdc48b86fa1e8eb0e28d918

SHA256
f53ffd023ed6c84c4140b3cd919e06ae634f6a68e5cf00bc2a589f89bab27bcc

SHA512
39a0aaca8f6368c40fb6650662f0d811c6bf14fe029c304da95c6c69f9a97423bc20cf1dfa761165783a04a5afe07a905a39294c8b762ba0eaaf2174d6e9b142

Download Submit
\??\c:\tmpa\script.au3

Filesize
490KB

MD5
47254a9762ec3d0d2840db3c509775fe

SHA1
b56ae57e7feac10d839d960f130f3a7caddd175b

SHA256
25d76801735b5b7b49a7fa3f4dcfc13536832a354a7200458099c120d4faa7b6

SHA512
54e761e26cb5721cbc24f2ee4e9e138530d7c89b0cd9d731ab6551153dc76999056031e6436faaf357524afe655a596d7e490f37a1a4ba20ecc9e7496f53c13d

Download Submit
memory/3640-110-0x0000000001070000-0x00000000010FD000-memory.dmp

Filesize
564KB

Download
memory/3640-105-0x0000000002980000-0x0000000002A80000-memory.dmp

Filesize
1024KB

Download
memory/3640-101-0x0000000001070000-0x00000000010FD000-memory.dmp

Filesize
564KB

Download
memory/4976-130-0x0000000000D90000-0x0000000001190000-memory.dmp

Filesize
4.0MB

Download
memory/4976-131-0x0000000003FA0000-0x00000000042CA000-memory.dmp

Filesize
3.2MB

Download
memory/4976-132-0x0000000003FA0000-0x00000000042CA000-memory.dmp

Filesize
3.2MB

Download