darkgate | 5ec2ac23230810dba049ba6628fa0fd423626f1a24601896bcc71428d6fb9893

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
24-10-2023 16:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ZoomInstaller.msi
Size

1.7MB
MD5

79f3e81f80108982afdb0375cd2d5878
SHA1

517dd7250d8e303dbeca3f7e084f702da12262d3
SHA256

5ec2ac23230810dba049ba6628fa0fd423626f1a24601896bcc71428d6fb9893
SHA512

bb42439f5e068e4d52c5adc776c0235596e3d755484ec5e97efa14e338af2171e20e1fd606a50679a390649146906882076565923ae5496e8b6c57a01270a0c0
SSDEEP

49152:apUPo/r9A+y5V8EHu4l4XcR+TpM4S/PHA0s5NhqaT:apJTSbkEHu0xR4pA3Hy5NUaT

Score

10^/10

darkgate a1111 discovery stealer

Malware Config

Extracted

Family

darkgate

Botnet

A1111

http://81.19.135.17

Attributes

alternative_c2_port
8080
anti_analysis
true
anti_debug
true
anti_vm
false
c2_port
2351
check_disk
false
check_ram
false
check_xeon
false
crypter_au3
true
crypter_dll
false
crypter_rawstub
false
crypto_key
XsiTyXlnWVdrXT
internal_mutex
txtMut
minimum_disk
100
minimum_ram
4096
ping_interval
4
rootkit
true
startup_persistence
true
username
A1111

Signatures

DarkGate
DarkGate is an infostealer written in C++.
stealer darkgate

Executes dropped EXE 2 IoCs

pid	Process
1600	KeyScramblerLogon.exe
2724	Autoit3.exe

Loads dropped DLL 8 IoCs

pid	Process
2464	MsiExec.exe
2464	MsiExec.exe
2464	MsiExec.exe
2464	MsiExec.exe
2464	MsiExec.exe
1600	KeyScramblerLogon.exe
1600	KeyScramblerLogon.exe
2464	MsiExec.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1500	ICACLS.EXE
2176	ICACLS.EXE

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\Installer\f76c85f.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSICA32.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f76c85f.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\Logs\DPX\setupact.log	EXPAND.EXE
File opened for modification	C:\Windows\Logs\DPX\setuperr.log	EXPAND.EXE
File opened for modification	C:\Windows\Installer\MSIDF29.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDF3A.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f76c85e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f76c85e.msi	msiexec.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x0006000000014df5-113.dat	nsis_installer_1
behavioral1/files/0x0006000000014df5-113.dat	nsis_installer_2

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Autoit3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Autoit3.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2968	msiexec.exe
2968	msiexec.exe

Suspicious use of AdjustPrivilegeToken 57 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2876	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2876	msiexec.exe
Token: SeRestorePrivilege	2968	msiexec.exe
Token: SeTakeOwnershipPrivilege	2968	msiexec.exe
Token: SeSecurityPrivilege	2968	msiexec.exe
Token: SeCreateTokenPrivilege	2876	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2876	msiexec.exe
Token: SeLockMemoryPrivilege	2876	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2876	msiexec.exe
Token: SeMachineAccountPrivilege	2876	msiexec.exe
Token: SeTcbPrivilege	2876	msiexec.exe
Token: SeSecurityPrivilege	2876	msiexec.exe
Token: SeTakeOwnershipPrivilege	2876	msiexec.exe
Token: SeLoadDriverPrivilege	2876	msiexec.exe
Token: SeSystemProfilePrivilege	2876	msiexec.exe
Token: SeSystemtimePrivilege	2876	msiexec.exe
Token: SeProfSingleProcessPrivilege	2876	msiexec.exe
Token: SeIncBasePriorityPrivilege	2876	msiexec.exe
Token: SeCreatePagefilePrivilege	2876	msiexec.exe
Token: SeCreatePermanentPrivilege	2876	msiexec.exe
Token: SeBackupPrivilege	2876	msiexec.exe
Token: SeRestorePrivilege	2876	msiexec.exe
Token: SeShutdownPrivilege	2876	msiexec.exe
Token: SeDebugPrivilege	2876	msiexec.exe
Token: SeAuditPrivilege	2876	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2876	msiexec.exe
Token: SeChangeNotifyPrivilege	2876	msiexec.exe
Token: SeRemoteShutdownPrivilege	2876	msiexec.exe
Token: SeUndockPrivilege	2876	msiexec.exe
Token: SeSyncAgentPrivilege	2876	msiexec.exe
Token: SeEnableDelegationPrivilege	2876	msiexec.exe
Token: SeManageVolumePrivilege	2876	msiexec.exe
Token: SeImpersonatePrivilege	2876	msiexec.exe
Token: SeCreateGlobalPrivilege	2876	msiexec.exe
Token: SeBackupPrivilege	2600	vssvc.exe
Token: SeRestorePrivilege	2600	vssvc.exe
Token: SeAuditPrivilege	2600	vssvc.exe
Token: SeBackupPrivilege	2968	msiexec.exe
Token: SeRestorePrivilege	2968	msiexec.exe
Token: SeRestorePrivilege	2780	DrvInst.exe
Token: SeRestorePrivilege	2780	DrvInst.exe
Token: SeRestorePrivilege	2780	DrvInst.exe
Token: SeRestorePrivilege	2780	DrvInst.exe
Token: SeRestorePrivilege	2780	DrvInst.exe
Token: SeRestorePrivilege	2780	DrvInst.exe
Token: SeRestorePrivilege	2780	DrvInst.exe
Token: SeLoadDriverPrivilege	2780	DrvInst.exe
Token: SeLoadDriverPrivilege	2780	DrvInst.exe
Token: SeLoadDriverPrivilege	2780	DrvInst.exe
Token: SeRestorePrivilege	2968	msiexec.exe
Token: SeTakeOwnershipPrivilege	2968	msiexec.exe
Token: SeRestorePrivilege	2968	msiexec.exe
Token: SeTakeOwnershipPrivilege	2968	msiexec.exe
Token: SeRestorePrivilege	2968	msiexec.exe
Token: SeTakeOwnershipPrivilege	2968	msiexec.exe
Token: SeRestorePrivilege	2968	msiexec.exe
Token: SeTakeOwnershipPrivilege	2968	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2876	msiexec.exe
2876	msiexec.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2464	2968	msiexec.exe	32
PID 2968 wrote to memory of 2464	2968	msiexec.exe	32
PID 2968 wrote to memory of 2464	2968	msiexec.exe	32
PID 2968 wrote to memory of 2464	2968	msiexec.exe	32
PID 2968 wrote to memory of 2464	2968	msiexec.exe	32
PID 2968 wrote to memory of 2464	2968	msiexec.exe	32
PID 2968 wrote to memory of 2464	2968	msiexec.exe	32
PID 2464 wrote to memory of 2176	2464	MsiExec.exe	33
PID 2464 wrote to memory of 2176	2464	MsiExec.exe	33
PID 2464 wrote to memory of 2176	2464	MsiExec.exe	33
PID 2464 wrote to memory of 2176	2464	MsiExec.exe	33
PID 2464 wrote to memory of 1964	2464	MsiExec.exe	35
PID 2464 wrote to memory of 1964	2464	MsiExec.exe	35
PID 2464 wrote to memory of 1964	2464	MsiExec.exe	35
PID 2464 wrote to memory of 1964	2464	MsiExec.exe	35
PID 2464 wrote to memory of 1600	2464	MsiExec.exe	37
PID 2464 wrote to memory of 1600	2464	MsiExec.exe	37
PID 2464 wrote to memory of 1600	2464	MsiExec.exe	37
PID 2464 wrote to memory of 1600	2464	MsiExec.exe	37
PID 1600 wrote to memory of 2724	1600	KeyScramblerLogon.exe	40
PID 1600 wrote to memory of 2724	1600	KeyScramblerLogon.exe	40
PID 1600 wrote to memory of 2724	1600	KeyScramblerLogon.exe	40
PID 1600 wrote to memory of 2724	1600	KeyScramblerLogon.exe	40
PID 2464 wrote to memory of 1500	2464	MsiExec.exe	39
PID 2464 wrote to memory of 1500	2464	MsiExec.exe	39
PID 2464 wrote to memory of 1500	2464	MsiExec.exe	39
PID 2464 wrote to memory of 1500	2464	MsiExec.exe	39

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ZoomInstaller.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2876

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3129ADF871B2F576DBDC2299BB158324
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-e93cb4ee-7d8f-46cf-92f8-3dd5f29ff31b\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    PID:2176
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    PID:1964
- - C:\Users\Admin\AppData\Local\Temp\MW-e93cb4ee-7d8f-46cf-92f8-3dd5f29ff31b\files\KeyScramblerLogon.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-e93cb4ee-7d8f-46cf-92f8-3dd5f29ff31b\files\KeyScramblerLogon.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1600
  - - C:\Users\Admin\AppData\Local\Temp\MW-e93cb4ee-7d8f-46cf-92f8-3dd5f29ff31b\files\Autoit3.exe
      "C:\Users\Admin\AppData\Local\Temp\MW-e93cb4ee-7d8f-46cf-92f8-3dd5f29ff31b\files\Autoit3.exe" C:\Users\Admin\AppData\Local\Temp\MW-e93cb4ee-7d8f-46cf-92f8-3dd5f29ff31b\files\script.au3
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      PID:2724
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-e93cb4ee-7d8f-46cf-92f8-3dd5f29ff31b\." /SETINTEGRITYLEVEL (CI)(OI)LOW
    3⤵
    - Modifies file permissions
    PID:1500

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2600

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003C4" "00000000000005CC"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MW-e93cb4ee-7d8f-46cf-92f8-3dd5f29ff31b\files.cab

Filesize
1.5MB

MD5
e2a7cdae38bb951ba98349ddaaafa22c

SHA1
2e2ff7d75189bc0f073c21a30bbd7ed96bf6d7e2

SHA256
4e78383a62ecd3ced1d831f51a2eebba104e6728273d3bcefe87fbbb7697ffef

SHA512
4c5ff2f19b0b192947b779797ffb77c1ff93461473d42ff1953d6cb66e5856ba20cf3927eba0e21e5143f73002e8269295f70806794b0a97c859cb3c267b3fed

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e93cb4ee-7d8f-46cf-92f8-3dd5f29ff31b\files\Autoit3.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e93cb4ee-7d8f-46cf-92f8-3dd5f29ff31b\files\Autoit3.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e93cb4ee-7d8f-46cf-92f8-3dd5f29ff31b\files\KeyScramblerIE.DLL

Filesize
620KB

MD5
063c5f260b3a34e4d7f1e1871bb57e07

SHA1
a24959e9b20286787ad7d35a625fa94f71b5922f

SHA256
f1e1f1baed9cfcfcb6cca151a0a2a315cda9b0a0ddf01906519447db515c3b48

SHA512
84471407be633ebb410bcc10789bc8e119f95a7cc073bb4ea8284255b8736b59a8b69769664e935f1391cc204e68f3754916c0b18067e6de351d6245fb8f0b6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e93cb4ee-7d8f-46cf-92f8-3dd5f29ff31b\files\KeyScramblerLogon.dll

Filesize
92KB

MD5
760aa6f15db378dda44f262e1349e28d

SHA1
9bb9a0caa54e8b2560245430f33985996b2d40f3

SHA256
ee04957d0010ca2134c4770b434b2fdec08a25400b474dd51f47d5d1dc8d574b

SHA512
c6cf081dc189d88c85d01832f5cb09ff42c1264d7d4c548a336a33b97ec0b0b24aeb25076fd24db7db2f7a7ced6eccc67d26497352f7eeb1d29bb9c0a59abce6

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e93cb4ee-7d8f-46cf-92f8-3dd5f29ff31b\files\KeyScramblerLogon.exe

Filesize
500KB

MD5
c790ebfcb6a34953a371e32c9174fe46

SHA1
3ead08d8bbdb3afd851877cb50507b77ae18a4d8

SHA256
fa7ad2f45128120bccc33f996f87a81faa2e9c1236666dd69b943a755f332eb1

SHA512
74e3ab12b2a2d5c45c5248dd2225bfbcf237a01ef94fdca3fe99cfde11bd7d0ccd25dd7f26bd283997d951f4df7e8f4b35f9475a32bdb854d6cc8867b2c45554

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e93cb4ee-7d8f-46cf-92f8-3dd5f29ff31b\files\KeyScramblerLogon.exe

Filesize
500KB

MD5
c790ebfcb6a34953a371e32c9174fe46

SHA1
3ead08d8bbdb3afd851877cb50507b77ae18a4d8

SHA256
fa7ad2f45128120bccc33f996f87a81faa2e9c1236666dd69b943a755f332eb1

SHA512
74e3ab12b2a2d5c45c5248dd2225bfbcf237a01ef94fdca3fe99cfde11bd7d0ccd25dd7f26bd283997d951f4df7e8f4b35f9475a32bdb854d6cc8867b2c45554

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e93cb4ee-7d8f-46cf-92f8-3dd5f29ff31b\files\Uninstall.exe

Filesize
88KB

MD5
6de8cb9727907a59bcaf9871cc493c70

SHA1
a0ea933423c48d36718dca842994b83e5ffc4756

SHA256
408c0fbf2992f89b058bdb228670ff27a68ef0a7a3b648a33ff86ecc39139a11

SHA512
a48d97a7862eeda211a59d1023071641c91c3065a347ad060c40f86532db36010f5c89b0f6ab427a783ccce45485e42cf6443a14c72faa118c9b0a4c34b5c21e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e93cb4ee-7d8f-46cf-92f8-3dd5f29ff31b\files\ipoylmv

Filesize
8B

MD5
4136718748abe50c92566b9c366ff5f2

SHA1
73e256840b41972660b5283445e62bd489c91dc4

SHA256
4450f5f6eeacbc3b4251aca8e90b45eb612ec692a90be5282ea10f33aa5932f3

SHA512
c88e42ab9150d0a612633b17cd8af8bea380ac4b3c1bc9c391f25e80dce346a32bb2602f473dda82f5cf1f24e8e8edcaee3f0293397dfb44dd0ce06b544e2bf4

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e93cb4ee-7d8f-46cf-92f8-3dd5f29ff31b\files\keyscrambler.ico

Filesize
39KB

MD5
fde5504bbf7620aca9f3850511c13a45

SHA1
484382ecc232cedc1651fba5f9311e9164f43369

SHA256
932409eb2abfc31f2dd218240de70a150359ea8ab09fcceb1f076b9a17c844b7

SHA512
6d67be9398fcc2b85fe4fd7357f37d6cfc1d3e548f713319080707c750b66d2b1e631c79a7e745c56b1a72be91735156e3989eff8d0b84c3442c0fa548c2a6b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e93cb4ee-7d8f-46cf-92f8-3dd5f29ff31b\files\keyscrambler.sys

Filesize
225KB

MD5
9baf5236d65a36ed2c388cf04108ab9f

SHA1
f5e28edea04a00b5e8806130cd2736336c6e3792

SHA256
9e79960a40797c11a007d9c8e6a4bce721baf603f5d651f5485eb5481c717b12

SHA512
1fc899c37e628adbe05a53812e6106332de7dbef83ce72094dd228067eefa71d09abe55d250b35d93f7454b9596073de95af6700e543c17bb5d43e7de0fcac1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e93cb4ee-7d8f-46cf-92f8-3dd5f29ff31b\files\script.au3

Filesize
912KB

MD5
8450a45fc31cb740987b41d247e13f23

SHA1
2ae3bfba1e003b68a30efbb50b405e844829ae8e

SHA256
9903ec10be031f0082371b7b09d867dd078389718d08fe253b4c14e53c9ff9f9

SHA512
b7be7a115983a242e46901812445a2451803fe82e6f15adfb9095002a6fe6d5229ade35acb8cd786a9fe7097658884949d25439e5d6e47bc190fe10a8d5315ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e93cb4ee-7d8f-46cf-92f8-3dd5f29ff31b\files\tgqbmrvc

Filesize
1.8MB

MD5
f22354701dc827653840c3ed3a6da586

SHA1
d7fdaab547e2ca38ab6b949cea693599a822c61b

SHA256
6d39366b744a2c37a53079b03cdd754b47c23d04daa3255375475117be4cedaa

SHA512
59a8facb729698388273c1602b0b3d379f4e123a29d210053faeb90e3d1fd2cfb16f297183af7f28611d46b431d8e93d01b7f2cb69113e3da4e4f25e80b2c5af

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e93cb4ee-7d8f-46cf-92f8-3dd5f29ff31b\msiwrapper.ini

Filesize
1KB

MD5
aa6c9d5c401bd61422692244d0aee3a7

SHA1
d59bd41813697bb6814e72f4d0bf6a301cfa6a3f

SHA256
c5638c908054d6c49c26dc371dc79fd7016f2c36aa640076389583817d527363

SHA512
cbdedf5aeb12927f04c58620edaaf0105eb1acaa978be2209b4d29a301741e3be89e951c65ff44e702b2e491350003b4fd372b347251cfab2fa494221d532a5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e93cb4ee-7d8f-46cf-92f8-3dd5f29ff31b\msiwrapper.ini

Filesize
458B

MD5
4838c5293f5e07db3f4c4707ec2c7040

SHA1
85be1e5a8c41284b371c26dd8cb1d3802c878157

SHA256
17a1dabb78f5a64df3e0349b05d89b7995f42add6fbfeaa1590a8635d0c2c58a

SHA512
806ef122d8fbcdb5601475f3406921f00ca227fa1a0a7228fae2f8b166bde857d621f2e57c656a8c00f99ce5aace04fd5b3745feae314e0355f8e3e098e9984f

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e93cb4ee-7d8f-46cf-92f8-3dd5f29ff31b\msiwrapper.ini

Filesize
1KB

MD5
3dd99db6d6dcfed87f290b651cca2855

SHA1
2c1743ba76fab1356d78531ea71629481515e3d8

SHA256
b1b7a7d1afce63550cd641f618826a11d7ee711c89256182566c08a11c2e5b32

SHA512
bfff2f1c52d75227480be5d395075b3a09bd6aaf2cd5d4e0a41d091e9e21a5ee259f1fc33dbf614612d8724b1cba6ac72d44b2ee3492bbf369973449113a42a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e93cb4ee-7d8f-46cf-92f8-3dd5f29ff31b\msiwrapper.ini

Filesize
1KB

MD5
3dd99db6d6dcfed87f290b651cca2855

SHA1
2c1743ba76fab1356d78531ea71629481515e3d8

SHA256
b1b7a7d1afce63550cd641f618826a11d7ee711c89256182566c08a11c2e5b32

SHA512
bfff2f1c52d75227480be5d395075b3a09bd6aaf2cd5d4e0a41d091e9e21a5ee259f1fc33dbf614612d8724b1cba6ac72d44b2ee3492bbf369973449113a42a3

Download Submit
C:\Windows\Installer\MSICA32.tmp

Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
C:\Windows\Installer\MSIDF3A.tmp

Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
\Users\Admin\AppData\Local\Temp\MW-e93cb4ee-7d8f-46cf-92f8-3dd5f29ff31b\files\Autoit3.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\Users\Admin\AppData\Local\Temp\MW-e93cb4ee-7d8f-46cf-92f8-3dd5f29ff31b\files\KeyScramblerIE.dll

Filesize
620KB

MD5
063c5f260b3a34e4d7f1e1871bb57e07

SHA1
a24959e9b20286787ad7d35a625fa94f71b5922f

SHA256
f1e1f1baed9cfcfcb6cca151a0a2a315cda9b0a0ddf01906519447db515c3b48

SHA512
84471407be633ebb410bcc10789bc8e119f95a7cc073bb4ea8284255b8736b59a8b69769664e935f1391cc204e68f3754916c0b18067e6de351d6245fb8f0b6c

Download Submit
\Users\Admin\AppData\Local\Temp\MW-e93cb4ee-7d8f-46cf-92f8-3dd5f29ff31b\files\KeyScramblerLogon.exe

Filesize
500KB

MD5
c790ebfcb6a34953a371e32c9174fe46

SHA1
3ead08d8bbdb3afd851877cb50507b77ae18a4d8

SHA256
fa7ad2f45128120bccc33f996f87a81faa2e9c1236666dd69b943a755f332eb1

SHA512
74e3ab12b2a2d5c45c5248dd2225bfbcf237a01ef94fdca3fe99cfde11bd7d0ccd25dd7f26bd283997d951f4df7e8f4b35f9475a32bdb854d6cc8867b2c45554

Download Submit
\Users\Admin\AppData\Local\Temp\MW-e93cb4ee-7d8f-46cf-92f8-3dd5f29ff31b\files\KeyScramblerLogon.exe

Filesize
500KB

MD5
c790ebfcb6a34953a371e32c9174fe46

SHA1
3ead08d8bbdb3afd851877cb50507b77ae18a4d8

SHA256
fa7ad2f45128120bccc33f996f87a81faa2e9c1236666dd69b943a755f332eb1

SHA512
74e3ab12b2a2d5c45c5248dd2225bfbcf237a01ef94fdca3fe99cfde11bd7d0ccd25dd7f26bd283997d951f4df7e8f4b35f9475a32bdb854d6cc8867b2c45554

Download Submit
\Users\Admin\AppData\Local\Temp\MW-e93cb4ee-7d8f-46cf-92f8-3dd5f29ff31b\files\KeyScramblerLogon.exe

Filesize
500KB

MD5
c790ebfcb6a34953a371e32c9174fe46

SHA1
3ead08d8bbdb3afd851877cb50507b77ae18a4d8

SHA256
fa7ad2f45128120bccc33f996f87a81faa2e9c1236666dd69b943a755f332eb1

SHA512
74e3ab12b2a2d5c45c5248dd2225bfbcf237a01ef94fdca3fe99cfde11bd7d0ccd25dd7f26bd283997d951f4df7e8f4b35f9475a32bdb854d6cc8867b2c45554

Download Submit
\Users\Admin\AppData\Local\Temp\MW-e93cb4ee-7d8f-46cf-92f8-3dd5f29ff31b\files\KeyScramblerLogon.exe

Filesize
500KB

MD5
c790ebfcb6a34953a371e32c9174fe46

SHA1
3ead08d8bbdb3afd851877cb50507b77ae18a4d8

SHA256
fa7ad2f45128120bccc33f996f87a81faa2e9c1236666dd69b943a755f332eb1

SHA512
74e3ab12b2a2d5c45c5248dd2225bfbcf237a01ef94fdca3fe99cfde11bd7d0ccd25dd7f26bd283997d951f4df7e8f4b35f9475a32bdb854d6cc8867b2c45554

Download Submit
\Windows\Installer\MSICA32.tmp

Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
\Windows\Installer\MSIDF3A.tmp

Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
memory/1600-99-0x0000000001230000-0x0000000001325000-memory.dmp

Filesize
980KB

Download
memory/1600-98-0x0000000002820000-0x0000000002F50000-memory.dmp

Filesize
7.2MB

Download
memory/1600-94-0x0000000000170000-0x0000000000212000-memory.dmp

Filesize
648KB

Download
memory/1600-107-0x0000000001230000-0x0000000001325000-memory.dmp

Filesize
980KB

Download
memory/1600-106-0x0000000000170000-0x0000000000212000-memory.dmp

Filesize
648KB

Download
memory/2724-124-0x0000000000B00000-0x0000000000F00000-memory.dmp

Filesize
4.0MB

Download
memory/2724-125-0x0000000002AF0000-0x0000000002BE5000-memory.dmp

Filesize
980KB

Download
memory/2724-127-0x0000000003300000-0x00000000036C3000-memory.dmp

Filesize
3.8MB

Download
memory/2724-126-0x0000000002AF0000-0x0000000002BE5000-memory.dmp

Filesize
980KB

Download
memory/2724-128-0x0000000003300000-0x00000000036C3000-memory.dmp

Filesize
3.8MB

Download