Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    155s
  • max time network
    163s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    24/10/2023, 19:33

General

  • Target

    NEAS.1fb6b8bed3a67ee4225f852c3d90fd2b629f2541ab431b4bd4d9d9f5bbd2c4b7msi_JC.msi

  • Size

    9.2MB

  • MD5

    69f900118f985990f488121cd1cf5e2b

  • SHA1

    33f6b7aac2afaba74eeac1a44ba9ec5d0a53d00c

  • SHA256

    1fb6b8bed3a67ee4225f852c3d90fd2b629f2541ab431b4bd4d9d9f5bbd2c4b7

  • SHA512

    09ae36c29bfbb09ed1fdc3da5ed365fa61cf2905e177909b6a8fcef8e0a25742d1acffdb13378b91c3fa607ecece4de39b380894b6df9152f06350972bbfaa42

  • SSDEEP

    196608:zhbWzPMCeNrs0rczeuNr/QnMOsaB9QVuHSzdUupBqbHSDjs6cv1HDQfgaP:FbWzPM5HCZNrgMVw6wyZUupkjSPcv1jO

Malware Config

Extracted

Family

darkgate

Botnet

civilian1337

C2

http://185.130.227.202

Attributes
  • alternative_c2_port

    8080

  • anti_analysis

    false

  • anti_debug

    false

  • anti_vm

    false

  • c2_port

    2351

  • check_disk

    false

  • check_ram

    false

  • check_xeon

    false

  • crypter_au3

    false

  • crypter_dll

    false

  • crypter_rawstub

    true

  • crypto_key

    VPsTDMdPtonzYs

  • internal_mutex

    txtMut

  • minimum_disk

    100

  • minimum_ram

    4096

  • ping_interval

    4

  • rootkit

    true

  • startup_persistence

    true

  • username

    civilian1337

Signatures

  • DarkGate

    DarkGate is an infostealer written in C++.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 64 IoCs
  • Blocklisted process makes network request 64 IoCs
  • Drops startup file 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 8 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 43 IoCs
  • Modifies registry class 9 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 53 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 55 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    1⤵
      PID:1236
    • C:\Windows\system32\taskhost.exe
      "taskhost.exe"
      1⤵
        PID:1128
      • C:\Windows\system32\msiexec.exe
        msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\NEAS.1fb6b8bed3a67ee4225f852c3d90fd2b629f2541ab431b4bd4d9d9f5bbd2c4b7msi_JC.msi
        1⤵
        • Enumerates connected drives
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:2372
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Enumerates connected drives
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2300
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding 33DF56A76EE90ED027C1DCB79176D96B
          2⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2792
          • C:\Windows\SysWOW64\ICACLS.EXE
            "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-159bbba6-10c5-49af-9326-6900b293f626\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
            3⤵
            • Modifies file permissions
            PID:112
          • C:\Windows\SysWOW64\EXPAND.EXE
            "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
            3⤵
            • Drops file in Windows directory
            PID:692
          • C:\Users\Admin\AppData\Local\Temp\MW-159bbba6-10c5-49af-9326-6900b293f626\files\windbg.exe
            "C:\Users\Admin\AppData\Local\Temp\MW-159bbba6-10c5-49af-9326-6900b293f626\files\windbg.exe"
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:1072
            • \??\c:\tmpa\Autoit3.exe
              c:\tmpa\Autoit3.exe c:\tmpa\script.au3
              4⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Checks processor information in registry
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:2920
              • C:\Windows\SysWOW64\rundll32.exe
                "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\MW-159bbba6-10c5-49af-9326-6900b293f626\files\data.bin
                5⤵
                • Modifies registry class
                PID:1812
              • \??\c:\windows\SysWOW64\cmd.exe
                "c:\windows\system32\cmd.exe" /c ping 127.0.0.1 & del /q /f c:\tmpa\* & rmdir /s /q c:\tmpa\ exit
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:2360
                • \??\c:\windows\SysWOW64\PING.EXE
                  ping 127.0.0.1
                  6⤵
                  • Runs ping.exe
                  PID:1556
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c ping 127.0.0.1
                5⤵
                • Suspicious use of NtCreateUserProcessOtherParentProcess
                • Blocklisted process makes network request
                • Drops startup file
                • Loads dropped DLL
                • Checks processor information in registry
                • Suspicious behavior: EnumeratesProcesses
                PID:984
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\MW-159bbba6-10c5-49af-9326-6900b293f626\files"
            3⤵
              PID:3020
            • C:\Windows\SysWOW64\ICACLS.EXE
              "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-159bbba6-10c5-49af-9326-6900b293f626\." /SETINTEGRITYLEVEL (CI)(OI)LOW
              3⤵
              • Modifies file permissions
              PID:2072
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2672
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000004EC" "00000000000003B4"
          1⤵
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          • Suspicious use of AdjustPrivilegeToken
          PID:2520
        • C:\Windows\system32\conhost.exe
          \??\C:\Windows\system32\conhost.exe "-3797421731776392785238835488-448511294-1329150459697527786307603185-1056407104"
          1⤵
            PID:688

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\haaahce\Autoit3.exe

            Filesize

            872KB

            MD5

            c56b5f0201a3b3de53e561fe76912bfd

            SHA1

            2a4062e10a5de813f5688221dbeb3f3ff33eb417

            SHA256

            237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

            SHA512

            195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

          • C:\ProgramData\haaahce\kcaaghc\fgfhafc

            Filesize

            170B

            MD5

            b80c01782aac6a52ee3f2f96600bec89

            SHA1

            afd6eb8737666c068991b2d640bce048d07e45ee

            SHA256

            475d84a04d5111574946242e2d891841f4cb931bc52d97f1fe994b4c385421f2

            SHA512

            e20d88d94741be801ddc6ea2af7d59c97e450d98209e461ff09b9736d620be14edce1f207cb43ec7cc4de8d2a1cd41421d077a20f0c8bfbb1d8dd3f49d2364e7

          • C:\Users\Admin\AppData\Local\Temp\MW-159bbba6-10c5-49af-9326-6900b293f626\files.cab

            Filesize

            8.9MB

            MD5

            3a4de3260c72e38f814cc2a7b2d42df7

            SHA1

            19458fb6838dd9d8be113b0b9983c7d77c12eb25

            SHA256

            411776c8e92afa462d734d14b7c569341442e5d7726009e80eaa497b5e09deb7

            SHA512

            3493664ecdb50d0c0d4f2646aabdd24a20fb435f4799af96f95f625aa983842c1baf7977956964d77d5b344c9e2551d60f007230838bc7a82bc40a2c9714cc0e

          • C:\Users\Admin\AppData\Local\Temp\MW-159bbba6-10c5-49af-9326-6900b293f626\files\00001-~1.PNG

            Filesize

            1.1MB

            MD5

            fd49f38e666f94abdbd9cc0bb842c29b

            SHA1

            36a00401a015d0719787d5a65c86784760ee93ff

            SHA256

            1f5620bf07b2c25dd18fea78288c48fb2f7b5f0a5cfc1ee6c8d8dbf6029c442f

            SHA512

            2fc40f776e84574f915e418c4b946097234faceb9902239015d2b80e683fe61d623035644055dddb6f7b92160b3c8663795f8a27bf16c5b137c7053cc9f4f612

          • C:\Users\Admin\AppData\Local\Temp\MW-159bbba6-10c5-49af-9326-6900b293f626\files\00002-~1.PNG

            Filesize

            1.0MB

            MD5

            f68d2ca13e1268dd79e95591b976ec45

            SHA1

            588454301e3c25065349740573282145aa0a5c7b

            SHA256

            af008f94fe42c29b1c7da7abe02e5edaaf9b89b1c8383e646ccfc8e0e7a66460

            SHA512

            a34b648c8453df91b88d7143237e5decf84a979bfe19a98ae5cff2d37081683236502ad2f62b585409cefae98da89e92acfc8665af40d3f7c9ece4c90e32ebae

          • C:\Users\Admin\AppData\Local\Temp\MW-159bbba6-10c5-49af-9326-6900b293f626\files\00003-~1.PNG

            Filesize

            1.1MB

            MD5

            7dbe5e4b98d7601585cfb9697f265e0f

            SHA1

            da8477a2494b1436664c535d7c854bf778942a76

            SHA256

            c3c4c040c61bbf8432d4450e34b7101110de26e5e4671736d64535b06189a288

            SHA512

            38e8d0e103096fee998aae33179ad15eee50acc57236bb75bf115f99bd7fa1e1d5fe386ab9a3adcced910f5114c36459c06b55b2218e8020832066eea3755d9e

          • C:\Users\Admin\AppData\Local\Temp\MW-159bbba6-10c5-49af-9326-6900b293f626\files\00004-~1.PNG

            Filesize

            1.0MB

            MD5

            85da5b7fd4b6983fffe78853c5276c03

            SHA1

            49a68d92beabfdfce7b2939f35a7b3e4bdc2bc96

            SHA256

            ff2a43f449bf81510c74eee9cd867bef4226c9c909b698e636ca8c56135d57ba

            SHA512

            c1d19bde8f9d434e29322edb8ac8892a475385bf97b5afd2f655175f1da6ce3ebc9df196585f3ea6a2a1755a1ec0fba2b60f203408ceebbea7801f4d1ab92f5b

          • C:\Users\Admin\AppData\Local\Temp\MW-159bbba6-10c5-49af-9326-6900b293f626\files\00005-~1.PNG

            Filesize

            1.0MB

            MD5

            602b44b5e0a94c61c7ae501966eb4fd5

            SHA1

            853f5c83bedd4523cb72ca127cc6c269ac99e2d9

            SHA256

            2e3feac0a21a7fa351458ef1fed86f6f7a282c15fbc7f21cac29f874db9da4f3

            SHA512

            e7fe6c8965a35faecb3ab7bf6a3f8ed7a58aba891c5d5a2addec6aeda4a6790cef78a7874a386d89327d6bcb1e90ad376444d37d44fd0c604d6905dbd7ac6c97

          • C:\Users\Admin\AppData\Local\Temp\MW-159bbba6-10c5-49af-9326-6900b293f626\files\00007-~1.PNG

            Filesize

            1.1MB

            MD5

            9a40cf65a81a8f618a4f562e2494a557

            SHA1

            3b06e119cc017bbe99c06906779f40f2d04b08ad

            SHA256

            087b59e3bfe212a96303f20122e9b9636753956fedaf2e1c8336e2e08c39f4e6

            SHA512

            745722fdeeb9d5f9011825d4826fb3c7c0fdeb0751a156a396b537c458854c376aac60a4709036ebf78e6d2d27cfeb302ef52ecfb1bfa3a6c238240d98839920

          • C:\Users\Admin\AppData\Local\Temp\MW-159bbba6-10c5-49af-9326-6900b293f626\files\00008-~1.PNG

            Filesize

            1.1MB

            MD5

            452b0afd9436be767a0ee61e98ef0356

            SHA1

            736f12f84f8af0bd04f5b207f31cba8dd359ae03

            SHA256

            0348e5297e8040b2cc3e83e2c6edf6ccbfa122af0b3880ebd079c0dda3286c9a

            SHA512

            2fc4deaadd35f691aca0af4fb2e36201a2f68e7f7dcda9fe4da01d0b72c4cb8e448ca69d90d1cb230abfc2dc795ff785c1a1b2e95b5ab8fc0833d86013660338

          • C:\Users\Admin\AppData\Local\Temp\MW-159bbba6-10c5-49af-9326-6900b293f626\files\DATAPI~1.JPG

            Filesize

            159KB

            MD5

            008b295295c49c6d07161baff5f7212b

            SHA1

            f89d13817531957967be21327c8180a35960d04d

            SHA256

            9f42965324b20db9ad4b9ab00217eade01e6978d9e68d03669adbe9a9fe66134

            SHA512

            6d8aae2cca7f283c0b850236763a0cb51947053b50758e4be7515ce76fc4e47876e6478e08934922e57ba9646e2fe35be23369617b7904038eee452ba363495e

          • C:\Users\Admin\AppData\Local\Temp\MW-159bbba6-10c5-49af-9326-6900b293f626\files\data.bin

            Filesize

            92KB

            MD5

            8b305b67e45165844d2f8547a085d782

            SHA1

            92b8ed7652e61fdf3acb4ce74f48bcc9ed14b722

            SHA256

            776622a88a71b989ae022dae2bfbe52d5f00024970548a465046b742089aa50b

            SHA512

            2bd688ab072464ed54ea111a07e44f130a6db2c51e6f5ede1d8583b31791ad3eb2ea51114e6ac624a50118f17dfd3ec3d72c7df00d8be3b4ef4dcd7b72a0dfe6

          • C:\Users\Admin\AppData\Local\Temp\MW-159bbba6-10c5-49af-9326-6900b293f626\files\data2.bin

            Filesize

            1.8MB

            MD5

            7673659bf664bd45a6f3c38b7d1c25d3

            SHA1

            a9b40ab4590b77887417ec33ecd061c98490176a

            SHA256

            41339e85c54f960b04039fd47df735c5ce78d99ede511364c8c8c2ad81f38c7d

            SHA512

            14ca50e20b3830765e8f116fc48ea49faabf3e7ede9f8768d5d0e70803d466ef506fe953f53057eb7e2f78009029d87b780c78127e1026b161bb095bf8c4ab24

          • C:\Users\Admin\AppData\Local\Temp\MW-159bbba6-10c5-49af-9326-6900b293f626\files\dbgeng.dll

            Filesize

            542KB

            MD5

            a1defa998f5984c7819cffd68664e00a

            SHA1

            9b0b17a2d660a2a51c8188186f394f8fe1650552

            SHA256

            abbb1d098f8ee24b0881278bee4228a59bb021242aba16af593c944c489e829f

            SHA512

            792ef593f78ffc453500f413640dee030bcf2bdd383697b01dc343f5e02e2b0f31b75ad68860fd7cfcae355e450e0d532ba99d1a912de7b47ced76fbc68fea24

          • C:\Users\Admin\AppData\Local\Temp\MW-159bbba6-10c5-49af-9326-6900b293f626\files\windbg.exe

            Filesize

            474KB

            MD5

            04ec4f58a1f4a87b5eeb1f4b7afc48e0

            SHA1

            58dcb1cbbec071d036a07f0e8feb858e4c5b96e7

            SHA256

            bd1af3dba56b129e6c624297eeed40c898fa2981fce5caafe467d88a748988a4

            SHA512

            5b572a504fac599e7e3f726d391e8ffdc2d083745609315a203000e8dc79b94d777fc520eb6530444d84f1ac9aad51406b91b527d8434077a58524feeccbbd80

          • C:\Users\Admin\AppData\Local\Temp\MW-159bbba6-10c5-49af-9326-6900b293f626\files\windbg.exe

            Filesize

            474KB

            MD5

            04ec4f58a1f4a87b5eeb1f4b7afc48e0

            SHA1

            58dcb1cbbec071d036a07f0e8feb858e4c5b96e7

            SHA256

            bd1af3dba56b129e6c624297eeed40c898fa2981fce5caafe467d88a748988a4

            SHA512

            5b572a504fac599e7e3f726d391e8ffdc2d083745609315a203000e8dc79b94d777fc520eb6530444d84f1ac9aad51406b91b527d8434077a58524feeccbbd80

          • C:\Users\Admin\AppData\Local\Temp\MW-159bbba6-10c5-49af-9326-6900b293f626\msiwrapper.ini

            Filesize

            1KB

            MD5

            703366dcde206069063835fa8b43a471

            SHA1

            b0a6d53a24c168a2dc59223b900ed192b82f37af

            SHA256

            01a7c25455ce0e3eb20f5877db6b60bfcb98f69b7f1b831e015eb3532b3ac62e

            SHA512

            f59d7c6ddbce2087a6a3652037e59964456653f710be2aff6130f180eb9767cd5cdd1d743613c6c688f778811326e7858bfa1bc05e43561f65dc9b299a292115

          • C:\Users\Admin\AppData\Local\Temp\MW-159bbba6-10c5-49af-9326-6900b293f626\msiwrapper.ini

            Filesize

            1KB

            MD5

            703366dcde206069063835fa8b43a471

            SHA1

            b0a6d53a24c168a2dc59223b900ed192b82f37af

            SHA256

            01a7c25455ce0e3eb20f5877db6b60bfcb98f69b7f1b831e015eb3532b3ac62e

            SHA512

            f59d7c6ddbce2087a6a3652037e59964456653f710be2aff6130f180eb9767cd5cdd1d743613c6c688f778811326e7858bfa1bc05e43561f65dc9b299a292115

          • C:\Windows\Installer\MSIB71F.tmp

            Filesize

            208KB

            MD5

            d82b3fb861129c5d71f0cd2874f97216

            SHA1

            f3fe341d79224126e950d2691d574d147102b18d

            SHA256

            107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

            SHA512

            244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

          • C:\temp\AutoIt3.exe

            Filesize

            872KB

            MD5

            c56b5f0201a3b3de53e561fe76912bfd

            SHA1

            2a4062e10a5de813f5688221dbeb3f3ff33eb417

            SHA256

            237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

            SHA512

            195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

          • C:\tmpa\Autoit3.exe

            Filesize

            872KB

            MD5

            c56b5f0201a3b3de53e561fe76912bfd

            SHA1

            2a4062e10a5de813f5688221dbeb3f3ff33eb417

            SHA256

            237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

            SHA512

            195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

          • \??\c:\temp\ahhebba.au3

            Filesize

            490KB

            MD5

            e6c14274f52c3de09b65c182807d6fe9

            SHA1

            5bd19f63092e62a0071af3bf031bea6fc8071cc8

            SHA256

            5fde42453eb2e4f1eef7cec5667093bd52d4712bffef4e383f154286b7ee9aa9

            SHA512

            7aa121c8d0d6f979c960882cd72a6c4766535bb277879b5040723fce3e206cc64df5c8438d5fe05e219796be4795cf25aacd13e91d8e0e24a58a17bd07f0ec4e

          • \??\c:\tmpa\AutoIt3.exe

            Filesize

            872KB

            MD5

            c56b5f0201a3b3de53e561fe76912bfd

            SHA1

            2a4062e10a5de813f5688221dbeb3f3ff33eb417

            SHA256

            237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

            SHA512

            195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

          • \??\c:\tmpa\script.au3

            Filesize

            490KB

            MD5

            e6c14274f52c3de09b65c182807d6fe9

            SHA1

            5bd19f63092e62a0071af3bf031bea6fc8071cc8

            SHA256

            5fde42453eb2e4f1eef7cec5667093bd52d4712bffef4e383f154286b7ee9aa9

            SHA512

            7aa121c8d0d6f979c960882cd72a6c4766535bb277879b5040723fce3e206cc64df5c8438d5fe05e219796be4795cf25aacd13e91d8e0e24a58a17bd07f0ec4e

          • \ProgramData\haaahce\Autoit3.exe

            Filesize

            872KB

            MD5

            c56b5f0201a3b3de53e561fe76912bfd

            SHA1

            2a4062e10a5de813f5688221dbeb3f3ff33eb417

            SHA256

            237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

            SHA512

            195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

          • \Users\Admin\AppData\Local\Temp\MW-159bbba6-10c5-49af-9326-6900b293f626\files\dbgeng.dll

            Filesize

            542KB

            MD5

            a1defa998f5984c7819cffd68664e00a

            SHA1

            9b0b17a2d660a2a51c8188186f394f8fe1650552

            SHA256

            abbb1d098f8ee24b0881278bee4228a59bb021242aba16af593c944c489e829f

            SHA512

            792ef593f78ffc453500f413640dee030bcf2bdd383697b01dc343f5e02e2b0f31b75ad68860fd7cfcae355e450e0d532ba99d1a912de7b47ced76fbc68fea24

          • \Users\Admin\AppData\Local\Temp\MW-159bbba6-10c5-49af-9326-6900b293f626\files\windbg.exe

            Filesize

            474KB

            MD5

            04ec4f58a1f4a87b5eeb1f4b7afc48e0

            SHA1

            58dcb1cbbec071d036a07f0e8feb858e4c5b96e7

            SHA256

            bd1af3dba56b129e6c624297eeed40c898fa2981fce5caafe467d88a748988a4

            SHA512

            5b572a504fac599e7e3f726d391e8ffdc2d083745609315a203000e8dc79b94d777fc520eb6530444d84f1ac9aad51406b91b527d8434077a58524feeccbbd80

          • \Users\Admin\AppData\Local\Temp\MW-159bbba6-10c5-49af-9326-6900b293f626\files\windbg.exe

            Filesize

            474KB

            MD5

            04ec4f58a1f4a87b5eeb1f4b7afc48e0

            SHA1

            58dcb1cbbec071d036a07f0e8feb858e4c5b96e7

            SHA256

            bd1af3dba56b129e6c624297eeed40c898fa2981fce5caafe467d88a748988a4

            SHA512

            5b572a504fac599e7e3f726d391e8ffdc2d083745609315a203000e8dc79b94d777fc520eb6530444d84f1ac9aad51406b91b527d8434077a58524feeccbbd80

          • \Users\Admin\AppData\Local\Temp\MW-159bbba6-10c5-49af-9326-6900b293f626\files\windbg.exe

            Filesize

            474KB

            MD5

            04ec4f58a1f4a87b5eeb1f4b7afc48e0

            SHA1

            58dcb1cbbec071d036a07f0e8feb858e4c5b96e7

            SHA256

            bd1af3dba56b129e6c624297eeed40c898fa2981fce5caafe467d88a748988a4

            SHA512

            5b572a504fac599e7e3f726d391e8ffdc2d083745609315a203000e8dc79b94d777fc520eb6530444d84f1ac9aad51406b91b527d8434077a58524feeccbbd80

          • \Users\Admin\AppData\Local\Temp\MW-159bbba6-10c5-49af-9326-6900b293f626\files\windbg.exe

            Filesize

            474KB

            MD5

            04ec4f58a1f4a87b5eeb1f4b7afc48e0

            SHA1

            58dcb1cbbec071d036a07f0e8feb858e4c5b96e7

            SHA256

            bd1af3dba56b129e6c624297eeed40c898fa2981fce5caafe467d88a748988a4

            SHA512

            5b572a504fac599e7e3f726d391e8ffdc2d083745609315a203000e8dc79b94d777fc520eb6530444d84f1ac9aad51406b91b527d8434077a58524feeccbbd80

          • \Windows\Installer\MSIB71F.tmp

            Filesize

            208KB

            MD5

            d82b3fb861129c5d71f0cd2874f97216

            SHA1

            f3fe341d79224126e950d2691d574d147102b18d

            SHA256

            107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

            SHA512

            244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

          • \tmpa\Autoit3.exe

            Filesize

            872KB

            MD5

            c56b5f0201a3b3de53e561fe76912bfd

            SHA1

            2a4062e10a5de813f5688221dbeb3f3ff33eb417

            SHA256

            237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

            SHA512

            195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

          • memory/984-165-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-208-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-226-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-225-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-145-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

            Filesize

            4KB

          • memory/984-146-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-224-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-222-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-150-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-148-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-152-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-223-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-221-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-157-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-158-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-220-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-219-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-218-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-217-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-166-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-167-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-168-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-169-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-170-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-171-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-172-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-173-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-174-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-175-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-176-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-177-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-178-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-179-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-180-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-181-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-182-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-183-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-184-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-194-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-195-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-196-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-197-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-198-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-199-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-200-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-201-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-203-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-202-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-204-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-205-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-206-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-207-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-216-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-209-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-211-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-210-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-212-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-213-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-215-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/984-214-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/1072-106-0x0000000000100000-0x000000000018D000-memory.dmp

            Filesize

            564KB

          • memory/1072-110-0x0000000000250000-0x0000000000350000-memory.dmp

            Filesize

            1024KB

          • memory/1072-117-0x0000000000100000-0x000000000018D000-memory.dmp

            Filesize

            564KB

          • memory/2920-142-0x0000000002F50000-0x000000000327A000-memory.dmp

            Filesize

            3.2MB

          • memory/2920-123-0x0000000000880000-0x0000000000C80000-memory.dmp

            Filesize

            4.0MB

          • memory/2920-124-0x0000000002F50000-0x000000000327A000-memory.dmp

            Filesize

            3.2MB

          • memory/2920-141-0x0000000002F50000-0x000000000327A000-memory.dmp

            Filesize

            3.2MB

          • memory/2920-149-0x0000000002F50000-0x000000000327A000-memory.dmp

            Filesize

            3.2MB

          • memory/2920-147-0x0000000000880000-0x0000000000C80000-memory.dmp

            Filesize

            4.0MB

          • memory/2920-144-0x0000000002F50000-0x000000000327A000-memory.dmp

            Filesize

            3.2MB

          • memory/2920-143-0x0000000002F50000-0x000000000327A000-memory.dmp

            Filesize

            3.2MB