darkgate | 1eff3c163f78ac2db6b1b3140f2c8995d60eb305698fde906628f7baee6628ba

Analysis

max time kernel
1799s
max time network
1800s
platform
windows11-21h2_x64
resource
win11-20231222-en
resource tags

arch:x64arch:x86image:win11-20231222-enlocale:en-usos:windows11-21h2-x64system
submitted
01/02/2024, 15:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

refurefy.msi
Size

4.2MB
MD5

e0e692aebaa2da2506ed840863673a8c
SHA1

8d2410aa0e2bc6b62cd4ef8a4278434661e62561
SHA256

1eff3c163f78ac2db6b1b3140f2c8995d60eb305698fde906628f7baee6628ba
SHA512

1521b7611f502fb1fec3667b26bff5b39d13e55cb942d2123bf90e28120782e9665de501b68d968b66a448c9a4a426be3431fbe287f2294010ab5273ef98acd5
SSDEEP

49152:npUPF9qhCxzT+WKjSX1ZzLVI4QWqyipO4+JtbjeYvd403NX9tmH3b3zB37irrrri:npoCQ1lLe7Wz1Jtbj9403NX9tmH3bjH

Score

10^/10

darkgate discovery persistence stealer

Malware Config

Signatures

DarkGate
DarkGate is an infostealer written in C++.
stealer darkgate

Detect DarkGate stealer 64 IoCs

resource	yara_rule
behavioral3/memory/3004-89-0x0000000005A10000-0x0000000005D5E000-memory.dmp	family_darkgate_v6
behavioral3/memory/2092-107-0x0000000003E60000-0x0000000004602000-memory.dmp	family_darkgate_v6
behavioral3/memory/3004-109-0x0000000005A10000-0x0000000005D5E000-memory.dmp	family_darkgate_v6
behavioral3/memory/2092-114-0x0000000003E60000-0x0000000004602000-memory.dmp	family_darkgate_v6
behavioral3/memory/2092-117-0x0000000003E60000-0x0000000004602000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-118-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2092-119-0x0000000003E60000-0x0000000004602000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-116-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-120-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-123-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2092-122-0x0000000003E60000-0x0000000004602000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-125-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-162-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-258-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2092-259-0x0000000003E60000-0x0000000004602000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-260-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-266-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-272-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-281-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-287-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-293-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-299-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-305-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-311-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-317-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-323-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-329-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-335-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-341-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-347-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-353-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-359-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-365-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-371-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-377-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-383-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-389-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-395-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-401-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-407-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-413-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-419-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-425-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-431-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-437-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-443-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-449-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-455-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-461-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-467-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-473-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-479-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-485-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-491-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-497-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-503-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-509-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-515-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-521-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-527-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-533-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-539-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-545-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral3/memory/2632-551-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2092 created 2772	2092	AcroRd32.exe	44

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4304	ICACLS.EXE
1904	ICACLS.EXE

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4286256601-2211319207-2237621277-1000\Software\Microsoft\Windows\CurrentVersion\Run\ccBhDFb = "C:\\ProgramData\\efabcce\\Autoit3.exe C:\\ProgramData\\efabcce\\bhdbdea.au3"	AcroRd32.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2092 set thread context of 2632	2092	AcroRd32.exe	103

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e575f46.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5C55F23A0C22B372.TMP	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	EXPAND.EXE
File created	C:\Windows\SystemTemp\~DFF02FA55CA32A6298.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{294A282C-18F8-47AC-8642-42D8BE1F09CF}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFEADDDE556385D7EF.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF042B4BAF410A679B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5FF2.tmp	msiexec.exe
File created	C:\Windows\Installer\e575f46.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	EXPAND.EXE

Executes dropped EXE 2 IoCs

pid	Process
4412	iTunesHelper.exe
3004	Autoit3.exe

Loads dropped DLL 2 IoCs

pid	Process
260	MsiExec.exe
4412	iTunesHelper.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000930f8a5de76563100000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000930f8a5d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900930f8a5d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d930f8a5d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000930f8a5d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	vbc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	vbc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Autoit3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Autoit3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4286256601-2211319207-2237621277-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4286256601-2211319207-2237621277-1000_Classes\Local Settings	Autoit3.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
1368	msiexec.exe
1368	msiexec.exe
3004	Autoit3.exe
3004	Autoit3.exe
3004	Autoit3.exe
3004	Autoit3.exe
2092	AcroRd32.exe
2092	AcroRd32.exe
2092	AcroRd32.exe
2092	AcroRd32.exe
2632	vbc.exe
2632	vbc.exe
2092	AcroRd32.exe
2092	AcroRd32.exe
2092	AcroRd32.exe
2092	AcroRd32.exe
2092	AcroRd32.exe
2092	AcroRd32.exe
2092	AcroRd32.exe
2092	AcroRd32.exe
2092	AcroRd32.exe
2092	AcroRd32.exe
2092	AcroRd32.exe
2092	AcroRd32.exe
2092	AcroRd32.exe
2092	AcroRd32.exe
2092	AcroRd32.exe
2092	AcroRd32.exe
2092	AcroRd32.exe
2092	AcroRd32.exe
2092	AcroRd32.exe
2092	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2092	AcroRd32.exe
2632	vbc.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeShutdownPrivilege	840	msiexec.exe
Token: SeIncreaseQuotaPrivilege	840	msiexec.exe
Token: SeSecurityPrivilege	1368	msiexec.exe
Token: SeCreateTokenPrivilege	840	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	840	msiexec.exe
Token: SeLockMemoryPrivilege	840	msiexec.exe
Token: SeIncreaseQuotaPrivilege	840	msiexec.exe
Token: SeMachineAccountPrivilege	840	msiexec.exe
Token: SeTcbPrivilege	840	msiexec.exe
Token: SeSecurityPrivilege	840	msiexec.exe
Token: SeTakeOwnershipPrivilege	840	msiexec.exe
Token: SeLoadDriverPrivilege	840	msiexec.exe
Token: SeSystemProfilePrivilege	840	msiexec.exe
Token: SeSystemtimePrivilege	840	msiexec.exe
Token: SeProfSingleProcessPrivilege	840	msiexec.exe
Token: SeIncBasePriorityPrivilege	840	msiexec.exe
Token: SeCreatePagefilePrivilege	840	msiexec.exe
Token: SeCreatePermanentPrivilege	840	msiexec.exe
Token: SeBackupPrivilege	840	msiexec.exe
Token: SeRestorePrivilege	840	msiexec.exe
Token: SeShutdownPrivilege	840	msiexec.exe
Token: SeDebugPrivilege	840	msiexec.exe
Token: SeAuditPrivilege	840	msiexec.exe
Token: SeSystemEnvironmentPrivilege	840	msiexec.exe
Token: SeChangeNotifyPrivilege	840	msiexec.exe
Token: SeRemoteShutdownPrivilege	840	msiexec.exe
Token: SeUndockPrivilege	840	msiexec.exe
Token: SeSyncAgentPrivilege	840	msiexec.exe
Token: SeEnableDelegationPrivilege	840	msiexec.exe
Token: SeManageVolumePrivilege	840	msiexec.exe
Token: SeImpersonatePrivilege	840	msiexec.exe
Token: SeCreateGlobalPrivilege	840	msiexec.exe
Token: SeBackupPrivilege	4388	vssvc.exe
Token: SeRestorePrivilege	4388	vssvc.exe
Token: SeAuditPrivilege	4388	vssvc.exe
Token: SeBackupPrivilege	1368	msiexec.exe
Token: SeRestorePrivilege	1368	msiexec.exe
Token: SeRestorePrivilege	1368	msiexec.exe
Token: SeTakeOwnershipPrivilege	1368	msiexec.exe
Token: SeRestorePrivilege	1368	msiexec.exe
Token: SeTakeOwnershipPrivilege	1368	msiexec.exe
Token: SeBackupPrivilege	4560	srtasks.exe
Token: SeRestorePrivilege	4560	srtasks.exe
Token: SeSecurityPrivilege	4560	srtasks.exe
Token: SeTakeOwnershipPrivilege	4560	srtasks.exe
Token: SeBackupPrivilege	4560	srtasks.exe
Token: SeRestorePrivilege	4560	srtasks.exe
Token: SeSecurityPrivilege	4560	srtasks.exe
Token: SeTakeOwnershipPrivilege	4560	srtasks.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
840	msiexec.exe
840	msiexec.exe
2092	AcroRd32.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2092	AcroRd32.exe
2092	AcroRd32.exe
2092	AcroRd32.exe
2092	AcroRd32.exe
2092	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 4560	1368	msiexec.exe	86
PID 1368 wrote to memory of 4560	1368	msiexec.exe	86
PID 1368 wrote to memory of 260	1368	msiexec.exe	88
PID 1368 wrote to memory of 260	1368	msiexec.exe	88
PID 1368 wrote to memory of 260	1368	msiexec.exe	88
PID 260 wrote to memory of 4304	260	MsiExec.exe	89
PID 260 wrote to memory of 4304	260	MsiExec.exe	89
PID 260 wrote to memory of 4304	260	MsiExec.exe	89
PID 260 wrote to memory of 1808	260	MsiExec.exe	91
PID 260 wrote to memory of 1808	260	MsiExec.exe	91
PID 260 wrote to memory of 1808	260	MsiExec.exe	91
PID 260 wrote to memory of 4412	260	MsiExec.exe	93
PID 260 wrote to memory of 4412	260	MsiExec.exe	93
PID 4412 wrote to memory of 3004	4412	iTunesHelper.exe	95
PID 4412 wrote to memory of 3004	4412	iTunesHelper.exe	95
PID 4412 wrote to memory of 3004	4412	iTunesHelper.exe	95
PID 260 wrote to memory of 548	260	MsiExec.exe	98
PID 260 wrote to memory of 548	260	MsiExec.exe	98
PID 260 wrote to memory of 548	260	MsiExec.exe	98
PID 260 wrote to memory of 1904	260	MsiExec.exe	101
PID 260 wrote to memory of 1904	260	MsiExec.exe	101
PID 260 wrote to memory of 1904	260	MsiExec.exe	101
PID 3004 wrote to memory of 2092	3004	Autoit3.exe	102
PID 3004 wrote to memory of 2092	3004	Autoit3.exe	102
PID 3004 wrote to memory of 2092	3004	Autoit3.exe	102
PID 3004 wrote to memory of 2092	3004	Autoit3.exe	102
PID 2092 wrote to memory of 2632	2092	AcroRd32.exe	103
PID 2092 wrote to memory of 2632	2092	AcroRd32.exe	103
PID 2092 wrote to memory of 2632	2092	AcroRd32.exe	103
PID 2092 wrote to memory of 2632	2092	AcroRd32.exe	103
PID 2092 wrote to memory of 2632	2092	AcroRd32.exe	103
PID 2092 wrote to memory of 3152	2092	AcroRd32.exe	104
PID 2092 wrote to memory of 3152	2092	AcroRd32.exe	104
PID 2092 wrote to memory of 3152	2092	AcroRd32.exe	104
PID 3152 wrote to memory of 3332	3152	RdrCEF.exe	106
PID 3152 wrote to memory of 3332	3152	RdrCEF.exe	106
PID 3152 wrote to memory of 3332	3152	RdrCEF.exe	106
PID 3152 wrote to memory of 3332	3152	RdrCEF.exe	106
PID 3152 wrote to memory of 3332	3152	RdrCEF.exe	106
PID 3152 wrote to memory of 3332	3152	RdrCEF.exe	106
PID 3152 wrote to memory of 3332	3152	RdrCEF.exe	106
PID 3152 wrote to memory of 3332	3152	RdrCEF.exe	106
PID 3152 wrote to memory of 3332	3152	RdrCEF.exe	106
PID 3152 wrote to memory of 3332	3152	RdrCEF.exe	106
PID 3152 wrote to memory of 3332	3152	RdrCEF.exe	106
PID 3152 wrote to memory of 3332	3152	RdrCEF.exe	106
PID 3152 wrote to memory of 3332	3152	RdrCEF.exe	106
PID 3152 wrote to memory of 3332	3152	RdrCEF.exe	106
PID 3152 wrote to memory of 3332	3152	RdrCEF.exe	106
PID 3152 wrote to memory of 3332	3152	RdrCEF.exe	106
PID 3152 wrote to memory of 3332	3152	RdrCEF.exe	106
PID 3152 wrote to memory of 3332	3152	RdrCEF.exe	106
PID 3152 wrote to memory of 3332	3152	RdrCEF.exe	106
PID 3152 wrote to memory of 3332	3152	RdrCEF.exe	106
PID 3152 wrote to memory of 3332	3152	RdrCEF.exe	106
PID 3152 wrote to memory of 3332	3152	RdrCEF.exe	106
PID 3152 wrote to memory of 3332	3152	RdrCEF.exe	106
PID 3152 wrote to memory of 3332	3152	RdrCEF.exe	106
PID 3152 wrote to memory of 3332	3152	RdrCEF.exe	106
PID 3152 wrote to memory of 3332	3152	RdrCEF.exe	106
PID 3152 wrote to memory of 3332	3152	RdrCEF.exe	106
PID 3152 wrote to memory of 3332	3152	RdrCEF.exe	106
PID 3152 wrote to memory of 3332	3152	RdrCEF.exe	106
PID 3152 wrote to memory of 3332	3152	RdrCEF.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2772
- \??\c:\windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  c:\windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2632

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\refurefy.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:840

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4560
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A05D070C8CD97A524EB2494A402CA751
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:260
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-23bc4574-dc5e-42e3-ade9-76e3cc5ddeaa\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    PID:4304
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    PID:1808
- - C:\Users\Admin\AppData\Local\Temp\MW-23bc4574-dc5e-42e3-ade9-76e3cc5ddeaa\files\iTunesHelper.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-23bc4574-dc5e-42e3-ade9-76e3cc5ddeaa\files\iTunesHelper.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4412
  - - \??\c:\temp\Autoit3.exe
      "c:\temp\Autoit3.exe" c:\temp\script.au3
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3004
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\temp\Overdue Account Letter Feb 13, 2023.pdf"
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Checks processor information in registry
        Modifies Internet Explorer settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2092
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3152
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=90101C67982A01D81886C109105D74BF --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=90101C67982A01D81886C109105D74BF --renderer-client-id=2 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job /prefetch:1
        7⤵
        
        PID:1552
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=903BEFABC54E6236FCEE512BE56896AA --mojo-platform-channel-handle=1756 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        7⤵
        
        PID:3332
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6383427E8A4B0F62EC6A233BC7BC856E --mojo-platform-channel-handle=2300 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        7⤵
        
        PID:2952
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=632CA2D6E095DD8F5F04FE504EF7E9EE --mojo-platform-channel-handle=2352 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        7⤵
        
        PID:2244
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C332723741B55E5FDF13F5DDDD4CD64A --mojo-platform-channel-handle=1920 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        7⤵
        
        PID:3044
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=A89CDB93B72453A9102138BA6D1A211E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=A89CDB93B72453A9102138BA6D1A211E --renderer-client-id=7 --mojo-platform-channel-handle=2368 --allow-no-sandbox-job /prefetch:1
        7⤵
        
        PID:500
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\MW-23bc4574-dc5e-42e3-ade9-76e3cc5ddeaa\files"
    3⤵
    PID:548
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-23bc4574-dc5e-42e3-ade9-76e3cc5ddeaa\." /SETINTEGRITYLEVEL (CI)(OI)LOW
    3⤵
    - Modifies file permissions
    PID:1904

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\efabcce\bhdbdea.au3

Filesize
907KB

MD5
158c76e3e09819ed5aeeb52a7182621d

SHA1
e0a744e0319bb4ca2d274b641ae0b05160d78f72

SHA256
89e643b280af63e6b166a4da96c80771ac78f72cb2bb22af9493163cf97770ba

SHA512
7bbdbfbb35770247491155fce70247d52833f4790c8b7422907b439d08f024da144c97f94c9433ab891135fd9c76c23130e25c60441093c49878d706f2bd472a

Download Submit
C:\ProgramData\efabcce\dgakedd

Filesize
1KB

MD5
823610c314d38f41dadbf6071ed31557

SHA1
646a0c24bc62a8cc01f24dcde012cc078959baac

SHA256
bc4ae6f1197e8b26e98a4d917605ba73cfb5a6ed2cb77b734af7ddfc6ddfe9ae

SHA512
ce2bd44da33ee07b32760db1acf305c9de51f2239b1a4ff314f41b979ab3964b9918752acf4fee22a2ab22fa68b46846e4d9af9a56b4d39c3880fc83407ce26e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
21KB

MD5
10f0ab6c003fb837447d7c86685c0c48

SHA1
f39a080ea374ec99b8c3056d64c6a1b7f7cf5e08

SHA256
93369c6867f197cf60ca42efefe80e85fb074c00e6243b6780f038ce5aec15ac

SHA512
e44ab2edf3c3310c925bf8e37570b469fb65a880321bd24d84c8cb9cb6731aefc74463a53d2e34739f310856ea3e6e434a9279dd8104ea9d3db92de6d571eab5

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
16e1f6b6e135673914329eb57fb22b35

SHA1
7dfb8301ead8af837012cfa9c649f0871510fafb

SHA256
6e0dfd14555af3afcc9c582144fa8dc7286b117d4d61ea5cfc513a40dc2ff131

SHA512
f93e54c65841b26f20adc529eb53b75b1985cd13db42773b31a1839bb010652e6c944702801d7720e05080becaa05df57c0c6998416c2693264b07823186a4f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-23bc4574-dc5e-42e3-ade9-76e3cc5ddeaa\files.cab

Filesize
3.0MB

MD5
36733a3d7ff444bc8594de947968dc89

SHA1
523e4d5f63a1b74a1604c7febb0c0259b29fa360

SHA256
bc887ab1e809213b575ca2bd6eaae4a30f2cbd49222e3127eeb79ffe280ebbef

SHA512
43264a47e29c81c0f8b9bfd7323b2d1f2ac3746ade77d8fbbfa611467a8ce0263e7bb9e3378732a389e3d0ed9c39c7c49b8161b265a448746ed10455785f8b65

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-23bc4574-dc5e-42e3-ade9-76e3cc5ddeaa\files\CoreFoundation.dll

Filesize
1.0MB

MD5
0d7a4cd949b5e3e3825d56b420f14ca4

SHA1
dca57312a1c1d205d6cb9c0d30e574e6fa2072b3

SHA256
9590f742e14146d8e58fd12dd2b6df6bc47ab6ee8ab1aef3762a7ff888182fe1

SHA512
54eefe738a81f7b02afa5b7751c3d4125a65ac6973f433edb28841d1bb0fb325279cf981f796f7bb47fc24ea1280c2d7564b3a857bddff5f05662782f94eb18c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-23bc4574-dc5e-42e3-ade9-76e3cc5ddeaa\files\CoreFoundation.dll

Filesize
986KB

MD5
f96aa2f45eca4d91a58aef6e1f6ee380

SHA1
da69da70bdc381fe2a3bd93eb45844c411224f10

SHA256
6e38536c0dd46ef2745cc1b2b89aff83b0a1fb76f0f1862484190c61a316a972

SHA512
b0ef54acd426099497f431b776b7c3f04963324dc034a4df87ac3222e1560cafec84bd72e4df60d3a7d913c89d0d9e4931026f81bd068897eb680adb549a78d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-23bc4574-dc5e-42e3-ade9-76e3cc5ddeaa\files\iTunesHelper.exe

Filesize
358KB

MD5
ed6a1c72a75dee15a6fa75873cd64975

SHA1
67a15ca72e3156f8be6c46391e184087e47f4a0d

SHA256
0d8878cca08903777888b3681f90e4a07c7aef7d9600a67dfa985844d4bf5eda

SHA512
256c2ebfeb42c2d3340d8bb423ef0ae48d5fb9fe5ca09c363595f51a03007482b67a777e4cae7a8194f69bc3a3fbcdb9abb5c9f92097925272431bb9d50f5c03

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-23bc4574-dc5e-42e3-ade9-76e3cc5ddeaa\files\sqlite3.dll

Filesize
801KB

MD5
501fa0fbb866e58c032f77e4c52cc0c6

SHA1
af092567120f0b41d382272d994eb3de78d0de26

SHA256
d74bb2fbc635692c7511489b4866ce9c72142248aefa16f73c5d53b59016353f

SHA512
3d7b628563704548e623c2a517f5aa167da61bf79941b394211026f0d9bdb8e650e9255db68ce6345699542a83a6e43e2a82d26fc7b974ec7502e1756fda02d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-23bc4574-dc5e-42e3-ade9-76e3cc5ddeaa\msiwrapper.ini

Filesize
1KB

MD5
01f360f942cc798c6fe3517768f1d6d8

SHA1
46fd91f1ebd4f1eabce53230a147e39bd5d23029

SHA256
793f719e5c764feb1651aff033b1e923e6716298328cfd3ba2fea3ddf4276db3

SHA512
3b458aebcbdc0f060ce0f24dfcaaf7607a85a3272943a3da703c242d1f31dadb9062f6fb7467824aa7b0d352fea06a05f149709785c3a3e72f112c4a97c1052f

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-23bc4574-dc5e-42e3-ade9-76e3cc5ddeaa\msiwrapper.ini

Filesize
1KB

MD5
f5e476f67d5266c31e807a9d3624429f

SHA1
2f048c43fcbc444889590caa9eb8dd37eaec2741

SHA256
6c1ce166624907043edb02d4ef74287ae83629eec776d169433988ebd288962c

SHA512
2e345ec575d70c04115639531c17a0c3ce094de46c50448bd3fc759a323b5aed95f97d38779260ec2c4d4055bc80c9f3f67492562b844ef068ab8638ef893ab2

Download Submit
C:\Users\Admin\AppData\Roaming\ccBhDFb

Filesize
32B

MD5
0414efb75349a4d8f83612bc069dc273

SHA1
d52c57a679b2695b53557ad798907baac09630b2

SHA256
2be8d204e4d2fb498f24d8f05774f4472031f3ba2ec48708049699dc8636ee28

SHA512
35e70eead964a2118b95eb874eec2aae78b7990d882d57c292e9a6fb0cf38e84357e8dd77ace07985dd72a7fcc8de03c101a2d42e46e5fdef876fc34fd248440

Download Submit
C:\Windows\Installer\MSI5FF2.tmp

Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
C:\temp\Autoit3.exe

Filesize
671KB

MD5
573280a4584734556775875388302598

SHA1
ebb014125027451d6225c6935c8942dabff370fc

SHA256
276c66e774c02b765c890a59707368d048abbba71b047375a89e68e5dd588e3b

SHA512
162d59cfbea9430dbc3e3af63f162636524f479ff43c766ffcafce7fb48b7b7e8a71091d7ceb3fccc01a8230f68a83900336ab0816438face879beeafba28ffc

Download Submit
C:\temp\Overdue Account Letter Feb 13, 2023.pdf

Filesize
330KB

MD5
8c1721e9249b7b2aea4a6f4270d14420

SHA1
aa5b2c59d1f1e082e41c2d23d806c11a6ce8fced

SHA256
370d9a78649f181edbc0ca8026ce9caa415b99dbf8acfd90f64a9b9de370e0d5

SHA512
910584b2e034c2f02963754f982b31bdf8303f6f598badfc870c637219d70fa5413d3fbeca30bb5c4f2a9906469a9128ad4d048848bda71e7366e006e446bcf5

Download Submit
C:\temp\cc.txt

Filesize
4B

MD5
254872a52d6847fa0f322983f0cca559

SHA1
24c1d179d715a3ee074aa91eeab74548ad2a8cd7

SHA256
5d0b4aa2c5a01698c7d70ad60c9cab292e2058fdb8d80a38fd8c7548c9c36ede

SHA512
ef8a668885df3c9b29821260b9eccff73cf49cbe5d800dfe9ddae8ac822962ca4e00d05b234b5fb36319bfaf99c68a67d50118befa5ecbf56c86db2dd7028b81

Download Submit
C:\temp\fs.txt

Filesize
4B

MD5
2cd46e7acf790dc33aa20f9dbb9fffda

SHA1
1e3c52d91de1eae149e9193d272cc6ca33539659

SHA256
c5499a9e4adf26dd72f005a1d8de67a3b08d0a5dfd9fad9e0b9488ea021f7c79

SHA512
4195ad0eda68e9f90bf4401abd7b51d1fdf684ac8075fdd9724d96d730d6a87dceb30aad82f956855018e3a51c3fef593f013e53bbe295a34c0052589280d7b2

Download Submit
C:\temp\lp.txt

Filesize
4B

MD5
801272ee79cfde7fa5960571fee36b9b

SHA1
3895a2d047f5d2c14122cb86a71d3172139ad644

SHA256
7fd052bd76eb71475b03f997dbdf5adf8c440ac0a6e1fced23a3d6b81826b103

SHA512
4030edca8e0e1d23dfbe3a7a4f30a4ff1d1e1338d6b8c9c8ba92370b9f2205605630679fbb95622d2318351bdf30c0987a6a245383c319ff5413e421f6e18283

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
1.4MB

MD5
fcada620244fd0f4e3ad2fbf1aaed1ab

SHA1
9e8747664f5d41eb4382b278a5a7ec0b31d45128

SHA256
d6ae968e893b4207920df5b3f30431a847c62e38de3823892befaeca39cfa542

SHA512
4398b33e3064754d8c0e4a467bc6dcee0ed5f9e7eda6a06454f7ef6a4318111f13629b004d74307564ed3baa41613aad879f0fd57b4852e60e0429b60ddec334

Download Submit
\??\Volume{5d8a0f93-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{6ecab120-5855-40d5-86a1-bd27e2fb47dc}_OnDiskSnapshotProp

Filesize
6KB

MD5
a1e9b6e0e1dccec71f7fd432fed74589

SHA1
b8c29f3f866f7a050292d51bad26361b23684924

SHA256
fe25304c6203bcac2de1e20ffc1e35ece02a00d6238a0ec4b4ce42dbb04989b2

SHA512
a7fca2f0b1d1b74f77cabedc8fb760c02559cf70354ae07400335c4a3a8aa7b936c2445a39e19843ef04040dedf5b7858975d77f47dfdb9a7699d8c3ff6b0365

Download Submit
\??\c:\temp\Autoit3.exe

Filesize
444KB

MD5
5a7c58de58b5980911448811be14e9c3

SHA1
bdb78c3501e4064643a14714eb540c79345b7534

SHA256
4733b3116c81898aa52cc47f82d5550ddc7f700317c8f59ba344761c197022de

SHA512
1181cd34f20568ce51fd0c1479aa2bfd06de6e01fd2b58704eb385ab5afbcdddf92890064d39fa41e55539d178e33366d11b4629be0bf1dce7c8d5b65f9ba16e

Download Submit
\??\c:\temp\script.au3

Filesize
872KB

MD5
d860f4e78ffe4e5c77222042ba07d468

SHA1
c1ed7ab732fd29d2560187230335d33adbc00833

SHA256
ab9d18b25ca5bcde183d70cd7467bf8d1a00796fe26f83e38ab1d9253ef85c67

SHA512
9541ee57a45ea0fbf212a2ac205e87b202ae21c155637cc04adca6024867f5f888b487e9ec38a434cc8ca7800a4e0ce331bd2579e06795c0eba7bbd39b7a978b

Download Submit
\??\c:\temp\test.txt

Filesize
76B

MD5
dd1c5f83309a94272996a07fcff8734d

SHA1
49e1d44a0a18668407abf825dba95cc8204ed359

SHA256
eaab4bcfc55463f2ba708eba2e3e4a707c6e75513d5b9e84075b89979ea132be

SHA512
10563c675cfa2b1133ac3c3624f142c35064494af052eb031ab7c82cbfc688e44e00e7095d84dc047b294ae5f9f98cc67cb3139453049ada7e7dbb60869cfbf5

Download Submit
memory/2092-104-0x00000000029D0000-0x00000000029D1000-memory.dmp

Filesize
4KB

Download
memory/2092-107-0x0000000003E60000-0x0000000004602000-memory.dmp

Filesize
7.6MB

Download
memory/2092-114-0x0000000003E60000-0x0000000004602000-memory.dmp

Filesize
7.6MB

Download
memory/2092-117-0x0000000003E60000-0x0000000004602000-memory.dmp

Filesize
7.6MB

Download
memory/2092-259-0x0000000003E60000-0x0000000004602000-memory.dmp

Filesize
7.6MB

Download
memory/2092-119-0x0000000003E60000-0x0000000004602000-memory.dmp

Filesize
7.6MB

Download
memory/2092-122-0x0000000003E60000-0x0000000004602000-memory.dmp

Filesize
7.6MB

Download
memory/2632-287-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-383-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-123-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-116-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-125-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-118-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-569-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-162-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-563-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-557-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-551-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-258-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-545-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-260-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-266-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-272-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-281-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-539-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-293-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-299-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-305-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-311-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-317-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-323-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-329-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-335-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-341-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-347-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-353-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-359-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-365-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-371-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-377-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-120-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-389-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-395-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-401-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-407-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-413-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-419-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-425-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-431-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-437-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-443-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-449-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-455-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-461-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-467-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-473-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-479-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-485-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-491-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-497-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-503-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-509-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-515-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-521-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-527-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2632-533-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3004-89-0x0000000005A10000-0x0000000005D5E000-memory.dmp

Filesize
3.3MB

Download
memory/3004-87-0x0000000004180000-0x0000000005150000-memory.dmp

Filesize
15.8MB

Download
memory/3004-109-0x0000000005A10000-0x0000000005D5E000-memory.dmp

Filesize
3.3MB

Download
memory/4412-77-0x0000014302CD0000-0x0000014302EDC000-memory.dmp

Filesize
2.0MB

Download
memory/4412-86-0x0000000077AA0000-0x0000000077C3D000-memory.dmp

Filesize
1.6MB

Download
memory/4412-88-0x0000014302CD0000-0x0000014302EDC000-memory.dmp

Filesize
2.0MB

Download