darkgate | d6d80231325c39b421d06eb3224ed54d958c1d643d961048176f2a93eecbb524

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10/02/2024, 17:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
freackinghydt.msi
Size 7.4MB
Sample240210-wcsejaef7w
SHA256 d6d80231325c39b421d06eb3224ed54d958c1d643d961048176f2a93eecbb524
MD5 e710dec0c27155f0025e97e4d0f08e20
SHA1 d6e84785163375e534ef0eec57b49a0379a58191
SHA512 270ff05e36284effc04fb9ce3a446e6f5f1dc41413618b7280364acb6a62e8412120234bafff1bd911c23c9694a5f5c4f4a00f1888da79b2fb641a2102fa9b11
SSDEEP 98304:mpp39PdVoYFhybZg4MqrdvwxLm6few5F0Qz5:SPdVoYFhaq4Mqrdvwxy0P5V
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkgate discovery stealer

Malware Config

Signatures

DarkGate
DarkGate is an infostealer written in C++.
stealer darkgate

Detect DarkGate stealer 2 IoCs

resource	yara_rule
behavioral2/memory/3088-91-0x0000000005CB0000-0x0000000005FFE000-memory.dmp	family_darkgate_v6
behavioral2/memory/3088-94-0x0000000005CB0000-0x0000000005FFE000-memory.dmp	family_darkgate_v6

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4248	ICACLS.EXE
3916	ICACLS.EXE

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e58056a.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{CFFA1B5C-73A6-4FCE-801B-0957D7A01EAD}	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	EXPAND.EXE
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	EXPAND.EXE
File opened for modification	C:\Windows\Installer\e58056a.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6B2.tmp	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
4528	NVIDIA Share.exe
3088	Autoit3.exe

Loads dropped DLL 2 IoCs

pid	Process
3096	MsiExec.exe
4528	NVIDIA Share.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000004a3253d230439a9b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800004a3253d20000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809004a3253d2000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d4a3253d2000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000004a3253d200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Autoit3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Autoit3.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3708	msiexec.exe
3708	msiexec.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1120	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1120	msiexec.exe
Token: SeSecurityPrivilege	3708	msiexec.exe
Token: SeCreateTokenPrivilege	1120	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1120	msiexec.exe
Token: SeLockMemoryPrivilege	1120	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1120	msiexec.exe
Token: SeMachineAccountPrivilege	1120	msiexec.exe
Token: SeTcbPrivilege	1120	msiexec.exe
Token: SeSecurityPrivilege	1120	msiexec.exe
Token: SeTakeOwnershipPrivilege	1120	msiexec.exe
Token: SeLoadDriverPrivilege	1120	msiexec.exe
Token: SeSystemProfilePrivilege	1120	msiexec.exe
Token: SeSystemtimePrivilege	1120	msiexec.exe
Token: SeProfSingleProcessPrivilege	1120	msiexec.exe
Token: SeIncBasePriorityPrivilege	1120	msiexec.exe
Token: SeCreatePagefilePrivilege	1120	msiexec.exe
Token: SeCreatePermanentPrivilege	1120	msiexec.exe
Token: SeBackupPrivilege	1120	msiexec.exe
Token: SeRestorePrivilege	1120	msiexec.exe
Token: SeShutdownPrivilege	1120	msiexec.exe
Token: SeDebugPrivilege	1120	msiexec.exe
Token: SeAuditPrivilege	1120	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1120	msiexec.exe
Token: SeChangeNotifyPrivilege	1120	msiexec.exe
Token: SeRemoteShutdownPrivilege	1120	msiexec.exe
Token: SeUndockPrivilege	1120	msiexec.exe
Token: SeSyncAgentPrivilege	1120	msiexec.exe
Token: SeEnableDelegationPrivilege	1120	msiexec.exe
Token: SeManageVolumePrivilege	1120	msiexec.exe
Token: SeImpersonatePrivilege	1120	msiexec.exe
Token: SeCreateGlobalPrivilege	1120	msiexec.exe
Token: SeBackupPrivilege	4352	vssvc.exe
Token: SeRestorePrivilege	4352	vssvc.exe
Token: SeAuditPrivilege	4352	vssvc.exe
Token: SeBackupPrivilege	3708	msiexec.exe
Token: SeRestorePrivilege	3708	msiexec.exe
Token: SeRestorePrivilege	3708	msiexec.exe
Token: SeTakeOwnershipPrivilege	3708	msiexec.exe
Token: SeRestorePrivilege	3708	msiexec.exe
Token: SeTakeOwnershipPrivilege	3708	msiexec.exe
Token: SeBackupPrivilege	4664	srtasks.exe
Token: SeRestorePrivilege	4664	srtasks.exe
Token: SeSecurityPrivilege	4664	srtasks.exe
Token: SeTakeOwnershipPrivilege	4664	srtasks.exe
Token: SeBackupPrivilege	4664	srtasks.exe
Token: SeRestorePrivilege	4664	srtasks.exe
Token: SeSecurityPrivilege	4664	srtasks.exe
Token: SeTakeOwnershipPrivilege	4664	srtasks.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1120	msiexec.exe
1120	msiexec.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 3708 wrote to memory of 4664	3708	msiexec.exe	95
PID 3708 wrote to memory of 4664	3708	msiexec.exe	95
PID 3708 wrote to memory of 3096	3708	msiexec.exe	97
PID 3708 wrote to memory of 3096	3708	msiexec.exe	97
PID 3708 wrote to memory of 3096	3708	msiexec.exe	97
PID 3096 wrote to memory of 4248	3096	MsiExec.exe	98
PID 3096 wrote to memory of 4248	3096	MsiExec.exe	98
PID 3096 wrote to memory of 4248	3096	MsiExec.exe	98
PID 3096 wrote to memory of 1920	3096	MsiExec.exe	100
PID 3096 wrote to memory of 1920	3096	MsiExec.exe	100
PID 3096 wrote to memory of 1920	3096	MsiExec.exe	100
PID 3096 wrote to memory of 4528	3096	MsiExec.exe	102
PID 3096 wrote to memory of 4528	3096	MsiExec.exe	102
PID 4528 wrote to memory of 3088	4528	NVIDIA Share.exe	103
PID 4528 wrote to memory of 3088	4528	NVIDIA Share.exe	103
PID 4528 wrote to memory of 3088	4528	NVIDIA Share.exe	103
PID 3096 wrote to memory of 2064	3096	MsiExec.exe	107
PID 3096 wrote to memory of 2064	3096	MsiExec.exe	107
PID 3096 wrote to memory of 2064	3096	MsiExec.exe	107
PID 3096 wrote to memory of 3916	3096	MsiExec.exe	109
PID 3096 wrote to memory of 3916	3096	MsiExec.exe	109
PID 3096 wrote to memory of 3916	3096	MsiExec.exe	109

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\freackinghydt.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1120

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4664
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D3ED20C2A252B5816C882D74F1495D18
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3096
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-40194eaf-8fad-4f14-8c44-6474381b9cf2\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    PID:4248
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    PID:1920
- - C:\Users\Admin\AppData\Local\Temp\MW-40194eaf-8fad-4f14-8c44-6474381b9cf2\files\NVIDIA Share.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-40194eaf-8fad-4f14-8c44-6474381b9cf2\files\NVIDIA Share.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4528
  - - \??\c:\temp\Autoit3.exe
      "c:\temp\Autoit3.exe" c:\temp\script.au3
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      PID:3088
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\MW-40194eaf-8fad-4f14-8c44-6474381b9cf2\files"
    3⤵
    PID:2064
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-40194eaf-8fad-4f14-8c44-6474381b9cf2\." /SETINTEGRITYLEVEL (CI)(OI)LOW
    3⤵
    - Modifies file permissions
    PID:3916

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

files.cab

Path C:\Users\Admin\AppData\Local\Temp\MW-40194eaf-8fad-4f14-8c44-6474381b9cf2\files.cab
Size 3.9MB
SHA256 7bfebd411d108a9bb6ddaa7e9d49b1ff1ad9135b0ca17c1025c4cb33e57499e4
MD5 03f51b019e314f7c201488d5792a49b7
SHA1 6238170dbd18db8647da70e594e0089059349c35
SHA512 89019c19920167529a7e10bea8d58e35829bac133a8013ef208ab09ec8ff6ae05b15c79049d380d044e9971783a40f66a2fc6c9098b48d79200976d888ff33aa
SSDEEP 49152:zaO3Zdd2I4V7sOqh+bzYVmxxSUjxkLe0oygIjTDqxGL5No7YXF0vkBy2IM:r39PdVoYFhy0
MD5 SHA1 SHA512 SSDEEP

Submit Download

CHROME~1.DLL

Path C:\Users\Admin\AppData\Local\Temp\MW-40194eaf-8fad-4f14-8c44-6474381b9cf2\files\CHROME~1.DLL
Size 798KB
SHA256 37647fd7d25efcaea277cc0a5df5bcf502d32312d16809d4fd2b86eebcfe1a5b
MD5 1dc385972231a936352505a9e651055f
SHA1 d5742907e488ec04daec5042173e4090fe67925d
SHA512 664b666b52f9c7e2e0f44c85ef4c22b302f89f1346a8209bfe84956829c952c956fb05064f29fd2eff38456ce55ac5a5422bb302f8d9b9e1f0442a28164307d8
SSDEEP 12288:mRR71sLqzaNgtqBO3encckBdLC7bcTGT350fQq/RGVn8mnQo1E5:CGeaO3EqdLCBOfQqpGV8rCM
MD5 SHA1 SHA512 SSDEEP

Submit Download

NVIDIA Share.exe

Path C:\Users\Admin\AppData\Local\Temp\MW-40194eaf-8fad-4f14-8c44-6474381b9cf2\files\NVIDIA Share.exe
Size 2.6MB
SHA256 0e3f5fda71b47655155cb8281cdf7d67af58df7cae35af936ae6fb2e345fdbe4
MD5 d17014721410d6627fc8a7e8e43b45d4
SHA1 c01cf25fe651fd3bd3c56655b6c893f4bfc04950
SHA512 93830e8cde5bb11d708871408c2c90e76c90c27da5c8a406c512500cf2b288c20bab11862ecb199df8f7d9b8a03a0c1ecf94cc703596d1ab24ecd16d301ad474
SSDEEP 49152:yIzHxHCygXjTDCxGLBJo7S7lYzkZ52Ia4+bZZEMVxK:Y7V5AbZ6MbK
MD5 SHA1 SHA512 SSDEEP

Submit Download

NVIDIA Share.exe

Path C:\Users\Admin\AppData\Local\Temp\MW-40194eaf-8fad-4f14-8c44-6474381b9cf2\files\NVIDIA Share.exe
Size 1.6MB
SHA256 2cfcd3a6fb615f437bfd13a986454ba3140149d550fe50665751012d437e50dd
MD5 4ec90a348e7d83d279a9942f63cc6abd
SHA1 fc311259c5d4f0859fb426dd09bd91b56f094fcf
SHA512 8c71aaaa289a1f3a0fa0421062f5886587947fb658adcafcb07db7a08753ff31d6375c5e49659a12a45897d6591e912ac8f0b62b594453a8721280f4f176dc72
SSDEEP 24576:yIzHxE2+7ugFQLeygUSjTDCwGGLV3brJo7oSE7V55P0TPZFknxb52ID:yIzHxHCygXjTDCxGLBJo7S7lYzkZ52ID
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcef.dll

Path C:\Users\Admin\AppData\Local\Temp\MW-40194eaf-8fad-4f14-8c44-6474381b9cf2\files\libcef.dll
Size 1.5MB
SHA256 2233322d30d35f1fb4205dd15e4af94ac8e12afc4669ae708eb232d28b3a4ba4
MD5 d039256ab8a19cafd9a627658db065c2
SHA1 1816991322461460525214c567d690e936015853
SHA512 7b038125a4d7d1364c9dd08eb9050e4b61f507b62565fa2098835101904b296a043c14e634e6e9f5a17a7ab399b8476e3c4dedbcdbcd8ff0a83066b91ae622a0
SSDEEP 24576:4ZNTqhx99zSBbP8N2xV1NLSswDgS3jc1bo:aTqh39zs4yygS3
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\MW-40194eaf-8fad-4f14-8c44-6474381b9cf2\files\sqlite3.dll
Size 1.6MB
SHA256 1d3770844573dcecaf0ecfafa5841e0a9d8c94a65e8b7faf3167cd4aef38d8ec
MD5 4fbf52607a167240f6ca60ec81094eb0
SHA1 c890f722aab965c83eafcd0531fe98ad5df1046a
SHA512 84dbc3a483d3babe53f5e5121702e90601246fb65dfc0848712dc91b0974b229753a0bcf1b16980ff7180b6f1534522a3e75b7312b939c7f7d0e2ef67d23af58
SSDEEP 24576:M8hfcdvwp7BIKEmH2oo6y3KGxmaowmHrc/prCTiGoUqF1dbkVkb0jCAzQ0QzNcb:V1cdvwZ+KEmH2f6HoUq9kHxQ0QzNe
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiwrapper.ini

Path C:\Users\Admin\AppData\Local\Temp\MW-40194eaf-8fad-4f14-8c44-6474381b9cf2\msiwrapper.ini
Size 448B
SHA256 f24856dbe5ea68b44c9203118b77840a1dbcb2664b96b471c3b3ef189f3ac4cb
MD5 5fec4b0be9623fa836f4c3d87fc171c9
SHA1 3f38015bbd0fa3f9fa1c00c6dfb48b7dd7d2b04a
SHA512 0ec26c83ddeb3876e927c4d5cb728161ad26a63bc61509b8738add2159936abe30988555533f8cae9e2d03e4a1d570949bd6830b234384320d1cf53fd6c9a282
MD5 SHA1 SHA512

Submit Download

msiwrapper.ini

Path C:\Users\Admin\AppData\Local\Temp\MW-40194eaf-8fad-4f14-8c44-6474381b9cf2\msiwrapper.ini
Size 1KB
SHA256 00c1bd3c37c6abc4f478385f979d83090f835e231e2cc7f86b073e125761bf26
MD5 8029a38c01d97e02c765e82cd06c9c05
SHA1 5736fa8e91299847ee898580cb46fd06f951f670
SHA512 168999e84d6d3c5fb9be7bac552322205840a3b80a5fe5f9dde2aea7a8c877a95b8deb7ff414440c30bf5c354baea3c8e52f148fc1f35a5104a6b157e6e548c0
MD5 SHA1 SHA512

Submit Download

msiwrapper.ini

Path C:\Users\Admin\AppData\Local\Temp\MW-40194eaf-8fad-4f14-8c44-6474381b9cf2\msiwrapper.ini
Size 1KB
SHA256 f6e0ded7ef7d15b1e0f568c043760e27ef9083a8920c32319bf831c097efaf5f
MD5 210c6ff9a43e847accb171d25d9c0c81
SHA1 49d6b846a29b667189168de48a65b8048923cd3a
SHA512 a8b02ac6d7629237651077b803aec7abce796946cbb1b1c8ec57ec6e8dc68cbe8c5ccb65db058806cb5ef13fc4ebf8f2895f2a3e529966bc4496b8f623171775
MD5 SHA1 SHA512

Submit Download

MSI6B2.tmp

Path C:\Windows\Installer\MSI6B2.tmp
Size 208KB
SHA256 107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c
MD5 d82b3fb861129c5d71f0cd2874f97216
SHA1 f3fe341d79224126e950d2691d574d147102b18d
SHA512 244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b
SSDEEP 3072:3spAtOdmXwCGjtYNKbYO2gjpcm8rRuqpjCLf2loHUvULyGxr5lqM2a8:BtOdiRQYpgjpjew5GAyGxjqo8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Autoit3.exe

Path C:\temp\Autoit3.exe
Size 760KB
SHA256 464b2008aee1513913168b347a5ba9cc8577e2ff3e513e4cbab71299b1c86fff
MD5 5a9871b35a1e12961c0e591ce047f37f
SHA1 fef05eb123999898ce2e80ea65f8f729cc6b7394
SHA512 39ae2c4d725e557ee7a8ff3ac609980f8dca4c69d6cd59efc6bf6c902fbd5dc473f94392d4a8d943d6c871e0e6a1ad7eba46400e803930cdc115330191338387
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxP:6T3E53Myyzl0hMf1tr7p
MD5 SHA1 SHA512 SSDEEP

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 13.5MB
SHA256 c1034623626ab80c5a5f29f3a7e5ae8fb6ca098aded8b9344b0cf1c95a7e9ffa
MD5 eab140c46344f3742287e301407bd191
SHA1 3c56e48287904f48b3d47bab5d4bc4ea9421215f
SHA512 c8d81b64a95db4682a670cc3013919067376eecbfa9cb69dfddd9202ee9536cf413a723f6e81b07ac7790d6c6d2c41d9c463c7dae4a36a1f4171d6bf3eb30a49
SSDEEP 12288:vh8jdmqnaDvH9QlO/bLnIkjTomktwLoSNVf+H0COxU6vVZkOpLNoRcYXfXVAOdOh:yjdmqn+vdoO/vvTLeZm
MD5 SHA1 SHA512 SSDEEP

Submit Download

{7390a8c6-a313-436f-9252-5071b2134e21}_OnDiskSnapshotProp

Path \??\Volume{d253324a-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{7390a8c6-a313-436f-9252-5071b2134e21}_OnDiskSnapshotProp
Size 6KB
SHA256 b466108fcad2dfb674b321199662b1339fb0fee039d019b9918549b908ee6e80
MD5 0ee11cf713f555dbc3b964cfb61bfeaf
SHA1 ec85f7a8e623b919e01b7177c25f5266d1d7e785
SHA512 68301838c1f9f7976a36ddbc970ca8cc6f0604dead1fc8b996570260bb5cabf283f7cc7230afe1fe72ffaa1ea1184b11eff3b048f38d3b6ca5177db039c56988
SSDEEP 96:FwRVdmQZ9YFpDD84LTHzbOHXOHBlBRQJ8Sc9XE56tOSVQEJN:aR3RZWb++sVeN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Autoit3.exe

Path \??\c:\temp\Autoit3.exe
Size 795KB
SHA256 ff12863a87e74332ee8c0444174f618367a63f1b322f35530f51b9111cc5a0b7
MD5 e0fab39c371fbdbb4911f69845f5ec2b
SHA1 ee282fc8069501f7681cb071e968aa4763765a26
SHA512 357efd7022e2d88115b26f10905e0b802420e717f7f9475e9915a35a21bafe6ee9bc9cfc90ce0eb008e0975f2fdfed9a178d1e256f462d17ea4a6133ccd34ff8
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawW:6T3E53Myyzl0hMf1tr7CawW
MD5 SHA1 SHA512 SSDEEP

Submit Download

script.au3

Path \??\c:\temp\script.au3
Size 562KB
SHA256 95b45cd112424a61de0680230d4affd0102cef13a49f6aecbc819425f4827756
MD5 f2234dc24c830b81149a94d2c5d54e88
SHA1 7cb784db3bb2703a64e25c0863cb91ac25c92f32
SHA512 0b1e79a1f647a7680beebf3ed2ab8821167ff02519cb28a71529326d484f5f68b26a20f23323d2005844f9ef70e920b0728426730d799a5adad37c46236de212
SSDEEP 12288:P4bk1MZ0mLLnKzFjMRCj8tD+CDppvi2h1dNue/fi3zQ0QxwcNcB5u5gXn3HXn3H1:wbkVkb0jCAzQ0QzNcMbm
MD5 SHA1 SHA512 SSDEEP

Submit Download

test.txt

Path \??\c:\temp\test.txt
Size 76B
SHA256 8310f9b7636e8e7272229888a5e36e5e51a1e601968a6aee76d42abe2f60daa9
MD5 8dfd483cc870677e05511543cf1ccda0
SHA1 6b9cda15c54549c85603a3fec6e571dc965623c7
SHA512 fa459969d08b7e3d4a348c41d8b0edfba19b322171bfe4457bdfd5cf1b205da6b38b6ba3f1f59a8060a952e8f95fb4d3a8a5a443dbac3e6a6e9a5f544d6480da
MD5 SHA1 SHA512

Submit Download

memory/3088-90-0x0000000004630000-0x0000000005600000-memory.dmp

Download

memory/3088-91-0x0000000005CB0000-0x0000000005FFE000-memory.dmp

Download

memory/3088-94-0x0000000005CB0000-0x0000000005FFE000-memory.dmp

Download

memory/4528-93-0x0000000076900000-0x0000000076A8C000-memory.dmp

Download

memory/4528-95-0x0000024B95490000-0x0000024B95646000-memory.dmp

Download

memory/4528-81-0x0000024B95490000-0x0000024B95646000-memory.dmp

Download