darkgate | 693ff5db0a085db5094bb96cd4c0ce1d1d3fdc2fbf6b92c32836f3e61a089e7a

Resubmissions

12/02/2024, 17:33

240212-v48edscc42 10

12/02/2024, 16:54

240212-veh37sca45 10

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/02/2024, 16:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

build-x64.msi
Size

5.8MB
MD5

9c02a9298b97fcfc5a75fbedf08002bd
SHA1

2d3bc2856c015914f2856331a0315298f3c34b0c
SHA256

693ff5db0a085db5094bb96cd4c0ce1d1d3fdc2fbf6b92c32836f3e61a089e7a
SHA512

fafe5dddb610068cb1044c803a6d681d1739904d8e0c4b2b0fc05bcd55cf9344f69e77c8627ae73713f759117d81a78855ff937ee8650b47ab18d37cb9ca34bc
SSDEEP

49152:ppUP3UhtSTK+0THkWsN8SDYdvH5eoQDWhbHHhZgWEF94FJy5jvrgFdbBUleY82cp:pp6nFDkEWoyvy5jvcdbBUkYC+XCFmpC

Score

10^/10

darkgate discovery stealer

Malware Config

Signatures

DarkGate
DarkGate is an infostealer written in C++.
stealer darkgate

Detect DarkGate stealer 2 IoCs

resource	yara_rule
behavioral1/memory/2844-352-0x00000000037F0000-0x00000000047C0000-memory.dmp	family_darkgate_v6
behavioral1/memory/2844-353-0x0000000004C70000-0x0000000004FCC000-memory.dmp	family_darkgate_v6

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2412	ICACLS.EXE
2692	ICACLS.EXE

Blocklisted process makes network request 3 IoCs

flow	pid	Process
3	2876	msiexec.exe
5	2876	msiexec.exe
7	1468	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID44E.tmp	msiexec.exe
File opened for modification	C:\Windows\Logs\DPX\setupact.log	EXPAND.EXE
File opened for modification	C:\Windows\Logs\DPX\setuperr.log	EXPAND.EXE
File opened for modification	C:\Windows\Installer\f76ccd2.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File created	C:\Windows\Installer\f76ccd1.msi	msiexec.exe
File created	C:\Windows\Installer\f76ccd2.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\f76ccd1.msi	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
1000	iTunesHelper.exe
2844	Autoit3.exe

Loads dropped DLL 3 IoCs

pid	Process
2676	MsiExec.exe
2676	MsiExec.exe
1000	iTunesHelper.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Autoit3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Autoit3.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1468	msiexec.exe
1468	msiexec.exe

Suspicious use of AdjustPrivilegeToken 53 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2876	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2876	msiexec.exe
Token: SeRestorePrivilege	1468	msiexec.exe
Token: SeTakeOwnershipPrivilege	1468	msiexec.exe
Token: SeSecurityPrivilege	1468	msiexec.exe
Token: SeCreateTokenPrivilege	2876	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2876	msiexec.exe
Token: SeLockMemoryPrivilege	2876	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2876	msiexec.exe
Token: SeMachineAccountPrivilege	2876	msiexec.exe
Token: SeTcbPrivilege	2876	msiexec.exe
Token: SeSecurityPrivilege	2876	msiexec.exe
Token: SeTakeOwnershipPrivilege	2876	msiexec.exe
Token: SeLoadDriverPrivilege	2876	msiexec.exe
Token: SeSystemProfilePrivilege	2876	msiexec.exe
Token: SeSystemtimePrivilege	2876	msiexec.exe
Token: SeProfSingleProcessPrivilege	2876	msiexec.exe
Token: SeIncBasePriorityPrivilege	2876	msiexec.exe
Token: SeCreatePagefilePrivilege	2876	msiexec.exe
Token: SeCreatePermanentPrivilege	2876	msiexec.exe
Token: SeBackupPrivilege	2876	msiexec.exe
Token: SeRestorePrivilege	2876	msiexec.exe
Token: SeShutdownPrivilege	2876	msiexec.exe
Token: SeDebugPrivilege	2876	msiexec.exe
Token: SeAuditPrivilege	2876	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2876	msiexec.exe
Token: SeChangeNotifyPrivilege	2876	msiexec.exe
Token: SeRemoteShutdownPrivilege	2876	msiexec.exe
Token: SeUndockPrivilege	2876	msiexec.exe
Token: SeSyncAgentPrivilege	2876	msiexec.exe
Token: SeEnableDelegationPrivilege	2876	msiexec.exe
Token: SeManageVolumePrivilege	2876	msiexec.exe
Token: SeImpersonatePrivilege	2876	msiexec.exe
Token: SeCreateGlobalPrivilege	2876	msiexec.exe
Token: SeBackupPrivilege	892	vssvc.exe
Token: SeRestorePrivilege	892	vssvc.exe
Token: SeAuditPrivilege	892	vssvc.exe
Token: SeBackupPrivilege	1468	msiexec.exe
Token: SeRestorePrivilege	1468	msiexec.exe
Token: SeRestorePrivilege	1204	DrvInst.exe
Token: SeRestorePrivilege	1204	DrvInst.exe
Token: SeRestorePrivilege	1204	DrvInst.exe
Token: SeRestorePrivilege	1204	DrvInst.exe
Token: SeRestorePrivilege	1204	DrvInst.exe
Token: SeRestorePrivilege	1204	DrvInst.exe
Token: SeRestorePrivilege	1204	DrvInst.exe
Token: SeLoadDriverPrivilege	1204	DrvInst.exe
Token: SeLoadDriverPrivilege	1204	DrvInst.exe
Token: SeLoadDriverPrivilege	1204	DrvInst.exe
Token: SeRestorePrivilege	1468	msiexec.exe
Token: SeTakeOwnershipPrivilege	1468	msiexec.exe
Token: SeRestorePrivilege	1468	msiexec.exe
Token: SeTakeOwnershipPrivilege	1468	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2876	msiexec.exe
2876	msiexec.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 2676	1468	msiexec.exe	32
PID 1468 wrote to memory of 2676	1468	msiexec.exe	32
PID 1468 wrote to memory of 2676	1468	msiexec.exe	32
PID 1468 wrote to memory of 2676	1468	msiexec.exe	32
PID 1468 wrote to memory of 2676	1468	msiexec.exe	32
PID 1468 wrote to memory of 2676	1468	msiexec.exe	32
PID 1468 wrote to memory of 2676	1468	msiexec.exe	32
PID 2676 wrote to memory of 2692	2676	MsiExec.exe	33
PID 2676 wrote to memory of 2692	2676	MsiExec.exe	33
PID 2676 wrote to memory of 2692	2676	MsiExec.exe	33
PID 2676 wrote to memory of 2692	2676	MsiExec.exe	33
PID 2676 wrote to memory of 2500	2676	MsiExec.exe	35
PID 2676 wrote to memory of 2500	2676	MsiExec.exe	35
PID 2676 wrote to memory of 2500	2676	MsiExec.exe	35
PID 2676 wrote to memory of 2500	2676	MsiExec.exe	35
PID 2676 wrote to memory of 1000	2676	MsiExec.exe	37
PID 2676 wrote to memory of 1000	2676	MsiExec.exe	37
PID 2676 wrote to memory of 1000	2676	MsiExec.exe	37
PID 2676 wrote to memory of 1000	2676	MsiExec.exe	37
PID 1000 wrote to memory of 2844	1000	iTunesHelper.exe	38
PID 1000 wrote to memory of 2844	1000	iTunesHelper.exe	38
PID 1000 wrote to memory of 2844	1000	iTunesHelper.exe	38
PID 1000 wrote to memory of 2844	1000	iTunesHelper.exe	38
PID 2676 wrote to memory of 2912	2676	MsiExec.exe	39
PID 2676 wrote to memory of 2912	2676	MsiExec.exe	39
PID 2676 wrote to memory of 2912	2676	MsiExec.exe	39
PID 2676 wrote to memory of 2912	2676	MsiExec.exe	39
PID 2676 wrote to memory of 2412	2676	MsiExec.exe	43
PID 2676 wrote to memory of 2412	2676	MsiExec.exe	43
PID 2676 wrote to memory of 2412	2676	MsiExec.exe	43
PID 2676 wrote to memory of 2412	2676	MsiExec.exe	43

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\build-x64.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2876

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5CD7A4D09F0ECF99A4D017DFC5A5DF24
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-250ba5a7-8390-43fa-8844-210040cb36d8\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    PID:2692
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    PID:2500
- - C:\Users\Admin\AppData\Local\Temp\MW-250ba5a7-8390-43fa-8844-210040cb36d8\files\iTunesHelper.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-250ba5a7-8390-43fa-8844-210040cb36d8\files\iTunesHelper.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1000
  - - \??\c:\temp\Autoit3.exe
      "c:\temp\Autoit3.exe" c:\temp\script.a3x
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      PID:2844
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\MW-250ba5a7-8390-43fa-8844-210040cb36d8\files"
    3⤵
    PID:2912
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-250ba5a7-8390-43fa-8844-210040cb36d8\." /SETINTEGRITYLEVEL (CI)(OI)LOW
    3⤵
    - Modifies file permissions
    PID:2412

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:892

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000590" "00000000000004A0"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C5C8CC0A7FE31816B4641D0465402560

Filesize
1KB

MD5
e94fb54871208c00df70f708ac47085b

SHA1
4efc31460c619ecae59c1bce2c008036d94c84b8

SHA256
7b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df86

SHA512
2e15b76e16264abb9f5ef417752a1cbb75f29c11f96ac7d73793172bd0864db65f2d2b7be0f16bbbe686068f0c368815525f1e39db5a0d6ca3ab18be6923b898

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf3150b23bf704fb6d0fe7bd35a13754

SHA1
9c8c08441e7a74bc2a4db7a24f9faf7325f9180b

SHA256
6cc1fae7a7c1e3f38029b6c3060c589640f918793b22244fc48a0a64826ebd0f

SHA512
b2147c04bf4b9fb36cc3f474c5181905e1427bb93327a8d2a6b9169127d97f7a98e34ee2ccfb345eea825f9ab45d5f1d62a7279aa71a57131ff2239b325ec129

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C5C8CC0A7FE31816B4641D0465402560

Filesize
264B

MD5
e54926c17b402e898c6f9348cd26a6e5

SHA1
21da2cd2595b0faed001c3c7b4b8bf7b8b203841

SHA256
4fe99aa74cdf7d9d6f368bbbaf65af62f80a68785d189c99d0b749dfadbf6b55

SHA512
9bbd5d1cd7b44d9357b7521bf08bf14570f1350b432478dfada4e3c1fbe5ab4f57603f980d5fac149190c800b6db8ffc152f07fed5e8d3479a8a5d0635762569

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab69FB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-250ba5a7-8390-43fa-8844-210040cb36d8\files.cab

Filesize
3.8MB

MD5
a04aca36bb7f1e583b192af3ee921e85

SHA1
cd7ab50c51249560d8b4bb4ef3f43e45a90ae427

SHA256
0c26bb4080c470dd44ccb2c23630a2aa49225dfa00ff01084202c3efdfee3a9c

SHA512
acb4e565295e7a3fe4c1424809766d686f5b38b957e91341f26a23edecdb522085e4d4cdc0c1971e9eb39037664d0bc43e694eae24548bf61aa6050ac4b5163e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-250ba5a7-8390-43fa-8844-210040cb36d8\files\iTunesHelper.exe

Filesize
110KB

MD5
f050ad7eb4b9b06344cb552b4d6b70f0

SHA1
7ed4312d72c34ffb811eefe68b2318c294120dd2

SHA256
e2724bf8ee00fe07a9a7026669a79efc604577f63e62a9b1a01aa6681bd391ca

SHA512
893afe683423e8fd1811794b913c9a8fe6f64dd71002a10673d60ac41734c2f9d92aae397fd508eb0d8e775a1be0c16b4dc2e746a2754bc9edb17de5291bcdbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-250ba5a7-8390-43fa-8844-210040cb36d8\files\iTunesHelper.exe

Filesize
33KB

MD5
c812b5bd39b8d6e99d103a9f6183b148

SHA1
a3d535b040b7ef7d2c98e07506d3329bfdd2c881

SHA256
f97cd6dbd3519d176e6b2e0925a16c870a4bfbdf1ca0a896243a7ca560d0cfd4

SHA512
a5df48445bbe5d98d1457090fe302d3d7be164cd79fee7cb06d8060bdd60d4f8df9b10f28e2c2d50f11d1f23d43d40e0c7d37f337af9ee96e55bd1162ee4f75c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-250ba5a7-8390-43fa-8844-210040cb36d8\files\sqlite3.dll

Filesize
1.2MB

MD5
f828571d82375c4977cd4d6fd50d3638

SHA1
d73403fe7ef2f5c185ff8427b3d111843dd080b1

SHA256
8e1f4f67f456b50a30970ef4bf7fe0c019cb56d68203a9b6e51d0d77f7474d3c

SHA512
471c1d43b9684d61dc5db0dc549f871393a002fc14055fb706a08503161ad1cf8d1a9508737dc5ceb711b3652a8c468d30ab473280e256ca933d72d0c79ba99f

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-250ba5a7-8390-43fa-8844-210040cb36d8\msiwrapper.ini

Filesize
1KB

MD5
69feca6de013e8a5babe6bc71a13f846

SHA1
c05d246e3055a81a5d2410c0b6e65ce301ac14a5

SHA256
12e90116af4b43faff0c563b329d2a07af28d289fcd06f8eec7b0009484c3e0e

SHA512
d09ac43970e05d1e72ff76e6c9e808699fb504f0b4db035c9cf263a3231f7f558fa37a2d2a03c56d206bad2672170b76a62bbf50443dd367832a30b028912520

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-250ba5a7-8390-43fa-8844-210040cb36d8\msiwrapper.ini

Filesize
1KB

MD5
5d4bdf249bb7a06dcb79de298e38a762

SHA1
352031fef943ba3876102f5bf29ea9291d2a657d

SHA256
bab143445703a59a496223315bc2b6c63b888d873e32d552b1ae52ba66080b7d

SHA512
71fdecb7f61aec0e16137072aebeee263816d3c6492310dfe566bf1fa3769d482c7ae4579015c33e73728e1c9368597561c662d64b0a366e82a696c80192a13d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6A3D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Windows\Installer\MSID44E.tmp

Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
C:\temp\Autoit3.exe

Filesize
807KB

MD5
d4f150b274c39d5e0eecbf9748d83d19

SHA1
01210d614b277e4b0166b630e764ab149f3836b7

SHA256
49b6f9cbab2473202fbe8c4dbf356864fd3b6e7c48ddd3d9fcf8844e9f63e6da

SHA512
1e6e445f25caae217614aa868d4f4b0bda2ec3f8cf4721bb702391a4aa2338eeacc072a4ed83b3e75cf15284530d42815ea490e7dea46faa1f8f9346609d1e80

Download Submit
\??\c:\temp\script.a3x

Filesize
473KB

MD5
33ca8bc4ac593027fd3e83ba44be54fc

SHA1
07e2e129a5b0a694d38ac29bc21f74eda100519f

SHA256
2296f929340976c680d199ce8e47bd7136d9f4c1f7abc9df79843e094f894236

SHA512
05f6f03e69a7d31686f422e422d61161bde45173a6453fdf0392a7a084c9bd69c7c0ed11eb7a37281481eea14497e95c51dfaded21e2ff943fee3f371592db61

Download Submit
\??\c:\temp\test.txt

Filesize
76B

MD5
e0cb113b19ce53ef7b72edbb0a4937dc

SHA1
2499a76ad9ec4a44571bfd8083e09b23373f9f69

SHA256
03bed76f17b8574d05e84b81f81c09a33b1ae1555c2caf4783e059b689879ab6

SHA512
0b046a6d16d22c0faa3eb729d9b74bfbc87f3cc847fd5ddfa89e573893d215841bae320f0697090b9a30778a07210929ac9c440fca884e920b369698d90a17ca

Download Submit
\Users\Admin\AppData\Local\Temp\MW-250ba5a7-8390-43fa-8844-210040cb36d8\files\CoreFoundation.dll

Filesize
1.6MB

MD5
821ace41bc5907bcb823d74594ed4578

SHA1
0eacf934630c5e058e3a67a9e52af736166ab1d3

SHA256
44fd4870110cc0ab42d52b74bd406f7b95b1bbb7530b0290cc96da91b6df223a

SHA512
8c1a4b50620f1548eddf1fb9d862810ead526f8c2f69f8eb5b0955a5b46cd7deaf9d60c525a1b376334f24ca8653ba71b199bc1edad898476064778fbd29212d

Download Submit
\Users\Admin\AppData\Local\Temp\MW-250ba5a7-8390-43fa-8844-210040cb36d8\files\iTunesHelper.exe

Filesize
71KB

MD5
208e79ac5dd1be38415089718f58713d

SHA1
a3a2e9d60c4355e6cdfd1cf8217b8ad570d489c5

SHA256
b43ce6d2bb900ef1ac73bab3e9473f66d40a036d8935c4231152d931b79da4ee

SHA512
2343a77ef7b7531022db01b5a0d4b7682c6881e96e93f66c2e895b6cec9b97c96ff3e1ef0772fd0d62d7031918ad7917357066e65196e2e7e7d51eee4f6e453a

Download Submit
memory/1000-337-0x00000000022F0000-0x0000000002490000-memory.dmp

Filesize
1.6MB

Download
memory/1000-344-0x00000000745B0000-0x0000000074958000-memory.dmp

Filesize
3.7MB

Download
memory/1000-346-0x00000000022F0000-0x0000000002490000-memory.dmp

Filesize
1.6MB

Download
memory/2844-352-0x00000000037F0000-0x00000000047C0000-memory.dmp

Filesize
15.8MB

Download
memory/2844-353-0x0000000004C70000-0x0000000004FCC000-memory.dmp

Filesize
3.4MB

Download