darkgate | 693ff5db0a085db5094bb96cd4c0ce1d1d3fdc2fbf6b92c32836f3e61a089e7a

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 02:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
693ff5db0a085db5094bb96cd4c0ce1d1d3fdc2fbf6b92c32836f3e61a089e7a.msi
Size 5.8MB
Sample240213-c4pm6sbf2y
SHA256 693ff5db0a085db5094bb96cd4c0ce1d1d3fdc2fbf6b92c32836f3e61a089e7a
MD5 9c02a9298b97fcfc5a75fbedf08002bd
SHA1 2d3bc2856c015914f2856331a0315298f3c34b0c
SHA512 fafe5dddb610068cb1044c803a6d681d1739904d8e0c4b2b0fc05bcd55cf9344f69e77c8627ae73713f759117d81a78855ff937ee8650b47ab18d37cb9ca34bc
SSDEEP 49152:ppUP3UhtSTK+0THkWsN8SDYdvH5eoQDWhbHHhZgWEF94FJy5jvrgFdbBUleY82cp:pp6nFDkEWoyvy5jvcdbBUkYC+XCFmpC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkgate discovery stealer

Malware Config

Signatures

DarkGate
DarkGate is an infostealer written in C++.
stealer darkgate

Detect DarkGate stealer 2 IoCs

resource	yara_rule
behavioral2/memory/1388-105-0x0000000006120000-0x000000000647C000-memory.dmp	family_darkgate_v6
behavioral2/memory/1388-106-0x0000000006120000-0x000000000647C000-memory.dmp	family_darkgate_v6

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4432	ICACLS.EXE
4376	ICACLS.EXE

Blocklisted process makes network request 3 IoCs

flow	pid	Process
6	1440	msiexec.exe
9	1440	msiexec.exe
12	1440	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	EXPAND.EXE
File opened for modification	C:\Windows\Installer\e57eb1b.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIED4E.tmp	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	EXPAND.EXE
File created	C:\Windows\Installer\e57eb1b.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8F7994CB-D53E-4E42-B335-CF29C4D0CA5C}	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
4880	iTunesHelper.exe
1388	Autoit3.exe

Loads dropped DLL 2 IoCs

pid	Process
3280	MsiExec.exe
4880	iTunesHelper.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000004a3253d230439a9b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800004a3253d20000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809004a3253d2000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d4a3253d2000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000004a3253d200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Autoit3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Autoit3.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1032	msiexec.exe
1032	msiexec.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1440	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1440	msiexec.exe
Token: SeSecurityPrivilege	1032	msiexec.exe
Token: SeCreateTokenPrivilege	1440	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1440	msiexec.exe
Token: SeLockMemoryPrivilege	1440	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1440	msiexec.exe
Token: SeMachineAccountPrivilege	1440	msiexec.exe
Token: SeTcbPrivilege	1440	msiexec.exe
Token: SeSecurityPrivilege	1440	msiexec.exe
Token: SeTakeOwnershipPrivilege	1440	msiexec.exe
Token: SeLoadDriverPrivilege	1440	msiexec.exe
Token: SeSystemProfilePrivilege	1440	msiexec.exe
Token: SeSystemtimePrivilege	1440	msiexec.exe
Token: SeProfSingleProcessPrivilege	1440	msiexec.exe
Token: SeIncBasePriorityPrivilege	1440	msiexec.exe
Token: SeCreatePagefilePrivilege	1440	msiexec.exe
Token: SeCreatePermanentPrivilege	1440	msiexec.exe
Token: SeBackupPrivilege	1440	msiexec.exe
Token: SeRestorePrivilege	1440	msiexec.exe
Token: SeShutdownPrivilege	1440	msiexec.exe
Token: SeDebugPrivilege	1440	msiexec.exe
Token: SeAuditPrivilege	1440	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1440	msiexec.exe
Token: SeChangeNotifyPrivilege	1440	msiexec.exe
Token: SeRemoteShutdownPrivilege	1440	msiexec.exe
Token: SeUndockPrivilege	1440	msiexec.exe
Token: SeSyncAgentPrivilege	1440	msiexec.exe
Token: SeEnableDelegationPrivilege	1440	msiexec.exe
Token: SeManageVolumePrivilege	1440	msiexec.exe
Token: SeImpersonatePrivilege	1440	msiexec.exe
Token: SeCreateGlobalPrivilege	1440	msiexec.exe
Token: SeBackupPrivilege	224	vssvc.exe
Token: SeRestorePrivilege	224	vssvc.exe
Token: SeAuditPrivilege	224	vssvc.exe
Token: SeBackupPrivilege	1032	msiexec.exe
Token: SeRestorePrivilege	1032	msiexec.exe
Token: SeRestorePrivilege	1032	msiexec.exe
Token: SeTakeOwnershipPrivilege	1032	msiexec.exe
Token: SeRestorePrivilege	1032	msiexec.exe
Token: SeTakeOwnershipPrivilege	1032	msiexec.exe
Token: SeBackupPrivilege	1452	srtasks.exe
Token: SeRestorePrivilege	1452	srtasks.exe
Token: SeSecurityPrivilege	1452	srtasks.exe
Token: SeTakeOwnershipPrivilege	1452	srtasks.exe
Token: SeBackupPrivilege	1452	srtasks.exe
Token: SeRestorePrivilege	1452	srtasks.exe
Token: SeSecurityPrivilege	1452	srtasks.exe
Token: SeTakeOwnershipPrivilege	1452	srtasks.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1440	msiexec.exe
1440	msiexec.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 1452	1032	msiexec.exe	96
PID 1032 wrote to memory of 1452	1032	msiexec.exe	96
PID 1032 wrote to memory of 3280	1032	msiexec.exe	98
PID 1032 wrote to memory of 3280	1032	msiexec.exe	98
PID 1032 wrote to memory of 3280	1032	msiexec.exe	98
PID 3280 wrote to memory of 4432	3280	MsiExec.exe	99
PID 3280 wrote to memory of 4432	3280	MsiExec.exe	99
PID 3280 wrote to memory of 4432	3280	MsiExec.exe	99
PID 3280 wrote to memory of 5116	3280	MsiExec.exe	101
PID 3280 wrote to memory of 5116	3280	MsiExec.exe	101
PID 3280 wrote to memory of 5116	3280	MsiExec.exe	101
PID 3280 wrote to memory of 4880	3280	MsiExec.exe	103
PID 3280 wrote to memory of 4880	3280	MsiExec.exe	103
PID 4880 wrote to memory of 1388	4880	iTunesHelper.exe	104
PID 4880 wrote to memory of 1388	4880	iTunesHelper.exe	104
PID 4880 wrote to memory of 1388	4880	iTunesHelper.exe	104
PID 3280 wrote to memory of 5064	3280	MsiExec.exe	109
PID 3280 wrote to memory of 5064	3280	MsiExec.exe	109
PID 3280 wrote to memory of 5064	3280	MsiExec.exe	109
PID 3280 wrote to memory of 4376	3280	MsiExec.exe	111
PID 3280 wrote to memory of 4376	3280	MsiExec.exe	111
PID 3280 wrote to memory of 4376	3280	MsiExec.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\693ff5db0a085db5094bb96cd4c0ce1d1d3fdc2fbf6b92c32836f3e61a089e7a.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1440

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1452
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding CDFD6F655DD0286B04A1E760481EBAA7
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3280
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-44f05326-5253-461e-9661-26df4e5aecae\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    PID:4432
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    PID:5116
- - C:\Users\Admin\AppData\Local\Temp\MW-44f05326-5253-461e-9661-26df4e5aecae\files\iTunesHelper.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-44f05326-5253-461e-9661-26df4e5aecae\files\iTunesHelper.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4880
  - - \??\c:\temp\Autoit3.exe
      "c:\temp\Autoit3.exe" c:\temp\script.a3x
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      PID:1388
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\MW-44f05326-5253-461e-9661-26df4e5aecae\files"
    3⤵
    PID:5064
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-44f05326-5253-461e-9661-26df4e5aecae\." /SETINTEGRITYLEVEL (CI)(OI)LOW
    3⤵
    - Modifies file permissions
    PID:4376

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

357F04AD41BCF5FE18FCB69F60C6680F_A55A1F98A2E2349B736808E9897028A5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_A55A1F98A2E2349B736808E9897028A5
Size 1KB
SHA256 595ee0bb73832a27c34b4e0c67dd3395fc54ec7e4f982f14e8557711940543a8
MD5 d8122b7238b377214a0a699eb8d9a2ea
SHA1 25284d30ae60e1f98c87b1e079f12546710c95e2
SHA512 3faf35e0154045d78ae97ec4aff589e8182143c99625ee5ca26071c188afa19809c428c9df3cdca03ca0c2a59d41ff8fc500116184923a622a2bed92657cf1d2
MD5 SHA1 SHA512

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 1KB
SHA256 625ae74d2775d7a8c29876ad17760e72674e8e94576b8ba2a34cf9c14cac0b6d
MD5 cacbd2c04f02598b6a3cc2f663186c89
SHA1 a6b73ab848745a233b5d10897a78f6ad44cb48c1
SHA512 ccefec6f936f918487ad3a721c4d962172ac1f428b2d42a657c7523b05247937aff5953caba5f4e6c6b2a0db4fc077c637ddbb4d1b347492d2c8a5d298d2ca6f
MD5 SHA1 SHA512

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_A55A1F98A2E2349B736808E9897028A5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_A55A1F98A2E2349B736808E9897028A5
Size 540B
SHA256 d87eef3eefe3b10af3537a2f791acaeb5d6d00d47e95acd45dfd82525cff81f8
MD5 5dbd7d47af9a6994771a071f9d34e342
SHA1 225273ee6098159d269511ff03c264f715886065
SHA512 007464b41c6df345f44be315fe707fde53fe0bd555d70bb1c85906ab4300aa138d9e25b4b6c1ba3ffc7043e216f26a7ba8c3384740d9b9f5f4d66b980982b92d
MD5 SHA1 SHA512

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 536B
SHA256 313e0d3d510a7fb8601cc5303e372847148e818f8e63f1c4a137916b25c45151
MD5 7bed8129a38ea375a014a3bc2effbac9
SHA1 2ee486e2ace84c8bb5a57e05bbc75db477a42c57
SHA512 126b9bd11df5da921747fb2d8ae0c473f8e6d6fff8acea2628fea627a76d9ad0e36502970157031a9c0d4d427dfa06a43b8831294407f846827324ca11bf83c4
MD5 SHA1 SHA512

Submit Download

files.cab

Path C:\Users\Admin\AppData\Local\Temp\MW-44f05326-5253-461e-9661-26df4e5aecae\files.cab
Size 5.6MB
SHA256 599ab65935afd40c3bc7f1734cbb8f3c8c7b4b16333b994472f34585ebebe882
MD5 a6f0fa38c1ef89290ee787f7577993ad
SHA1 1b03510e8c5a1a3c976086327ebab3c8acc19550
SHA512 9040548c6937e93168e57c1b3d18c20d21702d9632096191bab84929f18de0bce4cc31bb0f178b9d34f9259e6176bc4a8d5b86fe21ceec0b5a24ea2809acc68c
SSDEEP 49152:jUhtSTK+0THkWsN8SDYdvH5eoQDWhbHHhZgWEF94FJy5jvrgFdbBUleY82cX+XCW:HnFDkEWoyvy5jvcdbBUkYC+XCFmpCI
MD5 SHA1 SHA512 SSDEEP

Submit Download

CoreFoundation.dll

Path C:\Users\Admin\AppData\Local\Temp\MW-44f05326-5253-461e-9661-26df4e5aecae\files\CoreFoundation.dll
Size 615KB
SHA256 4d63f21fb10250253213c9c2f73febbdcb0ef114b0bf01d3481d9101c3419b8e
MD5 12a6edcbf45a816faed48b0be3aad263
SHA1 26884e65f21b8797f121dc02365ec94a786c1c32
SHA512 492f61ce4b7593136bf5a14fe31685b7aaa5bb614b61fcedc66890878565041729ddf37bef1708d941ccedde36a56703a4079e81a519671d074eb1bd22984caf
SSDEEP 6144:5OfO4OAx0mSz7KoKSKMqUr7tXVzEhBIrAQLQtTZoM/ccf+5:56rWm66Ur7rEhBiAY8TZ9/ccf+5
MD5 SHA1 SHA512 SSDEEP

Submit Download

CoreFoundation.dll

Path C:\Users\Admin\AppData\Local\Temp\MW-44f05326-5253-461e-9661-26df4e5aecae\files\CoreFoundation.dll
Size 453KB
SHA256 c8dc8cc72d280794277bf33a62ea38c3403ac34fca3c6fd8033e8be3adc6398d
MD5 744f8123a6aacbe161770818747855b2
SHA1 dbbeb0c06ca3818a64cfef5aaeeafda987dee2ff
SHA512 15843ec6fe3d7883cad311ba81bcc90a1d1d7b5a4d15867773dc42d11b6162b972a9c0f84ce6bd378637a63c07b5f194eb7e8c112432a2c231a01c88f6dfebba
SSDEEP 6144:5OfO4OAx0mSz7KoKSKMqUr7tXVzEhBIrAQLQtTZoMO:56rWm66Ur7rEhBiAY8TZ9O
MD5 SHA1 SHA512 SSDEEP

Submit Download

iTunesHelper.exe

Path C:\Users\Admin\AppData\Local\Temp\MW-44f05326-5253-461e-9661-26df4e5aecae\files\iTunesHelper.exe
Size 358KB
SHA256 0d8878cca08903777888b3681f90e4a07c7aef7d9600a67dfa985844d4bf5eda
MD5 ed6a1c72a75dee15a6fa75873cd64975
SHA1 67a15ca72e3156f8be6c46391e184087e47f4a0d
SHA512 256c2ebfeb42c2d3340d8bb423ef0ae48d5fb9fe5ca09c363595f51a03007482b67a777e4cae7a8194f69bc3a3fbcdb9abb5c9f92097925272431bb9d50f5c03
SSDEEP 6144:TjZtNtzxEFQVLEhZbblN4W6ZDNFfEai23+FM2+zIv+98vS:ZRxMQLEhZXybF8Ut4o8a
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\MW-44f05326-5253-461e-9661-26df4e5aecae\files\sqlite3.dll
Size 522KB
SHA256 8850c570e5f1268a750dd82547750ae9cc8896407d2d6340fb46cf7e7d4912cd
MD5 d3962f6f494fa1e90745e8d4436d75ba
SHA1 dabeb105e1aaf60e8fc065ad791d0d45976b0209
SHA512 59f56842021d5cc7aabfce7d8a98d287e4c2649055242d7649a638a7d24119c2a8b3748fb03b79d1cffee931c1453103bb8f5e82d9e6db8fa813c3b6bcc50f89
SSDEEP 6144:U13BigcnFF76dfYYyAPptNQKFsNyaR4NHHIRnFEtgE2SsSOvYqHQ0ytNvm:U1InFFODFOKxKnFoB+YBM
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiwrapper.ini

Path C:\Users\Admin\AppData\Local\Temp\MW-44f05326-5253-461e-9661-26df4e5aecae\msiwrapper.ini
Size 396B
SHA256 06d7c79114f5387c457cf2935063b7838ca16881cd77af50817d5d8d6ec18cfe
MD5 3495386008086ee61bc0b7a2eaf9a253
SHA1 7599e0ec737279f5e302736182c97c36992923ce
SHA512 05c740c8a2a0cdd3f82d37d4fe449e6603217278c3b1c1aa9748a3b3830594f1115017862fd5fdf38fa17bcdf4e85f0fbed089f982faae3bd267a165ef0011b9
MD5 SHA1 SHA512

Submit Download

msiwrapper.ini

Path C:\Users\Admin\AppData\Local\Temp\MW-44f05326-5253-461e-9661-26df4e5aecae\msiwrapper.ini
Size 1KB
SHA256 afa3af53d6a0db4a1ee7aa3de8a35281d92c602b9e1248ffb5705ef7755f5fd0
MD5 3a4053ff97ab6077eaecd264a8ad26ea
SHA1 db89b7dcc56f2862f4ffb5207110a11e0e1d5aa4
SHA512 4603b2f5632348ffaa69b6d68e33d666d71b1ceed89fccd5a643bb645c7c77bb35796f64b49510156eef6269a0062d3892bc976aaccb722cb6e7100a27880e6b
MD5 SHA1 SHA512

Submit Download

MSIED4E.tmp

Path C:\Windows\Installer\MSIED4E.tmp
Size 208KB
SHA256 107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c
MD5 d82b3fb861129c5d71f0cd2874f97216
SHA1 f3fe341d79224126e950d2691d574d147102b18d
SHA512 244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b
SSDEEP 3072:3spAtOdmXwCGjtYNKbYO2gjpcm8rRuqpjCLf2loHUvULyGxr5lqM2a8:BtOdiRQYpgjpjew5GAyGxjqo8
MD5 SHA1 SHA512 SSDEEP

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 421KB
SHA256 9ff3d5a7ef29e59c306902aeac48447dff89db9f4b5e49cdf77eff0caede6023
MD5 0f33620ec6f2d2dfc2459fdfbf0af744
SHA1 075c22e441e0cfa6cb3b1fc54d286a1e73000e91
SHA512 6adff9f9207eee0c78ea7a300cc29b232aba8171bbda1167f6b01f02b2db6c5a0e2e7cf5b882c47746ca51bfe77ebab5dc2e4025a4aaf2a837ce745f849c0415
SSDEEP 768:1DpMiA8OMuuGYe3v3NxYItNOxdcl5d7CYSzaSzWjIGkzVSSNzRjU22MadT5mmkzS:YYJxwtjRkaMcWiJhPkVcPX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{5b57f2ee-defc-4f40-9bd1-f30d00bea8af}_OnDiskSnapshotProp

Path \??\Volume{d253324a-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{5b57f2ee-defc-4f40-9bd1-f30d00bea8af}_OnDiskSnapshotProp
Size 6KB
SHA256 6e0c34bd72740dc6e768235684223d9170bfe2854ff8cf9191b77b37b359a3c3
MD5 44751381144e249f33c97727ac126ccd
SHA1 fb60d63f5b3aefe381f9cbeb6b4899bbcd821112
SHA512 fd66be599dd41eaa6333daed466ec86a813438ef5f2e7b927381f084c2a1da2e2e258b2699cca954569054514f5f055a3545510102717ff057520929653a7aba
SSDEEP 96:FktdmIZ9YFpDD84LTHzbOHXOHBlBRQJ8Sc9XE56tOSVQEJ:e/ZZWb++sVe
MD5 SHA1 SHA512 SSDEEP

Submit Download

Autoit3.exe

Path \??\c:\temp\Autoit3.exe
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

script.a3x

Path \??\c:\temp\script.a3x
Size 473KB
SHA256 2296f929340976c680d199ce8e47bd7136d9f4c1f7abc9df79843e094f894236
MD5 33ca8bc4ac593027fd3e83ba44be54fc
SHA1 07e2e129a5b0a694d38ac29bc21f74eda100519f
SHA512 05f6f03e69a7d31686f422e422d61161bde45173a6453fdf0392a7a084c9bd69c7c0ed11eb7a37281481eea14497e95c51dfaded21e2ff943fee3f371592db61
SSDEEP 12288:J0GjNCSnWfeFaW0Jq4byoEi/QuuEpMO29jHRcCH4M:OAC/eF5DUONurprlYD
MD5 SHA1 SHA512 SSDEEP

Submit Download

test.txt

Path \??\c:\temp\test.txt
Size 76B
SHA256 03bed76f17b8574d05e84b81f81c09a33b1ae1555c2caf4783e059b689879ab6
MD5 e0cb113b19ce53ef7b72edbb0a4937dc
SHA1 2499a76ad9ec4a44571bfd8083e09b23373f9f69
SHA512 0b046a6d16d22c0faa3eb729d9b74bfbc87f3cc847fd5ddfa89e573893d215841bae320f0697090b9a30778a07210929ac9c440fca884e920b369698d90a17ca
MD5 SHA1 SHA512

Submit Download

memory/1388-104-0x0000000004C30000-0x0000000005C00000-memory.dmp

Download

memory/1388-106-0x0000000006120000-0x000000000647C000-memory.dmp

Download

memory/1388-105-0x0000000006120000-0x000000000647C000-memory.dmp

Download

memory/4880-107-0x0000000074DF0000-0x0000000075198000-memory.dmp

Download

memory/4880-108-0x00000203C24A0000-0x00000203C2640000-memory.dmp

Download

memory/4880-95-0x00000203C24A0000-0x00000203C2640000-memory.dmp

Download