darkgate | 693ff5db0a085db5094bb96cd4c0ce1d1d3fdc2fbf6b92c32836f3e61a089e7a

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 02:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
693ff5db0a085db5094bb96cd4c0ce1d1d3fdc2fbf6b92c32836f3e61a089e7a.msi
Size 5.8MB
Sample240213-c4pyyach96
SHA256 693ff5db0a085db5094bb96cd4c0ce1d1d3fdc2fbf6b92c32836f3e61a089e7a
MD5 9c02a9298b97fcfc5a75fbedf08002bd
SHA1 2d3bc2856c015914f2856331a0315298f3c34b0c
SHA512 fafe5dddb610068cb1044c803a6d681d1739904d8e0c4b2b0fc05bcd55cf9344f69e77c8627ae73713f759117d81a78855ff937ee8650b47ab18d37cb9ca34bc
SSDEEP 49152:ppUP3UhtSTK+0THkWsN8SDYdvH5eoQDWhbHHhZgWEF94FJy5jvrgFdbBUleY82cp:pp6nFDkEWoyvy5jvcdbBUkYC+XCFmpC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkgate discovery stealer

Malware Config

Signatures

DarkGate
DarkGate is an infostealer written in C++.
stealer darkgate

Detect DarkGate stealer 1 IoCs

resource	yara_rule
behavioral2/memory/3852-106-0x00000000058B0000-0x0000000005C0C000-memory.dmp	family_darkgate_v6

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4908	ICACLS.EXE
3676	ICACLS.EXE

Blocklisted process makes network request 3 IoCs

flow	pid	Process
5	1776	msiexec.exe
7	1776	msiexec.exe
9	1776	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e57c479.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8F7994CB-D53E-4E42-B335-CF29C4D0CA5C}	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	EXPAND.EXE
File created	C:\Windows\Installer\e57c479.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC5FF.tmp	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	EXPAND.EXE
File opened for modification	C:\Windows\Installer\	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
1620	iTunesHelper.exe
3852	Autoit3.exe

Loads dropped DLL 2 IoCs

pid	Process
4396	MsiExec.exe
1620	iTunesHelper.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000008bec060def88e6600000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800008bec060d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809008bec060d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d8bec060d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000008bec060d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Autoit3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Autoit3.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2292	msiexec.exe
2292	msiexec.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1776	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1776	msiexec.exe
Token: SeSecurityPrivilege	2292	msiexec.exe
Token: SeCreateTokenPrivilege	1776	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1776	msiexec.exe
Token: SeLockMemoryPrivilege	1776	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1776	msiexec.exe
Token: SeMachineAccountPrivilege	1776	msiexec.exe
Token: SeTcbPrivilege	1776	msiexec.exe
Token: SeSecurityPrivilege	1776	msiexec.exe
Token: SeTakeOwnershipPrivilege	1776	msiexec.exe
Token: SeLoadDriverPrivilege	1776	msiexec.exe
Token: SeSystemProfilePrivilege	1776	msiexec.exe
Token: SeSystemtimePrivilege	1776	msiexec.exe
Token: SeProfSingleProcessPrivilege	1776	msiexec.exe
Token: SeIncBasePriorityPrivilege	1776	msiexec.exe
Token: SeCreatePagefilePrivilege	1776	msiexec.exe
Token: SeCreatePermanentPrivilege	1776	msiexec.exe
Token: SeBackupPrivilege	1776	msiexec.exe
Token: SeRestorePrivilege	1776	msiexec.exe
Token: SeShutdownPrivilege	1776	msiexec.exe
Token: SeDebugPrivilege	1776	msiexec.exe
Token: SeAuditPrivilege	1776	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1776	msiexec.exe
Token: SeChangeNotifyPrivilege	1776	msiexec.exe
Token: SeRemoteShutdownPrivilege	1776	msiexec.exe
Token: SeUndockPrivilege	1776	msiexec.exe
Token: SeSyncAgentPrivilege	1776	msiexec.exe
Token: SeEnableDelegationPrivilege	1776	msiexec.exe
Token: SeManageVolumePrivilege	1776	msiexec.exe
Token: SeImpersonatePrivilege	1776	msiexec.exe
Token: SeCreateGlobalPrivilege	1776	msiexec.exe
Token: SeBackupPrivilege	2352	vssvc.exe
Token: SeRestorePrivilege	2352	vssvc.exe
Token: SeAuditPrivilege	2352	vssvc.exe
Token: SeBackupPrivilege	2292	msiexec.exe
Token: SeRestorePrivilege	2292	msiexec.exe
Token: SeRestorePrivilege	2292	msiexec.exe
Token: SeTakeOwnershipPrivilege	2292	msiexec.exe
Token: SeRestorePrivilege	2292	msiexec.exe
Token: SeTakeOwnershipPrivilege	2292	msiexec.exe
Token: SeBackupPrivilege	3608	srtasks.exe
Token: SeRestorePrivilege	3608	srtasks.exe
Token: SeSecurityPrivilege	3608	srtasks.exe
Token: SeTakeOwnershipPrivilege	3608	srtasks.exe
Token: SeBackupPrivilege	3608	srtasks.exe
Token: SeRestorePrivilege	3608	srtasks.exe
Token: SeSecurityPrivilege	3608	srtasks.exe
Token: SeTakeOwnershipPrivilege	3608	srtasks.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1776	msiexec.exe
1776	msiexec.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 3608	2292	msiexec.exe	96
PID 2292 wrote to memory of 3608	2292	msiexec.exe	96
PID 2292 wrote to memory of 4396	2292	msiexec.exe	97
PID 2292 wrote to memory of 4396	2292	msiexec.exe	97
PID 2292 wrote to memory of 4396	2292	msiexec.exe	97
PID 4396 wrote to memory of 4908	4396	MsiExec.exe	98
PID 4396 wrote to memory of 4908	4396	MsiExec.exe	98
PID 4396 wrote to memory of 4908	4396	MsiExec.exe	98
PID 4396 wrote to memory of 3308	4396	MsiExec.exe	100
PID 4396 wrote to memory of 3308	4396	MsiExec.exe	100
PID 4396 wrote to memory of 3308	4396	MsiExec.exe	100
PID 4396 wrote to memory of 1620	4396	MsiExec.exe	102
PID 4396 wrote to memory of 1620	4396	MsiExec.exe	102
PID 1620 wrote to memory of 3852	1620	iTunesHelper.exe	103
PID 1620 wrote to memory of 3852	1620	iTunesHelper.exe	103
PID 1620 wrote to memory of 3852	1620	iTunesHelper.exe	103
PID 4396 wrote to memory of 2548	4396	MsiExec.exe	107
PID 4396 wrote to memory of 2548	4396	MsiExec.exe	107
PID 4396 wrote to memory of 2548	4396	MsiExec.exe	107
PID 4396 wrote to memory of 3676	4396	MsiExec.exe	110
PID 4396 wrote to memory of 3676	4396	MsiExec.exe	110
PID 4396 wrote to memory of 3676	4396	MsiExec.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\693ff5db0a085db5094bb96cd4c0ce1d1d3fdc2fbf6b92c32836f3e61a089e7a.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1776

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3608
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 599E5D96341A5C3BDE19222D445F4B32
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4396
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-03efed6d-37c0-419d-92fe-3eb92b002a3b\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    PID:4908
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    PID:3308
- - C:\Users\Admin\AppData\Local\Temp\MW-03efed6d-37c0-419d-92fe-3eb92b002a3b\files\iTunesHelper.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-03efed6d-37c0-419d-92fe-3eb92b002a3b\files\iTunesHelper.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1620
  - - \??\c:\temp\Autoit3.exe
      "c:\temp\Autoit3.exe" c:\temp\script.a3x
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      PID:3852
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\MW-03efed6d-37c0-419d-92fe-3eb92b002a3b\files"
    3⤵
    PID:2548
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-03efed6d-37c0-419d-92fe-3eb92b002a3b\." /SETINTEGRITYLEVEL (CI)(OI)LOW
    3⤵
    - Modifies file permissions
    PID:3676

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

357F04AD41BCF5FE18FCB69F60C6680F_A55A1F98A2E2349B736808E9897028A5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_A55A1F98A2E2349B736808E9897028A5
Size 1KB
SHA256 595ee0bb73832a27c34b4e0c67dd3395fc54ec7e4f982f14e8557711940543a8
MD5 d8122b7238b377214a0a699eb8d9a2ea
SHA1 25284d30ae60e1f98c87b1e079f12546710c95e2
SHA512 3faf35e0154045d78ae97ec4aff589e8182143c99625ee5ca26071c188afa19809c428c9df3cdca03ca0c2a59d41ff8fc500116184923a622a2bed92657cf1d2
MD5 SHA1 SHA512

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 1KB
SHA256 625ae74d2775d7a8c29876ad17760e72674e8e94576b8ba2a34cf9c14cac0b6d
MD5 cacbd2c04f02598b6a3cc2f663186c89
SHA1 a6b73ab848745a233b5d10897a78f6ad44cb48c1
SHA512 ccefec6f936f918487ad3a721c4d962172ac1f428b2d42a657c7523b05247937aff5953caba5f4e6c6b2a0db4fc077c637ddbb4d1b347492d2c8a5d298d2ca6f
MD5 SHA1 SHA512

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_A55A1F98A2E2349B736808E9897028A5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_A55A1F98A2E2349B736808E9897028A5
Size 540B
SHA256 697c625b4f9587ad97699f8f80d4984bb507d607619a1e6a9f3799e3646d6705
MD5 93dc6d502d0cde394b314530d97ae9cb
SHA1 b5c25aa63d9e17a6eef32dcea0573c78a8964d1f
SHA512 d2641cb0ab50488f8ba15e43a231a420275b98dab615c8ca3b61a34b6cbd59a3c57f2fd6e7519e83e0d922f56ed1ac33ea2152e1ca4aeeb988f898abee00fd18
MD5 SHA1 SHA512

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 536B
SHA256 a0b5e9b0c7c6686ecaef1bee00829267a7888c0668201ef5413354e466941803
MD5 fc6513f0fb292d3e0fde83f566114761
SHA1 c7f2960a3a4c2c97d238581a8e7ca3feac2bbeb0
SHA512 30be468791e03d4aec594f8625fcdf6bd116e8047c11397a7b0733e5c19f0d07d32a6dbe1f0de293d329722cb27cbf013e335fcc0a96a0cbf6b7d24d8c612cb9
MD5 SHA1 SHA512

Submit Download

files.cab

Path C:\Users\Admin\AppData\Local\Temp\MW-03efed6d-37c0-419d-92fe-3eb92b002a3b\files.cab
Size 102KB
SHA256 5cf95218c9cec0d4237c437a1e9006046414af71e0cf32df71ebb054333b4a77
MD5 1bd625938e4b78d7ddfe4b3a11810cb4
SHA1 1515297fee04225c8abddf3f69a2332a45743f2d
SHA512 85a1adfcea1bef9d4c870969790b6feae4ef9118dbc1f5782c11ea2dee7c6f1c9577258607eb7423bb5f7f8e7bb737d70ca390be6acf8237484be3aceb7d0d45
SSDEEP 1536:c2YzhtShjNJCxyVWzGN1lJWV9nO4u5AOg0ZY2RzrEup5FtrzifynOq:JP8G8O4OAD0ZY2RzPjKfAN
MD5 SHA1 SHA512 SSDEEP

Submit Download

CoreFoundation.dll

Path C:\Users\Admin\AppData\Local\Temp\MW-03efed6d-37c0-419d-92fe-3eb92b002a3b\files\CoreFoundation.dll
Size 542KB
SHA256 ea7c1f2e2fb7961ad64346944f641328d507b40c181bff4404d42882f3ff80cd
MD5 d350df6d9ae5596498237bf69ee6fc2f
SHA1 09e48e9b8e08d121f35ef4508fd7298c426db6fb
SHA512 24f7b85c715ff4becab961dee0fc1750100439b91babf32352b73bf5dfdff2a95d750cfe53d4dcb55eaeabcbabeeb2036e543a8ea58edaa0211997995c092abc
SSDEEP 6144:5OfO4OAx0mSz7KoKSKMqUr7tXVzEhBIrAQLQtTZoM/cc:56rWm66Ur7rEhBiAY8TZ9/cc
MD5 SHA1 SHA512 SSDEEP

Submit Download

CoreFoundation.dll

Path C:\Users\Admin\AppData\Local\Temp\MW-03efed6d-37c0-419d-92fe-3eb92b002a3b\files\CoreFoundation.dll
Size 490KB
SHA256 af55cbb9383c0a1c820af77cc94a8a0254c1eaa45b58e826fa4b57f9dbb106e2
MD5 48b50f9b0574527cb006e4b398be3794
SHA1 29080e85fabda7444c3ca8ab532fadd98dd9e3f1
SHA512 33ebf96813affb1b4b7217e15c6cf9d1e8fd98675a654395f11bbb0c1007a7569bff193250bf4d79112b5cb8ed27b88f6cc6503218b9fedf53e3fc0881d7cc82
SSDEEP 6144:5OfO4OAx0mSz7KoKSKMqUr7tXVzEhBIrAQLQtTZoMi:56rWm66Ur7rEhBiAY8TZ9i
MD5 SHA1 SHA512 SSDEEP

Submit Download

iTunesHelper.exe

Path C:\Users\Admin\AppData\Local\Temp\MW-03efed6d-37c0-419d-92fe-3eb92b002a3b\files\iTunesHelper.exe
Size 358KB
SHA256 0d8878cca08903777888b3681f90e4a07c7aef7d9600a67dfa985844d4bf5eda
MD5 ed6a1c72a75dee15a6fa75873cd64975
SHA1 67a15ca72e3156f8be6c46391e184087e47f4a0d
SHA512 256c2ebfeb42c2d3340d8bb423ef0ae48d5fb9fe5ca09c363595f51a03007482b67a777e4cae7a8194f69bc3a3fbcdb9abb5c9f92097925272431bb9d50f5c03
SSDEEP 6144:TjZtNtzxEFQVLEhZbblN4W6ZDNFfEai23+FM2+zIv+98vS:ZRxMQLEhZXybF8Ut4o8a
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\MW-03efed6d-37c0-419d-92fe-3eb92b002a3b\files\sqlite3.dll
Size 425KB
SHA256 f30d4dd89c8854c8e6cfdcc69e8432ea493f2269590f5f3215a5606b33525da9
MD5 ca2d95716296b3143ed768c520fe8b65
SHA1 3c8132a97cb3425a4de4030d65aefe1578837e96
SHA512 877e8d504c67782b4f0b7840c5b58249909110491dca37ec773687ffae0b004d54ab5f5780a060642f1f0eac47521651484e71902cdebc6e7636064a68c6c251
SSDEEP 6144:U13BigcnFF76dfYYyAPptNQKFsNyaR4NHHIRnFEtgE2Sw:U1InFFODFOKxKnFoBw
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiwrapper.ini

Path C:\Users\Admin\AppData\Local\Temp\MW-03efed6d-37c0-419d-92fe-3eb92b002a3b\msiwrapper.ini
Size 1KB
SHA256 15aaf790eec92d46fbbaf58aaf0e01f87c3438c5a009ec0f88fb8a0f5829c8d1
MD5 88989727ee0cf0e32ccbb9f296f43688
SHA1 d70dbce822ab295e60b2f807bdf87aa12bb49afe
SHA512 19de4e990373c9bbbe2fbee479939d46a6a3a1bada252bc28db7e7421435c1c84a794fdde73624c743aaed2dba5775763e474ef27b1339287b1bc94688f1be86
MD5 SHA1 SHA512

Submit Download

msiwrapper.ini

Path C:\Users\Admin\AppData\Local\Temp\MW-03efed6d-37c0-419d-92fe-3eb92b002a3b\msiwrapper.ini
Size 1KB
SHA256 f25ff65db6e918f0684a58d631fc681134e5f9cbf1b63e89ab8160f9faabad65
MD5 22ac9dd85eaabc6b259e3ff59a8e2372
SHA1 92f2b3a7b08906b27dfd82f219e2136b70e62aea
SHA512 7352e38028b602f2f56096a1022a24db9b231acb0e4188c320e5cfa0c7ad45d345c45bcf0919a290a2021e7785e4ac95157d8d77f359732284c545352dcd62a8
MD5 SHA1 SHA512

Submit Download

MSIC5FF.tmp

Path C:\Windows\Installer\MSIC5FF.tmp
Size 208KB
SHA256 107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c
MD5 d82b3fb861129c5d71f0cd2874f97216
SHA1 f3fe341d79224126e950d2691d574d147102b18d
SHA512 244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b
SSDEEP 3072:3spAtOdmXwCGjtYNKbYO2gjpcm8rRuqpjCLf2loHUvULyGxr5lqM2a8:BtOdiRQYpgjpjew5GAyGxjqo8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Autoit3.exe

Path C:\temp\Autoit3.exe
Size 460KB
SHA256 0ac49c22f40e6c5a62fb7b4af739fcdad49bbcdb136cdeb34c27c037caf18301
MD5 d1f221955f2ba99bb2442414551bea7a
SHA1 68683d260995e8eda3809a6ee8fd5bfe7d2b5f90
SHA512 1c06081d64508ba67c96bbf25dfc86e7b54261557d3148befa72f8402d643885c74e816c737e0011d5e027628e8446cc30f68a4e153876390a87f0c3e14c184f
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9n:6T3E53Myyzl0q
MD5 SHA1 SHA512 SSDEEP

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 648KB
SHA256 a456cc186fe28f0dce45d1946a068a95e85aa99bc2a8490ab734c3d028727261
MD5 a3caa66d40afb8bbc9ea39fe18cbabe9
SHA1 1ace8e286a53a698daf2b1febc04e4614587a1c3
SHA512 6ca94f9b5331f0d37038dec8e3ccd3c972ee596bac6598e2f670d6ff40710678a4b6426f64d1a2cb5cf2ffc5cd7ad629cfa0e3fe088057232927c5122e77264d
SSDEEP 768:6dWkASMuuGYe3v3NxYItNOxdcl5d7CYSzaSzWjIGkzVSSNzRjU22MadT5mmkzL3p:gYJxwtjRkaMcWiJhPkVcPA0ZGvfXhOI
MD5 SHA1 SHA512 SSDEEP

Submit Download

{cf65e915-5328-4363-be0a-7f6a01167db6}_OnDiskSnapshotProp

Path \??\Volume{0d06ec8b-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{cf65e915-5328-4363-be0a-7f6a01167db6}_OnDiskSnapshotProp
Size 6KB
SHA256 fdf89d3f257ce8b50ebfe45740933d9d1e86662f924724f760ee845b5fa759da
MD5 bc01c158fcf88f7db5a342ca6e12434a
SHA1 944b419884f3b4e3657f6af02d2959a4ac6812a9
SHA512 5f53f565500fa2ed778b6dcf8f05159b184b745aa72fe6b9e701b5ebf2dc51691fa096eeee7f1db3dc2b230cf9d79c60f11be7fe68599697464d3a0a477a8df0
SSDEEP 96:Fltx+YFpDD84LTHzbOHXOHBlBRQJ8Sc9XE56tOSVQEJ://b++sVe
MD5 SHA1 SHA512 SSDEEP

Submit Download

Autoit3.exe

Path \??\c:\temp\Autoit3.exe
Size 449KB
SHA256 7db63281d3e26a9c21b17e4004f49a9df2653cf07a1f71392816a087bbcb80a5
MD5 fe43cca2ee566c5b1ec52eaeb38ce1c7
SHA1 0fca403bfa728ac1235c622aa55c6f427c0a1aa6
SHA512 92b460e2a3cdbb0c11cb3d60c6403808b99ac0231706696a1d5905c982f83de907c73cae1d70fe1cf17c1b16e3122bb1c614c1e5efb14f1d45362e3a8f88c6d1
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcNw:6T3E53Myyzl0z
MD5 SHA1 SHA512 SSDEEP

Submit Download

script.a3x

Path \??\c:\temp\script.a3x
Size 473KB
SHA256 2296f929340976c680d199ce8e47bd7136d9f4c1f7abc9df79843e094f894236
MD5 33ca8bc4ac593027fd3e83ba44be54fc
SHA1 07e2e129a5b0a694d38ac29bc21f74eda100519f
SHA512 05f6f03e69a7d31686f422e422d61161bde45173a6453fdf0392a7a084c9bd69c7c0ed11eb7a37281481eea14497e95c51dfaded21e2ff943fee3f371592db61
SSDEEP 12288:J0GjNCSnWfeFaW0Jq4byoEi/QuuEpMO29jHRcCH4M:OAC/eF5DUONurprlYD
MD5 SHA1 SHA512 SSDEEP

Submit Download

test.txt

Path \??\c:\temp\test.txt
Size 76B
SHA256 03bed76f17b8574d05e84b81f81c09a33b1ae1555c2caf4783e059b689879ab6
MD5 e0cb113b19ce53ef7b72edbb0a4937dc
SHA1 2499a76ad9ec4a44571bfd8083e09b23373f9f69
SHA512 0b046a6d16d22c0faa3eb729d9b74bfbc87f3cc847fd5ddfa89e573893d215841bae320f0697090b9a30778a07210929ac9c440fca884e920b369698d90a17ca
MD5 SHA1 SHA512

Submit Download

memory/1620-94-0x0000018F189D0000-0x0000018F18B70000-memory.dmp

Download

memory/1620-107-0x0000018F189D0000-0x0000018F18B70000-memory.dmp

Download

memory/1620-105-0x000000005F5F0000-0x000000005F998000-memory.dmp

Download

memory/3852-104-0x00000000043B0000-0x0000000005380000-memory.dmp

Download

memory/3852-106-0x00000000058B0000-0x0000000005C0C000-memory.dmp

Download