darkgate | 3bf99810510c197b9cd6e434d95417515dbc42f94b11bbf9916ec160066eb77e

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/02/2024, 01:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2999391319cda1be5dacfaf5b05062b2.msi
Size 5.8MB
Sample240220-brt7fshb93
SHA256 3bf99810510c197b9cd6e434d95417515dbc42f94b11bbf9916ec160066eb77e
MD5 2999391319cda1be5dacfaf5b05062b2
SHA1 c983b7dff2ea4c63f3944e639eb54d0e6b0b655f
SHA512 1b9a7e5211979f37097c28122cbe99b5ec81ca3caa07944ddaba1afb2515ef3545f92bce35efa87914221016867f88b9b64c7a6a07e8e3f0cb556182047c7f27
SSDEEP 49152:NpUPFUhtSTK+0THkWsN8SDYdvH5eoQDWeEHHhRgWEF9nuriG7DrFWoRRRJuGgagL:NpMnFDcEWoVoFWRGga5q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkgate discovery stealer

Malware Config

Signatures

DarkGate
DarkGate is an infostealer written in C++.
stealer darkgate

Detect DarkGate stealer 2 IoCs

resource	yara_rule
behavioral2/memory/1236-105-0x0000000005B70000-0x0000000005ECB000-memory.dmp	family_darkgate_v6
behavioral2/memory/1236-106-0x0000000005B70000-0x0000000005ECB000-memory.dmp	family_darkgate_v6

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1600	ICACLS.EXE
1516	ICACLS.EXE

Blocklisted process makes network request 3 IoCs

flow	pid	Process
5	4260	msiexec.exe
7	4260	msiexec.exe
12	4260	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{FC678715-A87F-41A8-9C4F-2D3417298150}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIED6D.tmp	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	EXPAND.EXE
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	EXPAND.EXE
File created	C:\Windows\Installer\e57eb4a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57eb4a.msi	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
1120	iTunesHelper.exe
1236	Autoit3.exe

Loads dropped DLL 2 IoCs

pid	Process
432	MsiExec.exe
1120	iTunesHelper.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000831d4a26f757a3470000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000831d4a260000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900831d4a26000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d831d4a26000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000831d4a2600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Autoit3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Autoit3.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1060	msiexec.exe
1060	msiexec.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4260	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4260	msiexec.exe
Token: SeSecurityPrivilege	1060	msiexec.exe
Token: SeCreateTokenPrivilege	4260	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4260	msiexec.exe
Token: SeLockMemoryPrivilege	4260	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4260	msiexec.exe
Token: SeMachineAccountPrivilege	4260	msiexec.exe
Token: SeTcbPrivilege	4260	msiexec.exe
Token: SeSecurityPrivilege	4260	msiexec.exe
Token: SeTakeOwnershipPrivilege	4260	msiexec.exe
Token: SeLoadDriverPrivilege	4260	msiexec.exe
Token: SeSystemProfilePrivilege	4260	msiexec.exe
Token: SeSystemtimePrivilege	4260	msiexec.exe
Token: SeProfSingleProcessPrivilege	4260	msiexec.exe
Token: SeIncBasePriorityPrivilege	4260	msiexec.exe
Token: SeCreatePagefilePrivilege	4260	msiexec.exe
Token: SeCreatePermanentPrivilege	4260	msiexec.exe
Token: SeBackupPrivilege	4260	msiexec.exe
Token: SeRestorePrivilege	4260	msiexec.exe
Token: SeShutdownPrivilege	4260	msiexec.exe
Token: SeDebugPrivilege	4260	msiexec.exe
Token: SeAuditPrivilege	4260	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4260	msiexec.exe
Token: SeChangeNotifyPrivilege	4260	msiexec.exe
Token: SeRemoteShutdownPrivilege	4260	msiexec.exe
Token: SeUndockPrivilege	4260	msiexec.exe
Token: SeSyncAgentPrivilege	4260	msiexec.exe
Token: SeEnableDelegationPrivilege	4260	msiexec.exe
Token: SeManageVolumePrivilege	4260	msiexec.exe
Token: SeImpersonatePrivilege	4260	msiexec.exe
Token: SeCreateGlobalPrivilege	4260	msiexec.exe
Token: SeBackupPrivilege	3176	vssvc.exe
Token: SeRestorePrivilege	3176	vssvc.exe
Token: SeAuditPrivilege	3176	vssvc.exe
Token: SeBackupPrivilege	1060	msiexec.exe
Token: SeRestorePrivilege	1060	msiexec.exe
Token: SeRestorePrivilege	1060	msiexec.exe
Token: SeTakeOwnershipPrivilege	1060	msiexec.exe
Token: SeRestorePrivilege	1060	msiexec.exe
Token: SeTakeOwnershipPrivilege	1060	msiexec.exe
Token: SeBackupPrivilege	2160	srtasks.exe
Token: SeRestorePrivilege	2160	srtasks.exe
Token: SeSecurityPrivilege	2160	srtasks.exe
Token: SeTakeOwnershipPrivilege	2160	srtasks.exe
Token: SeBackupPrivilege	2160	srtasks.exe
Token: SeRestorePrivilege	2160	srtasks.exe
Token: SeSecurityPrivilege	2160	srtasks.exe
Token: SeTakeOwnershipPrivilege	2160	srtasks.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4260	msiexec.exe
4260	msiexec.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 2160	1060	msiexec.exe	96
PID 1060 wrote to memory of 2160	1060	msiexec.exe	96
PID 1060 wrote to memory of 432	1060	msiexec.exe	98
PID 1060 wrote to memory of 432	1060	msiexec.exe	98
PID 1060 wrote to memory of 432	1060	msiexec.exe	98
PID 432 wrote to memory of 1516	432	MsiExec.exe	99
PID 432 wrote to memory of 1516	432	MsiExec.exe	99
PID 432 wrote to memory of 1516	432	MsiExec.exe	99
PID 432 wrote to memory of 2300	432	MsiExec.exe	101
PID 432 wrote to memory of 2300	432	MsiExec.exe	101
PID 432 wrote to memory of 2300	432	MsiExec.exe	101
PID 432 wrote to memory of 1120	432	MsiExec.exe	103
PID 432 wrote to memory of 1120	432	MsiExec.exe	103
PID 1120 wrote to memory of 1236	1120	iTunesHelper.exe	104
PID 1120 wrote to memory of 1236	1120	iTunesHelper.exe	104
PID 1120 wrote to memory of 1236	1120	iTunesHelper.exe	104
PID 432 wrote to memory of 4328	432	MsiExec.exe	108
PID 432 wrote to memory of 4328	432	MsiExec.exe	108
PID 432 wrote to memory of 4328	432	MsiExec.exe	108
PID 432 wrote to memory of 1600	432	MsiExec.exe	110
PID 432 wrote to memory of 1600	432	MsiExec.exe	110
PID 432 wrote to memory of 1600	432	MsiExec.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\2999391319cda1be5dacfaf5b05062b2.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4260

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2160
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 15F67E5799C08B4CCDC3D3A5B587E99F
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:432
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-0ba69d8a-9d3b-4621-a188-384770cb0653\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    PID:1516
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    PID:2300
- - C:\Users\Admin\AppData\Local\Temp\MW-0ba69d8a-9d3b-4621-a188-384770cb0653\files\iTunesHelper.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-0ba69d8a-9d3b-4621-a188-384770cb0653\files\iTunesHelper.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1120
  - - \??\c:\temp\Autoit3.exe
      "c:\temp\Autoit3.exe" c:\temp\script.a3x
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      PID:1236
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\MW-0ba69d8a-9d3b-4621-a188-384770cb0653\files"
    3⤵
    PID:4328
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-0ba69d8a-9d3b-4621-a188-384770cb0653\." /SETINTEGRITYLEVEL (CI)(OI)LOW
    3⤵
    - Modifies file permissions
    PID:1600

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

357F04AD41BCF5FE18FCB69F60C6680F_A55A1F98A2E2349B736808E9897028A5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_A55A1F98A2E2349B736808E9897028A5
Size 1KB
SHA256 8817e9a8db777decfc8de91585f6ca7060b18e9685994b4a7f062ae7e315bb81
MD5 57b9e230293c3590a9f535a6d9451f73
SHA1 7eaf699c1cb2e40e5b81cf4b64c1ca95a14d7829
SHA512 b1f7d748a5ea2d39f3c21310a33f0962f0a42037abb005ae083896cff9041a63ba5675d083ba8e01e6266e6a69bcfae1043837b64423c0d785ff04b5a8dc9b1b
MD5 SHA1 SHA512

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 1KB
SHA256 6ffd615869eedc52d8285870c4a038e3edf195efea42342ee9903ce7d0360e2c
MD5 af2d60518efa71f59e4d052cac28c061
SHA1 d94177b15013641dcb4917e8336a3f0475c749c2
SHA512 af3a2c83e988befc51800da72c8075f572feb93e73c7da96c40e819c99ea477f2f668dc792ba0a8e82a85e0ce7815c3adce3cd36e2999c8e065a7557cdd18025
MD5 SHA1 SHA512

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_A55A1F98A2E2349B736808E9897028A5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_A55A1F98A2E2349B736808E9897028A5
Size 540B
SHA256 c8036554476b83f01cf2d66daa24409a9c325bf9aa1250fc67f3375bee36ebeb
MD5 21ec2e2fe76367be771771d0ea089709
SHA1 ceaf8b9bea666f74f189a64d8ef8b017873ed6e6
SHA512 857a7817e2a19ebbdc9ab1031b313c40b459f13306a1626c92d56427e0dede3a415d6bc6a58714460fb1c2cf01f7851312263c301a0db2f4c7303f6db446e48c
MD5 SHA1 SHA512

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 536B
SHA256 93a47cbf7ddf06202688f3dbc47732a4a0d4f1a6280e40371da1f27976e4bd74
MD5 5da3a7c37af14c187b8c5bda86742674
SHA1 587413215e44ee94b186e3472145915c5be4f7bf
SHA512 32e237f95d3baf8c0614deac07ed0d27a8f1e97a878c77f5d89fc83e7b7bd40f36690e00e0cca21ccedd54e58fd10f6339d2f3e27f71c0086ddba2ca78414ced
MD5 SHA1 SHA512

Submit Download

files.cab

Path C:\Users\Admin\AppData\Local\Temp\MW-0ba69d8a-9d3b-4621-a188-384770cb0653\files.cab
Size 5.6MB
SHA256 359e387871378831eb1293f41b54436abc6357733d1a573f0caff90ab1cbf07d
MD5 d339565d7c5224c45092b3aaeeb3797f
SHA1 c85565693714583e57fb9addb64368cc87288efa
SHA512 14b3cb62aa99f53a8205783297285b38268306d4876ebdc65ab42d2c7c5613dc4b7010d3f25f2ad60747e136ff5939dca8f6a986f7161f27c0d791f4e874062b
SSDEEP 49152:gUhtSTK+0THkWsN8SDYdvH5eoQDWeEHHhRgWEF9nuriG7DrFWoRRRJuGgagYmS5G:2nFDcEWoVoFWRGga5q7
MD5 SHA1 SHA512 SSDEEP

Submit Download

CoreFoundation.dll

Path C:\Users\Admin\AppData\Local\Temp\MW-0ba69d8a-9d3b-4621-a188-384770cb0653\files\CoreFoundation.dll
Size 3.6MB
SHA256 c2d43d768cebcf63e8d0c3ae8ffd2cd5070e4ac656a132b63d5e7372cef69c62
MD5 b4677a50c291d7c5a7f9f1b80f39a37f
SHA1 76d183107f9a8f89f09e25149e6e3de777b25d5a
SHA512 bb2a3bb016cca60bd5f8a33773752e8f88bae764a6497eaaccf563da8607805b5723b30135c001f2fbc20c628e75c099410d9fd09b375c3d2901b6e7f70ba356
SSDEEP 49152:Psh68THDmkeHoBN8SEsdV+5J+2D8/Etg8:2kbD3
MD5 SHA1 SHA512 SSDEEP

Submit Download

iTunesHelper.exe

Path C:\Users\Admin\AppData\Local\Temp\MW-0ba69d8a-9d3b-4621-a188-384770cb0653\files\iTunesHelper.exe
Size 358KB
SHA256 0d8878cca08903777888b3681f90e4a07c7aef7d9600a67dfa985844d4bf5eda
MD5 ed6a1c72a75dee15a6fa75873cd64975
SHA1 67a15ca72e3156f8be6c46391e184087e47f4a0d
SHA512 256c2ebfeb42c2d3340d8bb423ef0ae48d5fb9fe5ca09c363595f51a03007482b67a777e4cae7a8194f69bc3a3fbcdb9abb5c9f92097925272431bb9d50f5c03
SSDEEP 6144:TjZtNtzxEFQVLEhZbblN4W6ZDNFfEai23+FM2+zIv+98vS:ZRxMQLEhZXybF8Ut4o8a
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\MW-0ba69d8a-9d3b-4621-a188-384770cb0653\files\sqlite3.dll
Size 1.6MB
SHA256 28ead67d2352ddd11f963e8b23930905ecbaff371162dfdae5ed096f62eb3d79
MD5 ce6e163809f5e817ef0c259672f7a1cd
SHA1 123e2f032b2fc45d6d9fe482756243ed61137476
SHA512 07766db4cf023bf059415a58a9e1384acb39260ba71587b4eadb99f84d307c0ab70f76390894ab786a6461a0c809f8e9fe435f7bf9b334a369a178c54b295229
SSDEEP 24576:MxAaWSDRhCekKOe2lwQcRLjVoRRRpGTjSGv2aLtIgS/LfgimS5FE2YIfz:Mljiemj1YdoRRREu3g0gimS5FE21fz
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiwrapper.ini

Path C:\Users\Admin\AppData\Local\Temp\MW-0ba69d8a-9d3b-4621-a188-384770cb0653\msiwrapper.ini
Size 448B
SHA256 310037d776afb5ff30925a8dce76cb91562546ac888f4ee07d57adcd2baa5ec5
MD5 98cd2527cf280b42ae12053629a90f7e
SHA1 8e9447ae7f63d993efa9d340eb1003bb8ebf8e84
SHA512 440738c11245057624c152933ca8ef6c0f3c1be5871ee204006e4e30fcaa237ebc47aebac5b606abf876b5a8752ec1f13eb876d5e9403f6904869547fb31e17f
MD5 SHA1 SHA512

Submit Download

msiwrapper.ini

Path C:\Users\Admin\AppData\Local\Temp\MW-0ba69d8a-9d3b-4621-a188-384770cb0653\msiwrapper.ini
Size 1KB
SHA256 1d07be4cf763ffe3cdfa1bd1d83c067a8a253dc9fb4a220d428d1a6142d35f2e
MD5 fa458412c4268c03d9c2335ad35eea1d
SHA1 e46dbb41a74804c6e9359221bd523007f72e57c9
SHA512 f13156deeb52ee245ade0d7b2575184e438bf8d90274a6fffa6b2648c8f5d382f17209dd18af49b29d1c0573121f2e459796b50d1317025f64d7b3973030b1a9
MD5 SHA1 SHA512

Submit Download

msiwrapper.ini

Path C:\Users\Admin\AppData\Local\Temp\MW-0ba69d8a-9d3b-4621-a188-384770cb0653\msiwrapper.ini
Size 1KB
SHA256 e07166f8fb2efbe8ddafd38471dcbfe61a0716ea560bbd24594402884688e84c
MD5 27c6141b34d3f1d90197d4b0343dd91f
SHA1 37e0d50b350d2e04d346ba1104918449c66c0195
SHA512 33581665262abce3310093a4a64e69ff866bee4f00b88efa5162efc865e42ac81754e714978e68dca5529720e255342d3da8ad03708f5a61450128cf95a9c6e4
MD5 SHA1 SHA512

Submit Download

MSIED6D.tmp

Path C:\Windows\Installer\MSIED6D.tmp
Size 208KB
SHA256 107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c
MD5 d82b3fb861129c5d71f0cd2874f97216
SHA1 f3fe341d79224126e950d2691d574d147102b18d
SHA512 244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b
SSDEEP 3072:3spAtOdmXwCGjtYNKbYO2gjpcm8rRuqpjCLf2loHUvULyGxr5lqM2a8:BtOdiRQYpgjpjew5GAyGxjqo8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Autoit3.exe

Path C:\temp\Autoit3.exe
Size 704KB
SHA256 ab5e6b09b61459f2d82d09d1c62abe4f07a0c6624214dc46191b02415330c202
MD5 9acc4c8a133e28df5f1dabb3c7554cbe
SHA1 0f911bdef50d15922bd603feae8344efbfea2851
SHA512 7716bc68e70fade5877e04674326c9b0b561463772da7f48949b6c555f1091aa4edaf7886d05de3f976c3dcb95d4a8795c3ba181553b8248555691417addfe45
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdF3:6T3E53Myyzl0hMf1tr73
MD5 SHA1 SHA512 SSDEEP

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 23.0MB
SHA256 563ce6b758077c0e20aedc38bf35b9d785adda82e3f02ae55f3adde883d98e0e
MD5 c9fe15d6d906e06fe4e23de6824cc50b
SHA1 ffdff62e90aa88b3dccfa74a0de347de961ad5c8
SHA512 7c49716265dff58eb3baa154fff31172550f2228b259b1e5f7e0aac338eaa1c4af7df27863bedb940ae323be53ca0957854500efbff2f672e3e9dcccd3b0a471
SSDEEP 24576:Xjdmqn+MdoO/vvTLNKGep1bLhRBKGu9DVhwNExDAKta7mf+W4Du8cf9sz:3
MD5 SHA1 SHA512 SSDEEP

Submit Download

{72a32ae5-f860-447e-89bb-80d4fc01a548}_OnDiskSnapshotProp

Path \??\Volume{264a1d83-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{72a32ae5-f860-447e-89bb-80d4fc01a548}_OnDiskSnapshotProp
Size 6KB
SHA256 10274c1b53c4ffab4d47901f624fa3fbadd1885928f64fc29033207e3fcc7cc2
MD5 71768bd625961bf8efb9d067c4d7d531
SHA1 efff0ddeff493d4fb78ccd4a898ef5ceeed9b457
SHA512 f1f0f918d7cb0e1787ce115be469553e8e912bc54ae2ae6b05c58219194caa661f9db75de479fefbb5fb1b90e5c65db00d4fb32117621406bd08f7e4e34ba096
SSDEEP 96:Fkg5tpCYFpDD84LTHzbOHXOHBlBRQJ8Sc9XE56tOSVQEJ:mUTb++sVe
MD5 SHA1 SHA512 SSDEEP

Submit Download

Autoit3.exe

Path \??\c:\temp\Autoit3.exe
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

script.a3x

Path \??\c:\temp\script.a3x
Size 474KB
SHA256 9515b7b3ebe97e51842be2e91241f0332916d6ec8aecb767ba418de4d21f57f7
MD5 6354b28ac4bc8fa465d80c3ea3893116
SHA1 0eea737ad0a1a0cb5c3f14279a05d1fba6c6216d
SHA512 6150a7b646326f01118535c2469628de79e20b7461dccf44a2311d0c1f7e4ed2d8523e7671e26d9c843fabce2946ea33adf4cc4e6acfd3216e1e06cdc1efa53b
SSDEEP 12288:W5Qe8g4/NbKC6gKXAjdXmaE7OAxgimSMVI4gE2hO3/3Qf0d:3tIgS/LfgimS5FE2YIfI
MD5 SHA1 SHA512 SSDEEP

Submit Download

test.txt

Path \??\c:\temp\test.txt
Size 76B
SHA256 2a5eaa4fb540232306ee036ed870369570744b34d8bd17743293e4763d19933e
MD5 45306f5622da212035662680f1c09e0e
SHA1 a89ae25df7b6bc8a30c4dcfdc267cf912e17f1bb
SHA512 99c9a4c77b346cf95930575fdb6a0c7ef4fe3cc75831e8f4c5d8114d0b35ff8c7fa6ca4f4dca6b34b53bd133766565318da0904fb467f88a1d7f47d0577115b0
MD5 SHA1 SHA512

Submit Download

memory/1120-93-0x00000298728D0000-0x0000029872A70000-memory.dmp

Download

memory/1120-107-0x0000000075470000-0x0000000075818000-memory.dmp

Download

memory/1120-108-0x00000298728D0000-0x0000029872A70000-memory.dmp

Download

memory/1236-106-0x0000000005B70000-0x0000000005ECB000-memory.dmp

Download

memory/1236-105-0x0000000005B70000-0x0000000005ECB000-memory.dmp

Download

memory/1236-104-0x0000000004670000-0x0000000005640000-memory.dmp

Download