4118af93dcdfd0aa1ec6a08c9e5a893ee4ad53b4e81b7f6e6c9a4daedf243002

Analysis

max time kernel
138s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
16-07-2023 04:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CS-TG-64-c-2.msi
Size

87.9MB
MD5

3d1c32e1aed25780b60747208629a7e3
SHA1

3c8cd1f738724935ec53b8487d6762640ddfaf70
SHA256

4118af93dcdfd0aa1ec6a08c9e5a893ee4ad53b4e81b7f6e6c9a4daedf243002
SHA512

866f993737b1435936042a5c5bdfd12ad58eaa5c493242bc55eab2f91be2db149da58ea61168f5852fb72d220c4c1c39ffd08bf94d0f9932f0c29079e4dc0c69
SSDEEP

1572864:XCKawy0JEFm4X+8fXIA9A23rnE/PhfqJkerWNJTwuElK79nX/+z5vC1Eh88:XCKRl18vFATPYJbW4uYK79nXm4Eh88

Score

10^/10

evasion trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	reg.exe

Modifies Windows Firewall 1 TTPs 3 IoCs

evasion

Modify Existing Service

T1031

pid	Process
5000	netsh.exe
2752	netsh.exe
4868	netsh.exe

Executes dropped EXE 3 IoCs

pid	Process
3488	dac.exe
320	ConsoleProxy.exe
1112	Telegram.exe

Loads dropped DLL 10 IoCs

pid	Process
4772	MsiExec.exe
4772	MsiExec.exe
4772	MsiExec.exe
4772	MsiExec.exe
4772	MsiExec.exe
4772	MsiExec.exe
5088	MsiExec.exe
5088	MsiExec.exe
320	ConsoleProxy.exe
320	ConsoleProxy.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3488-215-0x0000000180000000-0x0000000180031000-memory.dmp	upx
behavioral1/memory/3488-218-0x0000000180000000-0x0000000180031000-memory.dmp	upx
behavioral1/memory/3488-217-0x0000000180000000-0x0000000180031000-memory.dmp	upx
behavioral1/memory/3488-219-0x0000000180000000-0x0000000180031000-memory.dmp	upx
behavioral1/memory/3488-220-0x0000000180000000-0x0000000180031000-memory.dmp	upx
behavioral1/memory/3488-235-0x0000000180000000-0x0000000180031000-memory.dmp	upx
behavioral1/memory/3488-255-0x0000000180000000-0x0000000180031000-memory.dmp	upx

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	ConsoleProxy.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	ConsoleProxy.exe
File opened (read-only)	\??\N:	ConsoleProxy.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\E:	ConsoleProxy.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	ConsoleProxy.exe
File opened (read-only)	\??\S:	ConsoleProxy.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Q:	ConsoleProxy.exe
File opened (read-only)	\??\Y:	ConsoleProxy.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	ConsoleProxy.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\B:	ConsoleProxy.exe
File opened (read-only)	\??\V:	ConsoleProxy.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\R:	ConsoleProxy.exe
File opened (read-only)	\??\Z:	ConsoleProxy.exe
File opened (read-only)	\??\K:	ConsoleProxy.exe
File opened (read-only)	\??\M:	ConsoleProxy.exe
File opened (read-only)	\??\O:	ConsoleProxy.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	ConsoleProxy.exe
File opened (read-only)	\??\W:	ConsoleProxy.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	ConsoleProxy.exe
File opened (read-only)	\??\X:	ConsoleProxy.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	ConsoleProxy.exe
File opened (read-only)	\??\J:	ConsoleProxy.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_F7F9B7BDCC367A8E3539D28F7D4D4BA2	dac.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_F7F9B7BDCC367A8E3539D28F7D4D4BA2	dac.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7229E30BCFD0992128433D951137A421_F0BB2463DDCCB4B49DC9200CC9E498E9	dac.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7229E30BCFD0992128433D951137A421_F0BB2463DDCCB4B49DC9200CC9E498E9	dac.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7229E30BCFD0992128433D951137A421_76EBFC12D6FD7EE9DD82775C12CF3BD5	dac.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7229E30BCFD0992128433D951137A421_76EBFC12D6FD7EE9DD82775C12CF3BD5	dac.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e5854d4.msi	msiexec.exe
File created	C:\Windows\Installer\e5854d2.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI55AD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5B7B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5854d2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5753.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{997F38C3-E68F-4219-8D4D-C234BE733C5E}	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000079cd0cec77ace0110000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000079cd0cec0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d012000000000000000032000000ffffffff00000000070001000068090079cd0cec000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01232000000000020ed0d000000ffffffff00000000070001000068091979cd0cec000000000000d0123200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000079cd0cec00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ConsoleProxy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ConsoleProxy.exe

Modifies data under HKEY_USERS 54 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mmc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	dac.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	dac.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	dac.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Recent File List	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Recent File List	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ConsoleProxy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ConsoleProxy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ConsoleProxy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7"	ConsoleProxy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	dac.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mmc.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ConsoleProxy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mmc.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Recent File List	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	ConsoleProxy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	ConsoleProxy.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Settings	mmc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@mmcbase.dll,-14008 = "Folder"	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	dac.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	ConsoleProxy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Recent File List	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ConsoleProxy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mmc.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Recent File List	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Settings	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Recent File List	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console	mmc.exe
Key created	\REGISTRY\USER\S-1-5-18_Classes\Local Settings	dac.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	ConsoleProxy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Settings	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mmc.exe

Modifies registry class 23 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3C83F799F86E9124D8D42C43EB37C3E5	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\67708036E3027134CBB5C9BE30891990	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3C83F799F86E9124D8D42C43EB37C3E5\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\Version = "16777216"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\67708036E3027134CBB5C9BE30891990\3C83F799F86E9124D8D42C43EB37C3E5	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\PackageCode = "65745A2C9FB1DBE429D470C895DA2819"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\Language = "2052"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList\PackageName = "CS-TG-64-c-2.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\ProductName = "CS-TG-64"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\Clients = 3a0000000000	msiexec.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
752	PING.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1112	Telegram.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3740	msiexec.exe
3740	msiexec.exe
320	ConsoleProxy.exe
320	ConsoleProxy.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2780	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2780	msiexec.exe
Token: SeSecurityPrivilege	3740	msiexec.exe
Token: SeCreateTokenPrivilege	2780	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2780	msiexec.exe
Token: SeLockMemoryPrivilege	2780	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2780	msiexec.exe
Token: SeMachineAccountPrivilege	2780	msiexec.exe
Token: SeTcbPrivilege	2780	msiexec.exe
Token: SeSecurityPrivilege	2780	msiexec.exe
Token: SeTakeOwnershipPrivilege	2780	msiexec.exe
Token: SeLoadDriverPrivilege	2780	msiexec.exe
Token: SeSystemProfilePrivilege	2780	msiexec.exe
Token: SeSystemtimePrivilege	2780	msiexec.exe
Token: SeProfSingleProcessPrivilege	2780	msiexec.exe
Token: SeIncBasePriorityPrivilege	2780	msiexec.exe
Token: SeCreatePagefilePrivilege	2780	msiexec.exe
Token: SeCreatePermanentPrivilege	2780	msiexec.exe
Token: SeBackupPrivilege	2780	msiexec.exe
Token: SeRestorePrivilege	2780	msiexec.exe
Token: SeShutdownPrivilege	2780	msiexec.exe
Token: SeDebugPrivilege	2780	msiexec.exe
Token: SeAuditPrivilege	2780	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2780	msiexec.exe
Token: SeChangeNotifyPrivilege	2780	msiexec.exe
Token: SeRemoteShutdownPrivilege	2780	msiexec.exe
Token: SeUndockPrivilege	2780	msiexec.exe
Token: SeSyncAgentPrivilege	2780	msiexec.exe
Token: SeEnableDelegationPrivilege	2780	msiexec.exe
Token: SeManageVolumePrivilege	2780	msiexec.exe
Token: SeImpersonatePrivilege	2780	msiexec.exe
Token: SeCreateGlobalPrivilege	2780	msiexec.exe
Token: SeCreateTokenPrivilege	2780	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2780	msiexec.exe
Token: SeLockMemoryPrivilege	2780	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2780	msiexec.exe
Token: SeMachineAccountPrivilege	2780	msiexec.exe
Token: SeTcbPrivilege	2780	msiexec.exe
Token: SeSecurityPrivilege	2780	msiexec.exe
Token: SeTakeOwnershipPrivilege	2780	msiexec.exe
Token: SeLoadDriverPrivilege	2780	msiexec.exe
Token: SeSystemProfilePrivilege	2780	msiexec.exe
Token: SeSystemtimePrivilege	2780	msiexec.exe
Token: SeProfSingleProcessPrivilege	2780	msiexec.exe
Token: SeIncBasePriorityPrivilege	2780	msiexec.exe
Token: SeCreatePagefilePrivilege	2780	msiexec.exe
Token: SeCreatePermanentPrivilege	2780	msiexec.exe
Token: SeBackupPrivilege	2780	msiexec.exe
Token: SeRestorePrivilege	2780	msiexec.exe
Token: SeShutdownPrivilege	2780	msiexec.exe
Token: SeDebugPrivilege	2780	msiexec.exe
Token: SeAuditPrivilege	2780	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2780	msiexec.exe
Token: SeChangeNotifyPrivilege	2780	msiexec.exe
Token: SeRemoteShutdownPrivilege	2780	msiexec.exe
Token: SeUndockPrivilege	2780	msiexec.exe
Token: SeSyncAgentPrivilege	2780	msiexec.exe
Token: SeEnableDelegationPrivilege	2780	msiexec.exe
Token: SeManageVolumePrivilege	2780	msiexec.exe
Token: SeImpersonatePrivilege	2780	msiexec.exe
Token: SeCreateGlobalPrivilege	2780	msiexec.exe
Token: SeCreateTokenPrivilege	2780	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2780	msiexec.exe
Token: SeLockMemoryPrivilege	2780	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2780	msiexec.exe
2780	msiexec.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
3488	dac.exe
3488	dac.exe
4696	mmc.exe
4696	mmc.exe
4520	mmc.exe
4520	mmc.exe
4428	mmc.exe
4428	mmc.exe
320	ConsoleProxy.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 3740 wrote to memory of 4772	3740	msiexec.exe	87
PID 3740 wrote to memory of 4772	3740	msiexec.exe	87
PID 3740 wrote to memory of 4772	3740	msiexec.exe	87
PID 3740 wrote to memory of 3296	3740	msiexec.exe	102
PID 3740 wrote to memory of 3296	3740	msiexec.exe	102
PID 3740 wrote to memory of 5088	3740	msiexec.exe	104
PID 3740 wrote to memory of 5088	3740	msiexec.exe	104
PID 3740 wrote to memory of 5088	3740	msiexec.exe	104
PID 3740 wrote to memory of 3488	3740	msiexec.exe	105
PID 3740 wrote to memory of 3488	3740	msiexec.exe	105
PID 4696 wrote to memory of 1828	4696	mmc.exe	108
PID 4696 wrote to memory of 1828	4696	mmc.exe	108
PID 4520 wrote to memory of 1808	4520	mmc.exe	112
PID 4520 wrote to memory of 1808	4520	mmc.exe	112
PID 3488 wrote to memory of 2028	3488	dac.exe	114
PID 3488 wrote to memory of 2028	3488	dac.exe	114
PID 2028 wrote to memory of 3192	2028	cmd.exe	116
PID 2028 wrote to memory of 3192	2028	cmd.exe	116
PID 2028 wrote to memory of 1376	2028	cmd.exe	117
PID 2028 wrote to memory of 1376	2028	cmd.exe	117
PID 2028 wrote to memory of 2008	2028	cmd.exe	118
PID 2028 wrote to memory of 2008	2028	cmd.exe	118
PID 3488 wrote to memory of 852	3488	dac.exe	119
PID 3488 wrote to memory of 852	3488	dac.exe	119
PID 4428 wrote to memory of 320	4428	mmc.exe	122
PID 4428 wrote to memory of 320	4428	mmc.exe	122
PID 4428 wrote to memory of 320	4428	mmc.exe	122
PID 320 wrote to memory of 5000	320	ConsoleProxy.exe	124
PID 320 wrote to memory of 5000	320	ConsoleProxy.exe	124
PID 320 wrote to memory of 5000	320	ConsoleProxy.exe	124
PID 320 wrote to memory of 2752	320	ConsoleProxy.exe	125
PID 320 wrote to memory of 2752	320	ConsoleProxy.exe	125
PID 320 wrote to memory of 2752	320	ConsoleProxy.exe	125
PID 320 wrote to memory of 4868	320	ConsoleProxy.exe	126
PID 320 wrote to memory of 4868	320	ConsoleProxy.exe	126
PID 320 wrote to memory of 4868	320	ConsoleProxy.exe	126
PID 3488 wrote to memory of 1032	3488	dac.exe	127
PID 3488 wrote to memory of 1032	3488	dac.exe	127
PID 1032 wrote to memory of 752	1032	cmd.exe	130
PID 1032 wrote to memory of 752	1032	cmd.exe	130
PID 320 wrote to memory of 224	320	ConsoleProxy.exe	131
PID 320 wrote to memory of 224	320	ConsoleProxy.exe	131
PID 320 wrote to memory of 224	320	ConsoleProxy.exe	131
PID 320 wrote to memory of 4596	320	ConsoleProxy.exe	133
PID 320 wrote to memory of 4596	320	ConsoleProxy.exe	133
PID 320 wrote to memory of 4596	320	ConsoleProxy.exe	133

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\CS-TG-64-c-2.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2780

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3740
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 69CF7EAC06753722BEB13F63D56E1AC7 C
  2⤵
  - Loads dropped DLL
  PID:4772
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3296
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9B2AB68D8B3A032728D93E2EACD50B92
  2⤵
  - Loads dropped DLL
  PID:5088
- C:\Users\Admin\AppData\Roaming\CS-TG-64\tdata\emoji\dac.exe
  "C:\Users\Admin\AppData\Roaming\CS-TG-64\tdata\emoji\dac.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3488
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\0TS5X.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2028
  - - C:\Windows\system32\reg.exe
      reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t reg_dword /d 0 /F
      4⤵
      UAC bypass
      PID:3192
  - - C:\Windows\system32\reg.exe
      reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t reg_dword /d 0 /F
      4⤵
      UAC bypass
      PID:1376
  - - C:\Windows\system32\reg.exe
      reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v PromptOnSecureDesktop /t reg_dword /d 0 /F
      4⤵
      UAC bypass
      PID:2008
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy /b C:\Users\Public\Pictures\24Y4t\bMlJf@c\v + C:\Users\Public\Pictures\24Y4t\bMlJf@c\b C:\Users\Public\Pictures\24Y4t\bMlJf@c\openconsolepacket.dll
    3⤵
    PID:852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Roaming\CS-TG-64\tdata\emoji\dac.exe > nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1032
  - - C:\Windows\system32\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      Runs ping.exe
      PID:752

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2748

C:\Windows\system32\mmc.exe
C:\Windows\system32\mmc.exe -Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" interface ip set address 以太网 static 1.0.0.2 255.255.255.0 1.0.0.1 1
  2⤵
  PID:1828

C:\Windows\system32\mmc.exe
C:\Windows\system32\mmc.exe -Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" interface ip set address \"WLAN\" static 1.0.0.3 255.255.255.0 1.0.0.1 1
  2⤵
  PID:1808

C:\Windows\system32\mmc.exe
C:\Windows\system32\mmc.exe -Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4428
- C:\Users\Public\Pictures\24Y4t\bMlJf@c\ConsoleProxy.exe
  "C:\Users\Public\Pictures\24Y4t\bMlJf@c\ConsoleProxy.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:320
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall delete rule name="" program="C:\Users\Public\Pictures\24Y4t\bMlJf@c\ConsoleProxy.exe"
    3⤵
    - Modifies Windows Firewall
    PID:5000
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="" dir=in action=allow program="C:\Users\Public\Pictures\24Y4t\bMlJf@c\ConsoleProxy.exe" description=""
    3⤵
    - Modifies Windows Firewall
    PID:2752
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="" dir=out action=allow program="C:\Users\Public\Pictures\24Y4t\bMlJf@c\ConsoleProxy.exe" description=""
    3⤵
    - Modifies Windows Firewall
    PID:4868
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\System32\netsh.exe" interface ip set address \"ÒÔÌ«Íø\" dhcp
    3⤵
    PID:224
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\System32\netsh.exe" interface ip set address \"WLAN\" dhcp
    3⤵
    PID:4596

C:\Users\Admin\AppData\Roaming\CS-TG-64\Telegram.exe
"C:\Users\Admin\AppData\Roaming\CS-TG-64\Telegram.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
PID:1112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5854d3.rbs

Filesize
10KB

MD5
813172b1d527375c8be8048026c93dd4

SHA1
4e268dbc569e97d3e98b776f64e03499a5ace73e

SHA256
090400439a761277ada379f720e6548d88e88dac7dbfd1860d734880e8c4b07f

SHA512
066415c7b1a60ecbbe196a9befd845e908f68edcf2dfd7b1a4f1482028081b04b64b69b2b88e2dc7b811b89ec6c8aaa72d52838e71a2a00202e3107e21c4ebdd

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA0F3.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA0F3.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA3A3.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA3A3.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA450.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA450.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA450.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA50D.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA50D.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA56C.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA56C.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA703.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA703.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Roaming\0TS5X.bat

Filesize
392B

MD5
30d6eb22d6aeec10347239b17b023bf4

SHA1
e2a6f86d66c699f6e0ff1ac4e140af4a2a4637d1

SHA256
659df6b190a0b92fc34e3a4457b4a8d11a26a4caf55de64dfe79eb1276181f08

SHA512
500872c3f2f3f801ec51717690873194675cb7f32cc4a862c09d90c18638d364d49b0e04c32323f52734e5c806e3503a63ac755c7019d762786a72840123df76

Download Submit
C:\Users\Admin\AppData\Roaming\CS-TG-64\Telegram.exe

Filesize
88.0MB

MD5
283591200a755fac312816e83e597073

SHA1
34344318bf7d82d64f96fa1a936394c62a283a12

SHA256
3573afd4c4bd9a5c8753521b739c6136089dead2d1397b61d1e047fc20ad2606

SHA512
98fbf755e26d90092bf395889e1c36e24d045a0f5277094a8ddcb7eb563543742e03a461ec611c1d1cec68cf1c715ed98b896811d3d8aa2cb88974eab8fe2210

Download Submit
C:\Users\Admin\AppData\Roaming\CS-TG-64\Telegram.exe

Filesize
87.8MB

MD5
d8fed3e46c270faa1f22f8594fe2a6f9

SHA1
49f3ebf6c0009101543c451fdbc2518979cff654

SHA256
2c37abf52c0d08f31f9aec63165b91bd2e1634e6d7954e7d7848af5157761272

SHA512
9ac24cd959d880b452bf233d2e6b4541682145d3b2a6169e46c50f037059bef4cd7b38479d2fdf4361d0ffae33751daa8ff622f034e457e122a35c2548bf9a34

Download Submit
C:\Users\Admin\AppData\Roaming\CS-TG-64\tdata\emoji\cache_22_7

Filesize
9.0MB

MD5
be5628882d28ba1bdb9850dc4b7e7fa1

SHA1
6d37839c4b8ded05c0e8108696e1b794de59a2a8

SHA256
def949e97a2a2d2e504f7c85a27a6f2fd44d3a898357398f4aaa7eb033dfb287

SHA512
16037fd6ee2bb26e1014e9e69a2ee5d7290ebe5021ed1eedaa5908b73c39cc2ba6f66c553be9a39163b8831e8f519b10009e71fb94ce392c7229541192aa1c39

Download Submit
C:\Users\Admin\AppData\Roaming\CS-TG-64\tdata\emoji\dac.exe

Filesize
30.8MB

MD5
8ec05535c281255297e6385427ea9ba1

SHA1
505d128948b45a5f752fb190cbeec1db16eea39f

SHA256
1914900753f9baf2138105f67c5716f1e961f9c0ad9746a423f2529a5419966d

SHA512
75eedbe257583f1b201807eff2af9237e9220397c669aebd6f9d6226cb140d99048c6fb7eda111dec591df8d80b723ed1f80f45fc64bee88bf3da879342484c2

Download Submit
C:\Users\Admin\AppData\Roaming\CS-TG-64\tdata\emoji\dac.exe

Filesize
30.8MB

MD5
8ec05535c281255297e6385427ea9ba1

SHA1
505d128948b45a5f752fb190cbeec1db16eea39f

SHA256
1914900753f9baf2138105f67c5716f1e961f9c0ad9746a423f2529a5419966d

SHA512
75eedbe257583f1b201807eff2af9237e9220397c669aebd6f9d6226cb140d99048c6fb7eda111dec591df8d80b723ed1f80f45fc64bee88bf3da879342484c2

Download Submit
C:\Users\Admin\AppData\Roaming\CS-TG-64\tdata\usertag

Filesize
8B

MD5
02fcd3a4e0f4bef1016affcce43facfe

SHA1
7aabd850de5437a3c468eee9c04bed4beb775279

SHA256
af85e9ba6adee8fc04b413d9e865e49268e9b5f6f61557ab17d0c8c1294e1666

SHA512
0d69295f1f9585bac640cb6b2277e6d820778e71f35df80296298799365fff73ede43c7e1b6bb07da7c22d73541b5de3f5ea087b83a64fd08792d4368cbd7bb1

Download Submit
C:\Users\Public\Pictures\24Y4t\bMlJf@c\ConsoleProxy.exe

Filesize
904KB

MD5
11c8023d0eb9a24b0717cbf84965a8ff

SHA1
0d095bab69f790618c4b2f35f74406b603f073aa

SHA256
86cfb935c6eb9898d6545db6bbf9713cde8f7761c8c41be08f707a53342b3bfb

SHA512
b6d9d8b21c3d5763131b78e473bf91ed0a7bf7a8f1e3c10ebecb1c3b47629184cdc6b88f55a645b95acb575e27fec12e6d904b4871460a6d724cc97bf3d868f6

Download Submit
C:\Users\Public\Pictures\24Y4t\bMlJf@c\ConsoleProxy.exe

Filesize
904KB

MD5
11c8023d0eb9a24b0717cbf84965a8ff

SHA1
0d095bab69f790618c4b2f35f74406b603f073aa

SHA256
86cfb935c6eb9898d6545db6bbf9713cde8f7761c8c41be08f707a53342b3bfb

SHA512
b6d9d8b21c3d5763131b78e473bf91ed0a7bf7a8f1e3c10ebecb1c3b47629184cdc6b88f55a645b95acb575e27fec12e6d904b4871460a6d724cc97bf3d868f6

Download Submit
C:\Users\Public\Pictures\24Y4t\bMlJf@c\PX.log

Filesize
156KB

MD5
a97e626e8a762bb0f86080d7a6bb1476

SHA1
6c44aa4aea9920c97645a7d5dedab5eb222ba350

SHA256
ec2b3c1424df05333f89c23c21734f50e457e70355fb8001fbaa2258be753268

SHA512
7fbf13711694d6a7541d20172e982f5cf87759eb7e22c3dff9eeca396b49440ec0ecd12bd3a22aa1f7bbaf379c24fe5a46abe4796f071f35b7d39eaa602caf1d

Download Submit
C:\Users\Public\Pictures\24Y4t\bMlJf@c\b

Filesize
95KB

MD5
49229abe0956938e3ba4ae83602066a7

SHA1
c5d150884f4a13cf1b39c0cc75cfa463b29e5e43

SHA256
914a41788fb08b2c7b0da630b305234d9f2cf4c95cc7ec98f13a0fc82ff0f552

SHA512
e1282e15db22856ddf7191fcf1fc1a87f56cbb84ea8dcd62b72f5c090634c9ce29573c01cfe5fa3385b833d1a2612651b77a8c92679929885df11694a8f96b77

Download Submit
C:\Users\Public\Pictures\24Y4t\bMlJf@c\openconsolepacket.dll

Filesize
191KB

MD5
e6912fe59dbaa3e8ce961f28a967ebbb

SHA1
86ea35b8ddea47ac15d62d74d06ad00f7582db14

SHA256
6a996cc140d07a2b46402d88ca1d4e105a8f067f8a0876c59d0da56a22826798

SHA512
7c065dd460c5c33c67b9be4f5a277a02d9c081a7456d693e03c0e1a4fa6c44fa98e92ef1848ed2d458b1c603a93777fcac79760b43efdf0c08dc69b70c938329

Download Submit
C:\Users\Public\Pictures\24Y4t\bMlJf@c\openconsolepacket.dll

Filesize
191KB

MD5
e6912fe59dbaa3e8ce961f28a967ebbb

SHA1
86ea35b8ddea47ac15d62d74d06ad00f7582db14

SHA256
6a996cc140d07a2b46402d88ca1d4e105a8f067f8a0876c59d0da56a22826798

SHA512
7c065dd460c5c33c67b9be4f5a277a02d9c081a7456d693e03c0e1a4fa6c44fa98e92ef1848ed2d458b1c603a93777fcac79760b43efdf0c08dc69b70c938329

Download Submit
C:\Users\Public\Pictures\24Y4t\bMlJf@c\openconsolewpcap.dll

Filesize
323KB

MD5
a7f09b55c208d954a0c08e3075284299

SHA1
4bed18499eb811012d933fb8c556ab1edcb69e9e

SHA256
9341fbbfdeafd25f464ec852ab0ae33afc5bc5f947cfc0a744436502732c2b42

SHA512
1da7b45d131d1e0ef066ed64ce0622228b24e80b4128b4df9b4626fab98f0d41d52bbcd2ef4bfad65381aaa3b5e4a8508dcad3e55e906b156ce4adabc1c8e37c

Download Submit
C:\Users\Public\Pictures\24Y4t\bMlJf@c\openconsolewpcap.dll

Filesize
323KB

MD5
a7f09b55c208d954a0c08e3075284299

SHA1
4bed18499eb811012d933fb8c556ab1edcb69e9e

SHA256
9341fbbfdeafd25f464ec852ab0ae33afc5bc5f947cfc0a744436502732c2b42

SHA512
1da7b45d131d1e0ef066ed64ce0622228b24e80b4128b4df9b4626fab98f0d41d52bbcd2ef4bfad65381aaa3b5e4a8508dcad3e55e906b156ce4adabc1c8e37c

Download Submit
C:\Users\Public\Pictures\24Y4t\bMlJf@c\v

Filesize
95KB

MD5
01e16df2a3d27d442116d5eadf39e7e8

SHA1
3922c7bfa76c90cf3f910efd3fcad7f158fd6fec

SHA256
35e5d3c71ee21bff8e2a4560766437a01fbfdfadd22054838cd710ce8c861e28

SHA512
54627829103cb5304675761bb54d2f8548191f07ea25f13d2134d9b1867231732cceed2b2907f88383ddd49b71d55be81423d85f8c4a3d0466ac41e58b1f6136

Download Submit
C:\Windows\Installer\MSI55AD.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Windows\Installer\MSI55AD.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Windows\Installer\MSI5753.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Windows\Installer\MSI5753.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Windows\Installer\e5854d2.msi

Filesize
87.9MB

MD5
3d1c32e1aed25780b60747208629a7e3

SHA1
3c8cd1f738724935ec53b8487d6762640ddfaf70

SHA256
4118af93dcdfd0aa1ec6a08c9e5a893ee4ad53b4e81b7f6e6c9a4daedf243002

SHA512
866f993737b1435936042a5c5bdfd12ad58eaa5c493242bc55eab2f91be2db149da58ea61168f5852fb72d220c4c1c39ffd08bf94d0f9932f0c29079e4dc0c69

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.0MB

MD5
d04b78c55641e4793005e84692762fcf

SHA1
fb4275030f52a0d8961b34aaf1968c09dae45720

SHA256
5bb5ae212b4a0fe2d2231e64892b02ca68c76cfd923752c6f14157e991bdfd7a

SHA512
fb233f4413f27c19c4e7fbc57c80b175f8377256bfa9d5fd0836d2406222a6353656f0e30176f274a92bee7ea9b8848a3448b9770ca49658a9cccc01610ea18c

Download Submit
\??\Volume{ec0ccd79-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{95155b56-0990-4f1e-8c0d-4adbc4b4251f}_OnDiskSnapshotProp

Filesize
5KB

MD5
cf817d8e6bc8c19fe415e0c312b24d4e

SHA1
fb450377c80156bd0f1bcb8275f73b969c6a84ab

SHA256
5f4fb1a756b6349db9442df72fbdc416cdc6f278d7ea781835409fb0e1f49892

SHA512
19394aff072969750de0604b291fef59faa456e860a1c52c5efbdaa33169142c031cec138a91abfea54b68689e1599fc75114f8c46254fcfa1b680eb272d8ddc

Download Submit
memory/320-277-0x0000000002750000-0x00000000027AE000-memory.dmp

Filesize
376KB

Download
memory/320-281-0x0000000002750000-0x00000000027AE000-memory.dmp

Filesize
376KB

Download
memory/320-278-0x0000000002750000-0x00000000027AE000-memory.dmp

Filesize
376KB

Download
memory/320-279-0x0000000002750000-0x00000000027AE000-memory.dmp

Filesize
376KB

Download
memory/320-260-0x0000000002750000-0x00000000027AE000-memory.dmp

Filesize
376KB

Download
memory/320-257-0x0000000002750000-0x00000000027AE000-memory.dmp

Filesize
376KB

Download
memory/320-271-0x0000000002750000-0x00000000027AE000-memory.dmp

Filesize
376KB

Download
memory/320-283-0x0000000002750000-0x00000000027AE000-memory.dmp

Filesize
376KB

Download
memory/320-282-0x0000000002750000-0x00000000027AE000-memory.dmp

Filesize
376KB

Download
memory/320-258-0x0000000002750000-0x00000000027AE000-memory.dmp

Filesize
376KB

Download
memory/1112-289-0x0000021795710000-0x0000021795720000-memory.dmp

Filesize
64KB

Download
memory/3488-220-0x0000000180000000-0x0000000180031000-memory.dmp

Filesize
196KB

Download
memory/3488-255-0x0000000180000000-0x0000000180031000-memory.dmp

Filesize
196KB

Download
memory/3488-215-0x0000000180000000-0x0000000180031000-memory.dmp

Filesize
196KB

Download
memory/3488-217-0x0000000180000000-0x0000000180031000-memory.dmp

Filesize
196KB

Download
memory/3488-218-0x0000000180000000-0x0000000180031000-memory.dmp

Filesize
196KB

Download
memory/3488-219-0x0000000180000000-0x0000000180031000-memory.dmp

Filesize
196KB

Download
memory/3488-235-0x0000000180000000-0x0000000180031000-memory.dmp

Filesize
196KB

Download