beb1c209e511b20fd914c2a55d557aab557535f46ef3e1ffd70e478e375c483a

Analysis

max time kernel
141s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
23-08-2023 05:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TG-x64.msi
Size

85.0MB
MD5

f55bad2eb9042a2602b0ec3e85229a12
SHA1

3ab48b03629dfff4afb9a5a883e93e5a63011849
SHA256

beb1c209e511b20fd914c2a55d557aab557535f46ef3e1ffd70e478e375c483a
SHA512

8b9ebac68c158d6d7823e728afa0424c582ce31a13e928a90cd77ea1970daba5df2af7c211c3d9122ab06414b8b773af60fe9f294f61d7b3702ce0d2a9275ad0
SSDEEP

1572864:3CKa/mZuqQjEedKzR+X2JoqtK5vWcPTlXLquLznMOSRzqVMwa6uM5L6smN9IWO+B:3CKZuqQAedcsX1LlWcPThGGzPSRzZwo9

Score

10^/10

evasion trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	reg.exe

Executes dropped EXE 2 IoCs

Processes:

dach.exeAliIM.exe

pid process

2788 dach.exe
2436 AliIM.exe
Loads dropped DLL 9 IoCs

Processes:

MsiExec.exeMsiExec.exeAliIM.exe

pid process

2268 MsiExec.exe
2268 MsiExec.exe
2268 MsiExec.exe
2268 MsiExec.exe
2268 MsiExec.exe
2268 MsiExec.exe
3964 MsiExec.exe
3964 MsiExec.exe
2436 AliIM.exe

pid	process
2788	dach.exe
2436	AliIM.exe

pid	process
2268	MsiExec.exe
2268	MsiExec.exe
2268	MsiExec.exe
2268	MsiExec.exe
2268	MsiExec.exe
2268	MsiExec.exe
3964	MsiExec.exe
3964	MsiExec.exe
2436	AliIM.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral3/memory/2788-222-0x0000000180000000-0x000000018003E000-memory.dmp	upx
behavioral3/memory/2788-224-0x0000000180000000-0x000000018003E000-memory.dmp	upx
behavioral3/memory/2788-225-0x0000000180000000-0x000000018003E000-memory.dmp	upx
behavioral3/memory/2788-226-0x0000000180000000-0x000000018003E000-memory.dmp	upx
behavioral3/memory/2788-227-0x0000000180000000-0x000000018003E000-memory.dmp	upx
behavioral3/memory/2788-239-0x0000000180000000-0x000000018003E000-memory.dmp	upx
behavioral3/memory/2788-263-0x0000000180000000-0x000000018003E000-memory.dmp	upx

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exeAliIM.exe

description	ioc	process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	AliIM.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	AliIM.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\W:	AliIM.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\P:	AliIM.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	AliIM.exe
File opened (read-only)	\??\M:	AliIM.exe
File opened (read-only)	\??\N:	AliIM.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\O:	AliIM.exe
File opened (read-only)	\??\V:	AliIM.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\I:	AliIM.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	AliIM.exe
File opened (read-only)	\??\R:	AliIM.exe
File opened (read-only)	\??\S:	AliIM.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	AliIM.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\E:	AliIM.exe
File opened (read-only)	\??\U:	AliIM.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	AliIM.exe
File opened (read-only)	\??\J:	AliIM.exe
File opened (read-only)	\??\L:	AliIM.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\T:	AliIM.exe

Drops file in System32 directory 6 IoCs

Processes:

dach.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_F7F9B7BDCC367A8E3539D28F7D4D4BA2	dach.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7229E30BCFD0992128433D951137A421_F0BB2463DDCCB4B49DC9200CC9E498E9	dach.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7229E30BCFD0992128433D951137A421_F0BB2463DDCCB4B49DC9200CC9E498E9	dach.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7229E30BCFD0992128433D951137A421_76EBFC12D6FD7EE9DD82775C12CF3BD5	dach.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7229E30BCFD0992128433D951137A421_76EBFC12D6FD7EE9DD82775C12CF3BD5	dach.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_F7F9B7BDCC367A8E3539D28F7D4D4BA2	dach.exe

Drops file in Windows directory 10 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\e58f364.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e58f364.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF46D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF539.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{64C771E6-49B2-43AB-9C7C-204A7AEEFF42}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF9CE.tmp	msiexec.exe
File created	C:\Windows\Installer\e58f366.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 64 IoCs

Processes:

mmc.exemmc.exeexplorer.exemmc.exedach.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Recent File List	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowTypeOverlay = "1"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	dach.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	dach.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Settings	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	dach.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mmc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState = 240000003428000000000000000000000000000001000000130000000000000062000000	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\DontPrettyPath = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowStatusBar = "1"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Recent File List	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden = "2"	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Filter = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\RenderSoft TextCalc\TextCalc\Recent File List	dach.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	dach.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowCompColor = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\IconsOnly = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\SeparateProcess = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AutoCheckSelect = "0"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\RenderSoft TextCalc\TextCalc	dach.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mmc.exe
Key created	\REGISTRY\USER\S-1-5-18_Classes\Local Settings	dach.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\ExplorerStartupTraceRecorded = "1"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	explorer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\RenderSoft TextCalc	dach.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dach.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	dach.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Settings	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Recent File List	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideIcons = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	dach.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowInfoTip = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\MapNetDrvBtn = "0"	explorer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\RenderSoft TextCalc\TextCalc\Settings	dach.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Settings	mmc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@mmcbase.dll,-14008 = "Folder"	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\WebView = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	dach.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	dach.exe

Modifies registry class 23 IoCs

Processes:

msiexec.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E177C462B94BA34C9C702A4A7EEFF24\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E177C462B94BA34C9C702A4A7EEFF24\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E177C462B94BA34C9C702A4A7EEFF24	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E177C462B94BA34C9C702A4A7EEFF24\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E177C462B94BA34C9C702A4A7EEFF24\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E177C462B94BA34C9C702A4A7EEFF24\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E177C462B94BA34C9C702A4A7EEFF24\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6E177C462B94BA34C9C702A4A7EEFF24	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E177C462B94BA34C9C702A4A7EEFF24\ProductName = "HIP-THH"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E177C462B94BA34C9C702A4A7EEFF24\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B0B06FDC9804AA44B87795745B93C68C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B0B06FDC9804AA44B87795745B93C68C\6E177C462B94BA34C9C702A4A7EEFF24	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E177C462B94BA34C9C702A4A7EEFF24\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E177C462B94BA34C9C702A4A7EEFF24\Version = "16777216"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E177C462B94BA34C9C702A4A7EEFF24\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E177C462B94BA34C9C702A4A7EEFF24\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E177C462B94BA34C9C702A4A7EEFF24\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E177C462B94BA34C9C702A4A7EEFF24\SourceList\PackageName = "TG-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E177C462B94BA34C9C702A4A7EEFF24\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E177C462B94BA34C9C702A4A7EEFF24\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6E177C462B94BA34C9C702A4A7EEFF24\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E177C462B94BA34C9C702A4A7EEFF24\PackageCode = "88BDD1AFCC554E34FA442BDB0A4E3ECC"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E177C462B94BA34C9C702A4A7EEFF24\Language = "2052"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

msiexec.exeAliIM.exe

pid process

2476 msiexec.exe
2476 msiexec.exe
2436 AliIM.exe
2436 AliIM.exe
Suspicious behavior: SetClipboardViewer 2 IoCs

Processes:

mmc.exemmc.exe

pid process

988 mmc.exe
4484 mmc.exe

pid	process
2476	msiexec.exe
2476	msiexec.exe
2436	AliIM.exe
2436	AliIM.exe

pid	process
988	mmc.exe
4484	mmc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	2888	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2888	msiexec.exe
Token: SeSecurityPrivilege	2476	msiexec.exe
Token: SeCreateTokenPrivilege	2888	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2888	msiexec.exe
Token: SeLockMemoryPrivilege	2888	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2888	msiexec.exe
Token: SeMachineAccountPrivilege	2888	msiexec.exe
Token: SeTcbPrivilege	2888	msiexec.exe
Token: SeSecurityPrivilege	2888	msiexec.exe
Token: SeTakeOwnershipPrivilege	2888	msiexec.exe
Token: SeLoadDriverPrivilege	2888	msiexec.exe
Token: SeSystemProfilePrivilege	2888	msiexec.exe
Token: SeSystemtimePrivilege	2888	msiexec.exe
Token: SeProfSingleProcessPrivilege	2888	msiexec.exe
Token: SeIncBasePriorityPrivilege	2888	msiexec.exe
Token: SeCreatePagefilePrivilege	2888	msiexec.exe
Token: SeCreatePermanentPrivilege	2888	msiexec.exe
Token: SeBackupPrivilege	2888	msiexec.exe
Token: SeRestorePrivilege	2888	msiexec.exe
Token: SeShutdownPrivilege	2888	msiexec.exe
Token: SeDebugPrivilege	2888	msiexec.exe
Token: SeAuditPrivilege	2888	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2888	msiexec.exe
Token: SeChangeNotifyPrivilege	2888	msiexec.exe
Token: SeRemoteShutdownPrivilege	2888	msiexec.exe
Token: SeUndockPrivilege	2888	msiexec.exe
Token: SeSyncAgentPrivilege	2888	msiexec.exe
Token: SeEnableDelegationPrivilege	2888	msiexec.exe
Token: SeManageVolumePrivilege	2888	msiexec.exe
Token: SeImpersonatePrivilege	2888	msiexec.exe
Token: SeCreateGlobalPrivilege	2888	msiexec.exe
Token: SeCreateTokenPrivilege	2888	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2888	msiexec.exe
Token: SeLockMemoryPrivilege	2888	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2888	msiexec.exe
Token: SeMachineAccountPrivilege	2888	msiexec.exe
Token: SeTcbPrivilege	2888	msiexec.exe
Token: SeSecurityPrivilege	2888	msiexec.exe
Token: SeTakeOwnershipPrivilege	2888	msiexec.exe
Token: SeLoadDriverPrivilege	2888	msiexec.exe
Token: SeSystemProfilePrivilege	2888	msiexec.exe
Token: SeSystemtimePrivilege	2888	msiexec.exe
Token: SeProfSingleProcessPrivilege	2888	msiexec.exe
Token: SeIncBasePriorityPrivilege	2888	msiexec.exe
Token: SeCreatePagefilePrivilege	2888	msiexec.exe
Token: SeCreatePermanentPrivilege	2888	msiexec.exe
Token: SeBackupPrivilege	2888	msiexec.exe
Token: SeRestorePrivilege	2888	msiexec.exe
Token: SeShutdownPrivilege	2888	msiexec.exe
Token: SeDebugPrivilege	2888	msiexec.exe
Token: SeAuditPrivilege	2888	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2888	msiexec.exe
Token: SeChangeNotifyPrivilege	2888	msiexec.exe
Token: SeRemoteShutdownPrivilege	2888	msiexec.exe
Token: SeUndockPrivilege	2888	msiexec.exe
Token: SeSyncAgentPrivilege	2888	msiexec.exe
Token: SeEnableDelegationPrivilege	2888	msiexec.exe
Token: SeManageVolumePrivilege	2888	msiexec.exe
Token: SeImpersonatePrivilege	2888	msiexec.exe
Token: SeCreateGlobalPrivilege	2888	msiexec.exe
Token: SeCreateTokenPrivilege	2888	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2888	msiexec.exe
Token: SeLockMemoryPrivilege	2888	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

2888 msiexec.exe
2888 msiexec.exe
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

dach.exemmc.exemmc.exemmc.exe

pid process

2788 dach.exe
2788 dach.exe
3208 mmc.exe
3208 mmc.exe
988 mmc.exe
988 mmc.exe
4484 mmc.exe
4484 mmc.exe

pid	process
2888	msiexec.exe
2888	msiexec.exe

pid	process
2788	dach.exe
2788	dach.exe
3208	mmc.exe
3208	mmc.exe
988	mmc.exe
988	mmc.exe
4484	mmc.exe
4484	mmc.exe

Suspicious use of WriteProcessMemory 35 IoCs

Processes:

msiexec.exemmc.exemmc.exedach.execmd.exemmc.exeexplorer.exeAliIM.exe

description	pid	process	target process
PID 2476 wrote to memory of 2268	2476	msiexec.exe	MsiExec.exe
PID 2476 wrote to memory of 2268	2476	msiexec.exe	MsiExec.exe
PID 2476 wrote to memory of 2268	2476	msiexec.exe	MsiExec.exe
PID 2476 wrote to memory of 2784	2476	msiexec.exe	srtasks.exe
PID 2476 wrote to memory of 2784	2476	msiexec.exe	srtasks.exe
PID 2476 wrote to memory of 3964	2476	msiexec.exe	MsiExec.exe
PID 2476 wrote to memory of 3964	2476	msiexec.exe	MsiExec.exe
PID 2476 wrote to memory of 3964	2476	msiexec.exe	MsiExec.exe
PID 2476 wrote to memory of 2788	2476	msiexec.exe	dach.exe
PID 2476 wrote to memory of 2788	2476	msiexec.exe	dach.exe
PID 3208 wrote to memory of 3480	3208	mmc.exe	netsh.exe
PID 3208 wrote to memory of 3480	3208	mmc.exe	netsh.exe
PID 988 wrote to memory of 3076	988	mmc.exe	netsh.exe
PID 988 wrote to memory of 3076	988	mmc.exe	netsh.exe
PID 2788 wrote to memory of 3008	2788	dach.exe	cmd.exe
PID 2788 wrote to memory of 3008	2788	dach.exe	cmd.exe
PID 3008 wrote to memory of 3816	3008	cmd.exe	reg.exe
PID 3008 wrote to memory of 3816	3008	cmd.exe	reg.exe
PID 3008 wrote to memory of 5012	3008	cmd.exe	reg.exe
PID 3008 wrote to memory of 5012	3008	cmd.exe	reg.exe
PID 3008 wrote to memory of 2772	3008	cmd.exe	reg.exe
PID 3008 wrote to memory of 2772	3008	cmd.exe	reg.exe
PID 2788 wrote to memory of 224	2788	dach.exe	cmd.exe
PID 2788 wrote to memory of 224	2788	dach.exe	cmd.exe
PID 4484 wrote to memory of 3520	4484	mmc.exe	explorer.exe
PID 4484 wrote to memory of 3520	4484	mmc.exe	explorer.exe
PID 3396 wrote to memory of 2436	3396	explorer.exe	AliIM.exe
PID 3396 wrote to memory of 2436	3396	explorer.exe	AliIM.exe
PID 3396 wrote to memory of 2436	3396	explorer.exe	AliIM.exe
PID 2436 wrote to memory of 2668	2436	AliIM.exe	netsh.exe
PID 2436 wrote to memory of 2668	2436	AliIM.exe	netsh.exe
PID 2436 wrote to memory of 2668	2436	AliIM.exe	netsh.exe
PID 2436 wrote to memory of 4428	2436	AliIM.exe	netsh.exe
PID 2436 wrote to memory of 4428	2436	AliIM.exe	netsh.exe
PID 2436 wrote to memory of 4428	2436	AliIM.exe	netsh.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\TG-x64.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2888

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2476

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 9DD40DDDE9F534E753C8F97AC045F38B C
2⤵
- Loads dropped DLL
PID:2268

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
2⤵
PID:2784

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 15931CC2DC67FAD226C2F8A76E78046D
2⤵
- Loads dropped DLL
PID:3964

C:\Users\Admin\AppData\Roaming\HIP-THH\tdata\emoji\dach.exe
"C:\Users\Admin\AppData\Roaming\HIP-THH\tdata\emoji\dach.exe"
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2788

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\H8Re1.bat"
3⤵
- Suspicious use of WriteProcessMemory
PID:3008

C:\Windows\system32\reg.exe
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t reg_dword /d 0 /F
4⤵
- UAC bypass
PID:3816

C:\Windows\system32\reg.exe
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t reg_dword /d 0 /F
4⤵
- UAC bypass
PID:5012

C:\Windows\system32\reg.exe
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v PromptOnSecureDesktop /t reg_dword /d 0 /F
4⤵
- UAC bypass
PID:2772

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy /b C:\Users\Public\Pictures\3om2k\V89sM_g\n + C:\Users\Public\Pictures\3om2k\V89sM_g\m C:\Users\Public\Pictures\3om2k\V89sM_g\UpdateAssist.dll
3⤵
PID:224

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1996

C:\Windows\system32\mmc.exe
C:\Windows\system32\mmc.exe -Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3208

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" interface ip set address 以太网 static 1.0.0.2 255.255.255.0 1.0.0.1 1
2⤵
PID:3480

C:\Windows\system32\mmc.exe
C:\Windows\system32\mmc.exe -Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: SetClipboardViewer
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:988

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" interface ip set address \"WLAN\" static 1.0.0.3 255.255.255.0 1.0.0.1 1
2⤵
PID:3076

C:\Windows\system32\mmc.exe
C:\Windows\system32\mmc.exe -Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: SetClipboardViewer
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4484

C:\Windows\explorer.exe
"C:\Windows\explorer.exe" /root, C:\Users\Public\Pictures\3om2k\V89sM_g\AliIM.exe
2⤵
- Modifies data under HKEY_USERS
PID:3520

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:3396

C:\Users\Public\Pictures\3om2k\V89sM_g\AliIM.exe
"C:\Users\Public\Pictures\3om2k\V89sM_g\AliIM.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2436

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" interface ip set address \"ÒÔÌ«Íø\" dhcp
3⤵
PID:2668

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" interface ip set address \"WLAN\" dhcp
3⤵
PID:4428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e58f365.rbs

Filesize
11KB

MD5
dff008fdac79e0b24f82adc63595d629

SHA1
67a40e773af6ff3262a7c0af4eafcea1b1ca3ae6

SHA256
5eced906063203a70d0d6ce848186f6e65edf85afcd96836fe6131d8bd866476

SHA512
f583ec70a91180a13e89bf22cac26ae0cd4b2bc41377bfa039af7dc083c2f7ab4fb963f29ae0f2c3cd737a51bcf92bd57df4b24f99cb63a5c94a608d03349a54

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI781E.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI781E.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI80CA.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI80CA.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI81A5.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI81A5.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI81A5.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8233.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8233.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8244.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8244.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI84E4.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI84E4.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Roaming\H8Re1.bat

Filesize
392B

MD5
30d6eb22d6aeec10347239b17b023bf4

SHA1
e2a6f86d66c699f6e0ff1ac4e140af4a2a4637d1

SHA256
659df6b190a0b92fc34e3a4457b4a8d11a26a4caf55de64dfe79eb1276181f08

SHA512
500872c3f2f3f801ec51717690873194675cb7f32cc4a862c09d90c18638d364d49b0e04c32323f52734e5c806e3503a63ac755c7019d762786a72840123df76

Download Submit
C:\Users\Admin\AppData\Roaming\HIP-THH\tdata\emoji\cache_21_4

Filesize
1.1MB

MD5
bb05e538eb0fd043124c1dbd7a54f6a0

SHA1
c44c550a754d87880e3413cfa0cb3bcbe7523edb

SHA256
0255d50c8fc8f036794a3cebdf2937a94821c6cf07caee1be90cf11fbf4f4c47

SHA512
ff6a9b0862307ebe85d72a62eefc09054290995c373f3c5b248bb6f04a6246d68160f6227873bc11649b894cd011f263c0d258796dffa09afb31412d78a8be69

Download Submit
C:\Users\Admin\AppData\Roaming\HIP-THH\tdata\emoji\dach.exe

Filesize
26.4MB

MD5
2cbc7a3f347b6cc2ea3da8a4c704bfe2

SHA1
da22d871980121b5a14e74e7b74da2a7003d9489

SHA256
581699ab0b929e148533b2d57819810d14a532df7ac5ca6d18b3d562d7dc88f3

SHA512
037ced5fa254eb1b1adb95dc0f3a33497f315bda91c72823f73bb523f50726cda0925096d0e9ed8ee64e6dc39a39959b112058e9e95d28f5027287a20bdfbc18

Download Submit
C:\Users\Admin\AppData\Roaming\HIP-THH\tdata\emoji\dach.exe

Filesize
26.4MB

MD5
2cbc7a3f347b6cc2ea3da8a4c704bfe2

SHA1
da22d871980121b5a14e74e7b74da2a7003d9489

SHA256
581699ab0b929e148533b2d57819810d14a532df7ac5ca6d18b3d562d7dc88f3

SHA512
037ced5fa254eb1b1adb95dc0f3a33497f315bda91c72823f73bb523f50726cda0925096d0e9ed8ee64e6dc39a39959b112058e9e95d28f5027287a20bdfbc18

Download Submit
C:\Users\Public\Pictures\3om2k\V89sM_g\AliIM.exe

Filesize
473KB

MD5
ed17abee766074018926ff48e0ce7a3d

SHA1
d6d3172176302db9ee6225ea06dc1667a814327b

SHA256
a8325bd88171952dfb45b16d8bf541e4fbe5d0e546c4e6f6d8aca32b96756dc8

SHA512
7dba4925e7aa66b172c76e294938385db09edaf652b751ca3464b03b6203387c07c13c93eafaa9707ec8ad03cc586b1d67abbc731ff6792d422f49a18c30ca86

Download Submit
C:\Users\Public\Pictures\3om2k\V89sM_g\AliIM.exe

Filesize
473KB

MD5
ed17abee766074018926ff48e0ce7a3d

SHA1
d6d3172176302db9ee6225ea06dc1667a814327b

SHA256
a8325bd88171952dfb45b16d8bf541e4fbe5d0e546c4e6f6d8aca32b96756dc8

SHA512
7dba4925e7aa66b172c76e294938385db09edaf652b751ca3464b03b6203387c07c13c93eafaa9707ec8ad03cc586b1d67abbc731ff6792d422f49a18c30ca86

Download Submit
C:\Users\Public\Pictures\3om2k\V89sM_g\AliwangwangFramework.dll

Filesize
215KB

MD5
0ba0713397a453abccfdd0542a8a8c1d

SHA1
38825f7a4f8997998620d695beb80f7aa9748e6a

SHA256
6e0aaf4d72409c28d8ae7bd0b669615cd5bc7d1b3631e024dc04db57f02b16b3

SHA512
f550cdd6f9dfb4763c8677d3ba807137c7ff7865484817321d5c28d8a1b8177fb3d2016662c27e04cb27df935bb963c51e374888dd8046a8f19bdebd9421a5a8

Download Submit
C:\Users\Public\Pictures\3om2k\V89sM_g\UpdateAssist.dll

Filesize
200KB

MD5
61d49ae47f7fc07f79af64c95169f69e

SHA1
e46f038cfea8de5d75bf9f24c44079b16769457d

SHA256
05afde58840d8e5a98e479c404a2d508b3a5c85bd6f6fc1f4ecfcf0bc38ed10e

SHA512
74d45e6517d0513d46f7e6453154ef832004998d4da2e31c81cbe64acc3a94d24599f065d60dfbe3ca562f2bb4c3f89c5a5acb9de39aa921d26bdf4745505f63

Download Submit
C:\Users\Public\Pictures\3om2k\V89sM_g\UpdateAssist.dll

Filesize
200KB

MD5
61d49ae47f7fc07f79af64c95169f69e

SHA1
e46f038cfea8de5d75bf9f24c44079b16769457d

SHA256
05afde58840d8e5a98e479c404a2d508b3a5c85bd6f6fc1f4ecfcf0bc38ed10e

SHA512
74d45e6517d0513d46f7e6453154ef832004998d4da2e31c81cbe64acc3a94d24599f065d60dfbe3ca562f2bb4c3f89c5a5acb9de39aa921d26bdf4745505f63

Download Submit
C:\Users\Public\Pictures\3om2k\V89sM_g\ZP.log

Filesize
159KB

MD5
8deb060ded3af0b733f967caae99d9b3

SHA1
4a33d4e1fc45f325191f82c3e5a7decc99f21254

SHA256
b12a8ea89bd5582c54dca77c663c1a4f6f0d68d1d41ecd2b56fff7520109832d

SHA512
ae7c02cb1cab1b4a0be18ea72034cf9ed8426fb31d51114ca454eef90205aacd60770b68f18d27305c79dcf75755d4bad80affa5c644665cae1802a2ca6ffb0d

Download Submit
C:\Users\Public\Pictures\3om2k\V89sM_g\m

Filesize
100KB

MD5
41018de291eabc6864c0df467b0b3f79

SHA1
0f4777c5e381fff0cce6036ac7aac12984518e18

SHA256
c654b24360b208b58c66dec156dd2698e03b09a44ea1d6b8eef875275c5ab5f4

SHA512
2a661c5e86a65c4ec5310e5e7f7f6f43af7efe93ead598cf6b5b4afe9b24429b86268746ca0396f02818d4d86fcae27088bfe56614779b4fe626627ea4747ae5

Download Submit
C:\Users\Public\Pictures\3om2k\V89sM_g\n

Filesize
100KB

MD5
bf3be0df5d9f5aa446f73bcf5bdc7d1d

SHA1
1385c180fbae3056a648c921acf0fc7ed075d998

SHA256
1196416efafd445f2eafde81c8f783573613d0594997361016a2ae1452ff490c

SHA512
8c0e33a4eebb3fd8dbd179caa987ff86b978450eb07fdd9aaec754f949a3667e4c372843fb0e70b32312ebe28f36f43e3fe4ea82a9994f3ce19316a9c54e4acb

Download Submit
C:\Windows\Installer\MSIF46D.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Windows\Installer\MSIF46D.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Windows\Installer\MSIF539.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Windows\Installer\MSIF539.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Windows\Installer\e58f364.msi

Filesize
85.0MB

MD5
f55bad2eb9042a2602b0ec3e85229a12

SHA1
3ab48b03629dfff4afb9a5a883e93e5a63011849

SHA256
beb1c209e511b20fd914c2a55d557aab557535f46ef3e1ffd70e478e375c483a

SHA512
8b9ebac68c158d6d7823e728afa0424c582ce31a13e928a90cd77ea1970daba5df2af7c211c3d9122ab06414b8b773af60fe9f294f61d7b3702ce0d2a9275ad0

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.0MB

MD5
516a415ab1b15415d3058db3e52d426b

SHA1
8280cd2e32fb9962e99236e463e969950dc08538

SHA256
4f890436bb551fc3af0407b72920a4d308882a78ee2db09fe6f99099645c6c81

SHA512
8d11033d34e32362514330a2ed3cf06533ad89d59e508b24e8c6ecf48529d62b541678d31ad889073286b9f2188430cfc9e1d3ce168ac8aed8ca070d8e763922

Download Submit
\??\Volume{6cfc8904-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{e98b4970-5f85-4f88-83fb-e4a7255e6799}_OnDiskSnapshotProp

Filesize
5KB

MD5
6dac22d982a5e8a43421e95767786091

SHA1
45e74884ce9e4ce62883d046c9fa71b9d0723906

SHA256
73f507ea8bc57052d374df0aafe716215cb6dbfddaa1f40d589fc69b255e5485

SHA512
d8c7780176042b26260b19aacbb048dd75ebe9994073ee4c286f99265e6b5aa3ee34729fbc72f5bbd6af754c4d5a60239c42e471519cb2d047b5108242c826f4

Download Submit
memory/2436-260-0x0000000002810000-0x000000000286E000-memory.dmp

Filesize
376KB

Download
memory/2436-282-0x0000000002810000-0x000000000286E000-memory.dmp

Filesize
376KB

Download
memory/2436-287-0x0000000002810000-0x000000000286E000-memory.dmp

Filesize
376KB

Download
memory/2436-284-0x0000000002810000-0x000000000286E000-memory.dmp

Filesize
376KB

Download
memory/2436-259-0x0000000002810000-0x000000000286E000-memory.dmp

Filesize
376KB

Download
memory/2436-262-0x0000000002810000-0x000000000286E000-memory.dmp

Filesize
376KB

Download
memory/2436-283-0x0000000002810000-0x000000000286E000-memory.dmp

Filesize
376KB

Download
memory/2436-264-0x0000000002810000-0x000000000286E000-memory.dmp

Filesize
376KB

Download
memory/2436-281-0x0000000002810000-0x000000000286E000-memory.dmp

Filesize
376KB

Download
memory/2436-280-0x0000000002810000-0x000000000286E000-memory.dmp

Filesize
376KB

Download
memory/2788-222-0x0000000180000000-0x000000018003E000-memory.dmp

Filesize
248KB

Download
memory/2788-224-0x0000000180000000-0x000000018003E000-memory.dmp

Filesize
248KB

Download
memory/2788-225-0x0000000180000000-0x000000018003E000-memory.dmp

Filesize
248KB

Download
memory/2788-239-0x0000000180000000-0x000000018003E000-memory.dmp

Filesize
248KB

Download
memory/2788-263-0x0000000180000000-0x000000018003E000-memory.dmp

Filesize
248KB

Download
memory/2788-226-0x0000000180000000-0x000000018003E000-memory.dmp

Filesize
248KB

Download
memory/2788-227-0x0000000180000000-0x000000018003E000-memory.dmp

Filesize
248KB

Download