8811ba79350e34819cd998a11b5feb1065a305947e71c1cf735c6388a8c5f7ff

Analysis

max time kernel
283s
max time network
294s
platform
windows10-2004_x64
resource
win10v2004-20230824-en
resource tags

arch:x64arch:x86image:win10v2004-20230824-enlocale:en-usos:windows10-2004-x64system
submitted
28-08-2023 03:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CS-TG-64-9.msi
Size

91.0MB
MD5

4c889869706b752690025b6ee8ac95e2
SHA1

d53a19935ecdc28a7b153f2036ae0a2c5bade940
SHA256

8811ba79350e34819cd998a11b5feb1065a305947e71c1cf735c6388a8c5f7ff
SHA512

faf2c1bcbf9ed08d90092d00112ffb47f21e474c221a4725144b6ca3a3c7de727dfb8ec965651a46efc61e2ca0f93e6fabc1b004c5d1f9ecb0e47e806990007b
SSDEEP

1572864:TCKawy0JEFm4X+8fXIA98xyB2Ywy6+hKstti21u4jaY/5AL+8s234jrXiQnNO2AM:TCKRl18vF8xyBuii21u4u+RrfxATRPdc

Score

10^/10

evasion trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	reg.exe

Modifies Windows Firewall 1 TTPs 3 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exenetsh.exenetsh.exe

pid process

4820 netsh.exe
4188 netsh.exe
4676 netsh.exe
Executes dropped EXE 2 IoCs

Processes:

dac.exeConsoleProxy.exe

pid process

3852 dac.exe
4588 ConsoleProxy.exe

pid	process
4820	netsh.exe
4188	netsh.exe
4676	netsh.exe

pid	process
3852	dac.exe
4588	ConsoleProxy.exe

Loads dropped DLL 10 IoCs

Processes:

MsiExec.exeMsiExec.exeConsoleProxy.exe

pid	process
2532	MsiExec.exe
2532	MsiExec.exe
2532	MsiExec.exe
2532	MsiExec.exe
2532	MsiExec.exe
2532	MsiExec.exe
3956	MsiExec.exe
3956	MsiExec.exe
4588	ConsoleProxy.exe
4588	ConsoleProxy.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral3/memory/3852-97-0x0000000180000000-0x0000000180040000-memory.dmp	upx
behavioral3/memory/3852-98-0x0000000180000000-0x0000000180040000-memory.dmp	upx
behavioral3/memory/3852-95-0x0000000180000000-0x0000000180040000-memory.dmp	upx
behavioral3/memory/3852-99-0x0000000180000000-0x0000000180040000-memory.dmp	upx
behavioral3/memory/3852-100-0x0000000180000000-0x0000000180040000-memory.dmp	upx
behavioral3/memory/3852-112-0x0000000180000000-0x0000000180040000-memory.dmp	upx
behavioral3/memory/3852-131-0x0000000180000000-0x0000000180040000-memory.dmp	upx

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exeConsoleProxy.exe

description	ioc	process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	ConsoleProxy.exe
File opened (read-only)	\??\X:	ConsoleProxy.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\O:	ConsoleProxy.exe
File opened (read-only)	\??\V:	ConsoleProxy.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	ConsoleProxy.exe
File opened (read-only)	\??\R:	ConsoleProxy.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\E:	ConsoleProxy.exe
File opened (read-only)	\??\Q:	ConsoleProxy.exe
File opened (read-only)	\??\J:	ConsoleProxy.exe
File opened (read-only)	\??\U:	ConsoleProxy.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\N:	ConsoleProxy.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	ConsoleProxy.exe
File opened (read-only)	\??\K:	ConsoleProxy.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	ConsoleProxy.exe
File opened (read-only)	\??\T:	ConsoleProxy.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	ConsoleProxy.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\S:	ConsoleProxy.exe
File opened (read-only)	\??\W:	ConsoleProxy.exe
File opened (read-only)	\??\Y:	ConsoleProxy.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe

Drops file in System32 directory 7 IoCs

Processes:

dac.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7229E30BCFD0992128433D951137A421_F0BB2463DDCCB4B49DC9200CC9E498E9	dac.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7229E30BCFD0992128433D951137A421_F0BB2463DDCCB4B49DC9200CC9E498E9	dac.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7229E30BCFD0992128433D951137A421_76EBFC12D6FD7EE9DD82775C12CF3BD5	dac.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7229E30BCFD0992128433D951137A421_76EBFC12D6FD7EE9DD82775C12CF3BD5	dac.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{CF8C0790-850E-411C-A139-A59E45B89DA8}.catalogItem	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_F7F9B7BDCC367A8E3539D28F7D4D4BA2	dac.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_F7F9B7BDCC367A8E3539D28F7D4D4BA2	dac.exe

Drops file in Windows directory 10 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\e598ff2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9BCB.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{997F38C3-E68F-4219-8D4D-C234BE733C5E}	msiexec.exe
File created	C:\Windows\Installer\e598ff4.msi	msiexec.exe
File created	C:\Windows\Installer\e598ff2.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9476.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9561.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 53 IoCs

Processes:

mmc.exedac.exemmc.exemsiexec.exeConsoleProxy.exemmc.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console	mmc.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Recent File List	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	dac.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Recent File List	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	dac.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	ConsoleProxy.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	dac.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	ConsoleProxy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Recent File List	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dac.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ConsoleProxy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	mmc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	dac.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@mmcbase.dll,-14008 = "Folder"	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ConsoleProxy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	ConsoleProxy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7"	ConsoleProxy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-18_Classes\Local Settings	dac.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mmc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Recent File List	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ConsoleProxy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ConsoleProxy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Settings	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Settings	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ConsoleProxy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Recent File List	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Settings	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	ConsoleProxy.exe

Modifies registry class 23 IoCs

Processes:

msiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3C83F799F86E9124D8D42C43EB37C3E5\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\67708036E3027134CBB5C9BE30891990\3C83F799F86E9124D8D42C43EB37C3E5	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\PackageCode = "2B2E9AE6A4679524CBD07FC20F15CD2C"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\Language = "2052"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\67708036E3027134CBB5C9BE30891990	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList\PackageName = "CS-TG-64-9.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3C83F799F86E9124D8D42C43EB37C3E5	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\ProductName = "CS-TG-64"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\Version = "16777216"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1856 PING.EXE
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

msiexec.exeConsoleProxy.exe

pid process

2312 msiexec.exe
2312 msiexec.exe
4588 ConsoleProxy.exe
4588 ConsoleProxy.exe

pid	process
1856	PING.EXE

pid	process
2312	msiexec.exe
2312	msiexec.exe
4588	ConsoleProxy.exe
4588	ConsoleProxy.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	5072	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5072	msiexec.exe
Token: SeSecurityPrivilege	2312	msiexec.exe
Token: SeCreateTokenPrivilege	5072	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5072	msiexec.exe
Token: SeLockMemoryPrivilege	5072	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5072	msiexec.exe
Token: SeMachineAccountPrivilege	5072	msiexec.exe
Token: SeTcbPrivilege	5072	msiexec.exe
Token: SeSecurityPrivilege	5072	msiexec.exe
Token: SeTakeOwnershipPrivilege	5072	msiexec.exe
Token: SeLoadDriverPrivilege	5072	msiexec.exe
Token: SeSystemProfilePrivilege	5072	msiexec.exe
Token: SeSystemtimePrivilege	5072	msiexec.exe
Token: SeProfSingleProcessPrivilege	5072	msiexec.exe
Token: SeIncBasePriorityPrivilege	5072	msiexec.exe
Token: SeCreatePagefilePrivilege	5072	msiexec.exe
Token: SeCreatePermanentPrivilege	5072	msiexec.exe
Token: SeBackupPrivilege	5072	msiexec.exe
Token: SeRestorePrivilege	5072	msiexec.exe
Token: SeShutdownPrivilege	5072	msiexec.exe
Token: SeDebugPrivilege	5072	msiexec.exe
Token: SeAuditPrivilege	5072	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5072	msiexec.exe
Token: SeChangeNotifyPrivilege	5072	msiexec.exe
Token: SeRemoteShutdownPrivilege	5072	msiexec.exe
Token: SeUndockPrivilege	5072	msiexec.exe
Token: SeSyncAgentPrivilege	5072	msiexec.exe
Token: SeEnableDelegationPrivilege	5072	msiexec.exe
Token: SeManageVolumePrivilege	5072	msiexec.exe
Token: SeImpersonatePrivilege	5072	msiexec.exe
Token: SeCreateGlobalPrivilege	5072	msiexec.exe
Token: SeCreateTokenPrivilege	5072	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5072	msiexec.exe
Token: SeLockMemoryPrivilege	5072	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5072	msiexec.exe
Token: SeMachineAccountPrivilege	5072	msiexec.exe
Token: SeTcbPrivilege	5072	msiexec.exe
Token: SeSecurityPrivilege	5072	msiexec.exe
Token: SeTakeOwnershipPrivilege	5072	msiexec.exe
Token: SeLoadDriverPrivilege	5072	msiexec.exe
Token: SeSystemProfilePrivilege	5072	msiexec.exe
Token: SeSystemtimePrivilege	5072	msiexec.exe
Token: SeProfSingleProcessPrivilege	5072	msiexec.exe
Token: SeIncBasePriorityPrivilege	5072	msiexec.exe
Token: SeCreatePagefilePrivilege	5072	msiexec.exe
Token: SeCreatePermanentPrivilege	5072	msiexec.exe
Token: SeBackupPrivilege	5072	msiexec.exe
Token: SeRestorePrivilege	5072	msiexec.exe
Token: SeShutdownPrivilege	5072	msiexec.exe
Token: SeDebugPrivilege	5072	msiexec.exe
Token: SeAuditPrivilege	5072	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5072	msiexec.exe
Token: SeChangeNotifyPrivilege	5072	msiexec.exe
Token: SeRemoteShutdownPrivilege	5072	msiexec.exe
Token: SeUndockPrivilege	5072	msiexec.exe
Token: SeSyncAgentPrivilege	5072	msiexec.exe
Token: SeEnableDelegationPrivilege	5072	msiexec.exe
Token: SeManageVolumePrivilege	5072	msiexec.exe
Token: SeImpersonatePrivilege	5072	msiexec.exe
Token: SeCreateGlobalPrivilege	5072	msiexec.exe
Token: SeCreateTokenPrivilege	5072	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5072	msiexec.exe
Token: SeLockMemoryPrivilege	5072	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

5072 msiexec.exe
5072 msiexec.exe
Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

dac.exemmc.exemmc.exemmc.exeConsoleProxy.exe

pid process

3852 dac.exe
3852 dac.exe
4036 mmc.exe
4036 mmc.exe
3140 mmc.exe
3140 mmc.exe
3600 mmc.exe
3600 mmc.exe
4588 ConsoleProxy.exe

pid	process
5072	msiexec.exe
5072	msiexec.exe

pid	process
3852	dac.exe
3852	dac.exe
4036	mmc.exe
4036	mmc.exe
3140	mmc.exe
3140	mmc.exe
3600	mmc.exe
3600	mmc.exe
4588	ConsoleProxy.exe

Suspicious use of WriteProcessMemory 46 IoCs

Processes:

msiexec.exemmc.exemmc.exedac.execmd.exemmc.exeConsoleProxy.execmd.exe

description	pid	process	target process
PID 2312 wrote to memory of 2532	2312	msiexec.exe	MsiExec.exe
PID 2312 wrote to memory of 2532	2312	msiexec.exe	MsiExec.exe
PID 2312 wrote to memory of 2532	2312	msiexec.exe	MsiExec.exe
PID 2312 wrote to memory of 3596	2312	msiexec.exe	srtasks.exe
PID 2312 wrote to memory of 3596	2312	msiexec.exe	srtasks.exe
PID 2312 wrote to memory of 3956	2312	msiexec.exe	MsiExec.exe
PID 2312 wrote to memory of 3956	2312	msiexec.exe	MsiExec.exe
PID 2312 wrote to memory of 3956	2312	msiexec.exe	MsiExec.exe
PID 2312 wrote to memory of 3852	2312	msiexec.exe	dac.exe
PID 2312 wrote to memory of 3852	2312	msiexec.exe	dac.exe
PID 4036 wrote to memory of 4900	4036	mmc.exe	netsh.exe
PID 4036 wrote to memory of 4900	4036	mmc.exe	netsh.exe
PID 3140 wrote to memory of 1264	3140	mmc.exe	netsh.exe
PID 3140 wrote to memory of 1264	3140	mmc.exe	netsh.exe
PID 3852 wrote to memory of 4424	3852	dac.exe	cmd.exe
PID 3852 wrote to memory of 4424	3852	dac.exe	cmd.exe
PID 4424 wrote to memory of 4652	4424	cmd.exe	reg.exe
PID 4424 wrote to memory of 4652	4424	cmd.exe	reg.exe
PID 4424 wrote to memory of 2636	4424	cmd.exe	reg.exe
PID 4424 wrote to memory of 2636	4424	cmd.exe	reg.exe
PID 4424 wrote to memory of 5056	4424	cmd.exe	reg.exe
PID 4424 wrote to memory of 5056	4424	cmd.exe	reg.exe
PID 3852 wrote to memory of 660	3852	dac.exe	cmd.exe
PID 3852 wrote to memory of 660	3852	dac.exe	cmd.exe
PID 3600 wrote to memory of 4588	3600	mmc.exe	ConsoleProxy.exe
PID 3600 wrote to memory of 4588	3600	mmc.exe	ConsoleProxy.exe
PID 3600 wrote to memory of 4588	3600	mmc.exe	ConsoleProxy.exe
PID 4588 wrote to memory of 4188	4588	ConsoleProxy.exe	netsh.exe
PID 4588 wrote to memory of 4188	4588	ConsoleProxy.exe	netsh.exe
PID 4588 wrote to memory of 4188	4588	ConsoleProxy.exe	netsh.exe
PID 4588 wrote to memory of 4676	4588	ConsoleProxy.exe	netsh.exe
PID 4588 wrote to memory of 4676	4588	ConsoleProxy.exe	netsh.exe
PID 4588 wrote to memory of 4676	4588	ConsoleProxy.exe	netsh.exe
PID 3852 wrote to memory of 4136	3852	dac.exe	cmd.exe
PID 3852 wrote to memory of 4136	3852	dac.exe	cmd.exe
PID 4588 wrote to memory of 4820	4588	ConsoleProxy.exe	netsh.exe
PID 4588 wrote to memory of 4820	4588	ConsoleProxy.exe	netsh.exe
PID 4588 wrote to memory of 4820	4588	ConsoleProxy.exe	netsh.exe
PID 4136 wrote to memory of 1856	4136	cmd.exe	PING.EXE
PID 4136 wrote to memory of 1856	4136	cmd.exe	PING.EXE
PID 4588 wrote to memory of 3876	4588	ConsoleProxy.exe	netsh.exe
PID 4588 wrote to memory of 3876	4588	ConsoleProxy.exe	netsh.exe
PID 4588 wrote to memory of 3876	4588	ConsoleProxy.exe	netsh.exe
PID 4588 wrote to memory of 3628	4588	ConsoleProxy.exe	netsh.exe
PID 4588 wrote to memory of 3628	4588	ConsoleProxy.exe	netsh.exe
PID 4588 wrote to memory of 3628	4588	ConsoleProxy.exe	netsh.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\CS-TG-64-9.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5072

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
PID:4920

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2312

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 227A8150F094813AE868AAC67ED9523F C
2⤵
- Loads dropped DLL
PID:2532

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
2⤵
PID:3596

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding FB386A8AC9DB67D9924CC53BF1B9033B
2⤵
- Loads dropped DLL
PID:3956

C:\Users\Admin\AppData\Roaming\CS-TG-64\tdata\emoji\dac.exe
"C:\Users\Admin\AppData\Roaming\CS-TG-64\tdata\emoji\dac.exe"
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3852

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\q766E.bat"
3⤵
- Suspicious use of WriteProcessMemory
PID:4424

C:\Windows\system32\reg.exe
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t reg_dword /d 0 /F
4⤵
- UAC bypass
PID:4652

C:\Windows\system32\reg.exe
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t reg_dword /d 0 /F
4⤵
- UAC bypass
PID:2636

C:\Windows\system32\reg.exe
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v PromptOnSecureDesktop /t reg_dword /d 0 /F
4⤵
- UAC bypass
PID:5056

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy /b C:\Users\Public\Pictures\22X60\46rDB@9\v + C:\Users\Public\Pictures\22X60\46rDB@9\b C:\Users\Public\Pictures\22X60\46rDB@9\openconsolewpcap.dll
3⤵
PID:660

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Roaming\CS-TG-64\tdata\emoji\dac.exe > nul
3⤵
- Suspicious use of WriteProcessMemory
PID:4136

C:\Windows\system32\PING.EXE
ping -n 2 127.0.0.1
4⤵
- Runs ping.exe
PID:1856

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1268

C:\Windows\system32\mmc.exe
C:\Windows\system32\mmc.exe -Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4036

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" interface ip set address 以太网 static 1.0.0.2 255.255.255.0 1.0.0.1 1
2⤵
PID:4900

C:\Windows\system32\mmc.exe
C:\Windows\system32\mmc.exe -Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3140

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" interface ip set address \"WLAN\" static 1.0.0.3 255.255.255.0 1.0.0.1 1
2⤵
PID:1264

C:\Windows\system32\mmc.exe
C:\Windows\system32\mmc.exe -Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3600

C:\Users\Public\Pictures\22X60\46rDB@9\ConsoleProxy.exe
"C:\Users\Public\Pictures\22X60\46rDB@9\ConsoleProxy.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4588

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall delete rule name="" program="C:\Users\Public\Pictures\22X60\46rDB@9\ConsoleProxy.exe"
3⤵
- Modifies Windows Firewall
PID:4188

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall add rule name="" dir=in action=allow program="C:\Users\Public\Pictures\22X60\46rDB@9\ConsoleProxy.exe" description=""
3⤵
- Modifies Windows Firewall
PID:4676

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall add rule name="" dir=out action=allow program="C:\Users\Public\Pictures\22X60\46rDB@9\ConsoleProxy.exe" description=""
3⤵
- Modifies Windows Firewall
PID:4820

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" interface ip set address \"WLAN\" dhcp
3⤵
PID:3628

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" interface ip set address \"ÒÔÌ«Íø\" dhcp
3⤵
PID:3876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e598ff3.rbs

Filesize
10KB

MD5
60b35f4331450110939f7db57ac7dbc4

SHA1
6c0d76ad6244527d4dd43c392d4a789b3e6d3c0a

SHA256
cbc305c8e87363439539f1ef19b78b61957566f418d08a75f820c9548e37e138

SHA512
e91f3fe309d8ef86b0f9b585dece278f0e014e499b39151e10cb5d4f019cf112390f509b7a3bb1cde682514d9c87689ff99ebd1ea12d2fe62b1c9054518c6c87

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI4522.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI4522.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5204.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5204.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI535D.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI535D.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI535D.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI53DB.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI53DB.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI543A.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI543A.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5890.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5890.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Roaming\CS-TG-64\tdata\emoji\cache_22_7

Filesize
9.0MB

MD5
be5628882d28ba1bdb9850dc4b7e7fa1

SHA1
6d37839c4b8ded05c0e8108696e1b794de59a2a8

SHA256
def949e97a2a2d2e504f7c85a27a6f2fd44d3a898357398f4aaa7eb033dfb287

SHA512
16037fd6ee2bb26e1014e9e69a2ee5d7290ebe5021ed1eedaa5908b73c39cc2ba6f66c553be9a39163b8831e8f519b10009e71fb94ce392c7229541192aa1c39

Download Submit
C:\Users\Admin\AppData\Roaming\CS-TG-64\tdata\emoji\dac.exe

Filesize
22.4MB

MD5
6979bc62c1f906107f9d04313e5603d7

SHA1
beff1f31e99fdc9f7d2788286a46db0398a9b0c3

SHA256
8128b035364ffdaf6905e23ec64703481082cb67669ba740289bb0050d4b60dc

SHA512
e67768056620096150e72ba97b7df3d496b1a5f9e039502f91d66760a53fe21ead68f14a33d9a735127d7ca2f94b3d651e3e826c82b6eb7dc2820cf8857c3a55

Download Submit
C:\Users\Admin\AppData\Roaming\CS-TG-64\tdata\emoji\dac.exe

Filesize
22.4MB

MD5
6979bc62c1f906107f9d04313e5603d7

SHA1
beff1f31e99fdc9f7d2788286a46db0398a9b0c3

SHA256
8128b035364ffdaf6905e23ec64703481082cb67669ba740289bb0050d4b60dc

SHA512
e67768056620096150e72ba97b7df3d496b1a5f9e039502f91d66760a53fe21ead68f14a33d9a735127d7ca2f94b3d651e3e826c82b6eb7dc2820cf8857c3a55

Download Submit
C:\Users\Admin\AppData\Roaming\q766E.bat

Filesize
392B

MD5
30d6eb22d6aeec10347239b17b023bf4

SHA1
e2a6f86d66c699f6e0ff1ac4e140af4a2a4637d1

SHA256
659df6b190a0b92fc34e3a4457b4a8d11a26a4caf55de64dfe79eb1276181f08

SHA512
500872c3f2f3f801ec51717690873194675cb7f32cc4a862c09d90c18638d364d49b0e04c32323f52734e5c806e3503a63ac755c7019d762786a72840123df76

Download Submit
C:\Users\Public\Pictures\22X60\46rDB@9\ConsoleProxy.exe

Filesize
904KB

MD5
07664d67b56857133ce91e0ede047ec6

SHA1
c83dd9f00278e567f23b918791e2f1ba1b025c8b

SHA256
effe2e868cb9f885a1f91044be10eca56057f0fd2fea43f0fc4ad349e344c15f

SHA512
610b68bfc4acba3307b9ae106b388777040d024cb6ce5a3cee92462ab0d20986d1bf1a0ab9a827fe45fc48442b5e0c771329ac47e6ebacd4d9d793cf81fa036d

Download Submit
C:\Users\Public\Pictures\22X60\46rDB@9\ConsoleProxy.exe

Filesize
904KB

MD5
07664d67b56857133ce91e0ede047ec6

SHA1
c83dd9f00278e567f23b918791e2f1ba1b025c8b

SHA256
effe2e868cb9f885a1f91044be10eca56057f0fd2fea43f0fc4ad349e344c15f

SHA512
610b68bfc4acba3307b9ae106b388777040d024cb6ce5a3cee92462ab0d20986d1bf1a0ab9a827fe45fc48442b5e0c771329ac47e6ebacd4d9d793cf81fa036d

Download Submit
C:\Users\Public\Pictures\22X60\46rDB@9\PX.log

Filesize
156KB

MD5
472ddeee5da29d3724bf98599ca696cf

SHA1
a8fcae7d616db80a27ebd077b9f4b85a430c4d43

SHA256
77e619e81e74b37967abc309edd3e7a02b97c5a13ad606bd5255bd77b812478c

SHA512
089588e11a9241b809a64a0f361ceb3ef743d1d06ee9c02ee471be5a8d91299cae84b18f8d0ceee3716fb1378e850438c09cdbf3818ae9c64bf1ecab9753f87e

Download Submit
C:\Users\Public\Pictures\22X60\46rDB@9\b

Filesize
104KB

MD5
87fc2bd3754f13f346d5deb868b7b205

SHA1
909995865895b9c79c0a3b6c17b5867e1c67b4de

SHA256
f194e9e6449f4634a1f20ffa9d17ad5a2af228ad55160ab27ec2562265dc0715

SHA512
43adb9a29c443477126226a12f3035672a43f168e58e0b2e540995491248fd6173d637314be477d6d13f1397f0504def4171e02cae14876fecd12b2e74bd2bce

Download Submit
C:\Users\Public\Pictures\22X60\46rDB@9\openconsolepacket.dll

Filesize
126KB

MD5
75601eb6b85df77b3b8328e524cdd8be

SHA1
58e732acec0c0e65370030fc61e6577a2cc0d4af

SHA256
530010b5cb8a82bae6e244bca0a1a5202ece0cf59c83f7434af77b2a8ed32a84

SHA512
cc01c13b7926d31354a90db66b317c02fb4e155785f4c27eee24fdecdda4b5d18cdaf09581d4e54f0d10169708e4c2f904144a669cb5f4019146e19acef3f982

Download Submit
C:\Users\Public\Pictures\22X60\46rDB@9\openconsolepacket.dll

Filesize
126KB

MD5
75601eb6b85df77b3b8328e524cdd8be

SHA1
58e732acec0c0e65370030fc61e6577a2cc0d4af

SHA256
530010b5cb8a82bae6e244bca0a1a5202ece0cf59c83f7434af77b2a8ed32a84

SHA512
cc01c13b7926d31354a90db66b317c02fb4e155785f4c27eee24fdecdda4b5d18cdaf09581d4e54f0d10169708e4c2f904144a669cb5f4019146e19acef3f982

Download Submit
C:\Users\Public\Pictures\22X60\46rDB@9\openconsolewpcap.dll

Filesize
208KB

MD5
ceb101e19e1627a7cefc3edd8e594d43

SHA1
52da2a83f1ed5e2f9e34e7462a724986b1946c61

SHA256
e3210354d07b2e785f794fade1f84ab072f9e6bd169d246974ae1550bde33b92

SHA512
c20418068d538c727a310b236c66122d5f0fc86300c32c10be05d32a2c0e8da8b7af632e202aa612c863eb2149b7891e577e81dc729148cb3f6dcad0697836f2

Download Submit
C:\Users\Public\Pictures\22X60\46rDB@9\openconsolewpcap.dll

Filesize
208KB

MD5
ceb101e19e1627a7cefc3edd8e594d43

SHA1
52da2a83f1ed5e2f9e34e7462a724986b1946c61

SHA256
e3210354d07b2e785f794fade1f84ab072f9e6bd169d246974ae1550bde33b92

SHA512
c20418068d538c727a310b236c66122d5f0fc86300c32c10be05d32a2c0e8da8b7af632e202aa612c863eb2149b7891e577e81dc729148cb3f6dcad0697836f2

Download Submit
C:\Users\Public\Pictures\22X60\46rDB@9\v

Filesize
104KB

MD5
b3d69bc92cd8824c81dce8a039289b51

SHA1
4d1636c74bc6c05b3da6fc71ad0a2fccbf48357a

SHA256
e3c6afedac974e02f301dc9c05ee8456343d1b013a3edbd7e648a13b36193a88

SHA512
444108a37cb065ee2b070bdd0f0ddb22bfc78eb6b5d9de1025960f22cb86fc4d865988445df75605bff8e806d6ba3659d2260432125f04ce80bf8fba27af83a8

Download Submit
C:\Windows\Installer\MSI9476.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Windows\Installer\MSI9476.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Windows\Installer\MSI9561.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Windows\Installer\MSI9561.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Windows\Installer\e598ff2.msi

Filesize
91.0MB

MD5
4c889869706b752690025b6ee8ac95e2

SHA1
d53a19935ecdc28a7b153f2036ae0a2c5bade940

SHA256
8811ba79350e34819cd998a11b5feb1065a305947e71c1cf735c6388a8c5f7ff

SHA512
faf2c1bcbf9ed08d90092d00112ffb47f21e474c221a4725144b6ca3a3c7de727dfb8ec965651a46efc61e2ca0f93e6fabc1b004c5d1f9ecb0e47e806990007b

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.0MB

MD5
11ff0840519240d9cc7c59f68768a56e

SHA1
372fdedd3bf66ca9e2b2154f475bc3420ba3215b

SHA256
49681298e75a1bb0f1c78519654f1a43f84262ef3b80048fb58bb9a37944398f

SHA512
79b128ddb5feca8b01e12ff6233fa44843a366b4c53de6755279b994ec51bb8d49de8334b0d2744d24cbf865ff5d4873c41e647eff37c8fade098b2ac442e54b

Download Submit
\??\Volume{4de78220-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{96af919f-6eab-4abf-984d-6512a5bfb133}_OnDiskSnapshotProp

Filesize
5KB

MD5
ff572e28ad762854107b5827db293dce

SHA1
5e862283b8dd2abde25322dfa15d0688da852428

SHA256
139dfeac6ff0fb4dd202ae025a34b89af41d3c9804f2225e1be6a4b9ca17b3d9

SHA512
22373ff321f0260b4b3ea13602afc5c9204c0689f4be1aec15133482debbf859bc58b5aaaf9068389ef450e5d2f0efa9631a3ee7de070d5b50377f45821b9ecb

Download Submit
memory/3852-95-0x0000000180000000-0x0000000180040000-memory.dmp

Filesize
256KB

Download
memory/3852-97-0x0000000180000000-0x0000000180040000-memory.dmp

Filesize
256KB

Download
memory/3852-98-0x0000000180000000-0x0000000180040000-memory.dmp

Filesize
256KB

Download
memory/3852-131-0x0000000180000000-0x0000000180040000-memory.dmp

Filesize
256KB

Download
memory/3852-100-0x0000000180000000-0x0000000180040000-memory.dmp

Filesize
256KB

Download
memory/3852-99-0x0000000180000000-0x0000000180040000-memory.dmp

Filesize
256KB

Download
memory/3852-112-0x0000000180000000-0x0000000180040000-memory.dmp

Filesize
256KB

Download
memory/4588-144-0x0000000002920000-0x000000000297E000-memory.dmp

Filesize
376KB

Download
memory/4588-145-0x0000000002920000-0x000000000297E000-memory.dmp

Filesize
376KB

Download
memory/4588-146-0x0000000002920000-0x000000000297E000-memory.dmp

Filesize
376KB

Download
memory/4588-147-0x0000000002920000-0x000000000297E000-memory.dmp

Filesize
376KB

Download
memory/4588-153-0x0000000002920000-0x000000000297E000-memory.dmp

Filesize
376KB

Download
memory/4588-155-0x0000000002920000-0x000000000297E000-memory.dmp

Filesize
376KB

Download
memory/4588-154-0x0000000002920000-0x000000000297E000-memory.dmp

Filesize
376KB

Download
memory/4588-156-0x0000000002920000-0x000000000297E000-memory.dmp

Filesize
376KB

Download
memory/4588-157-0x0000000002920000-0x000000000297E000-memory.dmp

Filesize
376KB

Download
memory/4588-160-0x0000000002920000-0x000000000297E000-memory.dmp

Filesize
376KB

Download