cd1d744dc39adf50bc17b587d203d5fce77995c4c51cc0438187dfc9eabbd948

Analysis

max time kernel
120s
max time network
137s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
02-09-2023 04:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

desk-zhonwenbao4.9.msi
Size

90.9MB
MD5

9cee7423f1bd5d64559c49689a18c06b
SHA1

5a75b69d2e66fc679c123d60a12712566246904a
SHA256

296608771a852e2e95f8fbd3f1990e671a9b7d44f84470335f262ff9b14b7d1c
SHA512

4e0da5e6fe0205d065cd3eeb9d5e2fb644177d65c273f447686b51d614b5c89a0c435b2ae2698d2a8e2aba5838dc576e5fb2cceb7d44aeea959d9e9369ed6f00
SSDEEP

1572864:3S8hXhuaZPB/j+Q4FAXaG/25Zwd7zZ2r+qriUeB6SXJObHXEq0bT7MbC3IA64Fy1:2aORGqR5ORqrUB7kbon7MbC3z6MbK

Score

10^/10

evasion trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	reg.exe

Modifies Windows Firewall 1 TTPs 3 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exenetsh.exenetsh.exe

pid process

2512 netsh.exe
2664 netsh.exe
2752 netsh.exe
Executes dropped EXE 2 IoCs

Processes:

dac.exeConsoleProxy.exe

pid process

1080 dac.exe
1608 ConsoleProxy.exe

pid	process
2512	netsh.exe
2664	netsh.exe
2752	netsh.exe

pid	process
1080	dac.exe
1608	ConsoleProxy.exe

Loads dropped DLL 16 IoCs

Processes:

MsiExec.exeMsiExec.exemsiexec.exeConsoleProxy.exe

pid	process
2776	MsiExec.exe
2776	MsiExec.exe
2776	MsiExec.exe
2776	MsiExec.exe
2776	MsiExec.exe
1684	MsiExec.exe
3044	msiexec.exe
3044	msiexec.exe
1240
1240
1240
1240
1608	ConsoleProxy.exe
1608	ConsoleProxy.exe
1240
1240

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral4/memory/1080-76-0x0000000180000000-0x0000000180030000-memory.dmp	upx
behavioral4/memory/1080-82-0x0000000180000000-0x0000000180030000-memory.dmp	upx
behavioral4/memory/1080-83-0x0000000180000000-0x0000000180030000-memory.dmp	upx
behavioral4/memory/1080-84-0x0000000180000000-0x0000000180030000-memory.dmp	upx
behavioral4/memory/1080-85-0x0000000180000000-0x0000000180030000-memory.dmp	upx
behavioral4/memory/1080-99-0x0000000180000000-0x0000000180030000-memory.dmp	upx
behavioral4/memory/1080-138-0x0000000180000000-0x0000000180030000-memory.dmp	upx

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in System32 directory 6 IoCs

Processes:

dac.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_F7F9B7BDCC367A8E3539D28F7D4D4BA2	dac.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_F7F9B7BDCC367A8E3539D28F7D4D4BA2	dac.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7229E30BCFD0992128433D951137A421_F0BB2463DDCCB4B49DC9200CC9E498E9	dac.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7229E30BCFD0992128433D951137A421_F0BB2463DDCCB4B49DC9200CC9E498E9	dac.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7229E30BCFD0992128433D951137A421_76EBFC12D6FD7EE9DD82775C12CF3BD5	dac.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7229E30BCFD0992128433D951137A421_76EBFC12D6FD7EE9DD82775C12CF3BD5	dac.exe

Drops file in Windows directory 11 IoCs

Processes:

msiexec.exeDrvInst.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSIEB39.tmp	msiexec.exe
File created	C:\Windows\Installer\f76e9d3.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\f76e9d5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f76e9d2.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f76e9d2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEE08.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f76e9d3.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 64 IoCs

Processes:

DrvInst.exedac.exenetsh.exenetsh.exemmc.exemmc.exemmc.exenetsh.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{619D4FDE-2B23-41CD-B289-E3EAE32F3CD8}	dac.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{619D4FDE-2B23-41CD-B289-E3EAE32F3CD8}\WpadNetworkName = "Network 2"	dac.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-100 = "RD Gateway Quarantine Enforcement Client"	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mmc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-1 = "IPsec Relying Party"	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	dac.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	mmc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dac.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@mmcbase.dll,-14008 = "Folder"	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	dac.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-2 = "Provides IPsec based enforcement for Network Access Protection"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Settings	mmc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-102 = "1.0"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\e2-5f-d5-cc-86-f6\WpadDecisionReason = "1"	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	dac.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-100 = "EAP Quarantine Enforcement Client"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{619D4FDE-2B23-41CD-B289-E3EAE32F3CD8}\WpadDecision = "0"	dac.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	dac.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-100 = "EAP Quarantine Enforcement Client"	netsh.exe

Modifies registry class 23 IoCs

Processes:

msiexec.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\Version = "16777216"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\67708036E3027134CBB5C9BE30891990\3C83F799F86E9124D8D42C43EB37C3E5	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList\PackageName = "desk-zhonwenbao4.9.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3C83F799F86E9124D8D42C43EB37C3E5\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\PackageCode = "63F29DC7FCF25354CB1205C9543A7856"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\67708036E3027134CBB5C9BE30891990	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3C83F799F86E9124D8D42C43EB37C3E5	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\ProductName = "CS-TG-64"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C83F799F86E9124D8D42C43EB37C3E5\Language = "2052"	msiexec.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

dac.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	dac.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	dac.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2820 PING.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msiexec.exe

pid process

3044 msiexec.exe
3044 msiexec.exe
Suspicious behavior: SetClipboardViewer 2 IoCs

Processes:

mmc.exemmc.exe

pid process

1820 mmc.exe
2432 mmc.exe

pid	process
2820	PING.EXE

pid	process
3044	msiexec.exe
3044	msiexec.exe

pid	process
1820	mmc.exe
2432	mmc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	2800	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2800	msiexec.exe
Token: SeRestorePrivilege	3044	msiexec.exe
Token: SeTakeOwnershipPrivilege	3044	msiexec.exe
Token: SeSecurityPrivilege	3044	msiexec.exe
Token: SeCreateTokenPrivilege	2800	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2800	msiexec.exe
Token: SeLockMemoryPrivilege	2800	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2800	msiexec.exe
Token: SeMachineAccountPrivilege	2800	msiexec.exe
Token: SeTcbPrivilege	2800	msiexec.exe
Token: SeSecurityPrivilege	2800	msiexec.exe
Token: SeTakeOwnershipPrivilege	2800	msiexec.exe
Token: SeLoadDriverPrivilege	2800	msiexec.exe
Token: SeSystemProfilePrivilege	2800	msiexec.exe
Token: SeSystemtimePrivilege	2800	msiexec.exe
Token: SeProfSingleProcessPrivilege	2800	msiexec.exe
Token: SeIncBasePriorityPrivilege	2800	msiexec.exe
Token: SeCreatePagefilePrivilege	2800	msiexec.exe
Token: SeCreatePermanentPrivilege	2800	msiexec.exe
Token: SeBackupPrivilege	2800	msiexec.exe
Token: SeRestorePrivilege	2800	msiexec.exe
Token: SeShutdownPrivilege	2800	msiexec.exe
Token: SeDebugPrivilege	2800	msiexec.exe
Token: SeAuditPrivilege	2800	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2800	msiexec.exe
Token: SeChangeNotifyPrivilege	2800	msiexec.exe
Token: SeRemoteShutdownPrivilege	2800	msiexec.exe
Token: SeUndockPrivilege	2800	msiexec.exe
Token: SeSyncAgentPrivilege	2800	msiexec.exe
Token: SeEnableDelegationPrivilege	2800	msiexec.exe
Token: SeManageVolumePrivilege	2800	msiexec.exe
Token: SeImpersonatePrivilege	2800	msiexec.exe
Token: SeCreateGlobalPrivilege	2800	msiexec.exe
Token: SeCreateTokenPrivilege	2800	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2800	msiexec.exe
Token: SeLockMemoryPrivilege	2800	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2800	msiexec.exe
Token: SeMachineAccountPrivilege	2800	msiexec.exe
Token: SeTcbPrivilege	2800	msiexec.exe
Token: SeSecurityPrivilege	2800	msiexec.exe
Token: SeTakeOwnershipPrivilege	2800	msiexec.exe
Token: SeLoadDriverPrivilege	2800	msiexec.exe
Token: SeSystemProfilePrivilege	2800	msiexec.exe
Token: SeSystemtimePrivilege	2800	msiexec.exe
Token: SeProfSingleProcessPrivilege	2800	msiexec.exe
Token: SeIncBasePriorityPrivilege	2800	msiexec.exe
Token: SeCreatePagefilePrivilege	2800	msiexec.exe
Token: SeCreatePermanentPrivilege	2800	msiexec.exe
Token: SeBackupPrivilege	2800	msiexec.exe
Token: SeRestorePrivilege	2800	msiexec.exe
Token: SeShutdownPrivilege	2800	msiexec.exe
Token: SeDebugPrivilege	2800	msiexec.exe
Token: SeAuditPrivilege	2800	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2800	msiexec.exe
Token: SeChangeNotifyPrivilege	2800	msiexec.exe
Token: SeRemoteShutdownPrivilege	2800	msiexec.exe
Token: SeUndockPrivilege	2800	msiexec.exe
Token: SeSyncAgentPrivilege	2800	msiexec.exe
Token: SeEnableDelegationPrivilege	2800	msiexec.exe
Token: SeManageVolumePrivilege	2800	msiexec.exe
Token: SeImpersonatePrivilege	2800	msiexec.exe
Token: SeCreateGlobalPrivilege	2800	msiexec.exe
Token: SeCreateTokenPrivilege	2800	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

2800 msiexec.exe
2800 msiexec.exe
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

dac.exemmc.exemmc.exemmc.exe

pid process

1080 dac.exe
1080 dac.exe
1548 mmc.exe
1548 mmc.exe
1820 mmc.exe
1820 mmc.exe
2432 mmc.exe
2432 mmc.exe

pid	process
2800	msiexec.exe
2800	msiexec.exe

pid	process
1080	dac.exe
1080	dac.exe
1548	mmc.exe
1548	mmc.exe
1820	mmc.exe
1820	mmc.exe
2432	mmc.exe
2432	mmc.exe

Suspicious use of WriteProcessMemory 60 IoCs

Processes:

msiexec.exemmc.exemmc.exedac.execmd.exemmc.exeConsoleProxy.execmd.exe

description	pid	process	target process
PID 3044 wrote to memory of 2776	3044	msiexec.exe	MsiExec.exe
PID 3044 wrote to memory of 2776	3044	msiexec.exe	MsiExec.exe
PID 3044 wrote to memory of 2776	3044	msiexec.exe	MsiExec.exe
PID 3044 wrote to memory of 2776	3044	msiexec.exe	MsiExec.exe
PID 3044 wrote to memory of 2776	3044	msiexec.exe	MsiExec.exe
PID 3044 wrote to memory of 2776	3044	msiexec.exe	MsiExec.exe
PID 3044 wrote to memory of 2776	3044	msiexec.exe	MsiExec.exe
PID 3044 wrote to memory of 1684	3044	msiexec.exe	MsiExec.exe
PID 3044 wrote to memory of 1684	3044	msiexec.exe	MsiExec.exe
PID 3044 wrote to memory of 1684	3044	msiexec.exe	MsiExec.exe
PID 3044 wrote to memory of 1684	3044	msiexec.exe	MsiExec.exe
PID 3044 wrote to memory of 1684	3044	msiexec.exe	MsiExec.exe
PID 3044 wrote to memory of 1684	3044	msiexec.exe	MsiExec.exe
PID 3044 wrote to memory of 1684	3044	msiexec.exe	MsiExec.exe
PID 3044 wrote to memory of 1080	3044	msiexec.exe	dac.exe
PID 3044 wrote to memory of 1080	3044	msiexec.exe	dac.exe
PID 3044 wrote to memory of 1080	3044	msiexec.exe	dac.exe
PID 1548 wrote to memory of 1644	1548	mmc.exe	netsh.exe
PID 1548 wrote to memory of 1644	1548	mmc.exe	netsh.exe
PID 1548 wrote to memory of 1644	1548	mmc.exe	netsh.exe
PID 1820 wrote to memory of 892	1820	mmc.exe	netsh.exe
PID 1820 wrote to memory of 892	1820	mmc.exe	netsh.exe
PID 1820 wrote to memory of 892	1820	mmc.exe	netsh.exe
PID 1080 wrote to memory of 2112	1080	dac.exe	cmd.exe
PID 1080 wrote to memory of 2112	1080	dac.exe	cmd.exe
PID 1080 wrote to memory of 2112	1080	dac.exe	cmd.exe
PID 2112 wrote to memory of 1332	2112	cmd.exe	reg.exe
PID 2112 wrote to memory of 1332	2112	cmd.exe	reg.exe
PID 2112 wrote to memory of 1332	2112	cmd.exe	reg.exe
PID 2112 wrote to memory of 2372	2112	cmd.exe	reg.exe
PID 2112 wrote to memory of 2372	2112	cmd.exe	reg.exe
PID 2112 wrote to memory of 2372	2112	cmd.exe	reg.exe
PID 2112 wrote to memory of 2172	2112	cmd.exe	reg.exe
PID 2112 wrote to memory of 2172	2112	cmd.exe	reg.exe
PID 2112 wrote to memory of 2172	2112	cmd.exe	reg.exe
PID 1080 wrote to memory of 884	1080	dac.exe	cmd.exe
PID 1080 wrote to memory of 884	1080	dac.exe	cmd.exe
PID 1080 wrote to memory of 884	1080	dac.exe	cmd.exe
PID 2432 wrote to memory of 1608	2432	mmc.exe	ConsoleProxy.exe
PID 2432 wrote to memory of 1608	2432	mmc.exe	ConsoleProxy.exe
PID 2432 wrote to memory of 1608	2432	mmc.exe	ConsoleProxy.exe
PID 2432 wrote to memory of 1608	2432	mmc.exe	ConsoleProxy.exe
PID 1608 wrote to memory of 2512	1608	ConsoleProxy.exe	netsh.exe
PID 1608 wrote to memory of 2512	1608	ConsoleProxy.exe	netsh.exe
PID 1608 wrote to memory of 2512	1608	ConsoleProxy.exe	netsh.exe
PID 1608 wrote to memory of 2512	1608	ConsoleProxy.exe	netsh.exe
PID 1608 wrote to memory of 2664	1608	ConsoleProxy.exe	netsh.exe
PID 1608 wrote to memory of 2664	1608	ConsoleProxy.exe	netsh.exe
PID 1608 wrote to memory of 2664	1608	ConsoleProxy.exe	netsh.exe
PID 1608 wrote to memory of 2664	1608	ConsoleProxy.exe	netsh.exe
PID 1608 wrote to memory of 2752	1608	ConsoleProxy.exe	netsh.exe
PID 1608 wrote to memory of 2752	1608	ConsoleProxy.exe	netsh.exe
PID 1608 wrote to memory of 2752	1608	ConsoleProxy.exe	netsh.exe
PID 1608 wrote to memory of 2752	1608	ConsoleProxy.exe	netsh.exe
PID 1080 wrote to memory of 1212	1080	dac.exe	cmd.exe
PID 1080 wrote to memory of 1212	1080	dac.exe	cmd.exe
PID 1080 wrote to memory of 1212	1080	dac.exe	cmd.exe
PID 1212 wrote to memory of 2820	1212	cmd.exe	PING.EXE
PID 1212 wrote to memory of 2820	1212	cmd.exe	PING.EXE
PID 1212 wrote to memory of 2820	1212	cmd.exe	PING.EXE

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\desk-zhonwenbao4.9.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2800

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3044

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding B1BAADF82274815749D95499577D0051 C
2⤵
- Loads dropped DLL
PID:2776

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 56C0F112D4F53824898C343363C2A5C1
2⤵
- Loads dropped DLL
PID:1684

C:\Users\Admin\AppData\Roaming\CS-TG-64\tdata\emoji\dac.exe
"C:\Users\Admin\AppData\Roaming\CS-TG-64\tdata\emoji\dac.exe"
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1080

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\3znqB.bat"
3⤵
- Suspicious use of WriteProcessMemory
PID:2112

C:\Windows\system32\reg.exe
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t reg_dword /d 0 /F
4⤵
- UAC bypass
PID:1332

C:\Windows\system32\reg.exe
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t reg_dword /d 0 /F
4⤵
- UAC bypass
PID:2372

C:\Windows\system32\reg.exe
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v PromptOnSecureDesktop /t reg_dword /d 0 /F
4⤵
- UAC bypass
PID:2172

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy /b C:\Users\Public\Pictures\TJHzg\xtg78@A8\v + C:\Users\Public\Pictures\TJHzg\xtg78@A8\b C:\Users\Public\Pictures\TJHzg\xtg78@A8\openconsolewpcap.dll
3⤵
PID:884

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Roaming\CS-TG-64\tdata\emoji\dac.exe > nul
3⤵
- Suspicious use of WriteProcessMemory
PID:1212

C:\Windows\system32\PING.EXE
ping -n 2 127.0.0.1
4⤵
- Runs ping.exe
PID:2820

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1996

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003A0" "00000000000003B4"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2860

C:\Windows\system32\mmc.exe
C:\Windows\system32\mmc.exe -Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1548

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" interface ip set address 本地连接 static 1.0.0.2 255.255.255.0 1.0.0.1 1
2⤵
- Modifies data under HKEY_USERS
PID:1644

C:\Windows\system32\mmc.exe
C:\Windows\system32\mmc.exe -Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: SetClipboardViewer
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1820

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" interface ip set address \"无线网络连接\" static 1.0.0.3 255.255.255.0 1.0.0.1 1
2⤵
- Modifies data under HKEY_USERS
PID:892

C:\Windows\system32\mmc.exe
C:\Windows\system32\mmc.exe -Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: SetClipboardViewer
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432

C:\Users\Public\Pictures\TJHzg\xtg78@A8\ConsoleProxy.exe
"C:\Users\Public\Pictures\TJHzg\xtg78@A8\ConsoleProxy.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1608

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall delete rule name="" program="C:\Users\Public\Pictures\TJHzg\xtg78@A8\ConsoleProxy.exe"
3⤵
- Modifies Windows Firewall
- Modifies data under HKEY_USERS
PID:2512

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall add rule name="" dir=in action=allow program="C:\Users\Public\Pictures\TJHzg\xtg78@A8\ConsoleProxy.exe" description=""
3⤵
- Modifies Windows Firewall
PID:2664

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall add rule name="" dir=out action=allow program="C:\Users\Public\Pictures\TJHzg\xtg78@A8\ConsoleProxy.exe" description=""
3⤵
- Modifies Windows Firewall
PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f76e9d4.rbs

Filesize
10KB

MD5
8d3f6cbe8139f073de5651083ecb562e

SHA1
7b5c733bfba9638f786c86a05e855aad76026533

SHA256
a42fcab8a8624fa9293aa9f9d5d301288d583403862fddf1b63a9b413372a538

SHA512
4fcd24c215ba51c61c54712f92551bb0028c0f10a9d97d29dd5c6815f7699a71fc4476a40762e50c7c9c2d0be7ef7598954a5f774a1af319232480d49d98e69e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI84F8.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI87B7.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8845.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8845.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI88F1.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI89EC.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Roaming\3znqB.bat

Filesize
392B

MD5
30d6eb22d6aeec10347239b17b023bf4

SHA1
e2a6f86d66c699f6e0ff1ac4e140af4a2a4637d1

SHA256
659df6b190a0b92fc34e3a4457b4a8d11a26a4caf55de64dfe79eb1276181f08

SHA512
500872c3f2f3f801ec51717690873194675cb7f32cc4a862c09d90c18638d364d49b0e04c32323f52734e5c806e3503a63ac755c7019d762786a72840123df76

Download Submit
C:\Users\Admin\AppData\Roaming\CS-TG-64\tdata\emoji\cache_22_7

Filesize
9.0MB

MD5
be5628882d28ba1bdb9850dc4b7e7fa1

SHA1
6d37839c4b8ded05c0e8108696e1b794de59a2a8

SHA256
def949e97a2a2d2e504f7c85a27a6f2fd44d3a898357398f4aaa7eb033dfb287

SHA512
16037fd6ee2bb26e1014e9e69a2ee5d7290ebe5021ed1eedaa5908b73c39cc2ba6f66c553be9a39163b8831e8f519b10009e71fb94ce392c7229541192aa1c39

Download Submit
C:\Users\Admin\AppData\Roaming\CS-TG-64\tdata\emoji\dac.exe

Filesize
23.0MB

MD5
ec65abfa1f59b0d7d5335150834226b3

SHA1
036768482c85e94135847d91db77a901b21ff621

SHA256
f5842ba5da811ef75225d03c28b7178c47cc358da67ea5d577a29e23eea3fe6a

SHA512
eb605664dfe37fbd30819235b0851b905f8802a596cc8d986fe4322ea899cb55276dcbca5b85c0d7df50b32ad02016bbe98b012585d5fa6722156edcdc427040

Download Submit
C:\Users\Admin\AppData\Roaming\CS-TG-64\tdata\emoji\dac.exe

Filesize
23.0MB

MD5
ec65abfa1f59b0d7d5335150834226b3

SHA1
036768482c85e94135847d91db77a901b21ff621

SHA256
f5842ba5da811ef75225d03c28b7178c47cc358da67ea5d577a29e23eea3fe6a

SHA512
eb605664dfe37fbd30819235b0851b905f8802a596cc8d986fe4322ea899cb55276dcbca5b85c0d7df50b32ad02016bbe98b012585d5fa6722156edcdc427040

Download Submit
C:\Users\Public\Pictures\TJHzg\xtg78@A8\ConsoleProxy.exe

Filesize
904KB

MD5
07664d67b56857133ce91e0ede047ec6

SHA1
c83dd9f00278e567f23b918791e2f1ba1b025c8b

SHA256
effe2e868cb9f885a1f91044be10eca56057f0fd2fea43f0fc4ad349e344c15f

SHA512
610b68bfc4acba3307b9ae106b388777040d024cb6ce5a3cee92462ab0d20986d1bf1a0ab9a827fe45fc48442b5e0c771329ac47e6ebacd4d9d793cf81fa036d

Download Submit
C:\Users\Public\Pictures\TJHzg\xtg78@A8\ConsoleProxy.exe

Filesize
904KB

MD5
07664d67b56857133ce91e0ede047ec6

SHA1
c83dd9f00278e567f23b918791e2f1ba1b025c8b

SHA256
effe2e868cb9f885a1f91044be10eca56057f0fd2fea43f0fc4ad349e344c15f

SHA512
610b68bfc4acba3307b9ae106b388777040d024cb6ce5a3cee92462ab0d20986d1bf1a0ab9a827fe45fc48442b5e0c771329ac47e6ebacd4d9d793cf81fa036d

Download Submit
C:\Users\Public\Pictures\TJHzg\xtg78@A8\PX.log

Filesize
156KB

MD5
a4a2e7d0f65a958404227b9fe3b334a7

SHA1
c009268c802f25e259f6804ad7f5bc0aa92bea78

SHA256
253488a52213e35845d5c66a67aca65d35801a3998523a895976ce521748abba

SHA512
04b6afcdcad80461c977717d448cefacdb2bf856f4b1350e8d923c9b6001d2f7868968c340a2ab12a5a1d5c724fdb16e73710cadbed85ce3a058eabd86a4ac00

Download Submit
C:\Users\Public\Pictures\TJHzg\xtg78@A8\b

Filesize
104KB

MD5
87fc2bd3754f13f346d5deb868b7b205

SHA1
909995865895b9c79c0a3b6c17b5867e1c67b4de

SHA256
f194e9e6449f4634a1f20ffa9d17ad5a2af228ad55160ab27ec2562265dc0715

SHA512
43adb9a29c443477126226a12f3035672a43f168e58e0b2e540995491248fd6173d637314be477d6d13f1397f0504def4171e02cae14876fecd12b2e74bd2bce

Download Submit
C:\Users\Public\Pictures\TJHzg\xtg78@A8\openconsolepacket.dll

Filesize
126KB

MD5
75601eb6b85df77b3b8328e524cdd8be

SHA1
58e732acec0c0e65370030fc61e6577a2cc0d4af

SHA256
530010b5cb8a82bae6e244bca0a1a5202ece0cf59c83f7434af77b2a8ed32a84

SHA512
cc01c13b7926d31354a90db66b317c02fb4e155785f4c27eee24fdecdda4b5d18cdaf09581d4e54f0d10169708e4c2f904144a669cb5f4019146e19acef3f982

Download Submit
C:\Users\Public\Pictures\TJHzg\xtg78@A8\openconsolewpcap.dll

Filesize
208KB

MD5
ceb101e19e1627a7cefc3edd8e594d43

SHA1
52da2a83f1ed5e2f9e34e7462a724986b1946c61

SHA256
e3210354d07b2e785f794fade1f84ab072f9e6bd169d246974ae1550bde33b92

SHA512
c20418068d538c727a310b236c66122d5f0fc86300c32c10be05d32a2c0e8da8b7af632e202aa612c863eb2149b7891e577e81dc729148cb3f6dcad0697836f2

Download Submit
C:\Users\Public\Pictures\TJHzg\xtg78@A8\v

Filesize
104KB

MD5
b3d69bc92cd8824c81dce8a039289b51

SHA1
4d1636c74bc6c05b3da6fc71ad0a2fccbf48357a

SHA256
e3c6afedac974e02f301dc9c05ee8456343d1b013a3edbd7e648a13b36193a88

SHA512
444108a37cb065ee2b070bdd0f0ddb22bfc78eb6b5d9de1025960f22cb86fc4d865988445df75605bff8e806d6ba3659d2260432125f04ce80bf8fba27af83a8

Download Submit
C:\Windows\Installer\MSIEB39.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Windows\Installer\f76e9d2.msi

Filesize
90.9MB

MD5
9cee7423f1bd5d64559c49689a18c06b

SHA1
5a75b69d2e66fc679c123d60a12712566246904a

SHA256
296608771a852e2e95f8fbd3f1990e671a9b7d44f84470335f262ff9b14b7d1c

SHA512
4e0da5e6fe0205d065cd3eeb9d5e2fb644177d65c273f447686b51d614b5c89a0c435b2ae2698d2a8e2aba5838dc576e5fb2cceb7d44aeea959d9e9369ed6f00

Download Submit
\Users\Admin\AppData\Local\Temp\MSI84F8.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
\Users\Admin\AppData\Local\Temp\MSI87B7.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
\Users\Admin\AppData\Local\Temp\MSI8845.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
\Users\Admin\AppData\Local\Temp\MSI88F1.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
\Users\Admin\AppData\Local\Temp\MSI89EC.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
\Users\Admin\AppData\Roaming\CS-TG-64\Telegram.exe

Filesize
126.7MB

MD5
b207b753976baf91f4a1cfb6a195fd9d

SHA1
4c7a1cf450d6a96f6f9321a6407cd2d6dd50abb9

SHA256
96fbe1f018b68dc7be9b901eace3e9de00f8b6939af49153b8ebd88d868404d8

SHA512
5e8d9b3a4b78dbf495f14f0136cd891ee4f2fa6bcb4a051b73ba0f1acced17ac1abfceb94748cd10ba759c467be09b107ce1493679791715d05b65e13c5241f1

Download Submit
\Users\Admin\AppData\Roaming\CS-TG-64\Telegram.exe

Filesize
126.7MB

MD5
b207b753976baf91f4a1cfb6a195fd9d

SHA1
4c7a1cf450d6a96f6f9321a6407cd2d6dd50abb9

SHA256
96fbe1f018b68dc7be9b901eace3e9de00f8b6939af49153b8ebd88d868404d8

SHA512
5e8d9b3a4b78dbf495f14f0136cd891ee4f2fa6bcb4a051b73ba0f1acced17ac1abfceb94748cd10ba759c467be09b107ce1493679791715d05b65e13c5241f1

Download Submit
\Users\Admin\AppData\Roaming\CS-TG-64\Telegram.exe

Filesize
126.7MB

MD5
b207b753976baf91f4a1cfb6a195fd9d

SHA1
4c7a1cf450d6a96f6f9321a6407cd2d6dd50abb9

SHA256
96fbe1f018b68dc7be9b901eace3e9de00f8b6939af49153b8ebd88d868404d8

SHA512
5e8d9b3a4b78dbf495f14f0136cd891ee4f2fa6bcb4a051b73ba0f1acced17ac1abfceb94748cd10ba759c467be09b107ce1493679791715d05b65e13c5241f1

Download Submit
\Users\Admin\AppData\Roaming\CS-TG-64\Telegram.exe

Filesize
126.7MB

MD5
b207b753976baf91f4a1cfb6a195fd9d

SHA1
4c7a1cf450d6a96f6f9321a6407cd2d6dd50abb9

SHA256
96fbe1f018b68dc7be9b901eace3e9de00f8b6939af49153b8ebd88d868404d8

SHA512
5e8d9b3a4b78dbf495f14f0136cd891ee4f2fa6bcb4a051b73ba0f1acced17ac1abfceb94748cd10ba759c467be09b107ce1493679791715d05b65e13c5241f1

Download Submit
\Users\Admin\AppData\Roaming\CS-TG-64\Telegram.exe

Filesize
126.7MB

MD5
b207b753976baf91f4a1cfb6a195fd9d

SHA1
4c7a1cf450d6a96f6f9321a6407cd2d6dd50abb9

SHA256
96fbe1f018b68dc7be9b901eace3e9de00f8b6939af49153b8ebd88d868404d8

SHA512
5e8d9b3a4b78dbf495f14f0136cd891ee4f2fa6bcb4a051b73ba0f1acced17ac1abfceb94748cd10ba759c467be09b107ce1493679791715d05b65e13c5241f1

Download Submit
\Users\Admin\AppData\Roaming\CS-TG-64\Telegram.exe

Filesize
126.7MB

MD5
b207b753976baf91f4a1cfb6a195fd9d

SHA1
4c7a1cf450d6a96f6f9321a6407cd2d6dd50abb9

SHA256
96fbe1f018b68dc7be9b901eace3e9de00f8b6939af49153b8ebd88d868404d8

SHA512
5e8d9b3a4b78dbf495f14f0136cd891ee4f2fa6bcb4a051b73ba0f1acced17ac1abfceb94748cd10ba759c467be09b107ce1493679791715d05b65e13c5241f1

Download Submit
\Users\Admin\AppData\Roaming\CS-TG-64\Telegram.exe

Filesize
126.7MB

MD5
b207b753976baf91f4a1cfb6a195fd9d

SHA1
4c7a1cf450d6a96f6f9321a6407cd2d6dd50abb9

SHA256
96fbe1f018b68dc7be9b901eace3e9de00f8b6939af49153b8ebd88d868404d8

SHA512
5e8d9b3a4b78dbf495f14f0136cd891ee4f2fa6bcb4a051b73ba0f1acced17ac1abfceb94748cd10ba759c467be09b107ce1493679791715d05b65e13c5241f1

Download Submit
\Users\Admin\AppData\Roaming\CS-TG-64\tdata\emoji\dac.exe

Filesize
23.0MB

MD5
ec65abfa1f59b0d7d5335150834226b3

SHA1
036768482c85e94135847d91db77a901b21ff621

SHA256
f5842ba5da811ef75225d03c28b7178c47cc358da67ea5d577a29e23eea3fe6a

SHA512
eb605664dfe37fbd30819235b0851b905f8802a596cc8d986fe4322ea899cb55276dcbca5b85c0d7df50b32ad02016bbe98b012585d5fa6722156edcdc427040

Download Submit
\Users\Public\Pictures\TJHzg\xtg78@A8\openconsolepacket.dll

Filesize
126KB

MD5
75601eb6b85df77b3b8328e524cdd8be

SHA1
58e732acec0c0e65370030fc61e6577a2cc0d4af

SHA256
530010b5cb8a82bae6e244bca0a1a5202ece0cf59c83f7434af77b2a8ed32a84

SHA512
cc01c13b7926d31354a90db66b317c02fb4e155785f4c27eee24fdecdda4b5d18cdaf09581d4e54f0d10169708e4c2f904144a669cb5f4019146e19acef3f982

Download Submit
\Users\Public\Pictures\TJHzg\xtg78@A8\openconsolewpcap.dll

Filesize
208KB

MD5
ceb101e19e1627a7cefc3edd8e594d43

SHA1
52da2a83f1ed5e2f9e34e7462a724986b1946c61

SHA256
e3210354d07b2e785f794fade1f84ab072f9e6bd169d246974ae1550bde33b92

SHA512
c20418068d538c727a310b236c66122d5f0fc86300c32c10be05d32a2c0e8da8b7af632e202aa612c863eb2149b7891e577e81dc729148cb3f6dcad0697836f2

Download Submit
\Windows\Installer\MSIEB39.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
memory/1080-84-0x0000000180000000-0x0000000180030000-memory.dmp

Filesize
192KB

Download
memory/1080-99-0x0000000180000000-0x0000000180030000-memory.dmp

Filesize
192KB

Download
memory/1080-85-0x0000000180000000-0x0000000180030000-memory.dmp

Filesize
192KB

Download
memory/1080-138-0x0000000180000000-0x0000000180030000-memory.dmp

Filesize
192KB

Download
memory/1080-83-0x0000000180000000-0x0000000180030000-memory.dmp

Filesize
192KB

Download
memory/1080-82-0x0000000180000000-0x0000000180030000-memory.dmp

Filesize
192KB

Download
memory/1080-76-0x0000000180000000-0x0000000180030000-memory.dmp

Filesize
192KB

Download
memory/1548-110-0x0000000002040000-0x0000000002041000-memory.dmp

Filesize
4KB

Download
memory/1608-134-0x00000000006E0000-0x000000000073E000-memory.dmp

Filesize
376KB

Download
memory/1608-135-0x00000000006E0000-0x000000000073E000-memory.dmp

Filesize
376KB

Download
memory/1608-133-0x00000000006E0000-0x000000000073E000-memory.dmp

Filesize
376KB

Download
memory/1820-111-0x0000000002040000-0x0000000002041000-memory.dmp

Filesize
4KB

Download
memory/2432-125-0x0000000001F40000-0x0000000001F41000-memory.dmp

Filesize
4KB

Download