Malware Analysis Report

2025-08-05 10:49

Sample ID 241017-cc95sswemc
Target 8e7bdf6f8b347cad8593178316b332824ca8d370e283aa46d88f79182baaa501.exe
SHA256 8e7bdf6f8b347cad8593178316b332824ca8d370e283aa46d88f79182baaa501
Tags
discovery bootkit persistence
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

8e7bdf6f8b347cad8593178316b332824ca8d370e283aa46d88f79182baaa501

Threat Level: Likely malicious

The file 8e7bdf6f8b347cad8593178316b332824ca8d370e283aa46d88f79182baaa501.exe was found to be: Likely malicious.

Malicious Activity Summary

discovery bootkit persistence

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Writes to the Master Boot Record (MBR)

Enumerates processes with tasklist

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

System Network Configuration Discovery: Internet Connection Discovery

Runs ping.exe

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-17 01:57

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-17 01:57

Reported

2024-10-17 01:59

Platform

win10v2004-20241007-en

Max time kernel

140s

Max time network

131s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8e7bdf6f8b347cad8593178316b332824ca8d370e283aa46d88f79182baaa501.exe"

Signatures

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\8e7bdf6f8b347cad8593178316b332824ca8d370e283aa46d88f79182baaa501.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\8e7bdf6f8b347cad8593178316b332824ca8d370e283aa46d88f79182baaa501.exe

"C:\Users\Admin\AppData\Local\Temp\8e7bdf6f8b347cad8593178316b332824ca8d370e283aa46d88f79182baaa501.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 lrcs.csdownload.me udp
US 8.8.8.8:53 wefixyou.csdownload.me udp
FR 213.251.172.94:80 wefixyou.csdownload.me tcp
FR 213.251.172.94:80 wefixyou.csdownload.me tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 94.172.251.213.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp

Files

memory/4336-0-0x0000000000840000-0x0000000000841000-memory.dmp

memory/4336-10-0x0000000000840000-0x0000000000841000-memory.dmp

memory/4336-9-0x0000000000400000-0x0000000000646000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-17 01:57

Reported

2024-10-17 01:59

Platform

win7-20240903-en

Max time kernel

141s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8e7bdf6f8b347cad8593178316b332824ca8d370e283aa46d88f79182baaa501.exe"

Signatures

Downloads MZ/PE file

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\CS16Launcher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\hl.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\hl.exe N/A

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\tasklist.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\tasklist.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\findstr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\findstr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\8e7bdf6f8b347cad8593178316b332824ca8d370e283aa46d88f79182baaa501.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\tasklist.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\findstr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\findstr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\tasklist.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\CS16Launcher.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\hl.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Users\Admin\AppData\Local\Temp\8e7bdf6f8b347cad8593178316b332824ca8d370e283aa46d88f79182baaa501.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Users\Admin\AppData\Local\Temp\8e7bdf6f8b347cad8593178316b332824ca8d370e283aa46d88f79182baaa501.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\AppData\Local\Temp\8e7bdf6f8b347cad8593178316b332824ca8d370e283aa46d88f79182baaa501.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8e7bdf6f8b347cad8593178316b332824ca8d370e283aa46d88f79182baaa501.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 276 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\8e7bdf6f8b347cad8593178316b332824ca8d370e283aa46d88f79182baaa501.exe C:\Windows\SysWOW64\cmd.exe
PID 276 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\8e7bdf6f8b347cad8593178316b332824ca8d370e283aa46d88f79182baaa501.exe C:\Windows\SysWOW64\cmd.exe
PID 276 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\8e7bdf6f8b347cad8593178316b332824ca8d370e283aa46d88f79182baaa501.exe C:\Windows\SysWOW64\cmd.exe
PID 276 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\8e7bdf6f8b347cad8593178316b332824ca8d370e283aa46d88f79182baaa501.exe C:\Windows\SysWOW64\cmd.exe
PID 2844 wrote to memory of 2828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2844 wrote to memory of 2828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2844 wrote to memory of 2828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2844 wrote to memory of 2828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2828 wrote to memory of 2836 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2828 wrote to memory of 2836 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2828 wrote to memory of 2836 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2828 wrote to memory of 2836 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2828 wrote to memory of 2676 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2828 wrote to memory of 2676 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2828 wrote to memory of 2676 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2828 wrote to memory of 2676 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2844 wrote to memory of 2732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2844 wrote to memory of 2732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2844 wrote to memory of 2732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2844 wrote to memory of 2732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2844 wrote to memory of 3048 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2844 wrote to memory of 3048 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2844 wrote to memory of 3048 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2844 wrote to memory of 3048 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3048 wrote to memory of 1572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 3048 wrote to memory of 1572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 3048 wrote to memory of 1572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 3048 wrote to memory of 1572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 3048 wrote to memory of 2368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 3048 wrote to memory of 2368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 3048 wrote to memory of 2368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 3048 wrote to memory of 2368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2844 wrote to memory of 1864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2844 wrote to memory of 1864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2844 wrote to memory of 1864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2844 wrote to memory of 1864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2844 wrote to memory of 2748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2844 wrote to memory of 2748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2844 wrote to memory of 2748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2844 wrote to memory of 2748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2748 wrote to memory of 2896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2748 wrote to memory of 2896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2748 wrote to memory of 2896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2748 wrote to memory of 2896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2748 wrote to memory of 2884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2748 wrote to memory of 2884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2748 wrote to memory of 2884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2748 wrote to memory of 2884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2844 wrote to memory of 1988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2844 wrote to memory of 1988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2844 wrote to memory of 1988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2844 wrote to memory of 1988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2844 wrote to memory of 2648 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2844 wrote to memory of 2648 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2844 wrote to memory of 2648 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2844 wrote to memory of 2648 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 2740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2648 wrote to memory of 2740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2648 wrote to memory of 2740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2648 wrote to memory of 2740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2648 wrote to memory of 1720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2648 wrote to memory of 1720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2648 wrote to memory of 1720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2648 wrote to memory of 1720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8e7bdf6f8b347cad8593178316b332824ca8d370e283aa46d88f79182baaa501.exe

"C:\Users\Admin\AppData\Local\Temp\8e7bdf6f8b347cad8593178316b332824ca8d370e283aa46d88f79182baaa501.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\~E31E.bat" -game cstrike -noipx -nojoy -noforcemparms -noforcemaccel"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c tasklist /fo csv |FINDSTR /I /C:"CS16Launcher.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist /fo csv

C:\Windows\SysWOW64\findstr.exe

FINDSTR /I /C:"CS16Launcher.exe"

C:\Windows\SysWOW64\PING.EXE

ping localhost -n 3

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c tasklist /fo csv |FINDSTR /I /C:"CS16Launcher.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist /fo csv

C:\Windows\SysWOW64\findstr.exe

FINDSTR /I /C:"CS16Launcher.exe"

C:\Windows\SysWOW64\PING.EXE

ping localhost -n 3

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c tasklist /fo csv |FINDSTR /I /C:"CS16Launcher.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist /fo csv

C:\Windows\SysWOW64\findstr.exe

FINDSTR /I /C:"CS16Launcher.exe"

C:\Windows\SysWOW64\PING.EXE

ping localhost -n 3

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c tasklist /fo csv |FINDSTR /I /C:"CS16Launcher.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist /fo csv

C:\Windows\SysWOW64\findstr.exe

FINDSTR /I /C:"CS16Launcher.exe"

C:\Windows\SysWOW64\PING.EXE

ping localhost -n 3

C:\Windows\SysWOW64\PING.EXE

ping localhost -n 1

C:\Windows\SysWOW64\PING.EXE

ping localhost -n 2

C:\Windows\SysWOW64\PING.EXE

ping localhost -n 2

C:\Users\Admin\AppData\Local\Temp\CS16Launcher.exe

"CS16Launcher.exe" -game cstrike

C:\Windows\SysWOW64\PING.EXE

ping localhost -n 2

C:\Users\Admin\AppData\Local\Temp\hl.exe

"CS16Launcher.exe" -game cstrike

Network

Country Destination Domain Proto
US 8.8.8.8:53 lrcs.csdownload.me udp
US 8.8.8.8:53 wefixyou.csdownload.me udp
FR 213.251.172.94:80 wefixyou.csdownload.me tcp
FR 213.251.172.94:80 wefixyou.csdownload.me tcp
US 8.8.8.8:53 csgoupd1.masterserver.me udp
NL 109.236.88.70:80 csgoupd1.masterserver.me tcp

Files

memory/276-0-0x0000000000240000-0x0000000000241000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\~E31E.bat

MD5 06f5083aa187ad4018d322e79d725e05
SHA1 2473e9179f8e68a2a68ccfab0b97eb3335fec55d
SHA256 de86746cb9010b0ee4251499d1427d0f59364e7843b2164521b3bf10a9698a23
SHA512 406c80a3ba9a6c9ba427f595f3ae9f2253107665c04832431324be035eb58b00e521825a1a964b8a6de94d9297ba18c7e1b7cbf443713058c4561f7ff936264c

memory/276-26-0x0000000000240000-0x0000000000241000-memory.dmp

memory/276-25-0x0000000000400000-0x0000000000646000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CS16Launcher.exe.New

MD5 002569d719a892cefdee47b40fb9de9d
SHA1 c87baaf1db6f143eafceafb0e10be366a729cff7
SHA256 a8b816e969bbb052ac822e0dcd4ef7021dd0e14bde5a17e58f9756cfd4209746
SHA512 00f19ef8b9ef56a889f31896bfba7171bb43e48a2fc2d514a38952c6d1ce122b53a516b2425cd2ff2313f2aec834bf5a438450cb12248719200bfce89e128321

C:\Users\Admin\AppData\Local\Temp\platform\config\MasterServers.vdf

MD5 79e8cbef4f9bcae4515d77059f2a5cd4
SHA1 29f708d3dd29e1a47837b75c4bd40d95661d563e
SHA256 127c6947762873f0056b613de689c6788d64d311cb8d6c48076ca0c9986c173d
SHA512 849d7dcea9a2f3adc7204903530c9cc5d254b9e32135dfb0afa070a845f51daccb45f1ff6d145b942e918c51caa1b091ee331b0f2f10fb26fc6b9b888032551b

C:\Users\Admin\AppData\Local\Temp\cstrike\valve.rc

MD5 49b89267ce7c9daee488b41c7ecbae66
SHA1 8686b5c577bd192e68a5a7bcb5b08c8395d27812
SHA256 5b1b2dd68c2ff1fc6cda3f415cfa7087884ca075c371574aa19c1e4474c4d540
SHA512 9790a5b972e94f1809f56c73c27d622a3829a182c7710cbbc4c5f9039337d2f498cdadbfe1930b2b20ce450234638e30eef5873a6e10411555c3ce4181a60d47

\Users\Admin\AppData\Local\Temp\hl.exe

MD5 2098ccf443433129b556c2849fe99e26
SHA1 074ddbaff48c88b3b5c8f881c35d2be2bb19a249
SHA256 4a899986a879ffd4b7e2d819c49b47cb362d849e86917da1f1931ef476b414af
SHA512 fb4dcfd5371c89af775367d9f2ba72bfd42f8b483ba31b0e839b66f065e5e7a1ec34bf4504aaad17e38502be6917f0b3e415add81dc84fc6942996c0a8f95a10

C:\Users\Admin\AppData\Local\Temp\hw.dll

MD5 a0bc2e53bb55121719af9386ac2ff588
SHA1 1642aa1bfd63585fb324b8d23806efead856a3c9
SHA256 7802a1fcc2ab1749399e455faae907c0df3194386160dc4fa0164c427662fdc2
SHA512 e3a2b2ed965d15833ded927c6566a5facf11d1d654b65f2bbce70405013f2fe13009fe61b5488821f0846fd6cf0a5c5f2fd15a1a93c61c97540c917bd5040c92

\Users\Admin\AppData\Local\Temp\FileSystem_Stdio.dll

MD5 d9c4a776f838733c64331db0c87af459
SHA1 480aedeccdf5845de06c7bf39f59783a8fe92b1a
SHA256 4f7dca9537cdf20b65da599ffc33ea69e8a132239cfb6a3d0b1b623359dcda85
SHA512 5996c9a5cc5bc459b4dcdd7961690cbefdb741dd19338bfb4d1a864ce265e623f4e204dc6f1d4b0b84e66d0ae2f56b4f9bdb3cd7355f8a450703d0a2614d8d82

C:\Users\Admin\AppData\Local\Temp\vgui.dll

MD5 d44ee82601ae62ede3e224269a0bbf53
SHA1 2d00b1d5e052584c6c86ec08795d56d2181a91ee
SHA256 0d4472d21443de839080860a300cca6b9436508f329d33d712e5c9bc07d4d998
SHA512 00dba1a1d88bbc8f77f86ac45068d3f071805a13bf30c7f5c3f3168d3b799e773a1a3a7decab7931a9104bfe91dc8d60cc54b9e82a12e01b29dfe13c4fd1d398

memory/908-174-0x00000000009C0000-0x0000000000A18000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Steam.dll

MD5 94d9e620da6bd5fe5a4d20aebb15ec6d
SHA1 3c63d12fd2fda36048461c3a74ef228bb58da61a
SHA256 88f7c7fe458ec238599dc57063a69b6417902f1e3591c6239af7c400954f764e
SHA512 d1fe188954b45d2db40dcb06b44fb60dfe09fd0e0118ddebb27cb294202c2f59b49009e99d28e200078b22061d48d5b3de6251f255426087337c9fc462a74af7

C:\Users\Admin\AppData\Local\Temp\mss32.dll

MD5 f520185e02e8a5d85860669176bc4adc
SHA1 cea8e9ff14994c89ad86cf891c89fea42a39250a
SHA256 fe62f1eb6ba407df77619d16927abbefad3c726014f6bd1f8c37a7c3d6b781cc
SHA512 b434e77a17cdac0109b698d0fccdd25dcdb15090a9fd0427504cc7f616673fa6c7307f07fb22cc2fc1e915887c0f9dc025aa8d38f51503f91df6a9ccee5ebe58

C:\Users\Admin\AppData\Local\Temp\steam_api_c.dll

MD5 6baefb250616105b06438d6742d1ebde
SHA1 bd5b8f0113ab76dd8e35d6c446ab0286450f5666
SHA256 02fe1504d1ff75a0ed34e4cd8000639711d0481b9ad888dc96ccf8eadddc4753
SHA512 4389235cd5077f5fa9774f5ef2b4a2122de357c897b30658ad3c581e8d8991cf987159849392fd6776a80bc57ab563eda5b0c1e6e167e4a61954e117ac963a45

memory/908-182-0x0000000000280000-0x0000000000295000-memory.dmp

memory/908-185-0x00000000002B0000-0x00000000002BF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\hwpatcher.dll

MD5 3531565d73be13ffdeabc638d0d32ece
SHA1 59e17ec1365012e143b559a5e33ea1792f5264e0
SHA256 ad16e56157ceae1169edb1bfa6c902ce85d3f5e23815403d27ccff32efb1a4f2
SHA512 5dc99ef4a12f0feb05f78b911fed456cb81470caf011ecdc5b75485b29e3b4025ff9ae6a51870a9752cbd66f13971b06dd74e6c803ede7c5a4dc0371a2d18235

\Users\Admin\AppData\Local\Temp\uklUcicY.dat

MD5 e1cd35bbc28f73b7481e8835ee0f0b13
SHA1 ef40d489c61b178b54f8116548662ee876e0133f
SHA256 6ecef9ef0f62491d595b2f32c69b53c53a1b3a8a7c9dea39d56c6861f5b93bdf
SHA512 baf6f9063f95e6d699088ec4c0611825e030382ff913084feb7f913cc8f011d079b6c7143359391d8e30a5e26ac5a5358882b20e3ac31c5afdbe8867ff6f62a3

memory/908-191-0x0000000004920000-0x0000000005B4A000-memory.dmp

memory/908-192-0x0000000004920000-0x0000000005B4A000-memory.dmp

memory/276-194-0x0000000000400000-0x0000000000646000-memory.dmp