Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    183s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/10/2022, 04:48

General

  • Target

    8e14c98dd7723cf7a05f58d78194237f2ccfa63fc20eeae9546cec05a90fb91f.exe

  • Size

    310KB

  • MD5

    74b2c9b9a15dc0a92f867fe210622c3f

  • SHA1

    befd6c6bb6889cdc0c32d9e36b369a6f9aea2454

  • SHA256

    8e14c98dd7723cf7a05f58d78194237f2ccfa63fc20eeae9546cec05a90fb91f

  • SHA512

    32f98c17927af20866b67c3ed9540929687de1559da37ae462618cdf72c01c617d657cd3429007bd613eb1bafdfca379664d02bf3b97c8b42af47393237b17a6

  • SSDEEP

    6144:NiMDpVyzfutYz87ZY7yAVxHytGNr8cwPM2vuii2IW6MIPg5q5zV:NXNkWqIueUHytMS5inWzIPDZV

Malware Config

Signatures

  • joker

    Joker is an Android malware that targets billing and SMS fraud.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8e14c98dd7723cf7a05f58d78194237f2ccfa63fc20eeae9546cec05a90fb91f.exe
    "C:\Users\Admin\AppData\Local\Temp\8e14c98dd7723cf7a05f58d78194237f2ccfa63fc20eeae9546cec05a90fb91f.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2180
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\9bak0.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4496
      • C:\Windows\SysWOW64\expand.exe
        expand.exe "C:\Users\Admin\AppData\Local\Temp\ico.cab" -F:*.* "C:\progra~1\ico"
        3⤵
        • Drops file in Program Files directory
        • Drops file in Windows directory
        PID:640
    • C:\Windows\SysWOW64\explorer.exe
      explorer.exe http://www.v258.net/list/list16.html?mmm
      2⤵
        PID:3396
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" http://www.q22.cc/?ukt
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3792
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3792 CREDAT:17410 /prefetch:2
          3⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:4932
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" http://www.v921.com/?uk
        2⤵
        • Modifies Internet Explorer settings
        PID:4668
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" http://www.779dh.com/?kj
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3084
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3084 CREDAT:17410 /prefetch:2
          3⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2248
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:4216
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.v258.net/list/list16.html?mmm
        2⤵
        • Enumerates system info in registry
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4248
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa4ae46f8,0x7ffaa4ae4708,0x7ffaa4ae4718
          3⤵
            PID:5000
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,13836173215298019521,2244452801456181863,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
            3⤵
              PID:1616
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,13836173215298019521,2244452801456181863,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
              3⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:5024
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,13836173215298019521,2244452801456181863,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2272 /prefetch:8
              3⤵
                PID:1948
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13836173215298019521,2244452801456181863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3712 /prefetch:1
                3⤵
                  PID:2060
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13836173215298019521,2244452801456181863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
                  3⤵
                    PID:3976
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2160,13836173215298019521,2244452801456181863,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5288 /prefetch:8
                    3⤵
                      PID:2388
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13836173215298019521,2244452801456181863,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
                      3⤵
                        PID:5192
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13836173215298019521,2244452801456181863,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
                        3⤵
                          PID:5248
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13836173215298019521,2244452801456181863,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
                          3⤵
                            PID:5564
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13836173215298019521,2244452801456181863,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3132 /prefetch:1
                            3⤵
                              PID:5716
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13836173215298019521,2244452801456181863,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6452 /prefetch:1
                              3⤵
                                PID:5912
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13836173215298019521,2244452801456181863,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1436 /prefetch:1
                                3⤵
                                  PID:4012
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:3352

                              Network

                              MITRE ATT&CK Enterprise v6

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

                                Filesize

                                2KB

                                MD5

                                b90f7774c9a454dcb4e765a13fd24eb0

                                SHA1

                                f08a1453647c33dfd7d5757619f8b786106c1810

                                SHA256

                                cef9e0d09bcefec36de16ecca1a53665018bae69aac8c5350e5e74594574b877

                                SHA512

                                648f95283286096734187c0c130db8ee294046fde96bcaf7409761bc5b4207073b2006f4dddd8c8e3f44423934ce92ac112bd18fafc329e0b839404552b54249

                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

                                Filesize

                                1KB

                                MD5

                                be9d844ee366a93894115b42bfdb9e5f

                                SHA1

                                72502c6dc0cf0096085e58347022d318e7cac171

                                SHA256

                                ea7d6276f53a1683acdd10a5d591483e43318e4a1623291cfebc4b984d4c5090

                                SHA512

                                495e1f2e07785ca66b0ab30c432de1a0e067c11d3cc05e214f5dc5a579e9f6908d5801a3122cc29653d7d8357c7a352c4c79cf7ccc873f6e94fdf849f1e9072b

                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\26FAECAB15AD715CB7849E2211F9473B

                                Filesize

                                1KB

                                MD5

                                9e1a3192b448ff47392265e1d9827e2f

                                SHA1

                                45434a476cad4073a1e7893f7315cc614d3909ae

                                SHA256

                                be555962739a0821916b873227de68605cc2147d4b0ecd78d5032b05b7660ece

                                SHA512

                                5980d60f41bea80fc7f8ad46dbecc92038e5ef3e40dd06b8ec23b862cdabe303a80c097380d1e2cf4c6290de3cb1284682cd69882491b824b23ffd4ebce34a32

                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\349D186F1CB5682FA0194D4F3754EF36_97A2CB43E01F27293633B7B57353C80B

                                Filesize

                                1KB

                                MD5

                                5f0c1a7d445a61a27e891a19ef7a5110

                                SHA1

                                7534b75e462f364cd6fec812700807be280a156f

                                SHA256

                                2920599acdcfbaa3ad649e97da30f55039ad8ac5ad8e17f790f4a11da7660ee3

                                SHA512

                                c34eb8518ec116959c1de1b95a539da7ef2c79a1bf84fc566d7a9f75fa0fa31eb4f60b4af759259e38501189eedc7bc7fdea46a5605ec66012f292f76874c513

                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442

                                Filesize

                                1KB

                                MD5

                                04964efdbb8c142dc7fff7f6e121dfd0

                                SHA1

                                f86cb05710980af91c086463c0d110272de93afc

                                SHA256

                                9b117573b0a7799a551bd69218a33c44cfe0464915bd34fbd4b7b9c27490c3b5

                                SHA512

                                e43215ef2109225fe67bba1dfa2c039d38291e02d7fb887e77e4c738ca61a264f3a6522cb3fbd449d9bcd7469f5f9c6eee0ddddf106650860f799a69c3088d21

                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A269719AA1471E96C

                                Filesize

                                1KB

                                MD5

                                00227a1997000059db17c4973b72409d

                                SHA1

                                f583a8cf20fafabdc46595d85f32ed3f51f140a9

                                SHA256

                                37f5fa67232195384dfb20b9437c251697dfb2c9a377b1da726176757b31c917

                                SHA512

                                bcb08425bf0998004ab5331c5d0b3989b1ac6ee9616da1e1e3cfd02ee288c267fa3b8b1ef1d3bd9dcce707c0a3288ef0904fc5851513641a05f4718fc3e711ea

                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3

                                Filesize

                                1KB

                                MD5

                                b76fee086aab8f6c3ce9646ae8be45b6

                                SHA1

                                8e70ee34a9e3e3abf5974305587049381f3b1090

                                SHA256

                                9deb4aacd71f4565f51165a170f9d626ef080adb6e5247c523d4894619d12484

                                SHA512

                                ec8fbe71b4a7f6df986739d771823f68c701c24e18b4081d78c11009e90b86dd4a7c5547b8b67743ec5f6456c6c5657b19127b62a9370a908c6e73da56b1c6a2

                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

                                Filesize

                                1KB

                                MD5

                                6ad22bb37c06a8542959021fc49948fa

                                SHA1

                                753e47099793b24efedc8208611e9fabb74990b2

                                SHA256

                                e88f513b287a2aaa2118d51d71a20ff6cd04dacb2bbafba25676fc0ade7874b7

                                SHA512

                                838d033789ae6028b8fac4c5a6f7415d1515a2ea3a4a022c890e0879abddcf05794165799ae890ae3c54601fed034efb3f2fed35d3fa980c13941799d87dd440

                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

                                Filesize

                                471B

                                MD5

                                bef401b0eb329ab477b70d2be6d719ec

                                SHA1

                                de86ff23ef8bd66c2e1d2fdd9979f7833fb27998

                                SHA256

                                cea29d04551686cb9c35cdfcf8ac941a52f6690c1caa6a583a2f3e35d7b62e22

                                SHA512

                                033121de34f558cea72b76234fc865d07bddcabfc54358577ce7b252d4cd7f684df34d1ec5fe74aa6ce2a095181dccdf534fac6112838a20e4227f0ae8d4527e

                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

                                Filesize

                                488B

                                MD5

                                e412e9b144a4a17e49e47f246a11a2b2

                                SHA1

                                d57f44bd804e590545ea1c3a28e154fdcb8fcf4b

                                SHA256

                                1d3b1700b192e2e9b0f84ccee7186691dfce2d9fc706b82e1cec564bc769f98f

                                SHA512

                                087e6456650768d63ca723be5ccf7c76b89fe3f471afd26f0b441e757799323658a94bcef08267989313d0541c93795f31d982bc750e6a65fc8b5ce910479dfc

                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

                                Filesize

                                508B

                                MD5

                                44418060cbb76bc083c59877635dc0f7

                                SHA1

                                3773856fda5ac4e3da26b92aa7f4ade9d2f920bf

                                SHA256

                                8f385f0ba5d5062c912eccc48607305c0bf3d377a99c5fae45b4375601065992

                                SHA512

                                f5a9ef4da830a7d5b883bd5a85b953b92606b1438ea6ebf914b57b71b508ac20dae3c10aac6c589f31893af54ca946c025a78c8e75b0767cea1bff739286d247

                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\26FAECAB15AD715CB7849E2211F9473B

                                Filesize

                                230B

                                MD5

                                617cf94f982effc1f4d8e2c3a79df530

                                SHA1

                                42ecf8c02a44f97cdc6122107b29d0861d6b681e

                                SHA256

                                3add2963c5fa337ab3485d69f9620b65b7c018e4c6337fe0ea26e92f60fda7a5

                                SHA512

                                9c7090be38c2ee2129afbecd015bd2430532724d372e8690b03b8e65a5192839506ff9b5bebb9e9c499c68bf31d89fab951ceac993904c319da9f60027b9d3f5

                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\349D186F1CB5682FA0194D4F3754EF36_97A2CB43E01F27293633B7B57353C80B

                                Filesize

                                532B

                                MD5

                                f21134109844a3fffa68a2bde26845b9

                                SHA1

                                6de2f56f2f2ce8a11955d2e7614fecd4968660ea

                                SHA256

                                0baed28dec11b968a4a4c21bc383d45e6be954454a5c92c5c146ea9a980bf193

                                SHA512

                                87e197271050fdb71467a93e8fea616c703ac8323a629b03b742f66268cda0c705f9f3c64a66ebcbc3f6be7ff68fc2d1e0d7b6f7f3bb429234fb4f4abbcfb578

                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442

                                Filesize

                                446B

                                MD5

                                edb4c9cc107ceeb57bb100263a3b4f50

                                SHA1

                                174b91e1880982a0c8225f7b935bb21bddd79e3b

                                SHA256

                                8604979b893892b039fac80055b58ee71248cb7642e98e538809af9f746316c1

                                SHA512

                                e5886f8d79a664697345c3a0e3a45404ccc9e2935e3f15826cc94bc1ce0b26412f43e42f5ca30612dcb9ffe02aaaa073d8a97301b44ef97ead8253bf56efe48a

                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A269719AA1471E96C

                                Filesize

                                492B

                                MD5

                                35b3a6d8bb8cf098ed4e5aacf44f9c6a

                                SHA1

                                95a717a963898ebbbf3abd735505e4a1b631bc8a

                                SHA256

                                a6f320f59335755346359f0ff97d447597c3bfe845e136d493193e2fabc009db

                                SHA512

                                1f989f7307b8a1b716b337f1469db951edc2787d1ff6bab4ed80488d598741e765ff01cad479ebc4d0a40304af2bc578d7d5068450615366011da86afb488b7a

                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3

                                Filesize

                                506B

                                MD5

                                be6bda2854e2b029a96bb4dfbb4b9610

                                SHA1

                                a7a220cae6bc98a49f983d9c503f39a54e09b505

                                SHA256

                                e1700195300bee03f4bbf664c7ca97716b4642b6df5172bc442821c21501a64d

                                SHA512

                                e3b73e34bf957b68faf5623d732cfd1189f073f7a4a5e51351b12e388ff2356e165a57b2e83a44821f713ae5c5390b108a4659e0161fa6b8612226674dd851e7

                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

                                Filesize

                                482B

                                MD5

                                8f757dd3e3831bc6aa6d7705692320ad

                                SHA1

                                2d65a265214e1ef1511509bd09561bc430196f47

                                SHA256

                                2f1a4802b7d3ad93a7002ef05802914064c6c9821cbcc5c64b136dfadca4dbc0

                                SHA512

                                bfba4e3403b5d9f4d5b345b58d6a108aca5e96623ec333d76792cd7d2f014a69840c4d20560bfc89291d9409e912c8268da1c36dd5a428fcb7d4f83ba7a1c1ec

                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

                                Filesize

                                430B

                                MD5

                                f4432ad2a0c662c440d9e429e15fe580

                                SHA1

                                1de79bf10ce09b63ebc6312a6133e97e50f03324

                                SHA256

                                d7c5e37bd5022091e5cd2f3db5388c3d4fdccda1d8c1c20c05ef679a9b949877

                                SHA512

                                4ef4062c8af07ad2b0379b9f87af061058d2c91ccc5551d248402a6ff167a5a41a593fe783006e14c12288daacb1f2317cea4908edce678a6ad6d47f1092aed0

                              • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{3EE4ECC0-4BBF-11ED-89AC-C2DBB15B3A76}.dat

                                Filesize

                                5KB

                                MD5

                                6ced4c3af3446f58c5658f5c82a2371b

                                SHA1

                                e2a3c46ee90212f6ae859362deb32ee9cc3215a6

                                SHA256

                                5fa2616cfac7f5ae4ad5c0afdd5828535db0508b3bac0512a689ca1e9285c174

                                SHA512

                                e5c9ed23055d9c6ddcf0dabdb07ac272bd25eaa38de53c6639389b4d1399a1506c1033daa40e6e6face88c875038b9ddaa5baa7aaa2c9bb398684852f452eb05

                              • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{3EE7281B-4BBF-11ED-89AC-C2DBB15B3A76}.dat

                                Filesize

                                5KB

                                MD5

                                2b46c9edd4d138aba1d6bc98a45128e1

                                SHA1

                                8430b2d7fcd0a8ddac5991891b97399b302cea7c

                                SHA256

                                68989489681324a0dc696851cf2e8ccea3d001620cf5ba996bc6f1c3f7b7bb3b

                                SHA512

                                ab167caabb8010a96720b973546ff1742dac164a5513abcdc80be47d4c1a45c7b116d419dfbf4ae19a6f3fcd917b54b00242ba954c1acf5b2459929604339fc8

                              • C:\Users\Admin\AppData\Local\Temp\9bak0.bat

                                Filesize

                                98B

                                MD5

                                ada787702460241a372c495dc53dbdcf

                                SHA1

                                da7d65ec9541fe9ed13b3531f38202f83b0ac96d

                                SHA256

                                0d0f600f95192d2d602dbda346c4e08745295f331f5a0349deae21705367b850

                                SHA512

                                c86091735b855691c89c7946145591dec6a6a6a36a2438d392587a9cc1f2d85c1ebe44fcff1cc9d94271a24ebbc2ca38639577a6f5c592e9e10517da26572708

                              • \??\c:\users\admin\appdata\local\temp\ico.cab

                                Filesize

                                20KB

                                MD5

                                1319e9998cedc513c68fa6d590b6ad63

                                SHA1

                                ae95b333e88a13886994f320f5dfb4856168a710

                                SHA256

                                9a5b18efe243fbe9b9b0be3674a24080e9210436986988f3f85a4007905083bb

                                SHA512

                                d4052a899c6c310296e2f5fdf6c2031c22d2644be620cb34ddcc6b59789d82a6462daaeb34466c568be48ee975c4a5ab43143eab0792312a6cd0d49f9fbd8d3f

                              • memory/2180-137-0x0000000000400000-0x0000000000534000-memory.dmp

                                Filesize

                                1.2MB

                              • memory/2180-133-0x0000000000400000-0x0000000000534000-memory.dmp

                                Filesize

                                1.2MB

                              • memory/2180-132-0x0000000000400000-0x0000000000534000-memory.dmp

                                Filesize

                                1.2MB

                              • memory/2180-140-0x0000000000400000-0x0000000000534000-memory.dmp

                                Filesize

                                1.2MB