joker | 86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19-10-2022 16:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868.exe
Size

1.2MB
MD5

a0c833e7b57d75a8ab288bb5f9414409
SHA1

945f74980e6df70404138f4f1d052173817f1480
SHA256

86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868
SHA512

cd06daa050e76d9025778f0773aed95ddfa103a6750ee1b3809fec5b86911695a1f76f12cb5b5799818f69b8c3354a332473f6d3037bab503de9eeb7185f8604
SSDEEP

24576:z84Fb6PHUotlxRz0rs2T62W5su0S7sBpbum:z/6PHpMA2T6L0S7sBpKm

Score

10^/10

joker infostealer persistence trojan

Malware Config

Signatures

joker
Joker is an Android malware that targets billing and SMS fraud.
infostealer trojan joker

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\safe.ico	86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868.exe

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\progra~1\ico\c6e702814eda499d8c52b3e841392ca7$dpx$.tmp\f0824fe55541284c81c39f2b6857c94b.tmp	expand.exe
File opened for modification	C:\progra~1\ico\Chat.ico	expand.exe
File opened for modification	C:\progra~1\ico\Taobao.ico	expand.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\290344c3-f8fb-45ae-992d-0fae8eed16fb.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221019211119.pma	setup.exe
File opened for modification	C:\progra~1\ico\c6e702814eda499d8c52b3e841392ca7$dpx$.tmp	expand.exe
File opened for modification	C:\progra~1\ico\c6e702814eda499d8c52b3e841392ca7$dpx$.tmp\job.xml	expand.exe
File opened for modification	C:\progra~1\ico\Beauty.ico	expand.exe
File opened for modification	C:\progra~1\ico\Film.ico	expand.exe
File created	C:\progra~1\ico\c6e702814eda499d8c52b3e841392ca7$dpx$.tmp\f55f96a1073ad34181a41bfea797cdff.tmp	expand.exe
File created	C:\progra~1\ico\c6e702814eda499d8c52b3e841392ca7$dpx$.tmp\12962a106a339a4b83a7fb87af7f5476.tmp	expand.exe
File opened for modification	C:\progra~1\ico\Video.ico	expand.exe
File opened for modification	C:\progra~1\ico\{6A1A9F82-8485-47C5-9907-C7D30E456D19}	expand.exe
File created	C:\progra~1\ico\c6e702814eda499d8c52b3e841392ca7$dpx$.tmp\986a4d59eb2fe445b619fbbec320cda4.tmp	expand.exe
File created	C:\progra~1\ico\c6e702814eda499d8c52b3e841392ca7$dpx$.tmp\79203acc3727144b9be8b0f5b0026218.tmp	expand.exe
File opened for modification	C:\progra~1\ico\meiv.ico	expand.exe
File created	C:\progra~1\ico\c6e702814eda499d8c52b3e841392ca7$dpx$.tmp\f5579b85f093374289d974c461523e8b.tmp	expand.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	expand.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	expand.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30991359"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DOMStorage\779dh.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000975fab978604b14697eb522259e91a10000000000200000000001066000000010000200000008880a9e59920df45ee92a96489a6bff44b8f88e0ccc461390bb6b5834ce8429a000000000e8000000002000020000000c9e3aaaf8c8ecfc3ab19271ec12e5c2a0bfc8311afac9c13c593b18f97ed20f42000000044b7caf414ff2f168c7e31885c146bcde29a0939e0b4fd45b15ac29e937b48e6400000004e655fa6ff79bcc6bd3b49ed2b9b5d9ed3cdffd735f91cf2fb0637efd2e7a789f91824605de6ada7738baccd5dac3e88050c38f1f402b9d76c228669175c4b22	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\ename.com\Total = "63"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.779dh.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\mitao5.tv\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1375999599"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30991359"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1379611890"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\779dh.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30991359"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30991359"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30991359"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30991359"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1376468045"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "126"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b00f2d64ffe3d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1375843705"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30991359"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30991359"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DOMStorage\618889.shop.ename.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "189"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DOMStorage\ename.com	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "372978817"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1375999599"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{7D311D58-4FF2-11ED-89AC-EE6CABA3804C} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{7D29F761-4FF2-11ED-89AC-EE6CABA3804C} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.779dh.com\ = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.779dh.com\ = "126"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4644	86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868.exe
4644	86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868.exe
4644	86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868.exe
4644	86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868.exe
4892	msedge.exe
4892	msedge.exe
4800	msedge.exe
4800	msedge.exe
5412	identity_helper.exe
5412	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4644	86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
1948	iexplore.exe
3332	iexplore.exe
4612	iexplore.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
4644	86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868.exe
4644	86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868.exe
3332	iexplore.exe
3332	iexplore.exe
1948	iexplore.exe
1948	iexplore.exe
4612	iexplore.exe
4612	iexplore.exe
3472	IEXPLORE.EXE
3472	IEXPLORE.EXE
3388	IEXPLORE.EXE
3388	IEXPLORE.EXE
1252	IEXPLORE.EXE
1252	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 848	4644	86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868.exe	82
PID 4644 wrote to memory of 848	4644	86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868.exe	82
PID 4644 wrote to memory of 848	4644	86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868.exe	82
PID 4644 wrote to memory of 396	4644	86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868.exe	81
PID 4644 wrote to memory of 396	4644	86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868.exe	81
PID 4644 wrote to memory of 396	4644	86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868.exe	81
PID 848 wrote to memory of 1952	848	cmd.exe	84
PID 848 wrote to memory of 1952	848	cmd.exe	84
PID 848 wrote to memory of 1952	848	cmd.exe	84
PID 3304 wrote to memory of 4800	3304	explorer.exe	86
PID 3304 wrote to memory of 4800	3304	explorer.exe	86
PID 4800 wrote to memory of 4920	4800	msedge.exe	88
PID 4800 wrote to memory of 4920	4800	msedge.exe	88
PID 4644 wrote to memory of 4612	4644	86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868.exe	91
PID 4644 wrote to memory of 4612	4644	86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868.exe	91
PID 4644 wrote to memory of 1948	4644	86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868.exe	92
PID 4644 wrote to memory of 1948	4644	86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868.exe	92
PID 4644 wrote to memory of 3332	4644	86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868.exe	93
PID 4644 wrote to memory of 3332	4644	86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868.exe	93
PID 3332 wrote to memory of 3388	3332	iexplore.exe	94
PID 3332 wrote to memory of 3388	3332	iexplore.exe	94
PID 3332 wrote to memory of 3388	3332	iexplore.exe	94
PID 1948 wrote to memory of 3472	1948	iexplore.exe	96
PID 1948 wrote to memory of 3472	1948	iexplore.exe	96
PID 1948 wrote to memory of 3472	1948	iexplore.exe	96
PID 4612 wrote to memory of 1252	4612	iexplore.exe	95
PID 4612 wrote to memory of 1252	4612	iexplore.exe	95
PID 4612 wrote to memory of 1252	4612	iexplore.exe	95
PID 4800 wrote to memory of 824	4800	msedge.exe	98
PID 4800 wrote to memory of 824	4800	msedge.exe	98
PID 4800 wrote to memory of 824	4800	msedge.exe	98
PID 4800 wrote to memory of 824	4800	msedge.exe	98
PID 4800 wrote to memory of 824	4800	msedge.exe	98
PID 4800 wrote to memory of 824	4800	msedge.exe	98
PID 4800 wrote to memory of 824	4800	msedge.exe	98
PID 4800 wrote to memory of 824	4800	msedge.exe	98
PID 4800 wrote to memory of 824	4800	msedge.exe	98
PID 4800 wrote to memory of 824	4800	msedge.exe	98
PID 4800 wrote to memory of 824	4800	msedge.exe	98
PID 4800 wrote to memory of 824	4800	msedge.exe	98
PID 4800 wrote to memory of 824	4800	msedge.exe	98
PID 4800 wrote to memory of 824	4800	msedge.exe	98
PID 4800 wrote to memory of 824	4800	msedge.exe	98
PID 4800 wrote to memory of 824	4800	msedge.exe	98
PID 4800 wrote to memory of 824	4800	msedge.exe	98
PID 4800 wrote to memory of 824	4800	msedge.exe	98
PID 4800 wrote to memory of 824	4800	msedge.exe	98
PID 4800 wrote to memory of 824	4800	msedge.exe	98
PID 4800 wrote to memory of 824	4800	msedge.exe	98
PID 4800 wrote to memory of 824	4800	msedge.exe	98
PID 4800 wrote to memory of 824	4800	msedge.exe	98
PID 4800 wrote to memory of 824	4800	msedge.exe	98
PID 4800 wrote to memory of 824	4800	msedge.exe	98
PID 4800 wrote to memory of 824	4800	msedge.exe	98
PID 4800 wrote to memory of 824	4800	msedge.exe	98
PID 4800 wrote to memory of 824	4800	msedge.exe	98
PID 4800 wrote to memory of 824	4800	msedge.exe	98
PID 4800 wrote to memory of 824	4800	msedge.exe	98
PID 4800 wrote to memory of 824	4800	msedge.exe	98
PID 4800 wrote to memory of 824	4800	msedge.exe	98
PID 4800 wrote to memory of 824	4800	msedge.exe	98
PID 4800 wrote to memory of 824	4800	msedge.exe	98
PID 4800 wrote to memory of 824	4800	msedge.exe	98
PID 4800 wrote to memory of 824	4800	msedge.exe	98

C:\Users\Admin\AppData\Local\Temp\86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868.exe
"C:\Users\Admin\AppData\Local\Temp\86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe http://www.v258.net/list/list16.html?mmm
  2⤵
  PID:396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\DufCI.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:848
- - C:\Windows\SysWOW64\expand.exe
    expand.exe "C:\Users\Admin\AppData\Local\Temp\ico.cab" -F:*.* "C:\progra~1\ico"
    3⤵
    - Drops file in Program Files directory
    - Drops file in Windows directory
    PID:1952
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.q22.cc/?ukt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4612 CREDAT:17410 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1252
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.v921.com/?uk
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1948 CREDAT:17410 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:3472
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.779dh.com/?kj
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3332
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3332 CREDAT:17410 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:3388

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.v258.net/list/list16.html?mmm
  2⤵
  - Adds Run key to start application
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xf8,0x108,0x7ff9645946f8,0x7ff964594708,0x7ff964594718
    3⤵
    PID:4920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,17509228338316757495,6514840948663169942,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
    3⤵
    PID:824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,17509228338316757495,6514840948663169942,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,17509228338316757495,6514840948663169942,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
    3⤵
    PID:1636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17509228338316757495,6514840948663169942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
    3⤵
    PID:3500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17509228338316757495,6514840948663169942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
    3⤵
    PID:1536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2080,17509228338316757495,6514840948663169942,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4828 /prefetch:8
    3⤵
    PID:4912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17509228338316757495,6514840948663169942,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
    3⤵
    PID:4392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17509228338316757495,6514840948663169942,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
    3⤵
    PID:4356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2080,17509228338316757495,6514840948663169942,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5760 /prefetch:8
    3⤵
    PID:5060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17509228338316757495,6514840948663169942,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
    3⤵
    PID:5144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17509228338316757495,6514840948663169942,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
    3⤵
    PID:5176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17509228338316757495,6514840948663169942,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
    3⤵
    PID:5636
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,17509228338316757495,6514840948663169942,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1716 /prefetch:8
    3⤵
    PID:6104
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:5060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff7b2065460,0x7ff7b2065470,0x7ff7b2065480
      4⤵
      PID:1944
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,17509228338316757495,6514840948663169942,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1716 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17509228338316757495,6514840948663169942,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
    3⤵
    PID:5756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2080,17509228338316757495,6514840948663169942,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5248 /prefetch:8
    3⤵
    PID:5164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17509228338316757495,6514840948663169942,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6864 /prefetch:1
    3⤵
    PID:3696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4368

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
2KB

MD5
006c98bc42ac1d15f0ec70e3488783c5

SHA1
a8c8302826468c903b511e206d6d058e2c3acdaa

SHA256
e24883740fbed2781e4df4e5387cd95c3345ec9944edeeb36babd2c10135fa00

SHA512
e0caea17f99a18483e0195c5311942c195ef42532f1868bfb5c64b3f6cb72cc0fc58414176a9bfc66452e11d17c2058eafb483a41890f502ec76dc3a6807f2f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Filesize
1KB

MD5
a198204d205b99124e925e4a74d937f6

SHA1
c2df9a93981fb450e8a8d3cfac265194b44e29d1

SHA256
7f59a4cbf763d2c62ab89a4b9bb1157ce732db26fe65f9b592cb0420ae685b9b

SHA512
ce5c4b5d96dbba0481f64c685e70c9623375c946a7661c2866bda0defd763c7823e4108912063d57a189a6446fe3ca3b3977b65ba732225e7cd939b2062e4d02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Filesize
1KB

MD5
a198204d205b99124e925e4a74d937f6

SHA1
c2df9a93981fb450e8a8d3cfac265194b44e29d1

SHA256
7f59a4cbf763d2c62ab89a4b9bb1157ce732db26fe65f9b592cb0420ae685b9b

SHA512
ce5c4b5d96dbba0481f64c685e70c9623375c946a7661c2866bda0defd763c7823e4108912063d57a189a6446fe3ca3b3977b65ba732225e7cd939b2062e4d02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\349D186F1CB5682FA0194D4F3754EF36_97A2CB43E01F27293633B7B57353C80B

Filesize
1KB

MD5
232e508084f0e9272073d45c05317bf2

SHA1
971e532e1a5f24bc9697d22f67c16a83b539312f

SHA256
c845a0911f522f5ed76c3bd5fcbdb7326b2bfce51c2592e40911e179d6481b02

SHA512
f60ae73a244ac1f9a15d796f272ea8bc3adf218a4dc0deba7901911057a437e7ea03a1f370f299579dd673c1ac42204e6fc8fae954469ef37223a5f2b3b79c31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A269719AA1471E96C

Filesize
1KB

MD5
0628eeb2c23f48aac1e04ec80966f0eb

SHA1
80c6a6f9a8b299e121046ede825a3e52382417fe

SHA256
fc295c7bcfb27acdfea6819bc8351a678dc652e56c36c72fc72b5bf78f0c5aaf

SHA512
56e05b9e226851a809fba4cc76bed67ec91b85c5842e5e59ba79a260882ef40a038b8a052754875f4a3ca565a0ea5f4cdb7fc035e17ecd5eeb9ebb538d99c8e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3

Filesize
1KB

MD5
4aad00897d28d1d30ad6908d45cad9c8

SHA1
9323965e0af203b3b3d52998baedac7cd6aef671

SHA256
dda951b3a2ab641f895dfea91fb90218ce4829b73a7f184d40d1621e6e0bacf9

SHA512
63435d00ee3127a4842ea095ce83eb5fa980b7296dada8b013040d3be13921f44d78b39f5782c9687238949f2576a355bd22ed516add532b43e848439d10d559

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
1KB

MD5
97ab7ffd65186e85f453dc7c02637528

SHA1
f22312a6a44613be85c0370878456a965f869a40

SHA256
630df8e970cc3b1ad508db713dd8be52e0ac7a5826f3f264a266232f9a1c23ee

SHA512
37d90c98e72ad55b2cbb938541c81bac1aa9d2b8a7e19f0fbfaa365b49e7bef2d3199f03e46aa9fbf3055f3701d21860820c451065f7e425d39bf86ca606bfb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Filesize
471B

MD5
0d9a2037e73cd22f48320fe2b948f859

SHA1
d43ae6f8ff7c1dfc0e64dda6140c71dd302ccc5b

SHA256
c9292d1d90eb1b32c358968678fd6145c0a7c432f5eb54bfae4c5f7f5d36f2c0

SHA512
aeae9b23910422ace83e35a0e94f6d524f39c44e78cf7bbb224766a20e050a6d9024fee12d7cef83971ee71265b4df727b3582428a1e1b3ecc329cf56d6b9e73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
488B

MD5
691716c48df91ed4b1b407f566b32a8d

SHA1
11f23e6de945cae9fe675f15a3dc8dccb3e4a0b8

SHA256
ebf19cefca2e46955792cd4483d04802559a4f32533601149e75f3fa57a05e78

SHA512
6e02988c348c77ff832ec70d280044176862ac1f6270f52a6c2bfbd2a9637362e9838a5f1b6f0593afea8bbfa57b44c04d28474ee9415459f638caf2475b682c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Filesize
508B

MD5
2efd4469333552c8097cc8f7dd79a9e7

SHA1
960ffaaab004d925341f518e68f3f7c5012af8d8

SHA256
9ff7b2e5a706d27d88bbeabd68f87184beec0cab2e9ac5fd55112bd48dae5b43

SHA512
cb6b2631f5fd7bf42dcc505d60c67bd66842415c7b928a97d1372c3d72c8b2b188602aac3822995747f2e4206371dff406c726db7b91f531ace941f3a608781c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Filesize
508B

MD5
a50fcfb561e99b2d32073090c35b7683

SHA1
08fd1d9ad62995a31682d3f0fff9712bb0c409db

SHA256
d6da0a56439b159aef93f75403cbb519a5f592a64159d37a5f807b7c33c2041f

SHA512
5943ae364c192aaa4eb471859d8c3b9221ad1c41a2467ebacaf06f89e6b03eb425b2c92f6771bb10cd5fe025a0bdee78e801ff17d87ffc06a46aef7f88ef3612

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Filesize
508B

MD5
a50fcfb561e99b2d32073090c35b7683

SHA1
08fd1d9ad62995a31682d3f0fff9712bb0c409db

SHA256
d6da0a56439b159aef93f75403cbb519a5f592a64159d37a5f807b7c33c2041f

SHA512
5943ae364c192aaa4eb471859d8c3b9221ad1c41a2467ebacaf06f89e6b03eb425b2c92f6771bb10cd5fe025a0bdee78e801ff17d87ffc06a46aef7f88ef3612

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\349D186F1CB5682FA0194D4F3754EF36_97A2CB43E01F27293633B7B57353C80B

Filesize
532B

MD5
7ec845514c57747a07c6a47d5db77c24

SHA1
eb04d1294e914169982e10517d4ee0e04dab1cda

SHA256
87cd0a6d0b0d5e55d7cec5dfa585c4a6df939bbfe0b01935b6f40d271abf1116

SHA512
3bf4a254e8f737dfc423b77ae49b2ed498c79fa95160f9822704d455d589874803d94c8dcffd5b5a922036e7edd12b9b9fd97dbd9ffd8ce37b840b74e9563df7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A269719AA1471E96C

Filesize
492B

MD5
5fdeca6985fb0ee92143989e94fc50f6

SHA1
17db40a6cdc79f53408a8fb74713c027144ecb43

SHA256
0767438a893f00748faf112101b70ef485f570cb75247abf3cb173fb4d373735

SHA512
568ee76ee8a07be7789a55f4eaddd1373be645ca59e7ebe7fcd2ac46866aeded9a564cd59885fd690db82d0fbdd8e0ba48265af255721da0c7f00da61fff4622

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3

Filesize
506B

MD5
4e3cb1885e52ae11b2ecd5160e132255

SHA1
d1401f416f10ccbcc44dff3ad76bf2178b5ebaa8

SHA256
797f3c77292c0f8bf75afc835b3d49b8dc3f00d01bb173619a454d445ca0895b

SHA512
389e29c06681865c3d73f615143e8da7ce5943ff80054ada432e0205cdbf5f4ca749fab80f378735a2b7a76b997bc0c69dd82adff4b59dab9bff2eedb8591f8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
482B

MD5
9b872e69accc18415b9e5e5680bf61e4

SHA1
d5d9a0276da311af13367a3686140a9fff99f8e5

SHA256
785a503c5bd1cd3825abc8fe6dca84fea2d87c6f3b408859a24be9ee5449267e

SHA512
f2f2c5f6cd57426cddb805e4fa8dfbae4fd27c1cc29231861e4cc1c29dd3141c16c852ea72621f4fd8b7974f1c7f29cab616868846818fba7aa1d678ee336625

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Filesize
430B

MD5
512639a40098abbc1b9f93914f7739c9

SHA1
b1905520ccc47d937e571f6afce0c8ab3d8a256b

SHA256
a7d9c1ac54c22f47cdce74a1cf4fff4e0db78cc318bd8d920b0b7d47a25e3b9b

SHA512
5d68b370f9ae2a31e07f4cdfd95277e8ffe775803ae1d4ef6f4337daa0539b175f18e9cf8eff4b042b9d87c17776d4b0dad4b225d8789d43dcb5903c828f6324

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{7D29F761-4FF2-11ED-89AC-EE6CABA3804C}.dat

Filesize
3KB

MD5
afe2ef626e8be6b69c1b126e9f12353a

SHA1
3e9fdd0e0d2e0424c774b3208004fac6408967c9

SHA256
90e0a7f12edce0d963baefdca58be90372c667e8915870fdfc7b570e573fb5c6

SHA512
af25ac4234f1ebb29a4656ba81fa3391a4e2261c52b001f9ea0d178b421d10b513f082dbbb1331d2b64c457db888ac874dd8adc8003e81f71139584e3e24ae2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{7D29F761-4FF2-11ED-89AC-EE6CABA3804C}.dat

Filesize
5KB

MD5
8f339a8bbacfa0ed907e872ab32c848b

SHA1
bcab69b9ac7838c28eb3924676f07399ae2afa9d

SHA256
422b06adf703ba55d327acdcd0a0b9ba1652520eca0b8116caa2db344d244aa3

SHA512
3665ffbc3463aaf2ec311f97751dd1d8ef0b37252470ccd086db38535bfae7141b940f14fa8a7ac59ff8e6d0c901e8b2085f1afd21b29fb5f2d40046c6f53bc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{7D311D58-4FF2-11ED-89AC-EE6CABA3804C}.dat

Filesize
5KB

MD5
f2da59bcbbd34d7e67c9400dd485d38a

SHA1
2c1e8024e84a1d22df277a0f9a8fb0a1b5ee3a86

SHA256
e76f2dfc5250bf0442642fb4d1c0034e87297384839de00ec4059e59567d9991

SHA512
c85907ab7bba8b8fe4431d9f845d49f0dae1968e7cd58d0805c4d9cca3d0a9b12be68dbc9d5db9ef35fe41501a5e16659ccf7cbf89af7ead8355f4746e39a39c

Download Submit
C:\Users\Admin\AppData\Local\Temp\DufCI.bat

Filesize
98B

MD5
ada787702460241a372c495dc53dbdcf

SHA1
da7d65ec9541fe9ed13b3531f38202f83b0ac96d

SHA256
0d0f600f95192d2d602dbda346c4e08745295f331f5a0349deae21705367b850

SHA512
c86091735b855691c89c7946145591dec6a6a6a36a2438d392587a9cc1f2d85c1ebe44fcff1cc9d94271a24ebbc2ca38639577a6f5c592e9e10517da26572708

Download Submit
\??\c:\users\admin\appdata\local\temp\ico.cab

Filesize
20KB

MD5
1319e9998cedc513c68fa6d590b6ad63

SHA1
ae95b333e88a13886994f320f5dfb4856168a710

SHA256
9a5b18efe243fbe9b9b0be3674a24080e9210436986988f3f85a4007905083bb

SHA512
d4052a899c6c310296e2f5fdf6c2031c22d2644be620cb34ddcc6b59789d82a6462daaeb34466c568be48ee975c4a5ab43143eab0792312a6cd0d49f9fbd8d3f

Download Submit
memory/4644-139-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/4644-134-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download