joker | 8b3153e6a804e97a1595d12aeecda381fec1b3246339f15b04e4c060be0f29a2

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 17:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8b3153e6a804e97a1595d12aeecda381fec1b3246339f15b04e4c060be0f29a2.exe
Size

1.3MB
MD5

8267a44cf3ba07faabda9134c695e4e3
SHA1

d7ee1fbe8411b5e4f3f15c578e48208dfee94973
SHA256

8b3153e6a804e97a1595d12aeecda381fec1b3246339f15b04e4c060be0f29a2
SHA512

893a5e0aa40f0d7dc7c5fa8f1508d1d7c3fb9c11003a2d6065f742393a2bea77943d3aba9a8cbd94c1c078e3841a87025caff82f66fd8fc92330b834e1def53f
SSDEEP

12288:zAsElZjbdonl0UlJbIA5h3zBRSzMqGDZsMrUCAlNk7S5Mwfe/uK6PQdONNB:zAsElGKUHbBhjBw6DZF4lMwkn6

Score

10^/10

joker infostealer persistence trojan

Malware Config

Signatures

joker
Joker is an Android malware that targets billing and SMS fraud.
infostealer trojan joker

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	8b3153e6a804e97a1595d12aeecda381fec1b3246339f15b04e4c060be0f29a2.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\safe.ico	8b3153e6a804e97a1595d12aeecda381fec1b3246339f15b04e4c060be0f29a2.exe

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File opened for modification	C:\progra~1\ico\1569996cc2c44ca6874e4e288ea1f59a$dpx$.tmp	expand.exe
File opened for modification	C:\progra~1\ico\Beauty.ico	expand.exe
File opened for modification	C:\progra~1\ico\Taobao.ico	expand.exe
File opened for modification	C:\progra~1\ico\1569996cc2c44ca6874e4e288ea1f59a$dpx$.tmp\job.xml	expand.exe
File created	C:\progra~1\ico\1569996cc2c44ca6874e4e288ea1f59a$dpx$.tmp\103c412b6f805f42973cc0fc024a9f46.tmp	expand.exe
File created	C:\progra~1\ico\1569996cc2c44ca6874e4e288ea1f59a$dpx$.tmp\dc2426c8268e0e42a2d71f9b6fffd487.tmp	expand.exe
File opened for modification	C:\progra~1\ico\{0F368A4D-0AB0-4425-AF40-5C40A0EA8F42}	expand.exe
File created	C:\progra~1\ico\1569996cc2c44ca6874e4e288ea1f59a$dpx$.tmp\4d869923d1a2674cb7ccf25318ec2988.tmp	expand.exe
File created	C:\progra~1\ico\1569996cc2c44ca6874e4e288ea1f59a$dpx$.tmp\b74a9378aaf50646a7abf77cd1b0b685.tmp	expand.exe
File opened for modification	C:\progra~1\ico\Film.ico	expand.exe
File created	C:\progra~1\ico\1569996cc2c44ca6874e4e288ea1f59a$dpx$.tmp\0dfdd5aa7f650246a2348f3125cf59e5.tmp	expand.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221031104113.pma	setup.exe
File created	C:\progra~1\ico\1569996cc2c44ca6874e4e288ea1f59a$dpx$.tmp\0c59eb627255064ca7a846a5105d5d7b.tmp	expand.exe
File opened for modification	C:\progra~1\ico\Chat.ico	expand.exe
File opened for modification	C:\progra~1\ico\Music.ico	expand.exe
File opened for modification	C:\progra~1\ico\Video.ico	expand.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\48006566-2dda-42af-9e01-eefe14f9c31c.tmp	setup.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	expand.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	expand.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1042005523"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.779dh.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1042005523"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DOMStorage\ename.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "252"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\ename.com\Total = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1042005523"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30993685"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1140038732"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{689442DB-5908-11ED-AECB-C2DBB15B3A76} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30993685"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DOMStorage\618889.shop.ename.com	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\779dh.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\779dh.com\Total = "126"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\mitao5.tv\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\779dh.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{68941BCB-5908-11ED-AECB-C2DBB15B3A76} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.779dh.com\ = "63"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30993685"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\779dh.com\Total = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\mitao5.tv\ = "63"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 608dbc5015edd801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DOMStorage\mitao5.tv	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "126"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.779dh.com\ = "126"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1140038732"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30993685"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000883ed98174fc174d8e18111dae0d91200000000002000000000010660000000100002000000051bb450e1b52a7e2704e81aaf8eba55ad044fd3e37d4e834717a84005df23859000000000e80000000020000200000004d285da8ff830f2100c3bea6dc9c0ae965ac2772243bdf702e0e29e596b6f4632000000016361020b624162fdc780c8cf95914cc58dee8bc6bee5bb5173d01ccb5493d7440000000e916135a709b17d0e5d4c57b4f5ead01db8d66c772147b629ad3bd09b1128815ca269447e4868e0e3da24563ef3bf974cd6cd80808191a8733a8754b7a61ba1e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30993685"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1080	8b3153e6a804e97a1595d12aeecda381fec1b3246339f15b04e4c060be0f29a2.exe
1080	8b3153e6a804e97a1595d12aeecda381fec1b3246339f15b04e4c060be0f29a2.exe
1080	8b3153e6a804e97a1595d12aeecda381fec1b3246339f15b04e4c060be0f29a2.exe
1080	8b3153e6a804e97a1595d12aeecda381fec1b3246339f15b04e4c060be0f29a2.exe
5116	msedge.exe
5116	msedge.exe
3604	msedge.exe
3604	msedge.exe
5868	identity_helper.exe
5868	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1080	8b3153e6a804e97a1595d12aeecda381fec1b3246339f15b04e4c060be0f29a2.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4820	iexplore.exe
4180	iexplore.exe
3604	msedge.exe
3604	msedge.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
1080	8b3153e6a804e97a1595d12aeecda381fec1b3246339f15b04e4c060be0f29a2.exe
1080	8b3153e6a804e97a1595d12aeecda381fec1b3246339f15b04e4c060be0f29a2.exe
1080	8b3153e6a804e97a1595d12aeecda381fec1b3246339f15b04e4c060be0f29a2.exe
4180	iexplore.exe
4820	iexplore.exe
4180	iexplore.exe
4820	iexplore.exe
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE
380	IEXPLORE.EXE
380	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 3428	1080	8b3153e6a804e97a1595d12aeecda381fec1b3246339f15b04e4c060be0f29a2.exe	79
PID 1080 wrote to memory of 3428	1080	8b3153e6a804e97a1595d12aeecda381fec1b3246339f15b04e4c060be0f29a2.exe	79
PID 1080 wrote to memory of 3428	1080	8b3153e6a804e97a1595d12aeecda381fec1b3246339f15b04e4c060be0f29a2.exe	79
PID 1080 wrote to memory of 5092	1080	8b3153e6a804e97a1595d12aeecda381fec1b3246339f15b04e4c060be0f29a2.exe	81
PID 1080 wrote to memory of 5092	1080	8b3153e6a804e97a1595d12aeecda381fec1b3246339f15b04e4c060be0f29a2.exe	81
PID 1080 wrote to memory of 5092	1080	8b3153e6a804e97a1595d12aeecda381fec1b3246339f15b04e4c060be0f29a2.exe	81
PID 3428 wrote to memory of 3204	3428	cmd.exe	82
PID 3428 wrote to memory of 3204	3428	cmd.exe	82
PID 3428 wrote to memory of 3204	3428	cmd.exe	82
PID 4924 wrote to memory of 3604	4924	explorer.exe	84
PID 4924 wrote to memory of 3604	4924	explorer.exe	84
PID 3604 wrote to memory of 5048	3604	msedge.exe	86
PID 3604 wrote to memory of 5048	3604	msedge.exe	86
PID 1080 wrote to memory of 4820	1080	8b3153e6a804e97a1595d12aeecda381fec1b3246339f15b04e4c060be0f29a2.exe	87
PID 1080 wrote to memory of 4820	1080	8b3153e6a804e97a1595d12aeecda381fec1b3246339f15b04e4c060be0f29a2.exe	87
PID 1080 wrote to memory of 4128	1080	8b3153e6a804e97a1595d12aeecda381fec1b3246339f15b04e4c060be0f29a2.exe	88
PID 1080 wrote to memory of 4128	1080	8b3153e6a804e97a1595d12aeecda381fec1b3246339f15b04e4c060be0f29a2.exe	88
PID 1080 wrote to memory of 4180	1080	8b3153e6a804e97a1595d12aeecda381fec1b3246339f15b04e4c060be0f29a2.exe	89
PID 1080 wrote to memory of 4180	1080	8b3153e6a804e97a1595d12aeecda381fec1b3246339f15b04e4c060be0f29a2.exe	89
PID 4820 wrote to memory of 380	4820	iexplore.exe	90
PID 4820 wrote to memory of 380	4820	iexplore.exe	90
PID 4180 wrote to memory of 2112	4180	iexplore.exe	91
PID 4820 wrote to memory of 380	4820	iexplore.exe	90
PID 4180 wrote to memory of 2112	4180	iexplore.exe	91
PID 4180 wrote to memory of 2112	4180	iexplore.exe	91
PID 3604 wrote to memory of 1072	3604	msedge.exe	96
PID 3604 wrote to memory of 1072	3604	msedge.exe	96
PID 3604 wrote to memory of 1072	3604	msedge.exe	96
PID 3604 wrote to memory of 1072	3604	msedge.exe	96
PID 3604 wrote to memory of 1072	3604	msedge.exe	96
PID 3604 wrote to memory of 1072	3604	msedge.exe	96
PID 3604 wrote to memory of 1072	3604	msedge.exe	96
PID 3604 wrote to memory of 1072	3604	msedge.exe	96
PID 3604 wrote to memory of 1072	3604	msedge.exe	96
PID 3604 wrote to memory of 1072	3604	msedge.exe	96
PID 3604 wrote to memory of 1072	3604	msedge.exe	96
PID 3604 wrote to memory of 1072	3604	msedge.exe	96
PID 3604 wrote to memory of 1072	3604	msedge.exe	96
PID 3604 wrote to memory of 1072	3604	msedge.exe	96
PID 3604 wrote to memory of 1072	3604	msedge.exe	96
PID 3604 wrote to memory of 1072	3604	msedge.exe	96
PID 3604 wrote to memory of 1072	3604	msedge.exe	96
PID 3604 wrote to memory of 1072	3604	msedge.exe	96
PID 3604 wrote to memory of 1072	3604	msedge.exe	96
PID 3604 wrote to memory of 1072	3604	msedge.exe	96
PID 3604 wrote to memory of 1072	3604	msedge.exe	96
PID 3604 wrote to memory of 1072	3604	msedge.exe	96
PID 3604 wrote to memory of 1072	3604	msedge.exe	96
PID 3604 wrote to memory of 1072	3604	msedge.exe	96
PID 3604 wrote to memory of 1072	3604	msedge.exe	96
PID 3604 wrote to memory of 1072	3604	msedge.exe	96
PID 3604 wrote to memory of 1072	3604	msedge.exe	96
PID 3604 wrote to memory of 1072	3604	msedge.exe	96
PID 3604 wrote to memory of 1072	3604	msedge.exe	96
PID 3604 wrote to memory of 1072	3604	msedge.exe	96
PID 3604 wrote to memory of 1072	3604	msedge.exe	96
PID 3604 wrote to memory of 1072	3604	msedge.exe	96
PID 3604 wrote to memory of 1072	3604	msedge.exe	96
PID 3604 wrote to memory of 1072	3604	msedge.exe	96
PID 3604 wrote to memory of 1072	3604	msedge.exe	96
PID 3604 wrote to memory of 1072	3604	msedge.exe	96
PID 3604 wrote to memory of 1072	3604	msedge.exe	96
PID 3604 wrote to memory of 1072	3604	msedge.exe	96
PID 3604 wrote to memory of 1072	3604	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\8b3153e6a804e97a1595d12aeecda381fec1b3246339f15b04e4c060be0f29a2.exe
"C:\Users\Admin\AppData\Local\Temp\8b3153e6a804e97a1595d12aeecda381fec1b3246339f15b04e4c060be0f29a2.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\fyiBA.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3428
- - C:\Windows\SysWOW64\expand.exe
    expand.exe "C:\Users\Admin\AppData\Local\Temp\ico.cab" -F:*.* "C:\progra~1\ico"
    3⤵
    - Drops file in Program Files directory
    - Drops file in Windows directory
    PID:3204
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe http://www.v258.net/list/list16.html?mmm
  2⤵
  PID:5092
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.q22.cc/?ukt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4820
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4820 CREDAT:17410 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:380
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.v921.com/?uk
  2⤵
  - Modifies Internet Explorer settings
  PID:4128
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.779dh.com/?kj
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4180
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4180 CREDAT:17410 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2112

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.v258.net/list/list16.html?mmm
  2⤵
  - Adds Run key to start application
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffab8b146f8,0x7ffab8b14708,0x7ffab8b14718
    3⤵
    PID:5048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,15126612338221797036,9731174762705956016,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
    3⤵
    PID:1072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,15126612338221797036,9731174762705956016,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,15126612338221797036,9731174762705956016,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2500 /prefetch:8
    3⤵
    PID:4420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15126612338221797036,9731174762705956016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3740 /prefetch:1
    3⤵
    PID:5008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15126612338221797036,9731174762705956016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3808 /prefetch:1
    3⤵
    PID:2364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2104,15126612338221797036,9731174762705956016,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5168 /prefetch:8
    3⤵
    PID:1868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15126612338221797036,9731174762705956016,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
    3⤵
    PID:4548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15126612338221797036,9731174762705956016,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
    3⤵
    PID:2620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2104,15126612338221797036,9731174762705956016,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5992 /prefetch:8
    3⤵
    PID:3804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15126612338221797036,9731174762705956016,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
    3⤵
    PID:3796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15126612338221797036,9731174762705956016,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
    3⤵
    PID:2572
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:5308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x118,0xec,0x11c,0x7ff6e3355460,0x7ff6e3355470,0x7ff6e3355480
      4⤵
      PID:5500
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,15126612338221797036,9731174762705956016,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3808 /prefetch:8
    3⤵
    PID:5328
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,15126612338221797036,9731174762705956016,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3808 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15126612338221797036,9731174762705956016,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
    3⤵
    PID:5892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15126612338221797036,9731174762705956016,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3852 /prefetch:1
    3⤵
    PID:6112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2104,15126612338221797036,9731174762705956016,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2632 /prefetch:8
    3⤵
    PID:4804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2104,15126612338221797036,9731174762705956016,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6392 /prefetch:8
    3⤵
    PID:4952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2104,15126612338221797036,9731174762705956016,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
    3⤵
    PID:5152

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1244

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
2KB

MD5
1a295f69dfd5c6f54042f8bc5b31a6af

SHA1
d2b64e2902114ce584f382cbd78b06354b6b14f7

SHA256
b14043ac188588e6e6282e515cc581ca0aaae5fbf84a0cf087204bae7fcdad55

SHA512
3ed6b02a4b6f723f5ca54e78e2c787e5670cc7bec3e3517e06fdc57afe966fbb62b3702bf6cc6a903fd8ef83ea6f79949018e35b7ca4d93cd3f8e865bc2e724f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Filesize
1KB

MD5
2339c16e5ec6c4c21fc43ebc11062580

SHA1
9673f8917543d105e1429c3edd6d73596f9b2066

SHA256
6137ddde8481c41e7323fa8c9775cba9ea4dd7ea3a6e91d22a3229e579392b9c

SHA512
1d85f53286f6f24e113b1a5ee9adeaad4a614f061bc0b41d8855630136e8a6dbf3992dee000486da1997f5ef9ba0f9a874df67b1ca09483155d886f5e8c11b08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\349D186F1CB5682FA0194D4F3754EF36_97A2CB43E01F27293633B7B57353C80B

Filesize
1KB

MD5
c819791ded12d8d4bdae75898e5a734c

SHA1
53712eaf4a55125cb24bb3b088ff2b133e761315

SHA256
78f23fb18ab91105a14127055692b402570d7ef1c9909a4d28c81a777c377ec2

SHA512
dba0d2e52d8f729215ee723dc8c1b48419be8eeda0bca47d60e007d9bfa81678117dfea425dcaf618cef710d62e918e390c34ce7bd77620e20b674b7895f8505

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A269719AA1471E96C

Filesize
1KB

MD5
74706d4254f91702bbda8946378b45da

SHA1
6dc762039d12e151811be8f6627ca72653ea38da

SHA256
1a9bf74f2e739aeb8a2fb1e275cce48904a77622ef5b8ccca94a098db7941094

SHA512
951afc149ed039e36266e567bf6c6989606a5f58daed6c24072cd377045efd09759bf91df8f6119c6f6cb8cf475044725522c257d3565f506d1ab3c23742b295

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3

Filesize
1KB

MD5
2a875279504b4b2a408dd70ca1c693c4

SHA1
f44cfc402438b23717db4f4c2759aa51c103b29c

SHA256
7c8e13e6de613b3ae2498edeef09516b6915af324edf13b1d21963a15c622079

SHA512
0a87f8c9826ffd696b02f11bfe07d878400d0fcca3514277bff0fc1b15c903bcf60143da9d34903149ef528cf2776ec9015ef69e52b92470c61863743de47926

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
1KB

MD5
136889ac23008bfdfefb91c9e5d8a11d

SHA1
8343b8ef34dc565eda256e042b43064cb8017131

SHA256
35188ecd41bd046f9f71e26f5404d5406be5e20bf8f2b6963adaec084783bef5

SHA512
b19722ef132c9169aa442b87f633f915934a51ea4164c674864aaffe4b01dd7ad6b7488450ca14b6d1467eb231e6941cad0aab29733ae4fa6b7df7d2a2f75bdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Filesize
471B

MD5
f60a6cdfc1e9053e531e2e43db699403

SHA1
bd11506642f3d12990da0ab6e85112e8c6353c68

SHA256
d26953e0aa2981cd7f9aa89a8513785bb9d047edc07fd7c4dfd304887fe73e45

SHA512
06a7ef2228aec3cb205b4914ac598f731e4b155cb4313406e40f5b7769bbb8231826d8d0909ec269170d8d08b0a30adbe821b2b090d5270e2d5f2f1182685e74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
488B

MD5
01baaeceefb9225007dd0f893b3d7c39

SHA1
38695805ead297f2f40988f7ca9f7b0b3906aee3

SHA256
aa21af433ba9c8f914b25a372336a8beaf5acf91e91c01c0b3658757d7769357

SHA512
9691bca84ae00a57cf00ebfd6f1fee7233d6a928a12f044e88b708ed1b70f2e38f4e48ff886cede4e20ed38b1bd23657fa06df3c96bd5d130e72ad3cd4ecec9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Filesize
508B

MD5
af14a979a20b5d786be2a481abe556a7

SHA1
e2bb96384a15b8109e8e6931633459ea6f537c29

SHA256
ea4c7548b4ae068d72e4f6f3795f2c3b17ffe268ac9c604f2de421d14216baf9

SHA512
a04b99bdf52387eb7fd79fa3d86073fdbb5afc02bde248471fe2932e4e4df55ad818f937142a66c11295250769e639ea8b83ef1b3fcbc158674f96c90b4048d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\349D186F1CB5682FA0194D4F3754EF36_97A2CB43E01F27293633B7B57353C80B

Filesize
532B

MD5
2390fd2755f87d200635377dcec58a9f

SHA1
3573caa9ccf6838a0736519f4b66b16820bb5855

SHA256
94a615da683cb0eb6dae5a167928364ee774b0b5df97ecd3dc869b5cb2ff72cf

SHA512
bf85b34f8c4347ff29d5bfb6814bb8f712d39578ec67d0cfb11b6828916667471c64cdb928af0f29acacc2c04170eb486cbe098e110d2c55214369bf23c50c3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A269719AA1471E96C

Filesize
492B

MD5
affc6dcf423f09ebb09eb64b9afb0753

SHA1
d247cf037a06f834f387f0a27e123ab98c40b0b3

SHA256
189cdb600a2905fc3c03e648f8db067264d4db2a30eba532d1e09297f12ac54f

SHA512
d5c364d9480d159308c2fb9ac9d9f30a0e28cbe628d0e6052df003acbcffffb0c1c268abd0922abb7ae5fd87facdd0ba5ee21af78c279d341e3a90bcc71ea621

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3

Filesize
506B

MD5
73c69c8dfff4010699fea0d7f5aed6e7

SHA1
1c87ab2cfdeceef717ef111aaeb90945bea9bca0

SHA256
fbd25431dbe4d5532cc9be08434f4ab203f0ba41608852d0c8951c21ef4f78ab

SHA512
bb106fbaa1846fbc2bbd1338bed88dc0efab5489862d67b9856adbbc26e5e10c187cf55d49f9910dad782333209d0e50e3fd4dc273f2ec4f8e77d97d93d90776

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
482B

MD5
50c0d83cf807e12e5e5d977c188bad89

SHA1
2f0f90ea34ff1665cecd88e2971d103bb8b1aea2

SHA256
bcedc7089121310052492f95c8608cfdf3d73c460026e1387ad2211bbd38c5df

SHA512
45b5d5f31c0a15db049e617badef361d2d2cda9df6ebee8d7597a2312f9956327e97a9476eb56f534d115a1a893f268c655de2190586a93888f40c3e3ee25753

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Filesize
430B

MD5
77d71d081fedc21a2f51040e2336aef5

SHA1
fbc510ed0061fab07c1ffd43d213893150cefad3

SHA256
d16ee7e7a71122706c51ca44719e994df92166b8112b9ebca3f701f2dada0212

SHA512
4318a4abbd80ca66644a7162a1f079446d22ee2dd6a0a6394c1a217503bca8f8facfce7eea03da494ee2e3e17dc984526add312957680d63a240b5c1bb62b015

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{68941BCB-5908-11ED-AECB-C2DBB15B3A76}.dat

Filesize
3KB

MD5
1040acd6f07efd4703db0babcd8bfadd

SHA1
4562e3ba06a199ed92f828452233f53b4cd895ac

SHA256
263a933f71674d00ee935672a15dbb5f8ea8a970d878724dec56556e46707f9f

SHA512
a74208c2f9bf9c6513c14d29bcc70f48d1dbf4f77206b2bf68751f14b595abfd5ab95ffbf9e65407fcaba21efde69cf33b26a0888db7fdf78c26116bb9edd8ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{689442DB-5908-11ED-AECB-C2DBB15B3A76}.dat

Filesize
3KB

MD5
953ba53cb1256c44d2b895a0f41b51c3

SHA1
9b6c09d7fcc88f5db37eac82c8f1fb8ffe6066cf

SHA256
bf629acbe3e01bcbaefec6c5c6581f1f4ccaa3dac2d2799a1f45f95fba96380c

SHA512
e86d56b7d51ed15a2331ef9f8735b7d8e7c726d2cc6678134abc055a0552680f516e3aaa81ae911caed4e80eb7dbfc7c6be57bc3d24940bb594061364572abd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\fyiBA.bat

Filesize
98B

MD5
ada787702460241a372c495dc53dbdcf

SHA1
da7d65ec9541fe9ed13b3531f38202f83b0ac96d

SHA256
0d0f600f95192d2d602dbda346c4e08745295f331f5a0349deae21705367b850

SHA512
c86091735b855691c89c7946145591dec6a6a6a36a2438d392587a9cc1f2d85c1ebe44fcff1cc9d94271a24ebbc2ca38639577a6f5c592e9e10517da26572708

Download Submit
\??\c:\users\admin\appdata\local\temp\ico.cab

Filesize
18KB

MD5
f462d70986dc71a5ff375a82bd9e3677

SHA1
f3d9c09a0ff51d81377e15ae4e0e2fceaede142b

SHA256
69528b0fb4e1bc3fb8d92839d98e0717b3f680d98fdfcb9809a2f557aacab295

SHA512
5bd2d67bb78dc8c4275390667c135ed10c4733e46ce58ef524ea79869f740db00d2f4a37b949896edcbf1ebbfa1ab4dd16afab4418ff637322883435bb7543ec

Download Submit
memory/1080-132-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/1080-140-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download