joker | 0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37

Analysis

max time kernel
172s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2022 19:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37.exe
Size

1.2MB
MD5

0e37dbc17b52f40bec09f8e984b766f2
SHA1

72ff7380dc31ec0dbbe3a08c32ae5e2268d98398
SHA256

0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37
SHA512

15948ead22d8bfd14712fb86a2ab6b55f766e50be5eac750c05c62c452d1efc23eeedfadebef0d4898ceadd69be3fd837450f64ade25e89e4c56f6c3b02b7869
SSDEEP

12288:EaJmCEtQUKKGpOdn6HZqpR+oklRnAnvcvcx8nFGS13z81uoQb3WDb:E6mCEaiGcd6HApR92RnAsFGS13zrGDb

Score

10^/10

joker infostealer persistence trojan

Malware Config

Signatures

joker
Joker is an Android malware that targets billing and SMS fraud.
infostealer trojan joker

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\safe.ico	0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37.exe

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File opened for modification	C:\progra~1\ico\4629f350b0ee40bcb2c01dc0996c6be2$dpx$.tmp\job.xml	expand.exe
File created	C:\progra~1\ico\4629f350b0ee40bcb2c01dc0996c6be2$dpx$.tmp\47a28265091c6847aef1594aab530dfe.tmp	expand.exe
File created	C:\progra~1\ico\4629f350b0ee40bcb2c01dc0996c6be2$dpx$.tmp\6ab9f0e7b8a44543b49aab464bacdfce.tmp	expand.exe
File opened for modification	C:\progra~1\ico\Video.ico	expand.exe
File opened for modification	C:\progra~1\ico\4629f350b0ee40bcb2c01dc0996c6be2$dpx$.tmp	expand.exe
File created	C:\progra~1\ico\4629f350b0ee40bcb2c01dc0996c6be2$dpx$.tmp\bdc3be72bfac964989eed7ac8dcfda2e.tmp	expand.exe
File opened for modification	C:\progra~1\ico\meiv.ico	expand.exe
File opened for modification	C:\progra~1\ico\Taobao.ico	expand.exe
File opened for modification	C:\progra~1\ico\{4BA7E635-1291-4D14-BC2B-9C8FACD15C85}	expand.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\fe2e4a61-e808-428c-b182-f11d2e07ec3b.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221108145208.pma	setup.exe
File opened for modification	C:\progra~1\ico\Beauty.ico	expand.exe
File opened for modification	C:\progra~1\ico\Chat.ico	expand.exe
File created	C:\progra~1\ico\4629f350b0ee40bcb2c01dc0996c6be2$dpx$.tmp\b65f1c2ad391f14a89706da55b5365dd.tmp	expand.exe
File opened for modification	C:\progra~1\ico\Film.ico	expand.exe
File created	C:\progra~1\ico\4629f350b0ee40bcb2c01dc0996c6be2$dpx$.tmp\3b1b38879feea84b98ccffcc63e1aa1e.tmp	expand.exe
File created	C:\progra~1\ico\4629f350b0ee40bcb2c01dc0996c6be2$dpx$.tmp\2fb8d88a38f96144a7036f21eea493b6.tmp	expand.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	expand.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	expand.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\779dh.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "189"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2611397075"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "374684038"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\mitao5.tv\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2617892907"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2617892907"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{BA167FA1-5F74-11ED-89AC-4AA92575F981} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.779dh.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "126"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DOMStorage\618889.shop.ename.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2619153732"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "63"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\779dh.com\Total = "126"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30995329"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2617110187"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DOMStorage\ename.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{BA18E210-5F74-11ED-89AC-4AA92575F981} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30995329"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\mitao5.tv\Total = "63"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30995329"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30995329"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30995329"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "252"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2619153732"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30995329"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30995329"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30995329"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2620234961"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	IEXPLORE.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
396	0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37.exe
396	0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37.exe
396	0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37.exe
396	0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37.exe
1516	msedge.exe
1516	msedge.exe
4896	msedge.exe
4896	msedge.exe
3408	identity_helper.exe
3408	identity_helper.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	396	0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3916	iexplore.exe
3404	iexplore.exe
1368	iexplore.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
396	0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37.exe
396	0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37.exe
1368	iexplore.exe
1368	iexplore.exe
3404	iexplore.exe
3404	iexplore.exe
3916	iexplore.exe
3916	iexplore.exe
4900	IEXPLORE.EXE
4900	IEXPLORE.EXE
2088	IEXPLORE.EXE
2088	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 396 wrote to memory of 4708	396	0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37.exe	79
PID 396 wrote to memory of 4708	396	0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37.exe	79
PID 396 wrote to memory of 4708	396	0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37.exe	79
PID 396 wrote to memory of 2220	396	0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37.exe	80
PID 396 wrote to memory of 2220	396	0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37.exe	80
PID 396 wrote to memory of 2220	396	0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37.exe	80
PID 2220 wrote to memory of 736	2220	cmd.exe	82
PID 2220 wrote to memory of 736	2220	cmd.exe	82
PID 2220 wrote to memory of 736	2220	cmd.exe	82
PID 1452 wrote to memory of 4896	1452	explorer.exe	85
PID 1452 wrote to memory of 4896	1452	explorer.exe	85
PID 4896 wrote to memory of 2104	4896	msedge.exe	87
PID 4896 wrote to memory of 2104	4896	msedge.exe	87
PID 396 wrote to memory of 3404	396	0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37.exe	88
PID 396 wrote to memory of 3404	396	0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37.exe	88
PID 396 wrote to memory of 3916	396	0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37.exe	89
PID 396 wrote to memory of 3916	396	0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37.exe	89
PID 396 wrote to memory of 1368	396	0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37.exe	90
PID 396 wrote to memory of 1368	396	0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37.exe	90
PID 1368 wrote to memory of 4900	1368	iexplore.exe	92
PID 1368 wrote to memory of 4900	1368	iexplore.exe	92
PID 1368 wrote to memory of 4900	1368	iexplore.exe	92
PID 3404 wrote to memory of 3016	3404	iexplore.exe	91
PID 3404 wrote to memory of 3016	3404	iexplore.exe	91
PID 3404 wrote to memory of 3016	3404	iexplore.exe	91
PID 3916 wrote to memory of 2088	3916	iexplore.exe	93
PID 3916 wrote to memory of 2088	3916	iexplore.exe	93
PID 3916 wrote to memory of 2088	3916	iexplore.exe	93
PID 4896 wrote to memory of 1128	4896	msedge.exe	96
PID 4896 wrote to memory of 1128	4896	msedge.exe	96
PID 4896 wrote to memory of 1128	4896	msedge.exe	96
PID 4896 wrote to memory of 1128	4896	msedge.exe	96
PID 4896 wrote to memory of 1128	4896	msedge.exe	96
PID 4896 wrote to memory of 1128	4896	msedge.exe	96
PID 4896 wrote to memory of 1128	4896	msedge.exe	96
PID 4896 wrote to memory of 1128	4896	msedge.exe	96
PID 4896 wrote to memory of 1128	4896	msedge.exe	96
PID 4896 wrote to memory of 1128	4896	msedge.exe	96
PID 4896 wrote to memory of 1128	4896	msedge.exe	96
PID 4896 wrote to memory of 1128	4896	msedge.exe	96
PID 4896 wrote to memory of 1128	4896	msedge.exe	96
PID 4896 wrote to memory of 1128	4896	msedge.exe	96
PID 4896 wrote to memory of 1128	4896	msedge.exe	96
PID 4896 wrote to memory of 1128	4896	msedge.exe	96
PID 4896 wrote to memory of 1128	4896	msedge.exe	96
PID 4896 wrote to memory of 1128	4896	msedge.exe	96
PID 4896 wrote to memory of 1128	4896	msedge.exe	96
PID 4896 wrote to memory of 1128	4896	msedge.exe	96
PID 4896 wrote to memory of 1128	4896	msedge.exe	96
PID 4896 wrote to memory of 1128	4896	msedge.exe	96
PID 4896 wrote to memory of 1128	4896	msedge.exe	96
PID 4896 wrote to memory of 1128	4896	msedge.exe	96
PID 4896 wrote to memory of 1128	4896	msedge.exe	96
PID 4896 wrote to memory of 1128	4896	msedge.exe	96
PID 4896 wrote to memory of 1128	4896	msedge.exe	96
PID 4896 wrote to memory of 1128	4896	msedge.exe	96
PID 4896 wrote to memory of 1128	4896	msedge.exe	96
PID 4896 wrote to memory of 1128	4896	msedge.exe	96
PID 4896 wrote to memory of 1128	4896	msedge.exe	96
PID 4896 wrote to memory of 1128	4896	msedge.exe	96
PID 4896 wrote to memory of 1128	4896	msedge.exe	96
PID 4896 wrote to memory of 1128	4896	msedge.exe	96
PID 4896 wrote to memory of 1128	4896	msedge.exe	96
PID 4896 wrote to memory of 1128	4896	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37.exe
"C:\Users\Admin\AppData\Local\Temp\0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:396
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe http://www.v258.net/list/list16.html?mmm
  2⤵
  PID:4708
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\QYYfK.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Windows\SysWOW64\expand.exe
    expand.exe "C:\Users\Admin\AppData\Local\Temp\ico.cab" -F:*.* "C:\progra~1\ico"
    3⤵
    - Drops file in Program Files directory
    - Drops file in Windows directory
    PID:736
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.q22.cc/?ukt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3404
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3404 CREDAT:17410 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:3016
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.v921.com/?uk
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3916
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3916 CREDAT:17410 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2088
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.779dh.com/?kj
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1368
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1368 CREDAT:17410 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4900

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.v258.net/list/list16.html?mmm
  2⤵
  - Adds Run key to start application
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd8,0x104,0x7ffe81b646f8,0x7ffe81b64708,0x7ffe81b64718
    3⤵
    PID:2104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,1416558828941626470,15744333588825161334,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
    3⤵
    PID:1128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,1416558828941626470,15744333588825161334,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,1416558828941626470,15744333588825161334,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
    3⤵
    PID:60
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1416558828941626470,15744333588825161334,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
    3⤵
    PID:4520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1416558828941626470,15744333588825161334,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
    3⤵
    PID:1828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2124,1416558828941626470,15744333588825161334,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4900 /prefetch:8
    3⤵
    PID:4216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1416558828941626470,15744333588825161334,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
    3⤵
    PID:2132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1416558828941626470,15744333588825161334,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
    3⤵
    PID:5208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1416558828941626470,15744333588825161334,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
    3⤵
    PID:5240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1416558828941626470,15744333588825161334,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
    3⤵
    PID:5312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2124,1416558828941626470,15744333588825161334,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5972 /prefetch:8
    3⤵
    PID:5708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1416558828941626470,15744333588825161334,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3740 /prefetch:1
    3⤵
    PID:5768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1416558828941626470,15744333588825161334,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1716 /prefetch:1
    3⤵
    PID:6068
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,1416558828941626470,15744333588825161334,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4936 /prefetch:8
    3⤵
    PID:5512
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:5548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff77a6f5460,0x7ff77a6f5470,0x7ff77a6f5480
      4⤵
      PID:1388
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,1416558828941626470,15744333588825161334,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4936 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2124,1416558828941626470,15744333588825161334,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6408 /prefetch:8
    3⤵
    PID:4808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1416558828941626470,15744333588825161334,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
    3⤵
    PID:3192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,1416558828941626470,15744333588825161334,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1256 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2124,1416558828941626470,15744333588825161334,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2120 /prefetch:8
    3⤵
    PID:1988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4736

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
2KB

MD5
0774dce1dca53ce5c4f06846dc34a01a

SHA1
b66a92ae7ae2abc81921ed83fea0886c908b14b3

SHA256
653df1e7ee6eb78011d131d41eebad55a6b11e14073ac204587960c404d2300f

SHA512
43582562e20238142d801d97dee6efff1213d38506dc8e21001517d799e52c5157a0ce814e29045fb267200878e964f04d05bb209ac738d510b48ebd689b82e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Filesize
1KB

MD5
1c407aa228ba30e64a48a17b13fd9cc0

SHA1
93e03d40c1aff55a6f06c6f81bd4837546ec255b

SHA256
aab9977b056e58eb5cd79f249b69223c316bfcd524f7ebb688a827e2c2532e2e

SHA512
6060d51732bef02f7c0af6f3718fbb0f9e427f0c29b034f0c62be035202287994b11887d107319a35f6ce81e6dc82ed26149a41751e7e60b7c4052ff61d63c11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\349D186F1CB5682FA0194D4F3754EF36_97A2CB43E01F27293633B7B57353C80B

Filesize
1KB

MD5
ab16524d6948052d5b181ca3fa8efc07

SHA1
7593b02526dd59be632dfbbf857c3448f6f8136a

SHA256
a8857c653441987fbb2753cab827c89f5b6b5539fcf15fb75b0c166d127bd6cb

SHA512
10eafcedf5c47ae372fb61b29be1ae7713dd3a9e807808589a47af1cf8a9c6a15348e6776d969cc9deca2f081fc3224fc72ca6d24d5f2549a6b994182fe37ded

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A269719AA1471E96C

Filesize
1KB

MD5
400366edba2f9e9aeea415a1543c2caa

SHA1
5dba7776a4c2ea90d5361d0b2e4e2be319e75322

SHA256
c6f91617f5118ec1eb4630fa0f9c9e3ecf26a91476b692b85da6ab8b11bcf75f

SHA512
180cb6710d2619f237c39c3fda6c83d61991075b2a616d35c1ce3e62e6a873e2e771a041f7df573859ec10e622fb991534f521045b23fda259d38814832110a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3

Filesize
1KB

MD5
eea8f36f3227ced4b16d0d39886ffc24

SHA1
1bbd173b9378d7ef57aacb6a5a7d9b76f0326a46

SHA256
04abae5123abcb5a579b1a33cb53c4708006d5ca8e8d7726cc9b34040b400e22

SHA512
81606806cf5b2cf2d40c71178af09727d11a1efc8d42780f918b502ca8cd45d63dd27d395f2de37d39ce5d74a9c3508835a145457ea5f990973d488ca1e628d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
1KB

MD5
be2b5211e42eb9225d21358e7eb3f78f

SHA1
35b1ab3adde0a5f3cad8862897f1ea7a86946349

SHA256
3185aa19aba785efc822b72e3f2959e07343c1935f8f2b46a4438060763c9111

SHA512
9b20c8dceb160aad20de302c2589b86fae64f7842b370812fd8baba3e8154a357c0a1c282ea95fbc5406ab093593637929edaf83c42e19c7b6a011d286b06b6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Filesize
471B

MD5
bff7448bc563576ad817d85efe9e9da8

SHA1
ec7a91ad9aff6999184f03886f1983a28bd266ba

SHA256
a9af95619eb89a31478fa7a662f8326e40a40a3e0ed0943d9b289a9b662b47f1

SHA512
01a5c199e2656d581c57cba0b4a6b3c1a6b1847a34e262c4d69727db8d042f7101107978a802c563fbaa333fb84777920e8fcdad321589834c8f233102a9802f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
488B

MD5
2982507ceaa501529ddc3591aa65f267

SHA1
34985df18f9bb2a20608d09cae14a4e1615a744c

SHA256
9b30ff461187daf07f1a9d23d5b0476183d417e5819dc2e118f20a162abdf850

SHA512
9f1901b1aa5f2b1cd8a72719dbd7f5352d731b54bc6d82b58f5a2e763d2cdd79de118f6c258373da39654984c3dd65d7c15470634b4cd4eb3651c7294535f7b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Filesize
508B

MD5
19e441243cd4ea513e5519b795a7f52f

SHA1
130eb67ca9344dea1924a9ff4ae2374dfde94a09

SHA256
a0330b992135aad955448047ce3a51aeb324d0b75864e05f8dafa6941e3797d7

SHA512
7a2e329c12e564a59aa8eff14b10bdb920a24fda4b97dc962267d7bce721a1be7db406d2903bd1fa65fc916a118e1a4479968868438b60dc7d4ba8c052fe8406

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\349D186F1CB5682FA0194D4F3754EF36_97A2CB43E01F27293633B7B57353C80B

Filesize
532B

MD5
8fdb1ab475a35829de5b6766cb12bdef

SHA1
4478b882e692d5220ee960a4fee43c689a5beff5

SHA256
333cbe2ff67643632ec8529dd5cdaa04c530abff6fc678e8908101d70503a929

SHA512
c760b73d8c063f128a644856ca9791126f8c74ab3d9031bbb3f95285cdbb13ba3c69968dd14845349ab206434199ab927de217f9130af63e5df4565aa56529a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A269719AA1471E96C

Filesize
492B

MD5
d8e72f508f299978bbae16ec06d6a62f

SHA1
408475d9bcc3622ee1363233f94e53564254f1a3

SHA256
3c96bf2f10f6ca4fba257ec8bd06ece8232797ca8d41f486bde2d1e93b45aebf

SHA512
2983401d818261e7231bf688b445e3472650aeb6fc7b3276c72aeeda3b49c206ab2de4447f9b83968c754b0e650b7976e2813e81ea12ee542e6b93432d1cde84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3

Filesize
506B

MD5
3bac32097a6ce3c57675a5d691262c0c

SHA1
9099f9ceabd04c1cd626f91781c01fdd5b64b3e6

SHA256
78048c2f27c023dccfc1ef1bf02bb2b1a12a06604e69b36789749fbd925a7622

SHA512
379699dacebe68d1f91ac4f4db8f3c18a49e8281163061659a9dc9b18327089c6ad2a1f2a0b1ec4c46f856b5f59c21503bf6bc557c1f63358dbbad077a68e64a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
482B

MD5
0d4d132037e40d35e0422ecfaf47cb7e

SHA1
aedcc575e5fc20b13548641155b6a31b4097d9f2

SHA256
c5d1ee7659e46a1d2e3288714335169a15dc72439204d88aacafdc92a6e6d450

SHA512
5551eb73a91dbd7629c65fbff75aa658fa95fdcb35b65a40cced0c6eb468854a527745a96e975a1f1599f90d3c35ac31e9c1e59492bcf546a8672dcb7cb59d56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Filesize
430B

MD5
231c58cac271ce8cf3c04b65f9f37417

SHA1
4df83c07ab170df800c936f15fc6f38e85c79f22

SHA256
f2de4c1e5e1a50357043fd6929a00bbeaee98f99a280edb59873c1989755b44a

SHA512
df4033219719ff199012c77266937fb1376c67a1485d8ec330340d914b49e607d038ed9466ef2aea314f9e36a599c9365611a7e2f4d64486c27a284ce16b9022

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BA11BFE6-5F74-11ED-89AC-4AA92575F981}.dat

Filesize
3KB

MD5
bd25f2c193e3c88d6583193f8a3da3ea

SHA1
5d7414c0fbfc78f44c8411d3f472da3a12300317

SHA256
3088b72165a3977ca896c9efaba2401963dfa2fc28c3cbf33ed2568627dfb098

SHA512
6e8f774c8b597f500f78978778d28388bd55aa96842cf46d40780c699e32a63b19c1df9452ea8a4030a38ba499fc2b73cac544a1af8eb5af7c92822daf6fa6da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BA11BFE6-5F74-11ED-89AC-4AA92575F981}.dat

Filesize
5KB

MD5
8a8624bd516c9f4a6973a7c038e39569

SHA1
dd0e9810fe8c29c24ea07582e0a1b25ef071132e

SHA256
fceb6024c2c61e249159344d2fdc3e0c9c29d1727b3ba4af0043d992f2619d2e

SHA512
d40e1f4792ac3f9211a3d28b40cd4dcf32cad3208c4892e54d42b0059fae822311dd85a993eeb2735def0839db5058e9f20f7b805104c1446528196c797b0386

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BA18E210-5F74-11ED-89AC-4AA92575F981}.dat

Filesize
5KB

MD5
d0fa3186499af972b5c5f0579e4950c0

SHA1
039721f3cd0204eceff5a1025423c43b48230441

SHA256
7bac56c918166e3d44d24bd4e9d8e83cc86dd2ed11eac0fe7daadd2e2c3d1fda

SHA512
40cc0b1233e5dad6d871cae0fc21ab572216eca00a9ee037d4c4185dbc728568ee1bffbe083f145f99c93ec1b3d6f5e0c64b79bc661bea270417aab99506d54a

Download Submit
C:\Users\Admin\AppData\Local\Temp\QYYfK.bat

Filesize
98B

MD5
ada787702460241a372c495dc53dbdcf

SHA1
da7d65ec9541fe9ed13b3531f38202f83b0ac96d

SHA256
0d0f600f95192d2d602dbda346c4e08745295f331f5a0349deae21705367b850

SHA512
c86091735b855691c89c7946145591dec6a6a6a36a2438d392587a9cc1f2d85c1ebe44fcff1cc9d94271a24ebbc2ca38639577a6f5c592e9e10517da26572708

Download Submit
\??\c:\users\admin\appdata\local\temp\ico.cab

Filesize
20KB

MD5
1319e9998cedc513c68fa6d590b6ad63

SHA1
ae95b333e88a13886994f320f5dfb4856168a710

SHA256
9a5b18efe243fbe9b9b0be3674a24080e9210436986988f3f85a4007905083bb

SHA512
d4052a899c6c310296e2f5fdf6c2031c22d2644be620cb34ddcc6b59789d82a6462daaeb34466c568be48ee975c4a5ab43143eab0792312a6cd0d49f9fbd8d3f

Download Submit
memory/396-136-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/396-140-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download