ca8bf4c5bd61c78880c9d9482b44cbb8cedbe9c4eb5398c4c933315632f54a51

Analysis

max time kernel
141s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c688a4cad75cec075d0a6a748e42c4b3.exe
Size 757KB
Sample240313-wpxvsadf97
SHA256 ca8bf4c5bd61c78880c9d9482b44cbb8cedbe9c4eb5398c4c933315632f54a51
MD5 c688a4cad75cec075d0a6a748e42c4b3
SHA1 ce3677d62f1e698fb92fd6bd426ba6152de8b27c
SHA512 d87afa29f523852e19c37f5f2d1f18b69d63d99edcd2c0a3a680a9698a7e4876f9833a942f7ab0dad958c7425ecf687e426b6e2b55a84272f67c6f125054397e
SSDEEP 12288:WIPXXKeG0OvA2/Qe7Q0YtYa/BSFfUC3EQoAKw2vGmQoUZx/3G:NPhVCQn0gY6BSFzEQrKw2v4HT2
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	c688a4cad75cec075d0a6a748e42c4b3.exe

Executes dropped EXE 3 IoCs

pid	Process
1780	chaoji.exe
3312	Äæ»ðÇ¿ÖÆÊÓÆµÄ¾Âív2.0 2004°æ±¾.exe
4100	G_Server.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00090000000231f3-4.dat	upx
behavioral2/memory/1780-18-0x0000000013140000-0x000000001322E000-memory.dmp	upx
behavioral2/memory/4100-23-0x0000000013140000-0x000000001322E000-memory.dmp	upx
behavioral2/memory/1780-28-0x0000000013140000-0x000000001322E000-memory.dmp	upx
behavioral2/memory/4100-198-0x0000000013140000-0x000000001322E000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\index	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOCK	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics.pma	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG	msedge.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\09a7aa9b-f1f6-4a57-9aea-8847d6abf21d.tmp	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000001	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\BudgetDatabase\LOG	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\MANIFEST-000001	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Login Data-journal	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\2a2c5bfa-527c-47d8-ab26-01e331f78e1b.tmp	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Favicons	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\CURRENT	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\DomainSuggestions\en-US.1	IEXPLORE.EXE
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RFe574db2.TMP	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\Low	IEXPLORE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0	msedge.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\b18e822b-8ebb-4be0-a98c-897540e2c6ae.tmp	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional Data-journal	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Local State~RFe578741.TMP	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RFe577520.TMP	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\960021ed-f3ef-4486-a899-536e6bbd0c1f.tmp	msedge.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	IEXPLORE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000001.dbtmp	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_2	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\b18e822b-8ebb-4be0-a98c-897540e2c6ae.tmp	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\000001.dbtmp	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\DomainSuggestions\en-US.1	IEXPLORE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000001.dbtmp	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe578741.TMP	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\throttle_store.dat	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Last Version	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\CURRENT	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\LOCK	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT~RFe575728.TMP	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\IECompatUaCache\Low	IEXPLORE.EXE
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Local State~RFe578712.TMP	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000001.dbtmp	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk	setup.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\CURRENT	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000001.dbtmp	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1	msedge.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\24e40a80-999b-4ff4-b445-a1b2dbcc9e88.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20240313180635.pma	setup.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\G_Server.exe	chaoji.exe
File opened for modification	C:\Windows\G_Server.exe	chaoji.exe
File created	C:\Windows\G_Server.DLL	G_Server.exe
File opened for modification	C:\Windows\G_Server.DLL	G_Server.exe
File created	C:\Windows\uninstal.bat	chaoji.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\iexplore\Count = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Setup\UrlHistoryMigrationTime = 0deb0d6e8a2fda01	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeUpdate	msedge.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\edge.services.last_account_id = "7027B5CAD482DBD1A6E3F3C31BBC686F7CFEE623D6058D4734AC6AEB9C19CE3C"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Feeds\MUID	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fc261ee8570ee1479984be3fbd3fcd0900000000020000000000106600000001000020000000130930cdb260113c90021ad41e4d9607d7957334a1128b49dc1975c2d357fd49000000000e8000000002000020000000a022738257e580511ab6ef051f07ac4998eba70703650f08b8731d860992b0ad10000000f3fd4eb08f60a9bdde0971c1426219c4400000002bc4492a71f9c3db5b5dfbc75e2eca89dacb3fcc4ad2ee64edad61fce74166e59d763676e532cece40301a753e461dc21de2e5c0e00c2e75704335faedada6f5	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\MAO Settings\DiscardLoadTimes = 0deb0d6e8a2fda01	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	setup.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\UserChoice\ProgId = "MSEdgeHTM"	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories64\{00021494-0000-0000-C000-000000000046}	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935}\DeviceId = "0018800D5708B2EA"	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts\MSEdgeMHT_.mhtml = "0"	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AppDataLow	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\BLBeacon	msedge.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\metricsid = "8387a21c-d21f-46a8-ada7-362dcb7bdb55"	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts\AppXe862j7twqs4aww05211jaakwxyfjx4da_read = "0"	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\BLBeacon\version = "92.0.902.67"	msedge.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IE11SS&market={language}"	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\F12	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@%SystemRoot%\system32\shell32.dll,-50176 = "File Operation"	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	setup.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\extensions.settings\jdiccldimpdaibmpdkjnbmckianbfold = "E05C3510BF6A375CF3003539B0558945A2B04D74FFF550BCBF0AD5BE3F9CEECD"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\extensions.settings	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts\AppX7rm9drdg8sk7vqndwj3sdjw11x96jc0y_microsoft-edge = "0"	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts\AppXd4nrz8ff68srnhf9t5a8sbjyar1cr723_.pdf = "0"	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@ieframe.dll,-12512 = "Bing"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\browser.show_home_button = "100FFA551CD2F42D8567F559ECD55259BE358639730892E1C542F2EF1EE2C59B"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{00021493-0000-0000-C000-000000000046}	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-18_Classes\Local Settings	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	setup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\iexplore\Count = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	msedge.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fc261ee8570ee1479984be3fbd3fcd09000000000200000000001066000000010000200000006dcdb7f6b7bd48104fe7be3f68663e76b81744c1970ad559e2c16486cdb22165000000000e800000000200002000000043c52a23d2f5a218a7729d70ab2b1089eadae38df4d7525114f042be43d68e561000000046b004f954636f562931ccf31798799040000000a97a535bccc57cdcb8ca636e345b9cdeddc7eda2c1ca6a3afea8bfa51629c202d49d46e2a5b5d28e41debea2f84682adf944af962ea774e575a9891013a8b0c3	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	msedge.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\extensions.settings\ihmafllikibpmigkcoadcmckbfhibefp = "185259C14F7E589E580D675FBF6C55A82B05183EC2436EC291176B1E159212E1"	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts\AppXq0fevzme2pys62n3e0fbqa7peapykr8v_http = "0"	setup.exe
Key created	\REGISTRY\USER\.DEFAULT	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories64\{00021494-0000-0000-C000-000000000046}\Enum	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories64\{00021493-0000-0000-C000-000000000046}	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\extensions.settings\dgiklkfkllikcanfonkcabmbdfmgleag = "2E332D0F55CDD799AD02ACCDF800A8D0AF2E5A3FC9D8DEB9AAC83B7ECF5A9DDF"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\iexplore	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
116	msedge.exe
116	msedge.exe
1420	msedge.exe
1420	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
1112	IEXPLORE.EXE
1112	IEXPLORE.EXE
1112	IEXPLORE.EXE
1112	IEXPLORE.EXE
1112	IEXPLORE.EXE
1112	IEXPLORE.EXE
1112	IEXPLORE.EXE
1112	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1112	IEXPLORE.EXE
1112	IEXPLORE.EXE
4196	IEXPLORE.EXE
4196	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 1780	5044	c688a4cad75cec075d0a6a748e42c4b3.exe	85
PID 5044 wrote to memory of 1780	5044	c688a4cad75cec075d0a6a748e42c4b3.exe	85
PID 5044 wrote to memory of 1780	5044	c688a4cad75cec075d0a6a748e42c4b3.exe	85
PID 5044 wrote to memory of 3312	5044	c688a4cad75cec075d0a6a748e42c4b3.exe	86
PID 5044 wrote to memory of 3312	5044	c688a4cad75cec075d0a6a748e42c4b3.exe	86
PID 5044 wrote to memory of 3312	5044	c688a4cad75cec075d0a6a748e42c4b3.exe	86
PID 1780 wrote to memory of 952	1780	chaoji.exe	89
PID 1780 wrote to memory of 952	1780	chaoji.exe	89
PID 1780 wrote to memory of 952	1780	chaoji.exe	89
PID 4100 wrote to memory of 1112	4100	G_Server.exe	88
PID 4100 wrote to memory of 1112	4100	G_Server.exe	88
PID 1112 wrote to memory of 4196	1112	IEXPLORE.EXE	91
PID 1112 wrote to memory of 4196	1112	IEXPLORE.EXE	91
PID 1112 wrote to memory of 4196	1112	IEXPLORE.EXE	91
PID 4196 wrote to memory of 932	4196	IEXPLORE.EXE	92
PID 4196 wrote to memory of 932	4196	IEXPLORE.EXE	92
PID 932 wrote to memory of 1420	932	ie_to_edge_stub.exe	93
PID 932 wrote to memory of 1420	932	ie_to_edge_stub.exe	93
PID 1420 wrote to memory of 1084	1420	msedge.exe	94
PID 1420 wrote to memory of 1084	1420	msedge.exe	94
PID 1420 wrote to memory of 4016	1420	msedge.exe	95
PID 1420 wrote to memory of 4016	1420	msedge.exe	95
PID 1420 wrote to memory of 4016	1420	msedge.exe	95
PID 1420 wrote to memory of 4016	1420	msedge.exe	95
PID 1420 wrote to memory of 4016	1420	msedge.exe	95
PID 1420 wrote to memory of 4016	1420	msedge.exe	95
PID 1420 wrote to memory of 4016	1420	msedge.exe	95
PID 1420 wrote to memory of 4016	1420	msedge.exe	95
PID 1420 wrote to memory of 4016	1420	msedge.exe	95
PID 1420 wrote to memory of 4016	1420	msedge.exe	95
PID 1420 wrote to memory of 4016	1420	msedge.exe	95
PID 1420 wrote to memory of 4016	1420	msedge.exe	95
PID 1420 wrote to memory of 4016	1420	msedge.exe	95
PID 1420 wrote to memory of 4016	1420	msedge.exe	95
PID 1420 wrote to memory of 4016	1420	msedge.exe	95
PID 1420 wrote to memory of 4016	1420	msedge.exe	95
PID 1420 wrote to memory of 4016	1420	msedge.exe	95
PID 1420 wrote to memory of 4016	1420	msedge.exe	95
PID 1420 wrote to memory of 4016	1420	msedge.exe	95
PID 1420 wrote to memory of 4016	1420	msedge.exe	95
PID 1420 wrote to memory of 4016	1420	msedge.exe	95
PID 1420 wrote to memory of 4016	1420	msedge.exe	95
PID 1420 wrote to memory of 4016	1420	msedge.exe	95
PID 1420 wrote to memory of 4016	1420	msedge.exe	95
PID 1420 wrote to memory of 4016	1420	msedge.exe	95
PID 1420 wrote to memory of 4016	1420	msedge.exe	95
PID 1420 wrote to memory of 4016	1420	msedge.exe	95
PID 1420 wrote to memory of 4016	1420	msedge.exe	95
PID 1420 wrote to memory of 4016	1420	msedge.exe	95
PID 1420 wrote to memory of 4016	1420	msedge.exe	95
PID 1420 wrote to memory of 4016	1420	msedge.exe	95
PID 1420 wrote to memory of 4016	1420	msedge.exe	95
PID 1420 wrote to memory of 4016	1420	msedge.exe	95
PID 1420 wrote to memory of 4016	1420	msedge.exe	95
PID 1420 wrote to memory of 4016	1420	msedge.exe	95
PID 1420 wrote to memory of 4016	1420	msedge.exe	95
PID 1420 wrote to memory of 4016	1420	msedge.exe	95
PID 1420 wrote to memory of 4016	1420	msedge.exe	95
PID 1420 wrote to memory of 4016	1420	msedge.exe	95
PID 1420 wrote to memory of 4016	1420	msedge.exe	95
PID 1420 wrote to memory of 116	1420	msedge.exe	96
PID 1420 wrote to memory of 116	1420	msedge.exe	96
PID 1420 wrote to memory of 2432	1420	msedge.exe	97
PID 1420 wrote to memory of 2432	1420	msedge.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\c688a4cad75cec075d0a6a748e42c4b3.exe
"C:\Users\Admin\AppData\Local\Temp\c688a4cad75cec075d0a6a748e42c4b3.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Users\Admin\AppData\Local\Temp\chaoji.exe
  "C:\Users\Admin\AppData\Local\Temp\chaoji.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1780
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\uninstal.bat
    3⤵
    PID:952
- C:\Users\Admin\AppData\Local\Temp\Äæ»ðÇ¿ÖÆÊÓÆµÄ¾Âív2.0 2004°æ±¾.exe
  "C:\Users\Admin\AppData\Local\Temp\Äæ»ðÇ¿ÖÆÊÓÆµÄ¾Âív2.0 2004°æ±¾.exe"
  2⤵
  - Executes dropped EXE
  PID:3312

C:\Windows\G_Server.exe
C:\Windows\G_Server.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE" about:blank
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1112
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1112 CREDAT:17410 /prefetch:2
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10052
      4⤵
      Suspicious use of WriteProcessMemory
      PID:932
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10052
        5⤵
        Drops file in System32 directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of WriteProcessMemory
        
        PID:1420
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe123f46f8,0x7ffe123f4708,0x7ffe123f4718
        6⤵
        Drops file in System32 directory
        
        PID:1084
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,8553438443487243988,519651548765023698,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
        6⤵
        
        PID:4016
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,8553438443487243988,519651548765023698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
        6⤵
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:116
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,8553438443487243988,519651548765023698,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2372 /prefetch:8
        6⤵
        
        PID:2432
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8553438443487243988,519651548765023698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3100 /prefetch:1
        6⤵
        
        PID:4524
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8553438443487243988,519651548765023698,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
        6⤵
        
        PID:2804
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8553438443487243988,519651548765023698,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:1
        6⤵
        
        PID:1496
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8553438443487243988,519651548765023698,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3796 /prefetch:1
        6⤵
        
        PID:4880
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8553438443487243988,519651548765023698,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1
        6⤵
        
        PID:4744
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8553438443487243988,519651548765023698,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
        6⤵
        Modifies data under HKEY_USERS
        
        PID:1800
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8553438443487243988,519651548765023698,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4240 /prefetch:1
        6⤵
        
        PID:4424
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,8553438443487243988,519651548765023698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
        6⤵
        
        PID:4204
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
        6⤵
        Drops file in System32 directory
        Drops file in Program Files directory
        Modifies data under HKEY_USERS
        
        PID:380
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x228,0x22c,0x230,0x204,0x234,0x7ff6fa575460,0x7ff6fa575470,0x7ff6fa575480
        7⤵
        
        PID:4976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

chaoji.exe

Path C:\Users\Admin\AppData\Local\Temp\chaoji.exe
Size 385KB
SHA256 e82da13475e37f29e19191cde499125c06eefefa33491d06d124a401e25ea1e6
MD5 d5938ad2aae6ce92d1a07cefce3dfbbf
SHA1 b4994dc4b47d5a4ec237160a71253f5085f62497
SHA512 a2a5eefa75ba7b23738e69294cbbf34302fd4c1c3b574c531b5ac4de0d4ee5aa12415b2bf8dfaa134ca8fef2d9b52a146afa9d296c719530c8fbe6ed15026d79
SSDEEP 6144:KWiuMO3bL+7ZMmJFhiGOdcl+hYgOgX90e8cVablOzBCfyZouQV:DixOrCHJFhiGQ9GM90eJabMCqZoD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Äæ»ðÇ¿ÖÆÊÓÆµÄ¾Âív2.0 2004°æ±¾.exe

Path C:\Users\Admin\AppData\Local\Temp\Äæ»ðÇ¿ÖÆÊÓÆµÄ¾Âív2.0 2004°æ±¾.exe
Size 338KB
SHA256 e1c909d46fc3501b887f71cb37a69c9e000d2ae1108f7c4f021ee1c29fc04a97
MD5 7f52fc970dbe18c845cad015b14b979f
SHA1 d098d7a22e3c5e7b512fccd63108d3779f634a39
SHA512 21b34224fc133a3dae146cb83e8efeee842e39ea8d7e041a57900dd76726ff8d5c8d37e77cee6f95f905a4e93232f33f1c1d1bfed9680018f8f40d78cf9dd5b2
SSDEEP 6144:av0j3J5Z7Oy3bKLPE+EqgcXlyw4CzIF6vo7vQrIxptUb/Z7DzMaj6luB:dvZ7kPCcXlM7MAT/UZdB
MD5 SHA1 SHA512 SSDEEP

Submit Download

search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Path C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Size 4KB
SHA256 5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
MD5 da597791be3b6e732f0bc8b20e38ee62
SHA1 1125c45d285c360542027d7554a5c442288974de
SHA512 d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
SSDEEP 24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
MD5 SHA1 SHA512 SSDEEP

Submit Download

8110a73a-3ee0-4882-986f-95927348c6f3.tmp

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\8110a73a-3ee0-4882-986f-95927348c6f3.tmp
Size 10KB
SHA256 e3931992beec6491fe03ef9ce54c85c3d2e6e6dacf7aa0eb750877e637b18bf3
MD5 01452a41b53a5f03344d52da80c7bd25
SHA1 f32aee5e9ec3f4ed1c329c81e996c6869fe30deb
SHA512 735b621755b4f4783042660cbe88ea71fe67a9ec0c518a4cdc3da79f6d62989f2d34a2f0d7e97b63a3682ddd9930bc6f34821eafbb7099947a1968338cf0ef0f
SSDEEP 192:RoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupop58PiYeMRU2PCMb5a9xUn:N9iIxuERzA83h09RZxYlasda9E1MeuBs
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 38472f6dd2c50b6e6fd71cc81bc726e2e5fbd1a14f187240d4cdca773da61d08
MD5 25e91f8ed0c43c7c70ee148e9d093d11
SHA1 37d088ce0021bd193777d6e581028d735ced2932
SHA512 09cc1b763464687e65bfceb3f728d3ce5ec7d6dcd10cf117b441c63bb064d1eb98e87fcec58cdc3cb228f9422799e4f1969c2a563d266d8a7fcf291bf9d20c0c
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 4KB
SHA256 522ac576585a69cc9f7b716f09ee083059de81fbcce8366fca73db569eecd003
MD5 a11f3feda88b7603ebbb11ea622d19f8
SHA1 e6e86fc44cbec069cb9d0df5e5f121e125389a0d
SHA512 63c3a034f5fe30f410fb6ae794f7fbda5bfd42baa8b829446ae5e013928139e46ea7cc7bff718ecd7293314acead9cb0dbd64c10bcd4f1d069b4301e76e4ccbd
SSDEEP 96:nFoN1ktYwpvWMoiVmdeHi5IhU7PVDCzia:nFI2dWMXnyM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 4KB
SHA256 5a56cc84a3e17080311410e80bdfad3cbf823509d1bc27055433f2bdb8f28bd9
MD5 e6fab5863af5d97af3c0cf20da7df0ac
SHA1 f8f587d7b50f23ca8b37d8b9f246deea76022be3
SHA512 95ad00d71ea8eac9df2fc736e857640aad39a8e67926b047e014341c8b53c3e0d89c3bb1ec4a7c1761de2ada452542037ef970682d3e0ba86b11f01c83d964bc
SSDEEP 96:nF1je1ktYwpvWMoiVmdeHi5IhU7PVD7AiEwb:nF82dWMXnyH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 975b71b428410947946cf9ddece35ef479994108a6fd3e4e304250e418c72c59
MD5 0cd0109d60c311dfe78d6c1c3bb5b6fe
SHA1 6cd49ca03451a818260e07cd2d1bfce3e4b53f60
SHA512 2d87f6543d4ff1276a555c84a600ce1f6b935f11b89b4ccc9d937bf240223fa19ae620d09b84f52041e26ca359985ce147ffaf07863c6078bb93e0e7ae6a571b
SSDEEP 96:nFwje1kCwpvWMoiVmdeHi5bJw7PVD7AiEwb:nF/2JWMXouH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences~RFe574db2.TMP

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RFe574db2.TMP
Size 4KB
SHA256 8ffef965e1a76b194729b5b63e406703224c241443e01f04431d224dba72c265
MD5 0a7914652b7190772bc5b7557f44be1d
SHA1 4ff31a9dbdace23719a5bd866c728a6447f932b7
SHA512 ac214f908937f9e895b19fd06f5305eaac962e4eadaeccf436b210692bda744249537628a550838b2c05ea526ebf6d44535f416418cc46c26c820a338070c22c
SSDEEP 96:nFoN1ktYwpvWMoiVmdeHi5IhU7PVDCAia:nFI2dWMXnyx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 8e60a96996f00a9db3eacb17ed64c08f28ade53494f968870f38e85c34da1ec6
MD5 237f31ab58e8f874ee4d309beb6fe942
SHA1 1048e36fcee01d0bff2de12ada0b27c5452ec207
SHA512 91b78ef10bf8999c66fb03c1a7b907bfef1662c8e3b0ad11fd4eecbaa89b766769c5f413d69e0d7d48d6e7cce483bdfdc27e3fe0594f9303741f3d3fde7483c5
SSDEEP 768:nbAWMN8F1+UoAYDCx9Tuqh0VfUC9xbog/OVtLlHwrUa1:nbAWMNu1ja6LRa1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences~RFe577520.TMP

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RFe577520.TMP
Size 24KB
SHA256 bb4eedcdf890e05ee53a1d50e71e35020cb0b1eb681655f85381abf02dd2c4c0
MD5 924bb9d6b1570c263fab4e102057b2cb
SHA1 4e209ac6d50e3d9b6e7842d33089d7bf4ec34013
SHA512 3564fdd9a33231858259fe2aa43ca3a5d7be77d170e067784c475c9ff44de192efe933ec48e9043a978c5e26792ebd4fa74868c945c08056d4cf0aa483f5a313
SSDEEP 768:TAWXH8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhLlHYrUJ8:TAWXHu1jacLtJ8
MD5 SHA1 SHA512 SSDEEP

Submit Download

temp-index

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\temp-index
Size 48B
SHA256 a40d64d286a0dc537061eba178656c8d1596e24b55eb6b8f26087bc09b845328
MD5 f9cf7b3617f74492dc5b38c0d146cba9
SHA1 445036b963866764f549a93c7fcbacba29fc6f86
SHA512 1013c8994ddb8ef3bee44101f26a97e3e02bd52b32d425d91aa5ec9783b1e7f58f592257f86d3144958a061165c4de28536c33efc30c54bdbfea01de5142b1d1
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
MD5 SHA1 SHA512

Submit Download

c874cc5f-4331-4ce6-8a06-9cf3ccaa7afb.tmp

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\c874cc5f-4331-4ce6-8a06-9cf3ccaa7afb.tmp
Size 70KB
SHA256 e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
MD5 e5e3377341056643b0494b6842c0b544
SHA1 d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA512 83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
SSDEEP 1536:vAlMWz7vLDtDSVlXXwpFlorgLUxF+D4n6owPFCawP/:vvuWAUxFaoGw/
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

suggestions[1].en-US

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
MD5 SHA1 SHA512 SSDEEP

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\Favorites\desktop.ini
Size 402B
SHA256 a45e345556901cd98b9bf8700b2a263f1da2b2e53dbdf69b9e6cfab6e0bd3464
MD5 881dfac93652edb0a8228029ba92d0f5
SHA1 5b317253a63fecb167bf07befa05c5ed09c4ccea
SHA512 592b24deb837d6b82c692da781b8a69d9fa20bbaa3041d6c651839e72f45ac075a86cb967ea2df08fa0635ae28d6064a900f5d15180b9037bb8ba02f9e8e1810
MD5 SHA1 SHA512

Submit Download

Kno5F46.tmp

Path C:\Windows\Temp\Kno5F46.tmp
Size 88KB
SHA256 1e2e25bf730ff20c89d57aa38f7f34be7690820e8279b20127d0014dd27b743f
MD5 002d5646771d31d1e7c57990cc020150
SHA1 a28ec731f9106c252f313cca349a68ef94ee3de9
SHA512 689e90e7d83eef054a168b98ba2b8d05ab6ff8564e199d4089215ad3fe33440908e687aa9ad7d94468f9f57a4cc19842d53a9cd2f17758bdadf0503df63629c6
SSDEEP 1536:V5JGkeov2IRdGjYQ4OozRuTah6gK8wd1ObAto2cTReH5xCVYiA4Pjqcawh7O6GAn:R
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9618e0c3700054daec0ae310f7e7d9e123b2482f788563dbcef53a8334938d6c
MD5 696f2d59d216ffb5f8333531aad67cd1
SHA1 69a67ed11aa53799adfcf561a555df19f082e1e6
SHA512 512bcc5991660f073d20f02b93b2062a5dd8e6f3f004f8f909a7dfcb89060c1e51903c6af5db30001991d4c725ab12369735e73877499d4f3a062faa0dd4c5c3
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

uninstal.bat

Path C:\Windows\uninstal.bat
Size 138B
SHA256 924f29a62ccf6a673fef05f39576daaffcc2fa2b2b5707abdc891158fcdb8fda
MD5 0852b204a6c1206a27a79d93846e5ef7
SHA1 28fafbbac04061d4071b3273980e77a5ece6c8b1
SHA512 01bed2ce8eebe189d5f1b2321611f7a29e4e09b144fde245ff93e112b8ca30be605e6e39b8fd61b1e883cf65c1b3658d8431bf71d1414af95bf264070db1b553
MD5 SHA1 SHA512

Submit Download

memory/1780-18-0x0000000013140000-0x000000001322E000-memory.dmp

Download

memory/1780-28-0x0000000013140000-0x000000001322E000-memory.dmp

Download

memory/3312-20-0x0000000002130000-0x0000000002131000-memory.dmp

Download

memory/3312-230-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/4100-23-0x0000000013140000-0x000000001322E000-memory.dmp

Download

memory/4100-198-0x0000000013140000-0x000000001322E000-memory.dmp

Download

memory/5044-19-0x0000000000400000-0x0000000000421000-memory.dmp

Download