Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    491s
  • max time network
    512s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    11/01/2023, 10:52

General

  • Target

    http://youtubepi.com

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 38 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of SetWindowsHookEx 20 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://youtubepi.com
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer Phishing Filter
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1684
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1684 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1112
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1684 CREDAT:472109 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1672
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Downloads\listFormats.json
      2⤵
      • Modifies registry class
      PID:2656
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Downloads\analyze.json
      2⤵
      • Modifies registry class
      PID:2176
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\analyze.json"
        3⤵
        • Suspicious use of SetWindowsHookEx
        PID:1772
    • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\listFormats (1).json"
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:2480
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\listFormats (2).json
      2⤵
        PID:560
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2008
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6d44f50,0x7fef6d44f60,0x7fef6d44f70
        2⤵
          PID:1992
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1116 /prefetch:2
          2⤵
            PID:1500
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1332 /prefetch:8
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:568
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1820 /prefetch:8
            2⤵
              PID:776
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2028 /prefetch:1
              2⤵
                PID:1620
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2136 /prefetch:1
                2⤵
                  PID:2068
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
                  2⤵
                    PID:2224
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3268 /prefetch:2
                    2⤵
                      PID:2380
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
                      2⤵
                        PID:2424
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3432 /prefetch:8
                        2⤵
                          PID:2484
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3612 /prefetch:8
                          2⤵
                            PID:2492
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3696 /prefetch:8
                            2⤵
                              PID:2572
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3676 /prefetch:8
                              2⤵
                                PID:2580
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3668 /prefetch:8
                                2⤵
                                  PID:2588
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3644 /prefetch:1
                                  2⤵
                                    PID:2688
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2144 /prefetch:1
                                    2⤵
                                      PID:2748
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3664 /prefetch:1
                                      2⤵
                                        PID:2824
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:1
                                        2⤵
                                          PID:2832
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4328 /prefetch:8
                                          2⤵
                                            PID:2960
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4488 /prefetch:8
                                            2⤵
                                              PID:2236
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1792 /prefetch:8
                                              2⤵
                                                PID:2584
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3852 /prefetch:8
                                                2⤵
                                                  PID:2692
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4180 /prefetch:8
                                                  2⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:1100
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3868 /prefetch:8
                                                  2⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:2584
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1848 /prefetch:8
                                                  2⤵
                                                    PID:2600
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3928 /prefetch:8
                                                    2⤵
                                                      PID:1132
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3808 /prefetch:8
                                                      2⤵
                                                        PID:2132
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3796 /prefetch:8
                                                        2⤵
                                                          PID:2104
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1852 /prefetch:1
                                                          2⤵
                                                            PID:2568
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=496 /prefetch:8
                                                            2⤵
                                                              PID:2728
                                                          • C:\Windows\system32\AUDIODG.EXE
                                                            C:\Windows\system32\AUDIODG.EXE 0x53c
                                                            1⤵
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:3008

                                                          Network

                                                          MITRE ATT&CK Enterprise v6

                                                          Replay Monitor

                                                          Loading Replay Monitor...

                                                          Downloads

                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

                                                            Filesize

                                                            1KB

                                                            MD5

                                                            5809c4d315ee0762ce7085f053e0b832

                                                            SHA1

                                                            1757da4e4301fcd2ebfca648f9f6a6413e0b9479

                                                            SHA256

                                                            c9ac28c4ba394bb788f9d41a32c925d689d26552392df72e7b6628eb08bb36f7

                                                            SHA512

                                                            51f4a95e9f9af22c35dd0e9821fcda039b674cf14708114401a72f7aab0b76227e91979374191bcc3e82f493456efa0e5ecb8002982e416c3205d87d5a64df88

                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_18CF33A810D0A2D5C0C28C211FE5F3C8

                                                            Filesize

                                                            471B

                                                            MD5

                                                            9a4ba4ab27cd47ead09d38283f795198

                                                            SHA1

                                                            cf1d1e13fa427879530cb912e495012a42312b7d

                                                            SHA256

                                                            8c0178a28c92e029ad04c5dbb4b8515117303e64cb3df9f3902a10f151ee1aab

                                                            SHA512

                                                            38430f5c588ec02b07f10f8f3b10fe0e30768ced71d756bc98593021e22200a0558587b69a2f78317b4e9d4f3ed66835df03085aa66014e1672945fc8877357e

                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_A53B1AB43B3D351517A14F4A651C94F1

                                                            Filesize

                                                            471B

                                                            MD5

                                                            0a8373bb4c517a184db7e8ae6ac202d2

                                                            SHA1

                                                            ab6c13439aa7f9a46a2407444d3f80e8895b6f46

                                                            SHA256

                                                            8ffd5ad2cebcb95eb36745886fbd643ab4b4f917a7544b548786837a8cb8e6d5

                                                            SHA512

                                                            c648db61e377301075ce99cdd069a69ab2d3c0fbbb9f73309b8aea45294af8dc98287eabe7da7f264d48ccc9eea900206ae9a780abbf66a9600e17b00da9e9d8

                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_ACA51E1ABBF1573BBD9B48CF6AC4217D

                                                            Filesize

                                                            472B

                                                            MD5

                                                            b6814de21e79e28c4a59b9bef50020cb

                                                            SHA1

                                                            5d6fcbdd6b70933b9367226523ce68364a1f0f1b

                                                            SHA256

                                                            49821c9c4c570ff4e089276c96b05cef53c725e77e34f6c772d2b932e7c81c2d

                                                            SHA512

                                                            d8b4868ea6138221413e3baa4274cf5c1401d615528f68f6c08839dc42855684f43c39fe8e44721845d5c760be0d7793dbba1c76671babb029fe756e67302e45

                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

                                                            Filesize

                                                            724B

                                                            MD5

                                                            f569e1d183b84e8078dc456192127536

                                                            SHA1

                                                            30c537463eed902925300dd07a87d820a713753f

                                                            SHA256

                                                            287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413

                                                            SHA512

                                                            49553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012

                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_259154B02A93A7C95A00126214FBE388

                                                            Filesize

                                                            472B

                                                            MD5

                                                            66b50d58ebed379dc4f68b02c92f59d2

                                                            SHA1

                                                            635df6d7900149fd2ce567c9d56f14ee71bb2b41

                                                            SHA256

                                                            8092144e087cea4ee21d2a00fa5488225063f57d821ae9fdebe12c4478b08fc5

                                                            SHA512

                                                            cd8cff5e0002c1c4d5da1b4d8414c3dbdd780787daaf6cb98882e740a1004a4c0789434e02b8c601c5135d9d21ec4f0c36f3fe1b2dbf43379564cd835972c4a8

                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

                                                            Filesize

                                                            1KB

                                                            MD5

                                                            a266bb7dcc38a562631361bbf61dd11b

                                                            SHA1

                                                            3b1efd3a66ea28b16697394703a72ca340a05bd5

                                                            SHA256

                                                            df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

                                                            SHA512

                                                            0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

                                                            Filesize

                                                            410B

                                                            MD5

                                                            84fed7f0e19443bc245f820ad7477c1d

                                                            SHA1

                                                            d8c48b53874bdf5cdb0eea821c47c82f0d6dbab3

                                                            SHA256

                                                            9968863fced01c65eed9b6ebf020307e0b6d980e53551b8259c625ae8c9ec9a7

                                                            SHA512

                                                            a916440a0df98f871da5117c2b0f474bb80bff680090691cb8004b4ec49789e15bc35047549ead99424e3deb61788f21336ca0a783b30632e72629fd15452ef0

                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_18CF33A810D0A2D5C0C28C211FE5F3C8

                                                            Filesize

                                                            410B

                                                            MD5

                                                            0dbe300c87ba079362aa8ad8a936e163

                                                            SHA1

                                                            503f4a6716c57bc3369e49eebdef8edd9a77a0bd

                                                            SHA256

                                                            ee54aa2ff4e6d369436d68aed2e7b2686247a7f8bad5893d74d56a00886d1370

                                                            SHA512

                                                            a08a91d8c95a922df606e34dd11d5243c43e41e87186988234a2b386e4cd75aebf9ca688b0fcb7bd9c4094944350de13dcd0952989bffe883d04a4754d5ec12f

                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                            Filesize

                                                            340B

                                                            MD5

                                                            07978aba5693a90a4c7ce541f6fc77a9

                                                            SHA1

                                                            3b6755a8c54bbe2089ba83b440b6de1eddf4959b

                                                            SHA256

                                                            a593e50cad07a5fd371d6cec85ff9ef2c845aa0ca8b8231a76a578038ebd4820

                                                            SHA512

                                                            5bdc89307b0a52e45cd8ad57f703938519a665d9b4cd984756becfe5cf67df56bdfa1d2d9720da270190f591cd782ff281356ef9fbc4da333d47fbcbd5454955

                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_A53B1AB43B3D351517A14F4A651C94F1

                                                            Filesize

                                                            406B

                                                            MD5

                                                            9534f650f791a1634b37befb42ee9e56

                                                            SHA1

                                                            d00fb67b5f78cc44cbca9d457c879d137661c91c

                                                            SHA256

                                                            e5196c5da0022e4a1291c6268d265f746650daa2f6c4a63d924ef7808a4e2e41

                                                            SHA512

                                                            3d37b58b5f1a744a9496981a4e9eb0d89d977da2e802ee22365f092a358f511f4da0792e49a196e561db795ee0a50c54ea78453203675ab4d53e13f5b3066151

                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_ACA51E1ABBF1573BBD9B48CF6AC4217D

                                                            Filesize

                                                            402B

                                                            MD5

                                                            0dbd7fca4f025a22eb4f8e486cd16c93

                                                            SHA1

                                                            6901ef5ea16db887febe33b1e25523a832fa3f58

                                                            SHA256

                                                            58f7b9c3ee26e8a8b6f08cd9573465b6498342901fd8a2f8c77a72e32bb3ffdc

                                                            SHA512

                                                            fb67a894fdc740dd5fa48f5a72c26f82a2da5311cd7b07146869da8b76ec0a6ada99bd82e4e6c270fed5c4633297a0e5b05086d0f747d0e1440748a6a0a84d27

                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

                                                            Filesize

                                                            392B

                                                            MD5

                                                            c19f07ca9b721ec534711df74da0108a

                                                            SHA1

                                                            8b71464495304a6836687b98c1767f2ec5928c5b

                                                            SHA256

                                                            0a201bfc01264fbc14b1139d0204a9d754283df855b3764c886fae9320542306

                                                            SHA512

                                                            ad178f876c977e306e55160c4ebf34bb45f74440b28c9bd39cfd0e2c84972545a6ebe51d2a2181b32676d1fa873df2800181f65d1b8525704ae1d73520430ce2

                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_259154B02A93A7C95A00126214FBE388

                                                            Filesize

                                                            406B

                                                            MD5

                                                            84c7c5bd73a52dc3da96bec24e38c90f

                                                            SHA1

                                                            4b9da23688f5a81c418f8aecda910d6f6ff37229

                                                            SHA256

                                                            50e996bf156c9ae605988f7a7f34a4f6026314c82c27ebee0c761b216fe90094

                                                            SHA512

                                                            5d03b1d1f3383574188b36f4fa06fcbf2c5035bcbcac10ee8b074075270dbee1761040487de63a842f4b3294eec4ded9ac3c9dbed79c822512a1b6a050dbed37

                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

                                                            Filesize

                                                            242B

                                                            MD5

                                                            90fc673dd970b813db701fb35f02c345

                                                            SHA1

                                                            fbbae8e7d4cdab53e4da38f61645f8d609d94223

                                                            SHA256

                                                            8cbc86a07b9c3116905478ec75b86a2c4367cf4769d664d194607618ee330c43

                                                            SHA512

                                                            dbce6d369fe01cda6cf8d84ef7c427077950d3bfb9f6f0390e92da523284acac0481346d6dd5e951bc9e2fbd75eea303a823218308da2fa7ec18d8f05c879e03

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\tcz8fqz\imagestore.dat

                                                            Filesize

                                                            5KB

                                                            MD5

                                                            f499c16f079502ff860b6b7b6174e2b6

                                                            SHA1

                                                            40c34a01e83a32fce130a7043b28959cbdbb234a

                                                            SHA256

                                                            5e99fd48641e4cfc56a45f2d6d0c772c5d70b03e06ce27390c2515234541ede3

                                                            SHA512

                                                            ffecf3531368d66a2efe2001c413dc99c9cb0004391affeec25bb594c75a2ceb55bc74f0d0b056ca05b776ce6e6a9fc7b8547416a6a9a7bbea173881e5b9f17d

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\tcz8fqz\imagestore.dat

                                                            Filesize

                                                            9KB

                                                            MD5

                                                            c979fa9f18e5907a6feeed156b48bffd

                                                            SHA1

                                                            ee234b6b521f5066ac161acf94723fadbcacdf62

                                                            SHA256

                                                            ee18b490ce304dd1960f4a800abcd7f3f1696bea4b3b08ded6818bd5a82aaced

                                                            SHA512

                                                            ac1601729134be9a8da50f3f485c83ee2edbd9a571648b9dafd0da85515da5dfea5bb6fb9906f7a6b411b23e81312d0e8f004b5e761dfd3c6f9271beff8c38ca

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\tcz8fqz\imagestore.dat

                                                            Filesize

                                                            10KB

                                                            MD5

                                                            52725ebf7c3d4166beddcb846ef2af83

                                                            SHA1

                                                            e5b12986c610814f6e1bc1f05d0f6a8d1295c181

                                                            SHA256

                                                            b5f350b6b65c348975c3a33858acd0744ff96f3c75fa615150788d6d0909eac1

                                                            SHA512

                                                            7917e71125b2778be4762381d647ea4fbab6e0f994429de18144e9a5c0b2fc81ac44b19308613da4b02db061615de6f194a223b2f18db8dd02c6d43e345d0db1

                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\SVH3C6RY.txt

                                                            Filesize

                                                            177B

                                                            MD5

                                                            19935357d38abfed0c2bdae32fe3ac78

                                                            SHA1

                                                            eefdcddbb05b9473eb82efbc4c407958a68b0dcc

                                                            SHA256

                                                            698a6f13098e60d24e559ce2fdcde01b5f1110c8c54229ba2d7718064c428e45

                                                            SHA512

                                                            48f947dafb4ddba1a9c4a9bf636e44d36f9c069896d4263ccbe17f088f19935e0abd5497e30d193f20570ded93dcb6706632cba02bb9654ae6e701fe1500028c

                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\TJTGPFLJ.txt

                                                            Filesize

                                                            608B

                                                            MD5

                                                            8a23d8979e20e12a550b7713e79cf525

                                                            SHA1

                                                            f52ec1f3f79a2ef09c91ce7c5dee91a10218dc2d

                                                            SHA256

                                                            bb4cc040a6a99da280d357c1d05ae72559cb54018ea24e8fb11876f1c8fc14d1

                                                            SHA512

                                                            d7a07f7f7eb0f53619dd9a56e011464e9e90d98edd75fb08331a9f8285de11e113fb6bce2d704ffc3d0d67bc34f8114eca1653be704b42cdcc0c8bef32622d0f

                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\WGY8P05O.txt

                                                            Filesize

                                                            573B

                                                            MD5

                                                            f0ed5fd7d7685b5b04ceab8c49e21c1b

                                                            SHA1

                                                            cbee10ce61f39ac131d86b0f6caaf964c536bce2

                                                            SHA256

                                                            a24606a00ec630908de82909ca940ff1d7f29cbb30ee33574938aa8439775778

                                                            SHA512

                                                            3af0f4ba571b5acd66b50392d89d44f72ef39a4ac6a7d38e36cdfcbe1898238798da41a0c9de57caef8555753f93b8852468105d48aed9673278036c2caa40ba

                                                          • C:\Users\Admin\Downloads\analyze.json.anhyl4m.partial

                                                            Filesize

                                                            38B

                                                            MD5

                                                            44ee0bd39aa9ef9e9bea327ff3fbdd19

                                                            SHA1

                                                            32caf77fe39c8eafaecd9d5efd39e792405cc4ab

                                                            SHA256

                                                            0a678d5248f52e23dfc15bed04f6b5f9270a742cdc21e24b27afa9d9fc228ef9

                                                            SHA512

                                                            94ed7e4b8f2372e9c7354baf83d959ef92ba5b7a67cfbb03a201b74792eb984df61eb61755d6f192ed9e895d0dc4d607aa7f25c56c24130495a8631ea81c7d9c

                                                          • C:\Users\Admin\Downloads\listFormats (1).json.3q30eb0.partial

                                                            Filesize

                                                            3KB

                                                            MD5

                                                            aee5c1cc84c4bb29f06baf02d5d99974

                                                            SHA1

                                                            e4c5180977371f8b7d3e335341114964a33111b3

                                                            SHA256

                                                            0f38a308068e5f2f2f733a7989675bfd9ac43bba3095755d36763f44c0797592

                                                            SHA512

                                                            3927136827f61fc8740964bd136ead914fd5437743b936cc8db88d2462632becc832307f6c4e205a31906954fc19a549df5a39db98aff33f1a7f2543d52b6e1d

                                                          • C:\Users\Admin\Downloads\listFormats (2).json.8lqhz2o.partial

                                                            Filesize

                                                            3KB

                                                            MD5

                                                            a6580db3a55d9e0481e060191bde6171

                                                            SHA1

                                                            4e921e2c12ed24cf205c09ad93c08ff3e854173a

                                                            SHA256

                                                            a693fb2b785de37bef71d1f6c217623c5876c67ea9064fbafabfb4f02d0eb75b

                                                            SHA512

                                                            73744c6c0fe6603dad760d8b764f7610e6d5bbec25855d61f3582bb6a7b8a849fe130593e0e6687624571f1d32c2beb5bd9b5e2d50eed9a046c328e498eb9edd

                                                          • C:\Users\Admin\Downloads\listFormats.json.48q6td3.partial

                                                            Filesize

                                                            3KB

                                                            MD5

                                                            f2c032e60dad2bed448b1d443aee66dd

                                                            SHA1

                                                            ba12ebdfb9e4a7a408331c629328ff9ad7080952

                                                            SHA256

                                                            ba0b5bc3419f8947cbda9ac7c998ffb376734d49d40d9ffcc0f90b0f19b2841b

                                                            SHA512

                                                            2b13e8f3b2c4ef4f80710011bf0b9405c30fc57d72aba64fe6b722fac00bb4c1e3f4b41d88aedfad7bb1b2301cf2ffcbaece3203a638373b4e771be5727c654d

                                                          • memory/1772-84-0x0000000076401000-0x0000000076403000-memory.dmp

                                                            Filesize

                                                            8KB

                                                          • memory/2656-78-0x000007FEFC341000-0x000007FEFC343000-memory.dmp

                                                            Filesize

                                                            8KB