Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    19/04/2024, 18:02

General

  • Target

    faddc3f2bbd29804c67442c527a45890_JaffaCakes118.exe

  • Size

    1.3MB

  • MD5

    faddc3f2bbd29804c67442c527a45890

  • SHA1

    52076fedaa0592bc81bd4bfeb7cfb90c29db473b

  • SHA256

    5a9d617e78467db2648608417a550c0cd2072708962d8afebdd865d08f4ae13e

  • SHA512

    764da64df51ddcae6641c9f267e4c00752e13e73cd4126196fed74f790deda1e98f4a0e33dd111f65d302c1a79ccddb1e89f4d1b2a1fab643f20f81c77ec70d8

  • SSDEEP

    24576:FHLI4YHHEmomR1VN0F6tr/OzBBSDrz1nPTdgdXrdBHLcsH661S0C0xytR:VAkX0N0gtr/AShnUBHLcsauCJR

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 6 IoCs
  • Drops file in Windows directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 47 IoCs
  • Modifies registry class 53 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\faddc3f2bbd29804c67442c527a45890_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\faddc3f2bbd29804c67442c527a45890_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2996
    • C:\Users\Admin\AppData\Local\Temp\is-H8FRD.tmp\faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-H8FRD.tmp\faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp" /SL5="$70120,1119550,51712,C:\Users\Admin\AppData\Local\Temp\faddc3f2bbd29804c67442c527a45890_JaffaCakes118.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3064
      • C:\Windows\SysWOW64\explorer.exe
        "C:\Windows\System32\explorer.exe" C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
        3⤵
          PID:2476
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\System32\rundll32.exe" "C:\Windows\vistaw7\comrundu.ducc" message1
          3⤵
          • Loads dropped DLL
          PID:2540
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe" http://www.cdjspaper.com/
          3⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2076
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2076 CREDAT:275457 /prefetch:2
            4⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:1752
        • C:\Windows\vistaw7\KAV_97_10.exe
          "C:\Windows\vistaw7\KAV_97_10.exe"
          3⤵
          • Executes dropped EXE
          • Modifies registry class
          PID:2840
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      PID:2760

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

      Filesize

      1KB

      MD5

      55540a230bdab55187a841cfe1aa1545

      SHA1

      363e4734f757bdeb89868efe94907774a327695e

      SHA256

      d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

      SHA512

      c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

      Filesize

      1KB

      MD5

      5b121a7a52f3006896ed592436d639b8

      SHA1

      632d50b0321b02508806f709bf216604c25d5a0b

      SHA256

      95b4c8faafe749b26c6e93dd581ae9be3fadcebd65d052afae4c9092fef61d50

      SHA512

      bb3bfa2f47e35032dadfa5472d3b6c47643786a5fdb7d9fed79641f75c7e043d15f50fa5eb87133cc982547079b3e616247c9384c1154204b158ad83b11d77e2

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

      Filesize

      914B

      MD5

      e4a68ac854ac5242460afd72481b2a44

      SHA1

      df3c24f9bfd666761b268073fe06d1cc8d4f82a4

      SHA256

      cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

      SHA512

      5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4A9377E7E528F7E56B69A81C500ABC24

      Filesize

      889B

      MD5

      3e455215095192e1b75d379fb187298a

      SHA1

      b1bc968bd4f49d622aa89a81f2150152a41d829c

      SHA256

      ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99

      SHA512

      54ba004d5435e8b10531431c392ed99776120d363808137de7eb59030463f863cadd02bdf918f596b6d20964b31725c2363cd7601799caa9360a1c36fe819fbd

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4DD39726D4B55AC3B4119B35A893323C_5670351899FEFFE1111FCD3D8BEA636E

      Filesize

      5B

      MD5

      5bfa51f3a417b98e7443eca90fc94703

      SHA1

      8c015d80b8a23f780bdd215dc842b0f5551f63bd

      SHA256

      bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

      SHA512

      4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

      Filesize

      68KB

      MD5

      29f65ba8e88c063813cc50a4ea544e93

      SHA1

      05a7040d5c127e68c25d81cc51271ffb8bef3568

      SHA256

      1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

      SHA512

      e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A4B782275DC1682E4DC39E697A49B151

      Filesize

      1KB

      MD5

      96c25031bc0dc35cfba723731e1b4140

      SHA1

      27ac9369faf25207bb2627cefaccbe4ef9c319b8

      SHA256

      973a41276ffd01e027a2aad49e34c37846d3e976ff6a620b6712e33832041aa6

      SHA512

      42c5b22334cd08c727fdec4aca8df6ec645afa8dd7fc278d26a2c800c81d7cff86fc107e6d7f28f1a8e4faf0216fd4d2a9af22d69714ca9099e457d1b2d5188a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

      Filesize

      724B

      MD5

      8202a1cd02e7d69597995cabbe881a12

      SHA1

      8858d9d934b7aa9330ee73de6c476acf19929ff6

      SHA256

      58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

      SHA512

      97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

      Filesize

      1KB

      MD5

      a266bb7dcc38a562631361bbf61dd11b

      SHA1

      3b1efd3a66ea28b16697394703a72ca340a05bd5

      SHA256

      df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

      SHA512

      0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

      Filesize

      230B

      MD5

      1d4884733697af2c7f45d3e030bc5084

      SHA1

      54c0c19321da2c239b41eeb151a41dd439ea481f

      SHA256

      ba9316d50b83b37c0b946e5e173de28e38bdf4f82265496956682baee7c8d35a

      SHA512

      ab07ac7ca7c523c8cb4c7f5bd0ef57e4243035410a5b8cb21e387ffeaeb919ea2e46a9103ad02de75c4b629346fa29b09fdbf874a72c070ba28e0bd09851ef89

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

      Filesize

      252B

      MD5

      5d4dfde6af659de87a2afd723dd88f64

      SHA1

      9c73efb71a184eca234d3feee2513f54c6f45026

      SHA256

      97509afad42139d716f0d410dd285af9a75cac91e1d6aed2f57823510a49dfcd

      SHA512

      ee725a7e00acc87ad4798ec65c1cec131b034a2c0ca07f239b051c35c92120f37e87abbbac7e2aaf7872e5af8efe9b4960f902d684c803b76d5353f903ac3a67

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      2f7fdf00fe2de7a9e8626ccfaa780cb7

      SHA1

      161e61f35ce64a753c1352b4b7b03f7f17d230d0

      SHA256

      c88175074218849067b8fc0f83f20b74454708a3b78e28e34572630fa522b091

      SHA512

      17a8562b55bc9a9114fed5f83bbe67a78ab5f3f4a2473c4829f49f43e8d00f268ebd21c6a24cb0cad39d7b6635a6e799a4fbfee971316a8dbecf2d2134858b31

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      832e161fb0673bcb58354d8210724dcb

      SHA1

      06aa56386088defb4121e8a0ce571a3d87201c0a

      SHA256

      4e5f891932284edfbdea6b215e522ab7ff90b277e151334dd985e969a83d2709

      SHA512

      33142f8eedf8fb57fe90e67da29488d63a8b0d2cea60607517c03b0dae101d835378b117807bbe556b5b19694b6fc0b0cf4c894b4d0bf26ab2bf15bc0c6a8c94

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      dd90dffc1d42856b1876bf28325c44e6

      SHA1

      85c480528284b2b166f1e0858dd36902ae2f474f

      SHA256

      33bd18cafc16ae03a8a92b285b314cf90f08b16852322b410df28d012a027cf3

      SHA512

      9702e6880bfa4d21059b24bf72b04ea0ead00d02ff0bcb187d6655d195712cdae7513a288660efa4c43778436aae2c6bc2ec570d0417ae551718033f2fb8de6d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      5b573f8b3f3e78cd8ac7ea593e58d29d

      SHA1

      cac3539302ec1ebd7d9a94c206f1317388b36f16

      SHA256

      d4da6ae998a089715a3b36adf3ffe051ad855d645fc12ff9fa30908c03c771c0

      SHA512

      182dc6632df5f8b32fcd8a0abdd8331a5b860c81d4081625cf7c36dafe95b73916cdaa4d224d797c9abb4f38e778241002d9a6c2955ecf6076b2352ad0fa6b2f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      18a95a7a5da02354c20b7ca2c8b424c4

      SHA1

      94df73f86c16fbcf65e5a871bb4af48f8b8f4377

      SHA256

      60820ed5e08ace64a166b5d91b0d9e6f6bad836901f3bf95cc15b3eddef6858d

      SHA512

      38917c29efff0ca60d4ba42345f431071f4ee5ac59659be726fc3561b3e3e073db093c3cd5c7308a6fc52f2d3ae86f34ac578864e6f79f1ad5a87f1414ef76cb

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      e3199c959d4fdcf52bca28e1ee6c07f0

      SHA1

      20177a1b4675bbb9e707356f08bbb5d926d7855d

      SHA256

      0731fed8fba291f54e84805e33a3242eb5e816119c41216cbc6c2c646b1b3c56

      SHA512

      e706bf362a2e61cd768de4fb781d435ffa7b01e79232377b41073259582f62d00a976eca480ab20404234e53a471d92f820f36f21c07c0782aac62a21ec4b5f0

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      e19193f94794142b7b1ae37232e42a52

      SHA1

      ac57c2a6e5a15df9efa977f77955268bf435f5c3

      SHA256

      0ba8379a313e6a8dd87c90651ef69d11b89df287a123b557bf1e4b34bcf2664f

      SHA512

      db03e00c1f0973e797e7e1d9b8f8e5909652ac3bc6220a2cdcd8dbd0a247927403c55b4bf85003907585b8c44043e7921b042fc4a91cf899ee98ea8eacaa7dec

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      85fcba410318f7b300a3f59f04723609

      SHA1

      b6a71e813b65f84e86e71e344e6531f8a50509be

      SHA256

      14531a912cbe55e85e8adf84a2f0316a682a296e1fa882c18ebd95bc6fbc5f2b

      SHA512

      93db368036039b338c97358b09cb4495b82dd9392106f35065a9e2923bd183ed32d9885dabf5b605402790200106d5a08289095f740363b58b05929bc30153ac

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      588685ff543f17c67b1fc12cc12cb511

      SHA1

      2830532d2323556209b1b01825ec79f1d53c31a4

      SHA256

      880b021ef79bd2e13ea3d7ddd185edc9547d205dc3bc9137f51d4ff8da7e4535

      SHA512

      65df1b94301bb772c2fbeeb36acf7f5c7952d95e4a2b13effa8262594ea2f9d7348a0551af0b16bd7f41abdf2b5f4f6c1caea9ac3fd6c89c945def565b6ac550

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      3155df8fba7ffb5bd058497edd57a01a

      SHA1

      add5c5e0bade14f0897286fbe5a0e6fd99177f8e

      SHA256

      c5e99279b26f15d470986c1d666cf984df3109af9ddbf14a6ec64df02517d5cd

      SHA512

      1a0946cc8dc7137c5ed20513fe0ab9cdf705dcaaf118688454111bfe046b7d5dc16a3d8f16d2cc8e382a69821c5e481c20ae9a9604bb88bcca6f4624b46cf7c1

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      f3578c9af82115d405dbbf82af5cf9b1

      SHA1

      d289e82e227c8e93570485736c3c6cae987d47bd

      SHA256

      f68f446114c2c7e98f4efa416ecc440d8fc40b9c31f036ad30d57678745a2f5e

      SHA512

      1b788469c5a16299daf64621e4424d7d61cf99e32e4853257e8bdb669931b6379fac1815cc373576413211d42e783e0283d4945b50448d1ae0e5578f8a23aef9

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      f32fd8914041e848e02d7104f1747ab8

      SHA1

      41cac8267aa20b421ac0c8ecaeb03bc908af993d

      SHA256

      b4194c84d606a24724262251272a8927ccf98a9776f89e6aa507bb2337950d36

      SHA512

      f5198ecea950ed9fab1b9bc18666a50567dba58a49b79e10841b1cab84304ca30b25e486843b17a6e9262be5fa9d8098dac85f89bfdc2564a7f3d415c1a615de

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      a26cf93f1172fb58ab162ac9e2e7e028

      SHA1

      cccdbb27ef00e8c45ea1d13b7094420106d94ab1

      SHA256

      c5e14f2117de36d55ff0f24e1217dfa0b175fa65ae5b4e47ab0ae18b3db2d906

      SHA512

      0936aef869ff36a908447d34a8ba11d00de89ca13921a77cecc8c4ec6a7797f9ecb4f8bcfd2c90cc0f1dfe8961950c49e4becbc1c713dcc853e0fccbf693e963

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      0dfd0d6d20c9e3544a850be990ca0d02

      SHA1

      d48d2eb16cd24ab10dd63f222b81061742353819

      SHA256

      846a5a10d7938a20b232dba6bf4b22b542a55a3f443885565a48dea22ba71e3e

      SHA512

      25be3ae88891d4789e2cc894553d985c553e1f17ff3d8627f01b6985b16158db0830bb1d9f0743bc72151e4e520c059a854f1419cf4919e853361fcba60c3177

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      3e5b1b257834b7bbdb412768802c4011

      SHA1

      2044eb7e707ea0750bc44fca1404e7df947d032e

      SHA256

      9a7fc371e529de3f239c0ff7d0ba84e1de6e014db24bdb9286d5964a66fa3779

      SHA512

      fb9f0109cf4b12ecf600fc75eab82c29d672da362cd36deec318f0c46bf74436f43a9a6268772764b75674f882d270583493ce42752b9b5e32372a2d4f34f709

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      733c31e161a76af5c827f4de87d457a6

      SHA1

      9bba641eac7571bedaa00b850597950f9c252593

      SHA256

      5965f1fc09d8edc8eb6a9f489f1b6da3a2d4b84a8ab89dd1627e5097dc828713

      SHA512

      3bd8192fee2fe7a59887c5fedd8dc65e12b4724594ec41ac5a98c482cd634eb9b8c9434f09db60f852c7e0f25b0ad1df6a511f7177fb12ba8e4d1b3ae877f918

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      7894b1d00f9c9db0ef48a90eef49c799

      SHA1

      1f372aef1b894f7d16759970ede8209cea53feb2

      SHA256

      c48506770aeef19b783d2e36b093550a90bf617c3cd06d07a9c506d6d167bbe2

      SHA512

      2d9823c187a87a1b15865006989669868cb4e24d5cc8ed75c1dec61e7e51a73954d2378ee9c5228efff1ef38c37b6987b02fa77b2924081637d7f22db3d18c4c

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      90544a0ef88b89af74820073e3de8574

      SHA1

      d4e9a588db8a351c7c59251a920e4bd2c5bec2f1

      SHA256

      a700b670b302e9c428f4c0bbf97ee6855a316ce4c53b33ea4099d51931c3a28c

      SHA512

      2df4ba2b80bce5bc7b31601785a85016d5c6c3d3f783ea26ba1a77dcd26406f75efe74eb35495f8146b07b774b7c8611a0c4b519d75e3269fb3c4c6311a08fc3

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      c83b79bd13d015d6370ec4ac4787d58a

      SHA1

      d78707095169a9591da94babea08cb7cb06cbacc

      SHA256

      6fc9530c7930b067e83971df37d76c3e4922a3c3c4e53922f61fab3c26c8a6d9

      SHA512

      0ab749d0ff71c0bf31fd123663959811757b41b9bbbe6f543e0cd4d9062a96e7359695864446a070cc041a9e305ac198d31c045bbc37fb4346190993c0c8ba68

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      a44daa87fdfc741f35a47e9f1cf95850

      SHA1

      a68c51cc4503acc90fa973e35e220e91192cfcd1

      SHA256

      e5758eb268337383bc4b14c0e70ee29b657d1c45f33e32622eb937a29e991b31

      SHA512

      c6d46d6650ae3d47e161620106eed14a2b7bc1a8d78c1bd5fdbd32b7b04ded01f1b02af1791af8bc8234de2f18810ab3b953b1ef3e2f72310563eda33a88cb83

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      5e5eb2286ac34f1d706ac6cd45d1321e

      SHA1

      6fec215cccf9bec699d1225991d2b90d43609639

      SHA256

      fb070673e8b5326f92210319d381e12b1d3ec3375a33667ef2ac565cdb2d0bbb

      SHA512

      90ec762eed4ba0226f929c9b3b93e2c80fd1273e60a02de3b8c66a08d85b7437ca3d955e63180300ce90107addea1c52e961f76da937c85de36522b64a05460d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      14913785493272801e58eae062236cf7

      SHA1

      0b85ad79ee9a3639b0e2056537a4882d2cc32e39

      SHA256

      1b26037a8f6013e55d99e0fc0f1468b6d388aeb5b13e2fd009ee4f32aa798e7e

      SHA512

      a0d92e9face3c116d3347f6e0644c969bfc633cfb4933537cdd3756877f80ffd4335536f19251bd794cdd14362000dbea5525c6e9befe3ebde2bbdd00b0879c8

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      5987ec9fa94a8e79499266b16f0103f3

      SHA1

      57e48d1d15211cabc4335ba60c6bb8f99635509d

      SHA256

      e4b9ebb64c892bc1764cba41b443d81aeafd797fd2a8d21fdb72a68d904d3ace

      SHA512

      6f4659b1ed28c21c8340b9c29a186969cb850a1453cd5d7343e27a9d8c777dbaf887567c6c84f8f5e3ceae6a49a588c66e529b2acebeaca9c3520765096ad07d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      2a37b4697db7714e50896e4b451ab8b3

      SHA1

      627a6f4d38894229406c95fa57382b63b236dd68

      SHA256

      2038f09ce813bedb608bdba2a6a22c317b2ec1cc6f3ae8302b35a34dd6295a03

      SHA512

      a03b33244159f495cc787b8a2601c0d15d471dd839fa5f1147cd73e65b389177bfdb1d659f77f13bdcb52ed00f5f5ec12401e19ce6eda1ebc3aaa4a023c25b6f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      3e1877f140d1619d6ac7502a0fd45216

      SHA1

      9ec6653e563c7999cece01ca1ca324f4d0608867

      SHA256

      72afb82ecd257c505b1bd0a2501620983601e7d46fe8f29bc9a4acb60a82a695

      SHA512

      53c2c4cefdfc8a59c2587f9ba3adb1c38000c5d0e5cc9732625515cb92d5de04141e170207c1cf716d9202084ecd5f226707791f5a8ea444af3fc9c92809b39f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      f1b2e3c80b6bc8c2233caef5a6c2e6b3

      SHA1

      e66c6638e23cbbf922454bb727a4a875aa40bb10

      SHA256

      3c5c693b2e259a93b9fec7ff1ecb03b868eea9231ae007fe4bd664fa7ca4ccdd

      SHA512

      6902a7e2cbedf7766c6e83d669a4c05c8112f25c09ba10404b76c05d94a0441584c0f7cf339039523d7364bed64a2658bcea758365a3efa933b3bd6ceb5a6fa2

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      cb88b06c906c0f391dd4506b1310522a

      SHA1

      1bd3c92e37b6f0ca04af8ed31386a835359ee934

      SHA256

      42b6b0ccb16dcf2bd222ecdfbdf0e6c99430ba4fcd1d388e9c5530f869736af8

      SHA512

      d9b06c832a244964a10e539a00649b68819f16a70f6aab661056e50bcd29907fe88efec4f9f45f0670e196827a97e86e1e4735eebe066d9979d3addd974d1218

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      520912943e8a14df8711b12957d4e8c4

      SHA1

      5a19b592c3b0b496d7b4f4ca3948137c81dc6deb

      SHA256

      21132c8c78c465838077a85722d9259c78f2ea2c50673cecad2f0f8fd2723c0b

      SHA512

      c79cc93092b723a130718faed0bffcb20fef5d6f0eb846406801746c0d09311361e067fc021765d7756eab6afd2dc01ffede54d04a0433b93fc2b749fa09c52e

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      f298d675eebb37a31298f50a13143614

      SHA1

      579f2311256646b50ce0a115a0a04528dcf9b79d

      SHA256

      e1773ed384fd329a80c4b452f626c629871f6ca14de4ac86a13a9023eaf5a286

      SHA512

      a8ec8e1ffd6ae38bdd0ff0c3a254feadffc06caa9eef4a5f579c1d588c2d64f9a5143ef99fa047f967a4306962b670369d03be35112e35cba13aabb910ee5da2

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      8628776b75369677dd3a7258a2e2ba3c

      SHA1

      666b24bbc28ac1eb4f6186b14da6bbb328381367

      SHA256

      b0eb0afda85c6eed18309e4f0b670acba5606b1d38e1b744d0740d7f26f92c35

      SHA512

      951f602ab7204fa4ea882caf9d6866a91c47a27bd18c179287953950657c1b275a2cbadfd5bdbbf3c69df861ce1c87895f04b0c25dde13129dc1cf96d09ea157

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      071ca8c5316566c588d196d844d069df

      SHA1

      abb34c03079ee8bd58ad2b26296981bccd89d670

      SHA256

      bc7e36904833f9c2a6edff1d384c2783ce58d8e8ffac55c1ab73d88fbd371ca6

      SHA512

      e687e9b814ac7479e133ebe11726433c3bdf7cfbf55f99e3176c142754438763f831c09c735f610eb8e40da3f1c4be5c6b93d81739c062bbf676ef392be6c964

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      36a39a81cda6edbc0659cbdf25ed7a6a

      SHA1

      f2866cd5d50bdc5df9bb9a52180999dcdbb527f1

      SHA256

      23d0ad19a5f7e61dbb3eb8149ac0e4473baeed65a523577bc2239b9c73331450

      SHA512

      7520cb2e1b2a4918a669f8170699cdac151bff811ca6e424e6eb935da647406a7488f7c796f0dcf9469ff04383a37d8492c6fd7ec293269545e6debf77e6e80d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      b41c9d149a243329f8ad67a23f14be7b

      SHA1

      2b0cf4b991accc55cbd7531fc5bd78610ad076ff

      SHA256

      a063d3046675951e15c3cd367ced4089ffadeed507eb51ee87f412124b12c134

      SHA512

      ca43a69c57bf8f3efa8863cc6f4ffec1781619b3ab4e51835ac20ad8efca8eb69bd83a4df1852060ec5b5400596a054026792f99fd477f8abde78a0be46f43eb

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      52b6b9cc28917e31d025a8844b016d0f

      SHA1

      dfaa8f701794515e3c325a1ffc4393ea6602c2a9

      SHA256

      1d09fab39ff65b3324d6c87a645fc48c0da4d5744c99e26bf0221ccb6821f04c

      SHA512

      64aac1b16068f5bac2f245a2d5857c768784a66aa89bd081b9ec5fe9271bd239eb82af8d9914d333ae43a122a3cf98b956c41f3894c071dccf7eb9a8906140e0

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      c5adea0b2453eefdd01a153e40859143

      SHA1

      e69e0dd73b3a16ce26c77f9ee453cb249e0e8ac5

      SHA256

      81f72446f6860fac2b1783893091e310301512a47addb88bdcbb51e7fe8c9f55

      SHA512

      057598bfd759be4400503453619857120b1cfbb1dc004a587788eae23e4640d2756d0655866d1b31c85265c56dc5e1d16c38cf5d8f65ed02275be1adde9a7201

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      cd1da154b5b46636ff76de3ba305b4ae

      SHA1

      57a6fdc7e2a63e0f9dadf267130ea10959b23b20

      SHA256

      2771a52d16c1fa1bba2c48c0ab937f37a89cc03f1d7b157501c5e7f64afba94f

      SHA512

      68fbba112cb8c94e2981a01392248b1ee4a1bef3233c0dc7dfae6514ce67995cd3b81581a7ea170c4103abab0ddc3b2716d073a4ca871a922122c629bbff0298

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      d1d2718f7fa5ee053eef51e8f1570f1f

      SHA1

      06f2e964d65d5e7d5448e178c9e2c6e7bb0d5858

      SHA256

      6da084b5eddb3ba9446cbd48da01813b8039bfd82866a246975bfe26a8e50229

      SHA512

      8a2dfd1a291d5074533ed0b36b4c2f569e42c5ab3492bb8a8fae3564b18948ee6c6b7918e656e7b64e3acc4e09b18bc0eae344e5363e6a41c220cac10a1e8234

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A4B782275DC1682E4DC39E697A49B151

      Filesize

      262B

      MD5

      3d869f2ec626df2793832d0b585964bf

      SHA1

      3578cd2843b66642fe735f3d3f76ad19da3d1574

      SHA256

      8729e85f2925d413b73b0c160367d50ee637fe9f92bf95bf3478465971912ae7

      SHA512

      08e084180b1a64ae768ecfeb6ce05faa1ee09cb72e2c846f805b65c3c0c6ce71d97e30c3395aa8aa7ba6659a20f95d01dbeb132ab1abf784627332edb230af43

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

      Filesize

      392B

      MD5

      656f2ae09ce9fe3c24b395147a42ec46

      SHA1

      670f5bafb1083b8d717b50cf3d4533bd50a04b17

      SHA256

      3051d0885dfd3de7afe231a6dabba62f1ae9f1a5e84ca74fc0dd0874a65ed63f

      SHA512

      df0d339550867d4bc0d100f3fe7558f18d6943ae1454e931874bce66831351a0947191cf40b8af8ff5258b9a7ba9ce4d7111481ef3b9eb932cfb977f3f091326

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

      Filesize

      392B

      MD5

      53f5a21d3ad750b1aa818fe42e85a8e7

      SHA1

      53d199d6b3fc2a05b24b58682daad3b6c19c114d

      SHA256

      76c77211db235072e2186970a955ed9baed3128d621067480a6541013a89f6bb

      SHA512

      d7e95aa6400bc1530b092b467866a351ee0fb82895423ae48b4b2cc083cb2e2a6d8697c9905e95b3e74241b544926a46c80ba382fe955b11306e18786b0ccba0

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

      Filesize

      242B

      MD5

      a73ac89576bbbcdeebb6a7664e050498

      SHA1

      f5e254dfc677cdfa95b69912e269a522cd2ab947

      SHA256

      3fc08bb0a74bb3af39f6b7f00e6ef0cbc5521ea3e8b81f09d4020dda3671aebb

      SHA512

      c2a8bcdbb9aa05b72d891a508668327af9c5cdd6380636a53c7afdc1bf9bccbb511619d5a9d1ea1be5e9f63a08e49e3a7231d1501f733d032a7d1f9c26d91474

    • C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

      Filesize

      4KB

      MD5

      da597791be3b6e732f0bc8b20e38ee62

      SHA1

      1125c45d285c360542027d7554a5c442288974de

      SHA256

      5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

      SHA512

      d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\s8rbov0\imagestore.dat

      Filesize

      1KB

      MD5

      467129a30c1df28e861895bef6294199

      SHA1

      2c8c73a3a46114f61d5fde5c080a1a1c40610684

      SHA256

      8a3ffac77dc0d8ab7d050feed15710d6e558f0484b71c9b88535cfb4e0ceafe0

      SHA512

      8d7bda97e7b4f0adfd98c326e3a9711d3fd81ec26a8f96542c1e23d1b7579048d74331e39f09b08b6f7939f2cce2570fdb162e247f59a7d939522a4820eaf5de

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZWXD33JI\favicon[1].ico

      Filesize

      1KB

      MD5

      7ef1f0a0093460fe46bb691578c07c95

      SHA1

      2da3ffbbf4737ce4dae9488359de34034d1ebfbd

      SHA256

      4c62eef22174220b8655590a77b27957f3518b4c3b7352d0b64263b80e728f2c

      SHA512

      68da2c2f6f7a88ae364a4cf776d2c42e50150501ccf9b740a2247885fb21d1becbe9ee0ba61e965dd21d8ee01be2b364a29a7f9032fc6b5cdfb28cc6b42f4793

    • C:\Users\Admin\AppData\Local\Temp\Tar79E6.tmp

      Filesize

      177KB

      MD5

      435a9ac180383f9fa094131b173a2f7b

      SHA1

      76944ea657a9db94f9a4bef38f88c46ed4166983

      SHA256

      67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

      SHA512

      1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

    • C:\Windows\vistaw7\Install.tmp

      Filesize

      866KB

      MD5

      dfbef39d176da6636249d8583ddcc96d

      SHA1

      7c61f1c649ee3ee21a297bb59d0c8c093cdfdc7e

      SHA256

      837503486e5ef9cd430cbb2939d29bbca76491450759a749b69ff4619d9cc175

      SHA512

      f50647d70b360698d404248ace1a18a9d25a3d9fac88715d6d984ab15ce644b220754b177bacb14b20e1eb773cdf4a1edec1efac834a1b76f5e71f036d1f2640

    • C:\Windows\vistaw7\comrundu.ducc

      Filesize

      381KB

      MD5

      1a0cdae51e615380089b0c953db3c70d

      SHA1

      867bae67c4fb300bb30d0ac502864ebe8a0a634e

      SHA256

      c8c6ed1345a13ff90a4d08d6b0852f78423e8ddc69ae8910ce7ddae65b165451

      SHA512

      f0ffb1c91a6e771ac9256306d529b214c2a65902911422e6d820e4579fee5b02166f99725551de65b819dd0f70ebf57b641c6b3d50f333a1c3082be8afe5dce7

    • \Users\Admin\AppData\Local\Temp\is-9K6HH.tmp\InstallDll.dll

      Filesize

      442KB

      MD5

      853a849864b0a11962f27832bb3cc84c

      SHA1

      dcc4aedec6a3c56483979ba4343067066c4fe0e4

      SHA256

      592c77e4ce824e191dce77ae631285443e7c2e53783c7211fbdebdb1b2af5cf6

      SHA512

      e93a2a4ade5d43dc05e2ae3ae58183e6bbd578b1a106cde6a4a8380066d9a40fd502f3f237e402a70e061afbcd9965ae45389be51e9958e65e30d92b44fab497

    • \Users\Admin\AppData\Local\Temp\is-9K6HH.tmp\_isetup\_shfoldr.dll

      Filesize

      22KB

      MD5

      92dc6ef532fbb4a5c3201469a5b5eb63

      SHA1

      3e89ff837147c16b4e41c30d6c796374e0b8e62c

      SHA256

      9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

      SHA512

      9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

    • \Users\Admin\AppData\Local\Temp\is-H8FRD.tmp\faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp

      Filesize

      705KB

      MD5

      eb494bad9478bc28c4f8fb7fd7778445

      SHA1

      1b3e504108b39c6978e737e08d4cbd2c22d95e86

      SHA256

      e1af346595829eba017ec343cb179dd217b7991fb322cc4e8f18bf40ef8f941d

      SHA512

      8b14a9c14185d5afaba7443bf43cf14371ef3c3d524de00ba850f07952d1d18abdc62118cc4893ed2fa66570eb4098d01ba338f0cc00ae19be7bb697dc8d9f91

    • \Windows\vistaw7\KAV_97_10.exe

      Filesize

      677KB

      MD5

      e473d4d66d043c5ef07b1bc80af31e27

      SHA1

      3b33cbc5fda3ded92434f450fbdf34c9da11f541

      SHA256

      f7108dcf904c5256d8904ac2f9bc8cbd1e545dace38b4cf0210d9c3b7f10c919

      SHA512

      4f3be6f4c3ee89d8e13928ddf22edfc09c55b1a0149b8c50d4aa1999183d33ba9273dc6c26a620b40954391972f91381a7d73bc3d1eeaa8e414f232bb20b7ba9

    • memory/2540-1651-0x0000000000180000-0x00000000001E6000-memory.dmp

      Filesize

      408KB

    • memory/2540-53-0x0000000000180000-0x00000000001E6000-memory.dmp

      Filesize

      408KB

    • memory/2540-58-0x00000000000C0000-0x00000000000C1000-memory.dmp

      Filesize

      4KB

    • memory/2760-43-0x0000000003A10000-0x0000000003A11000-memory.dmp

      Filesize

      4KB

    • memory/2760-1742-0x0000000003A10000-0x0000000003A11000-memory.dmp

      Filesize

      4KB

    • memory/2760-44-0x0000000003A20000-0x0000000003A30000-memory.dmp

      Filesize

      64KB

    • memory/2996-0-0x0000000000400000-0x0000000000414000-memory.dmp

      Filesize

      80KB

    • memory/2996-92-0x0000000000400000-0x0000000000414000-memory.dmp

      Filesize

      80KB

    • memory/3064-18-0x0000000001EA0000-0x0000000001F15000-memory.dmp

      Filesize

      468KB

    • memory/3064-45-0x0000000001F60000-0x0000000001F61000-memory.dmp

      Filesize

      4KB

    • memory/3064-8-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

    • memory/3064-91-0x0000000000400000-0x00000000004C1000-memory.dmp

      Filesize

      772KB