Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    05/05/2024, 01:12

General

  • Target

    7c4580a23caaebf1a6bf1789f1ef4fad53b72fa736a7b11eb3cb70a089d34486.exe

  • Size

    1.1MB

  • MD5

    5573f9d646c2ff5c4cd5ee82a5b01e92

  • SHA1

    6c828b45f929b6747a42470abbdcf307a56953f0

  • SHA256

    7c4580a23caaebf1a6bf1789f1ef4fad53b72fa736a7b11eb3cb70a089d34486

  • SHA512

    9260bca4a6d1010c13d01dadafbe33de3847fee4c03f05f23a9b117df5e3447ddfc2307a506947e7d15238f2a640d71c1c84e167d9a1d7da19558ee774d23d18

  • SSDEEP

    24576:KMw5NGpwZ7/fEUd4zQwR3xCw1cisoZlVtDCapAQ:KMw5gicTcwF1zZlH9P

Score
7/10

Malware Config

Signatures

  • Drops startup file 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7c4580a23caaebf1a6bf1789f1ef4fad53b72fa736a7b11eb3cb70a089d34486.exe
    "C:\Users\Admin\AppData\Local\Temp\7c4580a23caaebf1a6bf1789f1ef4fad53b72fa736a7b11eb3cb70a089d34486.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2908
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k move Emotions Emotions.cmd & Emotions.cmd & exit
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2812
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:2196
      • C:\Windows\SysWOW64\findstr.exe
        findstr /I "wrsa.exe opssvc.exe"
        3⤵
          PID:2484
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          3⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:2524
        • C:\Windows\SysWOW64\findstr.exe
          findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
          3⤵
            PID:2356
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c md 1141
            3⤵
              PID:2412
            • C:\Windows\SysWOW64\findstr.exe
              findstr /V "MasBathroomsCompoundInjection" Participants
              3⤵
                PID:2428
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c copy /b Terminal + Involve + Experiencing + Borders + Deborah + Flip 1141\Y
                3⤵
                  PID:2420
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\1141\Buffer.pif
                  1141\Buffer.pif 1141\Y
                  3⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of WriteProcessMemory
                  PID:2580
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c schtasks.exe /create /tn "Indeed" /tr "wscript //B 'C:\Users\Admin\AppData\Local\EdTech Spark Solutions\EduSpark.js'" /sc minute /mo 5 /F
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2724
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks.exe /create /tn "Indeed" /tr "wscript //B 'C:\Users\Admin\AppData\Local\EdTech Spark Solutions\EduSpark.js'" /sc minute /mo 5 /F
                      5⤵
                      • Creates scheduled task(s)
                      PID:304
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EduSpark.url" & echo URL="C:\Users\Admin\AppData\Local\EdTech Spark Solutions\EduSpark.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EduSpark.url" & exit
                    4⤵
                    • Drops startup file
                    PID:2704
                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\1141\Buffer.pif
                    "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\1141\Buffer.pif"
                    4⤵
                    • Executes dropped EXE
                    PID:320
                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\1141\Buffer.pif
                    "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\1141\Buffer.pif"
                    4⤵
                    • Executes dropped EXE
                    PID:880
                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\1141\Buffer.pif
                    "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\1141\Buffer.pif"
                    4⤵
                      PID:1480
                  • C:\Windows\SysWOW64\PING.EXE
                    ping -n 5 127.0.0.1
                    3⤵
                    • Runs ping.exe
                    PID:2452

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\1141\Y

                Filesize

                577KB

                MD5

                49fe16db183b8320d77cdb7544052a22

                SHA1

                0142b4de6c5c63a7759d1a50694f996f231a73ca

                SHA256

                2d20b73435b6d3822d4074628d2861522c08d2c81b9c348d8a18c50b8dec0b18

                SHA512

                77c3a2e2f5d1b828a0dbff08d1fa99a8603fd5e609e4ad7e7acc9d58adf11bfece8cda8cf2d373b413ebebce22f96f714992c7081e496d81ab3cd17e64a8be08

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Alot

                Filesize

                21KB

                MD5

                4823e423b08bff6ebfed718131a3e420

                SHA1

                fef07a4cf8c633a57f4194d20a6b301db6b4a0ac

                SHA256

                51e4b1dcae698eaa0a8b4d4750a875dc5389b5d44aa270f13a11187ad031460d

                SHA512

                329fb5cdd61d4ecc441e95d3db16f7453681c198ff4b3e8c51ee7ad8c373018fe3ae9f099d59d0e011da6278f1bd777c353c0b83e0dd7365d980461fe38fecd9

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Borders

                Filesize

                187KB

                MD5

                adab53b3c3a1052c560fbc631f5b0633

                SHA1

                aaf1ad5f9143ae3e13518a61f640810124c32965

                SHA256

                70fa7078fa16c8642f1c5f87aece0e708a83bddfc0daa1e1cafc952139af84e9

                SHA512

                1d5fcfff8d01eabe8cec54cec2355de93edc024f6030d12c6e9ddba97ea45e4d3301c972fc3843ae5de24803d9a180877dafd01df5fe25f7e93bff1c69b048d2

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Bucks

                Filesize

                33KB

                MD5

                942215849169d73906e871eb256d4dc5

                SHA1

                0eb29860246b4b1e6ae666c37ed39a37d7bc467b

                SHA256

                0a13ebc949f696e36d7df9415a8b7532a6222102ba944302f662df9a2bd12c07

                SHA512

                864f150f58a0a567801b7dc52eec2d399f3d627d00e7895241f5d60470bbf6d37951d58da6fd76d3a4391c895afe443247778ca3b1ac65c15f43420169bc8728

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Chad

                Filesize

                55KB

                MD5

                a8e318404ec368f6755e51a476fa53d0

                SHA1

                cee0a03a5b3abb26576fef31d570ae11bac22efe

                SHA256

                e5e5918783ecc586ea0ae9a43c6ca0f052a3ac68aadb6447d0896fe0c246c8fe

                SHA512

                fd0a91610ccd8ecae5216c1d83df89b03233e47cbc18a2f2f62c9fcdf8218e5a4a482c3c75dccd575a8746be75d37469a68377fff551fa7152dab6b9b7fbdba4

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Consecutive

                Filesize

                32KB

                MD5

                6b3f9c7ace7ee64693b72a77af20c47d

                SHA1

                f798c43279dfc29788ce55dd350ae0f37dacc3fa

                SHA256

                5baac678570f038fbad9b5616c35fee86f7ec2b0f119cb32e1ac56bb684d5ffe

                SHA512

                8f464060f35af7da2533213c8a75fa8f51ce7234f7aa6cd45a4b3fa9032c5968347d644fb295d520da5ab58dff753665dc422d067ea05afb8ba265afc9ffe2a7

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Cruises

                Filesize

                58KB

                MD5

                1d87db2eebf4f5e1eda143dfa79702c5

                SHA1

                5c4cf9e08017874f8d67eb4c6055887151154123

                SHA256

                3e578aa5088754cb3f1670be5da189a6c2f033a03fc190497e466df86ea00085

                SHA512

                8654309985b636f72e03b6be306eec8f60b7653100638fb3cd62934b07ebe97bf70d7840735783dbc72173a3a19df0c27a7cf6ed1ae0c8ad14329e4e5a3028e2

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Deborah

                Filesize

                102KB

                MD5

                5c65f3fef13ee4f29524348df360fd53

                SHA1

                db9bafa78834892037bcddef97242e9d6af5bab8

                SHA256

                62893a7db6a90e4925ca63b0d192498c8cbcbd6a25f14afd45cf2c46cb4455a0

                SHA512

                5ac644ff11222c3f5c1f31618dabe66fcd4742ce1297161a97a823f29775de1141a7d19d6a58f72c426e82a2fe316ba6aa45ebaa8df847b827d614af57644463

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Double

                Filesize

                60KB

                MD5

                10e8178e6e63a91759ba1bc2080e6686

                SHA1

                fc29861e1b2603eba80f7fb4bb0ee3768660b8d7

                SHA256

                68b055a99affa72b2237fd69acabdff1e8858f9c7e5aa56785e1ad2d38c369b3

                SHA512

                30a085e7bbe2d58e71884003eeb42c3035fe9c8700386fb1a0a4ddc5c843f150aebf8cd929df377d1796b8f6b4c004ac93ef5909e455831ccd56b0c92cecad0d

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Emotions

                Filesize

                20KB

                MD5

                8cf7dfaf9339fc15d6a3cdefb3998321

                SHA1

                f429e3da767611bf35c1e3de3acc80dd1dead675

                SHA256

                fc9bc7c616e69cd3154abbcc48e8b9b55857b523704843a9370b07feca39d635

                SHA512

                a1f5bf7779905ce20df7aad454bbaa5863c0a9f44af3b6a5b298a81e8f90781deaf3307a84741e50454dbe29625772ac4b41cdbebf12a83b01d837b8cf6b0baa

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Experiencing

                Filesize

                75KB

                MD5

                d108e555d3ecd10773c250b467c58b54

                SHA1

                36c46df4ae364f72283988aa6290f1ed603e8a3a

                SHA256

                0a462da765f3f533312d9135e4efb9e82a9c57a6b872c9a0b176ecd396b90a9b

                SHA512

                9dec2ce1915eaeb18528ec07e187e55536796a225b94abe7e5a84d925e6c981ed512b6fdcacd2997c410ede0d49fab600b2cc4c99e20edb07345c6b25e28a755

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Favourites

                Filesize

                9KB

                MD5

                67e2aea94a166a0aa96fcfff3e6a3035

                SHA1

                88c8aa2b1ad29a7841d3112eae4cf7abd83d35a7

                SHA256

                5fa0236503220c39ffe423dbca181a1d3ec1f057578825dc5611ef768471483e

                SHA512

                83921500d46259f0cf13fc985ec3638b7aad6658c315ab1798e38dba496e3f56831b2b5a72c9b7b4f74ce93694f96cf39f5a871aabaa2e0d8679b19b9394a95d

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Fighter

                Filesize

                31KB

                MD5

                dd3d3e9a13dea98dd1cda7d96cec54b6

                SHA1

                c6f3d3d17ff045e699946a064930d2feb655179b

                SHA256

                7549f09c496c38b32273ee2ff416e0e00faff1f82dbd56cd15c323b27b9925d1

                SHA512

                6e816339b983c109afbd7f9d7898837d35ab0a98443c9371d314936661c3bb975c2123983e7163a59f1391a870c8e34a689a89fea87b84ba8eb74f4984f37f60

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Flip

                Filesize

                77KB

                MD5

                e7da39cbf58edec2e08fbba9f188e262

                SHA1

                1555950626f851641d95d03ab630c0d2306a8e3c

                SHA256

                ca833c746e97861dd3fde5cea2e5cca017fcb969f6ff0d171bb05865f414b8b1

                SHA512

                73fc31a3a3d88e4ce8131d6d37a0a45fa5b038fa31b9e45b28bc01fa4a7f52a649f86eba6accaa968be36f3e0782ed8a1958cd66c5e7bc2b70928e6a660c3241

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Genre

                Filesize

                29KB

                MD5

                e7af34a3c26494aec5a0ac18c7fc4ca3

                SHA1

                b5cac23c66c7002d6af40420c3353b26dfb3510a

                SHA256

                3572f701a9e02b7c0c50c598b1b94ed5ccb7144aaba4eb325b7ef51f79b2281a

                SHA512

                707c9996ef4f2203123244853eb853496301b5d45ddb8c10425764d0614ddfcf438444143ad76bcf0293d9412fa368f7584cb40d07a21f7c38a40e62aeb34eed

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Hayes

                Filesize

                63KB

                MD5

                bd54472639af3ae73cd0275dcfed9f56

                SHA1

                f678b85459fc0e06c6d435457cc6b0aa6d5bc8f7

                SHA256

                691cc6c68cc841dafbe8771d780040a52178113194c3aff2b4b63c6c2cf66fe6

                SHA512

                65f1efdc5776272a7d7748a1bbd432c3797f793ce3b8388686b5bbb5dd8ae56263f4685cea423ace18a12ec6fcfd3b611d228ceeed4e84f393d9037b3204a978

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Instances

                Filesize

                61KB

                MD5

                efc96273e79927dd1e1a7708d7dcea1e

                SHA1

                d43c4e23a0fc00374498405c54279115f78751e6

                SHA256

                09e0d89952c2fc781fc53377d268d9a3114128f3428682e296482295678c3ad8

                SHA512

                f0b70484bfae39fe794fe7921cdc0c731278d0a3f6a5547a374adbe535ea6d9484be7a4f8e6825ac9e5d7137580b1a488a0d0bc7ea4047526a12e7c0313f6b61

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Involve

                Filesize

                81KB

                MD5

                d5b97d48f2cbb21e8c19fdf3890b6742

                SHA1

                972b0778a9ecb321459438ee4c36984fe3e34b2b

                SHA256

                4a5affdcff2260d0ad22d353cb5143c141e2efe1d8796b447c4e554aed8af788

                SHA512

                214aecd4d3e9dac5b30a13b505f53a00e9ea9f674a1ca72e6a7f29fdb5a9206b9dc92f200414e80cc0d0b11ea2ddcd1808332aa04640564c95afc62cbe26a34e

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Kde

                Filesize

                67KB

                MD5

                b49b33e7e124632b5838314cc3e513f4

                SHA1

                ff002f5651692e53e0c130592abf1ad1458fc9dd

                SHA256

                9f3bc5b868b211989b803dc84f59325bd0296901013146b767938d27d0e047b5

                SHA512

                df8c0d81e07bc0a6edd480b478538660ccb3a3f03fc0fe52ec41d90ee47c29f50d5fb66764c42ff2736030f346ee2a7c41b8ce9fbd15dbb9b33a1889ac2dea83

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Ld

                Filesize

                66KB

                MD5

                87631f56dc8157496122b57ba2377ead

                SHA1

                9c83a22307bea3eb4d5abad9e783838e5dc44ec1

                SHA256

                a9969381ec4104116836cd60ba8c671e9a5454c24c14f627fbc8155499fff8cf

                SHA512

                2c541c9c914dffcdca75f10ab372a3d31cc145589fcc005bd35c701017ffe4806e2402e7e2aaba62558db1121da2ff16bd79b0cfa5f7ed0b2366da5c596c6923

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Old

                Filesize

                51KB

                MD5

                7ac91c3bad87a7706aa7155b1b3bb6cf

                SHA1

                ed7f4d3682757c77bf321c4b94487f54283f424f

                SHA256

                8962f54664f836ad448edd4caaa17872bf7c2a2fb8ad2330a4bcd4723f5e585e

                SHA512

                0bd521e112431df8cc1b27fa3b1706782681058053eee5f82c83718c968ed76c9ac0f38bfdaffa32ae7b4201ca4c07f7e53c00e59f8d476b102f221f3cbf117b

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Participants

                Filesize

                227B

                MD5

                8ef09993bc8ff43a1a9df856588a5e1e

                SHA1

                de765c7f5bbef8cc7ba2c5b342321ad2fc0f9e54

                SHA256

                b793d1d5516b64c95d31e5c279723f379c027de0d1a34c5921c7a865fa861c5d

                SHA512

                b5693f04e892dc974a59338dcabb1c3f200276a394ad31d72b05ba40a7c2086055e1032b7a5e5bbd284c3c0051043089d4ffee6021bc17819493cd147c4b5851

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Que

                Filesize

                69KB

                MD5

                566cf1ce94a72e230ed75eb9b508a83f

                SHA1

                7afd81066df7dae56b233891b5753375f4d9759d

                SHA256

                d8c1590aa74819bbbc91fecf4eaacaba340d870b824ee994a80054367e072ef1

                SHA512

                c550a9709d365263fd72918edf022ba4e311e59b00329de91bd3afc176e77328c512f0c627f8ba219e08c261565e396800702b9e5df4833f98f67d0f11681480

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Race

                Filesize

                55KB

                MD5

                b525bbbafc7c94b9d6ab704dc68623eb

                SHA1

                e29a83f0050437d9dda757ca576d7758cc9af7da

                SHA256

                2a3ec604d4229d6b21c8db3929afc8b91a1ffac4b80c6bdd94bfa201094c62e7

                SHA512

                9f768033792da03eed7a4745a31a4c45003bb98fc19e0034577368727fc953630e8a5dede5762aa0319b8919e827a38f0d2eda3b926e52e2ed92ed1cf4bc5df5

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Richmond

                Filesize

                42KB

                MD5

                eef83d457f48bf96aa86b995a09ebcac

                SHA1

                2fa30dc1c1041edeff99df28f504ed4dc8dc9de8

                SHA256

                3365a44dd04e1aa21d73e772c03aef5ee16e1a26a89cb2e4d5847745e0b96ed1

                SHA512

                3eca01a90ccfcadb1096c2e65a2a5546a032d93be8c986c28d86e25658231d776bdc01d2960ed63ba570a4830806f47d875345c8e8c11275bd903ea0094281ff

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Seek

                Filesize

                40KB

                MD5

                9f111d39205451939f099fbb3f279c6c

                SHA1

                5cf892d99e4770969c3cd8b0f973c42b50ba861e

                SHA256

                8e9665f779eb4d5988e40f79972e9e4a2f31ad29e8c3d0ff7c80b5112d4e668e

                SHA512

                a6b7adb29dc5b16b1435d32a7f8abd83a395b3958262f0e565d987d481b8e97c2230656ee3476893bab3133b96e4d7f9fe4e5fcc289e7a7167b8012221a03721

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Tags

                Filesize

                20KB

                MD5

                e9f7775034ba8e343614b1a633195a08

                SHA1

                d8ee525b70a5b6edf5b68bf7c89e7b8bcc6605e8

                SHA256

                410e6f30105f54d20ada2609a547da8a2c2b749e5c8ab718e170c5d1a84736fa

                SHA512

                f8604b7834e0806bcfff36435951f707ceb72b998142d48cd59ee47581477bc06c567125945d9daa23f1cfa9dfa4d2dfe557b68fed187af65e4cc1b7f986e0cb

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Terminal

                Filesize

                55KB

                MD5

                a1dbfb11bfe2a787419b94b8a3de71f1

                SHA1

                862209127532a91b69cdd4f8e39d43eced4780c6

                SHA256

                a49c086917c6ad9dabac6b353c30fe8bb638642ced133378f78e4f16dd12f987

                SHA512

                5fd74f1e9fac8650c3915af2663829917f8a0af4d759439f2da365ba083809de1aea8e10e865973402b202dee049fa0a7baa5fb6c6af015c44c0a86c4a855fc5

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Tokyo

                Filesize

                30KB

                MD5

                d9d072d6b2339adec85444bf6eb7d160

                SHA1

                6c28d87493ba97b2348ac34ae9b198853128bd95

                SHA256

                106eeaac9a87050a7ebb3bc20fed652b6e1c63749f602ec847ea818cf1d2441c

                SHA512

                115e35735be6d36f7169a9013da5ef0a2ada27dd6e279e786994b7c6e80ca7654da40c3fa091dbd766992c61f0b4ce9293077f6e1bdab2a6ae2bcdcfb1bf29e1

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Violence

                Filesize

                32KB

                MD5

                54904a58a31a33ca92955f41578b9ee1

                SHA1

                27f9e185e41b09068bd429f0b27c353115bf71e2

                SHA256

                2da372855940ccc1f1348d90b4da8eb02369f22579d82acccd1576cc8116bb05

                SHA512

                77a9ed9ddc33c62edf32c3853b97d5d7d05cf15d91c7f0fedecec7d014b6e7f772056c95c7674e35bfba8d187e3cb75f7c215b189a9325a0b6ccd1d1c28c1a2b

              • \Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\1141\Buffer.pif

                Filesize

                925KB

                MD5

                62d09f076e6e0240548c2f837536a46a

                SHA1

                26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

                SHA256

                1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

                SHA512

                32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

              • memory/320-73-0x0000000000080000-0x00000000000DC000-memory.dmp

                Filesize

                368KB

              • memory/320-74-0x0000000000080000-0x00000000000DC000-memory.dmp

                Filesize

                368KB

              • memory/320-76-0x0000000000080000-0x00000000000DC000-memory.dmp

                Filesize

                368KB