Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    05/05/2024, 02:41

General

  • Target

    159d0d43bb8ddacc4d4b0496bd52a0c6_JaffaCakes118.exe

  • Size

    1.1MB

  • MD5

    159d0d43bb8ddacc4d4b0496bd52a0c6

  • SHA1

    e0173a13bd473da9186654e092fdfc48cef93c2e

  • SHA256

    38fc4966516248b6396d8d89797975c001ae106dcfdcddc3687a825030195177

  • SHA512

    93e8ae8e1526d3538ba9b89160e3206eaa57455cf2ff83d67df28f64aabfe7d875cf73ebef2f79d18184d7353fef99f231b08d2ae467695dac502595445ae2cc

  • SSDEEP

    12288:HsM+aTA3c+FK1vrlVYBVignBtZnfVq4cz1i5pP9kPQyQ:MV4W8hqBYgnBLfVqx1WjkfQ

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 46 IoCs
  • Modifies Internet Explorer start page 1 TTPs 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\159d0d43bb8ddacc4d4b0496bd52a0c6_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\159d0d43bb8ddacc4d4b0496bd52a0c6_JaffaCakes118.exe"
    1⤵
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Suspicious use of WriteProcessMemory
    PID:836
    • C:\Program Files\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://search.searchfaa.com/?source=bing-bb8&uid=95ed66a2-a468-46b7-8fcd-94fa26817799&uc=20180115&ap=appfocus281&i_id=email__1.30
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2612
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2612 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2560
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c FOR /L %V IN (1,1,10) DO del /F "C:\Users\Admin\AppData\Local\Temp\159d0d43bb8ddacc4d4b0496bd52a0c6_JaffaCakes118.exe" >> NUL & PING 1.1.1.1 -n 1 -w 1000 > NUL & IF NOT EXIST "C:\Users\Admin\AppData\Local\Temp\159d0d43bb8ddacc4d4b0496bd52a0c6_JaffaCakes118.exe" EXIT
      2⤵
      • Deletes itself
      • Suspicious use of WriteProcessMemory
      PID:2252
      • C:\Windows\SysWOW64\PING.EXE
        PING 1.1.1.1 -n 1 -w 1000
        3⤵
        • Runs ping.exe
        PID:1744

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

    Filesize

    1KB

    MD5

    55540a230bdab55187a841cfe1aa1545

    SHA1

    363e4734f757bdeb89868efe94907774a327695e

    SHA256

    d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

    SHA512

    c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

    Filesize

    1KB

    MD5

    3ae9b6b5aa139f59a1f74a830b6b0111

    SHA1

    0a629f5a3aec95f8f101ecf8bcc66f4ba6943b32

    SHA256

    07d7d65a9b1c7e3091748bbcdf13dd652ba6763c5fb35aa0d4e9ca79a01a5814

    SHA512

    6e966fc893bae0cf693f03faecfec08f50f32116f2acbb5c6feec609274e073f2d9e5a8cf2e5cf2615a057f459737a5d0ac31abe3056eb1a4479512907450128

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    914B

    MD5

    e4a68ac854ac5242460afd72481b2a44

    SHA1

    df3c24f9bfd666761b268073fe06d1cc8d4f82a4

    SHA256

    cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

    SHA512

    5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4A9377E7E528F7E56B69A81C500ABC24

    Filesize

    889B

    MD5

    3e455215095192e1b75d379fb187298a

    SHA1

    b1bc968bd4f49d622aa89a81f2150152a41d829c

    SHA256

    ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99

    SHA512

    54ba004d5435e8b10531431c392ed99776120d363808137de7eb59030463f863cadd02bdf918f596b6d20964b31725c2363cd7601799caa9360a1c36fe819fbd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_9487BC0D4381A7CDEB9A8CC43F66D27C

    Filesize

    471B

    MD5

    83c3fa352abba94a88989b8e7705e15a

    SHA1

    9049c8b677d4ce982116ea12dd2f3225935b7d41

    SHA256

    a1ede8fe4928cfdd97977ac0f88e1e07f137225ebf1e9909e475d330825c4e3c

    SHA512

    c594bab218871be29c240c87f7c86a02063255e65aa5d09c74f8cd08765365f5e93bde8b7213550a9db7fb15e11f79129e5f3cbd54cbd81fb74400af85ccb5e2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

    Filesize

    230B

    MD5

    ef6ed139bcd0534efe9ff055169e023c

    SHA1

    7d86117a5fcd73663debfd61d0d98990123e756d

    SHA256

    6ef36f0468870f8e9d3b429f89ef2544cedcfac734a2f7f771534ec1fc71b921

    SHA512

    5900f5c5d3c51462e3c34423825379658abba525b3c965c002c3fcd9d94af4eb96eb265c5472177b9fb59b245863a4c870571f7cc54e7f5d2515b6a3f29b47fc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    252B

    MD5

    67a1974ab8bb9fc6f65772cdd8cdf4f7

    SHA1

    e25a1f9e7cc1ea26d7fc9b349b5bdd29efe4dad4

    SHA256

    7909820c16d9236eb21195cdd139d9f7b513a03341ce21b97adc8069807a1db5

    SHA512

    729ac106dc406eb47a5b7048fda02503a2087db7fdd0450f5c8e8cc17c564a849187019d276108a236a188091b268b9abc91a18f8efec4e6b5efddb7bb1f329e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b655d05d2b10055ec98f22117f0621f3

    SHA1

    89aaf9d4db99ff1502060e29ed24b9f4b5a535cf

    SHA256

    51744832be86762907a67f3d076732f53a52d56af6af578f464d246a71adc821

    SHA512

    28d2a6d22d3a8d17b6867b858fd0965da533f90a4a77b1822b04c30307808a065881a64c0c547e6f649738ac468947106d8769f2ae4227a16171b93412d2a572

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    1fed77e36fd07e9350a085e9667b8274

    SHA1

    60d87b77f1638310afa4f0e42d3c3ca6467146b2

    SHA256

    fd161ad58561a20a38bd15a07f09c5c82d5f57b7ffd04578aadaa8969f1a3da8

    SHA512

    914acef77daf0766cc2193661a50fd17994ace51f209d9b3d4dc3593cc9c8ab1aa67635ea9625cf39747e489dcf7884db71f067baddd9c102f0c8db3d4463335

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    68d2ce07f10fbad38bbc2761ddf656ce

    SHA1

    00e7046a256fbce604b88cc5594347bc7daf1453

    SHA256

    f1fe7018e08037ed58ed1cae1b27dc23943402f00ddc3c523ff56141ed39daa1

    SHA512

    896ee26e1975e34bddb912772c036de467c6ca5100964d3e4f7fe6d93de176d5c4366897fba512615d29b655cebe6f217a69fe4d31e9c9d570b97f2cf7f1c340

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    1ec971634f4cb960f670f1d97ef10e46

    SHA1

    a3309b12f240f33b9941598f91520656341dfa57

    SHA256

    58ef7aa89716bb12d8a5818abe03443d52d1c9227316a8ea93ee8b0ec8b925a1

    SHA512

    cbc68596873809e72b048ec7225feb35f998391777ffcb48ffa2572b855344c9435d8514680e75450c7371b560313ae9ac7fcfba7f9a235b26f6fbda6cdf8a55

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b9adae54efe15598011f119b6d78a874

    SHA1

    d1cdea647d4dd149892db3d9fe65bbc57317271f

    SHA256

    ea6ef84b7ce856f1630839d2211ef4cfe4ed518383d69678577d8596c52d35d4

    SHA512

    769f036425c3c7bf22c6f46d8404196d985c84447c1163e2e821268c10977e8fe1c4f22a17779bac5c0df8882a4da59921e9c6625f22d83eac88efffc3136a2e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    7feeb26daa4bb2f5ce7f94eca91122ca

    SHA1

    5965e9e20291a8f429863c8d8a426768a72824d7

    SHA256

    0deee969ea6bfd022aba612f232cf653d2e0f6b139aeb88986dee92564f0f0ab

    SHA512

    9433f2cfa1aeaa94ed938101df1b8affbbe8a6cfc1db3eafc96bb1aaa734f825ad2b15c02ea62123a48ee77f0d607157a536b6507e8f98d2df65dec8dd8013e8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    5f56bb99824b9c80abf18f698595e66b

    SHA1

    9daf47c00a883f9d557df470e74405eecf1b4a55

    SHA256

    184223e6ecf0dd0df985554c393b65a2c2b08799e140191494e69e1a3c061208

    SHA512

    01c231aa1fc853bc7cbba3118b4c5e912c9e4b1f0413c1fb0605b54955e65022f2ecc672b2dfd3519a21f601c1a4671e0095c9095c9b41aa51655ab414d224c6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    eda1cb38eb191e5f8c1f9ea00f337c6f

    SHA1

    d2146c29a9b333701da262b49b8726f58d4b4661

    SHA256

    c839b88808fd12eb4877c50c65bdf415eada54aae8f3ccacbd6731abb532c6d3

    SHA512

    40bf9b47369d06b6cf3aaab2a7bb05eccd24fa33f0a29b2ebd67eb364b7a66a9db2f74bcc837d7d211e7849dbcd3b1c1a1526be40d0ef6cde6466b6128a2b6f0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    e5a889d2f4cfd38f87a70367cfb35fd6

    SHA1

    e7032e2cbe6adca369a76027dcb3a255ce464ed1

    SHA256

    6988f76fdb36d8153c925150585a38f065f0cf9086b2a7811d7a99285c9787f2

    SHA512

    e7ee181963e83b4d4a9ec9b25d4d2a278d595622d771ceac63df4d1ed6a3b33f42a8596fc3e8979d37aec2e4f036c1ab76da93f4c5bd3aa1f5df187fce49059d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    9356c964a4d8ac9d95572aa1e4c6e1b5

    SHA1

    cd2f0487e268fb0836590e15f4a30760501931b2

    SHA256

    329b8592e0df986d9a2aa8e301e323991fb0f3a2b1c1cd5648140ea5a7096807

    SHA512

    a6ece5af9f328b3355c556000e231b3cef8f330920dd99f249eca0bbf6c96df16d31eb27bc998ca646ca9a73b39e4eb736b076ff11a25d3a6e14a34b446ebdec

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    821a5d633657d2d73730c4f4c162f157

    SHA1

    83ebfff1bbe7851d1c392aa6698eddaa0ee0166c

    SHA256

    de970c0817c8186f4005c8b9040588adb7f06178be24a826829b4921e289715c

    SHA512

    a62a3bebedc6dfea064a44f3bb7155229ef6ec3e7ad88485a80ba0cd095eaa6348b1f2d45909491ecfe988348fd82f0272540dfc09e6fc3797b87fbb60b5fd6c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    7524bb5aa1756c5bf5b4178d5b385d86

    SHA1

    05a0980301b20cb5436cf61a9512b9908e309138

    SHA256

    37c39cc804421a435d7bc5d2883a9a9256508a42feb5a35b49906dacf843389a

    SHA512

    61a01aebff383018c24df052352b142aa22e5c2a77e4e361baa99cda38facb6c052d5942e350092dd641f49a97ab2248ef6570e94e70c258c3dd01b9d9a8ebc6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    4e33266f86a78050df8047fa5adc458a

    SHA1

    15cadc2a0eaeda4ec26f5128524df7384eb29001

    SHA256

    4186f369b6c72c9ce5b14a8d3721f1434f9ab07732c51160e7e898a92e7549e6

    SHA512

    b60ae03a35a236e219e24182ff2b33a7cfe76124d354316b9474ee8220984341a8c030761e9453681c19e85a6057ca3faeab17eab89e4aa11910dce700448b57

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    9b31ea71f92b47fdadac2955f0fc10ca

    SHA1

    c68af47814afa006a112befa41dc14e21fe3a0bb

    SHA256

    12af460bbb059e954625007b493d84174882944996aba24195c19accdc8756ba

    SHA512

    d89ecfbeb9bb0b4128e26699b73dfe9aac448df4fe750adaf62fd7477b6f85a5d7af1b05840a6f3cb40eb4eb6fe5ad250f8dae1f4e88769578bc66e7bf702220

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    97109674f56ea00e49450fb4f964841b

    SHA1

    1bf2de1bd402de7b06aac43b3909e800213324bd

    SHA256

    a560a3074db102265360ece22b0638f4b223e9f03e90bb88eb459a57318c38ed

    SHA512

    9a47662330213abfdae41435261fcc9cb94dd0fad95b06498139458cfa25a7f0523c6bbb057fe875baed6a3f575180589e2eec94d334271afea997adb8f06871

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b5578b73111cdb620b9faf4d8d2ebb8a

    SHA1

    e5878093733dfd2b73cd563dd26b847a60d28c97

    SHA256

    ac8a3947485dc8fb40695f4841a3c4146649df72d82870f401f3971877680054

    SHA512

    41e8b4a1c476cf54f447b8fd79ade1cabc1c72779d6d9afc468985edeeb7f094570163fa8a17a7ed808e4cb4ff5d8f8d55576650692ecd1b9125616bf625af07

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    1b277f7607841b264553215321881338

    SHA1

    4eb6acb23c5996c15b028f422f4dbd46628fd7ed

    SHA256

    2138c78d99d99f01460c99371283091825a14c0780b89418aa893a5df4d6077f

    SHA512

    91312328d7dfbda22f8ecc48341291060a91b7bf7edcc9de309d150c0dfd91c659b64084ebb618220701c918e9c9a1c83f35b22f180a1b6b25eee0a956d7c4ec

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    cf0b37a0284665d051c4e97ace5e622e

    SHA1

    42d3fb7b97bffac9b0267202c4489489a9e944b9

    SHA256

    fc4d4fa355a255396776399e770f0b5aa6fcbff4f270663088138d24cff4e7c9

    SHA512

    57933c8a661ba3dca0ee6a89688c0058a51e117abd3c08ed4ba3d4c9b7de3906fefa08609a737582f6eaa406db5936658b254d5de1fed007977142bbbf26cdb7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    39a29a25037f9b7ed8394cfe1c293b7b

    SHA1

    a3740814c397e881e052c154279b6fdd3cc6816b

    SHA256

    6d712355c51fa8c9d954de9030191176e86e09d5410ec0a2dfb7c204d4aa2ae1

    SHA512

    18739a7507bfb63d08cafe82d0c475a7f204421ff07ece68fc6c32e493fda84f17eb3977debfed1faca7fa0d9addcb1b87bc9a1dd7c596ad099713fc40aa4c6a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b5c6d0770baa1ed3b846a206f4662fb9

    SHA1

    52bb0bbbfac470dd7aca0794e60a1b464d041666

    SHA256

    4a1b93780e60556e48eb020dfa93ca6eb4ad4c4a176b3ef4f6aeec9afe797738

    SHA512

    4549b761305b805e663810deaba611e2306e812f1d5fbfebff0a36ba8143fa19911b8a2f990550c5f3a69a559b2d9a9e0eba332de27b606afc4ce9f1a4d0b714

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    55aa4dd51ef1d9d354981866d8f6b384

    SHA1

    c618bf7b7a6e438a44ea738ec00b2b1aeade3bb9

    SHA256

    b32167980afdfad34867b1235632b4dfbf96d48562678c36f1af11606b736eb9

    SHA512

    104623a210019dbe64d24f50f310520033d0c60de4188412a5af33c803ce2a01f84e16b76202a7a438b7a90a976507f4a789500bc7c7724261d52541a55a351b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    e062f273277647e82511aeafe3af9a85

    SHA1

    c024b2eb1a20bc794e008c54c073ad9c8427436b

    SHA256

    20f3c22ecda4b2b6b9264ce4cf08c80a4a3c7faa9c09c97782f75b5a8f92155d

    SHA512

    e58004c891d37cd6d0a0fffb3f0f0f2ad50790319cc8edc679dd6d7d2d8e5a4f206ded4b0658a25ecaed862803bcb25514f2d598dff4c2936235babd4c01ae4e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    d2b6df33e8e327550dc110413160dd22

    SHA1

    0594d47fd1793e97523df5768c9b71df41175734

    SHA256

    946967f7c68663666a0d55ba3fc9c2272aed4de64c9da554e55e29f634ecc595

    SHA512

    939a63f205d3d22d0f574a15c3a6909d2040b692f5a282ec8e2c1f4eb9246af35dd4e1836159a5878fd6488252a2dcf0fd83c1a7bc1d978d390b5c2d9c1574df

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    96c1191e0e8c1ee752185e56366d2f12

    SHA1

    8e38a337fdaaeae8e20f7745ae1b91252d6d57bb

    SHA256

    e7fb62cd13c163ede871599a85aa25d6680665f1d9c00671aa4aa28d2875af98

    SHA512

    eebc5430458ac3fc8699387054f669ad65c93c6e88ec4c16fb763f7186076be2eaf311689e700ef7f8676197c582d073a92ec41424df7bacc560506b5471d04c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    e05fa0ca6eefb78bfd86b1cd3618bbe0

    SHA1

    f0c51a41dc29d6e821d56060a121984a2760601e

    SHA256

    0162c025791afd3fd273cc8b0d8559d8cdb71fa5bc7ef2e5a57493af1c07d60b

    SHA512

    ed8641450e7e9673b5c92e8932964f12838ab4e86cc77ba5d5e002315bb3debc811d7e21257bb13e03366935165987cdf42506079b11f6d33e09c9568481355e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    7e534e8ab2bf9c3e1d6e4aa89cfea518

    SHA1

    20a9212476a2a1f508d9f53135510dc6b8e13259

    SHA256

    fcda5b21c9b225cdadcfccc557b057757f9ce121329f410949bbb08db4e8b22e

    SHA512

    f26451c8f8533b9d2f28ba85a8fb8322bea031ea8e45d95430a645bf32a64971819f882efd9f6ea55adba7ce8a99dad2b27f2b0dbcbe9f6e2c8d6015e86ef7d3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    956ef60a3ef148a2bc7b538c9710d431

    SHA1

    c0b36094458914fa43da24ffce14a7b2056b3eac

    SHA256

    32b9bd9d9cd4b7bcf02eed7db11bf43e295b7fc9f180ccf9cc8fceda2e200dff

    SHA512

    78d617d82a5e731813ef8a86aef8eb32083f2ad4ac5aef474ffbb8b6356deee7f6c1a678eb33079f6e68c2dd9b11672b1c2f8528e413cfda494d9d0af04c4ffa

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    fd822446ec77e22cc406586b4b7aaa97

    SHA1

    196482048558b6138d35ebce90c9ed1ad08adb19

    SHA256

    84184101de4f6fe30deadfd208a51abf340fcf951a5b9d10f3d3ca411381470e

    SHA512

    e1fd32243fe2d2857f1effb57b934a90d4085717814ff129cee15c30bc0fdeefe1daae2334790be7bd57c2e70c36b192a688da9de7746c71c54524b254f81c2f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    bc10e85ad636a7780d1a65cd106f498f

    SHA1

    3be8ce1d4ea277a9e710d0e4a84c2a4e8abb697d

    SHA256

    b9f5525d3cb94ad5498039d9192431e978a60775a8b662f60e238ce1d13b088e

    SHA512

    366fae74c6c1fd61dfd9e7d0ec2d4551100f9a130f841a078104797fdbd0a7de7bf186577f4a99656aa80632dafd79d24b43cc6fdd51564877ea3342c2651a24

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    4291be685f57c03d6659eb21e742eebd

    SHA1

    bf4011f974998d8accd9b371b9b47a4bbc8cc94d

    SHA256

    6271b3e1426f0b28de8a54947943d398e8804c0558ccd5920f249098be2a73cd

    SHA512

    31fce08c97efcc57ecf89d9a1b74a64afb5b29f577bad745322bbac06026bd3783437edd818e6d4b06f3fba51d527dbf49da7e499c845aa8e022aa8247d07cbe

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    4a298ca2c72f9ab3ba8d5b8b1650fc8a

    SHA1

    cd14d87ecaaf9ba767ed9d2f24e992823678fdd3

    SHA256

    ff38bf623aa3bb426a44d2acec07e5add23f0ec7570f1b90332094cdbe5d4c5a

    SHA512

    192382aa2504b3a8b43c060a6c6d88de13d0c54dd06fbc694ec364afd6bd909036f71a1dd5f16cd9300686ac8de039430940f793b51fa477f60f3c81c1c68e91

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    fad3b4619c24c3d45135cca2132d1854

    SHA1

    0b4ef02860130917d25ae770417924aa8e6afda7

    SHA256

    022c45efddda6a603f2b7919919c504d852d67319192fdf33eae837c3552a6da

    SHA512

    7da4cfb1aebb1902de388f2843f0f4286daebc24d8e8f276c04dca81dd64195bf6eab7f093c13b591c57307c8eb3702c6da9b83ada9ca19119baf6cf38ac35c6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    6491403497f1249bb928d96d89e5fe3a

    SHA1

    25ae9c042b14d161ca85a86e813f761f5065052e

    SHA256

    44a1d3f79b4a6039d246eb71a374e8173e9aee12703282c55f85000c01ddfa23

    SHA512

    2f2d13e4bfd2fec5e8e792b821a7c36aa0199a7a19bc23b5e539c1c011f6232a8f92eda5f948b95b0fdad075891f6bf7ac817c1df6e193f25f10ed4e701f5094

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    91cf0773435a6d580b1121885512cf8d

    SHA1

    0afa227d6f5fab5d84a4a03e8185aaca167e9340

    SHA256

    2c64a84bd42c92ae95fb8148139a248c6264bf8342eb711d689dbe1b63a904fb

    SHA512

    6abc7560c6242736351f4befd7a7c9a1eec925d8af4b8cf7d6ce02788671d430188ab8ec4d8d0b20da986f4e719dc4737ff95667d28f9ffe70206cb1545630a1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    cdb8ecd9da1b46177f31023c1dfa6076

    SHA1

    4fba03d49590bbd08dc26c86e758d4bc08165ba1

    SHA256

    77119cc37f223e1c3d0b0f82b9886c66534127a323b2def7cc8c4d9fec953baf

    SHA512

    0dd05eff960a251b2882730b4c8b575fff6193365da2ca8688366f70bd730825c6da4bbc61c4ef6bfb4ec4334886d055fec3b22b10e6fd65e1074996daa004b3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    da2ac504902891315797aa3712141d41

    SHA1

    0ab04d00a1dce2775611170825ac1a4ae6071f49

    SHA256

    91ca4017c66bfe310b8c73242ceefb9e6be9c3b06a343a491545dca5952763fe

    SHA512

    bbaff0fb572ef4ebee2fb2ffcc89eeede56f626b53f91cd0792bc853798f092635dd87bff6d22216cfdb90ae87e8163e4017418ae85e05f289883a1e86fd7bbf

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    30a2a8cafbecf126d54fcc9485ca6270

    SHA1

    c5d3e566d146feea88cbebd5670327e2a95c08eb

    SHA256

    ab82f247f66179b36b14bce32759f9ae229d40ea4d1706ffa836f7770b64db50

    SHA512

    9332e81fc8238d4b9540a68947f700d7f27326f8a2add6eb06bb1b0f7754f41828fc562a2c408e01d7801d944f468a266078f61ff1415ae988586be2b927e96a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    f471fb94dc576d567f3ec30d1cc8bafd

    SHA1

    cab86510feaa973d6cdca96af61ffba28d8cf7c9

    SHA256

    1f89de65ef003f02a0f99b670b10523105ed5900f72f3940cec50e4602021581

    SHA512

    c8e489b5df496e7b19e40ee1320a537774174e94bfadde09e63bb2207a1c02b8a568aee774852a6814ea92082858c0e72699da746d8fc1f632d6c7c6530c51f2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    059d79d4e27c5023e8c1c6457b68cc21

    SHA1

    dac5efcc9319e420942b33bbde6f60b984a6d1ec

    SHA256

    9c1e04b6e0ce146190a846612d991bff9b2d89db84434c02574cac567cb90152

    SHA512

    9f7957b6aac15f195a5b8b5c1a60be25b8c846a43a9c4b1bc2aa9ae615d08c437fa5f6a9852f6566a98ad133a3b1dbd17ccfa189f2492b6013665fd1cd6503de

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    51731d935c8ff9e0a20f7ed163ab1d4b

    SHA1

    3d485f76e741ecf55b32d4d4e12209052d8899d4

    SHA256

    72d4bad781fa78caa4c5f6b52d886403baa1fa593cb92670104ed0dbb7861f4e

    SHA512

    1747f40fa818ddb5bbd672bf3c9a42afd4cf8bdc38429805060bdf39903f3b6098f2f55114f06da99f61874adbfbd66a7264e4bd268f1328071c9d8744f2412a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    0a16d619d71d6d3fd52138bca8a66452

    SHA1

    63d65f717fa76227b392a8d2e62e960cf2dbefc9

    SHA256

    1d904414ef568a33d437db4d5f9774de5aa608270da98e313951eb9a60032b75

    SHA512

    1762b685cd6170212b75fbc3f0b7ec062e3a27de9a6c91d7850f8900649acced3d1db7aa3fc0c5737033f8f39cca1d7e091214751fb02b84d2557abdb2fab60f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    757c670f124d7390f8287f1bd7419e52

    SHA1

    77f76f703991cbd5fba2a8679c6bf2cf76d27e95

    SHA256

    91ed54c575427bc34e08f61147537ae56b4b22f0f9933a927cf930f0dd3d7c3f

    SHA512

    954e0707973acf639b8511005f5d0954be6378255e4f7764f2ed3232d77c8bc4111f9b2eb1f028a38aa6998168922bf5839c78adedf8f2179a7e312315373e23

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    81ffcf9608ff94fb1f8e475ae79bed86

    SHA1

    fed39a78893619036a604d981c8dc1171b0fda85

    SHA256

    2f14e2b75084170313d9afbaf9399ee359f5c8c8175bffc90a5e3dc4977baf7e

    SHA512

    83fc31f3668da60188b57437b87cd2b9c27b8987bee1d0bff1f6d920a4c6e8b2cc368079c08fb813f7fc407e2f6a72d272ed652c2c100830a1676d245a591a73

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_685A755F9E99B4D751E9D861DE8DDD77

    Filesize

    402B

    MD5

    51664baac5670dcc7dacd6f6b4aec2c8

    SHA1

    c82d6563f259ab4e4103e32fbf10742eae661582

    SHA256

    f078f3e2236ab5bceaf812d0c7a0b8b40b21886a751a4dbf832cb8179a1cc0ea

    SHA512

    51956b3f5e718c8c8aafe9df8fcf1cf1c4afe2dde4e65b60cabe74c8e206dc0eabb50d085521e30713477724daa3326bc5abfbc0fb1d3be9603061413673830c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_9487BC0D4381A7CDEB9A8CC43F66D27C

    Filesize

    408B

    MD5

    4b38b08019fb4c142bd4ec29d4ae6fb4

    SHA1

    42809b40170e6a94d555328c17cb1501baa79ddf

    SHA256

    fcc78c291dcf640db69b1cb1d6335e5e03722d8fc2376c49ec122fc2b4341839

    SHA512

    58ebecbab2c2e5d69e48649d0376b0c4a3ea596f53c967d0696fe6fc28311b71432f2e8034c01030f22267d2de61773e027c5324d02e8660fd684b305a92dd4e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    caba07200e5009da28ed14c7c8659fa4

    SHA1

    f80dc7ecac00fbcc45cc2cb0a60c0db3f20a081b

    SHA256

    8a4f963a7682e6a088f7db9c829cd7b6738bac7d76ae98b6bd0c095edef23e74

    SHA512

    c6562d894801a7b6f48f05798a660e4089d25297794eb1621e999706171466c47a243cff703c7270864fa09db294660cc59b40e161f826a52c20c9b4946cad1a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

    Filesize

    4KB

    MD5

    da597791be3b6e732f0bc8b20e38ee62

    SHA1

    1125c45d285c360542027d7554a5c442288974de

    SHA256

    5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

    SHA512

    d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\s8rbov0\imagestore.dat

    Filesize

    110KB

    MD5

    d956cedf7bb715a76ca01c75b478fc3c

    SHA1

    6a70f4bde287a2469cc7bbb201df943afc31b51b

    SHA256

    f3cf800ae3a11e9cd60bed440c1e8462c876f6b0fbdda19acac264354e1f7361

    SHA512

    f55739f6e2d66f554ca79954e2c572a86183d8f6d63bd3f3360db20e8c8952409efd66b638644959085f24dabffe0bc3e798fe9a5bd18b8196066263b5338896

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0C9THIPY\favicon[1].ico

    Filesize

    109KB

    MD5

    504432c83a7a355782213f5aa620b13f

    SHA1

    faba34469d9f116310c066caf098ecf9441147f1

    SHA256

    df4276e18285a076a1a8060047fbb08e1066db2b9180863ec14a055a0c8e33f1

    SHA512

    314bb976aea202324fcb2769fdd12711501423170d4c19cd9e45a1d12ccb20e5d288bb19e2d9e8fd876916e799839d0bd51df9955d40a0ca07a2b47c2dbefa9c

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D4KHIKUM\js[1].js

    Filesize

    190KB

    MD5

    dcd0dd9fc8c84ac3760d1dbdfe05b9f6

    SHA1

    c23b691284930af4b050db10c0ec82ab55f8200c

    SHA256

    2a191c935124259022b7fa749e435e2e2ed0d12e50ad494a6d29cc1af9e60d19

    SHA512

    7b7da8edd27aea5a3091c8c7b33a4246046e94a87884f3743650f98a669f4ca47c69a31416415cff6efeac777a01852517a7f03ec70263c770cce38cd7150a89

  • C:\Users\Admin\AppData\Local\Temp\TarB1D.tmp

    Filesize

    177KB

    MD5

    435a9ac180383f9fa094131b173a2f7b

    SHA1

    76944ea657a9db94f9a4bef38f88c46ed4166983

    SHA256

    67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

    SHA512

    1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\1E12MXDK.txt

    Filesize

    681B

    MD5

    9983a2beb109f968d0a7f3ef54748962

    SHA1

    afe6201dad80a8d00e61bfd5dd9cff97d0f2361a

    SHA256

    6f24552df621bd247e2a8b66f78637d1c9e527dfff058970addec85d98b273db

    SHA512

    09597a2b643dc7224171d124a7706d3f1aaf6a30408fe3b867ac20ee9f35a8ed479f29df1ba54923bc8f62702c7059610bec42033b08699ce25527eef079ddfe