Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    27/05/2024, 07:27

General

  • Target

    785a5956f9670ab2f02920ba15d02bf4_JaffaCakes118.exe

  • Size

    1.1MB

  • MD5

    785a5956f9670ab2f02920ba15d02bf4

  • SHA1

    0527b0936e8ee7f5c6da3e425619d1b8c2b7d3e1

  • SHA256

    d3ab6b282cdc39a2dfeee1762e4ff77208b76821954262759724695bcd939d00

  • SHA512

    737bb76d941d1b30d1288cff32039e07980fc0a8df73e1e05ece4a6d11a6ef0fbda0be97823f6c38bb88f3669b696c14a90d3ee5322040476d0cb523502f4c92

  • SSDEEP

    12288:PsM+aTA3c+FK1vrlVYBVignBtZnfVq4cz1i5pP9kPQq:0V4W8hqBYgnBLfVqx1WjkX

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 44 IoCs
  • Modifies Internet Explorer start page 1 TTPs 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\785a5956f9670ab2f02920ba15d02bf4_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\785a5956f9670ab2f02920ba15d02bf4_JaffaCakes118.exe"
    1⤵
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Suspicious use of WriteProcessMemory
    PID:1796
    • C:\Program Files\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://search.searchlen.com/?source=Bing-bb8&uid=3d18b65a-f7a2-4d0a-92a3-8486931ea973&uc=20180115&ap=appfocus29&i_id=email__1.30
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3040
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3040 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:3008
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c FOR /L %V IN (1,1,10) DO del /F "C:\Users\Admin\AppData\Local\Temp\785a5956f9670ab2f02920ba15d02bf4_JaffaCakes118.exe" >> NUL & PING 1.1.1.1 -n 1 -w 1000 > NUL & IF NOT EXIST "C:\Users\Admin\AppData\Local\Temp\785a5956f9670ab2f02920ba15d02bf4_JaffaCakes118.exe" EXIT
      2⤵
      • Deletes itself
      • Suspicious use of WriteProcessMemory
      PID:1840
      • C:\Windows\SysWOW64\PING.EXE
        PING 1.1.1.1 -n 1 -w 1000
        3⤵
        • Runs ping.exe
        PID:2440

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

    Filesize

    1KB

    MD5

    2b79576931f7278028f9fcc700d932d2

    SHA1

    84f199382ad7efa564324e559dd9d0586d518fd7

    SHA256

    990697f2eed9d44971a4eaeec7c0ddd2822c683683bec33dff51ac1fcc07b059

    SHA512

    1aaef7b8a3e8e5e9dbcca8daadef4951b1467d76c4a3cfb39328c5dc21431bf68bfb1660ba403a755504e2611f864a27847a08a5d3dd6b63c7489d230f99ec24

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    914B

    MD5

    e4a68ac854ac5242460afd72481b2a44

    SHA1

    df3c24f9bfd666761b268073fe06d1cc8d4f82a4

    SHA256

    cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

    SHA512

    5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

    Filesize

    410B

    MD5

    498284891c9f64302114d8985cc8eb17

    SHA1

    d7eed42dcbc90b8792fc8efb1fc3c5f6e4885ad2

    SHA256

    dc06794ded81b392454e62b9e2994e378d623cdd994ab472945d204e66a00f9f

    SHA512

    c8cc6074b0dafc8c205d3eb2fb863e9a08b42a969978a3ebb55bed349764e725a3135da19bc115422438c33b0d55aa295de10dbbb7fb6953babe6c30ba48c41f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    252B

    MD5

    947f1f757a01d30d92666e750bc55d28

    SHA1

    24bc9d7eddaaf6206e7e59512add565465b3e8cf

    SHA256

    c16333acb22e955d4dcc326f573ec49728ada0047db66f1136a430a4267807d6

    SHA512

    6db2ad1c505d68444f87c8df270e693fec153bd42bcb7b82f93542c4a74f33046a39ef0b9c81e30be7bd7a1f8716eb2ef3b53053e77c4e9f24b97142fe6b8bef

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    4833299c902eb6e6f448dbb3abcfbaeb

    SHA1

    bf7bf20297b11bf839b1585fb845f35a746b3c9f

    SHA256

    4f3489930670a0264619d49d1266378c35cff058f3f4f2e6d43ee21ab2a6270b

    SHA512

    4e7799d8a5c47c8e0cb172130580edcdf7161de0a4681325097f807485161b120f6caffdba314bf0022b584818a629dcdb13ed2b40ef55604a0ed43561d562b8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    4a1d7c010c38a88607aaf7f6ad99b924

    SHA1

    f5602fdfbea924e85e3c55719a77c6a92d1619fb

    SHA256

    4150a5a84b544949cc71fb602b681770dbc6214b51ab445ff38041fbcd1daac4

    SHA512

    536a2f10729941ca409ccba9caf0e73917a0adb66053ba3b24c20d9d2a42ba6cb7cf88525e25d48cff4b1abb6fa99d969546cddc24bfce76bff8e36cd61b55fb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    12b455bc23368a9cb2de32f4d9d73b71

    SHA1

    366b1bcfd8b8378e58de1a047e3c1734d7bb4a36

    SHA256

    d55a1a953013d618c4983c24fc5d2efb429f9bef251ab428d8d3302724952571

    SHA512

    13b6584517183115132f323a7a96a026f25421ede2207838cfa12301f9945299548ce485aaf702b7be42a9df15ddc89078951e700009a134fc1463a65fba41af

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    24e5647e480cb7dc556bb842973f70ae

    SHA1

    ed81c33849a32718bd4863d833e80eece8611d52

    SHA256

    4f0706e82d467246b9dc895deff6c352d259f54ac373ec08981f84a3c8c0b02f

    SHA512

    334974b98617779eb83ffa7f114ab3f8cbbce766d909e98178fc0f33ac2baac6a8e4e502ea83c0580a1ca7689681b9781c13194b0ed528119003cb51fbb941e3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    78156a011c551f04fc3e7421fd4b1943

    SHA1

    8a5a793f371f49b12ec6c5f1db6caea1a6df6064

    SHA256

    fa7ada5d2436b1c116620d58dd3a0be1f3d20d2b30f35ed090fadaf1c32f9117

    SHA512

    a60d2ffe5713dc7c70a280e6debba9cb5df80ff6032192d05641ccd23d0681a6b6bb7281f4709ab8431e38ce42d38165b91869599992b313d508b59d504bbeca

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    87d7d57870f716ff2bab51d9f1a4339e

    SHA1

    ac6cdbda7e239f9cad4d7339fe6d681772f44878

    SHA256

    d8baa7b3aae6f897fa478b6e91eb3add26191c1f4ae74b9a46d08d87b5332b90

    SHA512

    af987358a526653d15d5c059aace37097e451c6aebebb0e927eb1b72a1fc0e273222d4669fad98397b574aa4083f6d3f7d552a0febb454f731231315995b38ee

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    3b0bed5b5db8090ec11ce12a2d1a4ffc

    SHA1

    8228e3c2da42b7773f66fbb58840095f24bd227a

    SHA256

    689c282de59f4f6bad16f7f21916d946df8be6b6e41a7b07e94d720bd697575b

    SHA512

    60b60d43006d72c3ba1566584a24c6df7f594b5322ca8564c8988a116db996b76d2b4241219c725dfd7f369ee4c1669e4b1a01306dccc45020b7e28a74a118bb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b3565d5b4e102a1f321ee44b9b6a7c2c

    SHA1

    918ab5a1729c1964dd4a25af181bc173112f0a6f

    SHA256

    355326d4788dfa5702356383726f0bcaa01cda70831a3c270624c0b6d2a7212d

    SHA512

    9fcffeb2b0739dc22d0715369d8068f46695a63957ff14b14b900632248f37c22cc0321a9181623ab959f55a2ed7e3ed7c09e04ec25f6221d07b9255eb61aa74

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    2f1239d485ebbfec0d01c7db49e08e6a

    SHA1

    94a909f8e14d7b7a605d4945055588313b388f51

    SHA256

    bda59966a19cb6c3f5a07eed541bb7bda733da7679e4ab3677cb1b03c6d769f5

    SHA512

    32fcfec960d54ec00b14ae8f4835b11522da6f4a039c1d9b2cf0e915cf5c12373f7c534b35c0a0da8434fc025ecbafeddb5aa9848252aa44f782c3400fb2f4fb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    27312584e01378daa6d487a53762c998

    SHA1

    0e5fcf182305cbf31bf9fe5a1e42580a2f6f5599

    SHA256

    878da8bab38432512402be010e23d56de1b0187b742a1aa6d17c46e98ec051b5

    SHA512

    6d6ad31a621a29c20ce58930cdc06afbc51bfb541c671ab47ae54aeaf3e0f5e96cda9e2877a3cec6df10019655856e7703b501acd9faf2429918f9f21f77d487

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    fc3c6df1586b09ce29b84bb3d8875789

    SHA1

    19e528a4bb1b328afe3ac4f93e38ee5032b9b8e5

    SHA256

    1712f8a83db2e55237304adb0580ad2fee67393e806425b6647d8127866d35ea

    SHA512

    d42cc12229a732e6c42a3473023b7457e9ad3096c143e9b2b7ba4beb63a5568f6f323071bd94c291833229208c155073e609100d1c5fe68f3ff0bb3bfab2b892

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    920056146a489413edbaa6610fe7559f

    SHA1

    c8dacf88b2448e9b5f24cad6aeba11cbfa90bd32

    SHA256

    dda7fa9966b605bc577461ef7b352b018fcdd841d526fc497855c60c006f31e4

    SHA512

    f1ecd27ea2df08b1a0efe69653a9b87b1b0a46e37c08709835cf0b6e65c40948c40d9b05882ae4e21ad8d2d7f32fbe311c3c366bfb3f7846dd66260d29da7440

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    750f308f33f06a975e80c8e9a9c08ffb

    SHA1

    9ce75974b8d389e1cc113c061b52fd43b6d33665

    SHA256

    6cd80b58ed6b216ca8a10f6700606059bf08eb5033cc025a21cc7d78c8561564

    SHA512

    9c68137219e84b4a6050ce7c68a5406ee781b0c08c8951ae06d750e867e2ec19422f1f8e68437dc17fb67bc474784b99c5743c43ec35cf23f9d90f0dec62cee8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    f73502f15f1f0ba361d6f7d351d92129

    SHA1

    8dcba5d6487957d243ddd8d06233d32af800ad0e

    SHA256

    9aaac0b50e5703ea262ebfccb229ab49c9c9cd339a9baacf9a71fc575f0fb6c0

    SHA512

    8ce01efb17a165c7c7d9ee061c71bef47756983bea0d79b2cd5fbb63c17c726121d60f267cb90d0997453172aed86dff0caa9780e9c5c4fe63a4ec1be08478e5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b0eed0ff9f7a74f2b047bd3dd8794e2c

    SHA1

    5e80a5e929a44178d503a1bc8ecf037254fc8787

    SHA256

    488a6eefb0f28d7aa43ce13f0a0fcbabb98cfb1d2e8fa37d3309c4de518d0c40

    SHA512

    758f306acf03c94a1ec4dcc341b66bbe58d08accc41f087b798e2274e355d751aa2ec9628173570184536757cff8af06ad015fcb108a8b5dd9465d26df2dc8ea

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    f11756f592e9692aed8f503f3a28cb57

    SHA1

    f7403f454b8cdd318bb1b16f7ffcfb33fd5897a5

    SHA256

    049bb0da159c908877a740e70e62549c84abeaee8ab13d522d8f1a4f4556a40e

    SHA512

    87b37c63221e84cdea4191eb687d0fd46e9fcd3d6a0ba64856541262758727129260092e908cf7df58e958ba08f9f6f43257795f6099593f92e5bb6e5383ec54

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    3033360d55b3604ffce44ec218ea487c

    SHA1

    c1d91d07ca9886984283d0fc5c878cb5d17360f6

    SHA256

    535eedf10550c6771b88082d3f60ee262b06fa1a740e0b62819e62c96bca2bdf

    SHA512

    3672f48be13112fa1693f58814ca65f27f9f2da5f51854546be81969ad13fb6083155746fc621ca2d761a335188495154c64eadfac628d2057b0681c9e8be33b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    20bdb557321f24525d2de5ddc2d40993

    SHA1

    57a6ebb91c326716d76b6667ec21093bd5994b71

    SHA256

    21e9d97018b217b554c6f0b7a1d1853c256307211510a50679b872c37026ca3f

    SHA512

    4e56e24b5453b249be9dc42cbf8fd08b5d0eb207d5259eb4d3e7569b6c08e0f3c1a107b92e47eb9655b7b662aaa88fcf1b94c2177efe0c05084c33f691db2ff6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    ad3db446ac9479a6fcc0db6d0f555bd0

    SHA1

    0015e25c8094dba6ccf5610f4c1bc6cb27e8c1d9

    SHA256

    557aa5a9f0fd4f44f94c63db15679323d6e62906e95af6a37d31ee98234d1f18

    SHA512

    08ebcb6ea9e45c47fe237f7232ce900983608d1d3218e462a9a6a0462a57268bba94fd8ca8f98de7b9c1cd9589b53417ae4a869d87302752d397af60a3f7b1db

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    9bfd325a62878412628eb3617f53cfd9

    SHA1

    a5dcddefbe8db2b00e3665cdbd590f1852759860

    SHA256

    ad34355d3e26b0400060250f22462734697757521c925c43f51bbfe2ca0c2947

    SHA512

    14df099666045c767c498812df90960b993f5308fde997d97ff362ecf9cd786b72810696a8a57e89fabd731cd4eb05e0f0daa1935ecf6e2a2143e21575ad7be5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    749e7a7f3c536931d1dc313636c92369

    SHA1

    ddea003314ea4fd5a0496f68c52fd34050fd056a

    SHA256

    91540e4b39582d267082122bd8c89fc3688a3d8847f0bfd47ac7fabe08e86887

    SHA512

    cddf759c29be5488f416a4100092611cdd47c27ec1e4d18e57c7a37dcbaf9527cd96154dbaa6763d891149661e6e1173b4ae0c192bcceeb3f4fe26ab1e7e4f18

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    e702f1e8937dfbd1cee0cb346847030c

    SHA1

    aa500955f79e0dd07959d3451bdb21c7446baa4c

    SHA256

    272e421eff6ca8d234a0f77ca077f3f5e263d227c99887f2ef9a7cfd584c93d4

    SHA512

    456199d1da940844559e55c6668e041876959acb48502ecbbc9bbbd2850e54a184ee5d694fba9afdc0a6f6cd4e4c323fb05583038c232ea73988ab301c348d38

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    1cd0aa9876e71f5955f302b0c0a8e261

    SHA1

    aaaae746831ef0fca6ccf3b5ccc1169573b03f07

    SHA256

    9063507f39d720d3330a9d648ab5b17b070858b0ce177a5830330a89ec6979a0

    SHA512

    ff994610d55e5bc238d6b934d0e2b21ca1c14b9a26c6a6248a9779ced1bf0846c36e68d0c1e39e9a5d6a30a67b16420c7ade2efc04eb255c69f7e42eaba61963

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    d7ec5d17afff37dd31ab68907b7a8cc3

    SHA1

    dd875891a57d3cfd37a1ef5d3f0da18bbd13e9fb

    SHA256

    c86327e2e5fe4b30267ba80d7b1ca7422d3f2875a37502b9b8a090acc692124c

    SHA512

    cb3f0ad46f2a82d3516ac47734c3b625b0f2d3a72607f2d6aa2aa9bf73f81c5b9b150913d0d72530697ffdd1854c02f1481498be3ba15e366136cb45a95797f3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    54b1d7fec4c35759c73f975ec3a7cb8e

    SHA1

    7d15e3464869a7c2fe92a00a37b86b3ffa655894

    SHA256

    32b2236766bcffaf95fa3f5899937b0889dbf01cccff9b63e12197261f500d46

    SHA512

    fef5c78be0a05e052500bf708ba2641f9109a4a29552a5c90be96899e42e5594e128c0327e575e713cda9c6a72bd0ddbff4d26117062e36853bc873b73e73f3d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    9624e43aec42509df1862dd76ddd49ed

    SHA1

    6d7e115b80431da0c5982ad6b0fb20680f410035

    SHA256

    333aba646f4552473a1e464948d0783487d9722e2eddffe60b634022671b8649

    SHA512

    614c7b76cedff805cfcef559a766840c07d24426dd8d2a26afd9c0b1453e2444c242d5dc403bdf19d1cf467e787e2fd2159eeaae0653303d22b7ede0556c6140

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    fc2157ea0954a333cf066406f36f5edd

    SHA1

    14a55ffc459acef27bd0f209576611f280763315

    SHA256

    e5ad740618f3c9e17d9cb578ae22ba060fdfa4f202b90b7417367e35d7ca33ee

    SHA512

    67e6441cfc4059e30756144c3d79d09c6fc16f9fbdcf6cc767cb7d0d3290236a1334cca0761389295935fbd2bba110d42f3acbbb900d2d9a1579448ed5542069

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    69b68a6f583bad39ead2da10a660d89f

    SHA1

    ccd7df9c7e39b36cc28fe77132dadb3ad4c66f7d

    SHA256

    ba2c0ea04414bd6b0bda2f85771efc408d011d118b8eab2b1bd87e2a4f7599e0

    SHA512

    1324a6423431e7750d4528c793d6259341ab957023e82820dbee0a5d682d160a9ef89c7b0d32dda759ce94b4f5d9aa82806a52792139c9d77d8771cf1eb5b490

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    643d02c89f151f594f2bddedf08f432e

    SHA1

    1d86ac7e9231689f4a93a1213cc4963a103ba753

    SHA256

    74bb5685a1d9c1c87e1e2b4b5aab9fe48e06f5eb2865dd0bc81b2e926cf8b08d

    SHA512

    10156d05886bd8e7534bdcac5bf15b99cef716eb70861580066fe1b54b031b2b36e7189f328c720b3d13b0d105f89511619e50da892c6f6d1fbecb13db6ae514

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    8fe4c445d9b5d7f50dcc65fb069ae2a3

    SHA1

    6a11fa4c6e4d13161c625cdcafd899f20f5cd26b

    SHA256

    d037785720ad849daefd1ce9c0da3a3ab4267e5d50bc8805af79953f07819b90

    SHA512

    54d9e69c2c68ff15929ad467dd51106b6461ecfbae3ec8f0e8d48f3a1611510454bd4ec27605bdfd103253c0261cf2b78867f3a4a9ee4b04d87b2fde8bc9599a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    901d196f68c270c268a9012f2ebfc00d

    SHA1

    edaf53c7f8f9555bbd71fc39e66f2386a1c203a2

    SHA256

    e03ecaf59e545ae2dd89d3c2c97ddea53c0295cad006c73b2921fb2fa4420da9

    SHA512

    be0cbd06bfd3e2b07a9a6d8bc6caf7ee5947558f37d21c9f08f51a8f71db05c3fb022466cff51bbcac0beeda21d046c183d9269c18f96ba158529cfe2f7505e5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    7f3a63d3ecf78edfbf87d3de9c0dfba1

    SHA1

    5e9f49b253cd885993bda2f155cdf5dcef63919a

    SHA256

    a112e21988a4c3f89234d43e8298c257c02112c437c21fb3c020f448af0ce9c2

    SHA512

    0389cb68815fa5894a5f16e74ab51d0eb05ad50f8c8483a53520f8744b8443c96cb05dfad193dc45ac853d00a10f6cd6c936c7ff60a6b1926186264b140c505c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    77fb814297e515d5ac08cf9b006e19f7

    SHA1

    454f5b3bcfd39592b0d99cd9d94328e6169b8515

    SHA256

    1ab586484f4a4a1a64baab41eaf448b935335a224d80a15dd9324470b65aa41e

    SHA512

    cabfd12b6fca443a17cc621616e14de612e7c1b6d05f279d717dd22004ac9136869925e307f2a53351ea4377ebe3f9b8c3dbf17d2ed2fd3b7319bcd9f3e32cd0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    59780f16620fdd08881b32bc6b64bc31

    SHA1

    69ae4c552ec983650f08738bb07477fbb290b2bf

    SHA256

    02c372bb5608baa2be3bfffc6b998fa03935c8ba9fac3261d0d99ceae5380f5a

    SHA512

    789d38ea273da5e433f17c40976126cb95b387efd852371c794ce9ccae32095a1838145789fa4e8c6fb2dd60eee023301be971d415a9fded55cf4e0cc3918f70

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    34f0e049036931be72fb666918bf4069

    SHA1

    efb83330c9fc5f62f18d4c322e9e9d2aadd78a48

    SHA256

    dc92732b48bc3d4e8af4e7518595de2c9d9f94cea7e647742ac02a0bc42dab82

    SHA512

    14cede2a89d37e88939d5a5ebceaf2d96869f12d317fcfda142a0b2496403b4ab31c4da1c534117bde452a3e22f8bd478b1a5b88407ccb2849605f279ed43348

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    c6a9fd10e6b86ce6dde1eecfbc516c35

    SHA1

    9d7ca3078834e8b74cc2c094627bff44fcf31cf5

    SHA256

    ec538ecce8a9b5b8252487f9ffd3bfdab9f780337e7becd11feacaa66fe4210e

    SHA512

    592ad1bdd4e3ad2f8feb5f2af8af0d9f78a0d4a3c12549dad71949f8265cbc29fbc241ce06111290eb8f8cd8b2a82ccf8c6d6f44f4e50b80b75d074ee2b8af76

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    d54b8c266b9111e9221e401c8c7849f9

    SHA1

    4a2366d12c5c55289307d7c68d6e8205e75096c6

    SHA256

    308ead721598f7845835f9e0390981a73fc85823cc0b1542c9ee6d1758ff8e68

    SHA512

    389bc576f45c2958ac98f1ef32aeff0ac52ca706224ee48b29c44fb726ef8bbe87b91c8caa20914d0be692bc101a60667833d3dec4b0423e6ffe7fd591f128df

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

    Filesize

    392B

    MD5

    4c0bf0854f7066a1294fa7e9b20b1aeb

    SHA1

    7d8dd3781ab2860a1a3d461629110a03f3f15a94

    SHA256

    a85dae381aa4f9d1f9b05850a1cca852b671c26c30e29733de0585db57a26710

    SHA512

    2e2451795b825cdcf022654f0499e36720470199d00955805ba94d344a21944af46cc6b363123cd3514200128c176c41eacc4ed0f590759a95f7fc39007aa462

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_8DBDB314F582CFB69D8C0359C37384D1

    Filesize

    406B

    MD5

    410d48ff4be2d09f47ca8c499e3dcc53

    SHA1

    63d2249b30d8b60dcd4ead45508dc430b56258cb

    SHA256

    b792e8400c4b2d89e1fcbd1df7e4de84579cce5e1a37eecab968ca6d1ca43ef1

    SHA512

    61b72a9974988eff557b787be7fe862be757c6857de000cc86eeb32ab898badb5f69b37a59366eba015f44e7994662e1d38dc75acd5d65a592bf0e160f2625eb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    785f84880037976fdbb1d3cb41678f01

    SHA1

    158c4a1285e3a7c697ef986abfd6278af06c8f07

    SHA256

    acf2b13e765e3bf6f50b0b80b6810a7fc208db93af65a71b916101406233d5c0

    SHA512

    adeabe3f128fdbda8908873cc9290ee6235acbfc41bea443bfbc77ac9e59086fd03d06306e050f31af5d9f4173b213f2475e7cdff08e6fd6f3a788cd7c1530e9

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\sxsuh4u\imagestore.dat

    Filesize

    110KB

    MD5

    3748a68799cdd2e1241b1344b73f19c5

    SHA1

    42b526d5ef062e420f273ece4925fda7cbe397ae

    SHA256

    3f1dab6ba52b8808b6e7a661cfede922e5389e35b858cd8fb57aed73e1badb52

    SHA512

    617f3eb05645f17f422ec247310ad3beb69e19bfab0c741f80bf28b7f3b574db570eb05eeb187575fcfebac16a84fbf4df97a83a4a86383fadd1ebce21ef2ad1

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3NPBB818\favicon[1].ico

    Filesize

    109KB

    MD5

    504432c83a7a355782213f5aa620b13f

    SHA1

    faba34469d9f116310c066caf098ecf9441147f1

    SHA256

    df4276e18285a076a1a8060047fbb08e1066db2b9180863ec14a055a0c8e33f1

    SHA512

    314bb976aea202324fcb2769fdd12711501423170d4c19cd9e45a1d12ccb20e5d288bb19e2d9e8fd876916e799839d0bd51df9955d40a0ca07a2b47c2dbefa9c

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5OCCPTL4\js[1].js

    Filesize

    190KB

    MD5

    69df5b3a60a5a1cdeb804bc42c6d94e8

    SHA1

    a1427d4befdd641087c5d36310078696717e3b25

    SHA256

    dc817e1206b13d83635eaaa63e4518d79bf5b6769437c60bd2f65548f89828e0

    SHA512

    3cb3e2029bc8127458a44a4531245e93adb4902bc2bfacbd579eb5312053157b473c1834fc6153f9c4c591db0c2f4ea159d5c36c478934670e7be771ec31fdb1

  • C:\Users\Admin\AppData\Local\Temp\Tar16E2.tmp

    Filesize

    177KB

    MD5

    435a9ac180383f9fa094131b173a2f7b

    SHA1

    76944ea657a9db94f9a4bef38f88c46ed4166983

    SHA256

    67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

    SHA512

    1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\1RZRFEDJ.txt

    Filesize

    183B

    MD5

    1c4c2fa1fb2ef958d33b249fa78fa30a

    SHA1

    5de8b1f9e1654e60f2cfe2ab2092f0cd1cb3ffbe

    SHA256

    51cadd3e88156455f3ca6b3768a546f54928340babefe359e4b96af8040d180e

    SHA512

    386f755dabcc5aa13782d997dfecec47789cee4677955364da5854f8d967253bae8051eb685ae8b0bd691fdfdfda763409f01848c4e9a264d21a831932f21a24