Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    26/07/2024, 22:53

General

  • Target

    7612a94a3405a1138fde444018f062e8_JaffaCakes118.exe

  • Size

    904KB

  • MD5

    7612a94a3405a1138fde444018f062e8

  • SHA1

    bea38dc13156805bfa1f845d12dd635de7f2c40d

  • SHA256

    605c30e41e7547abe5272a51f8e582c77b75f1b1ebbeb4f6617966ebe0111d1a

  • SHA512

    9621342a7512e799411603fbbf989f414b32c285c0294486f18f8fc839f0c84025c3434c74a751d6b6f110ac1063e591092e4b258abae81e335a58d8e7561fc9

  • SSDEEP

    24576:BZcNqxXLtaWWeaVcUhQOaaM2K8l5dgdsLcvp6o6cBMqp:I8JLsW5atzxlPgdsLCv

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 9 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 38 IoCs
  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7612a94a3405a1138fde444018f062e8_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\7612a94a3405a1138fde444018f062e8_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1108
    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\setup.exe
      .\setup.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2940
      • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\s_install.exe
        "C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\s_install.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2548
        • C:\Program Files\Java\jre7\bin\javaw.exe
          "C:\Program Files\Java\jre7\bin\javaw.exe" -Xms512m -Xmx1024m -jar "C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\s_install.exe"
          4⤵
          • Suspicious use of SetWindowsHookEx
          PID:2832
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" http://www.ipanalytics.de/c/linker.php?lid=SrdJWqxHbk
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2640
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2640 CREDAT:275457 /prefetch:2
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:912

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

    Filesize

    1KB

    MD5

    55540a230bdab55187a841cfe1aa1545

    SHA1

    363e4734f757bdeb89868efe94907774a327695e

    SHA256

    d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

    SHA512

    c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

    Filesize

    230B

    MD5

    eecc8942af6cc374d7a54ff9618eaf41

    SHA1

    dfcb0b19d60022b7c290a68ee11c65fbd372ca1d

    SHA256

    fbb337d877c0a5a0cd21c08fe3ac80f8dc6f8d7ccdfaefd701e096ebd790378b

    SHA512

    369a169d683b6013a67f2461040f455b9a0997f9cb4974cef7bdc3108edd9f1fec74b1e5a39bad308f5301b5d2389dff6b741cfde97443628b41f344598e40ef

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8b54a7d2f305c97701d0160de10d5d15

    SHA1

    09f3d4ec05d5dfc8306fa2780600ae0fc2011396

    SHA256

    91ac4bca3b17d34258320b4c1885c6ddb2f2542cd583590ee20cf11f43239018

    SHA512

    92de810ee3856674fd3f5286bb2c748ae20048e565a06650bfc0c67863c26faf6e68ad3c138847746943aafdad8a9997e1a6f41ae970dfece9c12b260e4ef2b3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a5682a30e20faaf8f224bab214be9726

    SHA1

    81a00b1914a45254cd9382355c87575dcd50f918

    SHA256

    2299d170f2304d74f03d665359bfa56e254d6180ef02d62b02460e112f5a036d

    SHA512

    0d9ab07603b6f216d7f11257c00daf7d262e9a2f3e1c57fb682d9cb0599609fc8167f52df57c70f56ad5eeb7005aa63b7f8f36d37ca6a032f663a95dd8a4ad63

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    40f53e00a5592e75d48ea3b064b0bff8

    SHA1

    96f5f0638e3efb509bbfd843ca68a4b0b7b72d3d

    SHA256

    2bed3a5ff0c9990b703a577761ed224de65f92f9f624c5710eb8a4b285747167

    SHA512

    d5ff2736b9b9ea81743afc1240a6a8d3b276a61db6426b39a2917936b1e0cb50d18935189c86d27861349774b64a5d9c1f79eefaf3160ddfb150d2c541e3fd44

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d6fe56ceea02d155ba2dfc838e419a27

    SHA1

    360071783a7e9c0932a916ea4c6acc0c46a7293b

    SHA256

    0804dc1f4d9b98434479afeecf7671ca3f9ab42e3c6e9c2731207e4dde53c211

    SHA512

    e6cd449cf28f3e3a73de6c3d56c1ddaf33637c7cd5e43ee30c37b344f0e176a0142d67b37f1a0fefffbff0f8e6f56c115677c8656ae6b57220eeb0477c465bc7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    bb80fbc327fe449fca26c8a80d617e78

    SHA1

    7fa188730a86bad565a7ce9bfd6f7aa7319aa25e

    SHA256

    7e0f7a4f81faa7e41ca6095f67e649920a08340ff332c447ebe72193feb90c9a

    SHA512

    c7b0020e20a2e5aa7cf038c5216e8a252b81881b1fad8b95723d31212abe7bb61293d4864f619b2368c05a45d0bbd6cb46f77da462d4e9c7074488af9a4a7d6c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    96a8511212b8836c123425b494307338

    SHA1

    ad4f86df242d7b076d2bf39ddf266b47263cca86

    SHA256

    9fd4f8b5b5feb7325f9eda65f4d8ca01e15bf41a4be9b2f221d00876e9756414

    SHA512

    bc9463bfda318a795c7fb3622988904b181b0b92bd57d37f8a3a55b03314f9cdcfc63300035af3157f7a1bcc78b68f4d937b23cb2ba154f8cc3fd0bdaa96f0a6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f2905198448168f6b500b1c3b3c4e169

    SHA1

    e962d0f3c6e10aec96cab9e5b1226e9341cf0135

    SHA256

    d05b7e4d8c1359f9129f181f65911c104cb261450d7c2c2ccf7a85905420e9cc

    SHA512

    f939efba60c65ad2e4d10425456d09d4bc3a7b622c666377eedb53c07495a931c83aa8ce8bf03bcb632cd2e34707cf546f0aeb48882036a59d3e43287959ed2c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d3293a94fa697136dad8890b17c2c9f1

    SHA1

    1a72a28d0a2ca2ec657d666e613db89bcae1fcb7

    SHA256

    e7964bf52c0d9ee9281922e919fad5e60c4103d3251a692f428098643fa823b9

    SHA512

    f73c6fee55a998e1e37cd57861350ce6efc9b922861a0aff392585ba4e34daa90a737fe1942de6242e73308ac81e776f3391727f987222ae459c80aa7f1023d8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9959c401efe0d60c4479bc2684cf09fb

    SHA1

    ecf5039a8308263037c7ff928a3d55bbcb33bd34

    SHA256

    411db2e703fc110edb93024037bcdbde4b13fef6ad1bb8c25c60830e2f3e4b31

    SHA512

    5a486de4059f11616067309881ccdca0aeb964584d99a50280030150595106090cd8af0f8c6de190361393b38ff7fbafac16790a5ecf0a62543939d8a10ccd46

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    180a9a1352af20d73a8edfaad6fcf4c7

    SHA1

    34347a7cfd2dd88afd3bda77a65ab78bd21b469e

    SHA256

    3cd7ba9374014f05cb8727cc9ec3ba453650e6391647c571e6e231ec0dc3be09

    SHA512

    b8ee6aa164fd2e2f596e536a74573a3e63dcc70781c8569194d5cf62423457bb6f1f05df15d4069a9e972a5e37efda1b08fbb26dcdf790bb7c8083e28fd3d4d2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ca2bca707ee2937d3dc08671cbecbe24

    SHA1

    5d141e85abfbecd9615c128c37963e8ab8a8ce8a

    SHA256

    91e15d5f089f89206fd7115a9c9f0b9ca55b545533c9a88b0c93655d43a702a4

    SHA512

    7b3e879c234305d818469b9e6b6f07698c135f72922c145f774396889f663b15067f06a3221990a08af32d078a508de0886038ee691877e4ae865ba7c889ed78

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    cbccb3c49e7fdc519a07e131864e3257

    SHA1

    dacd686d14478cf79ffe1adf13d1f1efd34c8587

    SHA256

    ecdb67bd3a44a89880871a19662d3a733b695e4c943e33a6d8570397c28598e8

    SHA512

    48ce06e7972af0c58e27f791c5c361021c42c98ba8497f83a366e6d8c7beb25c3132e0bfbb27a6a480d6e089d284fd5653c4f901d7bdebd3ee2d064770c9cd9b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b018dc55fecc4033a26f1196d9b3ae12

    SHA1

    225ebf05bad65101af4053a2fcabfa223925146a

    SHA256

    2d30c6479c3d0d2c178b13b18d652c4dfc97ca3930493a90e304bee574855490

    SHA512

    dc2a7c1dbf90a85607ec4d6eb76c4cc43d0df1a1f692011f547b3776cfce0f6d9534bc5ba6780d74760baf1891599ab8f8eaf70ba7691ab7b80603749c5f2621

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b312734207984bef424269dbb3f23a7d

    SHA1

    c6c257c2b306072d9a630b0f719cbe2fb21a6d96

    SHA256

    2ce2e77c5b81c04da6305ba12dcef0c0a3e2ef6302d5df75c346213c6f3da7e5

    SHA512

    ccca3cb4afd0fb3f6ca0ba7d1d3e186da70f6a6b0e1d02cf0ec25b1d85fcbe09261ecc6967a0721fb13ca19e4fbd21cbb34a9ac6eca6cbbd826e2896773037e4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    204f99876f456e235ea7232545798562

    SHA1

    26ee13f98729c99737742c1c33192dc53e5a7d1e

    SHA256

    1c49ffab32fe7e34f444fb2e758e7cfd41e0880e6ce026c169393c3b71f85e63

    SHA512

    38c007748915c5f97218611d4847e8deea98318042b73a253a32903fa5ac82c4b44c58028dcc3d72e14c66b4c2e8f61bffbf68d8361e4bb45b1750be600398d2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    804ef4f1df09279891064b91053a3b29

    SHA1

    b65e5a169ca46ad53297a1b2fb2a2ead873dac6d

    SHA256

    ff5483aee2618cb98e2c47afb77da9b1617d400ed55f78cbb5c5ad2b8a761598

    SHA512

    9c8dccceaf3f6e904dd6a071b5a88c721f466860b864b2b0336abd66e318af3361c1eed4f4feed79eb2a415aa4b68056cce21e55574ace7087c971b28b32b227

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    401d52fe17364ecc4c4b6b2986548725

    SHA1

    3954e3e2b1e4c9a113902715572d2dca78267353

    SHA256

    f1332a191c995a363199694f80e729cb65faafa6220eb1d215bb30dd32538141

    SHA512

    145e0db0ce559569c78a679508460c5bab595121252eeeebc4c0f37acddafe381eb17859288b059d8bc166b3c285163cd0507c6a105a855d0288a293453adab1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d2d1769d605c3a10fefd59dcda5cbe6c

    SHA1

    cb5ef031c434584f5c1d7c01029e4b80e8be470a

    SHA256

    f2526f8a111f1308351bd0f1dc665b09c5caec7f08c940d458d66a725e67b378

    SHA512

    329af4ee32c5f40dbff9624b42682f26eeeb08bcd9791d2d992dd58724e6404b073b0bbe17982dfcbe1826cf6ca13d80d1c9c9267c9761f9aea0419388f58807

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    aadb5ba66c3d7f2cc3b890895f16451c

    SHA1

    43673e087737968404d1dcbab45da67403f41ff8

    SHA256

    b00fd12473b1d1f84016dc4dc869cc1f860bf3280fc2a264c038e2fddc205799

    SHA512

    c778d6ff81b260cc89a9e7815823cb4dd7b79310633e94cc517ac2905ac507d95a07869e2be2a73494b93a9d50cdfd4f5b4b3747d72bd7d2f1c1d63b68d39c81

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ab568f703c2cdf9765334e7cd05f392c

    SHA1

    7b7c36334c6aa3d97d862bcf48f96d641b964a79

    SHA256

    86826538708acab6110c823cebc3f45bbdd107ed8e96ddc1a0640f9df55f8990

    SHA512

    d382013b574605eb0006554ec6cd911b7f9e78ff2298c219f92872d036241e81efd667cefcc70c4d8594f24450479b321bfcf7e5c2218161a87c2e228f2a391f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7438a803d68362fdfc192c93c6922825

    SHA1

    2639bcb7cce7b631b42e14d6a3f3be9277ef0519

    SHA256

    2b90476da268c06c7d1a93df230f7d95a1cb1c3079fd45296ee2bfde751044df

    SHA512

    a8144f0555776828b9a53a2f008095d5cc7dd8f28da1ec810009504d54c76e5e8cb2c9835f3b8e8c9f414ec6047a9fa23f2f920d06f7c89204dd008054cb1b10

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e9467de0778a598b6389add02e6f5ecc

    SHA1

    d3260b7652bfcacff0f85f9cb5d957047ced1c0c

    SHA256

    d1729b2022760b7ca79109e1ad81ba8d1ad975a8fced89f713c189ae1a9ba0e4

    SHA512

    62d83c96503f1a3f7508b854212e3b8f21e26b2f086f779101128c70e9e9a9c86ee3da648b42da6eea0dcd7f0fa0d4bfdff34e64920b1a0406ce37b47defa1f2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    47fd55d342b076c2807ac03a7b321969

    SHA1

    bba6fa5fce2bb8bcc02d49d2f727d69432e52f06

    SHA256

    f3035c5b624ef9914f1c86df3e94baedb15fb91421fea3772ade05704af761e9

    SHA512

    f5c79ed385d59806aaff4304274649732b2d252aba29c4c45f2e1565e211687fd5b0462b1a073256f6ddbaac17f1afdbec924bbade3a5102579d5895db573ee1

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\p6d9oj1\imagestore.dat

    Filesize

    873B

    MD5

    b085e3070301d4cd5a45f8234027e003

    SHA1

    a3f71c34b4291921d8491f1ba1dd594b9e541dc3

    SHA256

    955c035be283fa9940efdce0817a94a5e06f72e83e947412584a21b819f26979

    SHA512

    a75e1cc061fc61c195acb176ba291c272b5e2e3bb83838c9ca426e57c17e0b674690488765d563260767ce0e5d3390c8181c6ba23bc89afa1810b399226a4e43

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JQ7VMQEC\favicon-32x32[1].png

    Filesize

    689B

    MD5

    730f6d2f03fdb957bbe553a8c20bc659

    SHA1

    3f2142ee2f59569aed6e374bdc2471439536a843

    SHA256

    9cac36ade6ccd18d46677721c9d6111dcfba4ba72b6ba389b5c7eec83deb12e5

    SHA512

    3c1144544a548f2f54c3a938d4e54f88396d168b5590d70e65c08a711f5ee95068c1f3176b5de0f340899832ed450f30adfd1e8f99401530e575a5475ecce1c0

  • C:\Users\Admin\AppData\Local\Temp\CabFF07.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar1DA.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\options.txt

    Filesize

    119B

    MD5

    fe03bbb0503140a48333084f376b0daf

    SHA1

    b5909c98be01391e826bea3ed97c42f2c9d62384

    SHA256

    f45fddb770daeff0c1acd0ffb16c2277b767b22b1e86c470776387e738e51704

    SHA512

    6d73cdc4b467b13ee86c1eb0bd165f498826d6f55c663adf50bc00bae0f5902cde21ab94c220a5298e0a93122441d8abcb3736e30aa226f6bed89ff9a294437a

  • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\s_install.exe

    Filesize

    263KB

    MD5

    0f1931e26c21219db1c90e90037f11f6

    SHA1

    74b65f7fb7fa197d413ba5bc45cf10304deb4ecc

    SHA256

    f4d54e35b857b5dfbca6fefcff5ab5599ce30b62eef7deded6594c5be93d25c3

    SHA512

    0c6a90034e5852915af61ccc091568cb636f583d4c4b5cca8bfc3f7f86bbf6a79f16c324d723c1d3968d7996071bb85a79cd6fde682bb4bfeedfd770b7b8e817

  • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\tools.dll

    Filesize

    615KB

    MD5

    3c3c80039c6d346f75b15d8a08754ce3

    SHA1

    57e5cdf3ab2b37471613fa343cd113870f26c75c

    SHA256

    54e34b0c0e294b474630dc0b282c4b8904b3b5697c7891248fc2e0185688d91a

    SHA512

    c089a7ec8459bd20c319f98cf375f82a49db178fe40d7a0edf3464ee73bff42df47364ee0c8a3a9b4277eba7f35544e139db7948e62ef6e5332689f0c8fe17e3

  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\user.js

    Filesize

    391B

    MD5

    ee411ca5f47f3f17be491c7900f59cba

    SHA1

    a2482c3416ad6ebfe41113edf2e2bc07c9866a1a

    SHA256

    4d36d11c560cff3224c8725cb3db1d8c88316c8caf16f13ce866970509f7a0ec

    SHA512

    27ffa809d9030959be3e8f004a3b2bc4902aeb33b5f64781225dca8f4c97075d0b268f6c5335c64f5656eef3063a2d8c5e084f56016b9930f73b6ff01c597351

  • \Users\Admin\AppData\Local\Temp\WZSE0.TMP\setup.exe

    Filesize

    666KB

    MD5

    34a53701f595d002fa8b65655f41e6ae

    SHA1

    11f29f4c7836011cacbf201b0057c079a831c31e

    SHA256

    68b403e06f0d9dc2e776f82167fd4bf2e392d271533d091cb826f4dcb3b7b1df

    SHA512

    180afc8c738dcb09d233700b2e43be3d8d5a14885e7940966ca85e1203baa76a4d9a383299e6da278f0b02c963c9845ab41ba0277f5da4c46230f6bdd4484339

  • memory/2548-40-0x0000000000400000-0x0000000000439000-memory.dmp

    Filesize

    228KB

  • memory/2832-70-0x0000000002040000-0x0000000002041000-memory.dmp

    Filesize

    4KB

  • memory/2832-68-0x0000000002040000-0x0000000002041000-memory.dmp

    Filesize

    4KB

  • memory/2832-53-0x00000000020C0000-0x00000000020CA000-memory.dmp

    Filesize

    40KB

  • memory/2940-362-0x0000000000400000-0x00000000004AC000-memory.dmp

    Filesize

    688KB

  • memory/2940-361-0x0000000000400000-0x00000000004AC000-memory.dmp

    Filesize

    688KB