Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    08/08/2024, 10:20

General

  • Target

    Steam.exe

  • Size

    51KB

  • MD5

    eb794f3819b32c9fbc747309bb04cd68

  • SHA1

    a6c24bfb6c2ea4cdf10f0f54c0a4e8ac0380beb3

  • SHA256

    e8fd34b40b83391a855905620e4beeb153d256df196b063bc7845d747f1e7d67

  • SHA512

    0b6cf31c799513b4e0f5ac21180cc7a26451fc54504f03ace353a5a8c598885c594b3375e990ac442e08ffaa1f3e9692cbf6dfb8c035b4380497cefd57288aaf

  • SSDEEP

    768:juMMmVn76G3rspEacCIQgttZX+2V2ltnq7oTmggkbm1t+tuXSWCalOIhu//t/:SMDnv7sKEIHLXyBqCmjkbmn/weOImF/

Malware Config

Extracted

Family

xworm

C2

tree-cleaning.gl.at.ply.gg:33027

Attributes
  • install_file

    USB.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Deletes itself 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Steam.exe
    "C:\Users\Admin\AppData\Local\Temp\Steam.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:588
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://guns.lol/tuesday.cs
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2784
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2784 CREDAT:275457 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2644
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2784 CREDAT:472075 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2108
    • C:\Windows\system32\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp8D51.tmp.bat""
      2⤵
      • Deletes itself
      • Suspicious use of WriteProcessMemory
      PID:1928
      • C:\Windows\system32\timeout.exe
        timeout 3
        3⤵
        • Delays execution with timeout.exe
        PID:1532

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

    Filesize

    1KB

    MD5

    55540a230bdab55187a841cfe1aa1545

    SHA1

    363e4734f757bdeb89868efe94907774a327695e

    SHA256

    d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

    SHA512

    c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

    Filesize

    717B

    MD5

    822467b728b7a66b081c91795373789a

    SHA1

    d8f2f02e1eef62485a9feffd59ce837511749865

    SHA256

    af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9

    SHA512

    bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    914B

    MD5

    e4a68ac854ac5242460afd72481b2a44

    SHA1

    df3c24f9bfd666761b268073fe06d1cc8d4f82a4

    SHA256

    cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

    SHA512

    5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

    Filesize

    1KB

    MD5

    9729642c4b4651829268982d94ed88f8

    SHA1

    7cbfaeff1682d492e29a394de774a623047c9a07

    SHA256

    1ef5a6923ca603197c616e65ee8415b739d1656c6e3d60e07dcfa00f2813ea47

    SHA512

    07ad4e4d283d021c8571f68e6d43a522b27d74fbaf51881191938f6abe97df0d1ec58c9913910ee8933e512b0935343591fe567c5fcaa7e63a4c6a6672fea769

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

    Filesize

    230B

    MD5

    d3836bb94330db025c5163b6b299f789

    SHA1

    feeec684f4f2c20213ee400ceb3848f659facd60

    SHA256

    ed92b385ce73a81a251fdc88891be4b82f3dda2fe4f4c1faec4998a7b0063ff4

    SHA512

    d12dfaba5c6a9a518337c87524ea385794d6a6643caa8827047deba2ade73b98120251d6c33c95f34cf83a3bf0baf6098e78ca2384188e299254bbf3f4e0c171

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

    Filesize

    192B

    MD5

    ae50f63d42f71b2c9d4bbc3d8cb0335b

    SHA1

    25d5014d734c766ee2613cc5ad397c3663532378

    SHA256

    1410f57dfcbc53d10b2faf6f68a881f5834fe5a5687c9287ee9ffe69cf334451

    SHA512

    47d730cb76a88845d989bd243bf1e0743a568eb5d384a52da044100f412805265b2053399c62fb794de9b958b3c976cef568b67efccda89bf2993ed5fa9a1379

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    252B

    MD5

    9e3ad01daafe529593eab870bae6b50e

    SHA1

    a3fddcd3d136f0daec0f774e3e84e975ee31e7dc

    SHA256

    18a0e9b49d6b26b4be49e4bc773e0423e6af732e4846fd503bcfacc13922497c

    SHA512

    a5db98533dd45d0bd7765002631d614b84f92b3b72a7d69bfe069c43577f6ab02cad0714f193103e355ce0747a42976407a763d09b985bc4ad4d2ca0cad16ba5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

    Filesize

    408B

    MD5

    3cbd4fac9276dbd876580b6d2e1d374c

    SHA1

    18c540ca4277973a0362e38e5d25ac15961fa102

    SHA256

    a31f7679a81f0457663fd38725564447ebc01537ea601caedc59796f81db2130

    SHA512

    33d377add429e622d3d4ad520ed61ef08c07909c650878223a64d18a3a50878fd00c107cfb6d3dd1b31490642002583b9224fb7933c46440b570b55e147183c0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d2d7491669870df3d8c2bf27583cf574

    SHA1

    810556624ec493be0829446b94f92c0c96d7ad26

    SHA256

    ef061d23446fd390b5b804e7c8de7fea6cdf196e214effbd1ba66b7d24d65ede

    SHA512

    63d1f1f20f44d94e65985a69d6398492b4cf89da595446235aff76963c4433dcf1bcc57c06b94c69b160cd143cc0a8dace4fffaaa130053d155b446f42bcd19b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    cd49c15d3700a9119e2ef645411f7d23

    SHA1

    56a1f7b7c861c0cdd3f513d134a9d4ad14dd41f1

    SHA256

    ea0079a060d2b61595dc619719def40c808f25ff1aee9ba0c1eee7424ff31894

    SHA512

    c67d3e8cdd78746f6d470ab38b9ea55d7a57a659d46694c61d4b2be7eefe6e2f36c7f92f2c6e6c74e972cddf9d16653b51189bad6c19bcc6dc1d59f86c1d9548

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a2fe8bb70199ffcaff37d7a4989a5820

    SHA1

    fd56ee32e9249d80a3136db27ec9ba71523c82a7

    SHA256

    5515483528cabbe1f11fa05dadd6690945ea1ee1b95782be13c88b836bbb4afb

    SHA512

    684078590df3977e89715bfe5e11c940d70e71f0ce734e396832fc38c6b48faaf5a3c352dbbed93f96a10f8a4b7de545e48103a02079df9f73cdc1f98b57b339

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    bf7ef2d6c1da82db93f269e3790a5262

    SHA1

    749ccdf1e77937d90d0f16b5a19f0d4b5d7c706f

    SHA256

    716767dea9e7f66779557d6c89d1bdac644aa2601d51150a874e146133f2c9bb

    SHA512

    9a22ea8d8d2dfc37b1c9e55bc0116b239f9f9c1bcba354944dd2ae7ede7156cb10e993600485eb8006274eba2394457e1c7dc92d62be9539e6367b6f21707be6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    867815d3549233d736c18b02d8bed564

    SHA1

    864473d61501f63fa682225672269da508d62451

    SHA256

    7886b80c761d5310b69d6fe9a5acf8b07cf0fc0f3dcbed084eab4394a331e12f

    SHA512

    ef8eecfa2bcbda58c8b3cdf9ba6e3d0ea74a3dcbe323506103a1f2ef8113f0bb67d66f05cb47e5cb37bfbbc339f8ee67e4fc205b4e88ce97c480af8b1f386554

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    794b2f58516d77d0ebd12ac67186d84b

    SHA1

    c0bd21943486d8cb25a436c54dc3e3ef91fae711

    SHA256

    a7c9bdfc16c2059aad202e135c18ee2a05e7e4f69b81f17d6775ba6330fc2c8d

    SHA512

    5b5e60c68aaa214f4dfaeedf756705d617c46d97d7a69670ecea537a7c9a83725211e88bba4139b1943676d70462ec19957aa549bdfa006854572c5f8d3c6547

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    58eef9a5495c47b98d42c78c32306967

    SHA1

    c0b562ac421ffd3165239951c0ceefb13d1338c0

    SHA256

    ddb4a8851452756242b5d97f0884cad62f76acf3e4d08300f4418b9f3e5a2c90

    SHA512

    e12396fbf5637baf82ec58249c7093f269f0f1d8f86c1c88785ff8da4648c743896bdb6932b4e112999b70d53b6b0a5f3062f5f4d4c078ed78a4dd39153af8c9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    06389bf92431a2d290c98cf51bc27d1f

    SHA1

    bdddc0254173002a4089e79096356c593eeb36e1

    SHA256

    af75760b41d2c3e4048e441132db70dfeff46af5de38d672bee3e8fdd0ca29f3

    SHA512

    7bf1f062c622caea7791d15cd5b6ef786d188eec8ae9be0b262de13cfcb8bb69a8da79281b0d09217d7b6971c76101f05dc96ff2bdf48d462e44b72e2988480f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0e9e049a11d92a0f5b3f0bf11e8228fd

    SHA1

    8c251927cdab63937d1baecedacb39c26ede33b8

    SHA256

    64800b4228991983e75fd11532b57b62bfa327c40edd9640fac9ef256581c6b8

    SHA512

    265e88a7eaf5723e869b975e86b660fb8001e8b71ae6b21b393fde25a5b931e8a672db88790175f421c04855a17397e6919060c391a3c17c1c45c8154fa9ef63

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6d77763bff6a21b1340a7b09f24da2fe

    SHA1

    e045b269e6396fe13f5f5a7d949899e7b4510622

    SHA256

    2e89833b89a35a513ac021879090aeaf6f5456313bf1e0ebf0b599e3fbd21045

    SHA512

    a7ae383dbd06ec2638c97cfe7c71b571e028c1ee81f4d44dac35cc2ce27323375ec553b5f596eb062efd82262945d7328e4e499f1aa2fe86c98a2dc371792ce7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    98cdbd44c1879c290efeaf5ec458556c

    SHA1

    e87e08ecde078d4f6d07efd0fd4af1cfde1cd70f

    SHA256

    9b8694d2d3ad6381f9bf51c6d76155708291eff6ad17fb8690f3a817140df556

    SHA512

    f1e18f8accdea69c396c9b8cc85eff65146f5ed82bb868e63b75ed8a61df35f42a12e7070169c956d0af423d8bfff2b835ed10ad00bdc811d260df7ac995aa1b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8700d7f6e461979a4d215177479e10f1

    SHA1

    2d0798f6bd1c43b27b9ebd337c998bd837589f30

    SHA256

    96573fbcf4d6bbe5e182681b1886c6cc9009bbfd03c837f1fd438cbaa9237eb9

    SHA512

    680f84d36c4278caaa41f562e6b4c946060a508338dff2ec6c0331f8a7242ce767830eb0add3468149921b6623623951ee0f709216546530cf993a1ba4605c4d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    08d450451c2d21c1dcc80c3c06fa5ac2

    SHA1

    ddd7542f3980726d32dfb001dcfee45c92a5a3bf

    SHA256

    e5b5f564bea42b4e7537561917c0c522ee598070428e065e0ab85258da8dabc1

    SHA512

    b77aae71bd6e06d3d2abda4dfea7c0b19e3e62398886333133b30df9bdad77d4351cfeaff8fca3831abd47767cdc90cbf50888854bd5d9225b16a6c423345984

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5988f25d58e87471b114934f5e12f450

    SHA1

    5fc3c53e47bd35c08c582a44f7f4f0348b37ebf1

    SHA256

    ad91f4760dcdb7fc6b92e8b2e04d2ec714bb32802a6f0c6893a8e7a366bad71d

    SHA512

    4d4eddfa2c7a6360e31298be5a2992dc58fffc0c86f12a2295cc83034f66806185c0cd7f0b74d3c95472d7eee12753e1093ff4facc4af1865c91f3ea9913ec81

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9c162d9e05fc5226829b858853229ace

    SHA1

    2ed95aae700fc0566f2d4a46fb3c5cb85d1b3592

    SHA256

    82e58e10da91f5738cafd8af35c05cde2bc1e9ccbdb1d7f165fce66e30e2849a

    SHA512

    6474c5bc65164d75c99412cb3f6a6023a1fd96a041d16b1afa2f3baa8d07c0af69c19a0a7f7faf9a268116eae515775d41a98ae60de7930047361b66dd123f6f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    000c08e0241567daf012aba4c07adb15

    SHA1

    ee5600a42f4adfe982f8b96715c47b8b5d734cc3

    SHA256

    cde0408a8d60cbe37cd2141da291acb31d359ce265e64fe461617092d0c3c1f9

    SHA512

    eeaf6067324749a4f92a0cceeefb9cdc9c44487ab4093f50b01c0d40a5b2cda52e384c7268d3d1f3f8ac0ca423b1f73fe7e1caaa92382b7fb094038ef65d9f41

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    afdaf5e097d3f7817bf35ae891212ba7

    SHA1

    544d47d4665d354bc4c7205e7c36595b936c7ed3

    SHA256

    a2e0a321501924fec7cec28f9394fbcde791eb0f26219565d3b47edc678266c2

    SHA512

    dfd908faa1e1fe4f7797e4e924e2127a4891e6fb869535ce6e2180d8f863ce0cb7e67153370e84bc1ea1b48ddba803a44453fbc642e0748703af43235cabecc7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e4fc3c3820f37430ddc4a602661bb1d7

    SHA1

    28624c5d2a36eade1555bc601bc949900088546d

    SHA256

    aa2a5de8534ad57bec1921f7ccd0634d78f262041b98149a339180ddf726ae42

    SHA512

    468f9bce5461bbbb43d741b6fdeb7394040fa2b8ae22a556efeb94875661a4a6f134969593976195e36d452d36fc0f727e27a6c1b623517a66016ef851c0a464

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c740263848a8f239ff8ccdfe6b0f78e1

    SHA1

    02d0dd03f055c0e1561a87db5d18ab905f8c65af

    SHA256

    b26a460c32f388d592c9a6588c93d4861ece31e854cc0024386b49a168ecf978

    SHA512

    fe960d0f98886c47620523e923dbefd903dcd11607b3cb50f8deb4dbbaeefd7d9eb5bdaf043871a930aa0d698bf914a0b17ade2058fbfa365e4ef74c1a1c4e26

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9e54a77ba0fbbc82439729cd42cb2942

    SHA1

    3195d501e4b1e95ea05c379c78927468abb471bf

    SHA256

    abe22d4665c5fe2b580c08c03e59d8776187947d3ba9d4efdd491f16db666ec1

    SHA512

    3b3ed2446f240653fdf09677932ba685a5161857a36897e4298f9c08de8e81aeaddf72e0bb113b560983bca07705c1c9fc04eb120ce78c70d531b751b3856f68

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    162ee5fdba7a8a7278c1c7ca378bffd2

    SHA1

    43b07c4b0854e68862677f5c6fc75ab2e0056929

    SHA256

    93f1081528e2016d854395e6c4abd1bdb0d81ae4a51671073b3874a04423f222

    SHA512

    732a24eacd23e14ddce15cfe67c9fe55e2788db2b5d814611b2b33236b51527afd6474a4de9faae482bb0c2296856f1667584d6152b3939a7359ed8188feb7e6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2d16eff79abafb410e7359bbc70d742c

    SHA1

    321d02ae0e95dc59d88dfcda39b34aa980608d6c

    SHA256

    908f4bbac161e0791534a312baf7df804dbac62de88d5aa0bd75c066a0f5b5f8

    SHA512

    673a870684ea0c952902cda4a2c685496676664849a52781cfc09f6d57ffaa3f19b95ef8381793a8a211c1ac56ed574087c2be55d515ce2fd35b6c4e9be4f0c9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8875b5078ed1a70f6b81e25b36dd9719

    SHA1

    9f08816ef34dce597c138fe996d81f5b229fcb58

    SHA256

    a5a217b9c785869a2f4cc74be305a947350bec5169217e12d254a00f1de985c0

    SHA512

    f610b66a3deba141a18401231cd8f777ec128f601ff8469fd38430dc128fa534efb703c0720347f29a5718e800ac870c5d13abe14595f863494d8339cc12b922

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d7c1db2ac8f57d4fa2e3231ada737d5d

    SHA1

    e2257283678136e8f0cef735ecfc675f3803b2d8

    SHA256

    42cfcd227100d9ebf211bd394d413f9df357f451defd8fc1b30e41b1ba04f320

    SHA512

    693da0d7953f0e5690faff24a0abe8c1b21d6ce97835a64bd0775c4f891c45674249bd6a209a2ab7b633c90461eedc8106b83f9a250e582abbf4f957ed3ceefa

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f0debb7c26c548176e55b461133b96ab

    SHA1

    dbc6f6fc214850b4a0acc3e3c843b65cde118e3f

    SHA256

    b7ee28eceb563d5299369e2aef88c01f344a2b520be0307279f86592d1128f49

    SHA512

    8b3f69ddaacde64b6e4077abb2a572aed59f2e7cf31c12cf5bfeecceb6a92d30373cd622549df90fb0f5a5614bc8a14b4fe352c06c31d3e9f6d28fa52e2e76fd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c921c7decc75662136e99c15228b385c

    SHA1

    321b7ba2ecd2abd8ad212fa3c41dd11960494a1e

    SHA256

    627551d41544e0e968c25bce77da62f2acf3c548858e124c881ec8215e8f979d

    SHA512

    36eca3702df0f4454b1f512f8d4eddc141b5b689833fe8e19df564d345ba3d071c29b0cf0b3e9400c5ce22690a8237757c3a9f85bf6e000b058f756ba3b158b6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f47af3085b39f559ba40a0cd6fdecb52

    SHA1

    c3d21e509d1e56908ecf74f1168661bd2567a013

    SHA256

    cc0730ecc8d0f6f90f0d408b8752ee5dc922489c756681ca7131c22015c6108e

    SHA512

    188860b61dcd0a247d321dbebb249306dccd0b5c364a311c603475ac2dc04b9bce53dfc9aa8db6b75a2f760724ca85a9ea9271433e4895e35a705eb017cbeade

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c08796046aa00c33e6caed5ff112a16d

    SHA1

    370269db2777726799a3e164dd3cb68fcda59683

    SHA256

    91a0e9b5e60449075181b953cd12ef30f080d8a6aa01f3ed97bed4883a2ed575

    SHA512

    afcc35d517302a73b96a4bacf2478bdaae9b136022eacb83cd803f9d7d84d7c613e7bb861afac6b170a218ab8782a5bda84eda7d056a44ca352bbe523c33fe74

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6b6bc43ffdf1db18bf3252c2672fa0ee

    SHA1

    51175f522cc802896ab7b1837fecacfa9fd57fdc

    SHA256

    7a455555a201bc1d5fd5809cc2ac6b176cd135cbfc5b6cff614056cf7cd213d5

    SHA512

    e55ea514f6bff138f5b67fe8bc4e6ebca06241a6e1e44a183514619a821582b063d283bf5205c2e85153212d1554a742f20f2ba3ce23fbc1bf0fe85045a9df43

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    4c4bbabd5a6912eadf057664461ae3f6

    SHA1

    d39ae24356f7f6e46d39a86573db1cc416cc70a3

    SHA256

    9161b4c27ed3d977c148e716542140dde766f1b4c35a3e2b59d2ebb21f33104c

    SHA512

    c49badab164739c57211d33866fe7307219e4834390a18a69edecf3466a8b845fb7a9d2a20c3f3e69f4758851a9b89c4ad1b39aa0058d47e9bdbd37dcc3124c9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    73a16b2302209ac162c33e61e0b78630

    SHA1

    ecd03e6a2b874e02d590ddbec139d9fabd26e4db

    SHA256

    453b217f7d7d0b9967441212cded66571df3333272e9a363e807a2d2811f03c9

    SHA512

    831af1616d2eee75bde7afbdb789bfcb14ee16bbd99cf05da2ec98590a1e228dbc896f1953242335414dad0548eb756624d432990a769ffd39f279178687d32a

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JQ7VMQEC\X6XYTKIVDUW7GZTZPZNN4EUM5KH54KHF[1].woff

    Filesize

    34KB

    MD5

    bd7cac4b844318aa2b2f168b57b45c22

    SHA1

    d731068e2b28d4f1dfe5b4dbe8cce9c082fa8572

    SHA256

    9cdbec9eb9de8ac09b4745f0c21591e3ec385fcfab4e652175ab381001fc8d8b

    SHA512

    592dd8bb6a1a6a488332a785476cd566f1cb8a65c5cb10fcc27fe9472b89233faa985a0587f7437ca8ee2a3a8f345363e303a4f8bdfd4b496c173b744d59ced1

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JQ7VMQEC\api[1].js

    Filesize

    43KB

    MD5

    66e93c1f0c53bb0a4a34c2be54427e6c

    SHA1

    24346c2941c3d92c9f3634fc594079f4706650f7

    SHA256

    ce9b46c18d0769c78a7e889eb237606cb96b602061b39b4c1159a22a015b51df

    SHA512

    30e800eaa414a0f571e5100b71b19ac23743814a8fd2b7c991da97fea844b18f4ef64fc4aa90c3c300cc94f6ff47ea201e410f19f80cee84d2e307aaa10ef1de

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JQ7VMQEC\gradient_background[1].png

    Filesize

    238KB

    MD5

    5a45b1497b5e00ce306612d84f451297

    SHA1

    55c235ccf6e028b235fd2c09c444214f5383526a

    SHA256

    058ac033824f0fda4d87e4574a9b2d49d14e0e3c3f6c719cda30bc94ad43d6e6

    SHA512

    9a26acf4dbbd8138748ccc46006e96e3ffcdd6f419d4af341256879ae6009d6df135b20df1fe592f10d15a1e9de858852098d23a76929346cf3c4bb5f1dc9218

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SPRIFH8L\css[1].css

    Filesize

    601B

    MD5

    42b7433e70976a2368aa5c2fd1268144

    SHA1

    5b1c9c0b9d025f81caa138fb3c4b1248cf413835

    SHA256

    5e801ed8112f0bc4c701c2cbed74a90e3c7f0aa08532ac0b2adf553b346929cd

    SHA512

    8c6eef9f4c2a2384a75472bb622b6667d0b4087bcd70fed506d030010ea12b44dd3d0d3f8dab2a0e1dfd0b897e036dbcad95673dc05605b1422772436a44c35a

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SPRIFH8L\guns-solid[1].svg

    Filesize

    732B

    MD5

    48817a08ba7e68c843c044f272f9f6f7

    SHA1

    ac3a03887ef169327cca4fed5632453611da39a8

    SHA256

    e07f17964bb0c49b975f385542abb2f6c55e67b3b0d3b77c4d743fe3416553c4

    SHA512

    a3d4296d8a408af9e412fdb60554f63bf2005bc0eb3a863f7a47f2bc9f311e0a5672b68e318c0600cb099b3c64f6037a02c97e875b9fd91808d336ca8a7e50ef

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SPRIFH8L\tuesday[1].htm

    Filesize

    167B

    MD5

    0104c301c5e02bd6148b8703d19b3a73

    SHA1

    7436e0b4b1f8c222c38069890b75fa2baf9ca620

    SHA256

    446a6087825fa73eadb045e5a2e9e2adf7df241b571228187728191d961dda1f

    SHA512

    84427b656a6234a651a6d8285c103645b861a18a6c5af4abb5cb4f3beb5a4f0df4a74603a0896c7608790fbb886dc40508e92d5709f44dca05dd46c8316d15bf

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SPRIFH8L\vcd15cbe7772f49c399c6a5babf22c1241717689176015[1].js

    Filesize

    19KB

    MD5

    ec18af6d41f6f278b6aed3bdabffa7bc

    SHA1

    62c9e2cab76b888829f3c5335e91c320b22329ae

    SHA256

    8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f

    SHA512

    669b0e9a545057acbdd3b4c8d1d2811eaf4c776f679da1083e591ff38ae7684467abacef5af3d4aabd9fb7c335692dbca0def63ddac2cd28d8e14e95680c3511

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WK27LCMU\guns_logo_c[1].png

    Filesize

    35KB

    MD5

    0bf48ead8eef6e287bb3738993236be6

    SHA1

    be9f6d95513902571b89116d39068578eac601cb

    SHA256

    455ccaf35154db5e8e984be4a68e2a1bbd5f884063b7765855cd3bb51ca420cb

    SHA512

    4f9354ddcd79ea18c6c1b42ec9a4b8c9814c4f8e397e48f3838a38ef4007ceb31d30b02ab10a6b28d107c4d063a5d7ca634114d0ec8473cc3f29d8c1f1c5677e

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WK27LCMU\main[1].js

    Filesize

    7KB

    MD5

    f17994b6fb3d2115069595d49d8b976b

    SHA1

    09d11b56dcbf03213ba850ef26d8e1e63553cabc

    SHA256

    7bfd8c9cc1e1676cbe14f50da9f72ff8555b3368c6089bca35b1a1f4ddd700f1

    SHA512

    db59a6c0259e138bb30e1c5d8a75e94223bdd1a1469d926e5923aeb5292786c0013268e4ce5054603bb7c7e67c155234d24d9476514ab56390e4781a7f6d342b

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z2D3H3V6\_pow[1].js

    Filesize

    3KB

    MD5

    29523af8a267e83b324b6cdb29c340e2

    SHA1

    3e98bcf6902e65df2333d09ae47e43921354f7a3

    SHA256

    7ee75a615b122fdd8e963f63f4b0294a987b664fb66dfe4abccf3b33aeca666d

    SHA512

    86c656139c751142eb0432c72187ca12d5e52effc1ca6186a8a7e57cf0bad51a30727520a8c4001e3ad695797cb1d3667ae9d2443e0eacb93ac3f2c980fc7c0e

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z2D3H3V6\iconify.min[1].js

    Filesize

    25KB

    MD5

    e03e81386c237437b6e309ad988c7273

    SHA1

    595144883cf473fbdd9e88d55109d698b2f70f64

    SHA256

    98d393ba8bc8f81c23d5337f45bac1618c355308a57eccfd30b4af1be8e6469b

    SHA512

    a10d7243048421cf424dc2bba5f7c4c92f1fc689b6894590ac02e4de3dfec1f7520e343bec465bcc63067b665899fa02f0cf6f478edaa5b4b56586d6d39cbfa6

  • C:\Users\Admin\AppData\Local\Temp\Cab61C1.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar6241.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Local\Temp\tmp8D51.tmp.bat

    Filesize

    157B

    MD5

    beae32efc8b6bc8a7b35e8b8a41b40df

    SHA1

    bf09dfe027523df59a80549a7b69235929f2fdca

    SHA256

    f8ed7649a33cb925816a4b34dbe4d7a661140aeb1952d78f50130b7449acf7f1

    SHA512

    b0b3f25fbe9dc0f07261b0dfa5599fab7f44d0523905365eaf4ecabceb9b1bce3f4e5e54845571a7d2b8adbc217a49333d250aad4f456b87439f42939e58b972

  • memory/588-4-0x000007FEF5C00000-0x000007FEF65EC000-memory.dmp

    Filesize

    9.9MB

  • memory/588-0-0x000007FEF5C03000-0x000007FEF5C04000-memory.dmp

    Filesize

    4KB

  • memory/588-3-0x000007FEF5C03000-0x000007FEF5C04000-memory.dmp

    Filesize

    4KB

  • memory/588-2-0x000007FEF5C00000-0x000007FEF65EC000-memory.dmp

    Filesize

    9.9MB

  • memory/588-1-0x0000000001290000-0x00000000012A4000-memory.dmp

    Filesize

    80KB

  • memory/588-1702-0x000007FEF5C00000-0x000007FEF65EC000-memory.dmp

    Filesize

    9.9MB