Analysis
-
max time kernel
298s -
max time network
229s -
platform
windows7_x64 -
resource
win7-20230220-es -
resource tags
arch:x64arch:x86image:win7-20230220-eslocale:es-esos:windows7-x64systemwindows -
submitted
23-03-2023 08:19
Static task
static1
Behavioral task
behavioral1
Sample
MEMZ 3.0/MEMZ.bat
Resource
win7-20230220-es
Behavioral task
behavioral2
Sample
MEMZ 3.0/MEMZ.bat
Resource
win10v2004-20230221-es
Behavioral task
behavioral3
Sample
MEMZ 3.0/MEMZ.exe
Resource
win7-20230220-es
Behavioral task
behavioral4
Sample
MEMZ 3.0/MEMZ.exe
Resource
win10v2004-20230220-es
General
-
Target
MEMZ 3.0/MEMZ.exe
-
Size
12KB
-
MD5
a7bcf7ea8e9f3f36ebfb85b823e39d91
-
SHA1
761168201520c199dba68add3a607922d8d4a86e
-
SHA256
3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42
-
SHA512
89923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523
-
SSDEEP
192:HMDLTxWDf/pl3cIEiwqZKBktLe3P+qf2jhP6B5b2yL3:H4IDH3cIqqvUWq+jhyT2yL
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
MEMZ.exedescription ioc process File opened for modification \??\PhysicalDrive0 MEMZ.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006e8f12fa8cd8fd499ff2c01df6bc8a3c000000000200000000001066000000010000200000002cbed8f4347aed32506401e6bcc465515fada3ce5e57e6a7fd165902ce327224000000000e800000000200002000000069a943f4f657424f791a69d54146120c4a53ade01c29e58d74d4c2b1e0f7061d90000000c3f6ea179f602c1be85892929af845c857ebb4e2062edaf0a000c9d28001e9ee6cc0f2198967c059020580ec29a8afc317df7cabc6655ecf7022335500eeb68e7a817f92762267c6b2dd205477978b4fb59714b4f5a4aa9054db18cf477edaf13cb354d04fcda669d47b011509074ca3c31d42e0c52af25d5ab916c9513136556f58c2bfdbe2166110e78eea0713578f40000000d024f3ce321b5a47b798ba844c3a907410fdba0fb13f3e39fc44989233201574fbc566e48870ae5e8a9a496f5f6d6e3430316bb05139be96a03ac4cda67db8f4 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AC5B0461-C953-11ED-95EE-4E1956A5016B} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "386324649" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e08c2787605dd901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006e8f12fa8cd8fd499ff2c01df6bc8a3c0000000002000000000010660000000100002000000042aa27cf2c99e846b1e7c91d63ed79fa7c9214dfe4166703277890f0707ff435000000000e8000000002000020000000126a999ec21490159f628e433a6b25a4e2fad9adc42ce5730e6ae8a654e795be200000003e41c536a72a40cd04a04fde1c65649bd34d190afdf071406fe1142da267154a4000000079bd28d676885400ac71b2edfa7c133cd9f601e953a4871c2f92c2394c447f4c30652842c711f54462309d66c3493a06793564d2fbdc6eb1861626651e0d8781 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\es-ES = "es-ES.1" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
MEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exepid process 1588 MEMZ.exe 508 MEMZ.exe 1492 MEMZ.exe 828 MEMZ.exe 624 MEMZ.exe 1588 MEMZ.exe 508 MEMZ.exe 1492 MEMZ.exe 828 MEMZ.exe 624 MEMZ.exe 1588 MEMZ.exe 508 MEMZ.exe 1492 MEMZ.exe 828 MEMZ.exe 624 MEMZ.exe 1588 MEMZ.exe 508 MEMZ.exe 1492 MEMZ.exe 828 MEMZ.exe 624 MEMZ.exe 1588 MEMZ.exe 508 MEMZ.exe 1492 MEMZ.exe 828 MEMZ.exe 624 MEMZ.exe 1588 MEMZ.exe 508 MEMZ.exe 1492 MEMZ.exe 828 MEMZ.exe 624 MEMZ.exe 1588 MEMZ.exe 508 MEMZ.exe 1492 MEMZ.exe 828 MEMZ.exe 624 MEMZ.exe 1588 MEMZ.exe 508 MEMZ.exe 1492 MEMZ.exe 828 MEMZ.exe 624 MEMZ.exe 1588 MEMZ.exe 508 MEMZ.exe 1492 MEMZ.exe 828 MEMZ.exe 624 MEMZ.exe 1588 MEMZ.exe 508 MEMZ.exe 1492 MEMZ.exe 828 MEMZ.exe 624 MEMZ.exe 1588 MEMZ.exe 508 MEMZ.exe 1492 MEMZ.exe 624 MEMZ.exe 828 MEMZ.exe 1588 MEMZ.exe 508 MEMZ.exe 1492 MEMZ.exe 828 MEMZ.exe 624 MEMZ.exe 1588 MEMZ.exe 508 MEMZ.exe 1492 MEMZ.exe 828 MEMZ.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
AUDIODG.EXEdescription pid process Token: 33 824 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 824 AUDIODG.EXE Token: 33 824 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 824 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 872 iexplore.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
iexplore.exeIEXPLORE.EXEMEMZ.exepid process 872 iexplore.exe 872 iexplore.exe 1624 IEXPLORE.EXE 1624 IEXPLORE.EXE 1624 IEXPLORE.EXE 1624 IEXPLORE.EXE 1344 MEMZ.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
MEMZ.exeMEMZ.exeiexplore.exedescription pid process target process PID 932 wrote to memory of 1588 932 MEMZ.exe MEMZ.exe PID 932 wrote to memory of 1588 932 MEMZ.exe MEMZ.exe PID 932 wrote to memory of 1588 932 MEMZ.exe MEMZ.exe PID 932 wrote to memory of 1588 932 MEMZ.exe MEMZ.exe PID 932 wrote to memory of 508 932 MEMZ.exe MEMZ.exe PID 932 wrote to memory of 508 932 MEMZ.exe MEMZ.exe PID 932 wrote to memory of 508 932 MEMZ.exe MEMZ.exe PID 932 wrote to memory of 508 932 MEMZ.exe MEMZ.exe PID 932 wrote to memory of 1492 932 MEMZ.exe MEMZ.exe PID 932 wrote to memory of 1492 932 MEMZ.exe MEMZ.exe PID 932 wrote to memory of 1492 932 MEMZ.exe MEMZ.exe PID 932 wrote to memory of 1492 932 MEMZ.exe MEMZ.exe PID 932 wrote to memory of 828 932 MEMZ.exe MEMZ.exe PID 932 wrote to memory of 828 932 MEMZ.exe MEMZ.exe PID 932 wrote to memory of 828 932 MEMZ.exe MEMZ.exe PID 932 wrote to memory of 828 932 MEMZ.exe MEMZ.exe PID 932 wrote to memory of 624 932 MEMZ.exe MEMZ.exe PID 932 wrote to memory of 624 932 MEMZ.exe MEMZ.exe PID 932 wrote to memory of 624 932 MEMZ.exe MEMZ.exe PID 932 wrote to memory of 624 932 MEMZ.exe MEMZ.exe PID 932 wrote to memory of 1344 932 MEMZ.exe MEMZ.exe PID 932 wrote to memory of 1344 932 MEMZ.exe MEMZ.exe PID 932 wrote to memory of 1344 932 MEMZ.exe MEMZ.exe PID 932 wrote to memory of 1344 932 MEMZ.exe MEMZ.exe PID 1344 wrote to memory of 584 1344 MEMZ.exe notepad.exe PID 1344 wrote to memory of 584 1344 MEMZ.exe notepad.exe PID 1344 wrote to memory of 584 1344 MEMZ.exe notepad.exe PID 1344 wrote to memory of 584 1344 MEMZ.exe notepad.exe PID 1344 wrote to memory of 872 1344 MEMZ.exe iexplore.exe PID 1344 wrote to memory of 872 1344 MEMZ.exe iexplore.exe PID 1344 wrote to memory of 872 1344 MEMZ.exe iexplore.exe PID 1344 wrote to memory of 872 1344 MEMZ.exe iexplore.exe PID 872 wrote to memory of 1624 872 iexplore.exe IEXPLORE.EXE PID 872 wrote to memory of 1624 872 iexplore.exe IEXPLORE.EXE PID 872 wrote to memory of 1624 872 iexplore.exe IEXPLORE.EXE PID 872 wrote to memory of 1624 872 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /main2⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" \note.txt3⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://google.co.ck/search?q=how+to+create+your+own+ransomware3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:872 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5281⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
61KB
MD5e71c8443ae0bc2e282c73faead0a6dd3
SHA10c110c1b01e68edfacaeae64781a37b1995fa94b
SHA25695b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72
SHA512b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD53af6cd90036f7948a7a5ce725a0d8a49
SHA18f83e4973ed0af13d7dbd60e147d515609b6755c
SHA25688221032b37f2507002dc6e91d0e3186f40f4d0a31b9046fb0181ac0a5cd63da
SHA5120b986cc7130711c84de6e816a2104c11d0d1bdfcb05c8af832213d35e043c50821739b21fcaac308d671122527d8e2887ea13dab254818825a9839875f6455d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD50447d5e8f1fc6f07bd95101a1a100ef6
SHA1c213dfe6ca2942841ec1573c9a2cc4999796a4fb
SHA256a5f16f982b2c0adf0192628f1f0c6e2b375799743f6a95a9f40c9cf3d4d7c547
SHA5124c0003881087cfc2aecf20d8c705c79bd437b814a287bf022158e214a0a4870dd3c4fca8623bc486b5da631a705823cfde1ffa0a7257a17f4d3b470ff67fd421
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD512c9a3d8774e69a603ebfc3c3f7e019a
SHA1860fb14927fac77158c214970b11f47e20f4178f
SHA25699f7847c05fa7848802ff8e6b1795bbc1066d474adc20249c0974d8265ecab6d
SHA51273ddcc39ea43f7748e6c3153ea6e465c4166db96676b9f06f302ee2215b36ad05706dfaa1d5bb4c5a3f56bd1439260d74d9c0608effa3e4043991d50ec60cd28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5bccaa3f7d1061f67bded18827aa0d854
SHA175f4cad9b2d82e48dd46635ab25bfca5582c704a
SHA256e7f7d22f0314cb530f5b54657deec415d4bc468752944779f577ddcb3ca33e25
SHA512f6327d00a9094d29fca8b05459016eb7cc2937777117fb3a0a98d61ff3396a3998697ca2de8e09c607083335c24c516194d12659d695eda3525158dae3fbf46a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5b971cbe63727c56855f619661f7f7e56
SHA1fa0de0bb8ae3b1a9246ba5377dceb5033a2709ee
SHA2563d7d860125b68f2c3ee6098a541862de6705d8652a2380995d9b1b567db7d7ec
SHA512c76a9fcf1ab0192888be87e77b2d33fdcde7db3eca2d607330389d34e3600b2c87337b1c4f2cd00ff1db3522a2bffa0272b54343078445b500b6f143886c8e0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD56285d35c37d24214950676ace577c0c4
SHA1da8920c7887ded9180d94323e326dde87c77f615
SHA25643c36b7adb4fd252dc90a69a80127aa44ad43c6c9c1866a0f6ab5ff0d1b8b74e
SHA512562afc70c871ff03221c26670af9c17c7462a023a27a4d6fb13219892434aaef1c0b705ebc001764f494e16130c7e1e1c3229efd5e9c512ce8e7ce8d829a0662
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5c8a026176495071cfe2d7043a117b86c
SHA1e01cac24597c0736bc068deceafad0f3400167f4
SHA2564af4a4c0b5c1276f9b2e6fdbcd83e3fce5145598961f5af5a08b6b760e0a143c
SHA512ec8930b4bae9925dd2021b8d1203e18921338961a488b94222916c389a2fb1bb5d5c7fb443249658ef1f7ff3e69ef409e7cfac70d69980c6cf30032e81c14ae7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD579afdd22717a1f4fe9de5a15a6c3e908
SHA1897bc7c0a436c85468876aad77b1cd837a7575cf
SHA2568683f990358eb8d506598524f307ac7534068c7e1d93abe30a23ebce209c81cb
SHA512560fffdde0c29d3d3e10daa51e60665e9d54dc56421309aa2e8504aeaf8cc7148e1c40dd5ed6c08b696958a0b98f6ad58dbf07b5c758f63788d72716547a637a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD50608df50d5e975fe81f30cbcfd86a5ba
SHA138181c4303f611bb4846a9b980dfa37271d677a7
SHA2566c8b631f43a1d2ef483e73b872fe232b6d3c034385fd6ffd66d68dee7c9b7e61
SHA5125cae0c5686c849ff9c0ae14ac50132017c08048b848f8c7885b776dc5af7899822651cebcd53bbac91be279974c96103992dbf80ab9ae2d4889847409c21c49b
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\62yy7f8\imagestore.datFilesize
9KB
MD53e8131d48a8e13e7fc7488f03e608aba
SHA14f0bee484c48883e22516b14e2748af510b5e4c9
SHA256fda89df1074e9642a5b5965bd190921c117b344f15a339a1141f992eacc1f931
SHA5125e89be066361404d0f26774f3fc25fbbd74d77737d35d3fd2f5e58b7c362840b4903e9f04378e89cafbb09e22da2f6bef819cacefae750e0de5725d31f016e5b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BJWXLGAS\suggestions[1].es-ESFilesize
18KB
MD5e2749896090665aeb9b29bce1a591a75
SHA159e05283e04c6c0252d2b75d5141ba62d73e9df9
SHA256d428ea8ca335c7cccf1e1564554d81b52fb5a1f20617aa99136cacf73354e0b7
SHA512c750e9ccb30c45e2c4844df384ee9b02b81aa4c8e576197c0811910a63376a7d60e68f964dad858ff0e46a8fd0952ddaf19c8f79f3fd05cefd7dbf2c043d52c5
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T22XS5WA\favicon[2].icoFilesize
5KB
MD5f3418a443e7d841097c714d69ec4bcb8
SHA149263695f6b0cdd72f45cf1b775e660fdc36c606
SHA2566da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
SHA51282d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563
-
C:\Users\Admin\AppData\Local\Temp\CabD9BF.tmpFilesize
61KB
MD5fc4666cbca561e864e7fdf883a9e6661
SHA12f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA25610f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d
-
C:\Users\Admin\AppData\Local\Temp\TarD9C0.tmpFilesize
161KB
MD573b4b714b42fc9a6aaefd0ae59adb009
SHA1efdaffd5b0ad21913d22001d91bf6c19ecb4ac41
SHA256c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd
SHA51273af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd
-
C:\Users\Admin\AppData\Local\Temp\TarDC08.tmpFilesize
161KB
MD5be2bec6e8c5653136d3e72fe53c98aa3
SHA1a8182d6db17c14671c3d5766c72e58d87c0810de
SHA2561919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd
SHA5120d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\KKV1NHL5.txtFilesize
607B
MD542482c71fe0b2e753a279d20bb4de49c
SHA1fec9139ed231393f64b01cab066d00d5f811bd05
SHA256edcf6575a9eef8201a45af3d70221f81a29143942de616093e22e6581e60d2a3
SHA51209cffba6c502a14e2603e457e6ebaa8c3f294e78eaf3676710279b3e0d8cad5b88212b4985f24f5b3edd5a021f956ae8b11e61ef205e9b1d5bfad329b98a35af
-
C:\note.txtFilesize
218B
MD5afa6955439b8d516721231029fb9ca1b
SHA1087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA2568e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
SHA5125da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf