Resubmissions
07-04-2023 08:11
230407-j3f3zaae2s 707-04-2023 08:08
230407-j1q56aad91 707-04-2023 07:42
230407-jj2wbsad6z 7Analysis
-
max time kernel
448s -
max time network
397s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
07-04-2023 08:11
Static task
static1
Behavioral task
behavioral1
Sample
MEMZ 3.0/MEMZ.bat
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
MEMZ 3.0/MEMZ.bat
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
MEMZ 3.0/MEMZ.exe
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
MEMZ 3.0/MEMZ.exe
Resource
win10v2004-20230220-en
General
-
Target
MEMZ 3.0/MEMZ.exe
-
Size
12KB
-
MD5
a7bcf7ea8e9f3f36ebfb85b823e39d91
-
SHA1
761168201520c199dba68add3a607922d8d4a86e
-
SHA256
3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42
-
SHA512
89923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523
-
SSDEEP
192:HMDLTxWDf/pl3cIEiwqZKBktLe3P+qf2jhP6B5b2yL3:H4IDH3cIqqvUWq+jhyT2yL
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
MEMZ.exedescription ioc process File opened for modification \??\PhysicalDrive0 MEMZ.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dbb59ddc676e394a83d3f942d26f43ca000000000200000000001066000000010000200000004066443e0c002a7dce04de2c074a5f449bddaf8a29906273f44f2356fe588641000000000e8000000002000020000000acd26416ac35ab874a01c1fcfadb19ec2d8815d6b92788237c562a851da4b1ea900000000c4721e3ba95c42bb691321d1f6ebccbd826a4403609ec86e4659dc4d569945cc999742ee25b0deeb19bce8264ff0c2c2ae656b892901b7dceccf74cd13271dbfab1909f795fb083272b9862842ba7d04eafaac72080201e76b936ecf2b64408984606e8c6ef3612a21a81265ff79f3d94f2cd2ba95b699d399f8916ce816edfa555c9dfdbf3f400b7443b43e7ed85d040000000c2090c734f3b522c5ee05247c5013081cff9d3ac8f148b8e63cd84636003bdcd58e0563781bb7d8d66c6dc0d534b18c816b2ef78a2f328049747ea16130e6d3f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dbb59ddc676e394a83d3f942d26f43ca0000000002000000000010660000000100002000000034a6c5de65602aa868b27e6e774c766897ea5bc165188436672030f7cf188f4f000000000e800000000200002000000095d267256cded047aa152e72b1045e173d70a4160015480db0c871f82f8ac9dc20000000f658b025cc0df7e6760f089fbad7ed4c9b8f87020bf78561193ff4bf80f3a83b40000000a27ece9b1ad4e079b0c46743a22cccd8a78b2b6dcaa025f21fcb82fc72db42777abc6e358ccaf8130da734d98f724b928885175fc4519597e963111413bd2494 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 708b4a7d3969d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "387627295" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A26FA341-D52C-11ED-9688-F2A4F945A9C1} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
MEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exepid process 1804 MEMZ.exe 840 MEMZ.exe 900 MEMZ.exe 2028 MEMZ.exe 1760 MEMZ.exe 840 MEMZ.exe 1804 MEMZ.exe 900 MEMZ.exe 2028 MEMZ.exe 1760 MEMZ.exe 1804 MEMZ.exe 840 MEMZ.exe 900 MEMZ.exe 2028 MEMZ.exe 1760 MEMZ.exe 1804 MEMZ.exe 840 MEMZ.exe 900 MEMZ.exe 2028 MEMZ.exe 1760 MEMZ.exe 1804 MEMZ.exe 840 MEMZ.exe 900 MEMZ.exe 2028 MEMZ.exe 1760 MEMZ.exe 1804 MEMZ.exe 840 MEMZ.exe 900 MEMZ.exe 2028 MEMZ.exe 1760 MEMZ.exe 1804 MEMZ.exe 840 MEMZ.exe 900 MEMZ.exe 2028 MEMZ.exe 1760 MEMZ.exe 1804 MEMZ.exe 840 MEMZ.exe 900 MEMZ.exe 2028 MEMZ.exe 1760 MEMZ.exe 1804 MEMZ.exe 840 MEMZ.exe 900 MEMZ.exe 2028 MEMZ.exe 1760 MEMZ.exe 1804 MEMZ.exe 840 MEMZ.exe 900 MEMZ.exe 2028 MEMZ.exe 1760 MEMZ.exe 1804 MEMZ.exe 840 MEMZ.exe 900 MEMZ.exe 2028 MEMZ.exe 1760 MEMZ.exe 1804 MEMZ.exe 840 MEMZ.exe 900 MEMZ.exe 2028 MEMZ.exe 1760 MEMZ.exe 1804 MEMZ.exe 840 MEMZ.exe 900 MEMZ.exe 2028 MEMZ.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
AUDIODG.EXEdescription pid process Token: 33 1308 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1308 AUDIODG.EXE Token: 33 1308 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1308 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 268 iexplore.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
iexplore.exeIEXPLORE.EXEMEMZ.exepid process 268 iexplore.exe 268 iexplore.exe 924 IEXPLORE.EXE 924 IEXPLORE.EXE 924 IEXPLORE.EXE 924 IEXPLORE.EXE 1312 MEMZ.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
MEMZ.exeMEMZ.exeiexplore.exedescription pid process target process PID 1308 wrote to memory of 1804 1308 MEMZ.exe MEMZ.exe PID 1308 wrote to memory of 1804 1308 MEMZ.exe MEMZ.exe PID 1308 wrote to memory of 1804 1308 MEMZ.exe MEMZ.exe PID 1308 wrote to memory of 1804 1308 MEMZ.exe MEMZ.exe PID 1308 wrote to memory of 840 1308 MEMZ.exe MEMZ.exe PID 1308 wrote to memory of 840 1308 MEMZ.exe MEMZ.exe PID 1308 wrote to memory of 840 1308 MEMZ.exe MEMZ.exe PID 1308 wrote to memory of 840 1308 MEMZ.exe MEMZ.exe PID 1308 wrote to memory of 900 1308 MEMZ.exe MEMZ.exe PID 1308 wrote to memory of 900 1308 MEMZ.exe MEMZ.exe PID 1308 wrote to memory of 900 1308 MEMZ.exe MEMZ.exe PID 1308 wrote to memory of 900 1308 MEMZ.exe MEMZ.exe PID 1308 wrote to memory of 2028 1308 MEMZ.exe MEMZ.exe PID 1308 wrote to memory of 2028 1308 MEMZ.exe MEMZ.exe PID 1308 wrote to memory of 2028 1308 MEMZ.exe MEMZ.exe PID 1308 wrote to memory of 2028 1308 MEMZ.exe MEMZ.exe PID 1308 wrote to memory of 1760 1308 MEMZ.exe MEMZ.exe PID 1308 wrote to memory of 1760 1308 MEMZ.exe MEMZ.exe PID 1308 wrote to memory of 1760 1308 MEMZ.exe MEMZ.exe PID 1308 wrote to memory of 1760 1308 MEMZ.exe MEMZ.exe PID 1308 wrote to memory of 1312 1308 MEMZ.exe MEMZ.exe PID 1308 wrote to memory of 1312 1308 MEMZ.exe MEMZ.exe PID 1308 wrote to memory of 1312 1308 MEMZ.exe MEMZ.exe PID 1308 wrote to memory of 1312 1308 MEMZ.exe MEMZ.exe PID 1312 wrote to memory of 1912 1312 MEMZ.exe notepad.exe PID 1312 wrote to memory of 1912 1312 MEMZ.exe notepad.exe PID 1312 wrote to memory of 1912 1312 MEMZ.exe notepad.exe PID 1312 wrote to memory of 1912 1312 MEMZ.exe notepad.exe PID 1312 wrote to memory of 268 1312 MEMZ.exe iexplore.exe PID 1312 wrote to memory of 268 1312 MEMZ.exe iexplore.exe PID 1312 wrote to memory of 268 1312 MEMZ.exe iexplore.exe PID 1312 wrote to memory of 268 1312 MEMZ.exe iexplore.exe PID 268 wrote to memory of 924 268 iexplore.exe IEXPLORE.EXE PID 268 wrote to memory of 924 268 iexplore.exe IEXPLORE.EXE PID 268 wrote to memory of 924 268 iexplore.exe IEXPLORE.EXE PID 268 wrote to memory of 924 268 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /main2⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" \note.txt3⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://google.co.ck/search?q=what+happens+if+you+delete+system323⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:268 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x16c1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
61KB
MD5e71c8443ae0bc2e282c73faead0a6dd3
SHA10c110c1b01e68edfacaeae64781a37b1995fa94b
SHA25695b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72
SHA512b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD59e90ab2c51f29f20cd966b7da51f957c
SHA114531166e8ed8227015e5ff2083f388a720b1ef5
SHA256f2a96f4464e4c69a63133ad29ae4043182bf07483b504ca6260db63f635224da
SHA5127016534452bb1ac9f4b1e78df09c2338a86e2da5a20d9336e6ba59435d99481b5bf84e971eb72c4da5369ccc44bedd2999c495d379863ad61e6d0b19e3ad4a5f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5c83a682c3cf9280203d508b630218e25
SHA1f6c31f0a3ca42931864e1902b5bdaa5b49479f8f
SHA2560149b9742a0bc5764ce62b916093e251afe1e98cd717adbc513265dadee87f5f
SHA51237b9f67327109d8c84fd6df77f0cce86dc8c6f36fcf4f073d99e9e9b025f4246baf66b38c0075879936ee2b4dbabe3318dd7f42fef93c622fbbde51312834afe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD52e39c5d37add7dc397b31521e55e600e
SHA1440457f2a9be56b65d116fbf86a4761df7f01d50
SHA25689adead3df6f840c8ea0bc84be32a07fc92994bf0dd218d8f4fa1c1ecc942ac9
SHA5125f93057e0bd7d21691176452167437d26fad0c43ada46e823f9cc67376932c088341e06262998d3795f5f99329c204abb35a749e2d030c95c917e9f8da0ac0cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5b6903a284d12ded44a9ac8289511d6c5
SHA16c5bcc79bce40897974c5fd4351a6d53d9fa7d06
SHA256d23f9a2845cf3aa0909f4c67591da067648fe413f3e9bf3f0b99d82321a672cf
SHA5128f69a3408a8f6629c01d3f7d6b65a31ae34ca832ffad76dc8974638096af64cffe53322389166b38d706572a65df38de1ca9b7db18be39bd653d2239f7db2fbf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD50eaaa6691abf20a5c29af98407d9b4bc
SHA1569c6a6edbaf2f3fff81bb031ada5b26110afe50
SHA2561c3bf59493cceb4cdf7376066504c38aa62072cdcdf153609c3ea7d08d95b75c
SHA512f109ecd14ac04893c1b70d636901be81786ecbd3edb7cd8681dc5b744543ffaa773b40f32fb515640b2d59aa1d048920242818b7727d2dd3d22b792bd686c79f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD56757c6b209430b6a8f06d4d8717920b1
SHA1b9009c6bc44725703933e3622472f15f0bb9afd4
SHA2567a4d56bad7d30a5e1bc83961418ac19c6f56bf083ca4be4b1cc1ccb673d81dd3
SHA51239ad879b124d755af34680f65e78efaf3b8df04f13f83c7f4728cdfc31ead37de27ce4847225bb3ca6596cd31d52bd8204bfe916779b4effa6677238ab7d56ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5528792f2d07b30fd1c157c4c9722283e
SHA18179a2fbb0bf4e2b3cb727a072f98039fb94f885
SHA2567bb103fcf3eb19c3e12faea7e6c52df121b1182d232235bdb7d1d901b3acf857
SHA51212da8063e15d35297b4fe7953689e628fda1e1e4ed31fd021b2289bc2dedb419f358af5abb79b09a6fac8c303fe16035278990818cc5f63319aed311d283ad25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5d31bb96b1148d098e85ba6855817bf18
SHA13f29b815d6fcb4df318a2e431760ef97a7afce25
SHA256028afa57402575bce4377473da6eb33577bcd7b131fcf24bf1fba825da0f04f0
SHA51266187a758527620a585451655cd43557b60c6ce25865da7f790267c19043ad4bf707960697bdb4c692fe86a7b25dc883e8e7908b25be3c6b754381b3c1a329a3
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\07asiie\imagestore.datFilesize
9KB
MD58722e9a322d106652f0b16bc4293c587
SHA1bfdd0b4c4fb57f3b7bfe1beae08b8d89d7354f6a
SHA2568a90e0d8881e191074643d3f4c2de1af7fd3f1649fd73e7bee66acf8387285f4
SHA512763459470e7ef5151b99f1d728292066ccb4ec24a0078dbda68c47ac15332154785db8a7fdc0265f9b7629affc4a57efa7a4ac5711c207e8645cb2159349a6d8
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T210ZMR0\favicon[2].icoFilesize
5KB
MD5f3418a443e7d841097c714d69ec4bcb8
SHA149263695f6b0cdd72f45cf1b775e660fdc36c606
SHA2566da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
SHA51282d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TF0W5LQL\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Temp\CabA3A0.tmpFilesize
61KB
MD5fc4666cbca561e864e7fdf883a9e6661
SHA12f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA25610f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d
-
C:\Users\Admin\AppData\Local\Temp\TarC6CC.tmpFilesize
161KB
MD573b4b714b42fc9a6aaefd0ae59adb009
SHA1efdaffd5b0ad21913d22001d91bf6c19ecb4ac41
SHA256c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd
SHA51273af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd
-
C:\Users\Admin\AppData\Local\Temp\TarC943.tmpFilesize
161KB
MD5be2bec6e8c5653136d3e72fe53c98aa3
SHA1a8182d6db17c14671c3d5766c72e58d87c0810de
SHA2561919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd
SHA5120d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\5WBF52ZJ.txtFilesize
606B
MD539faf180a14b327e3c4e2b30896da27f
SHA1ac4a10981616d27884d3b209367ddba7956f9505
SHA25623d7cdd34e850a451afd0dbba7cd26eeb6fcca64098a81d8f7d002c34520993f
SHA512b084985803c944c2c3545e64a63b0812530e1d92f45232739d0feeb4f76079ad0a0811775105fcba635872afccb0f9e8852c0fbfbaf692430b8303640b205541
-
C:\note.txtFilesize
218B
MD5afa6955439b8d516721231029fb9ca1b
SHA1087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA2568e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
SHA5125da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf