Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
19/04/2024, 18:02
Static task
static1
Behavioral task
behavioral1
Sample
faddc3f2bbd29804c67442c527a45890_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
faddc3f2bbd29804c67442c527a45890_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
faddc3f2bbd29804c67442c527a45890_JaffaCakes118.exe
-
Size
1.3MB
-
MD5
faddc3f2bbd29804c67442c527a45890
-
SHA1
52076fedaa0592bc81bd4bfeb7cfb90c29db473b
-
SHA256
5a9d617e78467db2648608417a550c0cd2072708962d8afebdd865d08f4ae13e
-
SHA512
764da64df51ddcae6641c9f267e4c00752e13e73cd4126196fed74f790deda1e98f4a0e33dd111f65d302c1a79ccddb1e89f4d1b2a1fab643f20f81c77ec70d8
-
SSDEEP
24576:FHLI4YHHEmomR1VN0F6tr/OzBBSDrz1nPTdgdXrdBHLcsH661S0C0xytR:VAkX0N0gtr/AShnUBHLcsauCJR
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3064 faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp 2840 KAV_97_10.exe -
Loads dropped DLL 6 IoCs
pid Process 2996 faddc3f2bbd29804c67442c527a45890_JaffaCakes118.exe 3064 faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp 3064 faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp 3064 faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp 3064 faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp 2540 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 6 IoCs
description ioc Process File created C:\Program Files (x86)\prgenerate\is-0AOVI.tmp faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp File opened for modification C:\Program Files (x86)\prgenerate\is-0AOVI.tmp faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp File created C:\Program Files (x86)\prgenerate\is-JQQDV.tmp faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp File created C:\Program Files (x86)\prgenerate\is-GN3V8.tmp faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp File opened for modification C:\Program Files (x86)\prgenerate\unins000.dat faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp File created C:\Program Files (x86)\prgenerate\unins000.dat faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp -
Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\vistaw7\infofile.tmp faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp File created C:\Windows\vistaw7\KAV_97_10.exe faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp File created C:\Windows\vistaw7\serverID.txt faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp File created C:\Windows\vistaw7\taobao.ico faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp File created C:\Windows\vistaw7\Install.tmp faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp File created C:\Windows\vistaw7\comrundu.ducc faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp File created C:\Windows\vistaw7\honst.uic faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp File created C:\Windows\Condu.lnk faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp File opened for modification C:\Windows\vistaw7\Install.tmp faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp File created C:\Windows\vistaw7\Config.ini faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp File created C:\Windows\vistaw7\rd.txt faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c78d0f926d482f4e9ff8108b299eda70000000000200000000001066000000010000200000006b77c87af4472c81a3bdec01cf7b3c5b78407d68dab7b11d1404fe92f64f06e8000000000e8000000002000020000000a961b1d2db7c5d70723de6f45123154df971eac7c3f0fe124269230b556abc4e90000000561caf45e09b4cfa187c6c38c912bf3fc1b98a86aab8f645f67d5d1732089458a44abdb4cfb86e7ea2009ad7e5038ff5794c2cb89b95e3c9b9fbe53ec12b2ef90d359e98624ac2cc3d6a50c1f6a92a2307c6bc302a21f64019aceddf61a2233714767ba1bcce2aaec5f71b32865fedb6b1c4a1b4f9a5dcc6a334b57fadfe15708672a70c391e798f6205db2b255236e1400000002eab49a7910db4d90a8ee7d77b2eccd420aeb6a75d49369dc648f44f0cdb60a91ed45e62fe049ec2584d6ffa430bf76bb23abffed47cf03d1ea34cd6aeaffa3d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c78d0f926d482f4e9ff8108b299eda7000000000020000000000106600000001000020000000ca5c69c1217cb734d2529d12a3b446043e9ad1ec4322b9c88af3e52dcf9080c8000000000e8000000002000020000000ee0dbd9b23ac85d75254c300c3e0458ced42042f0db71dd39beb79160baa2645200000007be786ce72fb450296b27a9034dbd602787ceed3416c5c8a16f1e736b02b8fe6400000005870d6bb4d9ba116025589dc14dfe87849efdf34f33441eef05a96a0409c67d55cd137102d90412fcefdc69835691490b5e99337f69d151de77f099af3abdc2a iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{63B05D51-FE77-11EE-BD3E-4EA2EAC189B7} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419711790" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0fb7e778492da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe -
Modifies registry class 53 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\uic\Shell\Open\ faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idno = "0" KAV_97_10.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\uic\DefaultIcon faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\uic\Shell faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5} KAV_97_10.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\NodeSlot = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID KAV_97_10.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0} KAV_97_10.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\uic faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 58003100000000007d57cc8a14204d4943524f537e310000400008000400efbeee3a851a7d57cc8a2a000000860100000000010000000000000000000000000000004d006900630072006f0073006f0066007400000018000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\uic\Shell\Open\Command faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 5c003100000000007d57b68b122050524f4752417e330000440008000400efbeee3a851a7d57b68b2a00000085010000000001000000000000000000000000000000500072006f006700720061006d004400610074006100000018000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\uic\Shell\Open faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 8200310000000000ee3a2828110053544152544d7e3100006a0008000400efbeee3a851aee3a28282a000000bb0100000000010000000000000000004000000000005300740061007200740020004d0065006e007500000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003600000018000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 = 7a00310000000000ee3acd2611005374617274757000640008000400efbeee3a851aee3acc262a000000c50100000000010000000000000000003a00000000005300740061007200740075007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003700000016000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node KAV_97_10.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories KAV_97_10.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.uic faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idex = "353d47319c729fa32fe31cc420b9e676" KAV_97_10.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.uic\ = "uic" faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 52003100000000007e571708102057696e646f7773003c0008000400efbeee3a851a7e5717082a000000b1010000000001000000000000000000000000000000570069006e0064006f0077007300000016000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 7e003100000000007d57c48b110050726f6772616d730000660008000400efbeee3a851a7d57c48b2a000000bc0100000000010000000000000000003c0000000000500072006f006700720061006d007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003200000018000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\MRUListEx = ffffffff explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\uic\Shell\Open\Command\ = "\"Rundll32.exe\" \"C:\\Windows\\vistaw7\\infofile.icl\" Resetrun" faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 explorer.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3064 faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp 2076 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2076 iexplore.exe 2076 iexplore.exe 1752 IEXPLORE.EXE 1752 IEXPLORE.EXE 1752 IEXPLORE.EXE 1752 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2996 wrote to memory of 3064 2996 faddc3f2bbd29804c67442c527a45890_JaffaCakes118.exe 28 PID 2996 wrote to memory of 3064 2996 faddc3f2bbd29804c67442c527a45890_JaffaCakes118.exe 28 PID 2996 wrote to memory of 3064 2996 faddc3f2bbd29804c67442c527a45890_JaffaCakes118.exe 28 PID 2996 wrote to memory of 3064 2996 faddc3f2bbd29804c67442c527a45890_JaffaCakes118.exe 28 PID 3064 wrote to memory of 2476 3064 faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp 29 PID 3064 wrote to memory of 2476 3064 faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp 29 PID 3064 wrote to memory of 2476 3064 faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp 29 PID 3064 wrote to memory of 2476 3064 faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp 29 PID 3064 wrote to memory of 2540 3064 faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp 31 PID 3064 wrote to memory of 2540 3064 faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp 31 PID 3064 wrote to memory of 2540 3064 faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp 31 PID 3064 wrote to memory of 2540 3064 faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp 31 PID 3064 wrote to memory of 2540 3064 faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp 31 PID 3064 wrote to memory of 2540 3064 faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp 31 PID 3064 wrote to memory of 2540 3064 faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp 31 PID 3064 wrote to memory of 2076 3064 faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp 32 PID 3064 wrote to memory of 2076 3064 faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp 32 PID 3064 wrote to memory of 2076 3064 faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp 32 PID 3064 wrote to memory of 2076 3064 faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp 32 PID 3064 wrote to memory of 2840 3064 faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp 33 PID 3064 wrote to memory of 2840 3064 faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp 33 PID 3064 wrote to memory of 2840 3064 faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp 33 PID 3064 wrote to memory of 2840 3064 faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp 33 PID 3064 wrote to memory of 2840 3064 faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp 33 PID 3064 wrote to memory of 2840 3064 faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp 33 PID 3064 wrote to memory of 2840 3064 faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp 33 PID 2076 wrote to memory of 1752 2076 iexplore.exe 34 PID 2076 wrote to memory of 1752 2076 iexplore.exe 34 PID 2076 wrote to memory of 1752 2076 iexplore.exe 34 PID 2076 wrote to memory of 1752 2076 iexplore.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\faddc3f2bbd29804c67442c527a45890_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\faddc3f2bbd29804c67442c527a45890_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\is-H8FRD.tmp\faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp"C:\Users\Admin\AppData\Local\Temp\is-H8FRD.tmp\faddc3f2bbd29804c67442c527a45890_JaffaCakes118.tmp" /SL5="$70120,1119550,51712,C:\Users\Admin\AppData\Local\Temp\faddc3f2bbd29804c67442c527a45890_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe" C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup3⤵PID:2476
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Windows\vistaw7\comrundu.ducc" message13⤵
- Loads dropped DLL
PID:2540
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.cdjspaper.com/3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2076 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1752
-
-
-
C:\Windows\vistaw7\KAV_97_10.exe"C:\Windows\vistaw7\KAV_97_10.exe"3⤵
- Executes dropped EXE
- Modifies registry class
PID:2840
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2760
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD555540a230bdab55187a841cfe1aa1545
SHA1363e4734f757bdeb89868efe94907774a327695e
SHA256d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize1KB
MD55b121a7a52f3006896ed592436d639b8
SHA1632d50b0321b02508806f709bf216604c25d5a0b
SHA25695b4c8faafe749b26c6e93dd581ae9be3fadcebd65d052afae4c9092fef61d50
SHA512bb3bfa2f47e35032dadfa5472d3b6c47643786a5fdb7d9fed79641f75c7e043d15f50fa5eb87133cc982547079b3e616247c9384c1154204b158ad83b11d77e2
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
889B
MD53e455215095192e1b75d379fb187298a
SHA1b1bc968bd4f49d622aa89a81f2150152a41d829c
SHA256ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99
SHA51254ba004d5435e8b10531431c392ed99776120d363808137de7eb59030463f863cadd02bdf918f596b6d20964b31725c2363cd7601799caa9360a1c36fe819fbd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4DD39726D4B55AC3B4119B35A893323C_5670351899FEFFE1111FCD3D8BEA636E
Filesize5B
MD55bfa51f3a417b98e7443eca90fc94703
SHA18c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA256bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
SHA5124cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
1KB
MD596c25031bc0dc35cfba723731e1b4140
SHA127ac9369faf25207bb2627cefaccbe4ef9c319b8
SHA256973a41276ffd01e027a2aad49e34c37846d3e976ff6a620b6712e33832041aa6
SHA51242c5b22334cd08c727fdec4aca8df6ec645afa8dd7fc278d26a2c800c81d7cff86fc107e6d7f28f1a8e4faf0216fd4d2a9af22d69714ca9099e457d1b2d5188a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize724B
MD58202a1cd02e7d69597995cabbe881a12
SHA18858d9d934b7aa9330ee73de6c476acf19929ff6
SHA25658f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA51297ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416
Filesize230B
MD51d4884733697af2c7f45d3e030bc5084
SHA154c0c19321da2c239b41eeb151a41dd439ea481f
SHA256ba9316d50b83b37c0b946e5e173de28e38bdf4f82265496956682baee7c8d35a
SHA512ab07ac7ca7c523c8cb4c7f5bd0ef57e4243035410a5b8cb21e387ffeaeb919ea2e46a9103ad02de75c4b629346fa29b09fdbf874a72c070ba28e0bd09851ef89
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD55d4dfde6af659de87a2afd723dd88f64
SHA19c73efb71a184eca234d3feee2513f54c6f45026
SHA25697509afad42139d716f0d410dd285af9a75cac91e1d6aed2f57823510a49dfcd
SHA512ee725a7e00acc87ad4798ec65c1cec131b034a2c0ca07f239b051c35c92120f37e87abbbac7e2aaf7872e5af8efe9b4960f902d684c803b76d5353f903ac3a67
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52f7fdf00fe2de7a9e8626ccfaa780cb7
SHA1161e61f35ce64a753c1352b4b7b03f7f17d230d0
SHA256c88175074218849067b8fc0f83f20b74454708a3b78e28e34572630fa522b091
SHA51217a8562b55bc9a9114fed5f83bbe67a78ab5f3f4a2473c4829f49f43e8d00f268ebd21c6a24cb0cad39d7b6635a6e799a4fbfee971316a8dbecf2d2134858b31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5832e161fb0673bcb58354d8210724dcb
SHA106aa56386088defb4121e8a0ce571a3d87201c0a
SHA2564e5f891932284edfbdea6b215e522ab7ff90b277e151334dd985e969a83d2709
SHA51233142f8eedf8fb57fe90e67da29488d63a8b0d2cea60607517c03b0dae101d835378b117807bbe556b5b19694b6fc0b0cf4c894b4d0bf26ab2bf15bc0c6a8c94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd90dffc1d42856b1876bf28325c44e6
SHA185c480528284b2b166f1e0858dd36902ae2f474f
SHA25633bd18cafc16ae03a8a92b285b314cf90f08b16852322b410df28d012a027cf3
SHA5129702e6880bfa4d21059b24bf72b04ea0ead00d02ff0bcb187d6655d195712cdae7513a288660efa4c43778436aae2c6bc2ec570d0417ae551718033f2fb8de6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55b573f8b3f3e78cd8ac7ea593e58d29d
SHA1cac3539302ec1ebd7d9a94c206f1317388b36f16
SHA256d4da6ae998a089715a3b36adf3ffe051ad855d645fc12ff9fa30908c03c771c0
SHA512182dc6632df5f8b32fcd8a0abdd8331a5b860c81d4081625cf7c36dafe95b73916cdaa4d224d797c9abb4f38e778241002d9a6c2955ecf6076b2352ad0fa6b2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD518a95a7a5da02354c20b7ca2c8b424c4
SHA194df73f86c16fbcf65e5a871bb4af48f8b8f4377
SHA25660820ed5e08ace64a166b5d91b0d9e6f6bad836901f3bf95cc15b3eddef6858d
SHA51238917c29efff0ca60d4ba42345f431071f4ee5ac59659be726fc3561b3e3e073db093c3cd5c7308a6fc52f2d3ae86f34ac578864e6f79f1ad5a87f1414ef76cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e3199c959d4fdcf52bca28e1ee6c07f0
SHA120177a1b4675bbb9e707356f08bbb5d926d7855d
SHA2560731fed8fba291f54e84805e33a3242eb5e816119c41216cbc6c2c646b1b3c56
SHA512e706bf362a2e61cd768de4fb781d435ffa7b01e79232377b41073259582f62d00a976eca480ab20404234e53a471d92f820f36f21c07c0782aac62a21ec4b5f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e19193f94794142b7b1ae37232e42a52
SHA1ac57c2a6e5a15df9efa977f77955268bf435f5c3
SHA2560ba8379a313e6a8dd87c90651ef69d11b89df287a123b557bf1e4b34bcf2664f
SHA512db03e00c1f0973e797e7e1d9b8f8e5909652ac3bc6220a2cdcd8dbd0a247927403c55b4bf85003907585b8c44043e7921b042fc4a91cf899ee98ea8eacaa7dec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD585fcba410318f7b300a3f59f04723609
SHA1b6a71e813b65f84e86e71e344e6531f8a50509be
SHA25614531a912cbe55e85e8adf84a2f0316a682a296e1fa882c18ebd95bc6fbc5f2b
SHA51293db368036039b338c97358b09cb4495b82dd9392106f35065a9e2923bd183ed32d9885dabf5b605402790200106d5a08289095f740363b58b05929bc30153ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5588685ff543f17c67b1fc12cc12cb511
SHA12830532d2323556209b1b01825ec79f1d53c31a4
SHA256880b021ef79bd2e13ea3d7ddd185edc9547d205dc3bc9137f51d4ff8da7e4535
SHA51265df1b94301bb772c2fbeeb36acf7f5c7952d95e4a2b13effa8262594ea2f9d7348a0551af0b16bd7f41abdf2b5f4f6c1caea9ac3fd6c89c945def565b6ac550
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53155df8fba7ffb5bd058497edd57a01a
SHA1add5c5e0bade14f0897286fbe5a0e6fd99177f8e
SHA256c5e99279b26f15d470986c1d666cf984df3109af9ddbf14a6ec64df02517d5cd
SHA5121a0946cc8dc7137c5ed20513fe0ab9cdf705dcaaf118688454111bfe046b7d5dc16a3d8f16d2cc8e382a69821c5e481c20ae9a9604bb88bcca6f4624b46cf7c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f3578c9af82115d405dbbf82af5cf9b1
SHA1d289e82e227c8e93570485736c3c6cae987d47bd
SHA256f68f446114c2c7e98f4efa416ecc440d8fc40b9c31f036ad30d57678745a2f5e
SHA5121b788469c5a16299daf64621e4424d7d61cf99e32e4853257e8bdb669931b6379fac1815cc373576413211d42e783e0283d4945b50448d1ae0e5578f8a23aef9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f32fd8914041e848e02d7104f1747ab8
SHA141cac8267aa20b421ac0c8ecaeb03bc908af993d
SHA256b4194c84d606a24724262251272a8927ccf98a9776f89e6aa507bb2337950d36
SHA512f5198ecea950ed9fab1b9bc18666a50567dba58a49b79e10841b1cab84304ca30b25e486843b17a6e9262be5fa9d8098dac85f89bfdc2564a7f3d415c1a615de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a26cf93f1172fb58ab162ac9e2e7e028
SHA1cccdbb27ef00e8c45ea1d13b7094420106d94ab1
SHA256c5e14f2117de36d55ff0f24e1217dfa0b175fa65ae5b4e47ab0ae18b3db2d906
SHA5120936aef869ff36a908447d34a8ba11d00de89ca13921a77cecc8c4ec6a7797f9ecb4f8bcfd2c90cc0f1dfe8961950c49e4becbc1c713dcc853e0fccbf693e963
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50dfd0d6d20c9e3544a850be990ca0d02
SHA1d48d2eb16cd24ab10dd63f222b81061742353819
SHA256846a5a10d7938a20b232dba6bf4b22b542a55a3f443885565a48dea22ba71e3e
SHA51225be3ae88891d4789e2cc894553d985c553e1f17ff3d8627f01b6985b16158db0830bb1d9f0743bc72151e4e520c059a854f1419cf4919e853361fcba60c3177
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53e5b1b257834b7bbdb412768802c4011
SHA12044eb7e707ea0750bc44fca1404e7df947d032e
SHA2569a7fc371e529de3f239c0ff7d0ba84e1de6e014db24bdb9286d5964a66fa3779
SHA512fb9f0109cf4b12ecf600fc75eab82c29d672da362cd36deec318f0c46bf74436f43a9a6268772764b75674f882d270583493ce42752b9b5e32372a2d4f34f709
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5733c31e161a76af5c827f4de87d457a6
SHA19bba641eac7571bedaa00b850597950f9c252593
SHA2565965f1fc09d8edc8eb6a9f489f1b6da3a2d4b84a8ab89dd1627e5097dc828713
SHA5123bd8192fee2fe7a59887c5fedd8dc65e12b4724594ec41ac5a98c482cd634eb9b8c9434f09db60f852c7e0f25b0ad1df6a511f7177fb12ba8e4d1b3ae877f918
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57894b1d00f9c9db0ef48a90eef49c799
SHA11f372aef1b894f7d16759970ede8209cea53feb2
SHA256c48506770aeef19b783d2e36b093550a90bf617c3cd06d07a9c506d6d167bbe2
SHA5122d9823c187a87a1b15865006989669868cb4e24d5cc8ed75c1dec61e7e51a73954d2378ee9c5228efff1ef38c37b6987b02fa77b2924081637d7f22db3d18c4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD590544a0ef88b89af74820073e3de8574
SHA1d4e9a588db8a351c7c59251a920e4bd2c5bec2f1
SHA256a700b670b302e9c428f4c0bbf97ee6855a316ce4c53b33ea4099d51931c3a28c
SHA5122df4ba2b80bce5bc7b31601785a85016d5c6c3d3f783ea26ba1a77dcd26406f75efe74eb35495f8146b07b774b7c8611a0c4b519d75e3269fb3c4c6311a08fc3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c83b79bd13d015d6370ec4ac4787d58a
SHA1d78707095169a9591da94babea08cb7cb06cbacc
SHA2566fc9530c7930b067e83971df37d76c3e4922a3c3c4e53922f61fab3c26c8a6d9
SHA5120ab749d0ff71c0bf31fd123663959811757b41b9bbbe6f543e0cd4d9062a96e7359695864446a070cc041a9e305ac198d31c045bbc37fb4346190993c0c8ba68
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a44daa87fdfc741f35a47e9f1cf95850
SHA1a68c51cc4503acc90fa973e35e220e91192cfcd1
SHA256e5758eb268337383bc4b14c0e70ee29b657d1c45f33e32622eb937a29e991b31
SHA512c6d46d6650ae3d47e161620106eed14a2b7bc1a8d78c1bd5fdbd32b7b04ded01f1b02af1791af8bc8234de2f18810ab3b953b1ef3e2f72310563eda33a88cb83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e5eb2286ac34f1d706ac6cd45d1321e
SHA16fec215cccf9bec699d1225991d2b90d43609639
SHA256fb070673e8b5326f92210319d381e12b1d3ec3375a33667ef2ac565cdb2d0bbb
SHA51290ec762eed4ba0226f929c9b3b93e2c80fd1273e60a02de3b8c66a08d85b7437ca3d955e63180300ce90107addea1c52e961f76da937c85de36522b64a05460d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD514913785493272801e58eae062236cf7
SHA10b85ad79ee9a3639b0e2056537a4882d2cc32e39
SHA2561b26037a8f6013e55d99e0fc0f1468b6d388aeb5b13e2fd009ee4f32aa798e7e
SHA512a0d92e9face3c116d3347f6e0644c969bfc633cfb4933537cdd3756877f80ffd4335536f19251bd794cdd14362000dbea5525c6e9befe3ebde2bbdd00b0879c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55987ec9fa94a8e79499266b16f0103f3
SHA157e48d1d15211cabc4335ba60c6bb8f99635509d
SHA256e4b9ebb64c892bc1764cba41b443d81aeafd797fd2a8d21fdb72a68d904d3ace
SHA5126f4659b1ed28c21c8340b9c29a186969cb850a1453cd5d7343e27a9d8c777dbaf887567c6c84f8f5e3ceae6a49a588c66e529b2acebeaca9c3520765096ad07d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52a37b4697db7714e50896e4b451ab8b3
SHA1627a6f4d38894229406c95fa57382b63b236dd68
SHA2562038f09ce813bedb608bdba2a6a22c317b2ec1cc6f3ae8302b35a34dd6295a03
SHA512a03b33244159f495cc787b8a2601c0d15d471dd839fa5f1147cd73e65b389177bfdb1d659f77f13bdcb52ed00f5f5ec12401e19ce6eda1ebc3aaa4a023c25b6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53e1877f140d1619d6ac7502a0fd45216
SHA19ec6653e563c7999cece01ca1ca324f4d0608867
SHA25672afb82ecd257c505b1bd0a2501620983601e7d46fe8f29bc9a4acb60a82a695
SHA51253c2c4cefdfc8a59c2587f9ba3adb1c38000c5d0e5cc9732625515cb92d5de04141e170207c1cf716d9202084ecd5f226707791f5a8ea444af3fc9c92809b39f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1b2e3c80b6bc8c2233caef5a6c2e6b3
SHA1e66c6638e23cbbf922454bb727a4a875aa40bb10
SHA2563c5c693b2e259a93b9fec7ff1ecb03b868eea9231ae007fe4bd664fa7ca4ccdd
SHA5126902a7e2cbedf7766c6e83d669a4c05c8112f25c09ba10404b76c05d94a0441584c0f7cf339039523d7364bed64a2658bcea758365a3efa933b3bd6ceb5a6fa2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb88b06c906c0f391dd4506b1310522a
SHA11bd3c92e37b6f0ca04af8ed31386a835359ee934
SHA25642b6b0ccb16dcf2bd222ecdfbdf0e6c99430ba4fcd1d388e9c5530f869736af8
SHA512d9b06c832a244964a10e539a00649b68819f16a70f6aab661056e50bcd29907fe88efec4f9f45f0670e196827a97e86e1e4735eebe066d9979d3addd974d1218
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5520912943e8a14df8711b12957d4e8c4
SHA15a19b592c3b0b496d7b4f4ca3948137c81dc6deb
SHA25621132c8c78c465838077a85722d9259c78f2ea2c50673cecad2f0f8fd2723c0b
SHA512c79cc93092b723a130718faed0bffcb20fef5d6f0eb846406801746c0d09311361e067fc021765d7756eab6afd2dc01ffede54d04a0433b93fc2b749fa09c52e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f298d675eebb37a31298f50a13143614
SHA1579f2311256646b50ce0a115a0a04528dcf9b79d
SHA256e1773ed384fd329a80c4b452f626c629871f6ca14de4ac86a13a9023eaf5a286
SHA512a8ec8e1ffd6ae38bdd0ff0c3a254feadffc06caa9eef4a5f579c1d588c2d64f9a5143ef99fa047f967a4306962b670369d03be35112e35cba13aabb910ee5da2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58628776b75369677dd3a7258a2e2ba3c
SHA1666b24bbc28ac1eb4f6186b14da6bbb328381367
SHA256b0eb0afda85c6eed18309e4f0b670acba5606b1d38e1b744d0740d7f26f92c35
SHA512951f602ab7204fa4ea882caf9d6866a91c47a27bd18c179287953950657c1b275a2cbadfd5bdbbf3c69df861ce1c87895f04b0c25dde13129dc1cf96d09ea157
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5071ca8c5316566c588d196d844d069df
SHA1abb34c03079ee8bd58ad2b26296981bccd89d670
SHA256bc7e36904833f9c2a6edff1d384c2783ce58d8e8ffac55c1ab73d88fbd371ca6
SHA512e687e9b814ac7479e133ebe11726433c3bdf7cfbf55f99e3176c142754438763f831c09c735f610eb8e40da3f1c4be5c6b93d81739c062bbf676ef392be6c964
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD536a39a81cda6edbc0659cbdf25ed7a6a
SHA1f2866cd5d50bdc5df9bb9a52180999dcdbb527f1
SHA25623d0ad19a5f7e61dbb3eb8149ac0e4473baeed65a523577bc2239b9c73331450
SHA5127520cb2e1b2a4918a669f8170699cdac151bff811ca6e424e6eb935da647406a7488f7c796f0dcf9469ff04383a37d8492c6fd7ec293269545e6debf77e6e80d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b41c9d149a243329f8ad67a23f14be7b
SHA12b0cf4b991accc55cbd7531fc5bd78610ad076ff
SHA256a063d3046675951e15c3cd367ced4089ffadeed507eb51ee87f412124b12c134
SHA512ca43a69c57bf8f3efa8863cc6f4ffec1781619b3ab4e51835ac20ad8efca8eb69bd83a4df1852060ec5b5400596a054026792f99fd477f8abde78a0be46f43eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD552b6b9cc28917e31d025a8844b016d0f
SHA1dfaa8f701794515e3c325a1ffc4393ea6602c2a9
SHA2561d09fab39ff65b3324d6c87a645fc48c0da4d5744c99e26bf0221ccb6821f04c
SHA51264aac1b16068f5bac2f245a2d5857c768784a66aa89bd081b9ec5fe9271bd239eb82af8d9914d333ae43a122a3cf98b956c41f3894c071dccf7eb9a8906140e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c5adea0b2453eefdd01a153e40859143
SHA1e69e0dd73b3a16ce26c77f9ee453cb249e0e8ac5
SHA25681f72446f6860fac2b1783893091e310301512a47addb88bdcbb51e7fe8c9f55
SHA512057598bfd759be4400503453619857120b1cfbb1dc004a587788eae23e4640d2756d0655866d1b31c85265c56dc5e1d16c38cf5d8f65ed02275be1adde9a7201
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cd1da154b5b46636ff76de3ba305b4ae
SHA157a6fdc7e2a63e0f9dadf267130ea10959b23b20
SHA2562771a52d16c1fa1bba2c48c0ab937f37a89cc03f1d7b157501c5e7f64afba94f
SHA51268fbba112cb8c94e2981a01392248b1ee4a1bef3233c0dc7dfae6514ce67995cd3b81581a7ea170c4103abab0ddc3b2716d073a4ca871a922122c629bbff0298
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d1d2718f7fa5ee053eef51e8f1570f1f
SHA106f2e964d65d5e7d5448e178c9e2c6e7bb0d5858
SHA2566da084b5eddb3ba9446cbd48da01813b8039bfd82866a246975bfe26a8e50229
SHA5128a2dfd1a291d5074533ed0b36b4c2f569e42c5ab3492bb8a8fae3564b18948ee6c6b7918e656e7b64e3acc4e09b18bc0eae344e5363e6a41c220cac10a1e8234
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A4B782275DC1682E4DC39E697A49B151
Filesize262B
MD53d869f2ec626df2793832d0b585964bf
SHA13578cd2843b66642fe735f3d3f76ad19da3d1574
SHA2568729e85f2925d413b73b0c160367d50ee637fe9f92bf95bf3478465971912ae7
SHA51208e084180b1a64ae768ecfeb6ce05faa1ee09cb72e2c846f805b65c3c0c6ce71d97e30c3395aa8aa7ba6659a20f95d01dbeb132ab1abf784627332edb230af43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize392B
MD5656f2ae09ce9fe3c24b395147a42ec46
SHA1670f5bafb1083b8d717b50cf3d4533bd50a04b17
SHA2563051d0885dfd3de7afe231a6dabba62f1ae9f1a5e84ca74fc0dd0874a65ed63f
SHA512df0d339550867d4bc0d100f3fe7558f18d6943ae1454e931874bce66831351a0947191cf40b8af8ff5258b9a7ba9ce4d7111481ef3b9eb932cfb977f3f091326
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize392B
MD553f5a21d3ad750b1aa818fe42e85a8e7
SHA153d199d6b3fc2a05b24b58682daad3b6c19c114d
SHA25676c77211db235072e2186970a955ed9baed3128d621067480a6541013a89f6bb
SHA512d7e95aa6400bc1530b092b467866a351ee0fb82895423ae48b4b2cc083cb2e2a6d8697c9905e95b3e74241b544926a46c80ba382fe955b11306e18786b0ccba0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5a73ac89576bbbcdeebb6a7664e050498
SHA1f5e254dfc677cdfa95b69912e269a522cd2ab947
SHA2563fc08bb0a74bb3af39f6b7f00e6ef0cbc5521ea3e8b81f09d4020dda3671aebb
SHA512c2a8bcdbb9aa05b72d891a508668327af9c5cdd6380636a53c7afdc1bf9bccbb511619d5a9d1ea1be5e9f63a08e49e3a7231d1501f733d032a7d1f9c26d91474
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
1KB
MD5467129a30c1df28e861895bef6294199
SHA12c8c73a3a46114f61d5fde5c080a1a1c40610684
SHA2568a3ffac77dc0d8ab7d050feed15710d6e558f0484b71c9b88535cfb4e0ceafe0
SHA5128d7bda97e7b4f0adfd98c326e3a9711d3fd81ec26a8f96542c1e23d1b7579048d74331e39f09b08b6f7939f2cce2570fdb162e247f59a7d939522a4820eaf5de
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZWXD33JI\favicon[1].ico
Filesize1KB
MD57ef1f0a0093460fe46bb691578c07c95
SHA12da3ffbbf4737ce4dae9488359de34034d1ebfbd
SHA2564c62eef22174220b8655590a77b27957f3518b4c3b7352d0b64263b80e728f2c
SHA51268da2c2f6f7a88ae364a4cf776d2c42e50150501ccf9b740a2247885fb21d1becbe9ee0ba61e965dd21d8ee01be2b364a29a7f9032fc6b5cdfb28cc6b42f4793
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
Filesize
866KB
MD5dfbef39d176da6636249d8583ddcc96d
SHA17c61f1c649ee3ee21a297bb59d0c8c093cdfdc7e
SHA256837503486e5ef9cd430cbb2939d29bbca76491450759a749b69ff4619d9cc175
SHA512f50647d70b360698d404248ace1a18a9d25a3d9fac88715d6d984ab15ce644b220754b177bacb14b20e1eb773cdf4a1edec1efac834a1b76f5e71f036d1f2640
-
Filesize
381KB
MD51a0cdae51e615380089b0c953db3c70d
SHA1867bae67c4fb300bb30d0ac502864ebe8a0a634e
SHA256c8c6ed1345a13ff90a4d08d6b0852f78423e8ddc69ae8910ce7ddae65b165451
SHA512f0ffb1c91a6e771ac9256306d529b214c2a65902911422e6d820e4579fee5b02166f99725551de65b819dd0f70ebf57b641c6b3d50f333a1c3082be8afe5dce7
-
Filesize
442KB
MD5853a849864b0a11962f27832bb3cc84c
SHA1dcc4aedec6a3c56483979ba4343067066c4fe0e4
SHA256592c77e4ce824e191dce77ae631285443e7c2e53783c7211fbdebdb1b2af5cf6
SHA512e93a2a4ade5d43dc05e2ae3ae58183e6bbd578b1a106cde6a4a8380066d9a40fd502f3f237e402a70e061afbcd9965ae45389be51e9958e65e30d92b44fab497
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
705KB
MD5eb494bad9478bc28c4f8fb7fd7778445
SHA11b3e504108b39c6978e737e08d4cbd2c22d95e86
SHA256e1af346595829eba017ec343cb179dd217b7991fb322cc4e8f18bf40ef8f941d
SHA5128b14a9c14185d5afaba7443bf43cf14371ef3c3d524de00ba850f07952d1d18abdc62118cc4893ed2fa66570eb4098d01ba338f0cc00ae19be7bb697dc8d9f91
-
Filesize
677KB
MD5e473d4d66d043c5ef07b1bc80af31e27
SHA13b33cbc5fda3ded92434f450fbdf34c9da11f541
SHA256f7108dcf904c5256d8904ac2f9bc8cbd1e545dace38b4cf0210d9c3b7f10c919
SHA5124f3be6f4c3ee89d8e13928ddf22edfc09c55b1a0149b8c50d4aa1999183d33ba9273dc6c26a620b40954391972f91381a7d73bc3d1eeaa8e414f232bb20b7ba9