Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07/05/2024, 19:16
Static task
static1
Behavioral task
behavioral1
Sample
2158c62145486564696c924d8ced1241_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2158c62145486564696c924d8ced1241_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
2158c62145486564696c924d8ced1241_JaffaCakes118.exe
-
Size
1.1MB
-
MD5
2158c62145486564696c924d8ced1241
-
SHA1
474d1c5aacf28a0dfb345c021ad386e524323ea1
-
SHA256
cca1de03b965083dcea059431c8f2419b7f1f33275539983d44f0d3cacbf1c40
-
SHA512
520b8fd3edf2dc3c6c8623b4f76aad2aff275e563d093d1ff4543e806a622430629f43810c1e134dc11f0d9676e8c1a0ff416c1af28cb9f33b7eaa82cdd78294
-
SSDEEP
12288:vsM+aTA3c+FK1vrlVYBVignBtZnfVq4cz1i5pP9kPQKjh:UV4W8hqBYgnBLfVqx1Wjk3t
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2548 cmd.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DOMStorage\searchrs.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000f0e07ba3f9f0258dacfed3bc23d21ebd05fea9c5eacd306080357e44beea1ce7000000000e8000000002000020000000136ca5baa68f830502a5042a1bc4cfe9bcbaf1280d593db0790360517687bc23200000003cbafe7adc10e0769ddcf68d3a956853f326722d7052f57dad8a7399ae85504940000000de3dc7e3dbbf5fc256d8ab707f124ee70557cc624d0063c5e6b6de251a271aac9999df7d8b756e2d5e5ee255e4a39b853152d6e4d2e8dd5ebca486d5ca7be492 IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000005f0913b5bc859a3367df652c63ea9cbc3e42beb13393846b05c1975cbc4e8f08000000000e8000000002000020000000c4cc6605389ff779da7ba76c1f7e9a85fa23f9d7e0bc3dcddaf5862a66d034fa90000000dcdb1431509ee16accbfd77fb26e75552d7b4d7acf65977e8b1c6f41026516f8b27fe835448a0978809c2b38d7cf8d23a8238b6595711997360aa503a2fcaa9cb1124c7c01006b85df3a9d6182bcb9436da32201475993318dde4042cb22b75f35a14400cd2110b0bd87114c375088b7a9e04422bfbc2be2b6826b889707fbd38363a5e8ca9690195e64e2e06169a43b400000005b82182ad5caab87da33e4207b72d8f5e64572b4e88a145bfb9efdfab50b496880cf7fa06eb054fdee0ec701deeb2b7358e70c154f0974ec0ba3a72b4f3bd0ca IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4389A7B1-0CA6-11EF-9E38-E60682B688C9} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\{F758A4F1-9D7B-43FA-9167-045144FB1100}\SuggestionsURL = "https://ie.search.yahoo.com/os?appid=ie8&command={searchTerms}" 2158c62145486564696c924d8ced1241_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421271246" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9099451ab3a0da01 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\ 2158c62145486564696c924d8ced1241_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DOMStorage\searchrs.com\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\{F758A4F1-9D7B-43FA-9167-045144FB1100}\DisplayName = "Search" 2158c62145486564696c924d8ced1241_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\{F758A4F1-9D7B-43FA-9167-045144FB1100} 2158c62145486564696c924d8ced1241_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\{F758A4F1-9D7B-43FA-9167-045144FB1100}\URL = "http://search.searchrs.com/s?source=display&uid=4af2c6fa-c7a0-4efa-b275-9510f5fcd71e&uc=20180116&ap=appfocus45&i_id=recipes__1.30&query={searchTerms}" 2158c62145486564696c924d8ced1241_JaffaCakes118.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://search.searchrs.com/?source=display&uid=4af2c6fa-c7a0-4efa-b275-9510f5fcd71e&uc=20180116&ap=appfocus45&i_id=recipes__1.30" 2158c62145486564696c924d8ced1241_JaffaCakes118.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2012 PING.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2572 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2572 IEXPLORE.EXE 2572 IEXPLORE.EXE 2624 IEXPLORE.EXE 2624 IEXPLORE.EXE 2624 IEXPLORE.EXE 2624 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2864 wrote to memory of 2572 2864 2158c62145486564696c924d8ced1241_JaffaCakes118.exe 28 PID 2864 wrote to memory of 2572 2864 2158c62145486564696c924d8ced1241_JaffaCakes118.exe 28 PID 2864 wrote to memory of 2572 2864 2158c62145486564696c924d8ced1241_JaffaCakes118.exe 28 PID 2864 wrote to memory of 2572 2864 2158c62145486564696c924d8ced1241_JaffaCakes118.exe 28 PID 2572 wrote to memory of 2624 2572 IEXPLORE.EXE 29 PID 2572 wrote to memory of 2624 2572 IEXPLORE.EXE 29 PID 2572 wrote to memory of 2624 2572 IEXPLORE.EXE 29 PID 2572 wrote to memory of 2624 2572 IEXPLORE.EXE 29 PID 2864 wrote to memory of 2548 2864 2158c62145486564696c924d8ced1241_JaffaCakes118.exe 31 PID 2864 wrote to memory of 2548 2864 2158c62145486564696c924d8ced1241_JaffaCakes118.exe 31 PID 2864 wrote to memory of 2548 2864 2158c62145486564696c924d8ced1241_JaffaCakes118.exe 31 PID 2864 wrote to memory of 2548 2864 2158c62145486564696c924d8ced1241_JaffaCakes118.exe 31 PID 2548 wrote to memory of 2012 2548 cmd.exe 33 PID 2548 wrote to memory of 2012 2548 cmd.exe 33 PID 2548 wrote to memory of 2012 2548 cmd.exe 33 PID 2548 wrote to memory of 2012 2548 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\2158c62145486564696c924d8ced1241_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2158c62145486564696c924d8ced1241_JaffaCakes118.exe"1⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://search.searchrs.com/?source=display&uid=4af2c6fa-c7a0-4efa-b275-9510f5fcd71e&uc=20180116&ap=appfocus45&i_id=recipes__1.302⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2572 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2624
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c FOR /L %V IN (1,1,10) DO del /F "C:\Users\Admin\AppData\Local\Temp\2158c62145486564696c924d8ced1241_JaffaCakes118.exe" >> NUL & PING 1.1.1.1 -n 1 -w 1000 > NUL & IF NOT EXIST "C:\Users\Admin\AppData\Local\Temp\2158c62145486564696c924d8ced1241_JaffaCakes118.exe" EXIT2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\PING.EXEPING 1.1.1.1 -n 1 -w 10003⤵
- Runs ping.exe
PID:2012
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD555540a230bdab55187a841cfe1aa1545
SHA1363e4734f757bdeb89868efe94907774a327695e
SHA256d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8
Filesize1KB
MD5451b280df34a0930fcf560ee03d2de4f
SHA19eda2ec3cb9572767323a1bf03f81e1999f01a86
SHA2562e337f5be2b93bddc0abb9a79e7a504b977a39d244075c5363487f6835e332ec
SHA5124e89b5c9fdd73e20c16cb2e36949db46d25a2cc52fcd0cc0452eae2c2858ffd80c13b350f4557f14a9e7fdf746388ee81cb0a29c2c00dba778f840c85daa8f86
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_9487BC0D4381A7CDEB9A8CC43F66D27C
Filesize471B
MD57972f7fd399ceead57459acf4e482508
SHA1ecc0547299283dbbfe3c702c0b097b0a9a15dc8d
SHA25697e067756a42bf86a18779d19f9b3f419f1c91f22af7ceaab14eb34f45bed219
SHA5123d7c3ce143cea7c43465f4d569192b851af263a60e3fed26de2d6f9a3b45bfe2c150bb13af95e7c19988fb30174e3f0439ecce69d5042419fbfa63237fa4e098
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
Filesize2KB
MD537042d76e940a511b9d4cc452b17fd8a
SHA1a6a81fc9e64f15137a187646b66bd512ec2eb762
SHA2561d385cabfb998d595fc1f5987816e9b94e6be9b77b6509ac724282f4f36f9732
SHA5122c6978fd70809ea8456fa4cf0e02e92d0ae5bb5a34a3a0f561f1e26289badbde6a7911256475b47ab39de422abec3b93c60e44c3f2559784d2fe981271347c9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
Filesize1KB
MD54eef2da3d0c23be6c61ec01100a66bcc
SHA106c0676ecd97ab2ef4694b0d1af93437ac97da93
SHA2567f77250b0e305cdfb3a95ceff38e4d8d651040d43108bbd9c7472ab7e3b43989
SHA51252735daa756ff8e9248b897f9164c48295e729dae31fd508345049529984442a6e42cc77348dbc9089679c4962de342d3b3e8b379ce9e2e909373821294e4780
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D03E46CD585BBE111C712E6577BC5F07_B82D647113A63312F289CB1E910A9CB3
Filesize471B
MD595b2bcbce04a043cba3cea7677b53287
SHA19958c530be9419522b05b7570902dbee5a7cb46b
SHA25626fa1fdc429afe9197ef038169e2e5e61ebf074cec5251f89cf5b89c8e26093d
SHA51258c7379d95d000887368570d7fb8e50cffe69050a67ec43ecfb88901eb9e6352fe00e034199a384874f6be8b543719bfe5994c9849f4dd4c24b919d3f4f3f93e
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416
Filesize230B
MD5b7280a785f81a23919d496ca13e937e3
SHA16809244da6e9a20e5cb142d0855f01b9e5cffea9
SHA256f5238417c4868510853f52533e5a8c0da08351fca7c27ffa55f26d4d1d6ce238
SHA512cbfd93cc8ef5f70e73af66a12085b9c80e6b33904951bcca9bf2100b5006ca19f483d2af789c3a8b56ad71c77d13c155612d5b583279c0461e94f7f2ac3beada
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD54d0722ae422345b522196ce7e588ee9b
SHA12fbe0a9bf6aa3885927a1f6e866749076dbf2bae
SHA256130a309790f10dd8d9b3683bc398683f5e654d337b64d26365d705483d4a2bb8
SHA512ff656c1203703cd941399676fa014e6202aaf7a9bf98dbc2f5e02f60cf480ef5035d4beed9e5db306ca9407fe34338febf5fd572aa5f54ef4abbac995b6ac080
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8
Filesize438B
MD56ee9ce39d3884f3547587f02c2db6769
SHA164ce9129c0d3fbeef32157f956ab5a5c35c576be
SHA256d28b446abfa7679bd464b1c4939089cf4f30391c0afb70a62a5bdcb404db06b9
SHA51248e25ee8345a89774ac1456e610b9b086dc24feaadfea3c276a876825f0857870c50bc1913e8b645384084fd241056a6fd579e30f845033b0f4a6c4f8781be0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c3dc90898f6900f04695d3679a4d8468
SHA1208734e3f9e81f33d42046a0c5bc6fc9b76b802d
SHA2564ff0328dae3e2c41c18c0512c2910278052d903305bf9cd88bb610b648700f29
SHA512dd436ee0465d9387425aee8b872b5f6623cc738803ef802e496075e48b774e0280fd2272e6451658af3cd8fc98ab0657539a31f8e7ede120c8fb101bf976bc12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51883c75eeafbbeb85b2b1bfd88b5b631
SHA1c2e11f45f7c69bfca6dcc717734484d97f310a87
SHA25677b38e82c17a96aae080d69253a74a8d6fb4ecceba8302cd1da1d6f479e4eae3
SHA512ff683784078311345905f3d2c3898e613fc1dc74703bdbbbffa24c3e81b9fc424046eeec0fe650ab163dce28473f8a2fa5a3de62bef313fff1fc3a4b0f945ff6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD574e1bc512cd85801840853fa5f76b657
SHA13b18b8e5e90251fda01be6706216cd9834309801
SHA256e80c874f6fcf76bc398fafcdeb27289716460531c00c5d969c3ce1282e012259
SHA5120fed1f717db9bb0d2e4e5a0d76ceb10b2f9f88a34edd02d1bf074211e780883be3fd9ad0e17d3990c3560d611b1567c7e9045f49727202cc1c0a6a3fd91c3608
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD574c024787a26bf9cef161d2f4c3d9d63
SHA19b45be652f2a740e84e1c6bbe97c09f272c79501
SHA2569bf7a4e3b3cc42cc96f7a08f901d1012d0918f82067505577db3746d417ed112
SHA5128594b1c14c6c93aed24ae5a099c51bf8191786e9ad53bee19facc6bd17025406cc00614cf90fd7a2e026c20ccdfeb11f27671f8c30e0e3f9d9aab82f82ad34f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55412fa0c008e13f1ddffe7cfa4c9547c
SHA1b113458da8f44c0cd7e8c49b614e03c23b74062f
SHA2566cb7f6d363f14df49dcfc7a90408a03a8cfb5fc28362c757f58ba0f077e9935f
SHA51210022e8d2533e32c396defb6e4d4bfa390f2a735157e15db90b90a3fad35130bb2a900e95428a2e9cd230ffad5ace05100cc0a724c761a7ec2792cf5cb368054
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD574f609f6a71969e30a876fc3c682c6de
SHA15c2a91d42e654448745c384c69437800c9f610fc
SHA256fb8af22425b6cc6b41a89e1adefcab983b2df9f73c37ef7efd23b3f174740bba
SHA5126451590c717f467a84fa761e99bf93f6290771a5ecb973a64affd0eb43874c24f27c5d68cd1d1e6f55a1f597f378cc61d5d45deb45f8ad4c426d4ce8f6f3ce2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD591413eefa5d908278b73eda43204ae9f
SHA1a2a60f0e0d455ed907ea3bc570a7a4f8aa3195a8
SHA256f97a7492cf9c12ab33126bf6527d7985f290f3ee8642a7f6dd82d2db50bd3ba3
SHA51229eb0958fe55f1d3e150c49ec528b97f2771e70b427207769dd4937459d39e6363e3f553e72a8aa115bc7f3b14c81967bf6bf6542ee084b2c0cf78a4781db0f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51f6509955143a9479a6d38b204193d11
SHA18a1f66460a98d877220c29fa67d6cf14e456f3c1
SHA25674ceb9c49e2a535e78924aabe55fed62e91319935b963a6aba59b2de82efb79b
SHA512aef7f1af8a55e5b4da16129282540be8688a4c559eef5432eca40475fe015f285c9b0479ecff37bdfb5e758e87d1bc2986602d55281c9e4376b0997b4fc53a06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3251409d810296d5729cd063ed68260
SHA1ed7692c78d85f8a252ce560626dd918043be143e
SHA256f77b54954f595bd2dcff9330049b3be633fd0c7a4ae98796b66382727dfef336
SHA512027ab6f287eecb708bb2402c2637b27ad4788f675e2f4ec01e1d0475385c8ac2239efe8bca72ee84797b3a87948aabe79f729f46b0973115dea3995f52096f45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bcdda31f0c2549f531597a685dad2551
SHA114d5dc5ef2cdb8e721c88cf4f824951156e205aa
SHA25635028b0e8b75859776917b252bcf674fac5b7f0648bb9197736578e9e3ac3bd6
SHA51212346aec9925371a5c709d08ebec3c263a14bf6468e274d032145fddac9aea9efc9d2c92bca46ddd763625871bd99128ac63993d16e1ed07e00cd23c64a1ea12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2f6b35d1dbb1e3ffb81954da1bd801b
SHA1b98961b582b81f981518cf0c636a9cf34a5460f6
SHA256cc3c9d90c70fd9150e3888ee4a92bdad22135c7361734f946e5aa4eb00658711
SHA5122e54529249fc406ab8ed178900740c632951a3f0d4354ecae80a5cde2c7308a7f759a925131541691a969eefc745cc66043c36b211b154627e4cb90fde62ac6b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ccc38a1c790b09a62b58acd1c7b45d90
SHA1ffdaab29eb9414c1b6ef854c39691fc6161acf6a
SHA2565a378cbb325d21addd8f9482ec104a9baadede198cdc5d85a34c5d0c0e314626
SHA5126530386700d5dc8dba266678a6ce447934943e4b7d7e2922043642654cec3ec1fceb4291b3a1f652cd58638a7c5547bfc505fe9d7200111154d1554937392c92
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5605ab1e4b2618f50e6e589ad0a848583
SHA1ae95f78f9dae86b344b5a9600c0db65ae09e7fe6
SHA2561b838337303a505695d44120769ff06c7174eef9292b8c7d41e6d3b2be2b4826
SHA5122d15d3f8de6c8632d330c4cfbdf3e95986f20ccbfe6ce95fb7371c6f2ad2ae42cc52ea9a6e94be0b34884ad1bf21430bb7918aa9f4e6d18bad1b0cba7e7d56a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD505f9ff1f74e063b8ee80aa39fe14a42c
SHA1b9e7df192f54eb5e3e49592df9ed3eedcd5accff
SHA2560a5ed159ee019f18b522a5ca24715a0d5074abdba62f5ef7de190ea3d859b98a
SHA512626400d51207db5f97b8eeb85147951cd06e901e00333342b8785ab31ff81455e3886b8738979c2ee639bbbf62b53d9dce7b1e58b8cae843d7bba905580ef699
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cd04f7fa692ed89b05ee4c982e2fa946
SHA1c4c67054618e4a34bb9a8952986d7faff749bb1e
SHA25673f32e52880dd5d8036e525802f75c934e0c231cce7d3f72881186432c33dc17
SHA512eea8dd20fdd240c42b9d5272d006cb29f6ebb595f2717c5ad18f64531078b32cbd87a2c7ecd6e5a7808605b5e03671e30031a9cba9219f225b147126f42686fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58077248730bbae2e23af231f6ea2d9da
SHA152230337b7f00e0e168f222712cb021c2b160f7b
SHA256a3a840f460e27b6f170e7c5b67e1b68fccc356b5674e644c78319c7099b88699
SHA5128e5508387caeeb7b90ba04536b995d1559fc7a6e7b0c462f51683e88d7b517a4ac0dc6372c8f3b3a9ef3bbdc0eb59274f089994ea78997e6f534d8638de8fce8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b7c785ff3e3f899f513fdc468c9c0fd4
SHA16d503e922e2331f09f2af19d3c1561240f0666e7
SHA25617fc62aa13acc0584aa005ab55ab6bbe926ae5bd570bb9217e5621d5c1a84079
SHA512c0faac64fcee7d178d146dcb97c9e4f0f17ef7372f553ee7a172b7fecfec76ded36e12633c0356eb120c6ab6c83e92c49988f2836a581a053da1858ff00024f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59286fd9b6318f46b5d6249f640bc33c4
SHA192acb0191d6088288aa34502947e681a44b01027
SHA25615666b3dce61e02edf11167c03b4d8085ffb8dc757f8dc88b83518b8876e7d2c
SHA51296ada9e0b2429fbe1e102507c3b5f0217a4834932c711d2d0ad9d0d223556c0731490c681251e8591a14ed900e024a70a3296cd02aae744a9f8e90d9164bba38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD524f35cb0334c5f9fe7761e748d833e6a
SHA14a87f9095de05752561f74d092c6ebee63e3840d
SHA256c17f250a59be98f7dca75cb9626096accdee4b78e286fb16554d3ef88e74ca0f
SHA51268edd6451e81ebc66e972676a20cfc69cd3f176cf711e653df16c220a9c7dd1265665df31ae54ba1f1296314b4f9eb4af93c1e130caf3e1fc8bfd2bc46426686
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD521d50fe6d7f01ab4ac2341a0e3b009d9
SHA16b061fe7bf86731e198e86e4817f950b2c41dae2
SHA256a7cab8ba7388dd9cc930903c704e21aeb1785887668dbc7c2e660a0124bb98ae
SHA512ce87ac62ca9dec8ac8a5eb3195b4444bb7e7bf64c42c17d5d29416e6311acaa858ec180c08691fd5101d6689ecf06ac6cdfc5555259b131e2058f08e988c3e70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52f7a4fb8bc8b283836633be5736d39a5
SHA10097111a62e2cf01c805feff2bb5a85d9a05e1d6
SHA256ee09ae0ce16fde82fd83916eb3e98cd770bc9679f0edc16f3b4ab9af52103393
SHA5127bc847ab5135b2966bce8e0bbae81ba1c05d9358f979d79e2353220bed625dd2e094cd6c55dc4cdde12587df08219cc1eda5eb14dd1f4091ee6f0ae1fd698bae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b5d2afe475e10479e26cf552aea147c0
SHA1dbc76edc89da25f8ad1fd4c037af641179706fa1
SHA256421c4e3147e37b6834fcdb67bac7d0128e5ec7d400dfe22b05fc5432faf4f90f
SHA51249fc66706ef9f4db01cec5a84182e38f9a6f90b75c446b13fd8464e78ca3e708d1aea154df89a6d19fa6c421d7e5138cce92cbe1ae9c1cad2e898ec2e50f5193
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bc87a5caed6d32b2bff6945fc462f22a
SHA17dc1f4760602f4f44eea3442b69ff80273423952
SHA25656c5bf5d7222018b35a5cbe64a1d0815923217e954e5e0d06e050929a7a8ae98
SHA512e4c7b121198ba0172724147bcbc2100956ae75ca9e622f39c42584d98bfd82ccb195c761981264c74ed2c7cf9c34103c7fb47cc549f787c6332424dcd18d5e62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59aa515a24688dca79e8230d360692cf4
SHA15df7ae040815218f5e91c5e2734e711e1f065f4a
SHA256ad3a42ae30f720206ab2506a720f75e529cf6e78487f6f5d86f361ec49d9a8d0
SHA5122f4ca5f79256ee52470a6c18be92a1a43429027c6d13ef3445041facab2fce01bd1b5bed9110531223863388e8d5eedd77077ddc385159976e542f52e246dfc4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bcb7e53dba2a4100a0e90fdc13f27b52
SHA1481c27b25680d501b7de1158e61a5e1751bbd3a7
SHA256a95ead5b2817c7bedbfaa0839bbd94f3dc04cf5dc14425fc308e30b8b38eac8f
SHA5122a46e120569155e76386a4801a1fab8b9195824c0c7b8e11485ec1f9503125f3801a6473a878ec5b32a2de009d070428b29f380b6df7b9f4051897269668a29f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d9c146d9d5bbf45eb524217c9b57370
SHA1469839508700dcb17a00948783b98295376b4e31
SHA256418132fcbaf3514872d20a400656393ce1be5f2f9d8db8baddeda653faf32967
SHA51207e830b6a737a18eccc497ee6837959c25baf9f6542c32f42f537b9b70ce5ee4fba00ef807bd0b3ba0b00d420e74fd11a6406e56e06f8aef51db79ecacec6060
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD537565525af5770c23f1d6ddae7e5020d
SHA1e91bdee105abe9603f6e7d3c695af199938972f9
SHA2564988ce0c327afaa9cb02eafaacd6915c1cce3d355b98359b6ca9ef78ee51b566
SHA512212a3e31efeba210c45a9004d11af1e767cb9619a99a28798e2a865804442bfb3514c4e08144b45046788fab5c6c58ef9346207fea6a7a3c95849866ce84c2ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_9487BC0D4381A7CDEB9A8CC43F66D27C
Filesize408B
MD59cfb5847e51365080a3b73fc60774226
SHA1358adcbf08b0f044ed88779d0b00178345574e5c
SHA25643bf119b54799ee2f09e890b347057fb30a740eb34f5b54d18d1b1f14b8dfd13
SHA5120d2727fc4f7c3ec9e8c925ed1ef4b1baf29ea25b92a67bb57f83894c0bc815ae9f70ed258b82f5f1077a600a24206883e58e3906d270ceaf4d32644a7be1c971
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_9487BC0D4381A7CDEB9A8CC43F66D27C
Filesize408B
MD55f768280a11345848d17e475067fbb61
SHA125ea0d86b40a3c7d8e839b2b22d2b0b2d495582f
SHA256d60c34b02628b6dca0d60428e8f1f349e05b97965d8c5a901bd6f706377c2f7a
SHA5129061dc6fdda43d1b2c615bb238a871b01e99975bc689f04476ea85b36d3113408601605153b71d6c8cbd0e20c2f93b72473b76d894c633f53fac92b194859cd8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
Filesize458B
MD5637eb667a37f40ec6fdf5679225595ea
SHA11226371f020903db78c30508ab8c1c8aa29a15c1
SHA2561eac87dabe233f7f1d7dc4a612759a8e598187f98fd8385f3ed765fad3288fc2
SHA512b653abfc7e4d0677f5d3bb80d5c58c180ba84ba1f531645087b671400d2faf9e58707826ab3c05e67e1e0871d47ccbab80797974520f3216d0e31ad63dd2908d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D03E46CD585BBE111C712E6577BC5F07_B82D647113A63312F289CB1E910A9CB3
Filesize422B
MD5f9a69886a112f2448b5fef73669c153c
SHA165b3403852b2bdb3eaefaceb93d95d3788277cd5
SHA256a5f6409a9cdffd05950cf457a449344ce6daeaff925e9a021dba849f3863a4aa
SHA512b3d927c5ac9eb73d99df26baa30fdc1d9175e58a50e6e96047955e6a26ed309304394ab648a9df96d41e1e5815c144c84f4bbbf49c026a2aa3e616db5ecd7af2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5efde81b625a20bf69fc20169feacc1a4
SHA1cbd4763eb60665009b131e3566b6dc2e327ec085
SHA256fc77b3b919e4354be6c0cc36cbec69c83153a5d8fa4ad560e6f43c43c2d791b1
SHA5129dc8212e7958d7fcc8bb9f32231783e195565ecdc55256b9f0ce4d969c5f94fcd1a2e1735dbf217bfb8a8576621a8be92d6ac2fc375025e19f4766c8888e75b1
-
Filesize
110KB
MD51a219d73843e95c65d7a560e237773a3
SHA1d4e7af4642091c4d678207c1d005f8f981235786
SHA25659498b1e64d78e4d38dad1d77de0f8a78d33630aed76e60bc511f8c33ed884b7
SHA5123842fabdc64632f79cfd49a0a65eadb0d527d5086f2c0dc3dd96d5bab5d44ff2670abc9c908ed9c7c489dce4329c468f9996ebb8e03390fabda8f8a7318281fc
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UA1HZF3D\favicon[1].ico
Filesize109KB
MD5504432c83a7a355782213f5aa620b13f
SHA1faba34469d9f116310c066caf098ecf9441147f1
SHA256df4276e18285a076a1a8060047fbb08e1066db2b9180863ec14a055a0c8e33f1
SHA512314bb976aea202324fcb2769fdd12711501423170d4c19cd9e45a1d12ccb20e5d288bb19e2d9e8fd876916e799839d0bd51df9955d40a0ca07a2b47c2dbefa9c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VIF0OH2A\js[2].js
Filesize190KB
MD51f5811fc1e5e11ec7df6c3d445fe1f9d
SHA1c9de9d76f89ffcfc96cd5a23e7a55f1fa933fca1
SHA256c8833e35087b0c73dc7b1ce0d92b6e8c0fae292292cb23e6ecd52d581ff6bc0a
SHA51262b4768e221b935d80136e7bbcafd6cd0d11462eb87b16bfde1c46716503f15011590b986995dd1f9f4ac2c39d08f320c6b68db926df15e68b2333f75ea96d60
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
Filesize
667B
MD587dd60c1720b264503a502edadbceaf5
SHA1d249a15206a9196ad9032132fa91c72a35980e70
SHA256fdcf4b87c1feb96b4b1040c2b02438b62d842ddaf4010bce13bc63c3c546cd9a
SHA512a7574c5666227c1e74ffd2747983fcd2cf2c8391f45844d38fcb442a266b11353f66261dd81e86534670f0b711f3972b30b5788447a91b9ec15ed1d56276a9a3