Analysis
-
max time kernel
136s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
08/07/2024, 03:14
Static task
static1
Behavioral task
behavioral1
Sample
2aca4c28536d8881ea6a357cf76050ee_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2aca4c28536d8881ea6a357cf76050ee_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2aca4c28536d8881ea6a357cf76050ee_JaffaCakes118.exe
-
Size
654KB
-
MD5
2aca4c28536d8881ea6a357cf76050ee
-
SHA1
85e18854fb7a7a4c5f1d7830014d50e1555c41f8
-
SHA256
c3243905f89bfdacd8ece8dc8fa0d9e79e2522a9b6b3cea642eb64c70b507459
-
SHA512
35e8d8a7b7eb4e202843888bd5b74bc09447627771c4175653c2e8f09fe422fdf85008de012f0bc29ed69d516ddd70cc5fd5b41895df9eca6daa76ca5347d96d
-
SSDEEP
12288:waWzgMg7v3qnCiMErQohh0F4CCJ8lnyPQ/+:3aHMv6CorjqnyPQ/+
Malware Config
Signatures
-
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Cdobe Emulator\Internat Explorer\Desktop.ini 2aca4c28536d8881ea6a357cf76050ee_JaffaCakes118.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Cdobe Emulator\Internat Explorer\Desktop.ini 2aca4c28536d8881ea6a357cf76050ee_JaffaCakes118.exe File created C:\Program Files\Microsoft Cdobe Emulator\Internat Explorer\target.lnk 2aca4c28536d8881ea6a357cf76050ee_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Cdobe Emulator\Internat Explorer\target.lnk 2aca4c28536d8881ea6a357cf76050ee_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Cdobe Emulator\Internat Explorer 2aca4c28536d8881ea6a357cf76050ee_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000f201c64f41fd654a4920d6690a10acc8ca3d89ab518e79a494214cd9bd6a8565000000000e800000000200002000000084fe9e8e99308c874045d1b0c560ae22176678d6e160dcd7d676ae5ebe40b3a790000000f8ab91b729989599f9381e4302ce319151b89d2a8e9c4f4b64df490d559fa93cba364435a701d0f3c90d3733492857b1a3c000218dabdf5a3e9d0e010b873f8549a5748d186ea0868e9f3036e4fbed67037a8f92ca297355fb094796e0801906fce11fbef47650eba3b25a8a2a6f3ecd709ed1accb3b3af1e79a7ae16e07559e4a4d759262d6ab66254b7c30879d9f7b4000000049a0ae7a6cb1206557804da1a40ef555a73e5e32106a7f7981192dc0a6fb2bdfeb4d97c8a631ddc525b8ba8ddf32ebbee483184c4708c0119bf9dc98b0edfdb1 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow 2aca4c28536d8881ea6a357cf76050ee_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{514D1031-3D11-11EF-9629-7667FF076EE4} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60da3e291ed1da01 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426594874" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\New Windows\Allow\www.3929.cn 2aca4c28536d8881ea6a357cf76050ee_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000000b0e65889ba2574856a9b0903eedbaaad4f9dc33250ac41346ee35da04cb3ceb000000000e80000000020000200000005783ebd124304770729320a0dc0f41966529d3d6649c96102cc39b457a0cf35720000000ae5ea0823bdd4739cad1188eda40358df867b6b01f04b47c019c5155a9e8cbd640000000847d938e8ca1bd78fae764ef068935ecc73ec765aa8aecff67e2c29ca8e356f66e880955ca9e0a78f9bd994348ca659a3b2340fb266d13824e400dedc5510fa8 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{513C85D1-3D11-11EF-9629-7667FF076EE4} = "0" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\New Windows\Allow\www.soso.com 2aca4c28536d8881ea6a357cf76050ee_JaffaCakes118.exe -
Modifies registry class 9 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NGFZ\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE" 2aca4c28536d8881ea6a357cf76050ee_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.OLJ 2aca4c28536d8881ea6a357cf76050ee_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.OLJ\ = "NGFZ" 2aca4c28536d8881ea6a357cf76050ee_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NGFZ 2aca4c28536d8881ea6a357cf76050ee_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NGFZ\DefaultIcon 2aca4c28536d8881ea6a357cf76050ee_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NGFZ\shell 2aca4c28536d8881ea6a357cf76050ee_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NGFZ\shell\open 2aca4c28536d8881ea6a357cf76050ee_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NGFZ\shell\open\command 2aca4c28536d8881ea6a357cf76050ee_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NGFZ\shell\open\command\ = "explorer \"C:\\Program Files\\Microsoft %C%9d%8o%9b%8e Emulator\\Internat Explorer\"" 2aca4c28536d8881ea6a357cf76050ee_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2120 iexplore.exe 2956 IEXPLORE.EXE 2956 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2120 iexplore.exe 2120 iexplore.exe 2956 IEXPLORE.EXE 2956 IEXPLORE.EXE 2760 IEXPLORE.EXE 2760 IEXPLORE.EXE 2956 IEXPLORE.EXE 2956 IEXPLORE.EXE 2648 IEXPLORE.EXE 2648 IEXPLORE.EXE 2440 IEXPLORE.EXE 2440 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2376 wrote to memory of 2956 2376 2aca4c28536d8881ea6a357cf76050ee_JaffaCakes118.exe 30 PID 2376 wrote to memory of 2956 2376 2aca4c28536d8881ea6a357cf76050ee_JaffaCakes118.exe 30 PID 2376 wrote to memory of 2956 2376 2aca4c28536d8881ea6a357cf76050ee_JaffaCakes118.exe 30 PID 2376 wrote to memory of 2956 2376 2aca4c28536d8881ea6a357cf76050ee_JaffaCakes118.exe 30 PID 2120 wrote to memory of 2760 2120 iexplore.exe 32 PID 2120 wrote to memory of 2760 2120 iexplore.exe 32 PID 2120 wrote to memory of 2760 2120 iexplore.exe 32 PID 2120 wrote to memory of 2760 2120 iexplore.exe 32 PID 2956 wrote to memory of 2648 2956 IEXPLORE.EXE 33 PID 2956 wrote to memory of 2648 2956 IEXPLORE.EXE 33 PID 2956 wrote to memory of 2648 2956 IEXPLORE.EXE 33 PID 2956 wrote to memory of 2648 2956 IEXPLORE.EXE 33 PID 2956 wrote to memory of 2440 2956 IEXPLORE.EXE 34 PID 2956 wrote to memory of 2440 2956 IEXPLORE.EXE 34 PID 2956 wrote to memory of 2440 2956 IEXPLORE.EXE 34 PID 2956 wrote to memory of 2440 2956 IEXPLORE.EXE 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\2aca4c28536d8881ea6a357cf76050ee_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2aca4c28536d8881ea6a357cf76050ee_JaffaCakes118.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.81830.info/tg15.html?2d2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2648
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:406530 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2440
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2120 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2760
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD502f438a651e4e54b88475298a6667477
SHA1b4bf4363d8aeb954d3c4b6f42062b037b9425206
SHA25689af8165f1c55a435ee9db95eb9e9b2f31b07a73c368616ebee8bbd1c0d58536
SHA51262f25036ed7675a7e3617aa7f942517e769f68a55a37cd3f45f2d5e18e8b81e734817933f891314f27967ff81bbb41346b3557e9426fa2c4ccce05f8c5a18035
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53123cb63847a8e34bb09add2c2429bac
SHA127378623da7615d85dbaf50bb3e85784bdf5cefe
SHA25686df995a526425095546327900ed8d233994929184ae14d2051b094961a46e5b
SHA51201e7d44272ca5e70844634762c08c7142e5b9a576778d84f0e24073186f5c66d06dd4b4010127cdb45abc1f77765986e1669b9278004dd799e315039efecba0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53d377a7fa0ff7987e0a7e3b63997885b
SHA1baf28ace222fe95c4ee74d348ab42060cffbfab5
SHA256199954ba84467372300d19da09cd04ee6dbf9faa53d2e7d18fe05ab74fc1d8dd
SHA512d99b51cbec146c9ec4c5c6a022626b68c5ab29e579efb0cb2699bd930fc44f1180c1f0d576ef587d5e028fae9fb523c6ba9c5a2a70f1ad409b1b43574960d82d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57973c95f37553ba72e3aeb28f7c5d2b1
SHA15f4584d368cd89d29364c5c261bd58a6b28dae64
SHA2567e6c3be25fee4c189d9f6141f6140b8c96f37687384acd737ae77954e3fe5737
SHA5127d274b12ff8751c12acc7c8e9066972bca44da722dd062559f2c1f6766f9c3fa6e6025c8553580de52dea73ab86faf94c2e2076515b9b21b491b31fabdebd388
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD586de4eae141f8275a0d96116f218f9c4
SHA1f653eb02890ea8e5093c3226f96c6a25a26ef491
SHA256aa493950f17c32f13cf762e0fc28e08b0946b62c482b95192ecdbc6e3427c42a
SHA5127df25f72b6cef1a2374da2bd583fb96209eb6f279e30220ff6320b4ab347c80aa60940f821bea93c62cd9129f0a1be8e3ea4af7dba5d5552c6c8ae9811a5d45a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54a812a3da4f1bdf543aa6cd96421dbb8
SHA16ba43617d7baeeaa0b652815b700888c36643e41
SHA25673033caa6f7978482a42a1d98e0c2b511eb479a0ce3dad7c6ff47c9bd8cd9047
SHA5128ab73a794ab651ee53dd34a325a29b0ab4e2e0c95c2398c223aed581d3778588fa9c15385e4f9ba00481b46953d8d2a278fe36402cac3e100729e161ff76fa81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54be876c736686e390fa404182445ef90
SHA106c4411d35351f49c526d06da2565a40902a1af3
SHA256ca147f8a69863bef741c90f33b1fc215884d9d570c1a6f13ae7c3b832416ac3e
SHA512eaa6d1b7abb4834e4a943984128d282cceeabd256f8b2dc394c56193839cce14762bbeed7157a5ca9567266031e1dcd844dc5886a2f503c75c766626224eb6c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51bb02daa52dfbcac8288253efbea6407
SHA1e87c7301d735afe21c55b3bb009623bb252550e1
SHA256b1be0f7cf96443c4ebcc1844e4ad3ddf530c0649140c1e4f18b68d43f0eacbbb
SHA512796c13cc9bf55e1090738e8ea0dfbb0587f3c0b2f3744064619cb69a15ec283b1a3ac18f8342289624aa23b6a5c2b70f7c3d1c3a6679f5bf077560483d8ebd5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD511a151d15ca092af1f4c0b5ad44e3627
SHA1d0c44f78ad05814a0b2e346f1cedb58ca4fb430b
SHA256d738f90cc9c3be3c92ae9d375489ca93c04a2871d75879b2f5ceb7847d19f12d
SHA512ee125b2ec049e61cd85d1c8aacf1ef2c749e1fcaee288d266d24765a5506304863b3db4013e8143e7dcbda0dd4480013aa4eb57b655c1ee5dec068896e51b73a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f408357a7c47ff2d2d15c09ad71561b5
SHA145a72742d5f910dbf4c7324e18bbbbde2bb98e12
SHA256ae9d9fbd3331d3f0bb67f924fe0e9f989ac92e1d9be94b0a6db48581b490704e
SHA512ec9aea6c7a002e837dea3828d22be745bec5857637f17ff9556e6edd4714fc4c56fa8d45a68dd50d6da5299591098eda4e84edf1db710e1d225d6d61778b10ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c8dafde19ecaeaba8ba10300492429f1
SHA13e890811d79e924c80120db1b896acf604e1534d
SHA2569d2afcd22a6328275c020dd4e05d87551a781b8a2aa0b2c63b09007cb752df34
SHA512890dd3760ec98195b15218429e73954e708d3e7ed4f7d837a5887e778e4353e29cdb4f71e0a6e2ffbfa927408b932e209b643f398600574e2859698d71b620ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed0b332473a8931f962789d34771fd68
SHA185ebc260fa00808f8da4af0507c77ac6d267acbf
SHA256c7fe530f5461c906ed11c83d15e53f538dcf3a67d81e89eff15a9bc9ffe05646
SHA5122f75c67de1550076a0d93f48b52ac750ddc78b69f6212da7732b0f9ee20a4ffa067890fb6eba95e80a13fd865a7d6bfa21f75acd9899e4e2dc4e8d53015956c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58e882d083e145f2547258bf8059b3ce0
SHA1b76f62242aae160f13181763c41ee093e1877391
SHA2560f7581cbfe313786ccded9926d2065591a5ae68e1220af0461a913c507fbfc9c
SHA5126f69016cbad4d40a3800edde4e2ea244ebbedd4a1589e10dab6af7711c452b0589a3bfc1c75f79c6c2cf973e87080e2a1b5b728e6e54c21e99e0c1eafed6892b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52a8f4b97fb75b4c3dcd1cef81dc0e922
SHA119e076a6e7ce62062971c1700064c1ab90eb83e2
SHA25669cd895fc7c1201e0b61b2c8b16661a1d56f1bfc967945bb01edcae1d6a8abc0
SHA5121b780e72961137f497055936ba25bb645f1fe70743f103de8e7ee2c2b9b38bca8f3977b539e6a00d930e5b2cca71fe2ec51364790267e2d4cd49b21693717be2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54768f20f32dbb720bc0162065807d925
SHA1719c87caaa0e5e34025104c1dd3ed3988cc936db
SHA256a87dba5858075dbef061c638d5c91827b3a3dabad401c2ca8ae86b44e3e02bbe
SHA512bd5222d9183351274c62c845177b899cb236183cdcea6b5130e8008f6d1f6956e5dec76e94b5147d0e78415400f3d6aac27641895ed0f1ed90168731234f07a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5879319a5ae8a2a6a6676c03bba90f134
SHA123a66add79281955416dfb7add52bef32aaed76d
SHA25666cf23a48bf70e960be79afe6f630a1656a3fdc3a32669575f63439bd31ea09a
SHA512ca004f15a78fe52c69cb74626a95e056453095b56fc3d8c1af7413b59f19a5bff735d912b9d7fe5c5b1fe786df0743f691a6823a50b4e7f14374e7d2eff7b55d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5967013f3506ba568269fea05c3ca7e0b
SHA16ca89d2047837416345b9ea8f23b0909825d21bd
SHA2567cb2c3bdd1e92e4d62ebd3e3deb9ea507555d5efdfde2181c912e335c47a3d98
SHA512a96eb1fb061f34545b2460aea7da1dbcba2455219f0503d953030777a079a8378bf797ad0cfcfeb63ceb537e2cf76753f80249884aed2706dd1d6cec0abedc0b
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{513C85D1-3D11-11EF-9629-7667FF076EE4}.dat
Filesize3KB
MD59beb1449e99e64c5ba6d1145634779e0
SHA1918e4c5f54974235d66e397a4d57c480e8351abd
SHA25639ad010db3ce9d773229bf09ba786ff6b0dd1d06ad48b16ed6d792b6f1e3364d
SHA512015b8a65adac92fdae3cdd188d19a53f7e12f42581abbde2541a8a1c964d7a63449706ac8d6c8fe04993c7c90e4dc59c4104e1c9200192011a31b516f2bcf09d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b