1499a55c2f390b01a78e82ac27e6d6f91d9563d8d69d9659ea7da196bb9de6fb

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 23:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

697b7fc8bd49004867c5d81902ad0898_JaffaCakes118.exe
Size

892KB
MD5

697b7fc8bd49004867c5d81902ad0898
SHA1

ced28aaf58c55b299e80447855a315a51c87f8c8
SHA256

1499a55c2f390b01a78e82ac27e6d6f91d9563d8d69d9659ea7da196bb9de6fb
SHA512

6e32c7d4aadda84c4eea768c9e78ed8781c99c633dd2dd7791fedc2144307441b64de41a898ccfdceabff7ec442ebd72557e5f65d1fca0495f602829c8d422df
SSDEEP

12288:p31XsYeziPHb4pbsve7glUzHWelbgdx8Xm2tmy:pifg74NsW7g+Hflbg+J

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	697b7fc8bd49004867c5d81902ad0898_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	697b7fc8bd49004867c5d81902ad0898_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 61 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428544127"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{8EEB6A5E-494F-11EF-81F6-5EC22215AA79} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1669324682"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000503501ac0e5b684085dc571883e44fec00000000020000000000106600000001000020000000b0970861dcc4bd964d0652c643bcfb1aa91044b4ba2a3dd1892b5226bbd18aa0000000000e8000000002000020000000d99ff858c827bf8a766ec27fde2dd377a786add5094809ef4fcfe6ef7318f98420000000a2ca7d404d71d30dbce1cfb76615c3b1aa2e261b3c82a1b78fbcce61c9f993de40000000c110acc8821608d1aab53456c5018ea02ccf1014e49ad87f7863e99dc27526c528fb1d490f34e8d22de80321ad8dd320326008f82dd7331b0679e60d9084c1ae	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000503501ac0e5b684085dc571883e44fec000000000200000000001066000000010000200000004ea7f105c68d041fc61e763d1e55a4789a80e78a16cedf01422919ab0c93bbd0000000000e800000000200002000000045fb90a24ffefe8204979059047dd92c70ea25f5f4c16ae30be60a298d3b0da0200000007161dd0eabf99868f3791437e5280a496696eba44e1a5208c90d4ddc8dfa4b6a40000000392321616b18a7ddf32debc1a9991816baf0178baae5cc9848426021003452b2ae52609c8026d38a9e47fd729263276bbe54dab48007f63395c210b127ecc348	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31120732"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30e4557a5cddda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31120732"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10cb617a5cddda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1669324682"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31120732"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1666043676"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1666043676"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{8EE4431A-494F-11EF-81F6-5EC22215AA79} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31120732"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2676	iexplore.exe
3576	iexplore.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1100	697b7fc8bd49004867c5d81902ad0898_JaffaCakes118.exe
1100	697b7fc8bd49004867c5d81902ad0898_JaffaCakes118.exe
2676	iexplore.exe
2676	iexplore.exe
3576	iexplore.exe
3576	iexplore.exe
3216	IEXPLORE.EXE
3216	IEXPLORE.EXE
3748	IEXPLORE.EXE
3748	IEXPLORE.EXE
3748	IEXPLORE.EXE
3748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 2676	1100	697b7fc8bd49004867c5d81902ad0898_JaffaCakes118.exe	84
PID 1100 wrote to memory of 2676	1100	697b7fc8bd49004867c5d81902ad0898_JaffaCakes118.exe	84
PID 1100 wrote to memory of 3576	1100	697b7fc8bd49004867c5d81902ad0898_JaffaCakes118.exe	85
PID 1100 wrote to memory of 3576	1100	697b7fc8bd49004867c5d81902ad0898_JaffaCakes118.exe	85
PID 2676 wrote to memory of 3216	2676	iexplore.exe	86
PID 2676 wrote to memory of 3216	2676	iexplore.exe	86
PID 2676 wrote to memory of 3216	2676	iexplore.exe	86
PID 3576 wrote to memory of 3748	3576	iexplore.exe	87
PID 3576 wrote to memory of 3748	3576	iexplore.exe	87
PID 3576 wrote to memory of 3748	3576	iexplore.exe	87

C:\Users\Admin\AppData\Local\Temp\697b7fc8bd49004867c5d81902ad0898_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\697b7fc8bd49004867c5d81902ad0898_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.vdisk.cn/moxiaoya
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2676 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:3216
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.vdisk.cn/moxiaoya
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3576
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3576 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:3748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
f45300b4bfa494ccd852b64a295d2b8f

SHA1
f95de19f9cc5e8d0e9b60f290310856c475fd442

SHA256
66d527bef441e128a840939dd7a3dee3f505deb3ee866518961cdfae19991e85

SHA512
545dc62f0f047a05b9edf9fe48a4e5cf60e1c1c01a1cc367e810837f21facf0206b30ca7dc7a6bf530ac94891e63768313615e2c12603ce509d7302cd41dd9b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
5919f491c2fc380ebc39e4b1bf68c619

SHA1
4c47ce8a8a913e1276bd02aa7376271f2e68f490

SHA256
d41c026a8192e138a776a67ab74369b96054359d5b9ad61af739cc0aa360de22

SHA512
6d90eab76642510ec55e119728593375fb569d21620c93fc24140946b7060ae9fa1bb36180c14b6c8858efeb66cad41087328f5ed9af0af0e7b4604519fa651e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
9fd0585c85186fca746d3c80e7019176

SHA1
e89ee392bba59ed8df0f09a2336d9848af6d052f

SHA256
a8a78ce33f5cecc95f8224212b75da29b8f14d8dcddd6f6df99c549aedd19b9a

SHA512
9dd3b570c312e11983289a25abf9cb4541c947b8caa9e84551497d5aaeb9de789c2230978c15ac337f4b56930c6702910053f0779857dfc104b130b4460e960f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{8EE4431A-494F-11EF-81F6-5EC22215AA79}.dat

Filesize
5KB

MD5
a597e977337a79a0cb713a914aa4d69b

SHA1
d4371b5dee7cb4d87145a98b9ebc0341c3e73489

SHA256
5b385a2d2370b3412bab7415b1871e94b6cffcaf3dc13edf3c123f2b36739526

SHA512
a9fe074ed4df4d996c58bff2b95fb35a9e0b89fb9d865e38aca655d2c5fdc24527642a6401674cf11811224f17d335dca28a4dfa3c1328dae7281132e9772462

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{8EEB6A5E-494F-11EF-81F6-5EC22215AA79}.dat

Filesize
3KB

MD5
254730bda8ae61686964defa50629b65

SHA1
dbabc43e5252dd445285490efa61a406bee6106d

SHA256
626c1c97f0a6ac38a2bf7f3e68d01fb8a5fbe4afddb5cf1843d4cf754a384dfa

SHA512
b7287db4408def605ad77edadc3b89af9c160cde31e12c2f1a33648895912bbadd7a5f2ba8fb3c487dacc261b27eef36667aa58ff0e48377ee3c242dd39475d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verDA7.tmp

Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\yl6xsh0\imagestore.dat

Filesize
6KB

MD5
88c98401178172d7e9416da6c71303d0

SHA1
92eb1d7bf6ab7773f43a7c6e18b351473a094652

SHA256
f204b3c9ca23260cc05d305261ba64ad17c9eb8fa4b70f11170e647e21ca3c8e

SHA512
147f15f289caf76afb75c65cdc3d3cdc20b3848598ffcafe4cd9231657e67e18d41d94f86ba59ce9c4801c395cf99ce56f515e9b4d42d7b252c204bec2cdd325

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CWF229A2\favicon[2].ico

Filesize
3KB

MD5
75431504e45e9a6cbe94abe910df2d61

SHA1
f5017102eeecc57896d27f13f24093663fe518f4

SHA256
0e7b448d6bd1929afc573ae93df3901eb20507a295e059f29076dba25dca0e46

SHA512
238b3ef8b1161f419ad6143ac5a4d5b78797a6a902f81c06b7c552060ff41efb8e033ac550d6ab9add6b7bb32d4c64d160d5c4000daaed28b23c8d936a3c74a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FMLLHXYA\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit