Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/09/2024, 20:26
Static task
static1
Behavioral task
behavioral1
Sample
d064b804448a22524d6042e322c28282_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d064b804448a22524d6042e322c28282_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d064b804448a22524d6042e322c28282_JaffaCakes118.exe
-
Size
834KB
-
MD5
d064b804448a22524d6042e322c28282
-
SHA1
622d5c03e5e7e689daf162804a5546252ee1f8e1
-
SHA256
b4e9d76b65136f061a3f1897e2979cf3ca7972a3fe10821f5cb085fdd7c47f71
-
SHA512
7fc551bcc8ce4a658470825dcadeb12ec0e05f35705b18f1bb97f7a0bab63650bb159406722d877a8885dbf987f3300269122bc2836ffa660ab394a2838c6f0e
-
SSDEEP
12288:XaWzgMg7v3qnCiMErQohh0F4CCJ8lnyC8MEFmu6KMWoLnG:qaHMv6CorjqnyC8MEUKMpC
Malware Config
Signatures
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/1908-0-0x0000000000400000-0x00000000004C6000-memory.dmp autoit_exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d064b804448a22524d6042e322c28282_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5A877F81-6C8E-11EF-AAC7-FE6EB537C9A6} = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 307ec1499b00db01 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000acd812d0f3da1ab0c34bc7a1d26649124eb9bae09a1fd0c7525f6f6153f3ec6c000000000e80000000020000200000007c3b0c2b66c53f1f20c5b5f73f2d17f86399c3ea6e5be09a015b98b24f56e361900000003102c1a2bc8c00bfe8635639cd6f93b6d81a23b9daf8f1acdd39ef04e5402ff8e056aefb46323b0a4a10cc06275690b345b575297a2d6b778245ec6c7407a59a91a0fdb85fac5210a49b4865672337562c8c21d670cb12348848880a3ba6161d50a6890d09b6a4bce54d2f7f984e9a7eba48d15f8c166630b6d12707f80ed1e51a64dd895d86dda152e30852bbb0de99400000004ade10a62ab3835ecfde6b66acb5b50217f11af0431e67d7c16d94f52cf729fedacbd5c63418a71e58e9da349a06689e6365e77be5021d01b6890653f5cebe70 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5A875871-6C8E-11EF-AAC7-FE6EB537C9A6} = "0" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f542000000000200000000001066000000010000200000000fd249a84d41720a615f7b545b7b12b3a0f05a8f7f66a19d9d4140ff720ba703000000000e8000000002000020000000335f982b77bdf5d32dbce1203fac9e374753625e082f01502814e6dc5463c819200000009855240a7e189e098c49f597f3e905f424c5efb7ba1fbff5aa4c1fb1b966e9c94000000022c46bfb77b59af334dc10759a3d76841048be23d80b3f700d4a9cda9eedcf8f716179423b4ed22d0023b9d48796d4de143aebe93a83307b2d0be7b356ab2ee7 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431816282" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1908 d064b804448a22524d6042e322c28282_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1908 d064b804448a22524d6042e322c28282_JaffaCakes118.exe 2736 IEXPLORE.EXE 2748 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 2736 IEXPLORE.EXE 2736 IEXPLORE.EXE 2748 IEXPLORE.EXE 2748 IEXPLORE.EXE 2928 IEXPLORE.EXE 2928 IEXPLORE.EXE 2892 IEXPLORE.EXE 2892 IEXPLORE.EXE 2892 IEXPLORE.EXE 2892 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1908 wrote to memory of 2324 1908 d064b804448a22524d6042e322c28282_JaffaCakes118.exe 31 PID 1908 wrote to memory of 2324 1908 d064b804448a22524d6042e322c28282_JaffaCakes118.exe 31 PID 1908 wrote to memory of 2324 1908 d064b804448a22524d6042e322c28282_JaffaCakes118.exe 31 PID 1908 wrote to memory of 2324 1908 d064b804448a22524d6042e322c28282_JaffaCakes118.exe 31 PID 1908 wrote to memory of 2748 1908 d064b804448a22524d6042e322c28282_JaffaCakes118.exe 32 PID 1908 wrote to memory of 2748 1908 d064b804448a22524d6042e322c28282_JaffaCakes118.exe 32 PID 1908 wrote to memory of 2748 1908 d064b804448a22524d6042e322c28282_JaffaCakes118.exe 32 PID 1908 wrote to memory of 2748 1908 d064b804448a22524d6042e322c28282_JaffaCakes118.exe 32 PID 1908 wrote to memory of 2736 1908 d064b804448a22524d6042e322c28282_JaffaCakes118.exe 33 PID 1908 wrote to memory of 2736 1908 d064b804448a22524d6042e322c28282_JaffaCakes118.exe 33 PID 1908 wrote to memory of 2736 1908 d064b804448a22524d6042e322c28282_JaffaCakes118.exe 33 PID 1908 wrote to memory of 2736 1908 d064b804448a22524d6042e322c28282_JaffaCakes118.exe 33 PID 2736 wrote to memory of 2928 2736 IEXPLORE.EXE 34 PID 2736 wrote to memory of 2928 2736 IEXPLORE.EXE 34 PID 2736 wrote to memory of 2928 2736 IEXPLORE.EXE 34 PID 2736 wrote to memory of 2928 2736 IEXPLORE.EXE 34 PID 2748 wrote to memory of 2892 2748 IEXPLORE.EXE 35 PID 2748 wrote to memory of 2892 2748 IEXPLORE.EXE 35 PID 2748 wrote to memory of 2892 2748 IEXPLORE.EXE 35 PID 2748 wrote to memory of 2892 2748 IEXPLORE.EXE 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\d064b804448a22524d6042e322c28282_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d064b804448a22524d6042e322c28282_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\SysWOW64\notepad.exenotepad.exe2⤵
- System Location Discovery: System Language Discovery
PID:2324
-
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://hackgame.org/2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2748 CREDAT:275457 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2892
-
-
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://hackgame.org/videocrossfire2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2736 CREDAT:275457 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2928
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50f8a87d40a0b58fdeabae26a9152b2d9
SHA10a41368a02d81052f3d02599c9dcd2e95c365a2a
SHA256b34fce39f14e825655f0b021a2e724e78776e4752be47d0d2592df5120bc5976
SHA5127e6b9b4fb8a2f8f16c41866e3c82da07f7335ed27996fc7d981345595da3aa18dc452dab7956ca2df26c1cae8d11b65eba30f9e8bca34bd407be97cef17f9df3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a4c6ea0380dfe073f48b9324bb5bf848
SHA16406e0588bbaa9edac92543a659ff7406ee260d6
SHA256518f79702b9a47dcfb548b7e3daf5d59b2d88e43f922df2876d64d94b19802f1
SHA51250b60ae0374f86587160bc31e338de0bf12d88e97379fd9d4af32a864e149734327f8add119f16713a5a7ece1eb774d155e426aef0b48df60ed63b9274e22897
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d3b54c40b0e65e41fa9f8f8f37108373
SHA1eb98653f61b1d9d9716b6bcdc5dc00f7b43361a3
SHA25674f50e820de667db63a31a74545404a82bc0e0509ef136c0b2043edc02df170a
SHA512d5418bc738d42fc1f38fd4018a99b0eef0fbb1e6d01a5ecd18689269c8d714323aaec9a7e7412bf6366ab10d54cf95e883786bc3fda87b660dfbeffb6c91cbae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54cb4b88981abb99c6c44b83e9634799a
SHA16b149fe884a0bbff397bf4f6f45e06bf80d7a321
SHA256938f9c376dd01c63692cc10f3550aafe3b08a325d0bda19296a7584c7aa5278f
SHA512f93ad54c701f9f57269b8c9cbd863b593969339ccda9e08f9695e5c12200627dd66c23c7faa19d981f37b2f2bc84b8e7975be2b54a297b96fbe3dd41b1f11f91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD513934d6795bb06a336f49490aa93ecd2
SHA10fc8818bf62fbd89669c1e39687613771d609a96
SHA2561deceaf397575f39910f3241d7f0bd96cd9f0b607f5ef5206c3d3c99e92de930
SHA51259e613767b0df0be29b2410aa9b0cf99479f1fcc7d65afae3a020526d9abb8b5cd396a408a236075a622b323e83628bb5beda595142909618ebf9e6ffe7e7fc0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c6946ebaf60ae77de38730f8b879ca40
SHA1db26630b325f981b58204515511baf022d1deab8
SHA25621e7f5a04d4947d24f897c5f904f4bc2bf37d9a2446db1ed6cbee23a82de9b4a
SHA512c4d3c4edace9c0ae51c6e2fb6eb9b26e1ba2f375118f03adb416ec7ff0ab8bffb205a8f5094c4945c55294fe2127709ccf87138bd1b1983f3b736d084e2d9df2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57db86d154eb278476015c9c3e980bdcd
SHA13a2faf74eaaa8c1fb271bcacb92434c36693ff0c
SHA25610142584ff5957ba101db4e5339214a23b23002545bfe37341bb125ad2fadfdd
SHA5122c8c8eac36f7a461b64f23ee81077bbb66c64cee59b9d5443435b14183e57e567607ce4962a7e8398276c674c406d2c01ebfde431cde5c1be6fb6564d247b235
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57b0d454b9e8b6aa6771719d669c768df
SHA1020237e15117282a0a45feac1e5401686abbef01
SHA256fa40973706cf338dbd152fac6d4018453d6d0e6d7449e36ba0c0b91aceebd5ae
SHA512f385219f768c6b591cc037508565ec5a564d33d9f32c762ff7feb8badf4570df60e5e5e6069ede5eb9dd9043578017f4c24b28a74526ca75d974c843e19133e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50f6c390bacf57b5072bfca6e05187923
SHA14764f98f86928edd25482ca04c8f1885a28ff00f
SHA256d9ad842c34719bbcb6b2660180100ffb2ca086e39c66cd71be10ee5cf7ad55d9
SHA512ca2cb7013f6210d61720cd1b6068269a7f27115ce5b22da76757b5fda8a38747a8bf1de29c946cc142f2225cd0486b111779989cc5a0e8871bc311e45751f58b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a597c20e87fb0af4c8b97f85f1ae9c43
SHA1c8f2a7c5674daa4ef5851f387ea91d26a6b6a99d
SHA2565b7c66d63b6fabf38bdd71ebaa6ae915b7a65ca8188169dcfd07962ecda8d629
SHA512250090ebc43eeda9b9afa3106a0fcd16b3a7a21ad7177e0723bd3014d56a9d12b7d51f48d967a2793f59432572b9ded657f80c22b21c0a7bbe073ed6a68e70ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5543fdc4aef6bbfe7671d65bafd9b426a
SHA19131aa27998390b1021a701655d29c21a06d3e4e
SHA2568dff5a52d7f894f4129146202f68e9a9910bce6216c61fe31691cd18745b229f
SHA512ee807c61a6372eab2e7641a14cd76147cc61c5c9a86b0b0488de605d8c634d2a73d74e0ba1513293ee6bf0ec838766df9961e9c33b8ee6f522d2589fb095c279
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a862a3abbea3d73339a87ee832f3cfb7
SHA1baba9b775f3d55e5a2c58f31ac16f118700c5f44
SHA256dad0348e20fa1f1b756fa2f53201e67ea73c426b4d005453ee79bfb038c53299
SHA512bddddb8c7b159ec1c51de71cc9d6af5a9cbea783ef5d5f85149cdb4355844ef2c87da101c9ffc43f5551a7d2c8b4c809336d749a3fed452ae33231093c7c98fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51cb50a085ef55f37317dd6b71973b165
SHA100916d49f241dd2b7b0e107b066b73f49dbf2bba
SHA2563696adb0c79ef8b05f1be657628bc34d88859a4cb0e969f96d7ad0cd3f3d7d54
SHA512554acbff15e6d55c85bdc77178b87dca62217cd15f171b741c34421e2015c76c783630fa3d980539c4762d4acc4d0043e83adf7f9565f614e95f288e469e93a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59dded30e5aab27b5e913d3d1c5ad3ef2
SHA16f563e5cadb4ca41ce7a1ac841d03b90ada5d06f
SHA256f0cf8d56877b8c919aa57cef9c70e3d7e9acc6a4cf945d0fb3da671414720134
SHA51231374465b41145c0e43cc2b0ad8a31aaf9687e88123ebd6d8b1cb1a347a45f9c4e590a0606ba38bc1d62343ea2021758285bde5eb7afd356fbaee44ba2069ec3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD528937fd57ca367359dcb45448d306cb5
SHA127a90e58337d4d410528d9a6001e46b6500f1274
SHA2568aa31e6455db9848b3198e74346316cf5977179e5249280ce3f42e7b15335554
SHA51234b8f52d778262d1be435229f107466e53b82681f9bbce0e6e75e3b524a8b4492b591295f14680737cdfe5cebee294733fcbe77a8613053e7f89ca3b4067edfc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5256cf033b1aea0ab70bb0038e56d1948
SHA1fe5aa818d613451b29af8bc62f0c66b4258ff81d
SHA25697f74243931df4494f270549e6a3c73b9a4ea9598da62dc4a1f991705493f3c3
SHA512ce3a13c08c33a02276174c9ccf3a85793acb583b78e6100229b437b2f0d42ac770bbb3a7d55e20d1af0ef7a5a728e151d83f4b0d7f56a354b3c6c0712f71b809
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD561a39eb723713e02a2eb89823d4cf561
SHA1fc121f2f913e50b02cd81e931e293c62828cb199
SHA256e72c1c9ff5d9149632b6d6149e6010d7d30d1446419626e6b4eafde43781180a
SHA5125fee301901270abceadfcf2cfd3ac708f0a9b698a79524b05337b9491e6d8ed03ef85c97c4da1d06ce1e4d12dc9c15b38e233863d64a01b9b28a480b54002c61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59d92928dffaddb227a4ec96b223d75dc
SHA1e3064318a38ac29ba631e7fdd485c60ded41f2c9
SHA256d8e81ab54d9969f0fe92eecb31b96311e5941d2c24a581c8a4f0301c03a436eb
SHA51252215ebb8c79d16c169eb1cb150b765d3f951d9387e5c423e9407f9929d0d73b636f74112e51ad3781214a000afb7820a1f679961cbccb954fe4c539a7549f95
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD535f9510ef5ae7fa3f6d2871ace09d2b5
SHA1198f854d1f2e2a0eb4bbfd4969c89a1654e7b587
SHA25623db84a2515b2e29d1e40ba370105a0531b4977de14a400def92352f48ebb95b
SHA51228cace3f5bd6e1dbf696b973888018227ef141bc147c5faddf5839b70d14b2947e5cc4db6a7575f84133bb49e2f68e49645adb104d3fa4eb6b4074b6ced04bc9
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{5A875871-6C8E-11EF-AAC7-FE6EB537C9A6}.dat
Filesize5KB
MD558d8ad1d7ef5b63dc2b407c98bcd1969
SHA16b6ea7b6eb4e299b3a87e2f90b6bb03edbf03312
SHA2561152447346bb3e53a6c28fbaae14eaac2a81c03212c073006047d15c679d93c3
SHA512aaf1cc478524ad0508e6d04f102e1d7858c68d615fcd6277820d9e75789257016832ea7e183393e096ac4bdf55b0ed50e1a87cb6eb2397525ca6525d00804b36
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{5A877F81-6C8E-11EF-AAC7-FE6EB537C9A6}.dat
Filesize4KB
MD57560f134db1db2a519c30b649efaedb9
SHA1e9808c7f144ed45a81b427c195f9753b91c1ef73
SHA25652f48a734c67d8962cb4d0ca5651ad52d4eb79394cdfaa910e2c09a2ef067a51
SHA5127c3a87e31d084bb064125ec5ba9f6e5014aa4e87feefb5516b7631fd88e329287d5a10ee271b423854ec4a5688a0441abedf3f15a3a57980601f90e74af3060d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b