Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/09/2024, 10:59
Static task
static1
Behavioral task
behavioral1
Sample
fa4857d28614967143116e68226f7f95_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fa4857d28614967143116e68226f7f95_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
fa4857d28614967143116e68226f7f95_JaffaCakes118.html
-
Size
470KB
-
MD5
fa4857d28614967143116e68226f7f95
-
SHA1
131766b03e1068511d16c8355d9187e00d3500e3
-
SHA256
a36f9ed3a72e5e4ad7752b49ec5b6a2bcadae56da4402bf2332a2030949bae3a
-
SHA512
293983af4b1d8db660d8f1edd35391fb72a4e5d58c5cc07d403431eebf1d54fd767bc37ae19700cb66d38c42046969c75c3071e5db27708bfd132cc6e2a7fa8a
-
SSDEEP
6144:SksMYod+X3oI+Ysa38eaqUquyHQcHC29+F6HT4ACpYU65aDCl:55d+X3dfUquNcZ+IT4ppJdg
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2828 FP_AX_CAB_INSTALLER64.exe 2908 svchost.exe 2956 DesktopLayer.exe -
Loads dropped DLL 3 IoCs
pid Process 1688 IEXPLORE.EXE 1688 IEXPLORE.EXE 2908 svchost.exe -
resource yara_rule behavioral1/files/0x000500000001a4c7-544.dat upx behavioral1/memory/2908-548-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2908-551-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2956-561-0x0000000000400000-0x000000000042E000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\pxC8DB.tmp svchost.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe svchost.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.app.log IEXPLORE.EXE File opened for modification C:\Windows\Downloaded Program Files\SETBA0C.tmp IEXPLORE.EXE File created C:\Windows\Downloaded Program Files\SETBA0C.tmp IEXPLORE.EXE File opened for modification C:\Windows\Downloaded Program Files\swflash64.inf IEXPLORE.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FP_AX_CAB_INSTALLER64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DesktopLayer.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433596617" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{861E9661-7CBF-11EF-AD4F-5A85C185DB3E} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0efb84dcc10db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea22000000000200000000001066000000010000200000005170d447debf54747ae678fd0dec667ec0199fea859030f06b98a04b4acce98e000000000e800000000200002000000004b19d6cc081379975e636ba56195604d9f8b98bb31de485eaa10d8aa60c8770900000005a1bebd52862a97fe5cd228cf2bc8c1cb7940892c9281bae004b85713cc6f9411444e1f5c3de9041f21b2ed9bfcdfca8fddb5f08c8ae58aeece78762c69015c180086a444ed6367ddf906d01cacb749d07b5eb93271c21ced255254d7925168791142afb5bacee83f5f48d51dcb2f557c0fb9cbfd53ea4d8268cfb60cb75419fab75f820825eb9aaf0cc02a22dc3483d400000004986f379ed765423dec82f57e6c709b27cec5c69e79ed7bbba8e17d9e3870720d243dd3f3e595e74fe25573c735c053e98476f877ec3c41df73452a381b5d3e4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea22000000000200000000001066000000010000200000004f514cfccb7859ee6dd127b6a74aa4dba373e97a892ca07f4975ba76b296b282000000000e8000000002000020000000e57f34b9bc5c1131155e15d147e8f2eaa9d09df0f96ffa0938f61eb5847c4b4520000000312b0498bcc06acd5ae6d4ca85dd60f027e4ae84e81ba0fc86f7d2ab3d17ac18400000004a4799f4d94bab423f148bf6b55028cec6558cca16e756f60dc8fb76efc8f3a0e65386363a6e113659d6347fa73a86e828d809cc8f30d3a755034a3b876c818c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2828 FP_AX_CAB_INSTALLER64.exe 2956 DesktopLayer.exe 2956 DesktopLayer.exe 2956 DesktopLayer.exe 2956 DesktopLayer.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 1688 IEXPLORE.EXE Token: SeRestorePrivilege 1688 IEXPLORE.EXE Token: SeRestorePrivilege 1688 IEXPLORE.EXE Token: SeRestorePrivilege 1688 IEXPLORE.EXE Token: SeRestorePrivilege 1688 IEXPLORE.EXE Token: SeRestorePrivilege 1688 IEXPLORE.EXE Token: SeRestorePrivilege 1688 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2184 iexplore.exe 2184 iexplore.exe 2184 iexplore.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 2184 iexplore.exe 2184 iexplore.exe 1688 IEXPLORE.EXE 1688 IEXPLORE.EXE 2184 iexplore.exe 2184 iexplore.exe 328 IEXPLORE.EXE 328 IEXPLORE.EXE 2184 iexplore.exe 2184 iexplore.exe 2636 IEXPLORE.EXE 2636 IEXPLORE.EXE 2636 IEXPLORE.EXE 2636 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 2184 wrote to memory of 1688 2184 iexplore.exe 30 PID 2184 wrote to memory of 1688 2184 iexplore.exe 30 PID 2184 wrote to memory of 1688 2184 iexplore.exe 30 PID 2184 wrote to memory of 1688 2184 iexplore.exe 30 PID 1688 wrote to memory of 2828 1688 IEXPLORE.EXE 32 PID 1688 wrote to memory of 2828 1688 IEXPLORE.EXE 32 PID 1688 wrote to memory of 2828 1688 IEXPLORE.EXE 32 PID 1688 wrote to memory of 2828 1688 IEXPLORE.EXE 32 PID 1688 wrote to memory of 2828 1688 IEXPLORE.EXE 32 PID 1688 wrote to memory of 2828 1688 IEXPLORE.EXE 32 PID 1688 wrote to memory of 2828 1688 IEXPLORE.EXE 32 PID 2828 wrote to memory of 264 2828 FP_AX_CAB_INSTALLER64.exe 33 PID 2828 wrote to memory of 264 2828 FP_AX_CAB_INSTALLER64.exe 33 PID 2828 wrote to memory of 264 2828 FP_AX_CAB_INSTALLER64.exe 33 PID 2828 wrote to memory of 264 2828 FP_AX_CAB_INSTALLER64.exe 33 PID 2184 wrote to memory of 328 2184 iexplore.exe 34 PID 2184 wrote to memory of 328 2184 iexplore.exe 34 PID 2184 wrote to memory of 328 2184 iexplore.exe 34 PID 2184 wrote to memory of 328 2184 iexplore.exe 34 PID 1688 wrote to memory of 2908 1688 IEXPLORE.EXE 35 PID 1688 wrote to memory of 2908 1688 IEXPLORE.EXE 35 PID 1688 wrote to memory of 2908 1688 IEXPLORE.EXE 35 PID 1688 wrote to memory of 2908 1688 IEXPLORE.EXE 35 PID 2908 wrote to memory of 2956 2908 svchost.exe 36 PID 2908 wrote to memory of 2956 2908 svchost.exe 36 PID 2908 wrote to memory of 2956 2908 svchost.exe 36 PID 2908 wrote to memory of 2956 2908 svchost.exe 36 PID 2956 wrote to memory of 2676 2956 DesktopLayer.exe 37 PID 2956 wrote to memory of 2676 2956 DesktopLayer.exe 37 PID 2956 wrote to memory of 2676 2956 DesktopLayer.exe 37 PID 2956 wrote to memory of 2676 2956 DesktopLayer.exe 37 PID 2184 wrote to memory of 2636 2184 iexplore.exe 38 PID 2184 wrote to memory of 2636 2184 iexplore.exe 38 PID 2184 wrote to memory of 2636 2184 iexplore.exe 38 PID 2184 wrote to memory of 2636 2184 iexplore.exe 38
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fa4857d28614967143116e68226f7f95_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:22⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\ICD1.tmp\FP_AX_CAB_INSTALLER64.exeC:\Users\Admin\AppData\Local\Temp\ICD1.tmp\FP_AX_CAB_INSTALLER64.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://get3.adobe.com/flashplayer/update/activex4⤵PID:264
-
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵PID:2676
-
-
-
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275465 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:328
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:734214 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2636
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f5f6b94c6e3c8fc1a609bb08a8084c4a
SHA17c850da12ce695fb56611af55663fd4b8f3c99b9
SHA2564e8a65b4344478b90a7ba65cc372fb117e033d2586557dcb867156e573ecc7d3
SHA5124db7085003ad91d834995a7f86984c26954b912b43483fce40969ea7695a62d61f2d7fc468f821918811c118e396b31db8476d5bddd9c8a50820b7d35bdfb0f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55d78d7b4d0f51f578be0dd38600889e0
SHA10266c6e44b195f1a3431607a5a0e67d62f8343e6
SHA256d4293f848c59b6e10963dd8530f8cb9612b03be03d802587447217cbcac56ad3
SHA512347fe0fabd4bdc0fb93354481761ec15368696df1744341a1782a01040b4c23d8c334d174e6ad974837b7c160c64196624d6029dea86b2bf8ac8df57fbcee881
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD505f3f7a504dc6f91c3d64f78ba001252
SHA123d408e77df1c44bbd0223057909832830e77a72
SHA2566b2415d5cefc947e92f98655aa75e45c0a8eeca209269a6f6f2758876bcb326b
SHA512b087e962f5689d1f9b0aca003e0bfbf893cdb92177dada8cac4418fc6405c14bfa5f95843bd577ec0ffeb48c5b1c0b3265c921984d2c14765e82e4556ddb7ff5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52aa3469b21d0c2ec384e0f5ecb332e81
SHA118130a4eb9e7f4dd57647efe5a6f839d5a2baa5c
SHA256786d5f95d2f5725035299cd9e32a9728d0f8ba510f2c6c99c83516fb27355df7
SHA512003602a6e466f3560a5423b691254e8a7fb7fdb0cac2c1ce22320d7498316490122887a81c634e6c1a13b1f12b75bf98c5cc4174c0109b579ca1c9b87ac4c6aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cd4323c66495da78a3995fd6e3879111
SHA122410d050d5bbeb0f788e5fa431438db5c415d0a
SHA256e4910def399a44346c378d754ed3db02dbf4d236ea15cd3b5a428329f5d11410
SHA512c737634837e3f1d327ab1e9ec526d7bd5061384c8cafd365ab27a00e36003139da89a11c97c52e3d0ab05d7e062db99372d9389e098e44bf8e91925b25b5880e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56aabaab2bc54725ac42d3045d310f955
SHA14b99365d402c11e7a1aa3b16519aa7126c30b016
SHA25624d982fa820599463dcb77f61a30491c8afb80ddf4d1c6060a36fc9d57553b2e
SHA512e872a5cffb80e9c036e34fbb84bbe22594e697cc5088b7dbac68ebe4e97e81f1ab8a7aa681f8472b500746ba8b1fea077e7b2e3ddc046db255d1602abbb170d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e95b7a5f7527ab0cc25362fa8dde4ba
SHA1a89f874d265fda5f5f27dedfcdffcdbd579053e6
SHA2562076722348453fb20371278506bb38d4ecf7a5af0dd2b1d2bcf8c925e3f0d297
SHA512086b8165e6cbe2d22ed47276384eafb6fcaaaedc1479a2ff3c2a9e83f2cb10061ec20ed9a300216458605fa634ddac8a91c375db05f29846f8aae023f5121448
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d12632276f5e73c1da5c1b718b176f52
SHA117287d158ddfe6d9d2294b729b68db834764e074
SHA2561b77ab5b31b8b601e95bbf32bb591646f1e18ec6e790748c96e31b9658417f3f
SHA5123dec4dec8429ded76178a536e6fd5f8c12b974694bd42a97674e0e55b2a3077c0d2a694d43030999d1555dbfdec88f9cf4b0fde59b942e97c05707ff9e81b93a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b14f501abe2ad30a3ab4dacc6ad60ffa
SHA1f93fa38379eb57b22b1979874151218bcdc6eec6
SHA256c0032aa521850fe4ffcb3c8e3ce992bb03104752a32c819091b50aa9924a30bb
SHA5121892c003ff11e254d933d91f986d2c6b6e6aa5fb90383cf19f45b0906e7656526ad90fb98119ed676ad4efdd1b5ebbca988641739752b566cefb3253e230b692
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f5fb06babac88edafd260282a3f1493c
SHA16b6c66645a90d0174df0bbcbbe3dccb4ceed5af2
SHA25695e5526e85aaee3acd322cb66f7e95098ecf42ad708e55b68843e50f93207afa
SHA512686d6c11c568fe945a4f074b12a49a44492be3ae6ac459364feafaeccc56c38ab84f7269098db1f5243d146a405a5caa9bf214df601f7f3a2513343a9fc4937b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a155d97b3d5a1e543e14d9c9cbf74e61
SHA18637d00092a83308163fa257d7854d0e0d33fc9c
SHA256e9e6d6a80afdc1dce9cafa3315777260b2e4256ccf19fe4591cc2f1a8a875823
SHA512cfd0b01043d2e395817837c4eaafcb752a07310d9c2af757861e4afc9e906022a4e1428bb04a93e91bfd3e1a5653911855a201da5d02cacd969fefae31af1d48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55015a2fec8a31c4a7ee868d1d05c82b7
SHA1ed21be85da1133725a6847e453991f998fbaa73c
SHA2563244711010f527bff691900110cd692ea0b4fb089c36878b5e5e601704d83fde
SHA512bdab819940af0d1ce128e318499c1685fcb0fadea7bb7bee0434e5ea493b8c4e5b81344014a31f84ab0924004a3a9cbb9030b0a58a275b4609f44eb80a6e970e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52cf93fd4415cff6db2fa797c41c0e1f8
SHA12ffae02d060c4a93a7fe4f42191998a360283505
SHA256ec96866c983736638624cdbbdc704a50be8870480d001d6b415c385eb21915f8
SHA51219860b9956aceaaf74d7e97c3c0e927505d090bf6ddd446a223dad325ec9ce2dfaa9fc499ab8416e6da155f020513f7363d89db367b632934d92c857e629672a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d44a801b16a8222ce5bde14d0ca85d05
SHA18cdc89c113f208c5b71c2d251893c6b1649d205f
SHA2564644ec188173d86ebcfbc1d72b60d1a740431cff8600be01f6e95fd5a5e6fec2
SHA51253528e323b75e23d70c729fda9fc38112fdef780f2414f77669f8ba08269b4d8fff4bdb60adc7b2cdc50442adde922777809fae663fcf6074d422b232f560532
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a05994b60b33bb97d3b0154234f999e8
SHA1f63f0941f46ace68bb7baa354874a2485282e2cb
SHA256ae2779a749ac31e5f5b3b62c935116c30f0056104d3abcb0d82e06990d443ee3
SHA512e9f387389c12efef4cb174321ebb6b7083b0771b6b47ea715aaf0106d735f812f938b41a297fdbc9c2bbe8741673d4f99d5f424c14e3f4f8aa6b134e78aee1cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5420b51f2e12ba29ae0633bc605b6279a
SHA19d04bbf6c96a5d9d486ff48f8f4c7e7aca68504d
SHA2564874b17a7888247d97428d9a18d126a371f7ab3ba0da678aa0ee796eca5fa410
SHA5125970c072f4ec553cd0ff015723c7565be2fac380fb59464800b13e76be062f4869809ffeb32cc38297b2f388b535235daa3dd138c10875365393c059de72d979
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5506ae07408f05740681313aa5d51e168
SHA159edd3bbb5ff9112fcb2c935a63b2358086deacf
SHA256058a6d082deff1fdd3a48a6dfcc35bea95da81b121473f7ce6d7a5c91194eaf4
SHA512cdf7389fbdfb79bd06891b12fa7b6fedb5073e10c85be3703d41935717bbd7816170f3be17731e089432b2e3c21b3ba3bdd55e07306ff517f4b8e038ae5e5afa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a044b54289db832b2f5d3650c6385b8d
SHA1c7884ec6c89cbe8f4b9acca71e18ca910d27daca
SHA256f24d9c9a4b776dc940e145718efcb0b1e11e4adbffe9b158a8cab42bd29a6f5d
SHA5120e455456a6de7fe9896f746e0d30502b0b4f34db4162af793ac9a30d947b30b27f489a09a2ce066f957d9549b8e2053c1384d405554d2cc1d13212494f0d4834
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD530bb51961abda647722dea88a938c060
SHA1c4e07611356a1bc76414257bcf88e131ff9891e0
SHA2563c675a6444f5bf53eba00d4bf922beb8d56a4a36da17d9c14bcf8b8beab7c911
SHA51243f2db9dabf1fd2a38de1d70739db0756b08626c8858582a464ef7cd84082c40406079a3e07176afaf757cc3d9da1e139529fc49b34d44b4b963906d86c639f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56731ae1bae1f08ce929144a7d9d67a26
SHA1b386c7d07a241f5565fc88da988afd57f8f7aea6
SHA25607cd5572a94919de9975ed2cb4b3ccdc120958b374cf20b73d6f08b880459a31
SHA512090d8bd40ebff2b5c56b3c25c7cf5bb2b2e95f6cf33e23cbb0895c1e4199fe7b4237323107b09a8810f0cb15723d0f388253ccfceb88e4acd4b47e1516913055
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53790cb13768c78b56c0ba10366ec9249
SHA10faec163b14069160edd6993c6f1874c05e8292a
SHA2563a9a06a45ac9256a99339aa50c77b960cd68a3179325e9f49748d3b51067d988
SHA5129be81ea933d33802f7b12ffec21463357300b039c996d232c5a26ac8d7725c5652f76f002e294f911aa7eb0909d8312d20f3da9b700bd355a5d3ff41a73c15ed
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DJB1KT77\swflash[1].cab
Filesize225KB
MD5b3e138191eeca0adcc05cb90bb4c76ff
SHA12d83b50b5992540e2150dfcaddd10f7c67633d2c
SHA256eea074db3f86fed73a36d9e6c734af8080a4d2364e817eecd5cb37cb9ec9dc0b
SHA51282b4c76201697d7d25f2e4f454aa0dd8d548cdfd3ebfa0dd91845536f74f470e57d66a73750c56409510d787ee2483839f799fef5d5a77972cd4435a157a21a4
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
218B
MD560c0b6143a14467a24e31e887954763f
SHA177644b4640740ac85fbb201dbc14e5dccdad33ed
SHA25697ac49c33b06efc45061441a392a55f04548ee47dc48aa8a916de8d13dabec58
SHA5127032669715c068de67d85d5d00f201ee84bb6edac895559b2a248509024d6ce07c0494835c8ee802dbdbe1bc0b1fb7f4a07417ef864c04ebfaa556663dfd7c7f
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
757KB
MD547f240e7f969bc507334f79b42b3b718
SHA18ec5c3294b3854a32636529d73a5f070d5bcf627
SHA256c8c8cff5dc0a3f205e59f0bbfe30b6ade490c10b9ecc7043f264ec67ef9b6a11
SHA51210999161970b874db326becd51d5917f17fece7021e27b2c2dfbee42cb4e992c4d5dbeac41093a345ad098c884f6937aa941ec76fb0c9587e9470405ecb67161
-
Filesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a