Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30/09/2024, 21:31
Static task
static1
Behavioral task
behavioral1
Sample
0353871daee0ec99643055837b8d48fe_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
0353871daee0ec99643055837b8d48fe_JaffaCakes118.dll
-
Size
204KB
-
MD5
0353871daee0ec99643055837b8d48fe
-
SHA1
592925ded3a302c833628055fba0b9265a5c693e
-
SHA256
d492b2e481db1161344dc61215ba9078d041caf2e36d6b130d4decfcacd984de
-
SHA512
af541a0a6825ab42993fd0d3eb7ce7cc9f14ff055569802a2c894c4c34378562ecd4f6d11f6346ee4d2ea05e2caa49419a3101cdb4abad47fb067bb8aefeed0c
-
SSDEEP
3072:5EHoq7ox0HVMaJzvskxu2QnDqnZAn7jniSmj33iML0vPfBOj2hE0ScLXUh0nCpr4:iDDpxanDqZAn7KHFYvBOihEeLX/nJ/r
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe -
Modifies Internet Explorer Protected Mode 1 TTPs 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" notepad.exe -
Modifies Internet Explorer Protected Mode Banner 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" notepad.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main notepad.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433893730" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc5000000000020000000000106600000001000020000000779d8b63ed83874479915baff3811523ea0602afe2334c35ab9805e5a84dede8000000000e8000000002000020000000ffeadbb7bc2a3070f64321aaf8a084e7679fd9a2205fd60777cb35381f133978900000006f3cf0c064c89cc13b206379b2098aa7205d603de34bcd35fe50c57ae855a1aa3decbbf190814e2867dfa8077eac2cdcff1cfed9951e63d1fd8c17554168d0c3fa12a37dd129d45911bbbec5f7929e840fe811cfbc583f1a06932c152ed45d67786047088d8b4a7324338329b881f30e0874ae707a6afc08c50ec0f63496eabd98884a4843380ad43fa9193d6b076e2340000000481ca7de089339ce655ff34a02ca757479f948301971048a4f6251e4b040cf770730c3966c385f4763d6affd560ad362fcf02fca6abb290740af4b7b9b0542e8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40ed0e3a8013db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main rundll32.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4ADBEBA1-7F73-11EF-A087-5EE01BAFE073} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc50000000000200000000001066000000010000200000003b4442ba737e136e825264eadb58b56304172c84b3fe4b307328ba303625aca5000000000e800000000200002000000070f08ff2060bfa7bdd1b2fd3102a5a4f0293629551abd50c5e76ffc8ee5e9239200000007b4351b4bb3934fb8d092f5b2f6364eaed5a83b322830c8c5c6d060c497277b2400000004e4c5ad148cb858c5de89ea1ea3297e61952afdb9db7d020262315a804672d51da5f78d25ff80e3489a40493ed2abd765390e8d236dde1bd5bc4db95c2b8a2bf iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main notepad.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2520 rundll32.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2636 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2520 rundll32.exe 2520 rundll32.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe 2240 notepad.exe -
Suspicious use of FindShellTrayWindow 12 IoCs
pid Process 2768 iexplore.exe 2768 iexplore.exe 2768 iexplore.exe 2768 iexplore.exe 2768 iexplore.exe 2768 iexplore.exe 2768 iexplore.exe 2768 iexplore.exe 2768 iexplore.exe 2768 iexplore.exe 2476 ctfmon.exe 2476 ctfmon.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2768 iexplore.exe 2768 iexplore.exe 1776 IEXPLORE.EXE 1776 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 3064 wrote to memory of 2520 3064 rundll32.exe 30 PID 3064 wrote to memory of 2520 3064 rundll32.exe 30 PID 3064 wrote to memory of 2520 3064 rundll32.exe 30 PID 3064 wrote to memory of 2520 3064 rundll32.exe 30 PID 3064 wrote to memory of 2520 3064 rundll32.exe 30 PID 3064 wrote to memory of 2520 3064 rundll32.exe 30 PID 3064 wrote to memory of 2520 3064 rundll32.exe 30 PID 2520 wrote to memory of 1956 2520 rundll32.exe 31 PID 2520 wrote to memory of 1956 2520 rundll32.exe 31 PID 2520 wrote to memory of 1956 2520 rundll32.exe 31 PID 2520 wrote to memory of 1956 2520 rundll32.exe 31 PID 2520 wrote to memory of 2240 2520 rundll32.exe 32 PID 2520 wrote to memory of 2240 2520 rundll32.exe 32 PID 2520 wrote to memory of 2240 2520 rundll32.exe 32 PID 2520 wrote to memory of 2240 2520 rundll32.exe 32 PID 1952 wrote to memory of 2476 1952 explorer.exe 34 PID 1952 wrote to memory of 2476 1952 explorer.exe 34 PID 1952 wrote to memory of 2476 1952 explorer.exe 34 PID 2520 wrote to memory of 2240 2520 rundll32.exe 32 PID 2768 wrote to memory of 1776 2768 iexplore.exe 36 PID 2768 wrote to memory of 1776 2768 iexplore.exe 36 PID 2768 wrote to memory of 1776 2768 iexplore.exe 36 PID 2768 wrote to memory of 1776 2768 iexplore.exe 36 PID 2520 wrote to memory of 2636 2520 rundll32.exe 37 PID 2520 wrote to memory of 2636 2520 rundll32.exe 37 PID 2520 wrote to memory of 2636 2520 rundll32.exe 37 PID 2520 wrote to memory of 2636 2520 rundll32.exe 37 PID 2520 wrote to memory of 2636 2520 rundll32.exe 37 PID 2520 wrote to memory of 2768 2520 rundll32.exe 35
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0353871daee0ec99643055837b8d48fe_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0353871daee0ec99643055837b8d48fe_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- System Location Discovery: System Language Discovery
PID:1956
-
-
C:\Windows\SysWOW64\notepad.exenotepad.exe3⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
PID:2240
-
-
C:\Windows\SysWOW64\notepad.exenotepad.exe3⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
PID:2636
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\system32\ctfmon.exectfmon.exe2⤵
- Suspicious use of FindShellTrayWindow
PID:2476
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2768 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1776
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD548a7a9dfb1d347e9537340feebc62320
SHA1a03a8ecbd88171009a95797a197a102e7fcf4385
SHA2562d43733feab130f457b286399c7155cf09fd389f1b29338241f717e79e8f75f4
SHA5121f418e7b3650e967f79518c169bd5b42abb80d240b658655c37af04716af6c6b5e3d676b8bf30cb36729f40c4613b4701d342ff8e78e28a457bbf201d6efda38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51bfc7c5040691904ff293e5c739293aa
SHA1f73668dcd81e1016842212e8f10858b9caef74ab
SHA256e758ee02aba987226d90f49e039481b33322d51771c0806b2c77b744a778f4e2
SHA512cd6c892c6753ee2114c68f1b16929cc824235432bda46348af5413211ecfdf31ef7ad1ab76017011299c72bdb3cb4b3b00a7ce283db64f0e022decf9a49131ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD561c76e5e423646aa64248cbd1eb9163c
SHA159418a03fa2698b0e155c632c16942405d7390ed
SHA25696ed024cb7aaf103c54e0be04ce95ea0a4263e491bd512710ecda761b1b14035
SHA51207c3c22772679873ec92049a03ffade9a7778c9c58ad7545b175dac32e0482a0825bbee00f0550a000d6c51960e1b3d3dc89d5c87cf472b78fc7fea01808087a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52b006b4e530c35ddb6d97d23ea5b7b73
SHA1684581bac3d2a2f7bfe4e6060116e81ccb49d246
SHA256a1df6959b70274772723302a29633a2deaab9573422437a510a8a3031eb3fa2d
SHA512b34281d9a86493cb3a95abfa9385f38b319ef1d52073932f2cf3e4c2e37d8a44c68d0480954553d372f6e58631de8ce5fa65e4e81e7ab45dcc243ed93eb4a27c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD547c284585eaa66b22a1fb2cdc93df814
SHA16174e370de897be7cccddf00f9efe3b72602bbe8
SHA2567b5789a810261514cc2ba9ec1e9456522e59bf7eff9753243be953afa75932e7
SHA512a8ddd6368f4f25d9cf5b0f82b8711a5e34fd31d3f7722e7f8e4cf306fc593b19cf50df7dffba7d85580f4b2ebe4dc8be2fd9b28c25e36449b5d010ba46e56363
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b0f5c257681e5e3e7bf82f99b1875301
SHA1079f12446a723004ca7564a2a9f38cc46d9042ad
SHA256d7759113b954d0ab5b3b71e784e1887cbdb38a03284266c55125679a7f64376c
SHA51211945e61aaa4fe94d2052262d2d19e7a137c627f6409e5a64ab217fe84d1e3d1a6912a13cbe72b1d4464179dc4398ee72c5de2114287a871a9a31b97aff67b2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dd039a75b686ba4453f24db760c6623e
SHA1a478addab7bec43d3975a7656e83a0e84d066ea9
SHA2564b09a8e3d8976535b94d418fdd828e246e285d8aaa0a9a7c8547f73aea1fc818
SHA5129d82fca5c3ba2b03c73298d08cac99db471d6ad37b916d421d32946bbcb55e3c6781fd87c2d0f6aa2364014aae96bf0b44fe00d323d4ce862d16a684e27a48ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc9f5fa3febae031f863074d862813be
SHA138728a12e0d16c55dec9dd49059284cf4943930c
SHA256dc27b15507b70dc1f39d7d36cf774d6f6837d2df3068d96663c4c82fe634334f
SHA5125fe20753e5d14a8cc43f61b01c5012812b3776fafa74892b898f355c9ea3a226f4794d16f89b7d2fa6f30d5bf85100186254bff2a37241e4b76768758cf8d61d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ecb4e510a07f0260f253285d27e5384c
SHA1fbb5647f02cf60020bd81648b907e3b78c473d25
SHA256f00aefe272313b6c9f1f2e05c69468a2cff23c2289be89e7edcee725ef88ffd5
SHA512c26b22db233c15db4c5fe9ccfa7bcace74559f132d448a4dbd99cd6f061cfe160f5ad4f9a3a6284689f8a0d83532a06011268f06b7e857f10acf826d3795ebb2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f1d1b2e045e3b3fda203aaa69a76689a
SHA1f2c93e696daf93dd3c45d9cc0f82619d66b3c216
SHA256f9bf1facb6e7b6a8ada9ac544a34de4c08ac4f883a1cfac5beca8606d473aab9
SHA512a010a738b29118b58ccc0103ad5f32463bc6f38659806c44b37b9ad260191d8565a2fe7cd3fee3ecd5fef0733f9938b3d286126d1a874b321e718a0d8187f898
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bce9d91a9fae7b8aa122f53baba563eb
SHA1531dada29a30de47d66d464633855107235ac727
SHA256c4a8e65e594134782c2418108fbc35ac23c9075e3d4be8a5fa1d561683798953
SHA51294a941debcfaaea7a7a6645a1b9e934f5ba7ef2d4f83bc59f8e17f38d0297571c09891d7d28b48c64e281130fa771436409f1ddbe7e4d7a71a2ab11e55135449
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52dc080037020ca42b98e517e1bb4ed80
SHA1932e40dadc710344d4ce80a7ce8bd86573d3a648
SHA256c2fda58fcfabee1966a411b3a853e0af97e5c457698b0ce7a9b38693e8d0ac40
SHA5121fbaae6f6eb1db5213ca0caedbadf64c55ca68f6be34e9f7ad3e1d0dc5df391ea0329a886312eeaab2e9c7a58f3ce63ca79dba1fdc0e0cce08e7b9e3a742ccf3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ba0aee3abf3ca5320fcaa4526f4efc58
SHA13f6a61298eb765ae128e2376d8a25f3d9212ffce
SHA25639f95ca8efdea85c493a7c1801df31f690fa18c4be4e377f14eaf0345bad6f44
SHA512a0064770584c6268aa2cd23d84e135b5ab6c2ea9c6731331f620acd3a78bae54393be80257676fbe92c0baa2b0dcbbc315f5bd36dbc444d3a0412be9e05f3813
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c8549e356890c88f0639a5ca5c598e77
SHA1aa184b74f5adfa6c3ddc3316c3b4a201af9d099f
SHA256bcee13acb390470c329fb78e8fca0eb409bd070fbc225b4bdf55700140f9f1b2
SHA5121523102291f2e2a2c6c392e852ccdd0d7e96983947b81d08dbc0a2489be3d61f15d0ecd3457c0b6e5e5ad62da323a66ed9ca5b75ce1832001ffe798e34340b1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed56327982f0044a0fd3a496652dc37f
SHA138fe6f49b2742809c70bc3c9a6b1ccb17a3edb24
SHA25661f99b6a709ffb92d7547e62551b00a0ebdebe035559efd25e957ff8647310d3
SHA512f75f13531f6afc90458adeedc2742a6a03b14df51f9ef5d17a5bb83c90215b19ae83472aeff690e084139a228aa5eb135bae2db270b2a54bc44cb637a1711830
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5305903a702f6373b8de815c9f7da78a7
SHA15b635e134e82d105461fcb4c733b49969e1edcd2
SHA2561fbf0961578fa671f6eed5041abf621226bdd23d51fe0629a1f861cb97ae7c42
SHA512a5e8d9c31cdbb1a5b7d0c9b65d76d3b3f66f0f12cb40e9b443ac0f59ed06e631f3c6df3827d28c350e894ecc6f8a757097ebd6c7fe52c49d49281aec8604581c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5562dfa161d12401efa8416a4fde43805
SHA1d45e20295ab968183fd3bfcb17f5d50e961866a8
SHA256eb6161397bd49a535e21e6805a48fb06fcc75cf4b01f063990d856d78f9ef5e7
SHA512e8a8cb47b3cf5139a29cdcce17cb4f8cbc5ae578a3e3ee6eb524055f94a3c13a6ceab2c8756d1c36b91cb5f60899e32f2aad9d3b3c511ae14bac9d537003a920
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c3cd72f421a71b422c7c6d48fb131f60
SHA1d782bc8a501473f90e62deef327ed1c988ec0288
SHA2564ac0ac83a6180ef454c7107db0b48a292ecb4a91d43071abfc7de5cd1ecef028
SHA5122e8a29f9e6b57616c299158f388fcf5af6a151ad39e39caae4230d7fc441665efc7a2f6b00ca9b8ce19191c9fa241916f0d078a357f5d82108eb9f08b5d1e418
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54af2bc3a2165ab3232ebcd5850ecd338
SHA1efb435e7c1526e8b1cd93498c53ed2ace79dcd14
SHA25692ef1545899e958b6d41f5833bf457e44c2b3d7443db740a308a8cc7744506a1
SHA512a973d9711b07751a992858bcb149d60b1e23ff3c33da47d259410545abc32551d13e3337d8adadab877c2d8c6a62d3ccb629c6602de4257ba416cc78417edfe0
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b