Analysis
-
max time kernel
96s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/10/2024, 01:09
Static task
static1
Behavioral task
behavioral1
Sample
15962bfa885184b6a7383ff02d3df2ab_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
15962bfa885184b6a7383ff02d3df2ab_JaffaCakes118.exe
-
Size
92KB
-
MD5
15962bfa885184b6a7383ff02d3df2ab
-
SHA1
518131dbcc12b1672e91f0dd19da6f356f5aacc8
-
SHA256
da5e9696540af7b799eb517d6652700b1a22372b03bd0292cd3652176ac0aa05
-
SHA512
aa039b88d8752dc313536a52ecf6f100d68fdf880060df7368a039af453b95cf69c5c2c9bd3fcce574c62ded84db51aed8abd4cd0335025da55186da2680acff
-
SSDEEP
1536:GVZnxm6MG9xgfrvEaoiT/GyphjXDYjKwttoswRmhApE:2nxwgxgfR/DVG7wBpE
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 976 WaterMark.exe -
resource yara_rule behavioral2/memory/3564-9-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3564-12-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/976-27-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3564-11-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3564-7-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3564-4-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3564-5-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3564-3-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/976-34-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/976-37-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\px9FDA.tmp 15962bfa885184b6a7383ff02d3df2ab_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\WaterMark.exe 15962bfa885184b6a7383ff02d3df2ab_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe 15962bfa885184b6a7383ff02d3df2ab_JaffaCakes118.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 644 5056 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15962bfa885184b6a7383ff02d3df2ab_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WaterMark.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{939F079A-82B6-11EF-BFD9-C61537EC8B44} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31135427" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31135427" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31135427" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{93A168CE-82B6-11EF-BFD9-C61537EC8B44} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1746016906" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1746016906" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1748048388" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1746485732" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31135427" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31135427" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31135427" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31135427" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31135427" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1748048388" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1747892379" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1746485732" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1747892379" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434855589" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 976 WaterMark.exe 976 WaterMark.exe 976 WaterMark.exe 976 WaterMark.exe 976 WaterMark.exe 976 WaterMark.exe 976 WaterMark.exe 976 WaterMark.exe 976 WaterMark.exe 976 WaterMark.exe 976 WaterMark.exe 976 WaterMark.exe 976 WaterMark.exe 976 WaterMark.exe 976 WaterMark.exe 976 WaterMark.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 976 WaterMark.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4196 iexplore.exe 880 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 4196 iexplore.exe 4196 iexplore.exe 880 iexplore.exe 880 iexplore.exe 4104 IEXPLORE.EXE 4104 IEXPLORE.EXE 3272 IEXPLORE.EXE 3272 IEXPLORE.EXE 4104 IEXPLORE.EXE 4104 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 3564 15962bfa885184b6a7383ff02d3df2ab_JaffaCakes118.exe 976 WaterMark.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 3564 wrote to memory of 976 3564 15962bfa885184b6a7383ff02d3df2ab_JaffaCakes118.exe 82 PID 3564 wrote to memory of 976 3564 15962bfa885184b6a7383ff02d3df2ab_JaffaCakes118.exe 82 PID 3564 wrote to memory of 976 3564 15962bfa885184b6a7383ff02d3df2ab_JaffaCakes118.exe 82 PID 976 wrote to memory of 5056 976 WaterMark.exe 83 PID 976 wrote to memory of 5056 976 WaterMark.exe 83 PID 976 wrote to memory of 5056 976 WaterMark.exe 83 PID 976 wrote to memory of 5056 976 WaterMark.exe 83 PID 976 wrote to memory of 5056 976 WaterMark.exe 83 PID 976 wrote to memory of 5056 976 WaterMark.exe 83 PID 976 wrote to memory of 5056 976 WaterMark.exe 83 PID 976 wrote to memory of 5056 976 WaterMark.exe 83 PID 976 wrote to memory of 5056 976 WaterMark.exe 83 PID 976 wrote to memory of 4196 976 WaterMark.exe 87 PID 976 wrote to memory of 4196 976 WaterMark.exe 87 PID 976 wrote to memory of 880 976 WaterMark.exe 88 PID 976 wrote to memory of 880 976 WaterMark.exe 88 PID 4196 wrote to memory of 4104 4196 iexplore.exe 90 PID 4196 wrote to memory of 4104 4196 iexplore.exe 90 PID 4196 wrote to memory of 4104 4196 iexplore.exe 90 PID 880 wrote to memory of 3272 880 iexplore.exe 89 PID 880 wrote to memory of 3272 880 iexplore.exe 89 PID 880 wrote to memory of 3272 880 iexplore.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\15962bfa885184b6a7383ff02d3df2ab_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\15962bfa885184b6a7383ff02d3df2ab_JaffaCakes118.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:5056
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 2044⤵
- Program crash
PID:644
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4196 CREDAT:17410 /prefetch:24⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4104
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:880 CREDAT:17410 /prefetch:24⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3272
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5056 -ip 50561⤵PID:3832
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD515962bfa885184b6a7383ff02d3df2ab
SHA1518131dbcc12b1672e91f0dd19da6f356f5aacc8
SHA256da5e9696540af7b799eb517d6652700b1a22372b03bd0292cd3652176ac0aa05
SHA512aa039b88d8752dc313536a52ecf6f100d68fdf880060df7368a039af453b95cf69c5c2c9bd3fcce574c62ded84db51aed8abd4cd0335025da55186da2680acff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5db7c83e09ebc4317f2bf2df7f66b8513
SHA129d58ef43f72ce7cf79ce6109d038a6c9b4873f0
SHA2561ae4c8aa37bf433bc5b3b45e017c95bf843c7dbbe348c78c7ab6f3cad0fda4b8
SHA5126eb46ae0c3e091ba13b1c0e3fb6de568882940df7968d0e1297568ea5356a4691f2a869c7c9ac9e9642bcc2e4e1388d00b15c663276143e8cb5015ab89c27867
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5ae22ed425c46c39d5d49055c5f04b4a4
SHA1a7a9247f1d286f7df82fec12b4e9de4ef5ca1f8f
SHA256091dfcd727bba1ea08d89e54bea281df79ca3c46b84af74da595c4012cc79f1e
SHA512a7ba18813d90016a29a14e919959ce85373c06ee022ddfd9f3f179a93440473ba31369220f5af3056660c06074a598f43168f51977752b6d5d6409ba0798a4a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD533a9699619a55c8e33549a368e7aa96e
SHA1d53b0887318b3dc6da4e993e0081c1089080eb85
SHA256c3a045322e358bb56479a73476b2242bc3cc31899a1ccad6cb1af517855adde9
SHA512c01f75cc2834e16dc344371e2125273ab18fce4e16fa621c30e99f4351938d2ce880fed4f6578b3400c933a6fe96d0c5fb8d3180d76eb06580d543521c8df426
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{939F079A-82B6-11EF-BFD9-C61537EC8B44}.dat
Filesize5KB
MD531b502f231a2efbe961362c4f7203b8d
SHA1a4b83570bcf0454844803b6443c3b95b39441ee7
SHA25690f85588bb6ef29f1544ba6df363dfbf807f5837c1c7bf6f70dda6c40c945bc4
SHA5128328426a369962b797a219c6e05a0aed0e17c9f122ee540b956395d54a02ae93967d6e7fcaf11cf78c43a8ae606715a46bb0979844742b1a7ed000ebade59d25
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{93A168CE-82B6-11EF-BFD9-C61537EC8B44}.dat
Filesize3KB
MD56957cfc4e1e20145b28cc1eb608bf35d
SHA103001debfac91f1cd9674656c6c318e6127884b9
SHA25630300abd1b74890d58df4a2e99993f937c55441baf286e25afafaef387e6abb9
SHA512c7f30b4e8467623b0ba5e6bae7f2fd99900fabb7bdaa97ca580c950ccd12d288c2096eb4114428a3526e681702051ac3a549fa1d48abddd97210dd7f621fcc71
-
Filesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee