Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
01/01/2025, 22:15
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_60f3dfcdc854e97447a325fe4beaa609.dll
Resource
win7-20240708-en
General
-
Target
JaffaCakes118_60f3dfcdc854e97447a325fe4beaa609.dll
-
Size
724KB
-
MD5
60f3dfcdc854e97447a325fe4beaa609
-
SHA1
249ac6f89790573097046e5b0fee55bb0db7005e
-
SHA256
2832da6320014e9d439375b17aebeb7188ce3c7f82960d50c13c38f33fdbd933
-
SHA512
4069d05022be30812b26b2ece76639e3d823ca1b0de648236088869552b13ce04527e87465c33b95c1c07c11b23bd6bba3f50c0b44d19160a6f53232888b96a7
-
SSDEEP
12288:SE7NiOLg18+1/hv5VEipyz7mTWWa8afR2ftuD1xbmiU7+diwR19kN9G:SE3+F5GipwuWWpj+BNkXG
Malware Config
Signatures
-
Ramnit family
-
Executes dropped EXE 1 IoCs
pid Process 2208 rundll32mgr.exe -
Loads dropped DLL 2 IoCs
pid Process 2216 rundll32.exe 2216 rundll32.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
resource yara_rule behavioral1/files/0x000900000001225f-5.dat upx behavioral1/memory/2216-7-0x0000000000300000-0x000000000038F000-memory.dmp upx behavioral1/memory/2208-18-0x0000000000400000-0x000000000048F000-memory.dmp upx behavioral1/memory/2208-20-0x0000000000400000-0x000000000048F000-memory.dmp upx behavioral1/memory/2208-16-0x0000000000400000-0x000000000048F000-memory.dmp upx behavioral1/memory/2208-14-0x0000000000400000-0x000000000048F000-memory.dmp upx behavioral1/memory/2208-22-0x0000000000400000-0x000000000048F000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 816 2216 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32mgr.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DD0B9351-C88D-11EF-AC2A-E6BAD4272658} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "441931578" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DD0BBA61-C88D-11EF-AC2A-E6BAD4272658} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2208 rundll32mgr.exe 2208 rundll32mgr.exe 2208 rundll32mgr.exe 2208 rundll32mgr.exe 2208 rundll32mgr.exe 2208 rundll32mgr.exe 2208 rundll32mgr.exe 2208 rundll32mgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2208 rundll32mgr.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2936 iexplore.exe 2068 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 2936 iexplore.exe 2936 iexplore.exe 2068 iexplore.exe 2068 iexplore.exe 2232 IEXPLORE.EXE 2232 IEXPLORE.EXE 2756 IEXPLORE.EXE 2756 IEXPLORE.EXE 2232 IEXPLORE.EXE 2232 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 2192 wrote to memory of 2216 2192 rundll32.exe 30 PID 2192 wrote to memory of 2216 2192 rundll32.exe 30 PID 2192 wrote to memory of 2216 2192 rundll32.exe 30 PID 2192 wrote to memory of 2216 2192 rundll32.exe 30 PID 2192 wrote to memory of 2216 2192 rundll32.exe 30 PID 2192 wrote to memory of 2216 2192 rundll32.exe 30 PID 2192 wrote to memory of 2216 2192 rundll32.exe 30 PID 2216 wrote to memory of 2208 2216 rundll32.exe 31 PID 2216 wrote to memory of 2208 2216 rundll32.exe 31 PID 2216 wrote to memory of 2208 2216 rundll32.exe 31 PID 2216 wrote to memory of 2208 2216 rundll32.exe 31 PID 2216 wrote to memory of 816 2216 rundll32.exe 32 PID 2216 wrote to memory of 816 2216 rundll32.exe 32 PID 2216 wrote to memory of 816 2216 rundll32.exe 32 PID 2216 wrote to memory of 816 2216 rundll32.exe 32 PID 2208 wrote to memory of 2936 2208 rundll32mgr.exe 33 PID 2208 wrote to memory of 2936 2208 rundll32mgr.exe 33 PID 2208 wrote to memory of 2936 2208 rundll32mgr.exe 33 PID 2208 wrote to memory of 2936 2208 rundll32mgr.exe 33 PID 2208 wrote to memory of 2068 2208 rundll32mgr.exe 34 PID 2208 wrote to memory of 2068 2208 rundll32mgr.exe 34 PID 2208 wrote to memory of 2068 2208 rundll32mgr.exe 34 PID 2208 wrote to memory of 2068 2208 rundll32mgr.exe 34 PID 2936 wrote to memory of 2756 2936 iexplore.exe 35 PID 2936 wrote to memory of 2756 2936 iexplore.exe 35 PID 2936 wrote to memory of 2756 2936 iexplore.exe 35 PID 2936 wrote to memory of 2756 2936 iexplore.exe 35 PID 2068 wrote to memory of 2232 2068 iexplore.exe 36 PID 2068 wrote to memory of 2232 2068 iexplore.exe 36 PID 2068 wrote to memory of 2232 2068 iexplore.exe 36 PID 2068 wrote to memory of 2232 2068 iexplore.exe 36
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_60f3dfcdc854e97447a325fe4beaa609.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_60f3dfcdc854e97447a325fe4beaa609.dll,#12⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2936 CREDAT:275457 /prefetch:25⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2756
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2068 CREDAT:275457 /prefetch:25⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2232
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 2203⤵
- Program crash
PID:816
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e780387831420ed79db9d0211eb1753
SHA16acc0901d80eb7d0b38121d5c323585d0be54b0d
SHA256d76bdc64f926746aa70bbd2144ea053eec2c099228ac6310b3e89cf80c6b069c
SHA5126e44f4c6a7803af2389ba3709cbfe237b9baee76cb706a43cb866ac59568227647239a33f246c7a03da23549caa75382b24466dae16abf1ff8d21c2a1db20930
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5065bfed7d041fb226d5dd94b11f5f59a
SHA19d74e45f15d04aa3af0858770945ba46b545e7b0
SHA256817baa72a65ca94e3f69c05851ba94570a4676fe610a97a14b292cd3324b3cea
SHA512165cff30e95cc66672a5f3b6d89c7f8408b66c233f13eacff8818f5e9aa9c18497fa19d250f075d45542116bc93478e1d1d93d75f1966a6a8e4fbee47e23f0c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aad5c78ff320f354f76ae779ff8a799c
SHA1bac7f76021226d6817e2c237778ece02dca7f0c2
SHA2565492dea0aca9eed650b085043a08c85c44917c10375dd0a0b3cebb5cd3245351
SHA5129b561c3f65a8016a10679f7b3e7c5b1e614a86abae2c17c04c031acf072e9d9054022b7fbe6f5b97a6dffb359ce01cfbc89ffdc4f2f02da75cb07f3595eecda8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD500ad2162c9edec050e0737355ccd9463
SHA1d9a52431c896cf277be2375a15cbc762bfa9d0c0
SHA25606703abf87cb521dd918a580e87f14830fd4812053050baef95fbae11196d9cc
SHA5122605f88ab71cad19fb97895710128fae79e15be6da06a9e964ae27c9a88459f343cdb89802f1ccec5655bb378364f006e4ff3c66626cf7ed229ae53bf0e25ebd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ffdee62355960238b23bb978f103d3f9
SHA1633247f19078a8186d272a85667f7ce805517052
SHA2564d1563161d0513d8af00565dd766c4456459dcb491e9da10f8c7f3844be7b70c
SHA512b3d221590d04d2bf2011174fdf58a45c5884fa50ef21a936f91dd129b0ee40e568799c69e627919c44817595602ec3d6d6d0b0c38e48b9281a29cea48deac2c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD551a233e0769679ace2e350d3fd98315b
SHA1cb8ff1b3acd25b9ad53ecabcbad8953fa75999db
SHA25624427bc0bb1be3340c271ee412ef92983b95626fd89d1b73bfc411ff88aff3ac
SHA51295c4a3f082ea37fae77e25143681dc71b23af8c7badafc908dcf7c8b3d8cd58c72d0c357e7c2f53cbb54c3b13526602eacf60f5b061086417c47edf9d13208ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c6b13ad61b635b2060fe267e4dbf2d28
SHA1f8abcbf11f5f7f3e58061f709beda3adbf7dc67a
SHA256ad806098fc1fd9e5ba06c0db8daca91d06f402e76f66d4474f126d3dd6e18c7f
SHA5122b7a8eafd5b4f28eba41ca350623abe695d562a96ff86b18169064e383a08c30e7c06b87c988b68b1f39c62389d7f437e90f025f154cc142af3114d10377ce78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58c230b3d7d314ea12fa2affa6346472f
SHA14f882bbcfe0b4b0426093c391810a43e1b01f8f5
SHA256ff18e88b5e00448a6644d766f3ce162cf7c4489a08d2e9b0df9295e28bbd2ad3
SHA5127aceb4f549990dd2f049f562b0d46a8acdb2d81964fcc51c535344402cfc6d084b31e7e3ab6ccf6ac9b560d0b29429bba6c9c50510e0e48aeaf71fd5ac87cbdc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58777986fb3cf6d382393b7b5ff9ab7a1
SHA144b3dedc22ec9e0b3454312a4cf5f64489a79edd
SHA256d12f131374d8791716c4ccc1b7ce53554ee264010b6e7767b3f8455999c5aa0c
SHA512e325af2d8b3ba03c39d2c44337b3376298d5c03b5f6be7ef810271914e17b6f940eee7e5affe849de5e0c828b9ddf36595387262d116784cda4d447d9025f904
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55fbde871477fcbd081244234d0208b8b
SHA18e08ccca06f210ab6f58496279be7684af838e8e
SHA25688acb89df8d8350169622c54f73f14626fde0dd3c15a2cd4cd40356f3c92ce2a
SHA512c11dcb0988d90ea02af9b0f308298f26273ed0a10a4f11839059e0571222d799a359c47620801a4987f4be180081a67cd0b74933bcebb5b795dad331c2fc81a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50cfadcdca4d19d2861b9d83dc8de16fb
SHA11631e7edcf2b82ef7d84fe5f3ec05b02799aac1e
SHA256eb1dc6706f86803530a241f1b88747930029a867a58f0c0e171f4e439ed882a3
SHA512d860045a223151b0a1675de1202d7bd1fbefe21b7390899b0798a81c8c250776a5b13665b5ae1c6e1a11273cbeea99dfa93cfda068637a8394a1f89bc4bcbc78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD521ea84504beac0a589d85c3849ef89f3
SHA131fee2a4c24194568a419e475ae565184fc1bd53
SHA256192761a1fcf32389cf033dafd3c81bbc59d6e3a4ac20721bf51576981bad66a2
SHA51209fd2263fc92fbf008b980fde71d3a035fcf8845bb2f468ee86ae37dce87064c2dda5dd0965967a1616ae0352c71a1e1edc99f41964441d26df05a7932b5058f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58623c8d6ba2b54344108868e818a7b60
SHA10f19541e54534519f4115438f1d207de608e26df
SHA256527de280548790d90d18fd485ecf5ca42ebcfbe491811a6f3e798715e706bd27
SHA5126e9fc9de0d1fa8c196104dae37e91ec8cf77ecbf22fd9b2948fac1c5e0e7ca3ec90fce8c2a5fcfc985d816a5b895722d4135057fb1891b895edd1e86f5c57c6e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5091ce3bcccce6271e06256d6f11f08ab
SHA1a4bf923d642cd5bc5402a230c00b00afd529b582
SHA256550fe6b27f6a38cdfabb3955fbbf4b9b26be41bc8c7bfa1df7c8643be5c210cb
SHA512549391603c2259f034d2392f4cad11370836f5c02a9a274fea71639f4c17d85a7db4882cfaa626668d849230098a12cfb4209a40ba0fa879e79d59c7dc5c1bb4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5af8a267ee3aa2367467689dc42233ed7
SHA15135b3b981baedf0220ae8cb64dd4fd875de1d46
SHA25651b628a7552db4f5e609b68a42745adab4070cb914d655637c71b8b9d7935f2c
SHA5128c9c71597efa68b65dbe75fc1ba266118ca19340542bb6e6596a6f2192a38057d0ad87f7a2d284293d05adedf898ef1259d2739d411910662fe684c6ab041f77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54ed2292661eb085ec219100aadae649e
SHA162d4a5cbc93f38e566da490665df2fc2e1b08d76
SHA256ecea91fd247afb7b1d041273891f6799f83a16d0574cdb9cfe16e5b7bd2d3fd1
SHA512107fbd4b00589bc82afd43844c56efc081215081eceee3d3ee527431ee7bc48de2d8be852abc3f4c7b8e22a377762e079bc885ca0eb9fe466850093292da505b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cbf19331c7cc461aab9f7a7bf71485be
SHA1a8556347b843f9e59448c58b83deeed4ec2d0866
SHA25664344a99297b007404e31974ab040b733100e8764488b4c6efe3860e8da6d629
SHA51203baed527461fc7dd7cd4a76263343d24190fc00240424db77dbb414a88f811201139d237943f8e37557209034d742a66f66ca585126b1278d329d56b69ecbf1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f4710ed6685f7d44f03ee9ba08585b6b
SHA1a50e72d4588cbf0e2a8b6ee09efb1adb090b5097
SHA256202e8009b7f143040113486e7e830fea56c332814264cf80d5cc98e5e335c06d
SHA512cdcf4904d601195786c7783a3f784732fc7b91a4b5c3565af52e9e03f4753df17ff0cf1bd30d8c559c09087ae00810352575700ec9b5173f236d4381e21cfa81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5878733a8e2ef9b9134b26aa8a8d63f28
SHA1a2d89d77fb828567fcdaefde452cf1148e733453
SHA25651d89541610218aeb3bc056dd96926cd8f56808303cbcc8130201f70c1d8b2b9
SHA512bfc6c48a68cb12e78a092e56fa25e64a224c4a78178b34f6255c23426542479db3e20ef126bdf47d58e4840278d862b5ddc63fbc8def102a20154c0b3815f072
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f55ac8e4991e9defd43ac57cffecb7e9
SHA172658928b7936d4e283c57415c5f30e1f53da0cf
SHA2565e52a836444706753e86749b15ad49fc0547d7ec74aced8ca8669e4844825bad
SHA512337153946b90b12988dc1e8c6c340522e3923428578f41e5ab3b381c466b73a5ac4cceb9a80c81575f667a52ba77821ffbef87764c434d2eff82b747959ed268
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{DD0BBA61-C88D-11EF-AC2A-E6BAD4272658}.dat
Filesize3KB
MD5c3144b13039f3fad9a3b5f47807e00db
SHA10ffd563addbdfcbabe64ce87886adf5c4719c695
SHA256191500172ff494ddf74800061a844f347eeb245fe24ca51a11cf3d1e9ece84ce
SHA512b2409e981756035d819ae13922207573ae1f5c4632f373dd28556acf327565f58e9a60866bb9791e4a75f59f9dff2ea017e2a18cebaa87770f81bccaee6223fe
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
137KB
MD5b82a555fd9de0d736a97cd10a7e100e1
SHA148e4c1531efdc1ad03d00305c374c79bfebe2c23
SHA256e9a820755860e1c036b769a45dd9302984bcd759de69bcdbdd25515ddad867e8
SHA5125cf8df4c6bfc2008cdc3a53887945ac23fd3fba348b6dc1ca44f421cfcdf1fafa83d0519a4c6fa37280f2eb3680fe982c2e918ae0abaec434f498d9656e28a63