Malware Analysis Report

2025-08-10 12:16

Sample ID 240610-1we1rsshjl
Target 9c12a3fde88521c3465f88661593440f_JaffaCakes118
SHA256 220c33050c7451f14e9ab1de25aa8087109c40b4703fdad852e25c15e63a278d
Tags
upx
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

220c33050c7451f14e9ab1de25aa8087109c40b4703fdad852e25c15e63a278d

Threat Level: Shows suspicious behavior

The file 9c12a3fde88521c3465f88661593440f_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

upx

Checks computer location settings

UPX packed file

Drops file in Program Files directory

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-10 21:59

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-10 21:59

Reported

2024-06-10 22:02

Platform

win10v2004-20240426-en

Max time kernel

141s

Max time network

95s

Command Line

"C:\Users\Admin\AppData\Local\Temp\9c12a3fde88521c3465f88661593440f_JaffaCakes118.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\9c12a3fde88521c3465f88661593440f_JaffaCakes118.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\PROGRA~2\Zona\utils.jar C:\Users\Admin\AppData\Local\Temp\9c12a3fde88521c3465f88661593440f_JaffaCakes118.exe N/A
File created C:\PROGRA~2\Zona\License_ru.rtf C:\Users\Admin\AppData\Local\Temp\9c12a3fde88521c3465f88661593440f_JaffaCakes118.exe N/A
File created C:\PROGRA~2\Zona\License_uk.rtf C:\Users\Admin\AppData\Local\Temp\9c12a3fde88521c3465f88661593440f_JaffaCakes118.exe N/A
File created C:\PROGRA~2\Zona\License_en.rtf C:\Users\Admin\AppData\Local\Temp\9c12a3fde88521c3465f88661593440f_JaffaCakes118.exe N/A

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\9c12a3fde88521c3465f88661593440f_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\9c12a3fde88521c3465f88661593440f_JaffaCakes118.exe"

C:\Windows\SysWOW64\cscript.exe

cscript //NoLogo C:\Users\Admin\AppData\Local\Temp\hd.vbs

C:\Users\Admin\AppData\Local\Temp\9c12a3fde88521c3465f88661593440f_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\9c12a3fde88521c3465f88661593440f_JaffaCakes118.exe" /asService /logPath "C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log"

Network

Country Destination Domain Proto
US 8.8.8.8:53 stat.miniload.org udp
US 8.8.8.8:53 i0.x8.net udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
RU 178.218.223.40:80 i0.x8.net tcp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 dl4.getz.tv udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 stat.miniload.org udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 dl4.getz.tv udp
US 8.8.8.8:53 stat.miniload.org udp
US 8.8.8.8:53 dl4.getz.tv udp
RU 178.218.223.40:80 i0.x8.net tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 dl4.getz.tv udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 dl4.getz.tv udp
RU 178.218.223.40:80 i0.x8.net tcp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp

Files

memory/4524-0-0x00000000001C0000-0x000000000025E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log

MD5 65de8e5ee7c2a0a84688062e311c8360
SHA1 6fe1dcb0130949bd4925647eb2a7cdd818b6ab01
SHA256 722c1deec0b94f454d5c68c77efa406942c1596ff8e2ac118c68ed6f93606f30
SHA512 f0942c177b5e8338628814c58139255e78d0341bb12007ec1692f8599ea5dfde5104d0e4897708ed32c37849bf61e0a6136cb67d66b47e42ef76572dcfb79bab

C:\Users\Admin\AppData\Local\Temp\hd.vbs

MD5 d8682d715a652f994dca50509fd09669
SHA1 bb03cf242964028b5d9183812ed8b04de9d55c6e
SHA256 4bd3521fb2b5c48fe318a874bf64c6b1f62f5212b8c88790006cafaf31d207ba
SHA512 eaa39d87002df1eea16b215c9f099731253b7af72e46b12f64423874dbcdd8f68a164d7641bafb3f854aa6ad8aa7269da59ed0b32cd41eccba5d6f296f9a52ca

C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log

MD5 0b08ac785ce9c8d4ed923a75a9a9487d
SHA1 e91282210eefc5c457c4a32412d0a6dc8e7fd55c
SHA256 4ffde06e7f717daf99d71ce049caf4074bb384579f47cf1ff7e4b25cb9af185f
SHA512 b8ae746eeb5f45f255a9065f1fd251a7d2b74d96f40b0244a1807163ce475d5516e36a6cad8f8ffdc9a0fa3d3a2bbcf22aca85e2cb8de85cb50878c59f740ddf

C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log

MD5 f582b4f9503e14dde5d33c3e3b991ed6
SHA1 332398f37bb987b7d83cecf85a244cf65fc2f346
SHA256 2eb1c05e9c7dac90b8d8ac7f76978d7cb41ac2c8b1309f076318f441c9d75ac1
SHA512 9ae147b36bcddf86749d42afa7623cbe820885d3adb9fd0b9b9bcf19d2ed91fd90aec269531c851633c235e9a34ff58645aa3bd3bc5ce1f81cdf2b96d05ac5ea

C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log

MD5 3730a9ee358efe11c83da58cf2691982
SHA1 9c7a9f4bcbfd173f55ee6e847e6236a34ad3b5c3
SHA256 e3f9d6ea2b2bbf5a671d0b9d50575e404d1ce593ddde5c5a0649f8bd06739937
SHA512 28fbb76f807fc4550421445cdc8a3d06b6c83972c998253689c53d9c40a50324b643406a5784028cb41180aa0e4acf265df2a735d21420aafc6065a10ab28e72

C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log

MD5 40580f1cc06093cba1d70af3b7d4ad10
SHA1 8c7302de6d449747072d06d5af735c43af12ae4e
SHA256 e186ea1234781e5cb3bc4e0b9d36d8cc6b1e25271ba83575c59ce0607b46deb5
SHA512 30f0366388c681f2a8363596f4a81a0a4e6591744d10902605a4938a1dece830a76b746e2624d53a7417a6c726ce380ea821b294b6802e49d42d286dc8e693ff

memory/4524-95-0x00000000001C0000-0x000000000025E000-memory.dmp

memory/1996-103-0x00000000001C0000-0x000000000025E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log

MD5 e51a408f6fb802b3e668a372abf52a74
SHA1 9420cfdf6019085fc6bdc1d964ff1ea100592653
SHA256 0402a59247a7125303e361e8772c7f56a12fd257a666a2801ff8df2795c2ff51
SHA512 0f57890eebcd3f10c725e6c134b4e104410502eca9e2575a3577314b182821993559787e78888b29d0bfedc8d3ecef0aa371c4206ee0e9c2c8102c9fdf1e3bed

C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log

MD5 ffc571f9381662f33cc77608cb8b700b
SHA1 4a49eaec067c2a81a56761b98225363867095796
SHA256 b103e6f72733af1461a7422eb5448e7947e04c5b63153539ccdcc4164a0ffea1
SHA512 fc8be3aab1879d2bff55685a30891d2280ff0229647c992e47e5dbd22a1b9a07997862b17e95c854c0fd6bd8af7ffc60b1b5a8681bcd2f8f8295b52eecee9ff0

C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log

MD5 6182bc489b381dea34f9a2e38f1a629f
SHA1 019fb9fe1d0e835a87331ef37856481c38b06772
SHA256 6718a239684f041d1ab7159ae466bfd9fec271d7b9a6070bfa0008e814216405
SHA512 4ba990b4e5a394d4304ec8cfd64bd71bc45342353efad8a581547d75f09ab3fc356b32f7f71584f6e1ed813101329fd85e45c3f5b299c18f1f6ef44c352c3d97

C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log

MD5 c995925252382873d47806ea07f9bd7c
SHA1 730cc812475cd719007d7eb3868685b0734857cf
SHA256 ef67a7b64b39e703b9cecc9a261914e7ade8b7fb0cacff54555bb350f9100e1b
SHA512 39143c8bc7ad8ed5692f051da682d3f87d86a7452f9d285f36475e5b4291ab9a2b3413061c417fd36329328d7e7e682cbbdbc729ca220df43d8f361375993c15

C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log

MD5 7941c09c6e41a0caccc3be708f05c07f
SHA1 568933b3d80a2874a4d084fe67dac5fdf72b28c4
SHA256 94f27ec2d4f1406f43b53c7d04283352766118ac840adb219a796d8dc18361d0
SHA512 ef18d1e1dafcfd070fbf60517740eac9b556abc8df853b7d6214c29086346385613406858e8b6f1713907a29ee3c4c708bbae02ab4508ed6097c302799c8f42b

C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log

MD5 584c5ab3fae04545d1f93ede0c21e9d6
SHA1 11e3d65b9d22f2e92af0e89eab315ca2b1a47caa
SHA256 1b45e2b070791a308774f581726367b78dde1aa494d9a4899f8be0c64cf70fc3
SHA512 a347e4a188fdfc27f0160bd77b755a2984eca259404e41257093e781eb18b29adc456a504426e6f7776c0397b708b482cb335a3fa27562ce420ed18e9b8264c7

C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log

MD5 93d12c0695f6c06d9eea3379f98bfca6
SHA1 6248a50cdce5d394a3be3491beff7743f394c62f
SHA256 647c8c91071cf1fc90c2312c1c31821936c8b76601a9fc348f66f2f16ef36ff6
SHA512 04ccdd646df6d9d29bede67ce4fa7930d31a1dadae3d61dcc90cd8766bfef8089795dd9ea8293d9aabaecc51f9aa817d285571ced8fb81dcd8bfc7aaf9fe0a7b

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-10 21:59

Reported

2024-06-10 22:02

Platform

win7-20240215-en

Max time kernel

141s

Max time network

117s

Command Line

"C:\Users\Admin\AppData\Local\Temp\9c12a3fde88521c3465f88661593440f_JaffaCakes118.exe"

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\PROGRA~2\Zona\utils.jar C:\Users\Admin\AppData\Local\Temp\9c12a3fde88521c3465f88661593440f_JaffaCakes118.exe N/A
File created C:\PROGRA~2\Zona\License_ru.rtf C:\Users\Admin\AppData\Local\Temp\9c12a3fde88521c3465f88661593440f_JaffaCakes118.exe N/A
File created C:\PROGRA~2\Zona\License_uk.rtf C:\Users\Admin\AppData\Local\Temp\9c12a3fde88521c3465f88661593440f_JaffaCakes118.exe N/A
File created C:\PROGRA~2\Zona\License_en.rtf C:\Users\Admin\AppData\Local\Temp\9c12a3fde88521c3465f88661593440f_JaffaCakes118.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2972 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\9c12a3fde88521c3465f88661593440f_JaffaCakes118.exe C:\Windows\SysWOW64\cscript.exe
PID 2972 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\9c12a3fde88521c3465f88661593440f_JaffaCakes118.exe C:\Windows\SysWOW64\cscript.exe
PID 2972 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\9c12a3fde88521c3465f88661593440f_JaffaCakes118.exe C:\Windows\SysWOW64\cscript.exe
PID 2972 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\9c12a3fde88521c3465f88661593440f_JaffaCakes118.exe C:\Windows\SysWOW64\cscript.exe
PID 2972 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\9c12a3fde88521c3465f88661593440f_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\9c12a3fde88521c3465f88661593440f_JaffaCakes118.exe
PID 2972 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\9c12a3fde88521c3465f88661593440f_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\9c12a3fde88521c3465f88661593440f_JaffaCakes118.exe
PID 2972 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\9c12a3fde88521c3465f88661593440f_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\9c12a3fde88521c3465f88661593440f_JaffaCakes118.exe
PID 2972 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\9c12a3fde88521c3465f88661593440f_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\9c12a3fde88521c3465f88661593440f_JaffaCakes118.exe
PID 2972 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\9c12a3fde88521c3465f88661593440f_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\9c12a3fde88521c3465f88661593440f_JaffaCakes118.exe
PID 2972 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\9c12a3fde88521c3465f88661593440f_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\9c12a3fde88521c3465f88661593440f_JaffaCakes118.exe
PID 2972 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\9c12a3fde88521c3465f88661593440f_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\9c12a3fde88521c3465f88661593440f_JaffaCakes118.exe

Processes

C:\Users\Admin\AppData\Local\Temp\9c12a3fde88521c3465f88661593440f_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\9c12a3fde88521c3465f88661593440f_JaffaCakes118.exe"

C:\Windows\SysWOW64\cscript.exe

cscript //NoLogo C:\Users\Admin\AppData\Local\Temp\hd.vbs

C:\Users\Admin\AppData\Local\Temp\9c12a3fde88521c3465f88661593440f_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\9c12a3fde88521c3465f88661593440f_JaffaCakes118.exe" /asService /logPath "C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log"

Network

Country Destination Domain Proto
US 8.8.8.8:53 stat.miniload.org udp
US 8.8.8.8:53 i0.x8.net udp
RU 178.218.223.40:80 i0.x8.net tcp
US 8.8.8.8:53 dl4.getz.tv udp
RU 178.218.223.40:80 i0.x8.net tcp
RU 178.218.223.40:80 i0.x8.net tcp

Files

memory/2972-0-0x0000000000190000-0x000000000022E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\hd.vbs

MD5 d8682d715a652f994dca50509fd09669
SHA1 bb03cf242964028b5d9183812ed8b04de9d55c6e
SHA256 4bd3521fb2b5c48fe318a874bf64c6b1f62f5212b8c88790006cafaf31d207ba
SHA512 eaa39d87002df1eea16b215c9f099731253b7af72e46b12f64423874dbcdd8f68a164d7641bafb3f854aa6ad8aa7269da59ed0b32cd41eccba5d6f296f9a52ca

C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log

MD5 e396bdf205648ee7b5e06663a26391f7
SHA1 1f4e19837057402608dfc1c533012665a4b8ee90
SHA256 83c4dfa77c1de8e06ca3b633798bf0d61b9be0a166c792393ecb7d8787df02e8
SHA512 178fb013fc1117be9943a830e6a6a0f4c3bd4fca0aa4c34ad7aa868e3fc58019d91b0ebe805b2d40128f47b6f52ebd06d1756536b01d3f6cf8f14eb78740513c

memory/2972-43-0x0000000003230000-0x00000000032CE000-memory.dmp

memory/2044-44-0x0000000000190000-0x000000000022E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log

MD5 0c84f33a4c6269998ad933074b021d0b
SHA1 bfd66111e44244391c55b913de65fd6463bc45f2
SHA256 ed69fe03280be8386926219e9788709aeb11bf0c18ba1ec49dd1997fc316825c
SHA512 a024db27dfc43b89765c6b224d1ef402e431f800960fd94c2a40fbb66a851bc6da71eb3b70991d8c132f2c754d833cef0e2d81a1fe9b9b532e0c4b6696d0771e

C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log

MD5 8345951784c9b5a9ec71737128d079d2
SHA1 7235d5a01b9b7f685aec5363cea8fbcb3b476bff
SHA256 01f75babbdb351f33f0283e59806a03b42d8ec483d3169fba6ab989955cdd9e3
SHA512 b07ea320750864903b93e4209a35c8d26778c6b7d136d0b76cceb6f10866b1b19b3520ca0223d47e4e80e0a6d1e8b5982c9acf86e2d4638eaa801de2991ccd10

C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log

MD5 8fa48229214fda915d7b594ca0305abc
SHA1 4e0b3d66f32ffa1aab1e9ed9b721d4941adfab42
SHA256 3afb45418381f0fc36a5596f3a8d600608a8b2820f6d4661a115f975ff6ab9dd
SHA512 27a4910c86f04ff6da6bf3914c6857388e5c156dca0fcba9d30d924c3330e916db923dc3200a74fc34b24ba3e22e91f057ba9b65ad9a848bf7f880ecd482eb25

C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log

MD5 f5b957e861d20c59194223c3d66a5e03
SHA1 81e989360b9338f10b78dd54882cf28831765e8f
SHA256 fc5d86a54d84b2ccd19c8c41ecf37e9f09f1e2e997a55b778da52f22249a5ba5
SHA512 091850d068928769bcf37c8f1606ef8147013b836df6e19651a67a4d9856f5fdaee35e8c2d84be835ad977de8523c26b4ff7ea47ee6c771909a8ac9792abe9ef

memory/2972-99-0x0000000000190000-0x000000000022E000-memory.dmp

memory/2044-100-0x0000000000190000-0x000000000022E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log

MD5 be79551638e20bfe25a6748dccc4ecfa
SHA1 7328c14c0476430d5e6111a9683e55bb52bb59d3
SHA256 e9e82eadc1c50632cd60eb3877f609102c09565e46b5fcbf4d893c55862c4106
SHA512 34e0b0f560d8d0a3226a7f9887579a2af83b59d4129c4482ff41b45f03af79eda44a259772e2c30b2886f7eae0654145dc153f0070dc0bededa28b24cf78e5e4

C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log

MD5 453ccdaf122b21fb04452c5d507b1ff2
SHA1 c98fab8b5d1cdbf7475f19401fb2f2066157e261
SHA256 023f0d93cb44fa74947e551cc8ce4fa9b8cfd95ad1a089968cc7d84a939d247f
SHA512 ba2d55106eaa63f1acdb9ccba138220584f23e4b7ac4ea4409e356a129c7e5d68069b7460ec1e20bf10c4de3e173f5628bd9f82e02687b6bf19bb51910bb079e

C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log

MD5 f6ae608f45fbd6c4f9d6602562a0e66d
SHA1 979bacbb4f3cc72027d9bd06c85c0690684d9c4e
SHA256 28cb502f56079e8da9c52abf25b89e33ca6a23cd47825eb4b40aa8bef3b4bf9f
SHA512 556f2c98cf9c0879408292cf507035a5e82b4c6f62b873b5e547147a1119547c4987cddfdccacdf10fd12bf929c0a799f89f8652c7d83551b71ca123322bf89b

C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log

MD5 35889efad8841c379470235a9d7ea4a1
SHA1 5afd7eb228c86fc68c48ed0447731872711fa063
SHA256 096f2bb13348c894af110019f5cf1204a90982beafcd9589ec28bf23c5faabca
SHA512 bddbd0a35e7a0d1509754ba07d1be99511529ba9a3bfac9d29ca010c2402a8374accba6c6f9933851f586bf1bcf9a404d5f779282a124480c6593e5ae9b84350

C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log

MD5 082f9361207f5fd39c983333018cf62c
SHA1 7e47d58d8220e34bd11b9c02cbb7491236146ce1
SHA256 773e812e4205dd89ecf7270644e96b8dea13330e11ba59c3741db0021333cf0b
SHA512 1c34167b14510cad20d8a1f05606f8e507d4f1dedeab1e51788e4ab824cd57ad6693a97881abc188460657e5b9bf88a7c1e37dae4725f36c4922c22d8a9a4d58

C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log

MD5 1438c73bc5f54c10137408c3fe2e5be1
SHA1 0af8dfe412fac6c3a60dcc2876e1f3c74a381249
SHA256 f1fde43dd237c15436e48bf24c5038e1e75f697ac5456a43a073abd66e16a9c3
SHA512 bd660ce594a22e9dd794ef1280b8c58efd5e4337f647d93c3e5fb885bdeaff7577789633e0d90dab59bbafa7e8e0856e302fac8765538987850ea060d34df4f0

C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log

MD5 b3d21809dc4ac303587ff5cdec1679ac
SHA1 a5308dcaa2ee12141f8220eb8e0751726671550a
SHA256 d816af4cdbcb2e2457d59563bb6abcd6c6d5d3b4a4fbf1825891a8fa5900abc1
SHA512 16d69fdbed6b4672383cbaabe3f45ca8e9d8739e5e9afbbd524c2de93bfa8cc14f25afce49a00dc617829eeef5f474380c0d0dae340df98f3d33c686a4bc000f

C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log

MD5 6120b119eca1867af8aed9010fbea3d2
SHA1 ee5cf4b21fe5214f136e172ead6019b8c1fe009a
SHA256 e9e2bb05f1d62ca1970108c286b39105d6bfdb2d2434f544991a828ebc516301
SHA512 e6b91be9354804df2178e46cbcb6c185878c2162a7634a463809bf11f8a9a4e733952648aac875896bc9f4b52a989df2b47155202b38dd23433ac9a32be7cd40

C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log

MD5 2e11a10d8ec98bbdbed48c6dcc6e538c
SHA1 977c3a6c5bcf616f744377cbe1f4a424ec9bf5d3
SHA256 4eaae5a494a16d8c5993c72ed47650af50e71c497b4c29022e51bffd6d4f07a7
SHA512 94fbaf265895cee9f5d97606f598bd8773090766cbd433dcba04ab04b0061a484f45bd9827a11b9fb03d57268b1343d5bc56c5aa2893bac78017113171ea9daa

C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log

MD5 0eb37675dacfef6537e805a41a028880
SHA1 9c78030fe0c0443033a26e5a9eeb78cd0314ff04
SHA256 f9c8c37c07bb3fc5a80a506898460a7a857fc2e3965da4f849d070ebc0b7c0ce
SHA512 4cbc8b95b35d1a02a88d2054b9883a7a2675bb367790095ac5c45e5b03907f5c8c98e749e67b300446a469637838d0efbb9180349b12839452c59116f98f186d