38130c93482996bc6b4828242f63ec0ffb63209409cf92fc9d851f14ee18366c

Analysis

max time kernel
79s
max time network
145s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 18:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$8/ClownfishVoiceChanger.exe
Size

805KB
MD5

208c37506cddf0613517488da3287d12
SHA1

99b918443e424af947ed10aa84fa242af70ca856
SHA256

d29a8c5ad1704c7fbe0e24fadf4a8a1dabe441c84f9dfe4359755cc76c148a61
SHA512

0318dd9ecf5d41504f60fc0f71ac306cafbfb75808c7597a2ab3b745a487d042371fe5c159e42f0a431a29820e4e164e43e78673eb12124b9304adebdf5e2f65
SSDEEP

12288:ddCn17D4nHmjxRL7xU2ZlHIue0FZFVo0iV3NnKX2:dsn134nHkl7tZlHIueAZnQpE2

Score

5^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 44 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DOMStorage\clownfish-translator.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{06C11DF1-3FB3-11EF-9514-72D30ED4C808} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426884234"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1080ddeabfd3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000007ebc8eedb15f98c2a365ec145524376f52e8fb6ca6c9a4a875471812ef0c06d0000000000e80000000020000200000003243bd00b34c2e595eb1ce9e167b17813327a5dc6356ba659401bd68dbd3fb6720000000f06c40223cc28310f5eab9c40a5302fe0a53916a958cdedefc592c937771e79540000000f35a76e2c628477393309047db1c2eb7fe914aa30123d4d3fb26ecc17755eb27d0832e2c81c6fb9f92c4225039681c6b3bcbbf4e56e31e1e5d9a0b0869feaaa2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DOMStorage\clownfish-translator.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000d667c075a8c6f243c6921a1725bc4c35cab14d8409b40ec039b4e13b53a97b19000000000e80000000020000200000002532b44c2164304e00c1afd585460e60fcdb518ad09abb03021c7e541c769c7e90000000e307049bf7f3c2b0eeae554438e067ee76f87fed25960fdea44a1db49169bc15910c826724063a5391f91019ad7127c146491c9286ac936dd04ef52dd96b60b4aba85ac2c732f97ff946a2df1bb12d2450b9ff5e4b56dcfcbb6ea5ac9b7d4c2a3e1a9d72c1194b92221002efde67d1f2d013d26232e36c4bd584ef0aa76878c018568ca509af2d2cca15b85f51818da4400000002a1a57eaedd2495e120a46e8241860fe9f8cf93a335bdc37eb0a2349dd9ecfd60cec7bcc82279b947613c29b3cc00ee067cf2dbc532f2067fed5d4c722908c5e	iexplore.exe

Modifies registry class 19 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\MaxInstances = "4294967295"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\NumAPOInterfaces = "1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\ = "ClownfishAPO"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\InprocServer32	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\MinOutputConnections = "1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$8\\ClownfshAPO64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\FriendlyName = "ClownfishAPO"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\Copyright = "Developed in Shark Labs, Sofia, 2016-2021"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\MinorVersion = "0"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\MinInputConnections = "1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\MaxOutputConnections = "1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\APOInterface0 = "{FD7F2B29-24D0-4B5C-B177-592C39F9CA10}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\MajorVersion = "1"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\Flags = "15"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\MaxInputConnections = "1"	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1060	APOConfig.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1684	ClownfishVoiceChanger.exe
1684	ClownfishVoiceChanger.exe
1684	ClownfishVoiceChanger.exe
2496	iexplore.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1684	ClownfishVoiceChanger.exe
1684	ClownfishVoiceChanger.exe
1684	ClownfishVoiceChanger.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1684	ClownfishVoiceChanger.exe
2496	iexplore.exe
2496	iexplore.exe
1200	IEXPLORE.EXE
1200	IEXPLORE.EXE
1200	IEXPLORE.EXE
1200	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2496	1684	ClownfishVoiceChanger.exe	31
PID 1684 wrote to memory of 2496	1684	ClownfishVoiceChanger.exe	31
PID 1684 wrote to memory of 2496	1684	ClownfishVoiceChanger.exe	31
PID 2496 wrote to memory of 1200	2496	iexplore.exe	32
PID 2496 wrote to memory of 1200	2496	iexplore.exe	32
PID 2496 wrote to memory of 1200	2496	iexplore.exe	32
PID 2496 wrote to memory of 1200	2496	iexplore.exe	32
PID 1684 wrote to memory of 1060	1684	ClownfishVoiceChanger.exe	34
PID 1684 wrote to memory of 1060	1684	ClownfishVoiceChanger.exe	34
PID 1684 wrote to memory of 1060	1684	ClownfishVoiceChanger.exe	34
PID 1684 wrote to memory of 1060	1684	ClownfishVoiceChanger.exe	34
PID 1060 wrote to memory of 1936	1060	APOConfig.exe	36
PID 1060 wrote to memory of 1936	1060	APOConfig.exe	36
PID 1060 wrote to memory of 1936	1060	APOConfig.exe	36
PID 1060 wrote to memory of 1936	1060	APOConfig.exe	36
PID 1060 wrote to memory of 1936	1060	APOConfig.exe	36
PID 1060 wrote to memory of 1936	1060	APOConfig.exe	36
PID 1060 wrote to memory of 1936	1060	APOConfig.exe	36
PID 1936 wrote to memory of 1912	1936	regsvr32.exe	37
PID 1936 wrote to memory of 1912	1936	regsvr32.exe	37
PID 1936 wrote to memory of 1912	1936	regsvr32.exe	37
PID 1936 wrote to memory of 1912	1936	regsvr32.exe	37
PID 1936 wrote to memory of 1912	1936	regsvr32.exe	37
PID 1936 wrote to memory of 1912	1936	regsvr32.exe	37
PID 1936 wrote to memory of 1912	1936	regsvr32.exe	37

C:\Users\Admin\AppData\Local\Temp\$8\ClownfishVoiceChanger.exe
"C:\Users\Admin\AppData\Local\Temp\$8\ClownfishVoiceChanger.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" https://clownfish-translator.com/voicechanger/#download
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2496
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2496 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1200
- C:\Users\Admin\AppData\Local\Temp\$8\APOConfig.exe
  "C:\Users\Admin\AppData\Local\Temp\$8\APOConfig.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1060
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\$8\ClownfshAPO64.dll"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1936
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Users\Admin\AppData\Local\Temp\$8\ClownfshAPO64.dll"
      4⤵
      Modifies registry class
      PID:1912

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}
1⤵
PID:2848

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x328
1⤵
PID:596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

Filesize
893B

MD5
d4ae187b4574036c2d76b6df8a8c1a30

SHA1
b06f409fa14bab33cbaf4a37811b8740b624d9e5

SHA256
a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7

SHA512
1f44a360e8bb8ada22bc5bfe001f1babb4e72005a46bc2a94c33c4bd149ff256cce6f35d65ca4f7fc2a5b9e15494155449830d2809c8cf218d0b9196ec646b0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c48e99106f27ab92d9a371e4984888f8

SHA1
8afd251ae7b1754ae76137df82a4bef2be73b787

SHA256
d20d98a1b714cc284fb085d8eeb50905917ae54dbeb8073d83ca2da9a000cd64

SHA512
f7ed0ab30cff99254289ce68ddb901c69ad58210e59f7e7a15664d7c1a7c357649b4c20e9f1753075e0357ccdc0e2182c6d2036099b308f8778062fcb855273b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
976316a3dae1d47afd561a78d95f0236

SHA1
9f402e582d15d9d0eb3ff2faeb05feef7af80a36

SHA256
b3e0306e24a2ed657fade0312dd0d8c98d128515b76e0f7d3c00ae60a0588c24

SHA512
e7d5a51e5c6333f976e9b6c1b92dfe828d3c7495353c70db6e393d06c4cc448bc80d3485889190f5e146b5c47367cdc1e0040f3192c712d0d2274eb2a1c69db3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ee518c690fba382c8345ac58d71121a

SHA1
8445dddf9a5849c0f1651729fd1d5e5e27346577

SHA256
dababb29c57528069ff2ab12c4bf9eb8d0af4215c7bc61e9b59171ee1230e145

SHA512
41bc1ac0ccefb72571a301091746eb3c85502d664eff62e6f57b309e2f4491e2a42193d02c8a063a205db1a4f4151d99715da7fd825d13d373065bb65f4b586e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fedd1e2c7f567993c7fd45bdd2d19e4b

SHA1
9b276cc66c2f2ee458d86ea86a11b1fa3c23b3f7

SHA256
4c64df441c253ce59f17db772b0dcc6db672f64ce1df483b42a03ae996a832b4

SHA512
cde70597619d95be9e31d8432e7790102e04f867b882179bdc58ae7a7db0a9947edb175983dfc94746ae9d64c46e1fb209af02c0e9ccba3933b59525a33649ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e6ca0393db98b9ba8a2a16b8dedbaef3

SHA1
ee86b58e113cbf8a6457abbe1844e1fea85fb328

SHA256
9e4e7d226ef85b2cac7dfe5f9f264eac3f6171b9c5def0ebc56a27cf729efeeb

SHA512
d4e768dd649fc9ecd1ea20b3c9cb5ee896e0519bc2f06ca35c62cbefbdb806175e6a1ef46a801697fd116461e3f9467d293d986c71dc70157b86e5e31bf911c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08ed1a3e9500a69a8ec0621eb9c7264a

SHA1
2c865adaf0ce7997c9885fd9bc765bb33f6b470b

SHA256
4b7ae54ad15f94307129937a6fd4b0052bd1d3029b224c74ab8fdece60fdd81b

SHA512
c4b2748c05783bfa2d50baa4e8f2ca9f8c95d285191d4e021c255b62bf88b46f522850133b369f3b0d9f3b06ef1776e93d451a22ff7cc4839a4c57653c3b2904

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f74e9621ebe09f048480d883f7f98152

SHA1
4ae99a148efd8d5316b1b92ce4737910ca38eea7

SHA256
d45941208d95fb83a76e4704f29616c7e385f9d5e704ac6f298fbe6cc43c6b30

SHA512
c72650b4faee944c6fa5e0be099a6829b18412ee9b19b861d74517beb98c0803e984b2f5bf18f6e6ebf64c2a501ca0bf640772ff9ac735550d14ed7e8cd99ec1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5de0df3279c7d71ba3785840d77a57d6

SHA1
8cb00f6637acf1da444efa79a081393f483b7489

SHA256
849135f1eb99c74c6f60f793038323dd8f39bc3433fcb9f7aec6edd4b6085919

SHA512
350f61b0c535f34a67cf5f35d2fd5ed9f245b4795dba516696d62cb8787bda31991c0be6f42ccd0ce8edd1ee937a511e015aa360b9b547c271d08187798f22ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27b6dc9cea9fdb36259235e3f7087a5c

SHA1
e58947d74e19245cb610f7f3e3903004c21e8649

SHA256
4225ebb0d1981ffb48653c5c5552dca13d6a9a9384b049b546fb88d478bf74cf

SHA512
31fa9323386bc4830af059729ae1b42c8c9c1afaa73231c7ac7c05b1bd4aeece08dfca80808fa350740564f6e99783f475c6d6073390dcc84885eeef8c788cf5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
473e67ba7ff443903ca0199d33dc8ff4

SHA1
d9409cd773fec214ed6ddb2bada5a51493d6f9ab

SHA256
737873e13b89dc425afeb8cb8930cdeca1ce60e606c7c276bc8b4093c1b37b15

SHA512
3508f792c46acc5604527480d7ad2d5497173865547143fa9562563b6d97290471e856d55b33490fe4b21cf368e92019556b3b798d955218b6f6b9551f6560ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a4992ffcd13e607c4196862863f6049

SHA1
ff0d96adf3727ce3209cef11f7cf02f259a64a20

SHA256
369116199178e59f6ec842be5ca29ebbdcc1b141eb84259bb0f6466a37f1ab20

SHA512
ea0d5ed928b76d3eb7fa1941620bca872b2184270d4e67ed8913b14a3a82005c799ff9e819d9c869275dba781ca1f497e02ad212b78619f5196e32c877304453

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36b10300b80a0344a3fffa015920de31

SHA1
36773c3b7f54ca5332109b7e6fab85fc20d55e06

SHA256
a3afaf3eb8b2f72c3c584b6c28183f14ef72c1d5e59cdde62875c6c9498e2b38

SHA512
d1507b914c120c3c05e18e312fe65d4b5fac8209867b91203bfbf5c952d7c8d0fe2236dfa0fbc9a8b7bbe6ed3d615947f49161ac7813416b27d689eca74df42b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d819fbbe03e845540472e98866604111

SHA1
84513df82f963517ebe79b9585b3109e2e450d2b

SHA256
1f944a646ed2931fe7d869bb67a3b1c12ffc5d0b242b1a66ca0684bcc71eb33e

SHA512
2cb67bc5a205035ab83039d6525ebc0348c6d39d1decfb09115c4c282a40d99b702a786e0af2cf780e2e908634a005f7ea647f33d9365607d4f07e47c64035ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3fbd7f1f2237dfdf3a538ab3e6f8412b

SHA1
16d36e2da916f942a6cf44579b06c69851253ba7

SHA256
ee85bd8c64c87cebb16e1022d6cf64086e75d87119dbf4490133c55d205ab014

SHA512
02bcc180503922d0d5e1b9912f4824699594eb3940234dfc0721e502f7f3740890ec2a0992cfcaa3da9498eef44e9a88887dede9df17fe16b9ad115cb355e30b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a041a4c1a80b5e3b6b6702c5b215c822

SHA1
d547bfb62d42b6b773d61899682ca29702301adf

SHA256
dfff3e5c098b68b7a2f699af11a5f4fee595a4a157a5793d677c491c1ce8468e

SHA512
c471b91e754365f3b49b02b702a5b922f192f731fe6ba8f794a58b2ab372a321dba98e860a9b07e1f7b2c3182ab292a5f91ab53925ada61acedc5da940c4bc09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d344c88fdbb8a7d9689545ff0efd7438

SHA1
747cd79d3c81dc211b0ab9447e192a4f3435d34a

SHA256
0522c50ed03a19bcf2d2efcec111591245709a9bd3c89a9fefa2266fcaaf656d

SHA512
862a924c8d10c206979c94cb44f5355b20db6126cb76a5e43328a47fd7fa184a516f25cad25bd5b42fb740723d66cd1d7434154bcf603a30ae95e22b240a9d16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
164d3e8cf28e6df37b33570bd98752b2

SHA1
ba3db042fc8ae89c4cb5de69d355d65c6629158d

SHA256
9928cd945c6fdad43787eb397b70922225465eb8a52d99baa674f735bf5fafdf

SHA512
6c67308faeb2550491728d76e6421613c5483978e6f7fc434b9ab66e8a85710aa64eba128b2ba6d00f9808993d830c28d4cc389d456a3b3864bbc437c296e4de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c4b5d17b93b2cb70142113e259b1d57

SHA1
579750faf99ca1ea88de093c55de833ef1105d87

SHA256
f75fb578c5433746ccf2ed32c9c77139325208054f1e758923bcd9fa666ad919

SHA512
c3a4677d07e42ff24f237f172bfd1511d11bb134ccf258addae80f0c5914b791de80737d66c831be7a9e12d2923e6d9aa25463b0ed71405a97ae8d385f761fd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9f6e58595d7bce342a5f3146854806c

SHA1
7fa805a55aaa11ec3e972e7de5d184a29c77d2de

SHA256
0fd2e84d4f0529bf37cc5436dc1d835d2d8d72c0ed4e8f7591f2aa43873a0d66

SHA512
ff70cf66db1671bc73fa30fc1168d6b24d5d0b5f69f576610cd5f9ace49f6000a93a13d66a963c548a4a3f71c08b313d51f88d3fc4dec550e3887710aeea2c97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
171250ec5236c7ef5d15f9dc442afc96

SHA1
76bdc19ae4df2cd0c2bc2be5545336c70104ec01

SHA256
f0f8a12c8f35b33e06b0c6d2560e15740e85bafd27aa337ac424eb194b1b5d50

SHA512
577ec8b545fa59d6b98268282b7eda225a822712cce1af28c8dcc6440152e7437d3d49c163b810899d0c8eb8af3e253444546a6100e24e935505d9cb478d6e68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fdfcb90fc6e1431ad8826762916075c2

SHA1
8e658f254e95d9915b2b1eac71bf99687e3200bd

SHA256
53f706b6185702c7bd44c3fdb79fb698d3a757921679aad9107ab68920515a21

SHA512
3a8cdd2d8e7c1719acd14cb63c459b3b6f15f75566bde69f555f134f8e5da44c53b8e3b6d377ee044d65dbae5ebee03b3352ed3fe69cc0493600dbdab4c02537

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b95401215dee867cd18ca9c9bae610a0

SHA1
cbcfa7b571d7694b78716d4b89280a6d7fd87329

SHA256
9df10a9273fa31ad8113356e35789efd83adfaff0b36bbbdca39c804d8e0aff0

SHA512
df32898ffe7c6760750d2caf5cbbea9beeb260b51a685b104e38602ba311ad35f0df961893fdd0002848347dc611516e6503d21a05c29336a9f434e011543785

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A

Filesize
252B

MD5
bc00c774ff38ecc441856903e151a709

SHA1
46aa493ceb91a19afef04f3709872ce7cffc97ae

SHA256
2ad6747e76079f9e58af5c712644ae8da743455da342fa606a1ccb188ae40ca7

SHA512
55171ab4312dc71eb551d27617da809d6186e3f5a1779d227d7745f292bd18d94a65a637b4767d3549c4a065ca4c4915ccf741c1412f0259fe5c180d3843517d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\ljg9kkp\imagestore.dat

Filesize
1KB

MD5
c7336235a892caa0aee5939b9a4a55b7

SHA1
7eb8f7b7e98e2359bab74712533a181a83d7c7f7

SHA256
943100fe056e0c0260a0bc6a4dd8f8a28f9007ebc546a273b07a67d1ccdafd68

SHA512
e31c45f5755d1458046a942e342e20de88d3930d49e3dae44dc440e886e486a3b0e72d4ac4cd590b453a09d1feb277067650c1464008edcab0de216db25c9790

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VOGNAB2O\favicon[1].ico

Filesize
1KB

MD5
fc64ad0f4f10fbf6c8724ce6fb000353

SHA1
73e92b0c05c8af4d72b8bb07a3b8debe52050d50

SHA256
424e19fe824c9ace6caed7635273439c244fde4d7ab39ba8fae96eda8e9ca890

SHA512
e0a969b579ba3ec52a553b95e96aeac7644ee7562487caa17fcd256af7c7e5f1d2cfff6245e98993e940cabd04ba395cb9af27ebe3b9813f04298e8c10ac8b7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBFB9.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC0C5.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\Documents\ClownfishVoiceChanger.ini

Filesize
709B

MD5
a3de0f4aa718ca194b86d23912e01911

SHA1
5b511d76efe82ba75207865866ab844f5848a5dd

SHA256
993ffe4295fe8d6ddcb70e03b65b2f3ac5eb21099d0ce9a7dda6510348a1c5b2

SHA512
c7c736f9b24daa1cf44971ce68262383c8ebc18c96c09e7b3b4b7bc6502a67e859b798debb6a917cd0dab0bd787baea902482471d600957a430fe775a4e9be5f

Download Submit