2e8fcff3bdbbe14c2c400957e70d4e8bbac9ab420d28eb6f984f3a7d127b10f0

Analysis

max time kernel
146s
max time network
150s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 15:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3de309fde967c7ec03e772c01c7f95aa_JaffaCakes118.html
Size

27KB
MD5

3de309fde967c7ec03e772c01c7f95aa
SHA1

c5cd51d1d9c68526a06ec48ac763a097f87df3a5
SHA256

2e8fcff3bdbbe14c2c400957e70d4e8bbac9ab420d28eb6f984f3a7d127b10f0
SHA512

11a1c3a7725a010fee55049c2aafcab1a5f082703ba040fda5d3d3dfea59291d0375ee23400fec54d4b51df729cba5710838dd39cc325478bbf834336538a82e
SSDEEP

384:4joRoNZBMwR15kyGHA/IcSfoKe7/i+CVUwGlS0Zo94IRuy2J2UyigLK9QyZnKoPY:4joRoNZBMwRIyGPt69Bvd2/Iu

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426959053"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3BE65191-4061-11EF-BD1F-566676D6F1CF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000000c935d2565b74c65e7ce5e46dcf2b6715a3da0c6db47a336a2918fa11aef7710000000000e8000000002000020000000cae9ab9afc22464d2f01139405f8a13423293a754921283c7ece8f1caa8b8d0f900000002b3fb5dc13b10f44c0964dec2bca44e1b2d71073f9d011f9a473686b2ed7874ae30a99719e68f7d980cada6dec407c31fed22129bbc5143bb1f95d7c260fe6c6ff052aa39679a4905f074da2eb1791771ba0ea6ffa76b1cb3e5100893b425facd92f867e2725a16b0771fddd4a7c325d32a318d8599467f1c525d78c310a56b883385c33b9b77514c47a43b8e17e87a54000000038647eb3f6d80e7fad67b01164cb31f0709e119ade0c888b466b5c259b6be099c72c6fb7557cfc8fa729163b46addcc8b24e078455142c9a1b65631d2bafd7c9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000006ffb6be29acbe9603cd3c964903b03935c24e2bba543d03d0d388d27ddfce1db000000000e80000000020000200000000ced23a7c994f692dbb206fda8849f0b587044ae8bbfde23a85e289793169440200000008d9fead3d9be38f4353b6223f9f34e92da1f69b23e921b0f845de81b0406d6d84000000021d4d8563ac9a0ca398602da2bb42d858d8b4a964506aa8a8ebe01b43dddf3df59f9f93f4480b22c64cdf8730c2ea3faa86b4ce3b7959352ff8a7e9a9c90bba9	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e06dfa296ed4da01	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2732	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1932	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1932	iexplore.exe
1932	iexplore.exe
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 2732	1932	iexplore.exe	30
PID 1932 wrote to memory of 2732	1932	iexplore.exe	30
PID 1932 wrote to memory of 2732	1932	iexplore.exe	30
PID 1932 wrote to memory of 2732	1932	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3de309fde967c7ec03e772c01c7f95aa_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1932 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
822467b728b7a66b081c91795373789a

SHA1
d8f2f02e1eef62485a9feffd59ce837511749865

SHA256
af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9

SHA512
bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

Filesize
893B

MD5
d4ae187b4574036c2d76b6df8a8c1a30

SHA1
b06f409fa14bab33cbaf4a37811b8740b624d9e5

SHA256
a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7

SHA512
1f44a360e8bb8ada22bc5bfe001f1babb4e72005a46bc2a94c33c4bd149ff256cce6f35d65ca4f7fc2a5b9e15494155449830d2809c8cf218d0b9196ec646b0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
64528b13458a5c5af919ba96c7432aa6

SHA1
c87a9885fd71ff1b51b27cddbdefa24afef59ccc

SHA256
67c23236b9f6a467092de1dff6cfbd38606949a930d3c848fb9b559c097feb0c

SHA512
465847d5b4d848677ffedb53eb908bb60b4dea895b64cad30750c469a3c8b343954b654f42bc5a16e0948dda5805e1615b298550c2d29063875a117191bedf59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
2b3c25acbf03822cf56c1742260cdc0c

SHA1
ad2b33eac401748a95658010e92626622dda8f46

SHA256
f933a22b61cc1ca51a2ad33c3177cbff02af50d7a943c6cd22f9269e13b3c8ec

SHA512
79a057b3f42f0cfa3d05017bcdf8796a74bab450741d01d5811d0bc5a0f82ce2e4857cc2db4fb591ed7b4c660b1cd27601e4cf4a09d7cb5420a4c986197dcfc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61

Filesize
192B

MD5
9815ab1f3f328fe087f79e55a6ae2e82

SHA1
133d69f77f7a629209454afa724afa8a569b1182

SHA256
e97553cc3dd07c21ab2d540c800cb0794a2d7bb2057ef239763add6b89c9c7cc

SHA512
4aded88e5dd7302c43e5867cc5342b145c16fd5100997a0a2b4dfb93799cd0637a1711d312c91743535d8cf224dc00ea6f36930e2793147d6c1c1ed625090621

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ee5520b71d8b9b1e8d1122325a5ead4

SHA1
31f7e94182c8f8b7b110fda449a75a79a101f92b

SHA256
8ed5a06da4ceab9fe5b4f34bdd3bec63504128e379286d4617a27b528de6e918

SHA512
3d00daef2fdc401b48f32cea2df925821a95fb9b15e9aef235879bcee0faae21df89dc16703e4c7712d7e16f5f5c82717f3af8b7ce1f47b04dfe281d38ded9bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb0fede3aaf704496109c7b1367ce917

SHA1
2a4cd9014dd34e31e8f154243899ff848bb61739

SHA256
c660e9353fa55d792cfcaafc4d85e37d1d9b9c49731a993a6854ddf5cf7f35ec

SHA512
70fc017fdabf71d307a921214bd526158af622f71043b1941914695f291fa0975d93904c3f7a7a538916aa808ace966917ba06706921ac93e972bb942ef0c125

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4f5a7f8e8a6eebb60b601a1e2fc697a

SHA1
7551286503aaadfdaafa425e3523661462aae3e8

SHA256
71aff12b89d617c50593dd3dfe7725d458b3d26c48a4ab40b2aa6eea1e7018a1

SHA512
712471e027d78a039684bc56644fe044b3503f02b050b6f75868cb981b5ce74fb5fb9f39a4a7f7bb70adad7c3da62c193d17cb159321f31d42b9fd82a24d58c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7f923fd95c7773783ceaecf7042f66f

SHA1
d0b6af525ec422bf86121908775947f2ed18196f

SHA256
32ff828efab88940a7298804a2cb91cda202f89004cd01d8df5ba295007eac2b

SHA512
021f1566668f451f91c37491ca898df02193ab770ed439300822a100340dcd8aadc3fd782826cd9b926023d93809864e77a2420a2a292266e441651e0f78199d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
195e64f5935f030048eb14adf0ba715b

SHA1
fb810e7b87c61b800b3a2e384179e4de68c70e9a

SHA256
26657cd11cdb253cbceaebf92d69dbff7e421096a1560943ccbfe7f21cd54fa7

SHA512
3a39a964fdb81c0d1f467d33fd069b69f633909890fcc161e85c3923b1c7036a7e532e38d4be86986e2aa802dc2851562ee2930f60abeb3d99e31840781b6b2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d94c591215a607aa8f9edcd936805f1b

SHA1
fac43cd1f6360d5025c84bad6180d5182c669bb3

SHA256
328cb51a89e2c7edefc1799e06d0869d4b60aef4b1bfd072e8edf72e5c7304d4

SHA512
2b7f83b300d0b9b8283c16f4ff7866749acd38a519f14ddd15bfbbc05714eda471dbefcd5efbafd1bd340f1a4451764d7dfc961f8f13e595586d8f760ba4505e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec6c588eff1f4e5adda28fb66ab70c7c

SHA1
ce4013e4ffd596d441732edeac83b47e3bc3b27f

SHA256
dcccb5335eb99b8d6c9c43f87aec330027d6e09e59be78935137aab3cc43f3ce

SHA512
56b21cdfdfcf37ee06a53314bf5bb8f055981e4e30ff83e3729abb80534ea85e2682cd1862d2cf4169d817b83f51bdb0eb0b83a0256f7246a1ad7a90ea13bb75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c6c9cbbf550ad897536f3eb0b065962

SHA1
1634ac410423f518aa17a43cbc7056cf916d5c20

SHA256
5305ea90fb6bd6ea93275e1476b3710ef22d4dbb4b9607e7afb07fcd56dea2bc

SHA512
251b40aee60f0bbaf3e3f667129967d6b42b34f46e2b84d3d1350346ec4d914003765b1c3f2663df92e3d0c46788cfc710ba100f496cd0b9cbfd06eb9b7ead99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b8e9d125dfce469a87337fb764dc3e7

SHA1
3e784300efb38ed940f538306e200dfa41b380b8

SHA256
27f6e32dec7794b41feede5a71be542313ea555031ff82f799f0257e84317d8b

SHA512
08b6b8e0ff90f373f4158321ffa315b2afc2b47647abd0239bd8f6d77b3f28e4d0e7bff9cc8274fc80f8184dadd39f8f47226e8934b59b275b807d3e84a6d480

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
047863be1c9930ecb7bc8afae898f290

SHA1
4ec9405f85dc2ae00307c97da386c3598a93f079

SHA256
2faf6ae5cf28acb3f9a30f641c20333c779c468e21ba526ce05de34ef08eb20c

SHA512
b00b39b13b7765720e6ea478a31a4f9c00db5a2020d4a84ad8265e2b42c35604f6315699a2dd9cb1c92bfc18ee43a277852276c756e315a60e87e4333d675ee4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
224ca85330ea9e9355ef9282ae966fcb

SHA1
9f5fbe0872bd2dc44b5dad0a7b49a61459efc24c

SHA256
90aad030cfbcb6d61aa5f1bee8d7d002bb622aa22f01a11db371a40505aaea35

SHA512
1e6706ec4d34b67fe1c16eb7106fc1a553632ae58eb9c8ce8581dea6958fa8d44aa944ef2093a3271aa3e21de56cf771e2f99876fac8ee5f696efda684d413d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
42ea7517f03099a38c00f34700f80a03

SHA1
89bed94ec2e26e6d9eb56449af008eefe313a10f

SHA256
64df15be5e8e16c2721f809b8f2b79b4a1c1acfe49b2436a941da20f2c6a1f1f

SHA512
5b13c9081597e42f43458dcb8e0cabcbdccd6ed7152f0195610f0ecc98473a4fe460aebe1ffad3c308038a245f3e27772e88c7bad025b25e2099c254382282ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5cc7d40f4c38b5907f4da82e0162e9ef

SHA1
bbe676ef012c9783b255b9d0eedad7f8541fe05c

SHA256
e2b88a18f63baa9b575f9a8e964f64ad34d7150e14a10d322f3f3d8acf44fe2d

SHA512
b77c247310bdab5af0b854c692c56ec488c91cccda96802611e0c62ef1c0faf63dcee3bc4eea36965331706083f9fff0490b23115cb093006ae1ab5b01848068

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a9d4673ada9fbb1bdc55eb3e9773358

SHA1
9ea8094764b288759a811f6134830b9eedaadbc1

SHA256
f08eac0ddfb8a492b343a6276ebdef7f7760ba4f7ba87668464f0cb362e2aaef

SHA512
af7f08cf72dadf53a4ef1a1eecca100fcc389a441c2e9d7d0a6f3207aeaecf0d196fc8b84db12c5dfcf2b0434c71bf7ee502721055a1a205ab58ed3ba76bfcdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b13ef4837a2e7adf0f5b29ebb302a89d

SHA1
eb2902b750655f2b87454e63a05fbb46c42ffc65

SHA256
98b984c20e3f26a67da5e97fb302188321f4ae6dbd52f1d12886ec29b9532118

SHA512
ebddaf7bdd867e8ed176f024a12e971ce0e29e876ed4f4e44e617afbd4c9a3ff24d703ac373bdc4a71e16f6c03957fbf1187926b60528aa4d8c62ed2b8938f62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f1fb421694893dab8be1bcb9ba93857

SHA1
1b98fffbc4bd3d10f2340014d0be741afcc0cfb9

SHA256
fa5f776ae5544a44a220f32aa8f60b261b22a08fde195627b8fdfe19fa8ffae3

SHA512
06a855897dcacb4731fb9a38ca6b42849e1e65d074797b9da7d9d4e2f95853308644da0ab543adcf721e325832f77ee179b428fa6f72ab0049ac65790ef9dbb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f9679e5be9d232522a48e33b58c90ed

SHA1
11adc20c027ff996ec468b038b35d34971498f1f

SHA256
ee2cc5a5cd5584968d608ba68425b91f3a77a95a517319070c097a1214219b7c

SHA512
c983104f0bde76014c40131a206896bd730c05a42ef0953f0b0804b1acfb8869a0b5f9d022ff4ec013b8fed2e97c6c7d6848a8185614a3cf6cc46c501e0602a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0084f9dec173731afe8915ae8cb4a50e

SHA1
9e8817501d6a88fa03d23e005e28a0625bcbd69c

SHA256
f5a0be5dc9f115dff50bde9c267264b79800e0e39fd1d6fece689e650415bb1d

SHA512
b1af00ad8b22e0b574dcbd76cbcbb6d7d4dc250377799de10f74f92e3dcaf87682fffecc455c203b137ffc59858002d9a802ef3d62afdc8af22e091ebce2385c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
559210eef82adcd761f88cfa9710759d

SHA1
48e38a70f917ad2f1e633ed3eec4550b53928ce9

SHA256
eea55fa21fba3878253034d354b74d9d773802f9ffc2101b7593c3536c94f03f

SHA512
5c50f64253484d1d7e8ab9c920985ea11b405eba757990ae4ee2e4d9afaa4cfa7c58bab37eee30e6bb4d826a25c2c3dc11a669f6894bf344714f9d2c0715f288

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eaa200b94cdbd4d41da89788791f7943

SHA1
ef60025c1c471225e555fcc6601c5de7d8e76689

SHA256
f94539bb526193e2c40cc3e7937ae4cefc63216f1efe2fcd05eef090808fc53d

SHA512
cee36a931506f7e1faba482cee3e633e240a29ecffc8ae4dc2099cf4c71767f875f18d2f92024971f18ca20aac17b9945c7921904c7a810026a4775828e18304

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5a227b5bcda2fdd29c71afcd2d84066

SHA1
37e5463f13a6a387cb6a95fcb30c2d9c7a2cf3c2

SHA256
1b1fb515bd8a054ef8a44314fd3ebb300acef9674ee0c566c0d5f3a0ad0b854a

SHA512
9e5600502e3f511de35b756cfd6f8462d9b2a14d024ced274d0ef8c7cf36ec2525a00778e2f510d87311f5e7a2243ff0b8afd8156a00359038e892a8e9a745b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e178244c13cd1bac244a94100fbbf720

SHA1
52f33842ac55400bb9467a2af157679a455d01bf

SHA256
5f349ffc639c7cd5965d871389ed478fbeab1fc4dd59acc08c6ec1f747c7f256

SHA512
574adfcfbc589fde14b316b5543da4ce9ee1e40f68a6197ec93ba3603f39f86056162d91f1f828ce3601bcf4f096f2e99a29ed2c42b92d87f0ccf8d3decaa21f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
055f4b3ea494b757b2a46e8d4deafb5c

SHA1
0a6619606be81cc6b4f00f3a0208954cfac03f84

SHA256
63c59b7bf0c5c4f5269578ae3779755111323e1d952232cf603cb45a6532f4ea

SHA512
cd4ff33e426b8d862dc99d0e8c71853de388e588c08fd5e8550213da7d7da6ddfdc3c29352f555d62c2cf0202b4ec534e5e44de441fa97cb53db5fddb6201510

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7acec1f0121dc9c87d084d899608a26

SHA1
5cdc2bbe66571e1b66a3104a0ca8aefaac8d7642

SHA256
1acd1804eea8b03d66b0c8a9b39e30237536719b0def1aac4fa2d8851e195147

SHA512
9868a8fba7cdc94ae5f53b7741c2f78f83437ccf7cbf54acc40042d04cfd0c6bf4604accc38a506e03b12bb6620a04c0a483cabaf3f3b29a2a42fda9753e3939

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4bec7f8a5d1db8a56b411823b2fce0e3

SHA1
6c8ae3c890a2b2350aa2a9b9b70323c3a14cec46

SHA256
f326806d806601a737e5f022e28e8a28fa37b98dc06fcb0b9cd393a5bafc8ccb

SHA512
243babb1bb0470ba654e6ddb71e82c72c98715a1bd5f28fb5cd3448377b4439d97c075d2754fdbb70be1a1131d98aab3d03be250fdce8d7c01a8b0110acd986d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
150e40ee77edc18fd44fb0f4464a9923

SHA1
1b40afe574cb892a82a7b1a4f0bf1eae05bb4dad

SHA256
18d1927b3186492bd937b6d67e2d370fc5608201fe1a57b0ed280d9407e8ca66

SHA512
736b28970a8b68463aabdfa88b703cf9179a766d5630a8182dd295383165d0ff7ce17562033e59fd74c6f46493d5ba13972d0bf4234b266007f9c1835b63fc9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0230adbf752e574dc2bdca46f1d3c7a

SHA1
258179f09abaa67f9d6e723a0a060dd899e02532

SHA256
09a2649d758eb2ab6378acfb39e1ef232ab1edf7865afcbd71b5d55cf0b0ecd9

SHA512
5a12bd755c395d87801c6b0e4d17828ea525b66a259df93000813639948e5670358abd02d46cad3ace75472579c4e08d033435646c78a297bad0ed58e1e85417

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf2c1bd937601cabaec3718e9d281cf9

SHA1
7a4709089b3554f1effcdc7a376f44a751345ed4

SHA256
81b36dfd5942d5885536e3748fa051bfae3699158f0fa02e6e1b1b568de277d3

SHA512
53e8a170785463f8286a6659698717d27e231c3a8a7f51abcbee0b5d0b03f0399ba77151b635a8efd4959150902cb42324bc351e5722825f97ac33074274327a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eebc637df99ee7d4ef51998688d8988b

SHA1
f7862b6d2063e60bb6d46e5a21a6a920109b8338

SHA256
e5c79950bcb011c3b540122ddb6bfa9bc3994086e5d4e94d4f0ad99404fdd0cc

SHA512
c676d4c98dfc23748b25c5c2572d2df51e1cc3fc43d11ca9b75c743882ebadcb1733c3dd39e1fe76e0294f4d2947befc95c45ab3ad9d4321be79488441a704ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A

Filesize
252B

MD5
ba5c319296e7c8a8a031129ed03af275

SHA1
e33e0e0a208304f8139aada7a0c8eda9734a4edd

SHA256
72735c5ac768d6845f0c543faead2667db2f3d24255b7e635086fb5a2d245212

SHA512
bab4b5bb7b659873d8648eafdfbbccaead040ce37094618b8ba0e2882f183c76edf3d08e97134712bb8fbe9d7cabf9d6278edfd4fa2c3768bb3da906497c881a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NFAY0EOS\2989_First%20Amendment%20Court%20Cases.pdf.2[1].htm

Filesize
167B

MD5
0104c301c5e02bd6148b8703d19b3a73

SHA1
7436e0b4b1f8c222c38069890b75fa2baf9ca620

SHA256
446a6087825fa73eadb045e5a2e9e2adf7df241b571228187728191d961dda1f

SHA512
84427b656a6234a651a6d8285c103645b861a18a6c5af4abb5cb4f3beb5a4f0df4a74603a0896c7608790fbb886dc40508e92d5709f44dca05dd46c8316d15bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA23A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA2F8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit