83f5c60633475ae50b42629dea84314f74094c3770d72329af762c1cc74680be

Analysis

max time kernel
57s
max time network
140s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 15:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

681148ac866ee08182ffe71934df313c_JaffaCakes118.exe
Size

135KB
MD5

681148ac866ee08182ffe71934df313c
SHA1

cb025f81ace932cfdc46e70140faeeee030ae626
SHA256

83f5c60633475ae50b42629dea84314f74094c3770d72329af762c1cc74680be
SHA512

a3927f29238dbbfcde3d091146a2b094814a9c170ad89433adb78f2ba6f95e789b14428cb7dd87303adbe4ccc528f656693534c081a0ca504db96a1a2f905296
SSDEEP

1536:I0Y0qkc5IvFz70yiVdqDkhSchSWiSDWP/OsWQH6CazASXhXSWLlWT3PmcsYN/Xzx:IMqQFdiVdubWibOQNi3MWL4FksNYFfPK

Score

10^/10

defense_evasion discovery evasion persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	plugin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	watcher.exe

Executes dropped EXE 2 IoCs

pid	Process
2196	plugin.exe
2832	watcher.exe

Loads dropped DLL 2 IoCs

pid	Process
2164	681148ac866ee08182ffe71934df313c_JaffaCakes118.exe
2196	plugin.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\Module = "%ALLUSERSPROFILE%\\Media\\plugin.exe"	681148ac866ee08182ffe71934df313c_JaffaCakes118.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	plugin.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	plugin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	watcher.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	watcher.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\ProgramData\Media\watcher.exe:Zone.Identifier	cmd.exe
File created	C:\ProgramData\Media\plugin.exe:Zone.Identifier	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	681148ac866ee08182ffe71934df313c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	plugin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{01C6DA01-4905-11EF-8ED3-72D3501DAA0F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000ae5c89d940cd5cc82a192e284cdf06701238a11db506500ccd408f3b3231a4d4000000000e80000000020000200000004a2138e2da331c8c630e0b51b2a3989b6e5e6f99833129137caa3d5b52a459fc900000009013f092edc35b132798cef54e425e680b627d8a614a375f473cb0e400cf5f6043d6f627cf15b3e8a107443bb3e7b44393ee432729f92d624dbdbb691564ce99592bd757e377f944862c9c1d09e0b5575dba3b57eb5eb6949db3d93b27b8ce53ec8fd6724c82590820cf88757ad43ffc63b2011afa58af23edf7dc5177e9d6de4d534d748c6386a7ff179e8f70f591cc40000000bf7483c47314053769f3a9f34a9419ff0edf2a0f51bf6976b67ab9100ddfd107b2221a1e7a50275667582716e311795c582a1d54e02a314f3ea50aa5b413b5e4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000e1b508ce6c3939c748152add9552478d5787da3638ab482f16987cb283a07eff000000000e8000000002000020000000a43ebfc1947ec87f0e7581ba396e18653022a7cad47a781ce0959e7959cffb35200000008b592f2939f51cb452a769588cbc619016cb8303f9dc18200f415920a163132140000000d4663e049bccf91fe21e5c8d00978d8e6aa04671d2071eb6d04dadc9f81b93ae33636266391b11daf6d5ee4e78ca5035ac276d474021191af29f2797ecf80c0a	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 605d8ad811ddda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\ProgramData\Media\watcher.exe:Zone.Identifier	cmd.exe
File created	C:\ProgramData\Media\plugin.exe:Zone.Identifier	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2196	plugin.exe
2196	plugin.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe
2832	watcher.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2784	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2784	iexplore.exe
2784	iexplore.exe
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2116	2164	681148ac866ee08182ffe71934df313c_JaffaCakes118.exe	31
PID 2164 wrote to memory of 2116	2164	681148ac866ee08182ffe71934df313c_JaffaCakes118.exe	31
PID 2164 wrote to memory of 2116	2164	681148ac866ee08182ffe71934df313c_JaffaCakes118.exe	31
PID 2164 wrote to memory of 2116	2164	681148ac866ee08182ffe71934df313c_JaffaCakes118.exe	31
PID 2164 wrote to memory of 2004	2164	681148ac866ee08182ffe71934df313c_JaffaCakes118.exe	32
PID 2164 wrote to memory of 2004	2164	681148ac866ee08182ffe71934df313c_JaffaCakes118.exe	32
PID 2164 wrote to memory of 2004	2164	681148ac866ee08182ffe71934df313c_JaffaCakes118.exe	32
PID 2164 wrote to memory of 2004	2164	681148ac866ee08182ffe71934df313c_JaffaCakes118.exe	32
PID 2164 wrote to memory of 2196	2164	681148ac866ee08182ffe71934df313c_JaffaCakes118.exe	35
PID 2164 wrote to memory of 2196	2164	681148ac866ee08182ffe71934df313c_JaffaCakes118.exe	35
PID 2164 wrote to memory of 2196	2164	681148ac866ee08182ffe71934df313c_JaffaCakes118.exe	35
PID 2164 wrote to memory of 2196	2164	681148ac866ee08182ffe71934df313c_JaffaCakes118.exe	35
PID 2116 wrote to memory of 2784	2116	cmd.exe	36
PID 2116 wrote to memory of 2784	2116	cmd.exe	36
PID 2116 wrote to memory of 2784	2116	cmd.exe	36
PID 2116 wrote to memory of 2784	2116	cmd.exe	36
PID 2196 wrote to memory of 2832	2196	plugin.exe	37
PID 2196 wrote to memory of 2832	2196	plugin.exe	37
PID 2196 wrote to memory of 2832	2196	plugin.exe	37
PID 2196 wrote to memory of 2832	2196	plugin.exe	37
PID 2784 wrote to memory of 2688	2784	iexplore.exe	38
PID 2784 wrote to memory of 2688	2784	iexplore.exe	38
PID 2784 wrote to memory of 2688	2784	iexplore.exe	38
PID 2784 wrote to memory of 2688	2784	iexplore.exe	38

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	plugin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	plugin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	watcher.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	watcher.exe

C:\Users\Admin\AppData\Local\Temp\681148ac866ee08182ffe71934df313c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\681148ac866ee08182ffe71934df313c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\cmd.exe
  /c start http://youporn.ru
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://youporn.ru/
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2784
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2784 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2688
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\ProgramData\Media\rdb.bat
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  PID:2004
- C:\ProgramData\Media\plugin.exe
  -wait
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2196
- - C:\ProgramData\Media\watcher.exe
    C:\ProgramData\Media\watcher.exe
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - System policy modification
    PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Media\plugin.exe

Filesize
135KB

MD5
681148ac866ee08182ffe71934df313c

SHA1
cb025f81ace932cfdc46e70140faeeee030ae626

SHA256
83f5c60633475ae50b42629dea84314f74094c3770d72329af762c1cc74680be

SHA512
a3927f29238dbbfcde3d091146a2b094814a9c170ad89433adb78f2ba6f95e789b14428cb7dd87303adbe4ccc528f656693534c081a0ca504db96a1a2f905296

Download Submit
C:\ProgramData\Media\plugin.exe:Zone.Identifier

Filesize
13B

MD5
38de427224a5082a04fe82e2bd4ea9ec

SHA1
7e4a53de1f83762dd2febd39b818e2258bc83bc1

SHA256
12f99f53144294750fe8713d580eda286f4bd95cd9c840db8ab957def8040028

SHA512
ec3f3c324eeaad91ab0efd47b3084493d863f969344fa1ba87ace1974908053d396673b44c33b4dceeef792a74ad9278e06acc27c83459af1153de52f83afcbf

Download Submit
C:\ProgramData\Media\rdb.bat

Filesize
97B

MD5
5303b5018a6cd19200b98d31ab04f25d

SHA1
8285eb92f131111e40d2dc864d3b386dad6b9129

SHA256
464648d492af6bb50cf65ddcbdca3e90d4b224ccc6f4ce3944d439b6c32da524

SHA512
654aed00850f6b7e424a5ec5acad086a51fb54f5f944238979f43fa1aac430661250210fe5f38dcd78e46311adc7e6b282cb5c41bebfe5a7d297afd6db6de21b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ffe7229b044ad7248d0d04129b84940

SHA1
99a8237c5f91900cbd8bd6e72ea5a1d2e33958e6

SHA256
0bc968bb8e07e09bf60d9dbc951968ffb26a74a642bdb4dd5aedc880431728de

SHA512
7ccd333866ae6eef25e8d4ecef4ef648b3ef6f81756e4289546b96925c85401f93e50ca5a66e1d56ab8a645ca4d46ba0225692c454aaf2a55152986a6d514a66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
02379759ddd4019d3bb10c7ea8d3de0b

SHA1
679c0751d111147383b5bd2ea7e7d24d853cfe75

SHA256
3665a3d3de8e8b421bc78cd01f595c47ed141b36730eefcb08f86d2f27042722

SHA512
3d958ded10edbcebdc8930c73e3f8e05edf01d8c765f657a64255d8487e081b87339f51fa8968b0e2ba36570f953e28f832cafe3750cdcfce632e18d6c755334

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bec49b45cfbf39c4336d818b9fe4f0a9

SHA1
1be6b4a0c2d3a862956c4e9531d269957ed163f7

SHA256
e12fa7c06ea9b2d24dd4a6c681b4fbe2e75aa996576f4468ea5118648dcc884a

SHA512
7377b11f4d4439204b5239f70f1418a3dc4636234f2f24b40025227b7498ece2f625f534a0d64961c2f454bca9854dbc81e79a1ae86c65c1003978d7806a8d74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2be44c34bb50706bd0d826502daeeaa1

SHA1
ff8599823964e5707233273c3923bcc4134d307e

SHA256
467ad53136c0b49311c2a572221bd522fa558d825585b21d5bb478e2946784f0

SHA512
c4f50c4e30e53294d90f9c5235dccde02a5fb5570c2f67ca3b3413e118dd8679e18f505360ca34b026a2adef7bdad1c0067568820d4759150625a53330f4d098

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c01a37aac3b7b97def8766c664dfede

SHA1
d2777308c5c2b07229159136da710b5108ce4606

SHA256
c353776a47ab577b21b65fd9b5d6c7234aca82c8922425a40d52682616ba68d3

SHA512
3eec718c96ba14f18cdd6690b626994b9e6f9217f525a68db6cc9e549553876ca469eaf8b1f32c348f409d89e53d9c4b42738dc004d29ed3b958a522abf2816c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10390fbf2c6b92fb098d5bcd13f43e6e

SHA1
7e35ab93b17fa1faaeaf242f88eeda6b008a78a5

SHA256
0d23c20198ffaf539933a8bf353d2722077bac9b27b5373f6d93a8095d4654a0

SHA512
b243b4dee1e9b9d5124f33eca7728b8f6249e82c671cc8ca693265a96f890fcffc791a9a11add9e2c020a7e557467b3c944c82fcbfde46c0343d26d4601d1606

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee858d9d6b8cc5e0f4404a2f8b23d1da

SHA1
4a7e773200c844f07713a0a0c228b9c243aecb89

SHA256
e26eed8db7ec247b3f3331e1d0f540842ceedd3504823c9e4bb4731a416d40c4

SHA512
486c61988d1127efdb883cbeac774b2204944f1f1424e9e43f4588b0644d4c0e9fa550293a9c51cd19b398b4e395ffcc821734b76365c7d9e6d7363de9e14e29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4054f2b1b82dec3d844861ecf77f6fd5

SHA1
ac3c26eb9740774b1c3fde8038a173ddbdf1409b

SHA256
eea3e78f15d5eac34fb8668cd2fa48f35f1cf66d800a2260478802caa18b5b39

SHA512
196551139854d7693f7139c397b80169e3eac96c94497aff0ebb685c52365359d298a66a177a784cec65a155b181419732c237cd43f4db702ff3217bd97e1cdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
640599451d9b1861d4da50514bc7d993

SHA1
96882a5f98cd5e9e67c3e3b005adef7e26d1d66c

SHA256
cc26c915bec6bd07ad93209be8448d5931b8e64fab39e3a9044833664d35917f

SHA512
157ec498c643f19fd3a2d2e1bb699458c6c81c195d74e74cc362ea3f7e96be41b308067814ab2a45e892806eac0a427b508aaadbfd357ef4800a0d2e5d4332ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c6d5d1626e3aec49b0025e89232bd1f

SHA1
68629d6d1953ce4d57509f9f0dbda3ac01f7d572

SHA256
ce897c5eb663418c265e307011614ed5a3806fe9309466c62aec5c23d0e47666

SHA512
9d0f6019d993c2eefee3d202f335040d219573c66ddfdffa00a4a83eab55a8a8ae25b6df18d678f0711faad3672e4885d640f344e4beeb04927440759de63c9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd51202ce2a0b1725c677c3eafa744d3

SHA1
2644606c68a91d2bf9a38e8354981d9407fbc698

SHA256
e666c9880c0191c7990c4edf9e01b53daaa221092a413df0f02ce14db344b893

SHA512
032272269a5ac972893bc8d9ad61ba4daa9871aedc7eed56573d43a3934c0822fb84c118a0d15fcfd786a859e8a37a73b10abfe96ec33e3650ba480f48530002

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d9936fa34cee6990d7e69b7f2c2bec7

SHA1
66a0fd52268fc22f5b9b0b6b28305e379c927c72

SHA256
7ee2b2076614aeb4ebd0b08108029f7b08f4726b0b7a2674eec5d6d5899dfae4

SHA512
51cacbf2fdb6f1a81fb623eabe2cddf72c1b2bb4a06e00bc1e8c764671ed1c6d9092cfffbce5e614c6df8f97ba20f949b9e5547ebaed7373bab513ba2a7a273b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3251c24410d766821b6a982071d96a7d

SHA1
18d7af51fd4c9fa1f31c44f80322abd1bfe92d09

SHA256
162093a48a90dd4fd6758b9dfd6989b29750734af7c10b0a51e6542c6b797d17

SHA512
497f3b35503fa02604ff71f01425f0af57808afc33bf787a26cc54007182ff8666a34e5fe04217aba183665899bd9cd6d760123b51ae63b34ef56f1bf217c781

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a71e1ffc18d25559c54b841197443f47

SHA1
2e020530aa95fbed8e9ab114f47fa555881a2546

SHA256
5f807288984afe62c52c35289e66bc5749051e5f0da22c6afdf07756f718b287

SHA512
ebb92f5c388dbd907dd738120b7f51dc902cb177997239568a9ff1dda5473129fb5b9d87e5d153c57d4264a0f725df5bab6d2478ec955bf97e1c155bbc82f03a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68b04e9b32dd46c8052aeff7c1774825

SHA1
a5a7a799a48a2e43d7b8a720c98a3e16606543e4

SHA256
9d341aba7b624af9070d47bdffd4415e04430a3467a703104dd6a7bd57590a73

SHA512
56acee4408e1834e23dd17e520b7e57ddb02feb42ebdacf10610c3e8713eb4e0c02026d046ff16038f1faac24f8a6068c5098b432cdd92ef6233cdef7c2c1ffa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b95093a985437f5029c7e5f65bffdf34

SHA1
81e8a72aa08e53c798dfd4dceb4d4b38df7bd09d

SHA256
99fffef327dd31d7ab1188347637bc59a88d1cc5f329e480f2749529b56fcc15

SHA512
9c89c28f24d9a3fb5748e36b7594c9356dcbc37aeeeda3d721a5a4700f1306bc3a1a1f3f4872544096b75fc4d0172a8de7734d8e47d337592d7d4c18d8e637ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86d04a8de1c61f2235742294fac64c51

SHA1
34a3a8c6213fa593c200bb0284dd92ea411ccc52

SHA256
ae615684c7edb81e18beb7a3221b43ace1d4fc8ddbb81bd856153afdf4ebb01f

SHA512
be8f7b5d73cc085bd2f6a9a64a5638188f63f33023522e66c34f7620c73b589f43d530379c8b8a91b83b49df0f9eb64b845d13cb62f396911bba6849e8f777ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d96505413777274c0148c058dabeec94

SHA1
fbcb984efe06906acb6beb2e1c2009fb68e57b5a

SHA256
7e4bcb76fa734ed1aae22bfe81a89b87c9b69a20c1fcd103d2c2926ff1dbcd78

SHA512
9970a5f8ef86f6d51fa8ad845614a80a05e17cf9e285673b04a7b13a7f8ab98d0bd0322163f0b924ceea93c0622ebb74329304dade5b5cb9c800e16ad5b31dcc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab20EA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar20ED.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
memory/2116-38-0x0000000002300000-0x0000000002400000-memory.dmp

Filesize
1024KB

Download
memory/2116-37-0x0000000002300000-0x0000000002400000-memory.dmp

Filesize
1024KB

Download