19abf7ed826edd9c98b153cc27b816936e1b7078c7c88c50844f05e12cdc206f

Analysis

max time kernel
44s
max time network
147s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
30-11-2024 05:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4f4957b8ace5c6a91d9178a03f33b97_JaffaCakes118.exe
Size

135KB
MD5

b4f4957b8ace5c6a91d9178a03f33b97
SHA1

6cd8463d611c84b87e49f0f3541530eb08e857c5
SHA256

19abf7ed826edd9c98b153cc27b816936e1b7078c7c88c50844f05e12cdc206f
SHA512

da40e95e2b6560acab16d2a151bfa1e29f15f88907dd73e659c8b16583feed4d6e2847423d0bc2b97ecb951dec72066acc5151f91baf0c52400e774e8b1490ae
SSDEEP

1536:37v0kchIvFz70fiVdqDkhSchSWiSDWP/OsWQH6CazASXhXSWLlWT3PmcsYN/Xzgi:3ooF4iVdubWibOQNi3MWL4FksNYFfPK

Score

10^/10

defense_evasion discovery evasion persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	plugin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	watcher.exe

Executes dropped EXE 2 IoCs

pid	Process
2152	plugin.exe
2848	watcher.exe

Loads dropped DLL 2 IoCs

pid	Process
1268	b4f4957b8ace5c6a91d9178a03f33b97_JaffaCakes118.exe
2152	plugin.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\Module = "%ALLUSERSPROFILE%\\Media\\plugin.exe"	b4f4957b8ace5c6a91d9178a03f33b97_JaffaCakes118.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	plugin.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	plugin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	watcher.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	watcher.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\ProgramData\Media\plugin.exe:Zone.Identifier	cmd.exe
File created	C:\ProgramData\Media\watcher.exe:Zone.Identifier	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b4f4957b8ace5c6a91d9178a03f33b97_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	plugin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B0495451-AEDA-11EF-B45F-4E45515FDA5B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a907cc1344750743988d8bab481dbfbf00000000020000000000106600000001000020000000fb6b3e7177abb1d420fb68fd61eedbcbead638f4da5c78b762f57ddd4c30ecb2000000000e80000000020000200000000626e624f78693a44196d8db7b7cdb2cd188692d1dbe1ecf0ebdb545d4ba61f92000000001e1cb076fe3ff59064fb26ea57b4e3003d74f2da745d560d62e7c7bbddc78f740000000b59b3f5d19646303732ae9fee0e35c75b5dd14a5eacb40e49175f4e9fd08157dbd5f17c8816101f06240234545d00dab399da0a4acfb902e77acb8c1f62808c5	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a907cc1344750743988d8bab481dbfbf0000000002000000000010660000000100002000000005b720fa27277a38f04d87c2eeaf556324f809526c692ddd8146235cd0c6b844000000000e8000000002000020000000187a2b5ec091928e2c96471304b38dfc11c24f349224cf7cebc3fbcd73d1690d9000000099925f5d7f321709e86c8c2b0392bb6ae7a65bc4e54912439b7e373836e4f09bee286eb07f4d4785ca77c1db5f11db6cddcbea9cd64057ca4b023a9df1c8ac1ff2b430fd7f33f4435c07f2c03ae04ed6a1370433a3d70e279c6a5342a909be4426fc9ed5f4cfa7853773007708caf1edae28cdc680d63916246111becc7d9bc60dd3110723b8b0f05f491b479a72d49e400000007d2275aa90b85b208e613b9ddc688d74ef72a1f354f52efb896950cb5112b1e43b6fe0ab90fa29c1d7c44d32cb9e651181c059f52484a2ae0bb4c4d1d93fd1fa	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10442287e742db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\ProgramData\Media\plugin.exe:Zone.Identifier	cmd.exe
File created	C:\ProgramData\Media\watcher.exe:Zone.Identifier	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2152	plugin.exe
2152	plugin.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe
2848	watcher.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2908	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2908	iexplore.exe
2908	iexplore.exe
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 1512	1268	b4f4957b8ace5c6a91d9178a03f33b97_JaffaCakes118.exe	31
PID 1268 wrote to memory of 1512	1268	b4f4957b8ace5c6a91d9178a03f33b97_JaffaCakes118.exe	31
PID 1268 wrote to memory of 1512	1268	b4f4957b8ace5c6a91d9178a03f33b97_JaffaCakes118.exe	31
PID 1268 wrote to memory of 1512	1268	b4f4957b8ace5c6a91d9178a03f33b97_JaffaCakes118.exe	31
PID 1268 wrote to memory of 2512	1268	b4f4957b8ace5c6a91d9178a03f33b97_JaffaCakes118.exe	32
PID 1268 wrote to memory of 2512	1268	b4f4957b8ace5c6a91d9178a03f33b97_JaffaCakes118.exe	32
PID 1268 wrote to memory of 2512	1268	b4f4957b8ace5c6a91d9178a03f33b97_JaffaCakes118.exe	32
PID 1268 wrote to memory of 2512	1268	b4f4957b8ace5c6a91d9178a03f33b97_JaffaCakes118.exe	32
PID 1268 wrote to memory of 2152	1268	b4f4957b8ace5c6a91d9178a03f33b97_JaffaCakes118.exe	35
PID 1268 wrote to memory of 2152	1268	b4f4957b8ace5c6a91d9178a03f33b97_JaffaCakes118.exe	35
PID 1268 wrote to memory of 2152	1268	b4f4957b8ace5c6a91d9178a03f33b97_JaffaCakes118.exe	35
PID 1268 wrote to memory of 2152	1268	b4f4957b8ace5c6a91d9178a03f33b97_JaffaCakes118.exe	35
PID 1512 wrote to memory of 2908	1512	cmd.exe	36
PID 1512 wrote to memory of 2908	1512	cmd.exe	36
PID 1512 wrote to memory of 2908	1512	cmd.exe	36
PID 1512 wrote to memory of 2908	1512	cmd.exe	36
PID 2152 wrote to memory of 2848	2152	plugin.exe	37
PID 2152 wrote to memory of 2848	2152	plugin.exe	37
PID 2152 wrote to memory of 2848	2152	plugin.exe	37
PID 2152 wrote to memory of 2848	2152	plugin.exe	37
PID 2908 wrote to memory of 2988	2908	iexplore.exe	38
PID 2908 wrote to memory of 2988	2908	iexplore.exe	38
PID 2908 wrote to memory of 2988	2908	iexplore.exe	38
PID 2908 wrote to memory of 2988	2908	iexplore.exe	38

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	plugin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	plugin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	watcher.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	watcher.exe

C:\Users\Admin\AppData\Local\Temp\b4f4957b8ace5c6a91d9178a03f33b97_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b4f4957b8ace5c6a91d9178a03f33b97_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Windows\SysWOW64\cmd.exe
  /c start http://youporn.ru
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://youporn.ru/
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2908
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2908 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2988
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\ProgramData\Media\rdb.bat
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  PID:2512
- C:\ProgramData\Media\plugin.exe
  -wait
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2152
- - C:\ProgramData\Media\watcher.exe
    C:\ProgramData\Media\watcher.exe
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - System policy modification
    PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Media\rdb.bat

Filesize
97B

MD5
5303b5018a6cd19200b98d31ab04f25d

SHA1
8285eb92f131111e40d2dc864d3b386dad6b9129

SHA256
464648d492af6bb50cf65ddcbdca3e90d4b224ccc6f4ce3944d439b6c32da524

SHA512
654aed00850f6b7e424a5ec5acad086a51fb54f5f944238979f43fa1aac430661250210fe5f38dcd78e46311adc7e6b282cb5c41bebfe5a7d297afd6db6de21b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
f9b537a2b00c7b695076dd6805f4af5e

SHA1
e0b683d522506e18ccd6b5ed3571c7d2e4a5ef31

SHA256
562522b4aa35f3ab3b102c9c0c8a816e59ba105f006525c5df2509594d2d156b

SHA512
3d52e4ce726fb07cea6564511e663373d51c4388ffd0fa444231d6c9c5a80227e0161b41dd4329b3e1d00cc164db36f733909fab4fed6c30563ca9568e41ee97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26fad44d4185032e9bb3c5e359fccd17

SHA1
3feb77892fab7b2cbb5bc0244c518a13896fb3ea

SHA256
24d93ecf52278a2dd4c7b50caa1125b482b631363026209104bc98027c644573

SHA512
72461d0dded96cfa22d6f07f818cbbb0bcf5ef817f0c9343b6cbd7100e08a67c06d93d0ce047eb6f55222dd227d5901c316acc48e10ebe33259b2fd5e15159d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
acba8da094c8447cf39328eef1fb0069

SHA1
783504d080007a6b8f946031b769b09ef93e8b0e

SHA256
9e54f0691f434141a2be051b61dc650fc373cde5d5cc7d8b21251ed29e62e041

SHA512
fffe519c407e8b9ed81072c30ea5ada19389d669b9b5562f235ab2079d6d14976e9f68afa728baa86667abb20b6e20da63a2e32ccf3e3447494f46d8cdf3eb16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
acb4feb08cf5697cc4672b10b0d2a504

SHA1
8ecf104de7906a1fffa235463925213653a53b4d

SHA256
332d7a82e259a88c79489431739853c6d1f782b6f39fa6d4c66ae2c7b785e48b

SHA512
b56e02da410a6899b94ba1c09aa4a86a032ccd72b53139758a5743cdb39778cb523def80120d202f07301680ce95d84be8d8cdd36f74b86c063854091c6cb329

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28f1045047ff1bd336e16c507d742331

SHA1
3691eabafa7eca033b5ca5e58e6c814f7a386888

SHA256
912aba959a3eafe21d5992cdc040cbe92a36e4b4adac2870d229e2e0f3a8338c

SHA512
7116a033c274942c68d5cc46d7318db9df69dd36f17f0013f5f0d95f35a9a9a2edbaf5079853ad60afc9f4d07fbb1c20a63261523421eb5ab4ca84dac04eed16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
abd93b63a39297aa165571ac56fd6739

SHA1
7043f64e2dba65561f2d04ce1458a6083b1ac50d

SHA256
e3b85d7fd798931126c3789efd813c33d33edbfbb8627077b45d2ab3be88020a

SHA512
4f886ae8bd54095e148dabbac2d0c4396099a10ab945b1e187722253b38affbfb6ab310c89bca8873017e2417247bfad3b181447469a0b273fdb27c4425b5148

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b00061bc6409940487f13a98bdacb6ef

SHA1
dd5f27ad7c4e60f19f3163c592beeacc2c9fcc2f

SHA256
c3c9009cacd91c0e38b78d9e65feec5987fc269a2b52fddf2156aa63d1aaad90

SHA512
1fd0eaa2816316998c7b6e6796f40d3135cc0e55aa78b6f6077941ebbb83b2d390340dc64f8666f84ce52129c9ff7e1ba424c2ee0e80a1ec1b6ad1d5d3533b9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56bebefcbb860f09435f68c8fe3dd89a

SHA1
4338f3e911ddfc3ad69c2dc3dbeb8f98a31dca56

SHA256
9b930b8122a75d37a1568cc5e713a6532acab5901a83fc5bbc7b153ca7ad0ec9

SHA512
3a2b828364eacc96661e3cca9e6000e401d011b4d6f2aedd24464c73503c34da838d73b62f8d5e98dbbd044847b3719c10f3dc35de3af5ac21c9ac90584adf9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aafceb97b429fbfa8ed7fba6e4cb9bfe

SHA1
6ddb206980e588bd2903b36bfebf183dddd03387

SHA256
ea5d509aba17f38800e04d9877cf1e81dce90d8ceaa593bf99f7133f093d43de

SHA512
d2f0e03ac66608104a2a37ccd64785de5e07d4ddacc37f529630ec3a74675ce4b14391a84686de46246a9aafc0014c82e862d79072942eaeb0d7ed78f42823d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
892b36b66826dc247459d78e5bbd6347

SHA1
b05f5f892ae055ba1cceb1d12eeeeacc4c96b961

SHA256
cecd41953298a6dcc3f437e7bdc80dbad8e5b5222d0c5cfd56c1a84851062e73

SHA512
ad4652de28bc9964e11c5dee9ce92ac1d9ba1a433b068efcf4da26adb1b6399b050528affad5f5b26a9f159a7398bac92d3181378e94b819109b5211758649ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b8baeb3460595caf8dd5c46a58d52653

SHA1
7c62e71260df6e930b79bc98c3732d1020f697cb

SHA256
70d40faeebc6ecad7d65eb46a1bda1fea560def0e4bde3db8402c6e6d09dd946

SHA512
54438f26c8e12b5b66887189922d12fed5acf7c4b3be18fedd8cd996ee5a59781f2328646cfad02f3b1fbfb4169b7df19224c15894a34ef543e0a6280d7a3578

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3773f2e39c53d7c11de67cdfc7c68f6

SHA1
38f5e3b601ada50e0f0035268dcd02adf6f13400

SHA256
b5b3e2f26ec736c451858b2da8722372183bbdb705e71529d0ab640459113235

SHA512
dbb31d30a695bf9eabb1893e6e5760337efda11381d77683f9b5fa845712252edf16e4129840f28a8c371673b32a59a41c2fc10607117e317d6ccb45c73c764a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
837d0a7babbdceb6cbcfacb33b3243ef

SHA1
df64f557f605b2c26bbe3707069fb52803bb39d0

SHA256
8bbf312323a1c42a2e06f78c1c58b266ba1e540d4d04edec1151fac84b1117b0

SHA512
677dd419ecaee858d220efd56a34a7b32b1f0b48bd1cbeb9e3aa4201adf81fdf9ff3b6b91b7db03ece63fae270411627ac04067de010cb98ed26609a52b25cbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66ea51c65fb3b4f949918778e707889e

SHA1
4e463519a9b0fbf4799db3736f8e94a27f33d750

SHA256
1a8a40c8bb57e8788163d6f51af8bb01d6e8ea09fdaa7b0290c4ed248fe5662b

SHA512
1b759264e5c6626e3930f43fe56ffb6d53ab4c1f31a22521587f69b3b66916d8d36bb61842fbc7199000cf325777f4acbef2193726c873af5490cc718624ecc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c402a9177d23269671054a0e191140a3

SHA1
0c25709f84d910d8947bc7d79c1ecb7316d83f30

SHA256
2bed7495ee76c4477452a400834767daf0529c878c5680cfae77cdfd0ff70a2d

SHA512
f686a35e197641f08b567a0abc298fedc3689c574c6ce557b039016fc3edefd163c9e49648e176ae4a98cf553780bbd25df1f5ed6065004f02bb88aa705fd99b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
467ed9e312e1a4eeb655639f0c77edf6

SHA1
5a71b2ac58916c0b0b201c1e1fdb28fda0b1c4b0

SHA256
22313e887124a1232e9bbe5e036a0b50ae647d89916f2c42d61fddbb86a1edfc

SHA512
b7dab6834954fa4fe8bec2010eb9b8b53c1ba40b75efcaac2542d0dea857cf260f8975649a990a63e820d5f84f9edfa95b2d43da584212dd9c27f795d9baf1a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e183c37b3241f0181f1adbd5e5d63040

SHA1
bc545ac88eec050e508bd019f63ec21e82b6d79e

SHA256
97e65d2dbe1836a2feadd904145a6547a9153242007aad72fe117f743230e17a

SHA512
52341e0d006480009e74bf1cdb392419b45d61d7aca510e333749cd317a642991b3909d408bdad4d35da3ea17a8f594bae4f17d021abceac144f2cff083ebd8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e0a33048e621ef4fff36c82b5cedca8

SHA1
5250a946da79c1c2360d29de8a1d80140edebd9f

SHA256
81991c5a42edc652e4761d697d9a695b760e59a190071017962c06cd6ec4c0aa

SHA512
0072cd602d56cad140d7c9b23943ee7aa83c4ac81b2202638da05b4ed441bf235b1996e25bbd0c397f2a8556da9b54e2c6f0735fd5131e2678767d946ba7167e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76ce0cdf98865c413984b5dcb6bad6ba

SHA1
b98d3e9f7cec1fecb541073388cbf9d06e64c389

SHA256
e9ee3a3d08a62802c72362cf8585b1c9db0d73de4e37dac7f3df68bd60bfd7e9

SHA512
8e5ea44f9ceebf14f08b93582c07c0d6c8332a251cb2628fe8f6dd6a98bc1f7b97fa2b09d06a1513ba92e8ce742bb217d16273957a6cfc51d8d9eaeabe471fe7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
46b9e5dd72bd512d9416a550538b0ca6

SHA1
6d7fe8cfa89f8294af61761eadecb8587db5edb0

SHA256
471477c6190ca841f1916cb44927021ac9e6595f261f57ec245b01bcaf41c511

SHA512
98e259fc83c8b913331a40edb075c3fd43aaf3667cb382dee3d0b6ac9017e10a121902ba77698609b6722ca51847cad29cdab5af3c6b2217da43a1749c34a3ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
29af204b4a932e96de28a550ddf9cb25

SHA1
7c0377846ae8b912a9485849036d555b88ee1b28

SHA256
fabf97cdec497d425abfb139028f820ecc87bcfb89cc0a090dace8b0e0dd1038

SHA512
56c2e53d12f44c6ab0d1c8ddf7af7ac25854c53ae0ea7898446614cec16c4916c7f6f676b860335f81d357c028797be30fd4514d7cbdf99290c67749775e01eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE041.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF440.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\ProgramData\Media\plugin.exe

Filesize
135KB

MD5
b4f4957b8ace5c6a91d9178a03f33b97

SHA1
6cd8463d611c84b87e49f0f3541530eb08e857c5

SHA256
19abf7ed826edd9c98b153cc27b816936e1b7078c7c88c50844f05e12cdc206f

SHA512
da40e95e2b6560acab16d2a151bfa1e29f15f88907dd73e659c8b16583feed4d6e2847423d0bc2b97ecb951dec72066acc5151f91baf0c52400e774e8b1490ae

Download Submit