Analysis

  • max time kernel
    92s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-01-2025 21:53

General

  • Target

    JaffaCakes118_bf77575e35353666d14f859329f809ca.exe

  • Size

    6.2MB

  • MD5

    bf77575e35353666d14f859329f809ca

  • SHA1

    bf6971bd549f142cbbc55af77ac62583c037dcf9

  • SHA256

    90d5e4b6604b118f18ec88b7f032454493c0f75616468d217e7a481678d3f8bd

  • SHA512

    628268b5b9190dc3c358ce22d61e353b14c2cb3bf80a721072c5b9581a3fef87105b2041d7a3c178143e4fa2f7c5412463b9849ce1ca7932623272b0f3535736

  • SSDEEP

    196608:L+gqLKB2pDcLmoduFZ1TS9zC262x7QDEMqQEd:L+jOB2pALm8i+H7+bqr

Malware Config

Signatures

  • Babadeda

    Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.

  • Babadeda Crypter 1 IoCs
  • Babadeda family
  • DarkVNC

    DarkVNC is a malicious version of the famous VNC software.

  • Darkvnc family
  • DarkVNC payload 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 12 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 13 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bf77575e35353666d14f859329f809ca.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bf77575e35353666d14f859329f809ca.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3200
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\adv.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bf77575e35353666d14f859329f809ca.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1735873368 " AI_EUIMSI=""
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      PID:1676
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1848
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 864312BBB7BE78E33B005FEDB4268383 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1992
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding EA667A7BA6D8469688085C8B922AF296
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2496
    • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner\synctools.exe
      "C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner\synctools.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3408
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe
        3⤵
          PID:3444
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 616
          3⤵
          • Program crash
          PID:2448
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3408 -ip 3408
      1⤵
        PID:1572

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Config.Msi\e57deda.rbs

        Filesize

        19KB

        MD5

        3a2fe5a5ab93e4742293ca863ef66fe9

        SHA1

        de1ffd0a9028051ade029f15564313db9b5d90b0

        SHA256

        f888550be27f4e84d3e2a6b56b12151cb2d78c8091c540b6467bb5e986f15144

        SHA512

        dba9ab1a8e02f800ceea451b85e73365581fad1774fe7894e5571004d85e228a297e39544677b1d898f40e2e3fcd8e496a899d731270490bf9d8f9c5091ac322

      • C:\Users\Admin\AppData\Local\Temp\MSIDBEA.tmp

        Filesize

        391KB

        MD5

        a32decee57c661563b038d4f324e2b42

        SHA1

        3f381a7e31f450a40c8c2cf2c40c36a61fb7a4c2

        SHA256

        fcf24b9b574ed026d3f68b7b70aa6533806ba7fc566c476ccb62e6493ac28f04

        SHA512

        e17c125adad4702c9a30639858e22a2f0dc4f2926fca89758d544c62fe1fb95360dabd5bd2de2f62a607158bd9ef108c60d8cb5ce709c634668ee509988214f9

      • C:\Users\Admin\AppData\Local\Temp\MSIDC87.tmp

        Filesize

        864KB

        MD5

        4e2e67fc241ab6e440ad2789f705fc69

        SHA1

        bda5f46c1f51656d3cbad481fa2c76a553f03aba

        SHA256

        98f4ebaa6ea1083e98ea0dd5c74c2cb22b1375c55b6a12cfdc5d877f716de392

        SHA512

        452df66dd2b09485bf92d92b72b3ad2638cbf0a570741b80309056d1e67e68a18cbd0ad3616a2943bb29de62a057848a7382b6c64c3821335a51b0a03131564c

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\Examples\3d\3DBITMAP.LGO

        Filesize

        3KB

        MD5

        c7eb72cbf51334c39e297403a6e00e5c

        SHA1

        eb8e6b0b81888da182730c055ad228907c0e49b1

        SHA256

        f29fc7faf7d4bb8797367c5ab027c797c2af33edcf081efa9daa7a7e7bd9ee0f

        SHA512

        f6e79a3e723baeba11b21694d5177d8211510ac69e770f9f05553094c681e91613c2e6687da1b253a72d9e242c9975c25d62b3493fc070a1fdecd41cf3bd02f2

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\Examples\3d\3DJOY.LGO

        Filesize

        2KB

        MD5

        1dfb4a0a7e6372acdb89c2a9817284ea

        SHA1

        d87b2a9d393c3515dc2712c93727db41d600ad80

        SHA256

        e10b673f954c12e31812afd7773dee18940fb46b2fdd9aa70ea9ec3d4df4b488

        SHA512

        f80b3215c8c7162be25c5897e5b2bf60461299eedb18d4217e73ca2607afa6dcbdf9c3ee929eeac8f7ed6761febebc068451131b9cbfb6c625c50a8e7ef0e96d

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\Examples\3d\3DMOVIE.LGO

        Filesize

        2KB

        MD5

        85319eb1c4096384e18e71658148190e

        SHA1

        7cea0551747d67b4a08b6f78ced0567199f8e38f

        SHA256

        979982407f136490d2d2788055cc0feae741f584f8daed331f18cb5ae969c287

        SHA512

        2d20c9c509b929f6220bb62b047177db9fdf4dc6c891733733c1db0c3deb8a12a802cb17ba1567cea5b3b24b0f707ae75be0108dea2b23c7086abf931ab8db66

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\Examples\3d\3DSIMPLE.LGO

        Filesize

        1KB

        MD5

        77eae74dd7bd2ca9982bd2f12adff615

        SHA1

        9c82d2fadc1ead2cd0848a261b1430b49f806e79

        SHA256

        4018202e5192fdf1e92a2d4784b884af3c9f27409cabe16a8f1b8803df599ccf

        SHA512

        0d2c268994584fa15c88e54f7c673349ee259f006a40b69098b673d28ecaca6042840b98198015b80cfd61b106b2585ff05f47e6c470b4e8a2aa6cd967a6ffe2

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\Examples\3d\3DSTEPS.LGO

        Filesize

        8KB

        MD5

        8bb174bb497395b6d679af159b75e9b1

        SHA1

        6e286d495c5720c6c236f2d521e4baa7affd09ed

        SHA256

        520cb66f51f5822ab2c164fd23badf8879f3c22f63706a9875b4f3d87db0919c

        SHA512

        6ab2ec5c91442c6ba0412d6d66b65f274fee303a053f883ca934bb8791c18871c239347967c1ccaaf56724aa1115a39257deebfacf70abc7ce7d8c6ac715122c

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\Examples\3d\AXIS.LGO

        Filesize

        1KB

        MD5

        3be7e79f251f5dee60215a123df636bb

        SHA1

        5fce52c40ad8d6054f77bb5e84cfee34b145c447

        SHA256

        288e25d6e2b5346eab20256bb581aadb6e3752076412d60934642f79478be20f

        SHA512

        02d9ff2aefd3e29786f5b674b6d3458bf25ec221d093f1f6ae3ed6828912a2e7cf421fa3166081cda2e9fa0deb6497ad767510d22d63bf702ca644a6a5c64c76

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\Examples\3d\ICOSAHED.LGO

        Filesize

        4KB

        MD5

        1a52a14106fd3e659d3f960f7cf45ab5

        SHA1

        72e840e28848c0e0ea0c60eae20bfd775043c8e3

        SHA256

        9caf0a5e3ea51b7125a67fc6a8acfc21aecce0bb35746bb57c0abca8e9c801fa

        SHA512

        e2d81e0d9f9f9199296a097e859859227e31063110568221deae5a6651378a45920915a57b6c84c64e1ea497fa59621d0491133d05525b46796735f50bfc6a0a

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\Examples\3d\SHUTTLE.LGO

        Filesize

        2KB

        MD5

        ba4b027fb49d27471ee578dc93d5296b

        SHA1

        d9fdd8bed9931dcdb2d3f3056cbd5286d903c6ac

        SHA256

        0d4839f083cf2037256048560fb3979113f2948941d580158dde559429491ebd

        SHA512

        65bb4b4fe447c5c86bde7d4e85b524cee9e707c0ab10f07df189fdddb844a1fa83cc29aadd0c99028d71a17a6158ae6b3104ae1cd4a01cad60ae0daf84efff0c

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\Examples\3d\fmslogo.bmp

        Filesize

        66KB

        MD5

        074091f21cae34e830cac8ef5422b840

        SHA1

        2cf882243c45a7bb657cc74543850c07227ffa3d

        SHA256

        f8656e1e1ab41af29efa9550769e354e7e0f4476b802e32090e706880ec86603

        SHA512

        62ea398ffa3be0ad6c128bb51bb6d28d9dd2366420beb88a357d27f3a3d3951e69b822e23c6f4389d994408e647c4ee294a37f71615a4945b7d25ff851adcd81

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\Examples\Misc\CAR.BMP

        Filesize

        1KB

        MD5

        5fc366b3371bde5c769a8c5b9d0ff966

        SHA1

        124f3a48111e1adba8cbee101655d6bf438c9129

        SHA256

        4b0231a2577be467d7d37612b75e38d6e944b7ba757f7fe1c36b697e0fc5ee46

        SHA512

        e78445e2e70e7ffe3100ff91f5c388817b3cec3964e58ea3e5f415e221c88faf421712d363edcb954ec32d929f6c9e7e3da9e8fed0877e2516312afc5fa585b3

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\Examples\Misc\CARMASK.BMP

        Filesize

        1KB

        MD5

        afe2ac27f1ae91549f64971d1ba81e1c

        SHA1

        a717af1a26506bf440d8ade244e12b9283b2b7bc

        SHA256

        c889fe2430b247aa02e7a101360002b88151cfef4df3a99116c22ee80040db0d

        SHA512

        15f45e1a6743fd2d6b2ae06840466e20efa3018e659f3af65bec14ae372f42adc9ac81e5745c38ad7ae40d6c033d087d82699975afc482d89e441b772ed4703a

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\Examples\Misc\CLOCK.LGO

        Filesize

        1KB

        MD5

        c4acddb7dacd73b0a509fc54e9c607bb

        SHA1

        9f1e79be02b00a5eea5d615094eda6ffc4a45af0

        SHA256

        070086e62f194b7de43c7145508c1e68b8081d7c8393a43e4c49d6e5a147143d

        SHA512

        e21ec056a9952a441ba571db14d681274b1384e6dd10299d193223516f6ffea9bcc31c3bc114bc9cea8e71c9ce15fc483e7d51ca0295e8d3cd02aa81838ddb17

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\Examples\Multimed\CDROM.LGO

        Filesize

        638B

        MD5

        b7e032a03eca04ab9a57cd9378c2daea

        SHA1

        9819866aa84e9f69ac1cf244306e4055c20376c2

        SHA256

        4dac6972d0437a91f0e8d122c2d5a3b3dbd7ea7cae44ba30a210b948b7bc8082

        SHA512

        1ce2cd639efb2ac6ad6dbff9ca895485fd67d27b0497973003957769c4a9167288816d21c61af047500caf7f16cc0822a3b7d6b6c44a76ca64fd12d95e0d1544

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\Examples\Multimed\MIDIFILE.LGO

        Filesize

        1KB

        MD5

        6ea09ca25cdfa1ce3f1ce56fe71a9d6d

        SHA1

        e9056ee56f9b94271deabf6641186536a39b0953

        SHA256

        75a5dd57944dd55d6c3b3a99c14cce5b0e78701594dce3aef69c3fc5032c1520

        SHA512

        b9bc85a5ed091cc8661e438ce0aa420b23397be562ccd750f0c89cb2fce5cf7300feee5a8cc180ea2d1f132ddd70ba850cee4c088eac4aab7edd8ba19d244a17

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\Examples\Multimed\PAINT.LGO

        Filesize

        9KB

        MD5

        ac8a45e9af464471cb24ae03f6a013eb

        SHA1

        7e5d6fbc7f8a2e602400d5b5cea72340604c26f9

        SHA256

        f6233aa2a13cd8a69a0121b10a4980263b697dde777db0019117d2f7d0ba5405

        SHA512

        6b2c9097af60cc08f54c783852a272eb29956a86b6e215f8d7d245054dc309126a49c5561aaa06e1ca439d2dd8461d516660f79381cfa15116feb80f89d07c1a

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\Examples\Multimed\SHAPES.LGO

        Filesize

        1KB

        MD5

        0332b5c3611edd45f37327f77790bdb3

        SHA1

        2d7c75029ef8b90ab5967882477a359a75c3ed7e

        SHA256

        5ab5a634483c48e05ffa3ae23615cdc5aeef699e374c9cbd0e6a002b4fab80e1

        SHA512

        0ec71ac30c03dff87baf70808add8b15cb13de990f352eb50140ca78bca5b85dfc0b292cc527ce6f6f38595af7552c747dc5354a09aa1881058418e9c3cfb1fd

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\Examples\Multimed\SOUNDS.LGO

        Filesize

        1KB

        MD5

        f7057962212a95c144bcc6e60aef04dc

        SHA1

        abce5ff6866f17549efa4c236e337e8ab79a1087

        SHA256

        8199e3101e53dcba42657fc9a83aeed957e1df4dde0a9aa6cca7addb9a02883f

        SHA512

        b2e5521debecd8589d6dcd1a112d0f39c04d2d121bd2bdb821c7573aa6e91f7523361aecab58404edc90144c2563f84b2ba3fc3111c2aaf52b0d420a9e0e822e

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\Examples\Multimed\VIDEO.LGO

        Filesize

        858B

        MD5

        41e2e2486bed7aa9f30ba50886dc7091

        SHA1

        b30e92ef28ad24604eb52f8c3dcfb86e6a155285

        SHA256

        1d8bb0715855870c869995e6f118cc8cbca85e777491a8dc343707e1b85d1714

        SHA512

        ac1ce071612fe55a41c57ca0b26ecfd5db2f694be7c0ab0cf87a75b9696003717907c3c73cc66c1d60808182823f5c59cade7595b9f04d7f93c98ee407a84a0b

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\Examples\Multimed\sonata.mid

        Filesize

        15KB

        MD5

        d67a9682a6273e3f17b10ac2a3eceece

        SHA1

        1404f805b1358be8b56f8f44323497fa0b9d1557

        SHA256

        14f2c63e55954ec0b8e8b1fb3900abc0cd13aa41fbf24273154683d3470ea28c

        SHA512

        8ba7515a3888d1fa8b2bf1e1f6f1646cd437c4d69aba32e97c98ec66ae0eedf871a1de17f081dbb5741d6e04992911bc306c2f48bf088cdb580d5491b4399e7e

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\Examples\Network\NETLOCAL.LGO

        Filesize

        559B

        MD5

        886a6ec4c437b9d71c061c0b95f4fd40

        SHA1

        9e601bb54017a9a24df60b6c5709b86321fbdd60

        SHA256

        04ebc67ede85c171148c4a41c19ddfaf64a8342c6d10aaf97a3b7dc8da08ae76

        SHA512

        b2ee5ac1a59e3003469435b1138e7d2b64f0cee50eb7c7f1e47daec9d6d222b5c38f8ee0e482865d2845ef3bddeb0b0c525121f5a7bd1386360363529190f023

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\Examples\Pascal\CARDS.PAS

        Filesize

        1KB

        MD5

        b5e99669b838116e212ff4cdc97550ad

        SHA1

        2642129e6ca9263e465908ad3f2164442a5ec3b4

        SHA256

        9df2836c574e5597fde9decf6e626f3dfab36cb8e286a67ccc269a085f2263df

        SHA512

        465f0a13ec509c018894e2b0ce02bfe04c7458d4a4b398da8899a96fd02a61a5703764eafa4148d06b99263bdc8fa190d5fbf30b333be2954d5ac821f26ad281

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\Examples\Pascal\PSORT.PAS

        Filesize

        1KB

        MD5

        2fb755b503058af8136638e3e499c326

        SHA1

        6a94b44fcd62b4e869b1d80ae32a095e66a7c1d9

        SHA256

        eb2c42ed991d7e5da5191113799e7ae833d85ce67136769e1ebcbc3863a8e2b6

        SHA512

        3738381298b0234b2d6f0ba36dec9906b3bec6f64e57410e58c57a869e08844d2779f04872f2a1d13c8225acb477449a569159ac2dc3acf74f4e87ba26d96e69

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\Examples\UCBLogo\ALGS.LGO

        Filesize

        7KB

        MD5

        6adc19d9f3ffdefd4853fcc2cb7a7b7d

        SHA1

        0f245efb8ba7286b63caccd559b602beda8957ae

        SHA256

        4299e80f6ad590041c422c0927200b3effd2bb0a1bd186b25c5277e93c5d1ca6

        SHA512

        fa941a5a93f34dacd4f624918041ccd9ee43f94ef51f4dc9d25b4165af33594e1fcd6dcd85426c207a8c97bf9916c5ff9976bf1f0988790c268cdb5ec221c7e4

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\Examples\UCBLogo\DOCSETUP.LGO

        Filesize

        22KB

        MD5

        af2338b665a5417db65558498a59040f

        SHA1

        63549951dab5a788a2878eeb7842f09101bbb264

        SHA256

        5fb8b83555b911685ad6893d5d292065b46964a9b4a9a662406b0c93f72e370d

        SHA512

        a3478490d40492d99a8895a06716140d40333cc2fdebd70c345d577fb26931d2c9bf4f1194062c660fd764573526d5aa6c69d6e2843edf9a93b49082a30a6bcb

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\Examples\Windows\CALC.LGO

        Filesize

        2KB

        MD5

        038f7f7c01d85f43fb2db6e7fdd2f0aa

        SHA1

        96c34836eb5885f55808c52d4faf5c255d7d97a7

        SHA256

        4d5927b1336479d0c0fb6974e74574fc55fab91292d19ffe1ecc4fac490daf6d

        SHA512

        9b92d33e545f7a8d3e89b82483c8dd10c833e62bfd4c0986ce1542dd6376a3a1fa258863631d2921b80cbb955a596ced85c20fc838449961937a6638c9cffcac

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\Examples\index.html

        Filesize

        8KB

        MD5

        6e86736d64a4522b490c716cde97a8bc

        SHA1

        e48de1ddecfc842bbb8924c1023029ec21f838f6

        SHA256

        26d4e150e3fcb0b881d9cadf4adfc1aa369ca96e16b46c6935b7903d3916c04e

        SHA512

        67fe43cacf04a4844c4b11580ca549f4cb7fff160f32be5cd8d8449a6c47775f91a78b6503802615a5fc7e450358bfc53d486a07d302099fc73f8d67fa2b9804

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\LICENSE.TXT

        Filesize

        17KB

        MD5

        cab5d95bb20bd0f36241edd276851797

        SHA1

        31848479ee67d58a013f018bc165ce1674166c3f

        SHA256

        4cba25dfea9f5cf0454c4cfee27091740f8e556196330c010d1fbe35235dc59e

        SHA512

        c73db59553c69cf1d0cc1e945b2dfe38c59781c1d638bd8e044493732f255cb5f5b992a9db06086853608d81d7572f716922aa6a9042cf99ab1fc38c579ba478

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\Qt5TextToSpeech.dll

        Filesize

        114KB

        MD5

        99f5b275115a749309c0febb2c553a2a

        SHA1

        c3383e554c5c8d66ab1656603ff4f6d23568a520

        SHA256

        f4f008cec54534178cfd7164871adf4962c269e2b44d22491c580d2d589358ae

        SHA512

        f80ad1e94ae58ac5404e8a548200ec01e4941dd2460fa470fb6508c2d9a036d7d12f4547731999bd7dfa7ecd8b4bdf8a6ee4ad3d32ff07e39f6fb99ce1cb1f69

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\README.TXT

        Filesize

        3KB

        MD5

        2f271a2d2d92de5579f58b32f59993b2

        SHA1

        7582831fc25e3ce9c327706fd6d27f8a19e7abb0

        SHA256

        c3ffeaf3b4ee2c949c398e65dfeed95f8ef56da140b9a132c6d12d93d83dde2d

        SHA512

        7a0535c46553e39b507a994186b48c4d110296488306d6756fd42489dee5d317c238f725e44f167bb3f993d04fef996bad9956b40e86f42cd02b6de53b229681

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\adv.msi

        Filesize

        2.1MB

        MD5

        1ab81806b571bbd992717daf40ef49dd

        SHA1

        d93f1ee565f4029cde200b518fca803cc97d021f

        SHA256

        90a1c615944041326ccaa97e79652e704869d707bbb09bb83b871ed6bc2c2d03

        SHA512

        09760e4182b2a13ce63b1db6db6d0d0915d366248573fed8900be0b708f807f5e177562a53d2e77ea673517215974ff770d487265ac76b3e613b638a0ad37b9c

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\icuin30.dll

        Filesize

        196KB

        MD5

        3204dadc26ec04db0fadfc9adf914513

        SHA1

        fc4bf25277ce523b235b09eead166b05081cc943

        SHA256

        195a654a1bcd29d42543c870b72861fe07558c347426931b0e9e18defb445406

        SHA512

        7c271459281bb6fe596431ce1f4e48d95e6d58dac286f475700bbe5e48feed53cb0bab387e66b827334f8672ac502dc77655e9020f2db174d6a62e1bfc738d96

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\libEGL.dll

        Filesize

        67KB

        MD5

        2874582e39562af961a6d1c59447459c

        SHA1

        3cf7d154637aac69913b1f549938a21c7c4b16ba

        SHA256

        b1070d55627c2899d5928eff2f2e3187537162e93e189458fadd7ccfd6a2ca3d

        SHA512

        eeca63a7020346bda9a399b83f4e57b6b54bbb222c4a3cf7191ab7fe0271f6473bcc58f0e60ce5f7d5cbd57298b858ffa042b62ed9a9be0806e08e4c6f5c7091

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\libfreetype-4.dll

        Filesize

        2.3MB

        MD5

        cda01a2c066f5b01dcc183f3741ac3d8

        SHA1

        1848619e1db7b44518733bd9b1a9acaac7a3edf1

        SHA256

        84c79d9cc7eafc8754dfe215674f810fe265bc4e69ae8ca10000476580f7b17b

        SHA512

        b939449af537e54e37a6786296bac30099ade3d93d138cbe063b6ac99c4118d7a2ecdc9afbeaae78b8fa175781b7a7dfc52e4445aa7fd468f76732b55aa3a7eb

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\libgcc_s_seh-1.dll

        Filesize

        74KB

        MD5

        534b365361004828059600f05b34006d

        SHA1

        d8ff411b0939a021f47c845c6a90f1240bab5268

        SHA256

        438ae82ffd621a2413199155574cc85681f8986f05420b1485aa4be936c3bc0b

        SHA512

        1ccb3732a82f2fedca85c27afdd48e65dde70d5b1620e436d457624a2cb796887c5e7dc2983a0794ebbbcade3e5b9f9fc9320b390894471993c7b1e85268592d

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\libwinpthread-1.dll

        Filesize

        51KB

        MD5

        db18b7ec5f93127e6099744ea9568c1b

        SHA1

        e9143c76e308a816837e2f1a19dd0c5e2306ed08

        SHA256

        5bbef249a0d00e2d32c699d0bbe89f714ebeb872b3990a5cbeccb1d89f63e5e8

        SHA512

        ee1e645bed0bc3ad9e959d6342153e608ad21a7f5aef60b4cd8cc96fde7aeec4bbbb7474b59cab8ced8f28dc9f66cab32f4825333c891524901dcc40e70a1580

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\logohelp.chm

        Filesize

        395KB

        MD5

        4498d1584997d8ee7626b51f23bccdd1

        SHA1

        707c0b366848b51a16be5b858d021d1f687a4a6e

        SHA256

        1d8254bc535746478c18de7613731fbc87c5754126d260c40888d38c56007f81

        SHA512

        4cbb7f9191a39d5de8a8dedc054db71695fd54c292eb5a33657efd4483e6276427f076e9c9d49045282829dad57f04e07364532ed8bf96c3c55747ab66bc867f

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\logolib\#

        Filesize

        88B

        MD5

        f0a82f611f562197355d1d8b19de1fcb

        SHA1

        6cc0f96476fa9cf1f92e8d6dbdc3932d2c65c3f3

        SHA256

        ec9546682cb6e9f0cd51acf4e40a21d7e37cc5bf511718bf77857d82839eda5c

        SHA512

        fd4a2e5319ff95712bb663095d3989a21d2291aab1a80fe6edebe3178e6ad919fe3b42005a476f50d823c2224ecfbf5e3a569d360d5f9328cca5d61a999a0ef4

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\logolib\edpls

        Filesize

        43B

        MD5

        2c26ed91698c48237926c26856896a33

        SHA1

        8fbfbcadb2f40547feb3f9ac8c00dfba047dcc9d

        SHA256

        e267a396ac8c3d5d7b397e6a3a11b5a7bb380456e34bfa6affa7dd7bc8197b82

        SHA512

        924bc31885ed0f11fa6f4e10890d942e02b8db4336b013f6cd578cdc0520ed9fa451f05c3ab44738fd3e1798d5fef5614c97922881f346376f4062fb20a04116

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\logolib\erpls

        Filesize

        44B

        MD5

        e2f61a3e179e96b2552d68472b157f98

        SHA1

        1502e4db6d4607e3bf01b7c4a5a40aa939bb83d7

        SHA256

        bf31c8a529c1109938b70ad0b2098f47b1a225eb09d76c0a83a4fd01ae0cad3e

        SHA512

        e255b2a8fed46adad6d50718606a647349de28c61655b256c038e7b524ecb9ade6f17afb6602f637e6fd8477d0ffe0921e50bed0f7db0203b9cba7794ddd5e49

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\logolib\erps

        Filesize

        46B

        MD5

        3a9773d3c628a26efb158de5db1ef67e

        SHA1

        61e7b83995bf00c0cb8a506f31be47f31b257ef7

        SHA256

        f19570aa8b73e09307ca290ae4c13d644ce3d2a64c72681b673901e189bd619f

        SHA512

        f2bd8130f987da979fafaa956cd4b42e62312014df8f363f7f1c229143f5e357b48e0798a8b592b506359f1c723ab37aa272a40debbe882c7741d96c5c12a6e1

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\logolib\savel

        Filesize

        131B

        MD5

        e41d2dd16da472720fba2c405680ac06

        SHA1

        6479a8b86d125eae30d657b113d2da434f2695ec

        SHA256

        b97680394e1d7101aa9057bba2bbc1a6ff33bcf6be75e76ed5cbc337e272b751

        SHA512

        99377c2c5d1b8adb8a2228cb55ac24366c62921d91f09d1261fe4ad67ececcde8fcc1a81c6b667e8ad55d76a10f0ff7b1636e5c556408303972dd1af5b1d72ea

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\logolib\sort

        Filesize

        2KB

        MD5

        cd20b9c3705eefa651bade693c6dac2c

        SHA1

        a6331b125bc04c8564f4bbdba15abc1a5f44e997

        SHA256

        7d7dea747b020fcedec8a09bcf698dd8e781fe9c976cfe47af340c17d301a55f

        SHA512

        d5d232c4f238cfbc0e7a1003edab19e72504df9e4644f20a5de8bfdacd656fa1932abb3f17155c4ab0a182ef49715fb4100dd0fd28f700c98e29256d05c7331c

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\mil

        Filesize

        1.4MB

        MD5

        f19ba2037f7fabe1324ce080e9bc7de0

        SHA1

        9c5bb1c8ab494948c106a6a02747ffd97a4a3269

        SHA256

        f1d8d9bf22af094c7077ae97584a4e86d14cc7cd9b86b88e5d2332a4af7738ba

        SHA512

        db5d0cc5aff9b75197674e76518016458cd0612390695dd877f3956ba241ef24d016f913dbb2c394b8be97dffe1fe4826da65a73d414d96e3d6272bbb54a264d

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\synctools.exe

        Filesize

        5.2MB

        MD5

        5b03fc493384a87c0781d0c7227d1171

        SHA1

        7b019bb9767f97f007bc42e180c90e562590a7f9

        SHA256

        e029b852ecee64640b8b6615fa47445003492a34ad3cd69f46beaa16535abe0a

        SHA512

        625e3e5fb002b5d83e30973b532bc73ca881a73e125f1026805e2409e9feea2ed63aded408e24bb280b0b45974590ebf739f9c28e8dc7cc295a6bcfcea653d4d

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\14D3077\turtle.bmp

        Filesize

        1KB

        MD5

        8e5bc954263e6706359c06686159d143

        SHA1

        b5cdbfb8d0f200b580116404c6b6433b4df2c9d0

        SHA256

        bae9f06df713100360694f784164649e9595636e7a0ada30177152db0c1a584c

        SHA512

        66716ad105a16796ba27c40098e8bc2639107c858f97c743194a1a2b0076a3ab444547de1c2bd3b3f3923b1d9ce78364ed37a1af49adf297a1ecb33ac37c38dc

      • C:\Users\Admin\AppData\Roaming\John Sheehan\RestSharp-Tuner 1.3.2.3\install\decoder.dll

        Filesize

        202KB

        MD5

        831e0b597db11a6eb6f3f797105f7be8

        SHA1

        d89154670218f9fba4515b0c1c634ae0900ca6d4

        SHA256

        e3404d4af16702a67dcaa4da4c5a8776ef350343b179ae6e7f2d347e7e1d1fb7

        SHA512

        e5e71a62c937e7d1c2cf7698bc80fa42732ddd82735ba0ccaee28aee7a7ea7b2132650dfd2c483eb6fb93f447b59643e1a3d6d077a50f0cd42b6f3fc78c1ad8f

      • C:\Windows\Installer\MSIE1F9.tmp

        Filesize

        569KB

        MD5

        0be7cdee6c5103c740539d18a94acbd0

        SHA1

        a364c342ff150f69b471b922c0d065630a0989bb

        SHA256

        41abe8eb54a1910e6fc97fcea4de37a67058b7527badae8f39fba3788c46de14

        SHA512

        f96ef5458fdc985501e0dca9cac3c912b3f2308be29eb8e6a305a3b02a3c61b129c4db2c98980b32fd01779566fa5173b2d841755d3cb30885e2f130e4ad6e2c

      • memory/3408-499-0x0000000000F00000-0x0000000001432000-memory.dmp

        Filesize

        5.2MB

      • memory/3408-505-0x0000000000F00000-0x0000000001432000-memory.dmp

        Filesize

        5.2MB