Analysis

  • max time kernel
    137s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/10/2024, 07:33

General

  • Target

    2d492b3bf2516f20a3b3c188321451d7_JaffaCakes118.exe

  • Size

    489KB

  • MD5

    2d492b3bf2516f20a3b3c188321451d7

  • SHA1

    30f6207400abfa8e6dc2ffdb2a31ec73e5f13c87

  • SHA256

    abf8bf380e330a2f4a5f6977a76eb6d394bc73a77471a93f563f4941d8fdc2a2

  • SHA512

    a5bc36895e9a2d85d857bd294ab98782c66b8dfcc3e685315df7bced79f489eae13ca87c88ad36b3ffb4628eed54d9b1904006c314f87529943413eedf531880

  • SSDEEP

    6144:je34R2ucFzh36dqXEVTrnCRZG/t7FTBqTzP7n7O7L6K2Bfo7p6:n2tzh36VVTGf0ZTsnz7O7L6ju7p6

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 15 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2d492b3bf2516f20a3b3c188321451d7_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2d492b3bf2516f20a3b3c188321451d7_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3516
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pf.toggle.com/s/2/8/28260-662782-adobe-flash-player-ie-aol.exe?iv=2012100410&t=1728500671
      2⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:932
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc027346f8,0x7ffc02734708,0x7ffc02734718
        3⤵
          PID:4252
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,12432054785806596060,9616725636734512347,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
          3⤵
            PID:3472
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,12432054785806596060,9616725636734512347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:348
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,12432054785806596060,9616725636734512347,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
            3⤵
              PID:2804
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12432054785806596060,9616725636734512347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
              3⤵
                PID:4852
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12432054785806596060,9616725636734512347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
                3⤵
                  PID:4780
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12432054785806596060,9616725636734512347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3976 /prefetch:1
                  3⤵
                    PID:2008
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12432054785806596060,9616725636734512347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
                    3⤵
                      PID:2020
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,12432054785806596060,9616725636734512347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
                      3⤵
                        PID:2420
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,12432054785806596060,9616725636734512347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
                        3⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:2608
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12432054785806596060,9616725636734512347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
                        3⤵
                          PID:3580
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12432054785806596060,9616725636734512347,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1
                          3⤵
                            PID:1824
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12432054785806596060,9616725636734512347,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
                            3⤵
                              PID:4144
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12432054785806596060,9616725636734512347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:1
                              3⤵
                                PID:4340
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12432054785806596060,9616725636734512347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1704 /prefetch:1
                                3⤵
                                  PID:3996
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12432054785806596060,9616725636734512347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2212 /prefetch:1
                                  3⤵
                                    PID:1228
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,12432054785806596060,9616725636734512347,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5932 /prefetch:2
                                    3⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:4884
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:3160
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:4244

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                    Filesize

                                    152B

                                    MD5

                                    a0486d6f8406d852dd805b66ff467692

                                    SHA1

                                    77ba1f63142e86b21c951b808f4bc5d8ed89b571

                                    SHA256

                                    c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

                                    SHA512

                                    065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                    Filesize

                                    152B

                                    MD5

                                    dc058ebc0f8181946a312f0be99ed79c

                                    SHA1

                                    0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

                                    SHA256

                                    378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

                                    SHA512

                                    36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    6KB

                                    MD5

                                    ceb264edae79a92af1fd8e2105fd8dab

                                    SHA1

                                    e76f94df10574436810e2c053ff56c5f3124a87e

                                    SHA256

                                    3d3ad067f175db2479b076a44f6be8239b7956f54fd112878e2402ba40f496c5

                                    SHA512

                                    57b0fd0c7d1a85e061d9fe36b525e00b13e23d392e252291393c1ab25345be78852766a757f20f1ca530e78345ac3cb6db0cee0208276d252a0c848bd9a421b9

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    6KB

                                    MD5

                                    ee7b4f9edcb1a09c64bf646bd40ab8a3

                                    SHA1

                                    cfd549e67d484fbb3d97a7aa5c26b469a3a5be51

                                    SHA256

                                    a506944af88b398ba488f1b29f4a57624844c47b9620e1ba2efbb121af54a87e

                                    SHA512

                                    5ac205f1f63ec498029ef2facf2fbbd54e95443c414ccf5511689aabdac9e7f081ea98f40ab76baec3765e2c25bdb5372a29af224b55ba60a2aa3a0340cdc3fe

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                    Filesize

                                    16B

                                    MD5

                                    6752a1d65b201c13b62ea44016eb221f

                                    SHA1

                                    58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                    SHA256

                                    0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                    SHA512

                                    9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                    Filesize

                                    10KB

                                    MD5

                                    74b70f7ba194ffb97633b64c0f564e35

                                    SHA1

                                    ff114ecb22ce5b40fb54fa836c964abcae7d0722

                                    SHA256

                                    dd985395e93b4c42fdf3f0c2fa4bfe44a2ca7bbb6474a2b27e1caccdf95a9844

                                    SHA512

                                    e221a4a1bce975ad747ffab87fb635086c1d2424584cbd3cf03c0654787586794c892712467f3af1fb0ae3af35953fee08ec33ffcc85a9bb5f203b6dd64987d2

                                  • C:\Users\Admin\AppData\Local\Temp\nsm8B97.tmp\BrandingURL.dll

                                    Filesize

                                    4KB

                                    MD5

                                    71c46b663baa92ad941388d082af97e7

                                    SHA1

                                    5a9fcce065366a526d75cc5ded9aade7cadd6421

                                    SHA256

                                    bb2b9c272b8b66bc1b414675c2acba7afad03fff66a63babee3ee57ed163d19e

                                    SHA512

                                    5965bd3f5369b9a1ed641c479f7b8a14af27700d0c27d482aa8eb62acc42f7b702b5947d82f9791b29bcba4d46e1409244f0a8ddce4ec75022b5e27f6d671bce

                                  • C:\Users\Admin\AppData\Local\Temp\nsm8B97.tmp\InstallOptions.dll

                                    Filesize

                                    14KB

                                    MD5

                                    325b008aec81e5aaa57096f05d4212b5

                                    SHA1

                                    27a2d89747a20305b6518438eff5b9f57f7df5c3

                                    SHA256

                                    c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

                                    SHA512

                                    18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

                                  • C:\Users\Admin\AppData\Local\Temp\nsm8B97.tmp\LangDLL.dll

                                    Filesize

                                    5KB

                                    MD5

                                    9384f4007c492d4fa040924f31c00166

                                    SHA1

                                    aba37faef30d7c445584c688a0b5638f5db31c7b

                                    SHA256

                                    60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5

                                    SHA512

                                    68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf

                                  • C:\Users\Admin\AppData\Local\Temp\nsm8B97.tmp\NSISdl.dll

                                    Filesize

                                    14KB

                                    MD5

                                    a5f8399a743ab7f9c88c645c35b1ebb5

                                    SHA1

                                    168f3c158913b0367bf79fa413357fbe97018191

                                    SHA256

                                    dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

                                    SHA512

                                    824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

                                  • C:\Users\Admin\AppData\Local\Temp\nsm8B97.tmp\System.dll

                                    Filesize

                                    11KB

                                    MD5

                                    c17103ae9072a06da581dec998343fc1

                                    SHA1

                                    b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

                                    SHA256

                                    dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

                                    SHA512

                                    d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

                                  • C:\Users\Admin\AppData\Local\Temp\nsm8B97.tmp\UAC.dll

                                    Filesize

                                    17KB

                                    MD5

                                    09caf01bc8d88eeb733abc161acff659

                                    SHA1

                                    b8c2126d641f88628c632dd2259686da3776a6da

                                    SHA256

                                    3555afe95e8bb269240a21520361677b280562b802978fccfb27490c79b9a478

                                    SHA512

                                    ef1e8fc4fc8f5609483b2c459d00a47036699dfb70b6be6f10a30c5d2fc66bae174345bffa9a44abd9ca029e609ff834d701ff6a769cca09fe5562365d5010fa

                                  • C:\Users\Admin\AppData\Local\Temp\nsm8B97.tmp\inetc.dll

                                    Filesize

                                    20KB

                                    MD5

                                    50fdadda3e993688401f6f1108fabdb4

                                    SHA1

                                    04a9ae55d0fb726be49809582cea41d75bf22a9a

                                    SHA256

                                    6d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6

                                    SHA512

                                    e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8

                                  • C:\Users\Admin\AppData\Local\Temp\nsm8B97.tmp\ioSpecial.ini

                                    Filesize

                                    415B

                                    MD5

                                    d8db011362860645c5f36e6fcfaa631f

                                    SHA1

                                    ad356de5e5f6886418916b2bcd3307e3829cc984

                                    SHA256

                                    42ab22319e36a1ccaacdd052e31abc79b92b169e1474d6bf2bd5882e0f362796

                                    SHA512

                                    064c2d268d61211be4f8af34d15b01919cc6001cb68549636836c8ce4ea59a77f94a463496249ff4a03c551cc2abe66f12faad9d734bda8cfbc17a2c50ce37fe

                                  • C:\Users\Admin\AppData\Local\Temp\nsm8B97.tmp\ioSpecial.ini

                                    Filesize

                                    1KB

                                    MD5

                                    85f9ce04aacb0a4a2a3774ef6b286ebb

                                    SHA1

                                    96933a44b53cd8b49b87494fdeb81e41d4d5e0d4

                                    SHA256

                                    61b231ca6791c7f66c7a5b29cbf9b24b0270beba1b0c6e7d35b6435e0ae857d8

                                    SHA512

                                    25824607931d790ad2e1e105de0a9302d4adc15d2264d89c485c084f9e8d6938b3aecfcac65c44eb8220ddce643c39cd86a2cbeb85958fe1ff7c36de1c887812

                                  • C:\Users\Admin\AppData\Local\Temp\nsm8B97.tmp\ioSpecial.ini

                                    Filesize

                                    1KB

                                    MD5

                                    cf576e460cd55071a1227b1384b05946

                                    SHA1

                                    7e6f2a9bfa3183baf57324a66d1afed7e2dbd648

                                    SHA256

                                    4122ebee1c1ab407df83a75a7c0ebc5023f02e2013fac0dcaf6adef5667d352a

                                    SHA512

                                    0ef666ca83a6ca52808f8df977003f5c3cba6e4831e532b510293c3b147b8402f2f4f919f2e663d7e6d7587652f05340e67ddd84aa439ce4a6c66fd007f5d5bb

                                  • C:\Users\Admin\AppData\Local\Temp\nsm8B97.tmp\show_page_toolbar

                                    Filesize

                                    940B

                                    MD5

                                    b66e7fdd84c4e2db3580a9602ae8ddc7

                                    SHA1

                                    e037728865af4babe5cf45e227ba5c89b644f963

                                    SHA256

                                    01378dfc6a99d4341a56d597ab584eb13d46629c73c6cec1e4f02ff449f5823a

                                    SHA512

                                    994d65cb43e3b02b00cfbf3050307f9462ef6011cd97dc660defec97de6a22846ca91ebe3df9f71c5735f105eaf7686988f6ec761fde131816aaa4aaf883bcb2