Resubmissions

02-07-2024 00:01

240702-abamfayanh 10

01-07-2024 23:59

240701-316qdsyajh 10

01-07-2024 23:56

240701-3y4g9a1gjr 10

01-07-2024 23:49

240701-3vbyts1ejq 10

Analysis

  • max time kernel
    14s
  • max time network
    81s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    01-07-2024 23:59

General

  • Target

    1cfdc1d171614dec2d83d1d85d028551_JaffaCakes118.exe

  • Size

    92KB

  • MD5

    1cfdc1d171614dec2d83d1d85d028551

  • SHA1

    7d1ec11608a949572e47fc499d568620fa1f6d5d

  • SHA256

    b475d20cf7e6facb0a9ffa5a51e3ed7d50eeadd3ad90394b14a8989260694e7c

  • SHA512

    2cf2f192bfb263ed4062633a30389ef86e84f5be02d4f2cabc2035b9ecf8568201735ca7d9de8c95d9163d321505db9a9f18302dff100694c9cc7da5497710c9

  • SSDEEP

    1536:7zARgxLF+yZcU5bUriFh751xKn9TZ9egzWwMjB5P3aU9HxTEpZmv8/NA79n/lxiK:7zhpNUeFd49TZ9S3vHCZ3/Ny9n5

Malware Config

Signatures

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1cfdc1d171614dec2d83d1d85d028551_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1cfdc1d171614dec2d83d1d85d028551_JaffaCakes118.exe"
    1⤵
      PID:2020
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\ytk.bat" "C:\Users\Admin\AppData\Local\Temp\1cfdc1d171614dec2d83d1d85d028551_JaffaCakes118.exe" "
        2⤵
          PID:2268
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        1⤵
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:3068
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef67d9758,0x7fef67d9768,0x7fef67d9778
          2⤵
            PID:2904
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1184 --field-trial-handle=1396,i,13291345404643068814,7614403948927054484,131072 /prefetch:2
            2⤵
              PID:2816
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1408 --field-trial-handle=1396,i,13291345404643068814,7614403948927054484,131072 /prefetch:8
              2⤵
                PID:2852
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1612 --field-trial-handle=1396,i,13291345404643068814,7614403948927054484,131072 /prefetch:8
                2⤵
                  PID:2584
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2320 --field-trial-handle=1396,i,13291345404643068814,7614403948927054484,131072 /prefetch:1
                  2⤵
                    PID:1052
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2336 --field-trial-handle=1396,i,13291345404643068814,7614403948927054484,131072 /prefetch:1
                    2⤵
                      PID:1636
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1564 --field-trial-handle=1396,i,13291345404643068814,7614403948927054484,131072 /prefetch:2
                      2⤵
                        PID:340
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1488 --field-trial-handle=1396,i,13291345404643068814,7614403948927054484,131072 /prefetch:1
                        2⤵
                          PID:2560
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1472 --field-trial-handle=1396,i,13291345404643068814,7614403948927054484,131072 /prefetch:8
                          2⤵
                            PID:3064
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3468 --field-trial-handle=1396,i,13291345404643068814,7614403948927054484,131072 /prefetch:8
                            2⤵
                              PID:3028
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3688 --field-trial-handle=1396,i,13291345404643068814,7614403948927054484,131072 /prefetch:8
                              2⤵
                                PID:444
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3712 --field-trial-handle=1396,i,13291345404643068814,7614403948927054484,131072 /prefetch:1
                                2⤵
                                  PID:1312
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=2364 --field-trial-handle=1396,i,13291345404643068814,7614403948927054484,131072 /prefetch:1
                                  2⤵
                                    PID:2772
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=1396,i,13291345404643068814,7614403948927054484,131072 /prefetch:8
                                    2⤵
                                      PID:2228
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2740 --field-trial-handle=1396,i,13291345404643068814,7614403948927054484,131072 /prefetch:1
                                      2⤵
                                        PID:2008
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3144 --field-trial-handle=1396,i,13291345404643068814,7614403948927054484,131072 /prefetch:1
                                        2⤵
                                          PID:2240
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3812 --field-trial-handle=1396,i,13291345404643068814,7614403948927054484,131072 /prefetch:8
                                          2⤵
                                            PID:1824
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4032 --field-trial-handle=1396,i,13291345404643068814,7614403948927054484,131072 /prefetch:8
                                            2⤵
                                              PID:2016
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4044 --field-trial-handle=1396,i,13291345404643068814,7614403948927054484,131072 /prefetch:8
                                              2⤵
                                                PID:1284
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1568 --field-trial-handle=1396,i,13291345404643068814,7614403948927054484,131072 /prefetch:8
                                                2⤵
                                                  PID:1796
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4084 --field-trial-handle=1396,i,13291345404643068814,7614403948927054484,131072 /prefetch:8
                                                  2⤵
                                                    PID:552
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4072 --field-trial-handle=1396,i,13291345404643068814,7614403948927054484,131072 /prefetch:8
                                                    2⤵
                                                      PID:1040
                                                    • C:\Users\Admin\Downloads\MBSetup.exe
                                                      "C:\Users\Admin\Downloads\MBSetup.exe"
                                                      2⤵
                                                        PID:1844
                                                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                      1⤵
                                                        PID:2196

                                                      Network

                                                      MITRE ATT&CK Enterprise v15

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

                                                        Filesize

                                                        70KB

                                                        MD5

                                                        49aebf8cbd62d92ac215b2923fb1b9f5

                                                        SHA1

                                                        1723be06719828dda65ad804298d0431f6aff976

                                                        SHA256

                                                        b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                                                        SHA512

                                                        bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                        Filesize

                                                        304B

                                                        MD5

                                                        4dc4526d74c4acd44856eae3d82361c5

                                                        SHA1

                                                        b67eef7e9a980f3d708848b3d37d316db22115a6

                                                        SHA256

                                                        fbc6485b22c901b11b62c88dcde921ff282e0d16163ae2265f3ecf22c1d7d42c

                                                        SHA512

                                                        8f24fdbac975ff32b7b5a8a76f32f6284285d04a2d0bff697b532967f7af818856d9d627ca17463c4751b09fd9b0e60e9e78b189c4bd8ff212c57ec05626df7f

                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                        Filesize

                                                        304B

                                                        MD5

                                                        9b45870feb82276709a446a9ba82a13a

                                                        SHA1

                                                        9ea4c828fcd63d17a133035550836551c85c3d4a

                                                        SHA256

                                                        bddbd894be3e97ee7a9caee65f075d6dcab4b86690d885b6c0a9c808564fbd9f

                                                        SHA512

                                                        1c43e4a24b5a62f03f830b017c4f3fc660e290230be5a2a227de73fff60c0b35df231390e82b17727a41cf2fef86f7041d08a11755c385846edf58328c5694e1

                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                        Filesize

                                                        304B

                                                        MD5

                                                        f87815374b31af97216f0367ad59afbc

                                                        SHA1

                                                        c633043093865e30b929bfa53cb6d68276b5c342

                                                        SHA256

                                                        2ab2e9e1605d5bdd4073c05fe8065cdccd712729c68d73e5b623a446fe600fc1

                                                        SHA512

                                                        2d6ac4bc00141c70a5868f22e3e8e7d23094a4aad340525ff551e565180c4bff1aa793ab45313ca359fd3a1d76a54abd7a4c03476501b6e33fdbbf4c224c7238

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                        Filesize

                                                        216B

                                                        MD5

                                                        9c19517c5a94cbaf4036298b800f616b

                                                        SHA1

                                                        bfebc3c4c095c42da36333a1bd6af51347e73911

                                                        SHA256

                                                        838dd82ed50f856380449b2e4b92ce9e8b76f9ad5a0762c3c01bee4dba651a0f

                                                        SHA512

                                                        82cdebd0a571738877ff48b3901cffa86bce59400adc4c4f57a1764e34350c2954bfc265f0f918780ac20c450d97db781f5863d1ee544b5fbcce509d119145f7

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                                                        Filesize

                                                        264KB

                                                        MD5

                                                        f50f89a0a91564d0b8a211f8921aa7de

                                                        SHA1

                                                        112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                        SHA256

                                                        b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                        SHA512

                                                        bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                        Filesize

                                                        363B

                                                        MD5

                                                        f154d1d140ef4c809be54ceef0de041b

                                                        SHA1

                                                        0e1c5d229c189ddb1b212b39e00bee680ea54bf6

                                                        SHA256

                                                        5c626c15a44c85d14c780cc01c1c3861ad4b4faaceb7bfb5d1e3c76c7a7ed3cd

                                                        SHA512

                                                        a0d9ed09ccfcee47b2d2dbbdc9d8e8c41b02fbba0f037834b55566bdeee0721da3b25f9877d975bd1dcc824c73df25d731362690de6dc373647d0a2e737b30c3

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                        Filesize

                                                        363B

                                                        MD5

                                                        1583c5d2340fc74499db5f7774fefa46

                                                        SHA1

                                                        51e30541a541b7dd46d031abdcbbb69356b43525

                                                        SHA256

                                                        54b4d17d3088af35bafd0c151a74ebd32abedf5671082083c5322bb163ac4052

                                                        SHA512

                                                        93325a5808c599a75154d959e8bb3a6b0515eee690f1740b9382d26a11b927f1207f8282c7255db8a666409ee25954450a8f10e4816fc183a68817944ee0357e

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                        Filesize

                                                        363B

                                                        MD5

                                                        9af432c1e3faef5fb7aec147f057a5a4

                                                        SHA1

                                                        fc8a615cfe7acabdf37db96650873f617c50df17

                                                        SHA256

                                                        2f11149a39d905ae5b3fff89bfb3ad0f35719f08b0ab02d7ad455e1f27443198

                                                        SHA512

                                                        4637d9499801eac085a0e6fa2e79d989ff8d17c62287aabb4267bf4f77cfda450104759e5a5053206712e2bd1e908938f1195472052e4fb2ff4c4c9dd56165d8

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                        Filesize

                                                        6KB

                                                        MD5

                                                        2a0422355ae5ef42074c9b0640afcd39

                                                        SHA1

                                                        1a6adaca76ffccc4de44dce02b78564cacc83bfa

                                                        SHA256

                                                        f2b9d15317a5f2d1ca31080c8db5b23d6f2adf879958b2daaf4bb41a0c625f60

                                                        SHA512

                                                        7c63e6a4aacc47fd3252ebbb8e5912844e74e098a9a92025d465048f97ed39e7c53e37aea88685be55bdd0dbfe24b0250ad970080b4a4b24b473d4dfb51d9cf8

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                        Filesize

                                                        6KB

                                                        MD5

                                                        ed31b64a71f916f6930dd9bf046e77e3

                                                        SHA1

                                                        8bf006daefb5ba70f72f412f7c7bab06e73fe644

                                                        SHA256

                                                        f9e2fa42cf20f2db2b0eb32a193fc3fc1176dc6cf4722fe53d7ae7c2ac6ecae3

                                                        SHA512

                                                        cde70ce17ec69bb3f70684a4e50749fade216190c08d788bc72603a394df4b4a1d6224de8a2d34fd738e8dd07b942556fea694f0a14a24355514f156a6ac8a48

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                        Filesize

                                                        5KB

                                                        MD5

                                                        6ce66b0707a967ebc3b57710b77896bc

                                                        SHA1

                                                        b873398ff5816710fadc5b2341bde7578e8e9c70

                                                        SHA256

                                                        36897b043c554aca7bc5ded24f652fbcc9c9b9bc69fe725971895d40a6eb9f5a

                                                        SHA512

                                                        d6998541b65055819bc1befa9ee1eb2a92bf613eca1e8987b1c440da1ac60d37d0072d3b63657fce17def11551b5a998b419ea70e00c5941ea9028e54456c704

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                        Filesize

                                                        6KB

                                                        MD5

                                                        5bc648dade4d5325b0c4014e44fb9025

                                                        SHA1

                                                        cb5accc8770dcbc142c9fc522ad4230353d42c8c

                                                        SHA256

                                                        00e7d9cd9e95cb8f2078de70c4971bb681df34482685a46b84f7f926d79a7863

                                                        SHA512

                                                        1cdd0f3ae17cf2a4b996a20205a7eb6770c0e458069ea6375f05d61970d7800d222e38ea22c1cec6fa6e272b88b5644cbf45cc4a257481c4be209d7eac78dc99

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

                                                        Filesize

                                                        16B

                                                        MD5

                                                        18e723571b00fb1694a3bad6c78e4054

                                                        SHA1

                                                        afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                                                        SHA256

                                                        8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                                                        SHA512

                                                        43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                                                        Filesize

                                                        75KB

                                                        MD5

                                                        8b78e9e8d3f9d72fa8a32d9fae6d2bfc

                                                        SHA1

                                                        80e6f9fcac408d8330ec91bbb9c9882e61d07a9e

                                                        SHA256

                                                        f8579bb5385edced3271fec6506f51cd589c6481b86b5c67b1175e0d293a555d

                                                        SHA512

                                                        0fe2d401f39976989ae161af5caeee8808abfa87c293343528ee4a02b5b6dd17b36b6bd0d698c3321d8d4760a8f31c82ff87452af2692132f2ef1378d4aab91b

                                                      • C:\Users\Admin\AppData\Local\Temp\TarAF88.tmp

                                                        Filesize

                                                        181KB

                                                        MD5

                                                        4ea6026cf93ec6338144661bf1202cd1

                                                        SHA1

                                                        a1dec9044f750ad887935a01430bf49322fbdcb7

                                                        SHA256

                                                        8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                                                        SHA512

                                                        6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                                                      • C:\Users\Admin\AppData\Local\Temp\ytk.bat

                                                        Filesize

                                                        71B

                                                        MD5

                                                        e6b031b9b7d40fa332ebc6f38b2f9f64

                                                        SHA1

                                                        d6dbffcfcc6a26188fd8d2e5b6257af4821fb48f

                                                        SHA256

                                                        66a04ff993916bce61351e4c3b94ea079c806efb1723c7cd79bd32aaf6847e0b

                                                        SHA512

                                                        7d17655334fcda4c3326110d340fd91cd23ee284dec99c3a8bbc8408342fda5f51e27aaba75fba4cccd513c342c22f07ad2cf6e2326ba575e3cc0eba4ea91948

                                                      • C:\Users\Admin\Downloads\MBSetup.exe

                                                        Filesize

                                                        2.5MB

                                                        MD5

                                                        8611a0d47266ce8d473d540bd6534ffc

                                                        SHA1

                                                        8804544c8ac023d89783d3d27b8c00b11dd8cbb4

                                                        SHA256

                                                        a573205f27cd8a421e33322a41037ddf74d4f9cedc574c86dea6550a8f065143

                                                        SHA512

                                                        8f4291ebb1b8cb5561b857d3ea2418c503f79b37b201f017d04a3c49746bfdc29abad5cfef3f2ce150fa8163824ac0a649a24386aee4562940d394f6514e4b7c

                                                      • memory/1844-539-0x00000000002B0000-0x0000000000522000-memory.dmp

                                                        Filesize

                                                        2.4MB

                                                      • memory/1844-569-0x00000000002B0000-0x0000000000522000-memory.dmp

                                                        Filesize

                                                        2.4MB

                                                      • memory/2020-69-0x0000000000400000-0x000000000042F000-memory.dmp

                                                        Filesize

                                                        188KB

                                                      • memory/2020-87-0x0000000000400000-0x0000000000415000-memory.dmp

                                                        Filesize

                                                        84KB

                                                      • memory/2020-1-0x0000000000400000-0x0000000000415000-memory.dmp

                                                        Filesize

                                                        84KB

                                                      • memory/2020-0-0x0000000001D20000-0x0000000001E20000-memory.dmp

                                                        Filesize

                                                        1024KB