6950d9f5794147161a7628aedcea38671ee33148580e015cf973f6a86c158d15

Resubmissions

18-10-2024 13:44

241018-q1r6sazdkb 7

18-10-2024 13:29

241018-qrhkzs1hrn 10

Analysis

max time kernel
34s
max time network
36s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-10-2024 13:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

57b2a1db98a792e2498b6ba5344deb90_JaffaCakes118.exe
Size

344KB
MD5

57b2a1db98a792e2498b6ba5344deb90
SHA1

b8a75d237c860f0128eae5adeb7e76f41233fc36
SHA256

6950d9f5794147161a7628aedcea38671ee33148580e015cf973f6a86c158d15
SHA512

36ebdbc0b27025e9bcc0edbe0cb9b40f2f4f4bbc1582d8e94e42d399a474d45227789d158b7d991fd04424188429fbc00fcf9db06922e3e8abf1506c4aa6d729
SSDEEP

6144:FqvsZf39vcCN1RHCfsIltPv6qn0/+sK+x20Im5iTxSO+xUJ:FqIv/wTPv6Q0GwFPxU

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	57b2a1db98a792e2498b6ba5344deb90_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1708	jhronqbjqngq.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3268 set thread context of 4896	3268	57b2a1db98a792e2498b6ba5344deb90_JaffaCakes118.exe	120

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\jhronqbjqngq.exe	57b2a1db98a792e2498b6ba5344deb90_JaffaCakes118.exe
File opened for modification	C:\Windows\jhronqbjqngq.exe	57b2a1db98a792e2498b6ba5344deb90_JaffaCakes118.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhronqbjqngq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	57b2a1db98a792e2498b6ba5344deb90_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	57b2a1db98a792e2498b6ba5344deb90_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133737326765661170"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3232	chrome.exe
3232	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3232	chrome.exe
Token: SeCreatePagefilePrivilege	3232	chrome.exe
Token: SeShutdownPrivilege	3232	chrome.exe
Token: SeCreatePagefilePrivilege	3232	chrome.exe
Token: SeShutdownPrivilege	3232	chrome.exe
Token: SeCreatePagefilePrivilege	3232	chrome.exe
Token: SeShutdownPrivilege	3232	chrome.exe
Token: SeCreatePagefilePrivilege	3232	chrome.exe
Token: 33	4688	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4688	AUDIODG.EXE
Token: SeShutdownPrivilege	3232	chrome.exe
Token: SeCreatePagefilePrivilege	3232	chrome.exe
Token: SeShutdownPrivilege	3232	chrome.exe
Token: SeCreatePagefilePrivilege	3232	chrome.exe
Token: SeShutdownPrivilege	3232	chrome.exe
Token: SeCreatePagefilePrivilege	3232	chrome.exe
Token: SeShutdownPrivilege	3232	chrome.exe
Token: SeCreatePagefilePrivilege	3232	chrome.exe
Token: SeShutdownPrivilege	3232	chrome.exe
Token: SeCreatePagefilePrivilege	3232	chrome.exe
Token: SeDebugPrivilege	4896	57b2a1db98a792e2498b6ba5344deb90_JaffaCakes118.exe
Token: SeShutdownPrivilege	3232	chrome.exe
Token: SeCreatePagefilePrivilege	3232	chrome.exe
Token: SeShutdownPrivilege	3232	chrome.exe
Token: SeCreatePagefilePrivilege	3232	chrome.exe
Token: SeShutdownPrivilege	3232	chrome.exe
Token: SeCreatePagefilePrivilege	3232	chrome.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3232 wrote to memory of 4464	3232	chrome.exe	100
PID 3232 wrote to memory of 4464	3232	chrome.exe	100
PID 3232 wrote to memory of 452	3232	chrome.exe	101
PID 3232 wrote to memory of 452	3232	chrome.exe	101
PID 3232 wrote to memory of 452	3232	chrome.exe	101
PID 3232 wrote to memory of 452	3232	chrome.exe	101
PID 3232 wrote to memory of 452	3232	chrome.exe	101
PID 3232 wrote to memory of 452	3232	chrome.exe	101
PID 3232 wrote to memory of 452	3232	chrome.exe	101
PID 3232 wrote to memory of 452	3232	chrome.exe	101
PID 3232 wrote to memory of 452	3232	chrome.exe	101
PID 3232 wrote to memory of 452	3232	chrome.exe	101
PID 3232 wrote to memory of 452	3232	chrome.exe	101
PID 3232 wrote to memory of 452	3232	chrome.exe	101
PID 3232 wrote to memory of 452	3232	chrome.exe	101
PID 3232 wrote to memory of 452	3232	chrome.exe	101
PID 3232 wrote to memory of 452	3232	chrome.exe	101
PID 3232 wrote to memory of 452	3232	chrome.exe	101
PID 3232 wrote to memory of 452	3232	chrome.exe	101
PID 3232 wrote to memory of 452	3232	chrome.exe	101
PID 3232 wrote to memory of 452	3232	chrome.exe	101
PID 3232 wrote to memory of 452	3232	chrome.exe	101
PID 3232 wrote to memory of 452	3232	chrome.exe	101
PID 3232 wrote to memory of 452	3232	chrome.exe	101
PID 3232 wrote to memory of 452	3232	chrome.exe	101
PID 3232 wrote to memory of 452	3232	chrome.exe	101
PID 3232 wrote to memory of 452	3232	chrome.exe	101
PID 3232 wrote to memory of 452	3232	chrome.exe	101
PID 3232 wrote to memory of 452	3232	chrome.exe	101
PID 3232 wrote to memory of 452	3232	chrome.exe	101
PID 3232 wrote to memory of 452	3232	chrome.exe	101
PID 3232 wrote to memory of 452	3232	chrome.exe	101
PID 3232 wrote to memory of 1320	3232	chrome.exe	102
PID 3232 wrote to memory of 1320	3232	chrome.exe	102
PID 3232 wrote to memory of 1840	3232	chrome.exe	103
PID 3232 wrote to memory of 1840	3232	chrome.exe	103
PID 3232 wrote to memory of 1840	3232	chrome.exe	103
PID 3232 wrote to memory of 1840	3232	chrome.exe	103
PID 3232 wrote to memory of 1840	3232	chrome.exe	103
PID 3232 wrote to memory of 1840	3232	chrome.exe	103
PID 3232 wrote to memory of 1840	3232	chrome.exe	103
PID 3232 wrote to memory of 1840	3232	chrome.exe	103
PID 3232 wrote to memory of 1840	3232	chrome.exe	103
PID 3232 wrote to memory of 1840	3232	chrome.exe	103
PID 3232 wrote to memory of 1840	3232	chrome.exe	103
PID 3232 wrote to memory of 1840	3232	chrome.exe	103
PID 3232 wrote to memory of 1840	3232	chrome.exe	103
PID 3232 wrote to memory of 1840	3232	chrome.exe	103
PID 3232 wrote to memory of 1840	3232	chrome.exe	103
PID 3232 wrote to memory of 1840	3232	chrome.exe	103
PID 3232 wrote to memory of 1840	3232	chrome.exe	103
PID 3232 wrote to memory of 1840	3232	chrome.exe	103
PID 3232 wrote to memory of 1840	3232	chrome.exe	103
PID 3232 wrote to memory of 1840	3232	chrome.exe	103
PID 3232 wrote to memory of 1840	3232	chrome.exe	103
PID 3232 wrote to memory of 1840	3232	chrome.exe	103
PID 3232 wrote to memory of 1840	3232	chrome.exe	103
PID 3232 wrote to memory of 1840	3232	chrome.exe	103
PID 3232 wrote to memory of 1840	3232	chrome.exe	103
PID 3232 wrote to memory of 1840	3232	chrome.exe	103
PID 3232 wrote to memory of 1840	3232	chrome.exe	103
PID 3232 wrote to memory of 1840	3232	chrome.exe	103
PID 3232 wrote to memory of 1840	3232	chrome.exe	103
PID 3232 wrote to memory of 1840	3232	chrome.exe	103

C:\Users\Admin\AppData\Local\Temp\57b2a1db98a792e2498b6ba5344deb90_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\57b2a1db98a792e2498b6ba5344deb90_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3268
- C:\Users\Admin\AppData\Local\Temp\57b2a1db98a792e2498b6ba5344deb90_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\57b2a1db98a792e2498b6ba5344deb90_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4896
- - C:\Windows\jhronqbjqngq.exe
    C:\Windows\jhronqbjqngq.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1708
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\57B2A1~1.EXE
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4276

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffd8e2acc40,0x7ffd8e2acc4c,0x7ffd8e2acc58
  2⤵
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1904,i,2592245899087046891,7621546665304492079,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  PID:452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2192,i,2592245899087046891,7621546665304492079,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  PID:1320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2256,i,2592245899087046891,7621546665304492079,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2380 /prefetch:8
  2⤵
  PID:1840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3180,i,2592245899087046891,7621546665304492079,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3272,i,2592245899087046891,7621546665304492079,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4560,i,2592245899087046891,7621546665304492079,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4568 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4748,i,2592245899087046891,7621546665304492079,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4740 /prefetch:8
  2⤵
  PID:2000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4728,i,2592245899087046891,7621546665304492079,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4712 /prefetch:8
  2⤵
  PID:2632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4852,i,2592245899087046891,7621546665304492079,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=3440,i,2592245899087046891,7621546665304492079,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3484 /prefetch:8
  2⤵
  PID:652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5076,i,2592245899087046891,7621546665304492079,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3416 /prefetch:8
  2⤵
  PID:3924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3184,i,2592245899087046891,7621546665304492079,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4884 /prefetch:8
  2⤵
  PID:4048

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:5036

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x404 0x1fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
1817cf708b848cbb538a18efa1b0db7a

SHA1
bbb5da3f96262e13154f4a5c9d6fa1bf33925724

SHA256
a39af6dcb850ba98a4826740b72e7488b83ec918366c4b67e82ec2ca86c202c5

SHA512
2831c4eebc2c7211b0a29557b4ccdb3a714acf6720f5e0c4306c184a3f26f3b97b41860286dc1382781f7515dd15f240a00e277e5bfd7128094da1f376b19b18

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
23e8bc9ce30ba31bb46dc60d412ba3c9

SHA1
b8abe7ecf3bba7048ed91c81247b0cb036bd94e1

SHA256
ed21fbeec864c87622252937de32849bede7ae304040ffcf49c51bca1f3a4543

SHA512
70545383a44845b5c478390b556a33faa07081a707e18fb124ff8988f1943468b2af0af31e1a3ec764d0a20b92055111efa2591f1b38186e2b5a2707a5e0a749

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
b0bcd7b908cdcc2aec58983347c1bb0f

SHA1
204f4cc299bd82bc18b0d04c60c78835ec51999a

SHA256
481517f3f528dbc1ccedf42a1261802d2fb3769cadb59b78641ee22cedd76964

SHA512
878f050927107cb34b1d003bbe36f4b72a2d35e5185b6908070cdaaacf9f96244dfe20e16e0f718de7e5d4c919ecb7891ee065b86eb39874d7dd4c3752f88cf6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
d32a6f8000bfe15df5a936c0a83d3ad4

SHA1
7e3fdfca81e331dd082b65ad6c006cfb835c683b

SHA256
c4fae4cf30bf5278f534effa4ad89554870e04a76055c87cb5964a134240f959

SHA512
0cec46598bd51ac27d01a8be061f451f1b5046d301d5f923050c055ec0a1dfb153382e7ace2cbc2c4c965e6417e34e8eec6742d4d201e6870100184d97c86002

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
2350a68cc4cb1bcd2d26c44b2adc60e3

SHA1
cce54395350550568eced239c111fd58017769c8

SHA256
6e0e3010a7f56ef1b25b67354203ff224cf909c089d9ffaa364efd62e7fee8cd

SHA512
37a220f1388b223881e20d876565a94764d7b147f0c8d875cb5fe3d3387335e0f407b38caa91fbbc56d4dd1cc5312e37a968a2a3bda1bfdc4582457d9d81b855

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
5a65a20d6f42f4b44e9f7451f4ad0352

SHA1
e978b99bccc5d0aa0d3e6082db6339b294f38060

SHA256
8fb64efd7ba41727da84878e738a57ee5df588951e68b35b02b071537602afdc

SHA512
d14dd87138a81c94398d91436013ba298b98770b41aa133a38b11ae966efcefd322dc2d2e4ad3924a3c5a87e689418e25d3a9d526a17e1b9772f3ef5a5971bd0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
229KB

MD5
b2576fe052862dfa16c35227e99cca83

SHA1
ee839ee0fca1c4c17425582f834b60a8dfa72da8

SHA256
861505d00eda06545fd8c0d63c086cab3fd7caeecc3986f7bdd2542037213399

SHA512
8eac71e96566656b8b217a6af488dca59a76b1286970b8f92720dc3b50779be78bd65f0cc1d5c674fc253cb658b2a35b234c26d019893c53b8284f1258ca5488

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
229KB

MD5
57043744d21f4ebf05125c21db42f05d

SHA1
3e9d93217f550ac1b0af673435119bfa97693047

SHA256
63c99d73282cd685a95dccfb87004ca0fe1bf71f375a32f63c68bef9088ab7c5

SHA512
99ef19ae20bc006a9e20a47f1ad6bb548b2d4325b302c2437c636931a3a54053cf3bfed850049a4a85985f1b51c3349d3b42b96d3c299b7708286d3af6e4a84c

Download Submit
C:\Windows\jhronqbjqngq.exe

Filesize
344KB

MD5
57b2a1db98a792e2498b6ba5344deb90

SHA1
b8a75d237c860f0128eae5adeb7e76f41233fc36

SHA256
6950d9f5794147161a7628aedcea38671ee33148580e015cf973f6a86c158d15

SHA512
36ebdbc0b27025e9bcc0edbe0cb9b40f2f4f4bbc1582d8e94e42d399a474d45227789d158b7d991fd04424188429fbc00fcf9db06922e3e8abf1506c4aa6d729

Download Submit
memory/3268-56-0x0000000000E50000-0x0000000000E53000-memory.dmp

Filesize
12KB

Download
memory/3268-0-0x0000000000E50000-0x0000000000E53000-memory.dmp

Filesize
12KB

Download
memory/4896-58-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4896-79-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4896-57-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4896-54-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4896-55-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download