d311a4f486e2f81d1ffb11b37782d8bc1325b1df96ff21ab3b3de818ae3d5d84

Resubmissions

28/06/2026, 06:09

260628-gwr6jsfw217

22/06/2026, 23:09

260622-247w7agz4p8

22/06/2026, 23:07

260622-24fgyahs8v4

Analysis

user interaction
yes
max time kernel
36s
max time network
34s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/06/2026, 06:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BaBCKW.html
Size 11KB
Sample260628-gwr6jsfw21
SHA256 d311a4f486e2f81d1ffb11b37782d8bc1325b1df96ff21ab3b3de818ae3d5d84
MD5 c229b9d23420402bdea979bae2d31dde
SHA1 cf5cb6cd0c16a3cd252c792a13907df48fa2f0d4
SHA512 bdabdc88c2c5f8c1b6e4730801ad263d8f0172f9cbc19d80de98acaec7d06218f830366b5c10a63cf589de17ed23dd3b84542ab2183f93fe383f9fa3bd6f6fb8
SSDEEP 192:zMilLhIJhKYX5kerCNRupjQ4vYJkTcOHsU:zNOJhda4s4vYJk4OF
TLSH
T1BF32764A1EF280E701E785A97DF2FD0DAD85864BD219FC4832BC80A90FD7D468DC7995
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5108	jaureg.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaureg.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1312	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271005993496236"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4948	chrome.exe
4948	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 3336	4948	chrome.exe	86
PID 4948 wrote to memory of 2880	4948	chrome.exe	87
PID 4948 wrote to memory of 2880	4948	chrome.exe	87
PID 4948 wrote to memory of 1312	4948	chrome.exe	88
PID 4948 wrote to memory of 1180	4948	chrome.exe	89
PID 4948 wrote to memory of 1180	4948	chrome.exe	89
PID 4948 wrote to memory of 1620	4948	chrome.exe	90
PID 4948 wrote to memory of 1620	4948	chrome.exe	90
PID 4948 wrote to memory of 4796	4948	chrome.exe	91
PID 4948 wrote to memory of 4796	4948	chrome.exe	91
PID 4948 wrote to memory of 748	4948	chrome.exe	92
PID 4948 wrote to memory of 748	4948	chrome.exe	92
PID 4948 wrote to memory of 224	4948	chrome.exe	96
PID 4948 wrote to memory of 3920	4948	chrome.exe	110
PID 4948 wrote to memory of 2716	4948	chrome.exe	111
PID 4948 wrote to memory of 2716	4948	chrome.exe	111
PID 4948 wrote to memory of 4608	4948	chrome.exe	112
PID 4948 wrote to memory of 4608	4948	chrome.exe	112
PID 4948 wrote to memory of 3440	4948	chrome.exe	113
PID 4948 wrote to memory of 2152	4948	chrome.exe	114
PID 4948 wrote to memory of 2152	4948	chrome.exe	114
PID 4948 wrote to memory of 5108	4948	chrome.exe	115
PID 4948 wrote to memory of 1208	4948	chrome.exe	119
PID 4948 wrote to memory of 1220	4948	chrome.exe	120
PID 4948 wrote to memory of 2524	4948	chrome.exe	121

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\BaBCKW.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9cffcc728,0x7ff9cffcc734,0x7ff9cffcc740
  2⤵
  PID:3336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1660,i,13514153840031331903,18407046274467329002,262144 --field-trial-handle=1992,i,12049204058759908643,3791036687171920175,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:2880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2240,i,13431339261949585565,18358495652989530586,524288 --field-trial-handle=1992,i,12049204058759908643,3791036687171920175,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,17524134955695314155,5564488765392207032,524288 --field-trial-handle=1992,i,12049204058759908643,3791036687171920175,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:1180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3156,i,7676516319558974436,900682530588489442,2097152 --field-trial-handle=1992,i,12049204058759908643,3791036687171920175,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3160,i,17450062487515216002,17999531497047953555,2097152 --field-trial-handle=1992,i,12049204058759908643,3791036687171920175,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4404,i,16826112366266148971,4151843680050381035,2097152 --field-trial-handle=1992,i,12049204058759908643,3791036687171920175,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4440 /prefetch:2
  2⤵
  PID:748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5312,i,12848226087389731741,6430361232096564576,524288 --field-trial-handle=1992,i,12049204058759908643,3791036687171920175,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5652,i,13115656263029304588,12413579615139869621,524288 --field-trial-handle=1992,i,12049204058759908643,3791036687171920175,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  PID:3920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --metrics-shmem-handle=5636,i,1328648183302160888,4009288154667382241,524288 --field-trial-handle=1992,i,12049204058759908643,3791036687171920175,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5628 /prefetch:8
  2⤵
  PID:2716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --metrics-shmem-handle=5680,i,16155732851000739969,2507482633000588611,524288 --field-trial-handle=1992,i,12049204058759908643,3791036687171920175,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:4608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5848,i,7262430964490800766,4321460165769702376,524288 --field-trial-handle=1992,i,12049204058759908643,3791036687171920175,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:3440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --metrics-shmem-handle=5624,i,929458615647548310,6008623749700761854,524288 --field-trial-handle=1992,i,12049204058759908643,3791036687171920175,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  PID:2152
- C:\Users\Admin\Downloads\jaureg.exe
  "C:\Users\Admin\Downloads\jaureg.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5668,i,11069040748843319434,11569401336823503220,524288 --field-trial-handle=1992,i,12049204058759908643,3791036687171920175,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  PID:1208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6060,i,9044942074950015092,8174624237809721494,524288 --field-trial-handle=1992,i,12049204058759908643,3791036687171920175,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  PID:1220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5840,i,11031128058357849440,11245075806152526103,524288 --field-trial-handle=1992,i,12049204058759908643,3791036687171920175,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:2524

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 18c6c3ea2735af19490ed8c1a7ebf86a8dca578269054be31a0cf22aabbe3fe5
MD5 dab488c53da38ddc16ec72a9dd4bc779
SHA1 10060ca491fc9ed878481f8b9c685ad0b2f95d3f
SHA512 5c7d132d67749672151434cec4012ddf6b9019a5c8b6dfe6ac0e8d02a1556cd6c3e83dc4b59990f09ff6e70b8fff708fa1c4d973e8df39d1fd0c3582df161960
TLSH
T1EAE02BEAC821AC371DF95B2820104746E75013573F90C84F7A3D82088FB5A3B496682C
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 d7a0652653b735d037578f9bde32a43c2b559f995450c758f1cdbec063979ae9
MD5 deaf8ed9dca826c4a0b45e439a80de44
SHA1 b737f9146729fb2c428c16ff49138c0861cc877d
SHA512 f5c25378a688e7139f7b57f5244403ab9a605caacfbc1ddacd727d6a498d7a698fbcfb22dd1e8e83c308e6dc4bb2fd0072d1c55b72da90639025af1b4b39a074
SSDEEP 3:MsEllllkEthXllkl2zEkl9aWK:/M/xT02znUWK
TLSH
T1CA440404FFC45447C50C1030C011D3500371D71105157747345105535CC55404C41004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 92dd29f01d71ed9d0bc1137d0c73447724f2a7e6b7fc4d41c85eceffa338a228
MD5 481f78fffe919d0b7018242ea127b27a
SHA1 2d3aca3e9579afdaa4796ba03dee3373b5ceb007
SHA512 00f04f7e065629edef27ada007689cb4d82bc7f23df87de8bf4bf5c0c4f32493baf4d4d2caa950ed2215be496202eada303c826e57471101d4018d96b545dcac
TLSH
T1B0418AFB93B4897E8A1192E4EB156E1FCE6D0524031C3CA6C8D46E1B53F2972D20078F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 770e6f40323e3ebda203bffa48385700a019a6f82d76e7ed8118ef1a62c2e8da
MD5 ac69055292169566b77c77bd701d8554
SHA1 4846e1a256320cec9823f61f3b437b0ab09edf91
SHA512 e8e75f69a2577f654c8fbc39d294bc68242911b12791b9e661dd48fc7367f66331fe8078bd304687d6c9ddcb62d02477339ebb023ffddb160827e40fb53efa10
TLSH
T1D1F05967A6BE7427007A45FB1D09BC096A75B43802C074E8CF7A926CE1D24F32B02077
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5bc1a59835e2bd33838ac0d267d81aa1de2f2e26bd56ea833aec958eb3315c06
MD5 28fc50658ff02314247aaec3860d17b5
SHA1 5aef553814f8e0e7e9ec4899b6f89ce13d0cf6f2
SHA512 e6e62152b52ef9a86bf6dd1362218561c3ffe2f548aa54fb2a39698e9b7bf2b22ef01ee78dcb083617648d975ef94442ac368d0f0eef5bc91169c8ec8d43c3d1
SSDEEP 192:4RXmsH2XtfWCv7cpAPRp2qOF9BHsb+WNnquPiHgP2CBAMYVyIsnAUge:4R2sbOwUXl6rwdPYgP2Cb8e
TLSH
T1F242CA2EA95069BB5CD7C325F9257B53E7F5102225902EC0E6FC8A2C19E76CD321701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b3f4f2e14d679963538341ff0afac3d1413d6c870b4257e07fa033191b5d5d52
MD5 d7f90f8c742801dab019a8ec02eee5f0
SHA1 92798909b6b645895908139dc44894440e60cf09
SHA512 c298350a25a77e531f9135f460171a397773caa86df0966e111bcdb95e2a0b9a635929f435afd924dae1fb922f9c8e2b1787cc17b5017836bcbddc40bb0cd14f
SSDEEP 192:4RXmaH2XtfW8v7cpAPRp2qOW9BHsb+WNnquPiHgP2CBAMYVyIsnAUge:4R2abowUXl9rwdPYgP2Cb8e
TLSH
T14F42CA2EA96069BB5CD7D225F9257B53E7F5102225902EC0E7FC892C19E75CD321701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 844d3ec03467232c0b0b31852592e1d5bfd1b998c353219bbfd11d0dd2534c85
MD5 248039e3512518ae98cef47428956f17
SHA1 6b50102f479957e0c5bdc48e63949ea63a96eae7
SHA512 56f6fa2b67411fc0644fb1c73d9ea2b6838fd695e4701b9f0083f58780d47178025347ce2472b1dab91a02f1555f53e8546aeb65ea769478c186dc3b4f42e72a
SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLuLcSjzOXODR0+ErU3DTHGENMAYw:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7p4
TLSH
T13872E9676C4C9E770F94C6CCD8267F4FADB5024B66E9886483FA582503D5BCE110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 8f006b80bf95b0d0b925326982db145c200e380c0ab83e191ba94642e8c7ba46
MD5 ac1b84078dbde7fe9673fc6a63aa00f0
SHA1 160d3a35c4975fb43bb056fbc5c76d41bcddaec8
SHA512 d030e8b7e67a178ee262917f9194a067ed4926111a15d7a09ba549794ee4fbe194d825b6aaaa9fbf11c44f928d31fa05cfc30eb59ddbd3ffe23403745bb100e6
TLSH
T182B012408C01D241C41602F4215314987114DF10D70B2B0143E0BA668825364C01C050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e1a1.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58e1a1.TMP
Size 96B
SHA256 91f0dee88034ef8584029374b256a187532b893569f2fb2db4a805ace96d3884
MD5 82c81e2fdf9218063701db9cce7e9543
SHA1 a0538b33c4c77dbfea18c61bbad4c9a00293742a
SHA512 f801e025542e38acaf8a486bbdd047afd91cd16c6944db85dd9fa1a0f8314459f7185c7320234c21f9724ad91a05fe2539f1bb407423727e50450e65ac2c144a
TLSH
T1A7B00266C6026A12C08A03F5299599E8B1B1FF7DC603132793E01FAFEC35764952A5A0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 a9809f57c880a27f90e4dfdccd2adb38dc056e3ea578013358fdebb079f38398
MD5 f7e0524e0389d109a298890736996d8f
SHA1 7a9f3377798b48aee613115731c4ac085bc1d3d7
SHA512 4cefd33d0d8036b04355412bc19caec9e89ee635bec8eeaf17311547ff2b69857d828a40e0f1886e3a92be1299b2b2350aaf08d4c0c627782c5f27737674c14d
SSDEEP 3072:SNAFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:JFmUi21rSm8uUVNSlzY/
TLSH
T157C3131079E3F8B3FE99304476EE26158D684D818291C64157739E419DEF3C62FEAB38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 199897ff0b701650a6a85e24b6fd3ff7dd1384efdb073f7c4df6f06b2c82421a
MD5 1d87d5bd9821c01ff0cafbbdcb9c5fba
SHA1 e04bd1b555814f9c1e09b05bb7943c4fd4460d65
SHA512 15537121d3044726bde7dedf92b134e801bc04f68f0eba1966e75ad341fcf516b4425400d1b001a47b7f7278f25263e4aa2e11aa67b533a2704ec5da1b2ba347
SSDEEP 3072:SYFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:ZFmUi21rSm8uUVNSlzY/
TLSH
T1A2C3130076E3F8F2EE5930447BEE2A149D6C4D818291C6415273AE419DEF3C75FAAB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3afc4aa-f634-4786-857e-8a187c70b68c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d3afc4aa-f634-4786-857e-8a187c70b68c.tmp
Size 116KB
SHA256 3197ca631d1d34ceb7e6cbbec2c66d262f0d786f9e489f08cf4c3f0b5ee5b866
MD5 39042d2e4fb67643425b06f6456b1afb
SHA1 d621727b7c6731f75365b4c3216c32e6019d9380
SHA512 10adc829165b811f41677393686809de1adb9b23654f625d07f423d55c2852499886a61aceed2039b4290aa342d808f4b23cb6a39a6692cb8740203fc727e325
SSDEEP 3072:STnFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:cFmUi21rSm8uUVNSlzY/
TLSH
T1AAC3131079E3F8B3FE99304476EE2A158D684D818291C64157739E419DDF3C61FEAB38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaureg.exe

Path C:\Users\Admin\Downloads\jaureg.exe
Size 514KB
SHA256 a3554c0aa5b520fd6bafe5a51315af9fab83fc98d1a57cf24004656acb479f8f
MD5 5815e92687ebe087464ee1b2ec2ae9a9
SHA1 051e132c8c13d0a3d2b3cbece3dc12a6f6087df2
SHA512 4b389cdbd06ef8f7513214756e7fe0ebceef3e09877f41192919981b97bf7dad0bc6f94948e2ec3f4f286f0b1aca55c69d1e37f80ab2f4a2c60f8033ab1b9b76
SSDEEP 12288:gQJ7RKv89GDYikjjqggz7/PtFxRNWBYrpc:vJ7RKqjjg/PzNWyrW
TLSH
T13EB4AE2439A0C032D17311314D6AE794A73EF6704E6249E777D4AFBE2F345C1EB24AA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download