344700d3141170111a9b77db100f6961cc54a2988d964d34f7e1ca57aa42aa2a

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08-07-2024 19:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WaveInstaller.exe
Size

1.5MB
MD5

c822ab5332b11c9185765b157d0b6e17
SHA1

7fe909d73a24ddd87171896079cceb8b03663ad4
SHA256

344700d3141170111a9b77db100f6961cc54a2988d964d34f7e1ca57aa42aa2a
SHA512

a8612836fb4714b939d03f7fe08391bbc635ca83ab853fc677159e5db6b00f76b9b586bdae9c19d2406d9a2713d1caf614132cb6c14e1dddc6ac45e47f7e5a5d
SSDEEP

24576:9viinbT3ipyqwPx4x3RyFoBkkAd04wJAAh/jV1gJcPNZI6fntX3HOt2pbs81ind2:EinbT3ipTD0anywJAaD/3U2pb7indT

Score

1^/10

Malware Config

Signatures

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133649408895612060"	chrome.exe

Modifies registry class 50 IoCs

Processes:

chrome.exetaskmgr.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings	taskmgr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe1000000020c17a912fceda01a8be9b193cceda012f2c6cf96dd1da0114000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

taskmgr.exechrome.exe

pid	process
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
3516	chrome.exe
3516	chrome.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

chrome.exetaskmgr.exe

pid process

1652 chrome.exe
1288 taskmgr.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

Processes:

chrome.exe

pid process

3516 chrome.exe
3516 chrome.exe
3516 chrome.exe
3516 chrome.exe
3516 chrome.exe

pid	process
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

taskmgr.exechrome.exe

description	pid	process
Token: SeDebugPrivilege	1288	taskmgr.exe
Token: SeSystemProfilePrivilege	1288	taskmgr.exe
Token: SeCreateGlobalPrivilege	1288	taskmgr.exe
Token: SeShutdownPrivilege	3516	chrome.exe
Token: SeCreatePagefilePrivilege	3516	chrome.exe
Token: SeShutdownPrivilege	3516	chrome.exe
Token: SeCreatePagefilePrivilege	3516	chrome.exe
Token: SeShutdownPrivilege	3516	chrome.exe
Token: SeCreatePagefilePrivilege	3516	chrome.exe
Token: SeShutdownPrivilege	3516	chrome.exe
Token: SeCreatePagefilePrivilege	3516	chrome.exe
Token: SeShutdownPrivilege	3516	chrome.exe
Token: SeCreatePagefilePrivilege	3516	chrome.exe
Token: SeShutdownPrivilege	3516	chrome.exe
Token: SeCreatePagefilePrivilege	3516	chrome.exe
Token: SeShutdownPrivilege	3516	chrome.exe
Token: SeCreatePagefilePrivilege	3516	chrome.exe
Token: SeShutdownPrivilege	3516	chrome.exe
Token: SeCreatePagefilePrivilege	3516	chrome.exe
Token: SeShutdownPrivilege	3516	chrome.exe
Token: SeCreatePagefilePrivilege	3516	chrome.exe
Token: SeShutdownPrivilege	3516	chrome.exe
Token: SeCreatePagefilePrivilege	3516	chrome.exe
Token: SeShutdownPrivilege	3516	chrome.exe
Token: SeCreatePagefilePrivilege	3516	chrome.exe
Token: SeShutdownPrivilege	3516	chrome.exe
Token: SeCreatePagefilePrivilege	3516	chrome.exe
Token: SeShutdownPrivilege	3516	chrome.exe
Token: SeCreatePagefilePrivilege	3516	chrome.exe
Token: SeShutdownPrivilege	3516	chrome.exe
Token: SeCreatePagefilePrivilege	3516	chrome.exe
Token: SeShutdownPrivilege	3516	chrome.exe
Token: SeCreatePagefilePrivilege	3516	chrome.exe
Token: SeShutdownPrivilege	3516	chrome.exe
Token: SeCreatePagefilePrivilege	3516	chrome.exe
Token: SeShutdownPrivilege	3516	chrome.exe
Token: SeCreatePagefilePrivilege	3516	chrome.exe
Token: SeShutdownPrivilege	3516	chrome.exe
Token: SeCreatePagefilePrivilege	3516	chrome.exe
Token: SeShutdownPrivilege	3516	chrome.exe
Token: SeCreatePagefilePrivilege	3516	chrome.exe
Token: SeShutdownPrivilege	3516	chrome.exe
Token: SeCreatePagefilePrivilege	3516	chrome.exe
Token: SeShutdownPrivilege	3516	chrome.exe
Token: SeCreatePagefilePrivilege	3516	chrome.exe
Token: SeShutdownPrivilege	3516	chrome.exe
Token: SeCreatePagefilePrivilege	3516	chrome.exe
Token: SeShutdownPrivilege	3516	chrome.exe
Token: SeCreatePagefilePrivilege	3516	chrome.exe
Token: SeShutdownPrivilege	3516	chrome.exe
Token: SeCreatePagefilePrivilege	3516	chrome.exe
Token: SeShutdownPrivilege	3516	chrome.exe
Token: SeCreatePagefilePrivilege	3516	chrome.exe
Token: SeShutdownPrivilege	3516	chrome.exe
Token: SeCreatePagefilePrivilege	3516	chrome.exe
Token: SeShutdownPrivilege	3516	chrome.exe
Token: SeCreatePagefilePrivilege	3516	chrome.exe
Token: SeShutdownPrivilege	3516	chrome.exe
Token: SeCreatePagefilePrivilege	3516	chrome.exe
Token: SeShutdownPrivilege	3516	chrome.exe
Token: SeCreatePagefilePrivilege	3516	chrome.exe
Token: SeShutdownPrivilege	3516	chrome.exe
Token: SeCreatePagefilePrivilege	3516	chrome.exe
Token: SeShutdownPrivilege	3516	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

taskmgr.exechrome.exe

pid	process
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

taskmgr.exechrome.exe

pid	process
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
3516	chrome.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

chrome.exe

pid	process
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 3516 wrote to memory of 2132	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 2132	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 3140	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 3140	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 3140	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 3140	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 3140	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 3140	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 3140	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 3140	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 3140	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 3140	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 3140	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 3140	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 3140	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 3140	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 3140	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 3140	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 3140	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 3140	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 3140	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 3140	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 3140	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 3140	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 3140	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 3140	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 3140	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 3140	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 3140	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 3140	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 3140	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 3140	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 3140	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 436	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 436	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 2256	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 2256	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 2256	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 2256	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 2256	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 2256	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 2256	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 2256	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 2256	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 2256	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 2256	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 2256	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 2256	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 2256	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 2256	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 2256	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 2256	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 2256	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 2256	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 2256	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 2256	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 2256	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 2256	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 2256	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 2256	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 2256	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 2256	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 2256	3516	chrome.exe	chrome.exe
PID 3516 wrote to memory of 2256	3516	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
1⤵
PID:3356

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1288

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3516

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb78cdab58,0x7ffb78cdab68,0x7ffb78cdab78
2⤵
PID:2132

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1712 --field-trial-handle=1808,i,10706077428693140063,15619607484208690566,131072 /prefetch:2
2⤵
PID:3140

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1808,i,10706077428693140063,15619607484208690566,131072 /prefetch:8
2⤵
PID:436

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2248 --field-trial-handle=1808,i,10706077428693140063,15619607484208690566,131072 /prefetch:8
2⤵
PID:2256

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3100 --field-trial-handle=1808,i,10706077428693140063,15619607484208690566,131072 /prefetch:1
2⤵
PID:2672

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3108 --field-trial-handle=1808,i,10706077428693140063,15619607484208690566,131072 /prefetch:1
2⤵
PID:2096

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4384 --field-trial-handle=1808,i,10706077428693140063,15619607484208690566,131072 /prefetch:1
2⤵
PID:4116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4592 --field-trial-handle=1808,i,10706077428693140063,15619607484208690566,131072 /prefetch:8
2⤵
PID:1400

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4764 --field-trial-handle=1808,i,10706077428693140063,15619607484208690566,131072 /prefetch:8
2⤵
PID:4320

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4764 --field-trial-handle=1808,i,10706077428693140063,15619607484208690566,131072 /prefetch:8
2⤵
PID:3900

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4760 --field-trial-handle=1808,i,10706077428693140063,15619607484208690566,131072 /prefetch:1
2⤵
PID:3576

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3180 --field-trial-handle=1808,i,10706077428693140063,15619607484208690566,131072 /prefetch:1
2⤵
PID:4820

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4352 --field-trial-handle=1808,i,10706077428693140063,15619607484208690566,131072 /prefetch:8
2⤵
PID:1400

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 --field-trial-handle=1808,i,10706077428693140063,15619607484208690566,131072 /prefetch:8
2⤵
PID:1584

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2676 --field-trial-handle=1808,i,10706077428693140063,15619607484208690566,131072 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1652

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1580 --field-trial-handle=1808,i,10706077428693140063,15619607484208690566,131072 /prefetch:2
2⤵
PID:4300

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:2332

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4564

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Filesize
432B

MD5
d3c9f2efc0582a95b6541b9488826b0f

SHA1
5121b545df07032b08be8ecb110a7397fe860c28

SHA256
bbac338b35c93b5e1725b623ec217ecaa3a3094058f31222b9ba307565ec5458

SHA512
7990ae444fd69579d5add16b226c705bd4edae911b64cd463028cc144b377d3eb5654b32e69740c134655f86aefe6f53c8c3bb08bca8ca07167b207eac94e696

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
240B

MD5
38509410aed1b0bd0bcbfc15d9c9e2f4

SHA1
b7f2096c134b58c60d479de1776e3f8aa820ac5f

SHA256
3b7e51ebc769eec735103c30b4d88fa8d5dca73370ecf22c3a9a0ef091b0bf38

SHA512
2592fe47324b35cb30207f868e78d30a214e441fef3c6acb8d09afecb945217ae897b1fc7b7d278ca54ee76f10aeae48ea8fed7ed6a0c45799542480c8a2851f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
2KB

MD5
e6d9acb7e2f779e37662232747ddee9f

SHA1
1705b3a673c53710e28501f63d688add2e790d00

SHA256
c03907690943ba4ecbec5e2793173bb5bd2591875448e2dfb8dec28bd187c694

SHA512
67228b034ab6c10aa0e95c9f87ea9d46cdc651f7be8ba2886b9fe649f782f049c98cb13508a8253be67674fe76814db739237973291241341137f40acc5d2064

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
356B

MD5
256e25139fd74631dedb5d379463dc94

SHA1
f3f47f058116963e9341d1584705b1eba4aea401

SHA256
2a69e5abe2741761e801260aa628fca4edae888c67d6b7b5f0e26ad3da01332f

SHA512
bec863fe1dbdd1885ae9ae2a485022dba1a0ed259cd302e5184d0261e678ebc7e801e6971433013925fbcd3abe53c324e7c287f4a086a0efb8d100e291c3e81e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
f47b81c2ce9a7b6aa34991c34112d70f

SHA1
61b71f0546b202bb979665d8b9242996e5a9f0f5

SHA256
42b3730ee2eeb5565569b3dd801a9ddd115371141304ab6520b6867c4bfa2b4e

SHA512
65b5d34c55f3d563e38c4b33954d5ff1fbffc6c2a33495e32d4e58fece6aac6f5d2524bca241161804aa998879f3318a21acec4a4b07186c8488665784e04b9f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
d5df6d83a1ea3b1fee4d0f8eaef40877

SHA1
3096375fb036821a3c1640788f21fa911379a763

SHA256
91fac5c5b384015b0e1b8e92e56f5f6543bd49b6d8bff95477e3d3064842bfd1

SHA512
d4ccb1755ac41233a4dc6bbb2b4dd83f6076e7b63b3a850e53393170a390e75b4ed5fe5711e3ce3d5b0bf96f8555bacc1aa2107186c9726c7d922d37adce3735

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
c4fc7aaffb0972226daed19d8c81ac8f

SHA1
b331d495818e8d336e61c075b5f2bd1bdc2d2cb5

SHA256
5581760de02e6851f252d1e25b26e8bc8d144ced4dbbef5d6f5480007a68328a

SHA512
24d240ad0ce96a700849be6ce43c94517f0e8c86d34be5aa0f3f5cc122e1d6effc6c3accf2e286cdeff81f8153977031e74a201717c5072d0954b4bfa38115e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
10934d26300d0888ee714cdb63b37407

SHA1
b5d4be29107503cb5c9c452563f84df0432ce48a

SHA256
a8261d40122a29e6d0b78d9214eff7cc1aabcdd84a1b89eb48c50e609d8cd3f7

SHA512
ae5fd3efecf44fbef23e766dc885d0e1f64b6fb2234a60f6f3206dd6309d81996035f5e59806e8f50cc24c30487d8312f7bfb108ad12b7caee692410f81db981

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
c3598cddd0bbd9f458cc5e60038e635f

SHA1
a21b5d6714fe44c133fd4b62fc304de07d73458d

SHA256
6258f0f40c9876958c8c6ca1a6ac271370c867a23647a233abba1eeb44b43931

SHA512
3500a17bff4eab4687342033502311ec06d1604f0241c1f149fd38f6776e81637cf886d520e494b018708419cd07ff6bf12400752cde6d439019b6d1104f4286

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
e1cfe3c4054d42c472840727e27a10c7

SHA1
6ddb33754ececa6b00162fa4719b87941704dbf4

SHA256
8e8395178970c171337bd80c772d6aad3c95a9606ad49294ec81f9d367222f6f

SHA512
b76d28443c203f9d192904410c1f4acd247b89492c25e0b8ce96f310257c54ce8e33fbcccfff39220fe965ed0b81d55322219d9cd3b60805f4caeb719e1e0cf1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
e452561f6a804c8bf5f15ae50859ab4a

SHA1
a40d3977c903adef394dd4a503d30f15b5b31d86

SHA256
3630ce2c1f3db6173a3ba336d561ccdcea226cd0804b2088b3ae83f02d7150ab

SHA512
4fe99adb5503904b602ef1a61aa44d3438e7f8fd00f810bf29d100dc2078dc2062c0b377e115a18494c120bf02fe61224bde075fa77746798707a440134d8725

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
16KB

MD5
18fd1981586b5c89a17f51c7c281f0eb

SHA1
36cbfa9dc1df91a22408e19e4ef4b8e01967fb91

SHA256
7f1851327265c7946437bcf211e564c7accb6f04db3918f778f2a1eaeab8580c

SHA512
ddb4221c119bfe922ffac6ec62757e3356e2efdea6c8d306f3093463eb71dceda5dbb2b430a105bb4c217e7fb0ef4bff253d4f37de95eda70cb279354b164e4a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
285KB

MD5
5296d90adb1efc8e4c81b1f1c1317682

SHA1
c50cd27ca70c20b473063063cb2709a820efceaf

SHA256
5af6ec5289afd6625afb8ab87bc7b46a857a2200fedb8340d071624d3e397138

SHA512
519769ad853536dc5df34d12464aa0a5a81da26a9bcd8e60057c0ff8b9b8fc1433088e23393cf8ff36362d341d3e7d78058c54a37e5414c2957c18ad9717cd49

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
92KB

MD5
4d46936f0bb4a94a661cd793aa2eae33

SHA1
60b60bef76953d335859a36beaf29c0a3ec60661

SHA256
e75b2161a52d2b40be77e061e9975ec5109c0c3eb23e7857237e771d8f439c8b

SHA512
b48e55c2b450edd27229c03edd85a509af5a446373f5f1fc364aca384be4d0ff04eb0c08ef414beed710385944d60e978e855def91604033f009bfc5c1cfda74

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
91KB

MD5
7ee025054fb232863324d73805797b0d

SHA1
84502c88e60673494720c737963f2d93841af7e6

SHA256
a430067be45bd096cd717a949e17d7ba3aa537802273b15ad8c4110520ba6832

SHA512
01cd700844e223b4592148dae6035362e6a4a0aeefee55693d1c152e6938f0aa79a26c5e420e4c50f25f3214a478f634e9714da3436bd7b70b252cf32ac13a80

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe580ea1.TMP
Filesize
89KB

MD5
8943f8b8b2902a751c2fc3b4ec363130

SHA1
6a50364677f0028b3531ff41b1b5db332eab7e49

SHA256
1003e969a8a634013688d5db909a043eab24bae9a8fbe1f15126863487df11be

SHA512
6491357af042b2a1cb381506f9d8403832b8143fbdd246965d3ce87a9a42779939895c70c8f6e5833f6ef8de16e7617eb1f3aec0baebd68a30703eea6440839e

Download Submit
\??\pipe\crashpad_3516_OXTLKTHDGEASKLTK
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1288-14-0x00000298C8770000-0x00000298C8771000-memory.dmp

Filesize
4KB

Download
memory/1288-9-0x00000298C8770000-0x00000298C8771000-memory.dmp

Filesize
4KB

Download
memory/1288-18-0x00000298C8770000-0x00000298C8771000-memory.dmp

Filesize
4KB

Download
memory/1288-19-0x00000298C8770000-0x00000298C8771000-memory.dmp

Filesize
4KB

Download
memory/1288-13-0x00000298C8770000-0x00000298C8771000-memory.dmp

Filesize
4KB

Download
memory/1288-15-0x00000298C8770000-0x00000298C8771000-memory.dmp

Filesize
4KB

Download
memory/1288-16-0x00000298C8770000-0x00000298C8771000-memory.dmp

Filesize
4KB

Download
memory/1288-8-0x00000298C8770000-0x00000298C8771000-memory.dmp

Filesize
4KB

Download
memory/1288-7-0x00000298C8770000-0x00000298C8771000-memory.dmp

Filesize
4KB

Download
memory/1288-17-0x00000298C8770000-0x00000298C8771000-memory.dmp

Filesize
4KB

Download
memory/3356-3-0x00000000745F0000-0x0000000074DA0000-memory.dmp

Filesize
7.7MB

Download
memory/3356-1-0x0000000000420000-0x00000000005B2000-memory.dmp

Filesize
1.6MB

Download
memory/3356-0-0x00000000745FE000-0x00000000745FF000-memory.dmp

Filesize
4KB

Download
memory/3356-20-0x00000000745FE000-0x00000000745FF000-memory.dmp

Filesize
4KB

Download
memory/3356-6-0x0000000005C00000-0x0000000005C0E000-memory.dmp

Filesize
56KB

Download
memory/3356-5-0x0000000009380000-0x00000000093B8000-memory.dmp

Filesize
224KB

Download
memory/3356-4-0x00000000745F0000-0x0000000074DA0000-memory.dmp

Filesize
7.7MB

Download
memory/3356-47-0x00000000745F0000-0x0000000074DA0000-memory.dmp

Filesize
7.7MB

Download
memory/3356-2-0x00000000745F0000-0x0000000074DA0000-memory.dmp

Filesize
7.7MB

Download
memory/3356-45-0x00000000745F0000-0x0000000074DA0000-memory.dmp

Filesize
7.7MB

Download