344700d3141170111a9b77db100f6961cc54a2988d964d34f7e1ca57aa42aa2a

Analysis

max time kernel
459s
max time network
442s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
17-07-2024 10:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WaveInstaller Official.exe
Size

1.5MB
MD5

c822ab5332b11c9185765b157d0b6e17
SHA1

7fe909d73a24ddd87171896079cceb8b03663ad4
SHA256

344700d3141170111a9b77db100f6961cc54a2988d964d34f7e1ca57aa42aa2a
SHA512

a8612836fb4714b939d03f7fe08391bbc635ca83ab853fc677159e5db6b00f76b9b586bdae9c19d2406d9a2713d1caf614132cb6c14e1dddc6ac45e47f7e5a5d
SSDEEP

24576:9viinbT3ipyqwPx4x3RyFoBkkAd04wJAAh/jV1gJcPNZI6fntX3HOt2pbs81ind2:EinbT3ipTD0anywJAaD/3U2pb7indT

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 4 IoCs

Processes:

WaveBootstrapper.exeWaveWindows.exenode.exeBloxstrap.exe

pid process

4936 WaveBootstrapper.exe
3168 WaveWindows.exe
3784 node.exe
4664 Bloxstrap.exe

pid	process
4936	WaveBootstrapper.exe
3168	WaveWindows.exe
3784	node.exe
4664	Bloxstrap.exe

Checks for any installed AV software in registry 1 TTPs 4 IoCs

Security Software Discovery

T1518.001

Processes:

WaveWindows.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000\Software\KasperskyLab	WaveWindows.exe
Key created	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000\Software\KasperskyLab	WaveWindows.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000\Software\KasperskyLab\LastUsername	WaveWindows.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000\Software\KasperskyLab\Session	WaveWindows.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

Processes:

flow	ioc
64	raw.githubusercontent.com
65	raw.githubusercontent.com
1	raw.githubusercontent.com
40	raw.githubusercontent.com
62	raw.githubusercontent.com
63	raw.githubusercontent.com

Drops file in System32 directory 2 IoCs

Processes:

chrome.exe

description	ioc	process
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_01cf530faf2f1752\display.PNF	chrome.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_01cf530faf2f1752\display.PNF	chrome.exe

Drops file in Windows directory 4 IoCs

Processes:

setup.exesetup.exechrome.exe

description	ioc	process
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133656859063609878"	chrome.exe

Modifies registry class 19 IoCs

Processes:

Bloxstrap.exeMiniSearchHost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\roblox-player	Bloxstrap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\roblox-player\URL Protocol	Bloxstrap.exe
Key created	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\roblox	Bloxstrap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\roblox\ = "URL: Roblox Protocol"	Bloxstrap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\roblox\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe"	Bloxstrap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\roblox-player\ = "URL: Roblox Protocol"	Bloxstrap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\roblox-player\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe"	Bloxstrap.exe
Key created	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\roblox\DefaultIcon	Bloxstrap.exe
Key created	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\roblox\shell	Bloxstrap.exe
Key created	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\roblox-player\DefaultIcon	Bloxstrap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\roblox-player\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe\" %1"	Bloxstrap.exe
Key created	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\roblox-player\shell	Bloxstrap.exe
Key created	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\roblox-player\shell\open	Bloxstrap.exe
Key created	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\roblox\shell\open\command	Bloxstrap.exe
Key created	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\roblox\shell\open	Bloxstrap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\roblox\URL Protocol	Bloxstrap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\roblox\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe\" %1"	Bloxstrap.exe
Key created	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\roblox-player\shell\open\command	Bloxstrap.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

chrome.exechrome.exeWaveWindows.exeBloxstrap.exe

pid	process
3496	chrome.exe
3496	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3168	WaveWindows.exe
3168	WaveWindows.exe
4664	Bloxstrap.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

chrome.exe

pid process

3496 chrome.exe
3496 chrome.exe
3496 chrome.exe
3496 chrome.exe
3496 chrome.exe
3496 chrome.exe
3496 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

WaveInstaller Official.exechrome.exe

description	pid	process
Token: SeDebugPrivilege	1420	WaveInstaller Official.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe

Suspicious use of FindShellTrayWindow 29 IoCs

Processes:

chrome.exeBloxstrap.exe

pid	process
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
4664	Bloxstrap.exe
4664	Bloxstrap.exe

Suspicious use of SendNotifyMessage 14 IoCs

Processes:

chrome.exeBloxstrap.exe

pid	process
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
4664	Bloxstrap.exe
4664	Bloxstrap.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

MiniSearchHost.exe

pid process

1840 MiniSearchHost.exe

pid	process
1840	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 3496 wrote to memory of 4768	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 4768	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 484	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 484	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 484	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 484	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 484	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 484	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 484	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 484	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 484	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 484	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 484	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 484	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 484	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 484	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 484	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 484	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 484	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 484	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 484	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 484	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 484	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 484	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 484	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 484	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 484	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 484	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 484	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 484	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 484	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 484	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 564	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 564	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 2600	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 2600	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 2600	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 2600	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 2600	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 2600	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 2600	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 2600	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 2600	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 2600	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 2600	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 2600	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 2600	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 2600	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 2600	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 2600	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 2600	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 2600	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 2600	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 2600	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 2600	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 2600	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 2600	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 2600	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 2600	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 2600	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 2600	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 2600	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 2600	3496	chrome.exe	chrome.exe
PID 3496 wrote to memory of 2600	3496	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\WaveInstaller Official.exe
"C:\Users\Admin\AppData\Local\Temp\WaveInstaller Official.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1420

C:\Users\Admin\AppData\Local\Wave\WaveBootstrapper.exe
"C:\Users\Admin\AppData\Local\Wave\WaveBootstrapper.exe"
2⤵
- Executes dropped EXE
PID:4936

C:\Users\Admin\AppData\Local\Wave\WaveWindows.exe
"C:\Users\Admin\AppData\Local\Wave\WaveWindows.exe"
3⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Suspicious behavior: EnumeratesProcesses
PID:3168

C:\Users\Admin\AppData\Local\Luau Language Server\node.exe
"C:\Users\Admin\AppData\Local\Luau Language Server\node.exe" server --process-id=3168
4⤵
- Executes dropped EXE
PID:3784

C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe
"C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe"
4⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4664

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3496

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd8ffacc40,0x7ffd8ffacc4c,0x7ffd8ffacc58
2⤵
PID:4768

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1820,i,13018359785289413075,332912806311787755,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=1808 /prefetch:2
2⤵
PID:484

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1728,i,13018359785289413075,332912806311787755,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=2112 /prefetch:3
2⤵
PID:564

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2204,i,13018359785289413075,332912806311787755,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=2220 /prefetch:8
2⤵
PID:2600

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3080,i,13018359785289413075,332912806311787755,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3108 /prefetch:1
2⤵
PID:276

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3132,i,13018359785289413075,332912806311787755,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3140 /prefetch:1
2⤵
PID:2888

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4432,i,13018359785289413075,332912806311787755,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4416 /prefetch:1
2⤵
PID:4000

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4764,i,13018359785289413075,332912806311787755,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4776 /prefetch:8
2⤵
PID:4624

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4920,i,13018359785289413075,332912806311787755,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4928 /prefetch:8
2⤵
PID:2924

C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\setup.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\setup.exe" --reenable-autoupdates --system-level
2⤵
- Drops file in Windows directory
PID:2964

C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\setup.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff757a04698,0x7ff757a046a4,0x7ff757a046b0
3⤵
- Drops file in Windows directory
PID:4496

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4984,i,13018359785289413075,332912806311787755,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=5096 /prefetch:1
2⤵
PID:828

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=212,i,13018359785289413075,332912806311787755,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4524 /prefetch:8
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:3512

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4948,i,13018359785289413075,332912806311787755,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=1432 /prefetch:1
2⤵
PID:1808

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=3480,i,13018359785289413075,332912806311787755,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3432 /prefetch:1
2⤵
PID:244

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4368,i,13018359785289413075,332912806311787755,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4468 /prefetch:1
2⤵
PID:1812

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
1⤵
PID:1256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4084

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1840

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Software Discovery

T1518

Security Software Discovery

T1518.001

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.dll
Filesize
4.3MB

MD5
6546ceb273f079342df5e828a60f551b

SHA1
ede41c27df51c39cd731797c340fcb8feda51ea3

SHA256
e440da74de73212d80da3f27661fcb9436d03d9e8dbbb44c9c148aaf38071ca5

SHA512
f0ea83bf836e93ff7b58582329a05ba183a25c92705fab36f576ec0c20cf687ce16a68e483698bda4215d441dec5916ffbdfa1763fb357e14ab5e0f1ffcaf824

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe
Filesize
249KB

MD5
772c9fecbd0397f6cfb3d866cf3a5d7d

SHA1
6de3355d866d0627a756d0d4e29318e67650dacf

SHA256
2f88ea7e1183d320fb2b7483de2e860da13dc0c0caaf58f41a888528d78c809f

SHA512
82048bd6e50d38a863379a623b8cfda2d1553d8141923acf13f990c7245c833082523633eaa830362a12bfff300da61b3d8b3cccbe038ce2375fdfbd20dbca31

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.runtimeconfig.json
Filesize
372B

MD5
d94cf983fba9ab1bb8a6cb3ad4a48f50

SHA1
04855d8b7a76b7ec74633043ef9986d4500ca63c

SHA256
1eca0f0c70070aa83bb609e4b749b26dcb4409784326032726394722224a098a

SHA512
09a9667d4f4622817116c8bc27d3d481d5d160380a2e19b8944bdd1271a83f718415ce5e6d66e82e36819e575ec1b55f19c45213e0013b877b8d61e6feb9d998

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Modifications\ClientSettings\ClientAppSettings.json
Filesize
120B

MD5
636492f4af87f25c20bd34a731007d86

SHA1
22a5c237a739ab0df4ff87c9e3d79dbe0c89b56a

SHA256
22a1e85723295eeb854345be57f7d6fb56f02b232a95d69405bf9d9e67a0fa0d

SHA512
cd2e3a738f535eb1a119bd4c319555899bcd4ce1049d7f8591a1a68c26844f33c1bd1e171706533b5c36263ade5e275b55d40f5710e0210e010925969182cd0c

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Settings.json
Filesize
693B

MD5
9615e7328938f0ebad0cfe426a167fa9

SHA1
54ea72c2edfdc705cf95cc7925906a52544c2bcf

SHA256
dbcf7b7d6466ce437b6919ae3a6dc1c39739c81defb9b633b7e42d61a59c5b64

SHA512
d685a6da1693fdd0a589643806573514a21fee859bbcc52860373686d0c24df34af22b34f167a1e20fc60bb19ece7a1918ef4e279b0af07871f07be24df83d07

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-3243b6d003cf4642\ExtraContent\textures\ui\LuaApp\graphic\shimmer_lightTheme.png
Filesize
20KB

MD5
4f8f43c5d5c2895640ed4fdca39737d5

SHA1
fb46095bdfcab74d61e1171632c25f783ef495fa

SHA256
fc57f32c26087eef61b37850d60934eda1100ca8773f08e487191a74766053d1

SHA512
7aebc0f79b2b23a76fb41df8bab4411813ffb1abc5e2797810679c0eaa690e7af7561b8473405694bd967470be337417fa42e30f0318acbf171d8f31620a31aa

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-3243b6d003cf4642\ExtraContent\textures\ui\LuaApp\graphic\[email protected]
Filesize
71KB

MD5
3fec0191b36b9d9448a73ff1a937a1f7

SHA1
bee7d28204245e3088689ac08da18b43eae531ba

SHA256
1a03e6f6a0de045aa588544c392d671c040b82a5598b4246af04f5a74910dc89

SHA512
a8ab2bc2d937963af36d3255c6ea09cae6ab1599996450004bb18e8b8bdfbdde728821ac1662d8a0466680679011d8f366577b143766838fe91edf08a40353ce

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-3243b6d003cf4642\ExtraContent\textures\ui\LuaDiscussions\buttonFill.png
Filesize
247B

MD5
81ce54dfd6605840a1bd2f9b0b3f807d

SHA1
4a3a4c05b9c14c305a8bb06c768abc4958ba2f1c

SHA256
0a6a5cafb4dee0d8c1d182ddec9f68ca0471d7fc820cf8dc2d68f27a35cd3386

SHA512
57069c8ac03dd0fdfd97e2844c19138800ff6f7d508c26e5bc400b30fe78baa0991cc39f0f86fa10cd5d12b6b11b0b09c1a770e5cb2fdca157c2c8986a09e5ff

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-3243b6d003cf4642\content\configs\DateTimeLocaleConfigs\zh-hans.json
Filesize
2KB

MD5
fb6605abd624d1923aef5f2122b5ae58

SHA1
6e98c0a31fa39c781df33628b55568e095be7d71

SHA256
7b993133d329c46c0c437d985eead54432944d7b46db6ad6ea755505b8629d00

SHA512
97a14eda2010033265b379aa5553359293baf4988a4cdde8a40b0315e318a7b30feee7f5e14c68131e85610c00585d0c67e636999e3af9b5b2209e1a27a82223

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-3243b6d003cf4642\content\configs\DateTimeLocaleConfigs\zh-tw.json
Filesize
2KB

MD5
702c9879f2289959ceaa91d3045f28aa

SHA1
775072f139acc8eafb219af355f60b2f57094276

SHA256
a92a6988175f9c1d073e4b54bf6a31f9b5d3652eebdf6a351fb5e12bda76cbd5

SHA512
815a6bef134c0db7a5926f0cf4b3f7702d71b0b2f13eca9539cd2fc5a61eea81b1884e4c4bc0b3398880589bff809ac8d5df833e7e4aeda4a1244e9a875d1e97

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-3243b6d003cf4642\content\sounds\ouch.ogg
Filesize
6KB

MD5
9404c52d6f311da02d65d4320bfebb59

SHA1
0b5b5c2e7c631894953d5828fec06bdf6adba55f

SHA256
c9775e361392877d1d521d0450a5368ee92d37dc542bc5e514373c9d5003f317

SHA512
22aa1acbcdcf56f571170d9c32fd0d025c50936387203a7827dbb925f352d2bc082a8a79db61c2d1f1795ad979e93367c80205d9141b73d806ae08fa089837c4

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-3243b6d003cf4642\content\textures\Cursors\KeyboardMouse\IBeamCursor.png
Filesize
292B

MD5
464c4983fa06ad6cf235ec6793de5f83

SHA1
8afeb666c8aee7290ab587a2bfb29fc3551669e8

SHA256
99fd7f104948c6ab002d1ec69ffd6c896c91f9accc499588df0980b4346ecbed

SHA512
f805f5f38535fe487b899486c8de6cf630114964e2c3ebc2af7152a82c6f6faef681b4d936a1867b5dff6566b688b5c01105074443cc2086b3fe71f7e6e404b1

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-3243b6d003cf4642\content\textures\StudioToolbox\Clear.png
Filesize
538B

MD5
fa8eaf9266c707e151bb20281b3c0988

SHA1
3ca097ad4cd097745d33d386cc2d626ece8cb969

SHA256
8cf08bf7e50fea7b38f59f162ed956346c55a714ed8a9a8b0a1ada7e18480bc2

SHA512
e29274300eab297c6de895bb39170f73f0a4ffa2a8c3732caeeeac16e2c25fb58bb401fdd5823cc62d9c413ec6c43d7c46861d7e14d52f8d9d8ff632e29f167c

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-3243b6d003cf4642\content\textures\StudioUIEditor\valueBoxRoundedRectangle.png
Filesize
130B

MD5
521fb651c83453bf42d7432896040e5e

SHA1
8fdbf2cc2617b5b58aaa91b94b0bf755d951cad9

SHA256
630303ec4701779eaf86cc9fbf744b625becda53badc7271cbb6ddc56e638d70

SHA512
8fa0a50e52a3c7c53735c7dd7af275ebc9c1843f55bb30ebe0587a85955a8da94ff993822d233f7ed118b1070a7d67718b55ba4a597dc49ed2bf2a3836c696f6

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-3243b6d003cf4642\content\textures\TerrainTools\checkbox_square.png
Filesize
985B

MD5
2cb16991a26dc803f43963bdc7571e3f

SHA1
12ad66a51b60eeaed199bc521800f7c763a3bc7b

SHA256
c7bae6d856f3bd9f00c122522eb3534d0d198a9473b6a379a5c3458181870646

SHA512
4c9467e5e2d83b778d0fb8b6fd97964f8d8126f07bfd50c5d68c256703f291ceaed56be057e8e2c591b2d2c49f6b7e099a2b7088d0bf5bdd901433459663b1f8

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-3243b6d003cf4642\content\textures\ui\Controls\XboxController\Thumbstick1.png
Filesize
641B

MD5
2cbe38df9a03133ddf11a940c09b49cd

SHA1
6fb5c191ed8ce9495c66b90aaf53662bfe199846

SHA256
0835a661199a7d8df7249e8ae925987184efcc4fb85d9efac3cc2c1495020517

SHA512
dcef5baccef9fff632456fe7bc3c4f4a403363d9103a8047a55f4bd4c413d0c5f751a2e37385fe9eba7a420dbdb77ca2ff883d47fcdd35af222191cc5bd5c7a9

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-3243b6d003cf4642\content\textures\ui\Controls\XboxController\[email protected]
Filesize
1KB

MD5
e8c88cf5c5ef7ae5ddee2d0e8376b32f

SHA1
77f2a5b11436d247d1acc3bac8edffc99c496839

SHA256
9607af14604a8e8eb1dec45d3eeca01fed33140c0ccc3e6ef8ca4a1f6219b5dd

SHA512
32f5a1e907705346a56fbddfe0d8841d05415ff7abe28ae9281ba46fedf8270b982be0090b72e2e32de0ce36e21934f80eaf508fd010f7ab132d39f5305fb68f

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-3243b6d003cf4642\content\textures\ui\Controls\XboxController\[email protected]
Filesize
1KB

MD5
499333dae156bb4c9e9309a4842be4c8

SHA1
d18c4c36bdb297208589dc93715560acaf761c3a

SHA256
d35a74469f1436f114c27c730a5ec0793073bcf098db37f10158d562a3174591

SHA512
91c64173d2cdabc045c70e0538d45e1022cc74ec04989565b85f0f26fe3e788b700a0956a07a8c91d34c06fc1b7fad43bbdbb41b0c6f15b9881c3e46def8103e

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-3243b6d003cf4642\content\textures\ui\Controls\XboxController\Thumbstick2.png
Filesize
738B

MD5
a402aacac8be906bcc07d50669d32061

SHA1
9d75c1afbe9fc482983978cae4c553aa32625640

SHA256
62a313b6cc9ffe7dd86bc9c4fcd7b8e8d1f14a15cdf41a53fb69af4ae3416102

SHA512
d11567bcaad8bbd9e2b9f497c3215102c7e7546caf425e93791502d3d2b3f78dec13609796fcd6e1e7f5c7d794bac074d00a74001e7fe943d63463b483877546

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-3243b6d003cf4642\content\textures\ui\Controls\XboxController\[email protected]
Filesize
1KB

MD5
83e9b7823c0a5c4c67a603a734233dec

SHA1
2eaf04ad636bf71afdf73b004d17d366ac6d333e

SHA256
3b5e06eb1a89975def847101f700f0caa60fe0198f53e51974ef1608c6e1e067

SHA512
e8abb39a1ec340ac5c7d63137f607cd09eae0e885e4f73b84d8adad1b8f574155b92fbf2c9d3013f64ebbb6d55ead5419e7546b0f70dcde976d49e7440743b0f

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-3243b6d003cf4642\content\textures\ui\Controls\XboxController\[email protected]
Filesize
1KB

MD5
55b64987636b9740ab1de7debd1f0b2f

SHA1
96f67222ce7d7748ec968e95a2f6495860f9d9c9

SHA256
f4a6bb3347ee3e603ea0b2f009bfa802103bc434ae3ff1db1f2043fa8cace8fc

SHA512
73a88a278747de3fefbaabb3ff90c1c0750c8d6c17746787f17061f4eff933620407336bf9b755f4222b0943b07d8c4d01de1815d42ea65e78e0daa7072591e9

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
Filesize
64KB

MD5
b5ad5caaaee00cb8cf445427975ae66c

SHA1
dcde6527290a326e048f9c3a85280d3fa71e1e22

SHA256
b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

SHA512
92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
Filesize
1008B

MD5
d222b77a61527f2c177b0869e7babc24

SHA1
3f23acb984307a4aeba41ebbb70439c97ad1f268

SHA256
80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

SHA512
d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\15dac971-1c93-47f5-92c1-8b5ebbcb350d.tmp
Filesize
9KB

MD5
eef740015a5489960142df1316cf8aea

SHA1
d4ea0ef4d19e84807ac71603430530521571482b

SHA256
5c60c87688a17a7f9fcc57c96061ceabd81dee07809991c7443b7bf7fcaeb2a7

SHA512
0c050fd42ff5b8b520ad393ba30abca3e5565bed6cefff638f1dfd025a4d4a0b001cb22529eff0e97c1ac4a7b43a534f857bab99d6b9995ed76c247deffb863d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Filesize
649B

MD5
1d5397192bf82b5ce91eda6ccfd68874

SHA1
96a461ed0056bb8bfb81832469d44d9d353f2b3e

SHA256
f8389f8dda61494da2e8b99cc10f0031684b9f3da14571a59fe2526116bdfc6a

SHA512
b293dc772ea5ce5acd93bbb7795f7fed18a5ffaa163829050a13c3791cb4b52316529afc52a50b753e3754e3f644fe3fe8187f5f83bbbc867351de4c4f5d9ece

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001
Filesize
211KB

MD5
151fb811968eaf8efb840908b89dc9d4

SHA1
7ec811009fd9b0e6d92d12d78b002275f2f1bee1

SHA256
043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed

SHA512
83aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000002
Filesize
24KB

MD5
c594a826934b9505d591d0f7a7df80b7

SHA1
c04b8637e686f71f3fc46a29a86346ba9b04ae18

SHA256
e664eef3d68ac6336a28be033165d4780e8a5ab28f0d90df1b148ef86babb610

SHA512
04a1dfdb8ee2f5fefa101d5e3ff36e87659fd774e96aa8c5941d3353ccc268a125822cf01533c74839e5f1c54725da9cc437d3d69b88e5bf3f99caccd4d75961

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\78ab860c2c61b8d8_0
Filesize
280B

MD5
529f415b7f5e3a7b9b6b32aa6c25ace8

SHA1
9699f4186f82d44e94333a41e579dbdabf54a3b9

SHA256
4b1a9f2156aef481b364da731f1888e30fc275b110b20ce7e50c178b9e9d5a3e

SHA512
91f672b07d24dd6b7aee67bbf4243c29edf1e68d5ccf6089e14214248e6314eb4fea48ca86d58e9cedd00179d58576c85657e3295b155b31e65ca1b5ccfec807

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\aec3ef733c913ddf_0
Filesize
19KB

MD5
f7061f0f3e706a8f31f2a8a556d4c66d

SHA1
6efb2ba85691202d11246f5cfb6dec4838ff5928

SHA256
3edd71881ebae8b6a2185bc732914178df2ef7e43779824454c61c2c86676521

SHA512
f5143ea21c9118c3d031d2155eb0c05aa673254b8b4e2456fe5bcb2705f7bc3c8fc10f0a47f4632ee5b893c10c479ee663d3543b31972735dc4764121519298c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
216B

MD5
5be28d3c3061b7840533883b89955c6c

SHA1
7bc463689cce67e1a97a12cfd6777ea7857b1636

SHA256
c8d2dd2dde145b0bea5f571fb38f9a9761f18607354590b73cc4f2527e52d610

SHA512
e6de83b1395fb46230047ac39f5c3eb05ec28b5762eeb0fc08420387530ee4d3a494bd55be96f3b0a88929538b0902a0c9fb005b9c2d9be7c048d24d2057ec2d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
216B

MD5
82b18c49b1102f80cf3613d0cc78002a

SHA1
43794e682baa8735fe61f7947776fc027e1831a0

SHA256
b694572bc4343d6551b4268cdd0634a87948c8fe1c16769135a0487e7f6f470a

SHA512
ab5b22d2f6654eff6fabdbc08d02860a4bbae3e7eda1d7ceca8c18b010565651c4ca6dab97a928cb75fa10b658b9ca00092db17e3624b0c4710e9cf1f799b17b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
216B

MD5
523cfbd2710ecc46f1932889e854e30a

SHA1
98c21370f2d33d691fa0dcef58ebeb8c14166a72

SHA256
f3c0eff3aed95d38b2fd010104543b1cc3e42ec03b326a23a0685b9e765d502c

SHA512
55b4854db01d68575e2385750e34f0d15f7ee41e7efcf73095e4d4b94efbdd51102e2e082a860a43b5c62aadb089bd382f4a9d1efb0a8e9083d983a718d9ea3a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
216B

MD5
a7cc7b11345fb1631dc9c9254446b1ee

SHA1
fa47c82a0680670ad8c42658c720287d294bd053

SHA256
b8223cb415a29fcfdfe60943b903d43808a3fd5e5baf02a43835121d4c70c44a

SHA512
a3aaeaf86f2585b6354835525ebb3e6ee12e910df86475e1e94fc029518be6c39ae01ea2a070823d86517778e843dd44e3148f8e78060c9f511a7c9042e2c401

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
216B

MD5
1ff314bd3bbc8542f54a218003f61393

SHA1
f66bb4d749ddf40ea119c939a69ea271ba930016

SHA256
d3d1730eba11794ce944e42d9d1a980bfc3edc90cd8fad6119ffb5b14c873a16

SHA512
ce342ac8d72ba16c4190b748994c9e1517129e6373ca1ca2c288e1328f50370dd7fc0697e9280f72b4b20aa9e022aa20edc50cd4fbabfbc49ece30eb9fe14aa6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
216B

MD5
413ad95e96a07d49e8a371789d83fba7

SHA1
7968f15e8b1cf6320741d1bebb76324dc29f3a00

SHA256
bb30653af716eaa989a17e91a81dc63799727d640aef531f3535f3c83d042b8c

SHA512
bedafce37e1e99a779a9c2524c0685d72eadea7b02944060e6bb908304c8f7c34a9bdc56d9fc858d4f661187c28140aee5c7837bc6db0b393b77c8aaee0fc3a8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
216B

MD5
71725eed93801b82f4dbafa3e0f83bcb

SHA1
7e4e30d625bcb2cd1a1b291217acb5a109bd4db2

SHA256
736651c721c7ed22bfafd2606730fb0a34f1f1360b5bae45adc9178e6a5dfb03

SHA512
1dabab92e9392dbce1b95716afc0a4c8cf2409d16a8725f5bfbca276deb0bb2a8c400116e916a780fada80bafd59c63bf53b760bf1f9d4c7beb2b416d27ecc4a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
216B

MD5
0768202a48a2e6b521ae78c577b1031a

SHA1
b0ae3b98b490bf7dafa18ddf54db19ad82b55025

SHA256
afaabeff7d60019f9fe66342b48096c903df88b95ebda4837111eef8f37fd728

SHA512
cdbf3a24ee9acd28ce496e222310bc1f3f68d5fd8f2733771e56220ad82beb22f76f5958b451b33f8ec95c3deacaa30b51bffb9e5d4a6ca1d248bec9d2286d17

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
216B

MD5
00298a94715060d587a01a2bd0bf5558

SHA1
f637ca1ea48273678e92a0c71f1fc2823371a8f4

SHA256
f32ceca4bb01b08eb78c7fdabba134e41e9498c63e172d9bacfb95a850a4b874

SHA512
cf570a8bad66463678a4ef1a2cdc342d60e3c71e771a57aaec05c8693ea877ebce3be2ae305131a621283d55e72a8c7debb9cfd17d5c19a093282ce6ff65da98

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
216B

MD5
7006a203e686e3d3c4e50459f760c76f

SHA1
56a8ce78c2636e11ad2521dd3ba9cebef7e5ff73

SHA256
0399ee977b293eab5ba13e720ebd1e11ac776a182560212981e99afe0af4cd1a

SHA512
3c087a3e2140d48dccb5de79a312e41eb45e827f246474a1f3fe96abd64e70f310eb701190abe51079e9a9d1fc57b87a7ed38de10811893330f83aa4da298e31

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
2KB

MD5
0b700676fff94d0c70e65ec14de7af80

SHA1
6b46ac1646c329e20eecd9789bf63b6d8e84d0fe

SHA256
cdafc7db24c797be07ae532e7bcd91e18fc553f0fa7dad94c0fa7176a8317e4d

SHA512
037df921bf05bb7ce6920498e0d2bc5c921ce0896235db1d4a1cad95fbad79f44372cc76d92d84e420ed9d08c6c621af05b34f4479ab56fa78f4363b282d4235

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
2KB

MD5
e010f045d37b4683a27b25da3e211b30

SHA1
4f91fb98b899baae855478ee60a5dffd3b333bd2

SHA256
a818b714933bd585e2840f816f319a35bd8fea797753c853d29ddd814fa25615

SHA512
49d68864490fa7ecd9249ede5cb1c714d01510f2029e6de6c62efff6c294bbb76983b6b1a9ccc4e6ed8e021040fdf11421aefacbb9f714d23c9377a0171f6a1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
356B

MD5
411ba89680c64a9460269cc37fee1c31

SHA1
ca1853f99bd2d308cfc621ae8e2642214026fca4

SHA256
0326627f205f96d39a02e302eb5d6d2fe1e04c373d653f4fd10b58a764213b23

SHA512
914ebdb2423e39c23e73840c46fd50ade686581455065dda66ff02478ca9c4deff6ac5f984d40c931d9d8bc9c3f69355a249da3a17d31cd765f18c119a9478d8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
356B

MD5
ad5223fa76768900e6e99b50240c105e

SHA1
2fc024476615f591460b2ba57384c57c2b6a37a6

SHA256
b56354f56553d36a38c11a0a79cb4c022c97482c229b7f103a978f1c373a424b

SHA512
c1036915d4fde310c8564c0ebb7ccf4af703465b4b63a6cac5f218c6cd1628f1bddc03218ad1e909f5b98cbc4075bd1a2e6b3237b52b1e652b90f1bc63bda23c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
356B

MD5
70bf67b2495aedcb409611b04538a0e2

SHA1
70951e3447d1ebb81e604b190d4ed83c8d689272

SHA256
a24a02db76273ca8303eef8fa5efa0204e2733a21c0f327634b87029568af5ea

SHA512
0ad02a047104623b22fa742a0d1ece7dd71fe5a0eb93315aa328a5e78bcfe1c032ef0d54aa3428c10722dbec9bf5b1aa68b36d3c3d46cf450134ac06ae14beea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
d3ddd1fb911b033ef8a626d7b9981f2d

SHA1
db2e4bebdac3a03ef459f6aede55d125a9394581

SHA256
54320bdf05ff1d5257eada92b60243bb06181f655715fcebc403b24808a5f914

SHA512
15401bcd7dc066448c7c60daad8645c7f8a1eb5b0473a148e0721e8d7fb238e2c21da40a2298d8122b5fefdcb6dee9f11f76a627ac2c5ec8de7b7ded4b6ca093

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
320084ff7156bbd7fed2a6fc42ebdec0

SHA1
31be9f391b7ff58c582c110c55f1c43d8b3a54f2

SHA256
635df914890f81ccf44d9a10075f27d7220e8c65da4c26b59363eb0a0382f2c6

SHA512
5d3aeb1ad7463a9f760943c251f903b1f9f42bba4720c44aad91f781fb0812c721445d8ffaef3b9f5765524d5f2eb9ffc0b3f07929121ea79841963bc6a6ac06

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
1e595cb4fd7af2be4f35b6e249a27b8c

SHA1
8d785b4777001f4227a63e443eb9d4d66eb64a54

SHA256
489aea6236ae9aeaa853ac693c1de7360bb8e6dd7f63695b9969846a19a59b81

SHA512
afbb57ada6d2456518ade60269890743d412d05c05c4da8f74242bfec5516bb3a03f1e78f7218c394e262c67ca4540dfae6bb20db383f55c9318e9bbbe4c526a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
44153c74fee1c8ec5ef1716b303104df

SHA1
3aa469bc9de544c1b91cde9bf4824f2cc16ab622

SHA256
aae63e4553e726435051da0f2ceb779d1af362d6ffa5322946e650780070ce7f

SHA512
e52c91c29d1a94720a9da6c871e2160940f7e64528ed80ac0729c10a9363a75280c209c4096101bd9af9aeb5c21042e7ac8fcc1543ddaf8c10de61976c151ce7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
9bb91eaa3681c5ce0c22e9be9e12c026

SHA1
85b2c608ceb93e260d57d6ea58d381ace8d0c448

SHA256
f1f51ed03919a30a66e529590e8a7bc7e92e4044acee444f93cad37adfa8e056

SHA512
59040bcd7230ed217b103f058b8e4dd5c07772e489b4b3eb91ccf9467fa5d488ccc9971fb8b1067e53f922c54917e0cad2952f8d1c4eb4d40b4a01542486509a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
c4d5a9c1ac2cf98b701e423a644108ad

SHA1
ea895cee56ba89cde2fd0daaac804a6d041de0f9

SHA256
10d97180160e28d6248cfe0fc6f71ead13b377de3cadffe2c8d0ee22a1cd2a62

SHA512
405a29d38b558dcc7eab696e3e3f89f8190225d64a168c83a93b25d77311cf26d3b590325037fdc3b4e1de78e7022a088792c1c3c7e414959a4eff35b920ad51

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
82dd89aa2b0fa6a7e3264fd0db9b2ccf

SHA1
ec6546a30313ce262fcd6fde2ce29912e630f584

SHA256
ebd6d10ee1b4f216d365c1b023d80a7506398baaf8a3c8bde4132460b59cb06b

SHA512
d7250d3f350f8bb6c692110a3db29d0832e34f0c509c493527fd435b4a907333ba51fbe09af17031c8e3befe3c3d36494a8e04cfb9d4c3087825ac04b3f364f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
ac44e5faf3e4b043dd2b6a846ef86856

SHA1
0fc4fc1b9a8438982a83beb2cfe419a3c5e5dbaf

SHA256
57f361f7693b3e70c3f32b1941b96c0a4b52d997c55c8989816cd9730f76a8a7

SHA512
7cc6fe4fac6a367d66127544fcb536c1df28b00470adfcf3289c9dde87bd3505aa1cd0751ea37fcdb5c321134fbb02aae4c9c22ddc77ca8742b7b8ef5c2ba1fe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
4bb74d6334944f55c430dd81bd4ffa1f

SHA1
c25c0e9c85153c43b938d80756274e4ddd8c1209

SHA256
e74faf922cf7329a39069984f35c6239ce660d8c61aeb2e847c9699c229c2160

SHA512
6a2c73f2e138b41c26fcaff2be46543973063f7a99a57627ede9d1a82396f950cd453e1c261352dc92058560725a9cd99ce6d44f16b07c820a0f845e4fd33172

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
2283d80f98347412f70d9d8e0d09c218

SHA1
20e513d9b8b20e1b4b014c560178718adf817741

SHA256
c770e0eab83a8c00d01705610b60367be01daf08023e8746d9398e374641d0c7

SHA512
1caac278a3fd05e796aea88003f1ad25dd9b17b93b214af3f7974774ed84f1e7c7671bf04bdc525ed9400a9129906263aed69305b461470741ca7c787450723b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
575196b24b9d768f189ed304c145f37c

SHA1
d689756eb74e4e2c514214f5942f104682352250

SHA256
2c5acbd4b0a323697081cfbc7bd2531caccf8cb7aa9c39f1c5f4874ea2b2f8ee

SHA512
8efc1cf496b586a958ba0a89de133875e2337fbdbe89c0ed442e1a7a3d2ca37b0dcdeb95cb9056302aa0520911528887f2fe98ebfc70046c3d0df103cde04a4f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
87a0a7364051c1a7bea0696543dac782

SHA1
66f4f5274be2438fda6e68f631f0b34b73f3bca3

SHA256
db9b17ca962d343fe75887feb3cc9c25844a18e01ee87fc0a3a7706637c4e497

SHA512
be0bbbfc5dbe17ad818eff12acd199588ae507f5490e3027bdc6458b5eb1ecd2f31f033e396a46dcccad8b66b73bb56c3372858ec6708896708a42726a6edf51

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
8519dd9c4e18c4abf68934145fc2d10c

SHA1
ddae2aacdd2e6db27228ac932824dbb8b91c5bbe

SHA256
36a2c43074ccdbccdf0aa91729b214aecc2cfa4d5ef2df9067ef99746902333a

SHA512
4c57a255cc730732a75d09720b55ab5009f2731eaf0121ec8310418314296ac3ef9aae361d470c6dc5e78693c3f89362b10e33ba186d4ce286c9f3a4b147053f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
de54faa7554868b9413f799b0149fe1b

SHA1
e3155af900924808ac2327d5658a0cc9ee38f01d

SHA256
792ddae621536eb88eb5676c994afddb1e535e8fcc612c7dec9ec6bf7205ba9b

SHA512
9ad26818382a428afac71375924261086ce6f4945f1981dc7ab861dd91fc01d734be26ff5af260f2b25c7869c67110ae596d0f18d45ecd12bea1d7298ad919ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
22724aaf7fb8467e7ae890f8382dda0a

SHA1
162928311085b80da67055619a7f311caf34bda6

SHA256
cb6338cb77f04fee0903de0f85d50130ae7a9ab6fd4bbec80c69c9054ecc3368

SHA512
b0c67c427be8535f4f8648e87a163528d5777b6562f2fc1593c3901c81e09b02969e58d1247a2ceb164754f5763f39b9da1e6a808283645a8e704fb056da783e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
e7622c8df90b47b2cc468b88207b25d0

SHA1
561a34e6e282ea9778a67d1f8892a18b9680fde7

SHA256
1b3f1017efcb5255def447e8b974f8b95ea67c9e04d1fc990ead17c4e564816c

SHA512
99d93303a4538bb6856a9201ba562ff05f2ecdef09a4dc8cb61cceba6d2b8909d81e2f31a72a307a0577204fe711a258b74806b70abc19860eec914ec1ea358b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
fa0b5c3ef11173aeeca7fa1588e82544

SHA1
8997205ae2da153db7c9778f7fc13a7b22106bec

SHA256
3fc9e38b6aa5231d5f481d3e1e20c1679d983a8f7ce73c63be6173686f6261e0

SHA512
a15c62a0b06c82042158a791e729e031e01103546375d81b0c7ee47a4f0f3daf7f45444a508c5183541fc34669bd17ef34727878ea0752359be08c054d8c3844

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
2e4af333ff1aa30e98d5d0a8a8e382a5

SHA1
e1f08f1abecf55147b83ca1f69c19fda5e4cf3f3

SHA256
3cd2de20e858b159cc3615a40da0b8f29439deae834bfcb0749d4bba65aa813d

SHA512
d1e8a8c215c16eedbf24991c8aab2b4893c28e8e7eb710fb4d7737c6f6eeda749f117ff5463abd4cfa4d2a29b1cd0d982c1338334c284917a428423dca844689

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
8d2cd6b5db021714527e025a66c97807

SHA1
8117bd30b4ecc7f194ca8a69e20710bd247ffe5d

SHA256
f0db1b8d9016cae1b49e543111b9cfbd7eaef9353dfc388f548b59cc06b0912b

SHA512
2ca9b8b85b4b5e1975df4cbcd863118dc6b0305fd0ba24a0c171307e71fdba9fadcb9714606ac988141efec9f0ee4954d615cb699802b8e3768247b567d396f7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
6fc23e58de93772a1c3367d6ed95f0bd

SHA1
bb53c7682fffac0991460af11139fff3df5c40e0

SHA256
a6166113b729e0882f18b281711dfbd9b127c4f4b64a3831a503c517a8b21628

SHA512
6e68f1fc1048cf39b76fbbd0fb2133b1917218a1cae88910d2790bdcfc1f734ca73e4cb8f74804505abd2adba173ff168949ebeae5205ffbff3a555e3a530b0d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
ffa2ab4f859085b0e0e59581e9c79167

SHA1
e182e9befe0523d3d18c634dc59957cfdb927983

SHA256
bc62e759aff46deaf00afc4a5438142afa6e5093159dc8197d9a53cafdb84ec0

SHA512
41f5058830a98787b00fb4249821d29a567e0dd6216f9e5aec3c9f3d351af741a4b3fee10eb6094152eb3f9e7617b6a7760bd36bdfe71c7153242d4aa96f23ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
8076526f3d19947ce63d794e19111951

SHA1
f76989659cb6f16e122b099930181663513b1fea

SHA256
ed7560ec42a6cd8a98d97f8c61935972b4c9e6f872dd88f51ee0f7681431e410

SHA512
50cb5c43896c2c7997e219934e1b4d028bace3bb9bbf93c67544b7f4f152f39bdb45e5a843c4932bfc4967e35cadc17e66ad93984285dc8b8482eea66869b4b3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
e621f11daedce0bba2aae84a341191ae

SHA1
ef816c61a95551996636696062d8f7fdf57c0f36

SHA256
8f673949ea997f6f7eea6bc1bed31e895829140f372761a3728e35dd61cb45a7

SHA512
da0b8e187aa34151cf64a2b9600c7b51f57524da77df3039dfe39d60a00f57709c135ad8565ab7791af29ef394d5c0df17de2b267b21cdfe98f5d6bccf4bc352

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
749fa4d4b1b672ac391cc8968d1c3da5

SHA1
67260537e640fd242fb456ed6f252c21875b8606

SHA256
12ec24f1028b1a300332d11f51e45b3aad0efc8328f52e03e326f730571c067b

SHA512
efc2602f466cfc3ced603aec78d5f0e54e05d0f840972d9452aacc1df1445ba2704e5d4fe5796afcb6993d0405bb1241da7c5cffa5df8ce921910ba45cebb013

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
15KB

MD5
a21c03be89ac0785aa96ee16e12d2a51

SHA1
75e688f736f663c03fa7e15b8845cdf873c5b553

SHA256
60762502caa9582ee01d10aa6489e6841e5267797e930ba9e0fe40c2933775ca

SHA512
71ffa4c23876c61a4db2645ff69ce7a1fed52d2bec3b0f15f96313c6a24a919e6bc7009e448b0c4e1a8ceecca1658dee1ccc12b91bb5e430f01eb0c55f557010

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
184KB

MD5
94fb04b8aae29001b79d244f6f0a799d

SHA1
7031e7bf7b09d84f7708df42dcf6a4ff78fd47e9

SHA256
881370db71c86aa2c4bf18beff9262fb0b1b4632fb71cbb72f25be022f4f27ae

SHA512
97acca11172bb7748625d70ddb92ed50f8ea11300a19572505eec777680965a2eccefb651e3e66b9d8d37c8cd97ec1421613ec61d27664315a49e5becfa7b725

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
184KB

MD5
88da3d34f24cc657306396336a8c6ac8

SHA1
c2c7e08729a6a9d937acaadb8d217f92180d59ce

SHA256
e24100e20796f3f80c0cfcdecca776e583553ff1602b52e017ea3262767b3572

SHA512
ae3418119d6c715874144febcaacf737565a4bb349b737273410387eafeb8dbd70f2a2cb45e9d2f63184c627a8471ea3c4bca7707d7c4dfe5383b526400691a3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
184KB

MD5
076f670035e69fd30753254b61726a0e

SHA1
b5ab743f5b214ae48163eef1bf33c49cde4c0b24

SHA256
5cc1b7b65b5d716112f51d82153a0e7e0c8eaf1452b486ec54486632b8e057c8

SHA512
e2d7385ccf2fef3e8625d7bd865fe5e7ee61e022377647bf47952dcaf200169ea82af5c7d1704c5cffbb6e9cc6ba45b1c18130bd6f5beac6b8dc9eb66b6a3a75

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
184KB

MD5
5a9e995e51019cb4ce8315cc452680c0

SHA1
2010be458d475d964acb0cadaf31e74c0e4f6b87

SHA256
18586e59767e961954afb9ef69d6dc8ff9ce462d16da8262fc7005c40d5c0778

SHA512
3b7af713266b73f554e14e4dc77da2c8dd9128ce7e27f52796336d8090799b0da719e5a9ae86c265ec7de31981b3a8f7530eac434b2e95c39253fe8af5bc3de4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Filesize
264KB

MD5
46b6a8a6dc38584a070399082bfba9c2

SHA1
3975492960536e33f4d5d9b5f39cecbdf3a42ddd

SHA256
1d2e04044f559a0e181c87a4b07038dbd2231d12b0acc8ed235cc942063dcf54

SHA512
5bd955284bf55a65357d70d3d8bd895f5477afa744b9352928aff7bfa7e7d26ee5bc9b00529f4ff62355cafa45c7decc03d8c5841b94cce7ea58e262dfed9ef7

Download Submit
C:\Users\Admin\AppData\Local\Luau Language Server\server\index.js
Filesize
6.1MB

MD5
6b1cad741d0b6374435f7e1faa93b5e7

SHA1
7b1957e63c10f4422421245e4dc64074455fd62a

SHA256
6f17add2a8c8c2d9f592adb65d88e08558e25c15cedd82e3f013c8146b5d840f

SHA512
a662fc83536eff797b8d59e2fb4a2fb7cd903be8fc4137de8470b341312534326383bb3af58991628f15f93e3bdd57621622d9d9b634fb5e6e03d4aa06977253

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Filesize
10KB

MD5
a45cfa35ab8dd5d7090837fcdc001404

SHA1
f7af17ffa7d3ed92dc9db2119f5151797964a169

SHA256
b756630437d400f9d72ed58f7b95c94c3e0ea00f34fd2c45822227eb06ade6e6

SHA512
2a38a1804b884f5869f02bd97f2fb9b7e0d9c7a03a807ac52076ddbd1129289bc6afe49c2d5e77e495f310d831cd7bcd28ccea830799439bd2b31ed36d9a1cf3

Download Submit
C:\Users\Admin\AppData\Local\Wave\WaveBootstrapper.exe
Filesize
949KB

MD5
8fb51b92d496c6765f7ba44e6d4a8990

SHA1
d3e5a8465622cd5adae05babeb7e34b2b5c777d7

SHA256
ab49d6166a285b747e5f279620ab9cea12f33f7656d732aa75900fcb981a5394

SHA512
20de93a52fff7b092cb9d77bd26944abed5f5cb67146e6d2d70be6a431283b6de52eb37a0e13dc8bc57dcf8be2d5a95b9c11b3b030a3e2f03dd6e4efc23527a6

Download Submit
C:\Users\Admin\AppData\Local\Wave\WaveWindows.exe
Filesize
8.0MB

MD5
b8631bbd78d3935042e47b672c19ccc3

SHA1
cd0ea137f1544a31d2a62aaed157486dce3ecebe

SHA256
9cfda541d595dc20a55df5422001dfb58debd401df3abff21b1eee8ede28451c

SHA512
0c51d6247e39f7851538a5916b24972e845abfe429f0abdc7b532f654b4afe73dc6e1936f1b062da63bfc90273d3cbc297bf6c802e615f3711d0f180c070aa26

Download Submit
\??\pipe\crashpad_3496_QBXWCFGKQWZDDXWE
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1420-86-0x000000007492E000-0x000000007492F000-memory.dmp

Filesize
4KB

Download
memory/1420-92-0x0000000074920000-0x00000000750D1000-memory.dmp

Filesize
7.7MB

Download
memory/1420-3-0x0000000074920000-0x00000000750D1000-memory.dmp

Filesize
7.7MB

Download
memory/1420-5-0x00000000059E0000-0x00000000059EE000-memory.dmp

Filesize
56KB

Download
memory/1420-4-0x0000000005C10000-0x0000000005C48000-memory.dmp

Filesize
224KB

Download
memory/1420-1-0x00000000003E0000-0x0000000000572000-memory.dmp

Filesize
1.6MB

Download
memory/1420-148-0x000000000B590000-0x000000000B602000-memory.dmp

Filesize
456KB

Download
memory/1420-2-0x0000000074920000-0x00000000750D1000-memory.dmp

Filesize
7.7MB

Download
memory/1420-93-0x0000000074920000-0x00000000750D1000-memory.dmp

Filesize
7.7MB

Download
memory/1420-144-0x0000000009FC0000-0x000000000A056000-memory.dmp

Filesize
600KB

Download
memory/1420-145-0x000000000B560000-0x000000000B586000-memory.dmp

Filesize
152KB

Download
memory/1420-926-0x0000000074920000-0x00000000750D1000-memory.dmp

Filesize
7.7MB

Download
memory/1420-146-0x000000000B200000-0x000000000B208000-memory.dmp

Filesize
32KB

Download
memory/1420-0-0x000000007492E000-0x000000007492F000-memory.dmp

Filesize
4KB

Download
memory/1420-150-0x000000000B910000-0x000000000B91A000-memory.dmp

Filesize
40KB

Download
memory/1420-149-0x000000000B600000-0x000000000B60A000-memory.dmp

Filesize
40KB

Download
memory/3168-943-0x00000000094C0000-0x0000000009572000-memory.dmp

Filesize
712KB

Download
memory/3168-949-0x000000000AFE0000-0x000000000B337000-memory.dmp

Filesize
3.3MB

Download
memory/3168-948-0x000000000A030000-0x000000000A052000-memory.dmp

Filesize
136KB

Download
memory/3168-938-0x0000000005330000-0x0000000005338000-memory.dmp

Filesize
32KB

Download
memory/3168-937-0x0000000005500000-0x00000000055A0000-memory.dmp

Filesize
640KB

Download
memory/3168-936-0x0000000005450000-0x0000000005502000-memory.dmp

Filesize
712KB

Download
memory/3168-935-0x00000000001C0000-0x00000000009C2000-memory.dmp

Filesize
8.0MB

Download
memory/4936-924-0x0000000000960000-0x0000000000A52000-memory.dmp

Filesize
968KB

Download
memory/4936-927-0x0000000008A30000-0x0000000008B34000-memory.dmp

Filesize
1.0MB

Download
memory/4936-928-0x0000000009730000-0x0000000009746000-memory.dmp

Filesize
88KB

Download
memory/4936-929-0x0000000009770000-0x000000000977A000-memory.dmp

Filesize
40KB

Download
memory/4936-931-0x0000000009810000-0x000000000982E000-memory.dmp

Filesize
120KB

Download
memory/4936-930-0x00000000097B0000-0x00000000097B8000-memory.dmp

Filesize
32KB

Download