43e6ae7e38488e95741b1cad60843e7ce49419889285433eb4e697c175a153ab

Analysis

max time kernel
56s
max time network
149s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
05/08/2024, 06:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WaveInstaller.exe
Size

2.3MB
MD5

8ad8b6593c91d7960dad476d6d4af34f
SHA1

0a95f110c8264cde7768a3fd76db5687fda830ea
SHA256

43e6ae7e38488e95741b1cad60843e7ce49419889285433eb4e697c175a153ab
SHA512

09b522da0958f8b173e97b31b6c7141cb67de5d30db9ff71bc6e61ca9a97c09bff6b17d6eaa03c840500996aad25b3419391af64de1c59e98ff6a8eac636b686
SSDEEP

49152:6inbT3qpTDQSmanAmwJAaDMg33U2pLYiniT:6inKpTJmWAmmAMPWin

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaveInstaller.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2836	chrome.exe
2836	chrome.exe

Suspicious use of AdjustPrivilegeToken 57 IoCs

description	pid	Process
Token: SeDebugPrivilege	292	WaveInstaller.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 2688	2836	chrome.exe	32
PID 2836 wrote to memory of 2688	2836	chrome.exe	32
PID 2836 wrote to memory of 2688	2836	chrome.exe	32
PID 2836 wrote to memory of 2624	2836	chrome.exe	34
PID 2836 wrote to memory of 2624	2836	chrome.exe	34
PID 2836 wrote to memory of 2624	2836	chrome.exe	34
PID 2836 wrote to memory of 2624	2836	chrome.exe	34
PID 2836 wrote to memory of 2624	2836	chrome.exe	34
PID 2836 wrote to memory of 2624	2836	chrome.exe	34
PID 2836 wrote to memory of 2624	2836	chrome.exe	34
PID 2836 wrote to memory of 2624	2836	chrome.exe	34
PID 2836 wrote to memory of 2624	2836	chrome.exe	34
PID 2836 wrote to memory of 2624	2836	chrome.exe	34
PID 2836 wrote to memory of 2624	2836	chrome.exe	34
PID 2836 wrote to memory of 2624	2836	chrome.exe	34
PID 2836 wrote to memory of 2624	2836	chrome.exe	34
PID 2836 wrote to memory of 2624	2836	chrome.exe	34
PID 2836 wrote to memory of 2624	2836	chrome.exe	34
PID 2836 wrote to memory of 2624	2836	chrome.exe	34
PID 2836 wrote to memory of 2624	2836	chrome.exe	34
PID 2836 wrote to memory of 2624	2836	chrome.exe	34
PID 2836 wrote to memory of 2624	2836	chrome.exe	34
PID 2836 wrote to memory of 2624	2836	chrome.exe	34
PID 2836 wrote to memory of 2624	2836	chrome.exe	34
PID 2836 wrote to memory of 2624	2836	chrome.exe	34
PID 2836 wrote to memory of 2624	2836	chrome.exe	34
PID 2836 wrote to memory of 2624	2836	chrome.exe	34
PID 2836 wrote to memory of 2624	2836	chrome.exe	34
PID 2836 wrote to memory of 2624	2836	chrome.exe	34
PID 2836 wrote to memory of 2624	2836	chrome.exe	34
PID 2836 wrote to memory of 2624	2836	chrome.exe	34
PID 2836 wrote to memory of 2624	2836	chrome.exe	34
PID 2836 wrote to memory of 2624	2836	chrome.exe	34
PID 2836 wrote to memory of 2624	2836	chrome.exe	34
PID 2836 wrote to memory of 2624	2836	chrome.exe	34
PID 2836 wrote to memory of 2624	2836	chrome.exe	34
PID 2836 wrote to memory of 2624	2836	chrome.exe	34
PID 2836 wrote to memory of 2624	2836	chrome.exe	34
PID 2836 wrote to memory of 2624	2836	chrome.exe	34
PID 2836 wrote to memory of 2624	2836	chrome.exe	34
PID 2836 wrote to memory of 2624	2836	chrome.exe	34
PID 2836 wrote to memory of 2624	2836	chrome.exe	34
PID 2836 wrote to memory of 2656	2836	chrome.exe	35
PID 2836 wrote to memory of 2656	2836	chrome.exe	35
PID 2836 wrote to memory of 2656	2836	chrome.exe	35
PID 2836 wrote to memory of 748	2836	chrome.exe	36
PID 2836 wrote to memory of 748	2836	chrome.exe	36
PID 2836 wrote to memory of 748	2836	chrome.exe	36
PID 2836 wrote to memory of 748	2836	chrome.exe	36
PID 2836 wrote to memory of 748	2836	chrome.exe	36
PID 2836 wrote to memory of 748	2836	chrome.exe	36
PID 2836 wrote to memory of 748	2836	chrome.exe	36
PID 2836 wrote to memory of 748	2836	chrome.exe	36
PID 2836 wrote to memory of 748	2836	chrome.exe	36
PID 2836 wrote to memory of 748	2836	chrome.exe	36
PID 2836 wrote to memory of 748	2836	chrome.exe	36
PID 2836 wrote to memory of 748	2836	chrome.exe	36
PID 2836 wrote to memory of 748	2836	chrome.exe	36
PID 2836 wrote to memory of 748	2836	chrome.exe	36
PID 2836 wrote to memory of 748	2836	chrome.exe	36
PID 2836 wrote to memory of 748	2836	chrome.exe	36
PID 2836 wrote to memory of 748	2836	chrome.exe	36
PID 2836 wrote to memory of 748	2836	chrome.exe	36
PID 2836 wrote to memory of 748	2836	chrome.exe	36

C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:292

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef68a9758,0x7fef68a9768,0x7fef68a9778
  2⤵
  PID:2688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1176 --field-trial-handle=1384,i,9984472249431592285,16784823195194112950,131072 /prefetch:2
  2⤵
  PID:2624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1524 --field-trial-handle=1384,i,9984472249431592285,16784823195194112950,131072 /prefetch:8
  2⤵
  PID:2656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1620 --field-trial-handle=1384,i,9984472249431592285,16784823195194112950,131072 /prefetch:8
  2⤵
  PID:748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2312 --field-trial-handle=1384,i,9984472249431592285,16784823195194112950,131072 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2332 --field-trial-handle=1384,i,9984472249431592285,16784823195194112950,131072 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1396 --field-trial-handle=1384,i,9984472249431592285,16784823195194112950,131072 /prefetch:2
  2⤵
  PID:2944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2960 --field-trial-handle=1384,i,9984472249431592285,16784823195194112950,131072 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3656 --field-trial-handle=1384,i,9984472249431592285,16784823195194112950,131072 /prefetch:8
  2⤵
  PID:236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=2760 --field-trial-handle=1384,i,9984472249431592285,16784823195194112950,131072 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3936 --field-trial-handle=1384,i,9984472249431592285,16784823195194112950,131072 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2480 --field-trial-handle=1384,i,9984472249431592285,16784823195194112950,131072 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3764 --field-trial-handle=1384,i,9984472249431592285,16784823195194112950,131072 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=2268 --field-trial-handle=1384,i,9984472249431592285,16784823195194112950,131072 /prefetch:1
  2⤵
  PID:2720

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76c1c391a481e998e1e0bea27339a8e9

SHA1
990ae2df1017cbc27b3dcf215109e1d9a4e3ecc2

SHA256
f29816a2ffc7866b30902f56a6338c1493cbbe1a6b5ae75be367147e434652dc

SHA512
9ab32a649fe7bf7bfb3d27033638a305cc44cae6dcfb94a75188d47c9fb0d04c39be5030c131c1e9ba59a5703fece2ab09e6bfd56474626705645730e5392e5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
149a42f9ed55b59f6ec2cf946123a73a

SHA1
ebe8422bdcb9f2e6c21c46c0eb16e8e28df8e631

SHA256
1f57d0949ff0058cc0524ea6c4db9279298509f1195e211290f4cedc6f16c7dc

SHA512
a7b78eaacf205e2e6c0f875eb079cf03c4143058cf927cf04a02a3c0b909b21fa7ad51f187c63a60e3c074c91e31905ce16ea629c3983db4156b24466ffe29ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
46a8b2bf72e4cf6efaf93d410a8358c1

SHA1
89d522171f0d78a21825721cd6ebd3e8ddabbc53

SHA256
fe61e5b865346b4c1a0043c535f6cfcfa8d54538cdf5b597450b51c39697adfe

SHA512
21bdd797e6753eed56ec7c015549c0ad78861c1a905b94ae126bda2efd0f26c641eab2423ed886a5ff2920525389987b47be13aad6b046de569d3565083cf201

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8cd18a99ec279bad15ec9085cc13bdce

SHA1
50800143a3a64155b24f320d1a44717a0dd82c54

SHA256
179e872133660d743daa9d6b28f634d6af8419702fec752e60e31d037e938f13

SHA512
15fa98545d70d838886b3b3323b3f4faf244346fc55f194bfd965d0e87785bdde8a78d17b0c7c7bcf4c974d06a3ca06413a89b575ba13fdd50f6f212201b62da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f28a222d2803af0b9b32fe3504cb04a9

SHA1
6b9d2e3555e43dd6d3c6f35a337cdca2cbdb0438

SHA256
c85ad0b4dfe392733607dc518983cc4db4e126fd43fae5bb086e46647d69cdd6

SHA512
25537513eba7370f39b27f881308fc78c8074c950f78863290294dfa0ee144cd6b52f83161ec1873427b9fffffa4119a0fc917e79d0fa936e6e9c5b2a2948193

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29adc73d1f9742b4823e619e09c2e031

SHA1
5f2526babb0f6c43e2f56ae7c969031f1c8e43d7

SHA256
f483b4d180945a718e2729d0ffb461ba4d38e3cfd41b165d9f2b2d314a378d13

SHA512
4724ba07d88526aa1887dfd4e39d8a6a85c6a795ace14b36d8b1c8362e238f56bbc31f7caeb3dee4a760b28a1f0a09116582f2cc9db788526bf869234a8c0b1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d05407b8ea00ec8c38e91361d64a29d

SHA1
fa0c36548275f9ad455d4b8a9b53d2222d5f3324

SHA256
59b44f27712a276d2706f4212f9b1f17fe611014fa73b0cd7383c5499bf81ae9

SHA512
213f45587d6efe8331f375d0b08ed9a3f53560a1f7d63238ada4bb2f7370a86e368add9fd241e14f7d31ef23dc01092cabde2efbbfb66996f71686ee33cd154e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8af2682faa8f77b83660f3d57db19eee

SHA1
47ba514e442df41836de7eaeb4d0dea680fad691

SHA256
8d99d53dd7902cc3264e2d38da719521ac1391465e5c13f59b3f250a56ff3ada

SHA512
ad15db24afa4d65da882d0e2e1dedbd01fb824736b82ad68b7968b4f71785e441cc3ce155841c4a3c3a731b193f2998a143f3cc565f9be5289ea8bb5d44f5f41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30253bdedcb3ec50428eb3a9c40d2fbe

SHA1
2bc06cc75b76cfcb26b552cc05c0c79e18852aef

SHA256
18dfe61952c0b9d7a96dd13efd1b903e6d79c8586e0d14dcf955a7138af34e7f

SHA512
80d4d0824daeec7371e2e5953d417f8f7d7f779ebda085832e686b9366240ad7604bf48fcaa5c34500ed495effad4ceb42f5aa4bbd680a96cac8fe6c4d67f1ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49ba446c45c22d27531b3d5ab2dc716e

SHA1
8dcf6dc7a079ebbc90f15ae46eb4d660abcf227c

SHA256
99fed4c341f65c28125ee03344bf228bf423d8522715c226a135d464ac4ac4a1

SHA512
07d85d823569eaf4a735478b4ba97ca63ae8f228593247c6756684ba1b92d26d78eda37876a2f68b3b8d2915356576b15ded0a188a4773c7053cc729572b950d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e40d03dd37b0af1e6b5c8518055e020e

SHA1
aa49169981c4d319ca9efd1b2519c2bc1d32ef8f

SHA256
6409faa7a258efd40ed43de3d899277b4459cc2947df55982266edf5457302d1

SHA512
baa56275f714df56ada93046b9e906a6229056131c335c797fa4addc47c17e515faeb6a6d07616d2c41fd00c2866b7756b84ec5abbf7c7924baa733df06dc833

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c65714f0b250ea65d0cdc74c9292ec7

SHA1
bdf56e8707d8b124f70bcd01aa849ce4bbfc47c4

SHA256
753a496df042c43ba23d75627b4187e439a17946203f78da794238b059f3d880

SHA512
eac4dd11f6ff802a3e67796f966131ff5dd26195d958c5c834fe54c5fe3789ba8e2459c1828d0630b923a275239bbaa556d7b2582b916fb2cc6e769a3382742d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf0506555b1d44b4d12560e72c72d37f

SHA1
d93c14cc300abcf30a7aa0b2edaf3142504b56bd

SHA256
c1433e394d0cd9338b48b7631d375e88778d953b4c1779f1a25779ea107cdbd4

SHA512
4de4991c59ba0ce89e22867f485d4607688e233826ef92d9ddfd31080587b6d35ed4be6ba100de04c1ae5d291c66a274251a930168c54a68626420ff6f483e72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
161af8fea8ba6b30b9fd04d715c27f45

SHA1
2741800849654da8cc51ac6090645c2f46359ce9

SHA256
8618d03a9f85247d9a5da113b872d23066535117253c0c950bb036b098746b90

SHA512
54946088ec3ce872232d855207f1664127c4c30766eb8cc99e0250ad49efd69ab372d521c65e9293f208752e263dba9e6eeda5399848687b0ed27085193465dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8727926063591bd147598ab26cab1934

SHA1
f8b95acc4f9076749e1954fe490e8ef7bddad18c

SHA256
15be0ae1f247770acf63595dfaf9f6a0a20ee7f543d311d4017a028c84e743e6

SHA512
8b484d62138bfbcabfcb50e193c62a39f3b00a0525f8b423add73a8ac42b30180bcd5c2080833768c682ea6e888515d06312507977fe8600cecc716347577824

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b

Filesize
209KB

MD5
3e552d017d45f8fd93b94cfc86f842f2

SHA1
dbeebe83854328e2575ff67259e3fb6704b17a47

SHA256
27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6

SHA512
e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
600B

MD5
86c4fa2e9b82631896e7de1acb0b0674

SHA1
f2c05a4b8f73f71deb1394e800e1de0a63237bdb

SHA256
2cecd34ef776883e578c9c549ab32fd952d823491b896da791aa80a55ac8b974

SHA512
6c64837845b5a168af84353d2141b727e35fa7893d35c3e27a13aa4d506da69080985c3fedbb3f9f3cce26389f72b054efe88b2e87a6876fa4ab790dd9b19f57

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.brandbucket.com_0.indexeddb.leveldb\CURRENT~RFf774dd2.TMP

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
e32dc2f430247d13af5d8b14c269cc7e

SHA1
485b3fb9107b354cf56f4acbe5350cfe8211783a

SHA256
20882f2fe9fc41e9859a7d4ba07e29a17069baa8682eb0e9f957bedc41535018

SHA512
62eea3b82a8dfdaeccd4e1a2a7b4ad13abd89569b2ff04fd0cb10f504160c37689bb9c42ec7ed22bc332823ce8d63d69a95a47ff7026c7766cb05cdb3b1ff679

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
363B

MD5
074751800ff80fa3c54f31d40c9326a0

SHA1
705d0ff75f0a5886178846f651b44dc83709058a

SHA256
9a182691d95064e24ef1cc3b8807e116f358ff26637a5a2211cdfc5c598d9a03

SHA512
7e24fc4b4808c9123e8bcac6be92a6aef8f4bff97ed7d565ed215be0e8836ff0577eea5102b287476d68b4ba7a3a5fc0bb4fe72653db3e854cc716bf3060b344

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
547600b14995aa0ca0ee36ce786c8827

SHA1
4f79cb34505b46250140d4a4fb434c3326ed8e49

SHA256
27feda1a69f1023103508861908a0f95693dcca91405796a40f37d2b51885cd2

SHA512
e34de9e575162ff1cbd0af673aecb9890ebaad8e8dd0470d938b4aa92f215c4ab8850248f19ef2b4632a1831284562311f12652721b48b3603c5968d72a23204

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
b43ba3a14cf94709ab63d1a2bdb36ab5

SHA1
b48e9e2f2271a88521e54fb14415225148085903

SHA256
9b303629cd9b14df97b40e1d37d9730cb1c75a561aa52e08fa8908d94814a348

SHA512
d86f9a1b5cd93bdd3b1a0bbd152af8882b3bd80a6f2c50b3bcacde0cc0a495a8677469ae4db03a9aa03c3481d72d8753669573ef0f18a2664908dbdbc580ffe3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
c3d2d3a6d3df04ac685277a85faad15f

SHA1
8d7a2ae54f2dd244781929f1c2bca1d8842aacf8

SHA256
88aa71518b342ad8248056a1f80bd5c066e7dd9433cc8a386c32ef3dd0963c3a

SHA512
3180d75e51237d21fb324aaab074489439d16d5224b99258e36a5460ce5614eda93b6bece53a46e895fecf515e3f8d2175b1f1df0135f3afe83a29eabb9c92eb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\CURRENT

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab32B6.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar32C9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
memory/292-14-0x00000000079A0000-0x0000000007A16000-memory.dmp

Filesize
472KB

Download
memory/292-12-0x00000000742C0000-0x00000000749AE000-memory.dmp

Filesize
6.9MB

Download
memory/292-24-0x00000000742C0000-0x00000000749AE000-memory.dmp

Filesize
6.9MB

Download
memory/292-23-0x00000000742C0000-0x00000000749AE000-memory.dmp

Filesize
6.9MB

Download
memory/292-22-0x00000000058D0000-0x00000000058DA000-memory.dmp

Filesize
40KB

Download
memory/292-21-0x0000000000AA0000-0x0000000000AAA000-memory.dmp

Filesize
40KB

Download
memory/292-20-0x00000000051A0000-0x00000000051B6000-memory.dmp

Filesize
88KB

Download
memory/292-18-0x0000000004E50000-0x0000000004E58000-memory.dmp

Filesize
32KB

Download
memory/292-17-0x0000000004E20000-0x0000000004E46000-memory.dmp

Filesize
152KB

Download
memory/292-16-0x0000000004CA0000-0x0000000004CD2000-memory.dmp

Filesize
200KB

Download
memory/292-15-0x0000000004C10000-0x0000000004C1A000-memory.dmp

Filesize
40KB

Download
memory/292-0-0x00000000742CE000-0x00000000742CF000-memory.dmp

Filesize
4KB

Download
memory/292-13-0x0000000004AD0000-0x0000000004ADA000-memory.dmp

Filesize
40KB

Download
memory/292-25-0x00000000742C0000-0x00000000749AE000-memory.dmp

Filesize
6.9MB

Download
memory/292-11-0x00000000742CE000-0x00000000742CF000-memory.dmp

Filesize
4KB

Download
memory/292-10-0x00000000742C0000-0x00000000749AE000-memory.dmp

Filesize
6.9MB

Download
memory/292-9-0x00000000742C0000-0x00000000749AE000-memory.dmp

Filesize
6.9MB

Download
memory/292-7-0x0000000000AA0000-0x0000000000AAA000-memory.dmp

Filesize
40KB

Download
memory/292-8-0x0000000000AA0000-0x0000000000AAA000-memory.dmp

Filesize
40KB

Download
memory/292-6-0x0000000000570000-0x0000000000578000-memory.dmp

Filesize
32KB

Download
memory/292-5-0x0000000000560000-0x0000000000568000-memory.dmp

Filesize
32KB

Download
memory/292-4-0x0000000000BF0000-0x0000000000C72000-memory.dmp

Filesize
520KB

Download
memory/292-3-0x0000000000D70000-0x0000000000E22000-memory.dmp

Filesize
712KB

Download
memory/292-2-0x00000000742C0000-0x00000000749AE000-memory.dmp

Filesize
6.9MB

Download
memory/292-1-0x0000000000E40000-0x000000000108A000-memory.dmp

Filesize
2.3MB

Download