43e6ae7e38488e95741b1cad60843e7ce49419889285433eb4e697c175a153ab

Analysis

max time kernel
54s
max time network
154s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
06/08/2024, 01:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WaveInstaller.exe
Size

2.3MB
MD5

8ad8b6593c91d7960dad476d6d4af34f
SHA1

0a95f110c8264cde7768a3fd76db5687fda830ea
SHA256

43e6ae7e38488e95741b1cad60843e7ce49419889285433eb4e697c175a153ab
SHA512

09b522da0958f8b173e97b31b6c7141cb67de5d30db9ff71bc6e61ca9a97c09bff6b17d6eaa03c840500996aad25b3419391af64de1c59e98ff6a8eac636b686
SSDEEP

49152:6inbT3qpTDQSmanAmwJAaDMg33U2pLYiniT:6inKpTJmWAmmAMPWin

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaveInstaller.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
280	chrome.exe
280	chrome.exe

Suspicious use of AdjustPrivilegeToken 51 IoCs

description	pid	Process
Token: SeDebugPrivilege	2532	WaveInstaller.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 280 wrote to memory of 3020	280	chrome.exe	32
PID 280 wrote to memory of 3020	280	chrome.exe	32
PID 280 wrote to memory of 3020	280	chrome.exe	32
PID 280 wrote to memory of 1576	280	chrome.exe	34
PID 280 wrote to memory of 1576	280	chrome.exe	34
PID 280 wrote to memory of 1576	280	chrome.exe	34
PID 280 wrote to memory of 1576	280	chrome.exe	34
PID 280 wrote to memory of 1576	280	chrome.exe	34
PID 280 wrote to memory of 1576	280	chrome.exe	34
PID 280 wrote to memory of 1576	280	chrome.exe	34
PID 280 wrote to memory of 1576	280	chrome.exe	34
PID 280 wrote to memory of 1576	280	chrome.exe	34
PID 280 wrote to memory of 1576	280	chrome.exe	34
PID 280 wrote to memory of 1576	280	chrome.exe	34
PID 280 wrote to memory of 1576	280	chrome.exe	34
PID 280 wrote to memory of 1576	280	chrome.exe	34
PID 280 wrote to memory of 1576	280	chrome.exe	34
PID 280 wrote to memory of 1576	280	chrome.exe	34
PID 280 wrote to memory of 1576	280	chrome.exe	34
PID 280 wrote to memory of 1576	280	chrome.exe	34
PID 280 wrote to memory of 1576	280	chrome.exe	34
PID 280 wrote to memory of 1576	280	chrome.exe	34
PID 280 wrote to memory of 1576	280	chrome.exe	34
PID 280 wrote to memory of 1576	280	chrome.exe	34
PID 280 wrote to memory of 1576	280	chrome.exe	34
PID 280 wrote to memory of 1576	280	chrome.exe	34
PID 280 wrote to memory of 1576	280	chrome.exe	34
PID 280 wrote to memory of 1576	280	chrome.exe	34
PID 280 wrote to memory of 1576	280	chrome.exe	34
PID 280 wrote to memory of 1576	280	chrome.exe	34
PID 280 wrote to memory of 1576	280	chrome.exe	34
PID 280 wrote to memory of 1576	280	chrome.exe	34
PID 280 wrote to memory of 1576	280	chrome.exe	34
PID 280 wrote to memory of 1576	280	chrome.exe	34
PID 280 wrote to memory of 1576	280	chrome.exe	34
PID 280 wrote to memory of 1576	280	chrome.exe	34
PID 280 wrote to memory of 1576	280	chrome.exe	34
PID 280 wrote to memory of 1576	280	chrome.exe	34
PID 280 wrote to memory of 1576	280	chrome.exe	34
PID 280 wrote to memory of 1576	280	chrome.exe	34
PID 280 wrote to memory of 1576	280	chrome.exe	34
PID 280 wrote to memory of 1576	280	chrome.exe	34
PID 280 wrote to memory of 1568	280	chrome.exe	35
PID 280 wrote to memory of 1568	280	chrome.exe	35
PID 280 wrote to memory of 1568	280	chrome.exe	35
PID 280 wrote to memory of 336	280	chrome.exe	36
PID 280 wrote to memory of 336	280	chrome.exe	36
PID 280 wrote to memory of 336	280	chrome.exe	36
PID 280 wrote to memory of 336	280	chrome.exe	36
PID 280 wrote to memory of 336	280	chrome.exe	36
PID 280 wrote to memory of 336	280	chrome.exe	36
PID 280 wrote to memory of 336	280	chrome.exe	36
PID 280 wrote to memory of 336	280	chrome.exe	36
PID 280 wrote to memory of 336	280	chrome.exe	36
PID 280 wrote to memory of 336	280	chrome.exe	36
PID 280 wrote to memory of 336	280	chrome.exe	36
PID 280 wrote to memory of 336	280	chrome.exe	36
PID 280 wrote to memory of 336	280	chrome.exe	36
PID 280 wrote to memory of 336	280	chrome.exe	36
PID 280 wrote to memory of 336	280	chrome.exe	36
PID 280 wrote to memory of 336	280	chrome.exe	36
PID 280 wrote to memory of 336	280	chrome.exe	36
PID 280 wrote to memory of 336	280	chrome.exe	36
PID 280 wrote to memory of 336	280	chrome.exe	36

C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2532

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7589758,0x7fef7589768,0x7fef7589778
  2⤵
  PID:3020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1152 --field-trial-handle=1384,i,10871564205937313121,9301197260275943298,131072 /prefetch:2
  2⤵
  PID:1576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1516 --field-trial-handle=1384,i,10871564205937313121,9301197260275943298,131072 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1604 --field-trial-handle=1384,i,10871564205937313121,9301197260275943298,131072 /prefetch:8
  2⤵
  PID:336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2272 --field-trial-handle=1384,i,10871564205937313121,9301197260275943298,131072 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2304 --field-trial-handle=1384,i,10871564205937313121,9301197260275943298,131072 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2084 --field-trial-handle=1384,i,10871564205937313121,9301197260275943298,131072 /prefetch:2
  2⤵
  PID:2996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1120 --field-trial-handle=1384,i,10871564205937313121,9301197260275943298,131072 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3692 --field-trial-handle=1384,i,10871564205937313121,9301197260275943298,131072 /prefetch:8
  2⤵
  PID:820
- C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  PID:2092
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13fe07688,0x13fe07698,0x13fe076a8
    3⤵
    PID:2960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3780 --field-trial-handle=1384,i,10871564205937313121,9301197260275943298,131072 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=580 --field-trial-handle=1384,i,10871564205937313121,9301197260275943298,131072 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=684 --field-trial-handle=1384,i,10871564205937313121,9301197260275943298,131072 /prefetch:1
  2⤵
  PID:988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1356 --field-trial-handle=1384,i,10871564205937313121,9301197260275943298,131072 /prefetch:8
  2⤵
  PID:936

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

Filesize
209KB

MD5
3e552d017d45f8fd93b94cfc86f842f2

SHA1
dbeebe83854328e2575ff67259e3fb6704b17a47

SHA256
27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6

SHA512
e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000002

Filesize
24KB

MD5
c594a826934b9505d591d0f7a7df80b7

SHA1
c04b8637e686f71f3fc46a29a86346ba9b04ae18

SHA256
e664eef3d68ac6336a28be033165d4780e8a5ab28f0d90df1b148ef86babb610

SHA512
04a1dfdb8ee2f5fefa101d5e3ff36e87659fd774e96aa8c5941d3353ccc268a125822cf01533c74839e5f1c54725da9cc437d3d69b88e5bf3f99caccd4d75961

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
9b3b80b3c6a5b5d062cdaf4b80823530

SHA1
2a355a3eb7906d6ce67ec38bd0cc833476fe48f0

SHA256
4bbb942cd032b7f14fa8625f593e7c652082d05795a358271447fae6c7f5b2cc

SHA512
3a7b25340df3ea0c7be0e4a2a0808b288feb491673313d75ff45590db1bb69fd8b539ec01a4cb1486a1cd9e7380a32718ed5787e088856a716730d0bf2a1bf0f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
ba94545a53db68d44b1bbab867785f42

SHA1
a4266ff579a4b4dc8187f5125f6a3a2ee2d536cf

SHA256
f4a8bf79aeb96fbc5a390c4749321bbaf68eb0e6eaed485fe5a362d6705ffc48

SHA512
90f0f108bdb719295c1c2e293080c7cec63c26ec1c47e4c3ce2357afae36d918429605615b6beeb947c193624df1bc6ae55278721147273cfe37554055927f08

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
363B

MD5
e973a99930e3b32d6d183b8c3c70c6a0

SHA1
db03a8c458b7d656a8ed190778ce590a1793e921

SHA256
7e56c2373fd682107e17146134f228ff3c668fdaae8035638337a8b6ea1adee4

SHA512
4876168e2662fae85bb9fc02b893284bc77866006ac3e801a79a3bd0b9ccbd213c59848615571ebed7e5e881922c53be9acdabd8324f0c6f864e8f6a7c3604f8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
bf79c81fd8b6e3e48f96a585db24de58

SHA1
38d2f7b8eb824ecd9c73c5aba2230ee36be4cfa2

SHA256
baa5132054701644ac69443938e84def5764f19b4f04bce7f212a662ed7e8f2a

SHA512
419472c1e42def55b900defc35d19fe557a0eaacc504503db5b051ad3cc61347c51745821e7e5c537f74416df6c4d363b784b3d2004ce4c78715a03bec648757

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
811b56b42e0a6b84bc9828a26c1b7cc1

SHA1
261a3b7de7e57cdf7ef063697859b48f1dcdf9e0

SHA256
0db0dc35fddce6fd1affa726cf1fff9956ec5a4eb5df6af313fdc7abc2f2a6d6

SHA512
e8b885c095cf160851f2767409dcde27cc3a2dba7156903b41c31002a94a5ba62209431d3c7831399c6a409ae1f7cf33061fc64d567ca5d84af63e1cfa37c6a2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
093cdaff8d0c358485f9ddf0190f3b37

SHA1
2580e809a234bdcb46cf7f03948c534709f9b16c

SHA256
107b764ddac13e25e2645ac08c0655c3be0e762652d57c7af92c484363e32ea1

SHA512
454a9bd493b7b512d8d8639207c21b4d0796ef104bd38954a261c13493b1990e800c512e3c3bca5c2b5de577335a64e13d3beb81fd955dfbc7c28d689bf41c97

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
memory/2532-7-0x00000000008A0000-0x00000000008AA000-memory.dmp

Filesize
40KB

Download
memory/2532-23-0x00000000747D0000-0x0000000074EBE000-memory.dmp

Filesize
6.9MB

Download
memory/2532-13-0x0000000004F30000-0x0000000004F3A000-memory.dmp

Filesize
40KB

Download
memory/2532-14-0x0000000004FA0000-0x0000000004FD2000-memory.dmp

Filesize
200KB

Download
memory/2532-15-0x0000000005870000-0x0000000005896000-memory.dmp

Filesize
152KB

Download
memory/2532-16-0x00000000056D0000-0x00000000056D8000-memory.dmp

Filesize
32KB

Download
memory/2532-18-0x0000000005A70000-0x0000000005A86000-memory.dmp

Filesize
88KB

Download
memory/2532-19-0x0000000005B90000-0x0000000005B9A000-memory.dmp

Filesize
40KB

Download
memory/2532-20-0x00000000747DE000-0x00000000747DF000-memory.dmp

Filesize
4KB

Download
memory/2532-21-0x00000000747D0000-0x0000000074EBE000-memory.dmp

Filesize
6.9MB

Download
memory/2532-22-0x00000000008A0000-0x00000000008AA000-memory.dmp

Filesize
40KB

Download
memory/2532-12-0x00000000076A0000-0x0000000007716000-memory.dmp

Filesize
472KB

Download
memory/2532-11-0x0000000002180000-0x000000000218A000-memory.dmp

Filesize
40KB

Download
memory/2532-10-0x00000000747D0000-0x0000000074EBE000-memory.dmp

Filesize
6.9MB

Download
memory/2532-9-0x00000000747D0000-0x0000000074EBE000-memory.dmp

Filesize
6.9MB

Download
memory/2532-0-0x00000000747DE000-0x00000000747DF000-memory.dmp

Filesize
4KB

Download
memory/2532-8-0x00000000008A0000-0x00000000008AA000-memory.dmp

Filesize
40KB

Download
memory/2532-6-0x0000000000650000-0x0000000000658000-memory.dmp

Filesize
32KB

Download
memory/2532-5-0x0000000000640000-0x0000000000648000-memory.dmp

Filesize
32KB

Download
memory/2532-4-0x0000000002360000-0x00000000023E2000-memory.dmp

Filesize
520KB

Download
memory/2532-3-0x00000000747D0000-0x0000000074EBE000-memory.dmp

Filesize
6.9MB

Download
memory/2532-2-0x00000000044E0000-0x0000000004592000-memory.dmp

Filesize
712KB

Download
memory/2532-1-0x00000000003C0000-0x000000000060A000-memory.dmp

Filesize
2.3MB

Download