Analysis
-
max time kernel
68s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 17:42
Behavioral task
behavioral1
Sample
WaveInstaller.exe
Resource
win7-20240508-en
General
-
Target
WaveInstaller.exe
-
Size
231KB
-
MD5
0eca651a9a275b0674a052b757f4b9ae
-
SHA1
d646b68d18a28ba263ea2930e58f0b30ac83b4a3
-
SHA256
64f6576c6db1eaaefbe0ab36e362592c8b27ff856cfcb29c032d06c1f289df1c
-
SHA512
d1f62b20625a982c3b59fdc56af47833b5f3e0ed2bb3aa03b1c8b71c3160999d87bc53f9f4f7bf1cdf6d45d87ff6e5c96a5cc0977c0da9b6ec1278b3c24870d5
-
SSDEEP
6144:RloZM+rIkd8g+EtXHkv/iD4hE3sR8e1mRi:joZtL+EP8h/B
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/3016-1-0x0000000001320000-0x0000000001360000-memory.dmp family_umbral -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory 1 IoCs
Processes:
WaveInstaller.exedescription ioc process File opened for modification C:\Windows\System32\drivers\etc\hosts WaveInstaller.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2072 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 ip-api.com -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
WaveInstaller.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exechrome.exepid process 3016 WaveInstaller.exe 2528 powershell.exe 2344 powershell.exe 2208 powershell.exe 2796 powershell.exe 1184 powershell.exe 2504 chrome.exe 2504 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WaveInstaller.exewmic.exepowershell.exepowershell.exepowershell.exepowershell.exewmic.exedescription pid process Token: SeDebugPrivilege 3016 WaveInstaller.exe Token: SeIncreaseQuotaPrivilege 1208 wmic.exe Token: SeSecurityPrivilege 1208 wmic.exe Token: SeTakeOwnershipPrivilege 1208 wmic.exe Token: SeLoadDriverPrivilege 1208 wmic.exe Token: SeSystemProfilePrivilege 1208 wmic.exe Token: SeSystemtimePrivilege 1208 wmic.exe Token: SeProfSingleProcessPrivilege 1208 wmic.exe Token: SeIncBasePriorityPrivilege 1208 wmic.exe Token: SeCreatePagefilePrivilege 1208 wmic.exe Token: SeBackupPrivilege 1208 wmic.exe Token: SeRestorePrivilege 1208 wmic.exe Token: SeShutdownPrivilege 1208 wmic.exe Token: SeDebugPrivilege 1208 wmic.exe Token: SeSystemEnvironmentPrivilege 1208 wmic.exe Token: SeRemoteShutdownPrivilege 1208 wmic.exe Token: SeUndockPrivilege 1208 wmic.exe Token: SeManageVolumePrivilege 1208 wmic.exe Token: 33 1208 wmic.exe Token: 34 1208 wmic.exe Token: 35 1208 wmic.exe Token: SeIncreaseQuotaPrivilege 1208 wmic.exe Token: SeSecurityPrivilege 1208 wmic.exe Token: SeTakeOwnershipPrivilege 1208 wmic.exe Token: SeLoadDriverPrivilege 1208 wmic.exe Token: SeSystemProfilePrivilege 1208 wmic.exe Token: SeSystemtimePrivilege 1208 wmic.exe Token: SeProfSingleProcessPrivilege 1208 wmic.exe Token: SeIncBasePriorityPrivilege 1208 wmic.exe Token: SeCreatePagefilePrivilege 1208 wmic.exe Token: SeBackupPrivilege 1208 wmic.exe Token: SeRestorePrivilege 1208 wmic.exe Token: SeShutdownPrivilege 1208 wmic.exe Token: SeDebugPrivilege 1208 wmic.exe Token: SeSystemEnvironmentPrivilege 1208 wmic.exe Token: SeRemoteShutdownPrivilege 1208 wmic.exe Token: SeUndockPrivilege 1208 wmic.exe Token: SeManageVolumePrivilege 1208 wmic.exe Token: 33 1208 wmic.exe Token: 34 1208 wmic.exe Token: 35 1208 wmic.exe Token: SeDebugPrivilege 2528 powershell.exe Token: SeDebugPrivilege 2344 powershell.exe Token: SeDebugPrivilege 2208 powershell.exe Token: SeDebugPrivilege 2796 powershell.exe Token: SeIncreaseQuotaPrivilege 1124 wmic.exe Token: SeSecurityPrivilege 1124 wmic.exe Token: SeTakeOwnershipPrivilege 1124 wmic.exe Token: SeLoadDriverPrivilege 1124 wmic.exe Token: SeSystemProfilePrivilege 1124 wmic.exe Token: SeSystemtimePrivilege 1124 wmic.exe Token: SeProfSingleProcessPrivilege 1124 wmic.exe Token: SeIncBasePriorityPrivilege 1124 wmic.exe Token: SeCreatePagefilePrivilege 1124 wmic.exe Token: SeBackupPrivilege 1124 wmic.exe Token: SeRestorePrivilege 1124 wmic.exe Token: SeShutdownPrivilege 1124 wmic.exe Token: SeDebugPrivilege 1124 wmic.exe Token: SeSystemEnvironmentPrivilege 1124 wmic.exe Token: SeRemoteShutdownPrivilege 1124 wmic.exe Token: SeUndockPrivilege 1124 wmic.exe Token: SeManageVolumePrivilege 1124 wmic.exe Token: 33 1124 wmic.exe Token: 34 1124 wmic.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
Processes:
chrome.exepid process 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
Processes:
chrome.exepid process 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe 2504 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
WaveInstaller.execmd.exechrome.exedescription pid process target process PID 3016 wrote to memory of 1208 3016 WaveInstaller.exe wmic.exe PID 3016 wrote to memory of 1208 3016 WaveInstaller.exe wmic.exe PID 3016 wrote to memory of 1208 3016 WaveInstaller.exe wmic.exe PID 3016 wrote to memory of 2672 3016 WaveInstaller.exe attrib.exe PID 3016 wrote to memory of 2672 3016 WaveInstaller.exe attrib.exe PID 3016 wrote to memory of 2672 3016 WaveInstaller.exe attrib.exe PID 3016 wrote to memory of 2528 3016 WaveInstaller.exe powershell.exe PID 3016 wrote to memory of 2528 3016 WaveInstaller.exe powershell.exe PID 3016 wrote to memory of 2528 3016 WaveInstaller.exe powershell.exe PID 3016 wrote to memory of 2344 3016 WaveInstaller.exe powershell.exe PID 3016 wrote to memory of 2344 3016 WaveInstaller.exe powershell.exe PID 3016 wrote to memory of 2344 3016 WaveInstaller.exe powershell.exe PID 3016 wrote to memory of 2208 3016 WaveInstaller.exe powershell.exe PID 3016 wrote to memory of 2208 3016 WaveInstaller.exe powershell.exe PID 3016 wrote to memory of 2208 3016 WaveInstaller.exe powershell.exe PID 3016 wrote to memory of 2796 3016 WaveInstaller.exe powershell.exe PID 3016 wrote to memory of 2796 3016 WaveInstaller.exe powershell.exe PID 3016 wrote to memory of 2796 3016 WaveInstaller.exe powershell.exe PID 3016 wrote to memory of 1124 3016 WaveInstaller.exe wmic.exe PID 3016 wrote to memory of 1124 3016 WaveInstaller.exe wmic.exe PID 3016 wrote to memory of 1124 3016 WaveInstaller.exe wmic.exe PID 3016 wrote to memory of 1240 3016 WaveInstaller.exe wmic.exe PID 3016 wrote to memory of 1240 3016 WaveInstaller.exe wmic.exe PID 3016 wrote to memory of 1240 3016 WaveInstaller.exe wmic.exe PID 3016 wrote to memory of 1672 3016 WaveInstaller.exe wmic.exe PID 3016 wrote to memory of 1672 3016 WaveInstaller.exe wmic.exe PID 3016 wrote to memory of 1672 3016 WaveInstaller.exe wmic.exe PID 3016 wrote to memory of 1184 3016 WaveInstaller.exe powershell.exe PID 3016 wrote to memory of 1184 3016 WaveInstaller.exe powershell.exe PID 3016 wrote to memory of 1184 3016 WaveInstaller.exe powershell.exe PID 3016 wrote to memory of 2056 3016 WaveInstaller.exe wmic.exe PID 3016 wrote to memory of 2056 3016 WaveInstaller.exe wmic.exe PID 3016 wrote to memory of 2056 3016 WaveInstaller.exe wmic.exe PID 3016 wrote to memory of 2072 3016 WaveInstaller.exe cmd.exe PID 3016 wrote to memory of 2072 3016 WaveInstaller.exe cmd.exe PID 3016 wrote to memory of 2072 3016 WaveInstaller.exe cmd.exe PID 2072 wrote to memory of 2020 2072 cmd.exe PING.EXE PID 2072 wrote to memory of 2020 2072 cmd.exe PING.EXE PID 2072 wrote to memory of 2020 2072 cmd.exe PING.EXE PID 2504 wrote to memory of 2008 2504 chrome.exe chrome.exe PID 2504 wrote to memory of 2008 2504 chrome.exe chrome.exe PID 2504 wrote to memory of 2008 2504 chrome.exe chrome.exe PID 2504 wrote to memory of 1816 2504 chrome.exe chrome.exe PID 2504 wrote to memory of 1816 2504 chrome.exe chrome.exe PID 2504 wrote to memory of 1816 2504 chrome.exe chrome.exe PID 2504 wrote to memory of 1816 2504 chrome.exe chrome.exe PID 2504 wrote to memory of 1816 2504 chrome.exe chrome.exe PID 2504 wrote to memory of 1816 2504 chrome.exe chrome.exe PID 2504 wrote to memory of 1816 2504 chrome.exe chrome.exe PID 2504 wrote to memory of 1816 2504 chrome.exe chrome.exe PID 2504 wrote to memory of 1816 2504 chrome.exe chrome.exe PID 2504 wrote to memory of 1816 2504 chrome.exe chrome.exe PID 2504 wrote to memory of 1816 2504 chrome.exe chrome.exe PID 2504 wrote to memory of 1816 2504 chrome.exe chrome.exe PID 2504 wrote to memory of 1816 2504 chrome.exe chrome.exe PID 2504 wrote to memory of 1816 2504 chrome.exe chrome.exe PID 2504 wrote to memory of 1816 2504 chrome.exe chrome.exe PID 2504 wrote to memory of 1816 2504 chrome.exe chrome.exe PID 2504 wrote to memory of 1816 2504 chrome.exe chrome.exe PID 2504 wrote to memory of 1816 2504 chrome.exe chrome.exe PID 2504 wrote to memory of 1816 2504 chrome.exe chrome.exe PID 2504 wrote to memory of 1816 2504 chrome.exe chrome.exe PID 2504 wrote to memory of 1816 2504 chrome.exe chrome.exe PID 2504 wrote to memory of 1816 2504 chrome.exe chrome.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"2⤵
- Views/modifies file attributes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
-
C:\Windows\system32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe" && pause2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping localhost3⤵
- Runs ping.exe
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6799758,0x7fef6799768,0x7fef67997782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1168 --field-trial-handle=1376,i,7693890222199457018,384562663017877750,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1504 --field-trial-handle=1376,i,7693890222199457018,384562663017877750,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1556 --field-trial-handle=1376,i,7693890222199457018,384562663017877750,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2076 --field-trial-handle=1376,i,7693890222199457018,384562663017877750,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2084 --field-trial-handle=1376,i,7693890222199457018,384562663017877750,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1164 --field-trial-handle=1376,i,7693890222199457018,384562663017877750,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2976 --field-trial-handle=1376,i,7693890222199457018,384562663017877750,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3356 --field-trial-handle=1376,i,7693890222199457018,384562663017877750,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3556 --field-trial-handle=1376,i,7693890222199457018,384562663017877750,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3456 --field-trial-handle=1376,i,7693890222199457018,384562663017877750,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
1KB
MD589ea44c411de1d5b561e09c7337179fe
SHA1f3d0cddd7cee4465928199f779d88ffe812d4e8a
SHA2568e0334ac0d047b8932068b3dc1dccffe39fc5169c5205fa8df4561c822ca6a79
SHA512d3ba17c4cdff733968a9132f3548ccc91aba82bf79195438718fcdf54a53da0c23b3c86f1e92116c6d848ef2ccea5c562615c5df6fb60a78746ecdf1c8977bf8
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
5KB
MD50ecf6ec8e2172c680f3a4578bc324a58
SHA1dd645af39b930910451f476b62eece6f66f684af
SHA256fdab2b35de5c8717c3e682bdc84c600cf5d3b5620a795678adff072adbf6df83
SHA512df36dc7240879ff6e1f3570692ce1a11a17a07fb1d1131a8db73c800c63575a7636a15392dd52702ade6f32e93b1d838d2802278132e1928cbc9d5d12113c524
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
5KB
MD54bd2dd72a468a6e28ee05c03f2b4ec97
SHA1e52293acf032067ec1de7a4564a0388b157bd7c5
SHA2566fc2ccf52c68bde8393ab6606309f04c31973f654facdcf016be007db098ca42
SHA5126a548d697dcd6be618648490a96a60e367259fd77a5d101dbc07ef5faad561755609abb48c573b52a9ee4acad50cbaf560d70ffb86d064324ed991d06f6f2aed
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmpFilesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD509e573e747260a8c45d1189aa10564f1
SHA1483588a1802945f65b9177f091b2df18eed9b6c3
SHA25683497a1669ed55bbeccd9d2f15759abd38eba03ddf516cbe632d3bf7c2f8537e
SHA5126395b6dc1104e5878b50d99fbe598702c46c35c913eb0ec9adf1c88aae5c056f538280dc1f18581ff8015160f05eb8741f2715a3054d086c6db88e2c037954d9
-
C:\Windows\system32\drivers\etc\hostsFilesize
2KB
MD5577f27e6d74bd8c5b7b0371f2b1e991c
SHA1b334ccfe13792f82b698960cceaee2e690b85528
SHA2560ade9ef91b5283eceb17614dd47eb450a5a2a371c410232552ad80af4fbfd5f9
SHA512944b09b6b9d7c760b0c5add40efd9a25197c22e302c3c7e6d3f4837825ae9ee73e8438fc2c93e268da791f32deb70874799b8398ebae962a9fc51c980c7a5f5c
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1184-44-0x00000000022C0000-0x00000000022C8000-memory.dmpFilesize
32KB
-
memory/2344-15-0x0000000002290000-0x0000000002298000-memory.dmpFilesize
32KB
-
memory/2344-14-0x000000001B790000-0x000000001BA72000-memory.dmpFilesize
2.9MB
-
memory/2528-8-0x00000000002E0000-0x00000000002E8000-memory.dmpFilesize
32KB
-
memory/2528-7-0x000000001B7D0000-0x000000001BAB2000-memory.dmpFilesize
2.9MB
-
memory/3016-0-0x000007FEF55D3000-0x000007FEF55D4000-memory.dmpFilesize
4KB
-
memory/3016-48-0x000007FEF55D0000-0x000007FEF5FBC000-memory.dmpFilesize
9.9MB
-
memory/3016-2-0x000007FEF55D0000-0x000007FEF5FBC000-memory.dmpFilesize
9.9MB
-
memory/3016-1-0x0000000001320000-0x0000000001360000-memory.dmpFilesize
256KB