2c51f67e236cf95e2d51df4178699da09869ab077924cff0b3df1c512878ef2f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 14:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Wave.exe
Size

7.0MB
MD5

a8bd4a6b2f1d00928e61870a5688c13d
SHA1

e17646d5279534f2e3eb0e0cfc8b6c536bc0c095
SHA256

2c51f67e236cf95e2d51df4178699da09869ab077924cff0b3df1c512878ef2f
SHA512

6b5175beea4071668c87b16af3177bbb2cbaff6b28909dc1e09ad5b16b449c62d6adc372a0094de627fe9835f0c474d16708c3f698355ba1664bf321fa19f5fb
SSDEEP

98304:37//YITF8r2n8TevxbFKVlXk34tZ+t4+aNG5Lhd+2G4Op0cN+hmdYkvsFLL:37//1xBVqvG5dQ2m0cN+hmdYkvsFLL

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1196	POWERPNT.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1340	msedge.exe
1340	msedge.exe
2168	msedge.exe
2168	msedge.exe
744	identity_helper.exe
744	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1196	POWERPNT.EXE
1196	POWERPNT.EXE
1196	POWERPNT.EXE
1196	POWERPNT.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 4856	2168	msedge.exe	106
PID 2168 wrote to memory of 4856	2168	msedge.exe	106
PID 2168 wrote to memory of 2260	2168	msedge.exe	107
PID 2168 wrote to memory of 2260	2168	msedge.exe	107
PID 2168 wrote to memory of 2260	2168	msedge.exe	107
PID 2168 wrote to memory of 2260	2168	msedge.exe	107
PID 2168 wrote to memory of 2260	2168	msedge.exe	107
PID 2168 wrote to memory of 2260	2168	msedge.exe	107
PID 2168 wrote to memory of 2260	2168	msedge.exe	107
PID 2168 wrote to memory of 2260	2168	msedge.exe	107
PID 2168 wrote to memory of 2260	2168	msedge.exe	107
PID 2168 wrote to memory of 2260	2168	msedge.exe	107
PID 2168 wrote to memory of 2260	2168	msedge.exe	107
PID 2168 wrote to memory of 2260	2168	msedge.exe	107
PID 2168 wrote to memory of 2260	2168	msedge.exe	107
PID 2168 wrote to memory of 2260	2168	msedge.exe	107
PID 2168 wrote to memory of 2260	2168	msedge.exe	107
PID 2168 wrote to memory of 2260	2168	msedge.exe	107
PID 2168 wrote to memory of 2260	2168	msedge.exe	107
PID 2168 wrote to memory of 2260	2168	msedge.exe	107
PID 2168 wrote to memory of 2260	2168	msedge.exe	107
PID 2168 wrote to memory of 2260	2168	msedge.exe	107
PID 2168 wrote to memory of 2260	2168	msedge.exe	107
PID 2168 wrote to memory of 2260	2168	msedge.exe	107
PID 2168 wrote to memory of 2260	2168	msedge.exe	107
PID 2168 wrote to memory of 2260	2168	msedge.exe	107
PID 2168 wrote to memory of 2260	2168	msedge.exe	107
PID 2168 wrote to memory of 2260	2168	msedge.exe	107
PID 2168 wrote to memory of 2260	2168	msedge.exe	107
PID 2168 wrote to memory of 2260	2168	msedge.exe	107
PID 2168 wrote to memory of 2260	2168	msedge.exe	107
PID 2168 wrote to memory of 2260	2168	msedge.exe	107
PID 2168 wrote to memory of 2260	2168	msedge.exe	107
PID 2168 wrote to memory of 2260	2168	msedge.exe	107
PID 2168 wrote to memory of 2260	2168	msedge.exe	107
PID 2168 wrote to memory of 2260	2168	msedge.exe	107
PID 2168 wrote to memory of 2260	2168	msedge.exe	107
PID 2168 wrote to memory of 2260	2168	msedge.exe	107
PID 2168 wrote to memory of 2260	2168	msedge.exe	107
PID 2168 wrote to memory of 2260	2168	msedge.exe	107
PID 2168 wrote to memory of 2260	2168	msedge.exe	107
PID 2168 wrote to memory of 2260	2168	msedge.exe	107
PID 2168 wrote to memory of 1340	2168	msedge.exe	108
PID 2168 wrote to memory of 1340	2168	msedge.exe	108
PID 2168 wrote to memory of 2324	2168	msedge.exe	109
PID 2168 wrote to memory of 2324	2168	msedge.exe	109
PID 2168 wrote to memory of 2324	2168	msedge.exe	109
PID 2168 wrote to memory of 2324	2168	msedge.exe	109
PID 2168 wrote to memory of 2324	2168	msedge.exe	109
PID 2168 wrote to memory of 2324	2168	msedge.exe	109
PID 2168 wrote to memory of 2324	2168	msedge.exe	109
PID 2168 wrote to memory of 2324	2168	msedge.exe	109
PID 2168 wrote to memory of 2324	2168	msedge.exe	109
PID 2168 wrote to memory of 2324	2168	msedge.exe	109
PID 2168 wrote to memory of 2324	2168	msedge.exe	109
PID 2168 wrote to memory of 2324	2168	msedge.exe	109
PID 2168 wrote to memory of 2324	2168	msedge.exe	109
PID 2168 wrote to memory of 2324	2168	msedge.exe	109
PID 2168 wrote to memory of 2324	2168	msedge.exe	109
PID 2168 wrote to memory of 2324	2168	msedge.exe	109
PID 2168 wrote to memory of 2324	2168	msedge.exe	109
PID 2168 wrote to memory of 2324	2168	msedge.exe	109
PID 2168 wrote to memory of 2324	2168	msedge.exe	109
PID 2168 wrote to memory of 2324	2168	msedge.exe	109

C:\Users\Admin\AppData\Local\Temp\Wave.exe
"C:\Users\Admin\AppData\Local\Temp\Wave.exe"
1⤵
PID:1696

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /n "C:\Users\Admin\Desktop\RedoPop.potm"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffba3f46f8,0x7fffba3f4708,0x7fffba3f4718
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,15888651673135307754,3773152648273759546,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,15888651673135307754,3773152648273759546,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,15888651673135307754,3773152648273759546,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15888651673135307754,3773152648273759546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15888651673135307754,3773152648273759546,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15888651673135307754,3773152648273759546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15888651673135307754,3773152648273759546,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,15888651673135307754,3773152648273759546,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,15888651673135307754,3773152648273759546,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15888651673135307754,3773152648273759546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15888651673135307754,3773152648273759546,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3708 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15888651673135307754,3773152648273759546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:2688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
180B

MD5
00a455d9d155394bfb4b52258c97c5e5

SHA1
2761d0c955353e1982a588a3df78f2744cfaa9df

SHA256
45a13c77403533b12fbeeeb580e1c32400ca17a32e15caa8c8e6a180ece27fed

SHA512
9553f8553332afbb1b4d5229bbf58aed7a51571ab45cbf01852b36c437811befcbc86f80ec422f222963fa7dabb04b0c9ae72e9d4ff2eeb1e58cde894fbe234f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ebf00bfd396d0b6ad20bbbad60b2edfb

SHA1
86197def33f6ab517cdc19ee4ef1832dcbb4e87a

SHA256
d36df23964b2b60d9fccf4fb98a8569a483cff5328adc3b87717ac1a1ecada64

SHA512
defff83be91bc3611603f69634f18efd2b172bb6185c2d4fec3379889d62e3be2520cb4bb706be97a4981de84390c37b0a1b8d1f12926094ae6384e7ae635f86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a1c9520d5b3c94e73d6d97a37fbbb1d2

SHA1
9d70031c643cfb23fa073f1eef35c4c170fc2818

SHA256
7964b30e0277ddc253cd30f378dbec9f890bf7dd52a24cdc02271f57fffffb07

SHA512
2114840f45c8c1f6d0d33039b2a77bcc492b329dbd1f5826e1f1c39c5be05780c1f92f56e6eeba6e8ad544e6b23b413d2521631462611820848a5f880707f924

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c98944030980a421c74142a1d646086c

SHA1
c5d7fc5dcbf75bc104fd547b37497bc9ab112259

SHA256
91f4ba151d9d8df774e820df4a67d51fd80b35ece02c781e15641c5828238623

SHA512
05fb83bd597f649046ccb91d392e47c2e4bdb097cbaeabca75b8bf753635b0dded17a658fa990ecb74d7eb81b221052ec9abe413c5652488c2876b1321ae1ae6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
19dad366dde54623b8b3a8501411db1a

SHA1
ab553df1efe4807dc51efbe6677797fd99214798

SHA256
18b1563eb348871beb24baebbbefe96d22faa8508b39b408cceb392173cb1710

SHA512
2d77b48d776945687746c60c57774f81304bb400b06ea153d5b56449c4ee341c2e5b8045a0c4b26c3bef2f26b6fb65079fcc3e5f115f9d6191d0f818806021f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1c35ea3a2b3464666a1bd4887fa6a92b

SHA1
5133abfe5901f06f4f98979013692380ee9233d4

SHA256
a3654670392c8a4c556e7327c05658bbf00682b202e9d3def6140b402009eea5

SHA512
5c7a0b16aa039e450f647be64ffae8a614928d7596cde3c7dafc4b2dd73974ea1f83cd6201f3f79f915b3c0a03ad9e639f78ae7b65a0876b5779acd24fd1c5e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Filesize
2KB

MD5
e722a706f3fde2bde5ac6da7ec86578b

SHA1
7dc1b8904996e696bc772d634db273bbcb065c0a

SHA256
c609382b1dde6ffda776c9c7f24874a4b4bcb5cd490f4a8ab7b207794fe8b346

SHA512
93f5b527bf41ec9e15e1173b1c704529b21e7cdbafe0cf46e1b1522cda970150cb4e1aefd6e50c8977d617a67e8ca97a651c4fce20b43549e710a2ecc07a7872

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\f3df91c436730d7a37c58d5f25d9bf4a56fa3a34.tbres

Filesize
4KB

MD5
2b449c414b2dd2c6b1eb8a36b275e589

SHA1
5f0ec33032e15f2377ad102c7febbbbc889d9f2c

SHA256
176590de433ea71ccd605efd8efabc5c42834fad886829f6500cdefa075b2284

SHA512
327d658b9f8862c3ab71dd2d37ed24b841dcd7ed906373f83a1137126bb56a7cda8b31aca830ac9ecacd951780a252d7de32807884b534811bbba3520212a09c

Download Submit
C:\Users\Public\Desktop\Google Chrome.lnk

Filesize
2KB

MD5
b912c7424324879493c771def40a45e5

SHA1
914f55b098e0d79a5285bae6d00e8a6b3f2574c0

SHA256
2db04f2f0b7deace03e50618c8b1ee26be81fba29c3c8885b41dc6898cf6509c

SHA512
2822f6ca58037a55acd4d7d4ffd22afb88084bbc192c5f98b4d454e2693027fd07e163cf908d5924950dd5fb24a26994a3e82e2c755745be523c68d4a7557b11

Download Submit
memory/1196-8-0x00007FFF98550000-0x00007FFF98560000-memory.dmp

Filesize
64KB

Download
memory/1196-10-0x00007FFF96100000-0x00007FFF96110000-memory.dmp

Filesize
64KB

Download
memory/1196-32-0x00007FFF98550000-0x00007FFF98560000-memory.dmp

Filesize
64KB

Download
memory/1196-33-0x00007FFF98550000-0x00007FFF98560000-memory.dmp

Filesize
64KB

Download
memory/1196-35-0x00007FFF98550000-0x00007FFF98560000-memory.dmp

Filesize
64KB

Download
memory/1196-34-0x00007FFF98550000-0x00007FFF98560000-memory.dmp

Filesize
64KB

Download
memory/1196-36-0x00007FFFB9F50000-0x00007FFFBA220000-memory.dmp

Filesize
2.8MB

Download
memory/1196-14-0x00007FFFB9F50000-0x00007FFFBA220000-memory.dmp

Filesize
2.8MB

Download
memory/1196-13-0x00007FFFB9F50000-0x00007FFFBA220000-memory.dmp

Filesize
2.8MB

Download
memory/1196-11-0x00007FFF96100000-0x00007FFF96110000-memory.dmp

Filesize
64KB

Download
memory/1196-12-0x00007FFFB9F50000-0x00007FFFBA220000-memory.dmp

Filesize
2.8MB

Download
memory/1196-15-0x00007FFFB9F50000-0x00007FFFBA220000-memory.dmp

Filesize
2.8MB

Download
memory/1196-9-0x00007FFFB9F50000-0x00007FFFBA220000-memory.dmp

Filesize
2.8MB

Download
memory/1196-4-0x00007FFF98550000-0x00007FFF98560000-memory.dmp

Filesize
64KB

Download
memory/1196-7-0x00007FFF98550000-0x00007FFF98560000-memory.dmp

Filesize
64KB

Download
memory/1196-5-0x00007FFF98550000-0x00007FFF98560000-memory.dmp

Filesize
64KB

Download
memory/1196-6-0x00007FFF98550000-0x00007FFF98560000-memory.dmp

Filesize
64KB

Download
memory/1696-0-0x00007FFFBA0D3000-0x00007FFFBA0D5000-memory.dmp

Filesize
8KB

Download
memory/1696-3-0x00007FFFBA0D0000-0x00007FFFBAB91000-memory.dmp

Filesize
10.8MB

Download
memory/1696-2-0x00007FFFBA0D0000-0x00007FFFBAB91000-memory.dmp

Filesize
10.8MB

Download
memory/1696-1-0x00000262FBAA0000-0x00000262FC1A8000-memory.dmp

Filesize
7.0MB

Download