Resubmissions
21-09-2024 20:12
240921-yy3tha1emn 921-09-2024 11:22
240921-ng2vrszdrn 919-08-2024 15:30
240819-sxmg8swanj 902-07-2024 12:50
240702-p3d69ssgjd 902-07-2024 12:49
240702-p2f98ssfpa 909-04-2024 20:26
240409-y75dpahh68 909-04-2024 06:53
240409-hnsb1sgh43 908-04-2024 23:43
240408-3qqlesaf81 9Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows11-21h2_x64 -
resource
win11-20240611-en -
resource tags
arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system -
submitted
02-07-2024 12:50
General
-
Target
Injector.exe
-
Size
3.4MB
-
MD5
c6b39ee166d5b0a2c8a9021ccd1593ae
-
SHA1
e480e7c282f64e8b0179c82afe154dd59d14217d
-
SHA256
443b665c5f545a2bdd7855f86bf70a5ee7f35eda1b6b08615161f5809cbda02b
-
SHA512
3864aea36c522ca5658412128e6a4c862a647cf3b1054b9adbe418488590a37600d7639c3eba94ca9de76f087b244b95644c667213b1122889cf2d9b7a4652d2
-
SSDEEP
49152:Kl0nJ28J4VZohYWVGGjW8NhSU7zwo8oXJ2R3KPHsI7coj2J+eNgRpqNc1a:KmnJrJ4DohYWVTJNkIZZ2R6vsmA+FDqN
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Injector.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Injector.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Injector.exe -
Executes dropped EXE 7 IoCs
pid Process 5100 WaveInstaller.exe 240 WaveBootstrapper.exe 3148 WaveWindows.exe 560 CefSharp.BrowserSubprocess.exe 3160 CefSharp.BrowserSubprocess.exe 1916 node.exe 4600 Bloxstrap.exe -
Loads dropped DLL 25 IoCs
pid Process 240 WaveBootstrapper.exe 3148 WaveWindows.exe 3148 WaveWindows.exe 3148 WaveWindows.exe 3148 WaveWindows.exe 3148 WaveWindows.exe 560 CefSharp.BrowserSubprocess.exe 560 CefSharp.BrowserSubprocess.exe 560 CefSharp.BrowserSubprocess.exe 560 CefSharp.BrowserSubprocess.exe 560 CefSharp.BrowserSubprocess.exe 560 CefSharp.BrowserSubprocess.exe 560 CefSharp.BrowserSubprocess.exe 560 CefSharp.BrowserSubprocess.exe 560 CefSharp.BrowserSubprocess.exe 560 CefSharp.BrowserSubprocess.exe 560 CefSharp.BrowserSubprocess.exe 3160 CefSharp.BrowserSubprocess.exe 3160 CefSharp.BrowserSubprocess.exe 3160 CefSharp.BrowserSubprocess.exe 3160 CefSharp.BrowserSubprocess.exe 3160 CefSharp.BrowserSubprocess.exe 3160 CefSharp.BrowserSubprocess.exe 3160 CefSharp.BrowserSubprocess.exe 3148 WaveWindows.exe -
resource yara_rule behavioral1/memory/5056-0-0x00007FF77E4B0000-0x00007FF77EE10000-memory.dmp themida behavioral1/memory/5056-3-0x00007FF77E4B0000-0x00007FF77EE10000-memory.dmp themida behavioral1/memory/5056-1-0x00007FF77E4B0000-0x00007FF77EE10000-memory.dmp themida behavioral1/memory/5056-5-0x00007FF77E4B0000-0x00007FF77EE10000-memory.dmp themida behavioral1/memory/5056-4-0x00007FF77E4B0000-0x00007FF77EE10000-memory.dmp themida behavioral1/memory/5056-7-0x00007FF77E4B0000-0x00007FF77EE10000-memory.dmp themida -
Checks for any installed AV software in registry 1 TTPs 6 IoCs
description ioc Process Key queried \REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000\Software\KasperskyLab WaveWindows.exe Set value (str) \REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000\Software\KasperskyLab\LastUsername = "ababab" WaveWindows.exe Key opened \REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000\Software\KasperskyLab WaveWindows.exe Key created \REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000\Software\KasperskyLab WaveWindows.exe Key value queried \REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000\Software\KasperskyLab\LastUsername WaveWindows.exe Key value queried \REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000\Software\KasperskyLab\Session WaveWindows.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Injector.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
flow ioc 33 raw.githubusercontent.com 43 raw.githubusercontent.com 44 raw.githubusercontent.com 45 raw.githubusercontent.com 46 raw.githubusercontent.com 10 raw.githubusercontent.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 5056 Injector.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000_Classes\Local Settings\MuiCache MiniSearchHost.exe -
NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\Unconfirmed 189030.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\WaveInstaller.exe:Zone.Identifier msedge.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 5104 msedge.exe 5104 msedge.exe 4960 msedge.exe 4960 msedge.exe 3580 identity_helper.exe 3580 identity_helper.exe 3416 msedge.exe 3416 msedge.exe 1040 msedge.exe 1040 msedge.exe 3148 WaveWindows.exe 560 CefSharp.BrowserSubprocess.exe 560 CefSharp.BrowserSubprocess.exe 3160 CefSharp.BrowserSubprocess.exe 3160 CefSharp.BrowserSubprocess.exe 3148 WaveWindows.exe 3148 WaveWindows.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
pid Process 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5100 WaveInstaller.exe Token: SeDebugPrivilege 240 WaveBootstrapper.exe Token: SeDebugPrivilege 3148 WaveWindows.exe Token: SeDebugPrivilege 560 CefSharp.BrowserSubprocess.exe Token: SeDebugPrivilege 3160 CefSharp.BrowserSubprocess.exe Token: SeShutdownPrivilege 3148 WaveWindows.exe Token: SeCreatePagefilePrivilege 3148 WaveWindows.exe Token: SeShutdownPrivilege 3148 WaveWindows.exe Token: SeCreatePagefilePrivilege 3148 WaveWindows.exe Token: SeShutdownPrivilege 3148 WaveWindows.exe Token: SeCreatePagefilePrivilege 3148 WaveWindows.exe Token: SeShutdownPrivilege 3148 WaveWindows.exe Token: SeCreatePagefilePrivilege 3148 WaveWindows.exe Token: SeShutdownPrivilege 3148 WaveWindows.exe Token: SeCreatePagefilePrivilege 3148 WaveWindows.exe Token: SeShutdownPrivilege 3148 WaveWindows.exe Token: SeCreatePagefilePrivilege 3148 WaveWindows.exe Token: SeShutdownPrivilege 3148 WaveWindows.exe Token: SeCreatePagefilePrivilege 3148 WaveWindows.exe Token: SeShutdownPrivilege 3148 WaveWindows.exe Token: SeCreatePagefilePrivilege 3148 WaveWindows.exe Token: SeShutdownPrivilege 3148 WaveWindows.exe Token: SeCreatePagefilePrivilege 3148 WaveWindows.exe Token: SeShutdownPrivilege 3148 WaveWindows.exe Token: SeCreatePagefilePrivilege 3148 WaveWindows.exe Token: SeShutdownPrivilege 3148 WaveWindows.exe Token: SeCreatePagefilePrivilege 3148 WaveWindows.exe Token: SeShutdownPrivilege 3148 WaveWindows.exe Token: SeCreatePagefilePrivilege 3148 WaveWindows.exe Token: SeShutdownPrivilege 3148 WaveWindows.exe Token: SeCreatePagefilePrivilege 3148 WaveWindows.exe Token: SeShutdownPrivilege 3148 WaveWindows.exe Token: SeCreatePagefilePrivilege 3148 WaveWindows.exe Token: SeShutdownPrivilege 3148 WaveWindows.exe Token: SeCreatePagefilePrivilege 3148 WaveWindows.exe Token: SeShutdownPrivilege 3148 WaveWindows.exe Token: SeCreatePagefilePrivilege 3148 WaveWindows.exe Token: SeShutdownPrivilege 3148 WaveWindows.exe Token: SeCreatePagefilePrivilege 3148 WaveWindows.exe Token: SeShutdownPrivilege 3148 WaveWindows.exe Token: SeCreatePagefilePrivilege 3148 WaveWindows.exe Token: SeShutdownPrivilege 3148 WaveWindows.exe Token: SeCreatePagefilePrivilege 3148 WaveWindows.exe Token: SeShutdownPrivilege 3148 WaveWindows.exe Token: SeCreatePagefilePrivilege 3148 WaveWindows.exe Token: SeShutdownPrivilege 3148 WaveWindows.exe Token: SeCreatePagefilePrivilege 3148 WaveWindows.exe Token: SeShutdownPrivilege 3148 WaveWindows.exe Token: SeCreatePagefilePrivilege 3148 WaveWindows.exe Token: SeShutdownPrivilege 3148 WaveWindows.exe Token: SeCreatePagefilePrivilege 3148 WaveWindows.exe Token: SeShutdownPrivilege 3148 WaveWindows.exe Token: SeCreatePagefilePrivilege 3148 WaveWindows.exe Token: SeShutdownPrivilege 3148 WaveWindows.exe Token: SeCreatePagefilePrivilege 3148 WaveWindows.exe Token: SeShutdownPrivilege 3148 WaveWindows.exe Token: SeCreatePagefilePrivilege 3148 WaveWindows.exe Token: SeShutdownPrivilege 3148 WaveWindows.exe Token: SeCreatePagefilePrivilege 3148 WaveWindows.exe Token: SeShutdownPrivilege 3148 WaveWindows.exe Token: SeCreatePagefilePrivilege 3148 WaveWindows.exe Token: SeShutdownPrivilege 3148 WaveWindows.exe Token: SeCreatePagefilePrivilege 3148 WaveWindows.exe Token: SeShutdownPrivilege 3148 WaveWindows.exe -
Suspicious use of FindShellTrayWindow 45 IoCs
pid Process 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1916 node.exe 4600 Bloxstrap.exe 4636 MiniSearchHost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4960 wrote to memory of 2276 4960 msedge.exe 82 PID 4960 wrote to memory of 2276 4960 msedge.exe 82 PID 4960 wrote to memory of 3972 4960 msedge.exe 83 PID 4960 wrote to memory of 3972 4960 msedge.exe 83 PID 4960 wrote to memory of 3972 4960 msedge.exe 83 PID 4960 wrote to memory of 3972 4960 msedge.exe 83 PID 4960 wrote to memory of 3972 4960 msedge.exe 83 PID 4960 wrote to memory of 3972 4960 msedge.exe 83 PID 4960 wrote to memory of 3972 4960 msedge.exe 83 PID 4960 wrote to memory of 3972 4960 msedge.exe 83 PID 4960 wrote to memory of 3972 4960 msedge.exe 83 PID 4960 wrote to memory of 3972 4960 msedge.exe 83 PID 4960 wrote to memory of 3972 4960 msedge.exe 83 PID 4960 wrote to memory of 3972 4960 msedge.exe 83 PID 4960 wrote to memory of 3972 4960 msedge.exe 83 PID 4960 wrote to memory of 3972 4960 msedge.exe 83 PID 4960 wrote to memory of 3972 4960 msedge.exe 83 PID 4960 wrote to memory of 3972 4960 msedge.exe 83 PID 4960 wrote to memory of 3972 4960 msedge.exe 83 PID 4960 wrote to memory of 3972 4960 msedge.exe 83 PID 4960 wrote to memory of 3972 4960 msedge.exe 83 PID 4960 wrote to memory of 3972 4960 msedge.exe 83 PID 4960 wrote to memory of 3972 4960 msedge.exe 83 PID 4960 wrote to memory of 3972 4960 msedge.exe 83 PID 4960 wrote to memory of 3972 4960 msedge.exe 83 PID 4960 wrote to memory of 3972 4960 msedge.exe 83 PID 4960 wrote to memory of 3972 4960 msedge.exe 83 PID 4960 wrote to memory of 3972 4960 msedge.exe 83 PID 4960 wrote to memory of 3972 4960 msedge.exe 83 PID 4960 wrote to memory of 3972 4960 msedge.exe 83 PID 4960 wrote to memory of 3972 4960 msedge.exe 83 PID 4960 wrote to memory of 3972 4960 msedge.exe 83 PID 4960 wrote to memory of 3972 4960 msedge.exe 83 PID 4960 wrote to memory of 3972 4960 msedge.exe 83 PID 4960 wrote to memory of 3972 4960 msedge.exe 83 PID 4960 wrote to memory of 3972 4960 msedge.exe 83 PID 4960 wrote to memory of 3972 4960 msedge.exe 83 PID 4960 wrote to memory of 3972 4960 msedge.exe 83 PID 4960 wrote to memory of 3972 4960 msedge.exe 83 PID 4960 wrote to memory of 3972 4960 msedge.exe 83 PID 4960 wrote to memory of 3972 4960 msedge.exe 83 PID 4960 wrote to memory of 3972 4960 msedge.exe 83 PID 4960 wrote to memory of 5104 4960 msedge.exe 84 PID 4960 wrote to memory of 5104 4960 msedge.exe 84 PID 4960 wrote to memory of 2336 4960 msedge.exe 85 PID 4960 wrote to memory of 2336 4960 msedge.exe 85 PID 4960 wrote to memory of 2336 4960 msedge.exe 85 PID 4960 wrote to memory of 2336 4960 msedge.exe 85 PID 4960 wrote to memory of 2336 4960 msedge.exe 85 PID 4960 wrote to memory of 2336 4960 msedge.exe 85 PID 4960 wrote to memory of 2336 4960 msedge.exe 85 PID 4960 wrote to memory of 2336 4960 msedge.exe 85 PID 4960 wrote to memory of 2336 4960 msedge.exe 85 PID 4960 wrote to memory of 2336 4960 msedge.exe 85 PID 4960 wrote to memory of 2336 4960 msedge.exe 85 PID 4960 wrote to memory of 2336 4960 msedge.exe 85 PID 4960 wrote to memory of 2336 4960 msedge.exe 85 PID 4960 wrote to memory of 2336 4960 msedge.exe 85 PID 4960 wrote to memory of 2336 4960 msedge.exe 85 PID 4960 wrote to memory of 2336 4960 msedge.exe 85 PID 4960 wrote to memory of 2336 4960 msedge.exe 85 PID 4960 wrote to memory of 2336 4960 msedge.exe 85 PID 4960 wrote to memory of 2336 4960 msedge.exe 85 PID 4960 wrote to memory of 2336 4960 msedge.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\Injector.exe"C:\Users\Admin\AppData\Local\Temp\Injector.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5056
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb7bb93cb8,0x7ffb7bb93cc8,0x7ffb7bb93cd82⤵PID:2276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,10297284382650172135,1502025845450271947,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1908 /prefetch:22⤵PID:3972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1892,10297284382650172135,1502025845450271947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:5104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1892,10297284382650172135,1502025845450271947,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2556 /prefetch:82⤵PID:2336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,10297284382650172135,1502025845450271947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:1484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,10297284382650172135,1502025845450271947,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:2800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,10297284382650172135,1502025845450271947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:12⤵PID:2368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,10297284382650172135,1502025845450271947,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4492 /prefetch:12⤵PID:4932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,10297284382650172135,1502025845450271947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3464 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1892,10297284382650172135,1502025845450271947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4780 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,10297284382650172135,1502025845450271947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3784 /prefetch:12⤵PID:4044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,10297284382650172135,1502025845450271947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:12⤵PID:2952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,10297284382650172135,1502025845450271947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1892,10297284382650172135,1502025845450271947,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5144 /prefetch:82⤵PID:3620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,10297284382650172135,1502025845450271947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:12⤵PID:2828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1892,10297284382650172135,1502025845450271947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5960 /prefetch:82⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:1040
-
-
C:\Users\Admin\Downloads\WaveInstaller.exe"C:\Users\Admin\Downloads\WaveInstaller.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5100 -
C:\Users\Admin\AppData\Local\Wave\WaveBootstrapper.exe"C:\Users\Admin\AppData\Local\Wave\WaveBootstrapper.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:240 -
C:\Users\Admin\AppData\Local\Wave\WaveWindows.exe"C:\Users\Admin\AppData\Local\Wave\WaveWindows.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3148 -
C:\Users\Admin\AppData\Local\CefSharp\CefSharp.BrowserSubprocess.exe"C:\Users\Admin\AppData\Local\CefSharp\CefSharp.BrowserSubprocess.exe" --type=gpu-process --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\CefSharp\locales" --resources-dir-path="C:\Users\Admin\AppData\Local\CefSharp" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CefSharp" --cefsharpexitsub --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2020,i,12592945997457110984,17424951167381345139,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --enable-logging=handle --log-file=2068 --mojo-platform-channel-handle=2012 /prefetch:2 --host-process-id=31485⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:560
-
-
C:\Users\Admin\AppData\Local\Luau Language Server\node.exe"C:\Users\Admin\AppData\Local\Luau Language Server\node.exe" server --process-id=31485⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1916
-
-
C:\Users\Admin\AppData\Local\CefSharp\CefSharp.BrowserSubprocess.exe"C:\Users\Admin\AppData\Local\CefSharp\CefSharp.BrowserSubprocess.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\CefSharp\locales" --resources-dir-path="C:\Users\Admin\AppData\Local\CefSharp" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CefSharp" --cefsharpexitsub --field-trial-handle=2804,i,12592945997457110984,17424951167381345139,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --enable-logging=handle --log-file=2812 --mojo-platform-channel-handle=2800 /prefetch:3 --host-process-id=31485⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3160
-
-
C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe"C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4600
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,10297284382650172135,1502025845450271947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4436 /prefetch:12⤵PID:3148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,10297284382650172135,1502025845450271947,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1708 /prefetch:12⤵PID:3244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,10297284382650172135,1502025845450271947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:12⤵PID:2464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,10297284382650172135,1502025845450271947,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:12⤵PID:336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,10297284382650172135,1502025845450271947,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4692 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3412
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2516
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1916
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4636
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
249KB
MD5772c9fecbd0397f6cfb3d866cf3a5d7d
SHA16de3355d866d0627a756d0d4e29318e67650dacf
SHA2562f88ea7e1183d320fb2b7483de2e860da13dc0c0caaf58f41a888528d78c809f
SHA51282048bd6e50d38a863379a623b8cfda2d1553d8141923acf13f990c7245c833082523633eaa830362a12bfff300da61b3d8b3cccbe038ce2375fdfbd20dbca31
-
Filesize
915KB
MD5100c32f77e68a2ce962e1a28997567ea
SHA1a80a1f4019b8d44df6b5833fb0c51b929fa79843
SHA256c0b9e29b240d8328f2f9a29ca0298ca4d967a926f3174a3442c3730c00d5a926
SHA512f95530ef439fa5c4e3bc02db249b6a76e9d56849816ead83c9cd9bcd49d3443ccb88651d829165c98a67af40b3ef02b922971114f29c5c735e662ca35c0fb6ed
-
Filesize
7KB
MD5516ff62b2e1f4642caa954c0968719e8
SHA1e349d0ce82e2109dd0d18416d9cf46e8411b7f15
SHA25619da58849cec5933860116e60a1e94b08e30d90e0f955768270b47998d612045
SHA5127aa4a0c87b29c2a84f585a884d8208fc2352a43f2cdb549c100e3b121837ad5f8dadb1101f57d1d3fcb7ebec9d9f22e07dc14239b7d2e2d25793c999becf288b
-
Filesize
272KB
MD59ca06a8f9e5f7239ca225ab810274023
SHA1e1a219f567a7b7d3af9386df51b14c76e769c044
SHA2565fd00ae3e83e6ca156647ff6df87b49ffc7cad47c23fe3ae07c067c5adf6f74a
SHA512430c9bceed5439b987d5bd4840cfe32411ca61594f18597aca1948aa39a22c9d70beadf3bb9b1dd0373f81a94a25dcba17fa8e8c73abf06cba28d0971d5614c5
-
Filesize
667KB
MD5ae195e80859781a20414cf5faa52db06
SHA1b18ecb5ec141415e3a210880e2b3d37470636485
SHA2569957802c0792e621f76bbdb1c630fbad519922743b5d193294804164babda552
SHA512c6fef84615fe20d1760ca496c98629feb4e533556724e9631d4282622748e7601225cf19dfb8351f4b540ae3f83785c1bcea6fe8c246cf70388e527654097c1c
-
Filesize
1.0MB
MD51abf6bad0c39d59e541f04162e744224
SHA1db93c38253338a0b85e431bd4194d9e7bddb22c6
SHA25601cb663a75f18bb2d0d800640a114f153a34bd8a5f2aa0ed7daa9b32967dc29e
SHA512945d519221d626421094316f13b818766826b3bedddab0165c041540dddadc93136e32784c0562d26a420cb29479d04d2aa317b8d605cd242e5152bf05af197e
-
Filesize
1020KB
MD57191d97ce7886a1a93a013e90868db96
SHA152dd736cb589dd1def87130893d6b9449a6a36e3
SHA25632f925f833aa59e3f05322549fc3c326ac6fc604358f4efbf94c59d5c08b8dc6
SHA51238ebb62c34d466935eabb157197c7c364d4345f22aa3b2641b636196ca1aeaa2152ac75d613ff90817cb94825189612ddd12fb96df29469511a46a7d9620e724
-
Filesize
10.2MB
MD574bded81ce10a426df54da39cfa132ff
SHA1eb26bcc7d24be42bd8cfbded53bd62d605989bbf
SHA2567bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9
SHA512bd7b7b52d31803b2d4b1fd8cb76481931ed8abb98d779b893d3965231177bdd33386461e1a820b384712013904da094e3cd15ee24a679ddc766132677a8be54a
-
Filesize
359KB
MD57dd6b0e4a31d35a0fae5ff425707073c
SHA1fbd12e9f8e2252c52ce555c2ebbd7f07e62a0140
SHA2568762d8001fc3ddd90e3129dfea172817e8d09b9936eaae391957de4326c8c906
SHA512726968df6b83ab5f589276672250d92f532fe2dcea2176e42031a7f1dcecf578b0320cfe2a7d88bb9883ad99387d71c6ebf1e9968272bb5e62850ef09abd2648
-
Filesize
6.6MB
MD58803db5b167fb5a5f8a8c595c4e4d7c6
SHA17fde861151f3bea66c65b6c2487a30728048811a
SHA25652a58d25a41f4bd31cdb4a0d306217862e04ebf7c1925cc85330054a5523d719
SHA5122fa9a0eda221982896e41eb387b5e156198615ac1a1fbac0acffd13008919368b41a240df416c1fce2e48c20a14cd7af7cca9fba476ada5e64a0cadde84a44b7
-
Filesize
456KB
MD54430b1833d56bc8eb1f7dc82bb7f4bc9
SHA1dc15e6306625f155683326e859d83f846153c547
SHA256b44ddcfac9df4934007e6c55a3c7f5e7f14c7e5e29f35c81de917fc3b22aabbc
SHA512faf93bf371b2a88c1b874a5e2c54e4487fd152ad19c2a406a46f55ae75ecd421a779888c2e4c170857b16bfb5d8744bc1815a4732ed50b064b3cbd0c5ffad889
-
Filesize
8.0MB
MD54933d92c99afa246fc59eef010d5c858
SHA198d443654e93c73dd317f9f847f71fba3d5b3135
SHA25662f4674daa15245ee081920b8ee191e72f36ca8fe24f6b986a832f45676915b2
SHA512a3a69523c8e7310716daeebc06c2ba4fce673eccd1958e824ff179b82f4502d0ec095190179bbb387342e4150f952ea7533182fb6ba90377d17dafba8f4da623
-
Filesize
4.4MB
MD50ec149455727ace9acc09b3ba2c3a2b2
SHA16eeb990876cef6a34115b67f3190255db589f723
SHA256e2d8ef53897e864b5b66bc73606681c99461798a9f4c1e13ca5cef7bc774d7fd
SHA512c8eaa598c9439b1f2375fdac1f58896853510bddbd640707b9142c0d3793836120b28d7c2bd0407f0d5656dd19f14b312f37b7ac0165c9cc8b4c1a0f2af62531
-
Filesize
152B
MD56486ee9e961a437dadb68ff1544d18a8
SHA105f4daccca0bc1ce73fe71ad2325ba5dadd3df25
SHA2569a98b4686c9e90672a548c873943b3027fb111f7992263111d912318429f5834
SHA512ee3659f68a46f37f340f98b85a7aa289e700c5ced2a4f0104673bb5f18cc82d1e9b838ec0278407213c6ed2073998e7aad78a7a39390b7e460c8e26dfa91d0e9
-
Filesize
152B
MD52dfecbb576ee9795c5284da8a2a3c7f5
SHA1f1f0a6a97850aca2b4ab267a017564af02f24948
SHA256dca6901942fa748fc01339192c0738a06847d8497c9c61298f1e5df1f8352fb0
SHA512d664cc261113427810dd0b2d32763ddd08611a528fe6b285782d6b8ac03304b72a90fe7f3f7142e825ab8d948d5c9cf52f420546f3796b2ac23f3d00f3c17389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize216B
MD569f857866645a077ec4f7ad4b0ff81f0
SHA182a2e6f279222f7d8f0bef1144b5e05579138917
SHA256963e9e820144070b5c22fdfdf0daac177cf488e1d85d7e3b609d30ddd0796278
SHA5126450a7dcfaba6bae22cef440d7de97eaf4887e960484763d4411e1c6b1bf67feef071549ab8309bd416c89132cbf5ab28cce4ba387054f82d9004fad96230c1c
-
Filesize
252B
MD51c6347034f4d67205079fd704a899cd4
SHA1a793e4dd88c825cf2e49131a1dcafe8f390349fb
SHA256a2e5e3be2520a1221b0f7280082e5e83a8905e2b0827a40820975a1f16b771ad
SHA512eb309f8ff5005db3180658715a432a17bd42a619e1e7368a7c0841458c555fe82a63e1d5a87f748b46f535edf5615c73176f5d939866ac74731834a00fc892ce
-
Filesize
6KB
MD57b58fa54469638bea6b7b25557c06660
SHA1f2ffbbb8733a158868c0d7e53a2103046dec4f89
SHA2568a2afa647c05a8b417625175e5ae03b8ac837463ed169c408e33df694ab52723
SHA512a360a8f3ada499ecb598cb063a0c64f72a5077c1eb6f1bd1513aaf1fb31cd8f0ce91c0c4ee55abde03dfd9a7d04a62f955480553a450cce09f621d7eadd3415b
-
Filesize
5KB
MD5d44facf850771e78a6f423f91c657f5a
SHA19a4e998b7c4172eae0ecd6ae8d44de1e8a7409ba
SHA2565edbc8ed64889ab724ce28c65a8a264951d084e6f60323239e630ef0f1d24a83
SHA5121bc69e0080b4ad6189eac6680f140db0279515f86398768a73f3f9bdee1d19e6605a888b223bbe1aa90c72d804d2d998fc88cb16c406ad6c7ba5b4b10c70056a
-
Filesize
6KB
MD57348969e7b1cddd1847a1fa7fcdaf896
SHA16f66dcfe22e5931d22a57c5cd85ebe2311c1597e
SHA2569d8e416bdce32d5ff413b55d14020fd489ec65b347e8ed1f8ad32a4d8068e154
SHA512e9985d8a8c5dc8163225ff504bb529d778ac2ff629f70ce7bdec7fa072958dd93e5e2510add1bcb2571ab3e2f37a73b531b9ce1b0287f19c635d2d24e1ff1842
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD512c32e1c27fc6696df557bb0a88c4dd5
SHA1dbf34b4594b1927a62c108ef5fdbe021a6c17bb8
SHA25665e240b30da361f018b5ff92b6fc1d1dbe32b693b52788041b0218996961f866
SHA512ec4f082354264dcfca80d5411e80ddecccfbcfb45267b9a0bedddf0b168121ca723aa074614e6ec4c7cbeb940ec91830d2aec9612173aa2304c69fa38c7b05ec
-
Filesize
12KB
MD5dc9196473fe3cadc735ffe6aed0ef6eb
SHA16a1fcf973d6d6d6e102435e0514effa991cacbfc
SHA2569bb3763a1e811cce5f2d53a2eaccee0a1a71a0a556610f297d11fbb47580b433
SHA51238cd224ac39e3006429efc78780effd3e9e448a4b2a7bc1c18ef6a39611d422b53249b3fad6c65733cd5e90bf185a71084c8609e36d662767bffa58a7e9d36ea
-
Filesize
11KB
MD549c19a2a49a959dd0ac67019d6366636
SHA131e3715511ef151b9cd5d9943332970c0c1c3cbf
SHA256f152fe96b43c8bc34763ff22dc11d1e3b6bfb4ec6636da7810390169f2598bf8
SHA512caa61068d2b3e00eb1fba8a4716801d1312ce731f5e909ecd150ce5dd693c35fd8bb1feeb8c7d8d19ecf572dc7a6fc3ff7a4a0e4982118ef3e1f786a66dcc8ea
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Filesize10KB
MD57d35e348551b18673723840752fe1f24
SHA1adaff6b20bca35e0008e78e27bdd384daa2bab36
SHA2569d7291e74523cdd7b3ca9bf2e51fdeefff4f448b99a43ae57009fbc8d7acd854
SHA512dc6a9b8bcd800c1c9ed1c6ba174964db6cccb7961794b5bb2d133b9da592e10796a11fefc6e00931d42bc11a72f5aa9a5282ad6b8eb4ee86e58c9c7db9d47a22
-
Filesize
1.3MB
MD509cba584aa0aae9fc600745567393ef6
SHA1bbd1f93cb0db9cf9e01071b3bed1b4afd6e31279
SHA2560babd84d4e7dc2713e7265d5ac25a3c28d412e705870cded6f5c7c550a5bf8d5
SHA5125f914fa33a63a6d4b46f39c7279687f313728fd5f8437ec592369a2da3256ccff6f325f78ace0e6d3a2c37da1f681058556f7603da13c45b03f2808f779d2aa1
-
Filesize
3.9MB
MD53b4647bcb9feb591c2c05d1a606ed988
SHA1b42c59f96fb069fd49009dfd94550a7764e6c97c
SHA25635773c397036b368c1e75d4e0d62c36d98139ebe74e42c1ff7be71c6b5a19fd7
SHA51200cd443b36f53985212ac43b44f56c18bf70e25119bbf9c59d05e2358ff45254b957f1ec63fc70fb57b1726fd8f76ccfad8103c67454b817a4f183f9122e3f50
-
Filesize
939KB
MD5258a9cae6024c91784bbd8aa5379e86f
SHA1fe1a808ba23053413359a78d5ec096b2cd540dd5
SHA2563881840473ec5286189d2fc8e85f0f26a2532890055d1653da9580aa31b2d0e5
SHA512b621ef432b430d2df0443fa0ebdd59dc7de6b32375c2fc83e8474838843c4abcf4a35f2b5f80e78911fc52336d71812ca9fbc9919314ea3b59bd26036a4ea5a5
-
Filesize
7.5MB
MD5d480fa673e647e8724368ebdc25e0466
SHA1e9d79aa2ecbdae35092e05f2d7dec4bcb8cf1a78
SHA25697e79046d57739603a980f5a5fb0642c05a082781095b9a7eb8475083ecd5703
SHA5125f34adcb185556428e4351fb6ab0e009a8e0585e1f5fbefc480bfd5fcaa7321ede5d9d58ad28bd4d987c273cb35e057e04ba39add1a47615de4b2bba28bc7551
-
Filesize
1.5MB
MD5c822ab5332b11c9185765b157d0b6e17
SHA17fe909d73a24ddd87171896079cceb8b03663ad4
SHA256344700d3141170111a9b77db100f6961cc54a2988d964d34f7e1ca57aa42aa2a
SHA512a8612836fb4714b939d03f7fe08391bbc635ca83ab853fc677159e5db6b00f76b9b586bdae9c19d2406d9a2713d1caf614132cb6c14e1dddc6ac45e47f7e5a5d
-
Filesize
26B
MD5fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98