hxxps://getwave[.]gg

Analysis

max time kernel
101s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 20:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://getwave.gg

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\Control Panel\International\Geo\Nation	Bloxstrap.exe
Key value queried	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\Control Panel\International\Geo\Nation	WaveInstaller.exe
Key value queried	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\Control Panel\International\Geo\Nation	WaveBootstrapper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\Control Panel\International\Geo\Nation	WaveWindows.exe

Executes dropped EXE 7 IoCs

pid	Process
2588	WaveInstaller.exe
5868	WaveBootstrapper.exe
6068	WaveWindows.exe
5192	CefSharp.BrowserSubprocess.exe
5516	CefSharp.BrowserSubprocess.exe
5392	node.exe
1116	Bloxstrap.exe

Loads dropped DLL 25 IoCs

pid	Process
5868	WaveBootstrapper.exe
6068	WaveWindows.exe
6068	WaveWindows.exe
6068	WaveWindows.exe
6068	WaveWindows.exe
6068	WaveWindows.exe
5192	CefSharp.BrowserSubprocess.exe
5192	CefSharp.BrowserSubprocess.exe
5192	CefSharp.BrowserSubprocess.exe
5192	CefSharp.BrowserSubprocess.exe
5192	CefSharp.BrowserSubprocess.exe
5192	CefSharp.BrowserSubprocess.exe
5192	CefSharp.BrowserSubprocess.exe
5192	CefSharp.BrowserSubprocess.exe
5192	CefSharp.BrowserSubprocess.exe
5192	CefSharp.BrowserSubprocess.exe
5192	CefSharp.BrowserSubprocess.exe
5516	CefSharp.BrowserSubprocess.exe
5516	CefSharp.BrowserSubprocess.exe
5516	CefSharp.BrowserSubprocess.exe
5516	CefSharp.BrowserSubprocess.exe
5516	CefSharp.BrowserSubprocess.exe
5516	CefSharp.BrowserSubprocess.exe
5516	CefSharp.BrowserSubprocess.exe
6068	WaveWindows.exe

Checks for any installed AV software in registry 1 TTPs 4 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\Software\KasperskyLab	WaveWindows.exe
Key value queried	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\KasperskyLab\LastUsername	WaveWindows.exe
Key value queried	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\KasperskyLab\Session	WaveWindows.exe
Key opened	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\Software\KasperskyLab	WaveWindows.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
89	raw.githubusercontent.com
65	raw.githubusercontent.com
66	raw.githubusercontent.com
86	raw.githubusercontent.com
87	raw.githubusercontent.com
88	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 932407.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
2212	msedge.exe
2212	msedge.exe
2716	msedge.exe
2716	msedge.exe
4492	identity_helper.exe
4492	identity_helper.exe
60	msedge.exe
60	msedge.exe
6068	WaveWindows.exe
6068	WaveWindows.exe
5192	CefSharp.BrowserSubprocess.exe
5192	CefSharp.BrowserSubprocess.exe
5516	CefSharp.BrowserSubprocess.exe
5516	CefSharp.BrowserSubprocess.exe
6068	WaveWindows.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe

Suspicious use of AdjustPrivilegeToken 58 IoCs

description	pid	Process
Token: SeDebugPrivilege	2588	WaveInstaller.exe
Token: 33	5244	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5244	AUDIODG.EXE
Token: SeManageVolumePrivilege	5344	svchost.exe
Token: SeDebugPrivilege	5868	WaveBootstrapper.exe
Token: SeDebugPrivilege	6068	WaveWindows.exe
Token: SeDebugPrivilege	5192	CefSharp.BrowserSubprocess.exe
Token: SeDebugPrivilege	5516	CefSharp.BrowserSubprocess.exe
Token: SeShutdownPrivilege	6068	WaveWindows.exe
Token: SeCreatePagefilePrivilege	6068	WaveWindows.exe
Token: SeShutdownPrivilege	6068	WaveWindows.exe
Token: SeCreatePagefilePrivilege	6068	WaveWindows.exe
Token: SeShutdownPrivilege	6068	WaveWindows.exe
Token: SeCreatePagefilePrivilege	6068	WaveWindows.exe
Token: SeShutdownPrivilege	6068	WaveWindows.exe
Token: SeCreatePagefilePrivilege	6068	WaveWindows.exe
Token: SeShutdownPrivilege	6068	WaveWindows.exe
Token: SeCreatePagefilePrivilege	6068	WaveWindows.exe
Token: SeShutdownPrivilege	6068	WaveWindows.exe
Token: SeCreatePagefilePrivilege	6068	WaveWindows.exe
Token: SeShutdownPrivilege	6068	WaveWindows.exe
Token: SeCreatePagefilePrivilege	6068	WaveWindows.exe
Token: SeShutdownPrivilege	6068	WaveWindows.exe
Token: SeCreatePagefilePrivilege	6068	WaveWindows.exe
Token: SeShutdownPrivilege	6068	WaveWindows.exe
Token: SeCreatePagefilePrivilege	6068	WaveWindows.exe
Token: SeShutdownPrivilege	6068	WaveWindows.exe
Token: SeCreatePagefilePrivilege	6068	WaveWindows.exe
Token: SeShutdownPrivilege	6068	WaveWindows.exe
Token: SeCreatePagefilePrivilege	6068	WaveWindows.exe
Token: SeShutdownPrivilege	6068	WaveWindows.exe
Token: SeCreatePagefilePrivilege	6068	WaveWindows.exe
Token: SeShutdownPrivilege	6068	WaveWindows.exe
Token: SeCreatePagefilePrivilege	6068	WaveWindows.exe
Token: SeShutdownPrivilege	6068	WaveWindows.exe
Token: SeCreatePagefilePrivilege	6068	WaveWindows.exe
Token: SeShutdownPrivilege	6068	WaveWindows.exe
Token: SeCreatePagefilePrivilege	6068	WaveWindows.exe
Token: SeShutdownPrivilege	6068	WaveWindows.exe
Token: SeCreatePagefilePrivilege	6068	WaveWindows.exe
Token: SeShutdownPrivilege	6068	WaveWindows.exe
Token: SeCreatePagefilePrivilege	6068	WaveWindows.exe
Token: SeShutdownPrivilege	6068	WaveWindows.exe
Token: SeCreatePagefilePrivilege	6068	WaveWindows.exe
Token: SeShutdownPrivilege	6068	WaveWindows.exe
Token: SeCreatePagefilePrivilege	6068	WaveWindows.exe
Token: SeShutdownPrivilege	6068	WaveWindows.exe
Token: SeCreatePagefilePrivilege	6068	WaveWindows.exe
Token: SeShutdownPrivilege	6068	WaveWindows.exe
Token: SeCreatePagefilePrivilege	6068	WaveWindows.exe
Token: SeShutdownPrivilege	6068	WaveWindows.exe
Token: SeCreatePagefilePrivilege	6068	WaveWindows.exe
Token: SeShutdownPrivilege	6068	WaveWindows.exe
Token: SeCreatePagefilePrivilege	6068	WaveWindows.exe
Token: SeShutdownPrivilege	6068	WaveWindows.exe
Token: SeCreatePagefilePrivilege	6068	WaveWindows.exe
Token: SeShutdownPrivilege	6068	WaveWindows.exe
Token: SeCreatePagefilePrivilege	6068	WaveWindows.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
1116	Bloxstrap.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5392	node.exe
1116	Bloxstrap.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 4348	2716	msedge.exe	81
PID 2716 wrote to memory of 4348	2716	msedge.exe	81
PID 2716 wrote to memory of 1520	2716	msedge.exe	84
PID 2716 wrote to memory of 1520	2716	msedge.exe	84
PID 2716 wrote to memory of 1520	2716	msedge.exe	84
PID 2716 wrote to memory of 1520	2716	msedge.exe	84
PID 2716 wrote to memory of 1520	2716	msedge.exe	84
PID 2716 wrote to memory of 1520	2716	msedge.exe	84
PID 2716 wrote to memory of 1520	2716	msedge.exe	84
PID 2716 wrote to memory of 1520	2716	msedge.exe	84
PID 2716 wrote to memory of 1520	2716	msedge.exe	84
PID 2716 wrote to memory of 1520	2716	msedge.exe	84
PID 2716 wrote to memory of 1520	2716	msedge.exe	84
PID 2716 wrote to memory of 1520	2716	msedge.exe	84
PID 2716 wrote to memory of 1520	2716	msedge.exe	84
PID 2716 wrote to memory of 1520	2716	msedge.exe	84
PID 2716 wrote to memory of 1520	2716	msedge.exe	84
PID 2716 wrote to memory of 1520	2716	msedge.exe	84
PID 2716 wrote to memory of 1520	2716	msedge.exe	84
PID 2716 wrote to memory of 1520	2716	msedge.exe	84
PID 2716 wrote to memory of 1520	2716	msedge.exe	84
PID 2716 wrote to memory of 1520	2716	msedge.exe	84
PID 2716 wrote to memory of 1520	2716	msedge.exe	84
PID 2716 wrote to memory of 1520	2716	msedge.exe	84
PID 2716 wrote to memory of 1520	2716	msedge.exe	84
PID 2716 wrote to memory of 1520	2716	msedge.exe	84
PID 2716 wrote to memory of 1520	2716	msedge.exe	84
PID 2716 wrote to memory of 1520	2716	msedge.exe	84
PID 2716 wrote to memory of 1520	2716	msedge.exe	84
PID 2716 wrote to memory of 1520	2716	msedge.exe	84
PID 2716 wrote to memory of 1520	2716	msedge.exe	84
PID 2716 wrote to memory of 1520	2716	msedge.exe	84
PID 2716 wrote to memory of 1520	2716	msedge.exe	84
PID 2716 wrote to memory of 1520	2716	msedge.exe	84
PID 2716 wrote to memory of 1520	2716	msedge.exe	84
PID 2716 wrote to memory of 1520	2716	msedge.exe	84
PID 2716 wrote to memory of 1520	2716	msedge.exe	84
PID 2716 wrote to memory of 1520	2716	msedge.exe	84
PID 2716 wrote to memory of 1520	2716	msedge.exe	84
PID 2716 wrote to memory of 1520	2716	msedge.exe	84
PID 2716 wrote to memory of 1520	2716	msedge.exe	84
PID 2716 wrote to memory of 1520	2716	msedge.exe	84
PID 2716 wrote to memory of 2212	2716	msedge.exe	85
PID 2716 wrote to memory of 2212	2716	msedge.exe	85
PID 2716 wrote to memory of 3672	2716	msedge.exe	86
PID 2716 wrote to memory of 3672	2716	msedge.exe	86
PID 2716 wrote to memory of 3672	2716	msedge.exe	86
PID 2716 wrote to memory of 3672	2716	msedge.exe	86
PID 2716 wrote to memory of 3672	2716	msedge.exe	86
PID 2716 wrote to memory of 3672	2716	msedge.exe	86
PID 2716 wrote to memory of 3672	2716	msedge.exe	86
PID 2716 wrote to memory of 3672	2716	msedge.exe	86
PID 2716 wrote to memory of 3672	2716	msedge.exe	86
PID 2716 wrote to memory of 3672	2716	msedge.exe	86
PID 2716 wrote to memory of 3672	2716	msedge.exe	86
PID 2716 wrote to memory of 3672	2716	msedge.exe	86
PID 2716 wrote to memory of 3672	2716	msedge.exe	86
PID 2716 wrote to memory of 3672	2716	msedge.exe	86
PID 2716 wrote to memory of 3672	2716	msedge.exe	86
PID 2716 wrote to memory of 3672	2716	msedge.exe	86
PID 2716 wrote to memory of 3672	2716	msedge.exe	86
PID 2716 wrote to memory of 3672	2716	msedge.exe	86
PID 2716 wrote to memory of 3672	2716	msedge.exe	86
PID 2716 wrote to memory of 3672	2716	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://getwave.gg
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe206f46f8,0x7ffe206f4708,0x7ffe206f4718
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2276,2260899062073555525,4470496287522348282,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2276,2260899062073555525,4470496287522348282,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2276,2260899062073555525,4470496287522348282,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,2260899062073555525,4470496287522348282,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,2260899062073555525,4470496287522348282,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2276,2260899062073555525,4470496287522348282,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 /prefetch:8
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2276,2260899062073555525,4470496287522348282,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,2260899062073555525,4470496287522348282,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2276,2260899062073555525,4470496287522348282,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3372 /prefetch:8
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,2260899062073555525,4470496287522348282,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2276,2260899062073555525,4470496287522348282,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2276,2260899062073555525,4470496287522348282,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:60
- C:\Users\Admin\Downloads\WaveInstaller.exe
  "C:\Users\Admin\Downloads\WaveInstaller.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2588
- - C:\Users\Admin\AppData\Local\Wave\WaveBootstrapper.exe
    "C:\Users\Admin\AppData\Local\Wave\WaveBootstrapper.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:5868
  - - C:\Users\Admin\AppData\Local\Wave\WaveWindows.exe
      "C:\Users\Admin\AppData\Local\Wave\WaveWindows.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Checks for any installed AV software in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6068
    - - C:\Users\Admin\AppData\Local\CefSharp\CefSharp.BrowserSubprocess.exe
        
        "C:\Users\Admin\AppData\Local\CefSharp\CefSharp.BrowserSubprocess.exe" --type=gpu-process --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\CefSharp\locales" --resources-dir-path="C:\Users\Admin\AppData\Local\CefSharp" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CefSharp" --cefsharpexitsub --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2060,i,3454838201303629922,16704668975002591918,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --enable-logging=handle --log-file=2092 --mojo-platform-channel-handle=2052 /prefetch:2 --host-process-id=6068
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5192
    - - C:\Users\Admin\AppData\Local\Luau Language Server\node.exe
        
        "C:\Users\Admin\AppData\Local\Luau Language Server\node.exe" server --process-id=6068
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5392
    - - C:\Users\Admin\AppData\Local\CefSharp\CefSharp.BrowserSubprocess.exe
        
        "C:\Users\Admin\AppData\Local\CefSharp\CefSharp.BrowserSubprocess.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\CefSharp\locales" --resources-dir-path="C:\Users\Admin\AppData\Local\CefSharp" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CefSharp" --cefsharpexitsub --field-trial-handle=2812,i,3454838201303629922,16704668975002591918,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --enable-logging=handle --log-file=2816 --mojo-platform-channel-handle=2808 /prefetch:3 --host-process-id=6068
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5516
    - - C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe
        
        "C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,2260899062073555525,4470496287522348282,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,2260899062073555525,4470496287522348282,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,2260899062073555525,4470496287522348282,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,2260899062073555525,4470496287522348282,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:2468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:636

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x444 0x33c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5244

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe

Filesize
249KB

MD5
772c9fecbd0397f6cfb3d866cf3a5d7d

SHA1
6de3355d866d0627a756d0d4e29318e67650dacf

SHA256
2f88ea7e1183d320fb2b7483de2e860da13dc0c0caaf58f41a888528d78c809f

SHA512
82048bd6e50d38a863379a623b8cfda2d1553d8141923acf13f990c7245c833082523633eaa830362a12bfff300da61b3d8b3cccbe038ce2375fdfbd20dbca31

Download Submit
C:\Users\Admin\AppData\Local\CefSharp\CefSharp.BrowserSubprocess.Core.dll

Filesize
915KB

MD5
100c32f77e68a2ce962e1a28997567ea

SHA1
a80a1f4019b8d44df6b5833fb0c51b929fa79843

SHA256
c0b9e29b240d8328f2f9a29ca0298ca4d967a926f3174a3442c3730c00d5a926

SHA512
f95530ef439fa5c4e3bc02db249b6a76e9d56849816ead83c9cd9bcd49d3443ccb88651d829165c98a67af40b3ef02b922971114f29c5c735e662ca35c0fb6ed

Download Submit
C:\Users\Admin\AppData\Local\CefSharp\CefSharp.BrowserSubprocess.exe

Filesize
7KB

MD5
516ff62b2e1f4642caa954c0968719e8

SHA1
e349d0ce82e2109dd0d18416d9cf46e8411b7f15

SHA256
19da58849cec5933860116e60a1e94b08e30d90e0f955768270b47998d612045

SHA512
7aa4a0c87b29c2a84f585a884d8208fc2352a43f2cdb549c100e3b121837ad5f8dadb1101f57d1d3fcb7ebec9d9f22e07dc14239b7d2e2d25793c999becf288b

Download Submit
C:\Users\Admin\AppData\Local\CefSharp\CefSharp.dll

Filesize
272KB

MD5
9ca06a8f9e5f7239ca225ab810274023

SHA1
e1a219f567a7b7d3af9386df51b14c76e769c044

SHA256
5fd00ae3e83e6ca156647ff6df87b49ffc7cad47c23fe3ae07c067c5adf6f74a

SHA512
430c9bceed5439b987d5bd4840cfe32411ca61594f18597aca1948aa39a22c9d70beadf3bb9b1dd0373f81a94a25dcba17fa8e8c73abf06cba28d0971d5614c5

Download Submit
C:\Users\Admin\AppData\Local\CefSharp\chrome_100_percent.pak

Filesize
667KB

MD5
ae195e80859781a20414cf5faa52db06

SHA1
b18ecb5ec141415e3a210880e2b3d37470636485

SHA256
9957802c0792e621f76bbdb1c630fbad519922743b5d193294804164babda552

SHA512
c6fef84615fe20d1760ca496c98629feb4e533556724e9631d4282622748e7601225cf19dfb8351f4b540ae3f83785c1bcea6fe8c246cf70388e527654097c1c

Download Submit
C:\Users\Admin\AppData\Local\CefSharp\chrome_200_percent.pak

Filesize
1.0MB

MD5
1abf6bad0c39d59e541f04162e744224

SHA1
db93c38253338a0b85e431bd4194d9e7bddb22c6

SHA256
01cb663a75f18bb2d0d800640a114f153a34bd8a5f2aa0ed7daa9b32967dc29e

SHA512
945d519221d626421094316f13b818766826b3bedddab0165c041540dddadc93136e32784c0562d26a420cb29479d04d2aa317b8d605cd242e5152bf05af197e

Download Submit
C:\Users\Admin\AppData\Local\CefSharp\chrome_elf.dll

Filesize
1020KB

MD5
7191d97ce7886a1a93a013e90868db96

SHA1
52dd736cb589dd1def87130893d6b9449a6a36e3

SHA256
32f925f833aa59e3f05322549fc3c326ac6fc604358f4efbf94c59d5c08b8dc6

SHA512
38ebb62c34d466935eabb157197c7c364d4345f22aa3b2641b636196ca1aeaa2152ac75d613ff90817cb94825189612ddd12fb96df29469511a46a7d9620e724

Download Submit
C:\Users\Admin\AppData\Local\CefSharp\icudtl.dat

Filesize
10.2MB

MD5
74bded81ce10a426df54da39cfa132ff

SHA1
eb26bcc7d24be42bd8cfbded53bd62d605989bbf

SHA256
7bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9

SHA512
bd7b7b52d31803b2d4b1fd8cb76481931ed8abb98d779b893d3965231177bdd33386461e1a820b384712013904da094e3cd15ee24a679ddc766132677a8be54a

Download Submit
C:\Users\Admin\AppData\Local\CefSharp\libEGL.dll

Filesize
359KB

MD5
7dd6b0e4a31d35a0fae5ff425707073c

SHA1
fbd12e9f8e2252c52ce555c2ebbd7f07e62a0140

SHA256
8762d8001fc3ddd90e3129dfea172817e8d09b9936eaae391957de4326c8c906

SHA512
726968df6b83ab5f589276672250d92f532fe2dcea2176e42031a7f1dcecf578b0320cfe2a7d88bb9883ad99387d71c6ebf1e9968272bb5e62850ef09abd2648

Download Submit
C:\Users\Admin\AppData\Local\CefSharp\libGLESv2.dll

Filesize
6.6MB

MD5
8803db5b167fb5a5f8a8c595c4e4d7c6

SHA1
7fde861151f3bea66c65b6c2487a30728048811a

SHA256
52a58d25a41f4bd31cdb4a0d306217862e04ebf7c1925cc85330054a5523d719

SHA512
2fa9a0eda221982896e41eb387b5e156198615ac1a1fbac0acffd13008919368b41a240df416c1fce2e48c20a14cd7af7cca9fba476ada5e64a0cadde84a44b7

Download Submit
C:\Users\Admin\AppData\Local\CefSharp\locales\en-US.pak

Filesize
456KB

MD5
4430b1833d56bc8eb1f7dc82bb7f4bc9

SHA1
dc15e6306625f155683326e859d83f846153c547

SHA256
b44ddcfac9df4934007e6c55a3c7f5e7f14c7e5e29f35c81de917fc3b22aabbc

SHA512
faf93bf371b2a88c1b874a5e2c54e4487fd152ad19c2a406a46f55ae75ecd421a779888c2e4c170857b16bfb5d8744bc1815a4732ed50b064b3cbd0c5ffad889

Download Submit
C:\Users\Admin\AppData\Local\CefSharp\resources.pak

Filesize
8.0MB

MD5
4933d92c99afa246fc59eef010d5c858

SHA1
98d443654e93c73dd317f9f847f71fba3d5b3135

SHA256
62f4674daa15245ee081920b8ee191e72f36ca8fe24f6b986a832f45676915b2

SHA512
a3a69523c8e7310716daeebc06c2ba4fce673eccd1958e824ff179b82f4502d0ec095190179bbb387342e4150f952ea7533182fb6ba90377d17dafba8f4da623

Download Submit
C:\Users\Admin\AppData\Local\CefSharp\v8_context_snapshot.bin

Filesize
643KB

MD5
28477a60b4fbd51dfef5237245817690

SHA1
b0afd5ea9f9d550124f23c65bc7851ddeffc662f

SHA256
169ea86f544e5cdf2a460675f876a9abb7f56bbe122782e94bb03d624931fc12

SHA512
3520658583bb498d5032a7f7ae77195fd2e5f8ed03c6531e56dee8320d8701102a723766e59f7766ab223f837e65a6d85cf862bb2bef6d2755ce45e672a47b22

Download Submit
C:\Users\Admin\AppData\Local\CefSharp\vk_swiftshader.dll

Filesize
4.4MB

MD5
0ec149455727ace9acc09b3ba2c3a2b2

SHA1
6eeb990876cef6a34115b67f3190255db589f723

SHA256
e2d8ef53897e864b5b66bc73606681c99461798a9f4c1e13ca5cef7bc774d7fd

SHA512
c8eaa598c9439b1f2375fdac1f58896853510bddbd640707b9142c0d3793836120b28d7c2bd0407f0d5656dd19f14b312f37b7ac0165c9cc8b4c1a0f2af62531

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1fe3a26bd35b84102bb4203f31e74c7

SHA1
45fdfa8433789b575eb64e116718e62e0e0cf4a0

SHA256
26e0d51529de906dd285ba48288e25eaf5213c0f0bab9bc5f119ecbc5e1b93ee

SHA512
d528db2e9b917d4fbe24b1b5c6f4cb274f4f91c84f63e5119e041fa89ae0cd01a370e314f8b6aca9d6fa958e79feabc720f4b54b3d8aed69aab11fa84cad36bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2915233ace3b11bc8898c958f245aa9a

SHA1
68c6aa983da303b825d656ac3284081db682f702

SHA256
b2cb442f2ca27619c8df087f56fcbbb53186c53f8fd131af886ee3712220477e

SHA512
e3f1b70d39b615e212f84d587ee816598236ee6ce144d919593894fcce4a0900343a9e8b837a0d1bd10921fff1c976c84c4a570eda776fe84d374a69e7a54890

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
d64d877762e7d256da0a1067703862ea

SHA1
28b25ef8e160b6fe516e3a7761ad8b99806bef70

SHA256
9b3b6738c1d3e6e1492e5c8bd6b11e5687b9632fe665b41e8ca106fe7d253695

SHA512
3787be030a9bb98ab5b357b280eb5262e7f8227cb712a6a0ec2b96de26df06d0cefbf185631f629d2c9165b4dc310bc9f97b25ff0c5db707e410d53c3cb20079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
467B

MD5
d311da1be3c226f10e382f9a1b7092a7

SHA1
2068b0b770a0488b07aa613663b94123d4019332

SHA256
8f39e73c4cdb75486cc17eac67cc8fdc3df20dd0834c62f78382f9d81331b8de

SHA512
75fbb9935ed862f0dbf2c6f7e0d9cd8f4ed8974bccb182276c7351e258a3a076445a25a28965ac9937147c427a987b966d0081ab01e9b625f18a21686f0fb3e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d57a9c380e47709425dfd7a2c948448b

SHA1
db3e72d52a78e9379e5b258babbdcd080b35178a

SHA256
66cd15b5df818e2ee1ed64fe398b66dc38c495f3c0156d2f3f7774abc1253747

SHA512
d2f11f1fde3038801e5dd53d364bb76beb5b48e9c30fd774c7a999acd56678dc325218784fbcf623ae76412ba1bd9f20ac38eae141183ef147c9804165998fab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a8b5991fe4a7a6508037c19d2f0437cc

SHA1
f770b0785ae52e0379bbc377bdeb5b5efe237972

SHA256
fbf2779f360fbc122e6610cd3951ab2929c6a758c24a079758f17803af5e9472

SHA512
08616030515db3f3a91fa9e04f499d8a78b36c7857de2ad4ec4f03bc5f9a81ebd6e0ddf9b4dd20580b4c7f79907084eec4e063a07291235ec00de8bad5bfb1fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8dbcf04daf7d1d1ecba81c40388fbb1c

SHA1
8a741980fba599456615b719d64fcdcd62c14245

SHA256
2e09adc0f1481f8ea94d221191a716708d3f3b673392802657a0371cbaef869a

SHA512
5b97773406e9de27d00c9c46fa206cea94b9c6b3785aa9837da616109a7cf0a848b699521de2dbcad21f0a6b1d33dfa3ad21a66331a2e9e06fc067ce99ecbf7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a97e16772394ce56d02e641bbc635486

SHA1
0aa7ab7f3ed9b16876ba4ae615d813bdd4006c91

SHA256
9d5e22e2f28616646965c0b1281438e44e9ee034432d6e9753c797fe2e559e68

SHA512
ca4ee5365fbe577a79c4d54a1d10cad1859f08ed1b257a5826b8cef18bf27fdc7ef2f0da6a5e116f31ccc8a5c0f2d3885e4b11edcf4bc08572fd1a7b2d3572b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
85e1d40f4d6321fae2c3d5b8992c34fc

SHA1
f392d86878c2269294dd419b1a8d023ff2f0c8b8

SHA256
cc17c1d9e9faf2f8927df49e85ed4488e44563e044413a644d93897b02d6f6e3

SHA512
f00eb2f9edd7bcaa8d80e3dd48f57bb085c40379a4499e9ae30bf0521fa0c5e2f1475ff1c503bede0e1fe2906ca20dc993ec220e8a59e7d6bb5a570cf7097c8d

Download Submit
C:\Users\Admin\AppData\Local\Wave\CefSharp.Core.Runtime.dll

Filesize
1.3MB

MD5
09cba584aa0aae9fc600745567393ef6

SHA1
bbd1f93cb0db9cf9e01071b3bed1b4afd6e31279

SHA256
0babd84d4e7dc2713e7265d5ac25a3c28d412e705870cded6f5c7c550a5bf8d5

SHA512
5f914fa33a63a6d4b46f39c7279687f313728fd5f8437ec592369a2da3256ccff6f325f78ace0e6d3a2c37da1f681058556f7603da13c45b03f2808f779d2aa1

Download Submit
C:\Users\Admin\AppData\Local\Wave\D3DCOMPILER_47.dll

Filesize
3.9MB

MD5
3b4647bcb9feb591c2c05d1a606ed988

SHA1
b42c59f96fb069fd49009dfd94550a7764e6c97c

SHA256
35773c397036b368c1e75d4e0d62c36d98139ebe74e42c1ff7be71c6b5a19fd7

SHA512
00cd443b36f53985212ac43b44f56c18bf70e25119bbf9c59d05e2358ff45254b957f1ec63fc70fb57b1726fd8f76ccfad8103c67454b817a4f183f9122e3f50

Download Submit
C:\Users\Admin\AppData\Local\Wave\WaveBootstrapper.exe

Filesize
949KB

MD5
8fb51b92d496c6765f7ba44e6d4a8990

SHA1
d3e5a8465622cd5adae05babeb7e34b2b5c777d7

SHA256
ab49d6166a285b747e5f279620ab9cea12f33f7656d732aa75900fcb981a5394

SHA512
20de93a52fff7b092cb9d77bd26944abed5f5cb67146e6d2d70be6a431283b6de52eb37a0e13dc8bc57dcf8be2d5a95b9c11b3b030a3e2f03dd6e4efc23527a6

Download Submit
C:\Users\Admin\AppData\Local\Wave\WaveWindows.exe

Filesize
7.5MB

MD5
521e21ad5cd0137689bbde63f2729873

SHA1
a2333d3c6ad72680b568b56d7061b0aee5aa3e3d

SHA256
a632148f833a0c6ba79160f401aa614ae3d6aafe096abbffdabe046d3d712355

SHA512
2f77c2820ad24489d76547ba1a709e83395639ff9e1864d141b26e19834c245691bfd92a92047673da15517799ea0e3f17396c6a79d571bb0eee3636bfd8ed60

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 932407.crdownload

Filesize
1.5MB

MD5
c822ab5332b11c9185765b157d0b6e17

SHA1
7fe909d73a24ddd87171896079cceb8b03663ad4

SHA256
344700d3141170111a9b77db100f6961cc54a2988d964d34f7e1ca57aa42aa2a

SHA512
a8612836fb4714b939d03f7fe08391bbc635ca83ab853fc677159e5db6b00f76b9b586bdae9c19d2406d9a2713d1caf614132cb6c14e1dddc6ac45e47f7e5a5d

Download Submit
memory/2588-239-0x0000000006090000-0x0000000006098000-memory.dmp

Filesize
32KB

Download
memory/2588-104-0x0000000000B40000-0x0000000000CD2000-memory.dmp

Filesize
1.6MB

Download
memory/2588-105-0x0000000009F50000-0x0000000009F88000-memory.dmp

Filesize
224KB

Download
memory/2588-106-0x0000000009F20000-0x0000000009F2E000-memory.dmp

Filesize
56KB

Download
memory/2588-237-0x000000000B2D0000-0x000000000B366000-memory.dmp

Filesize
600KB

Download
memory/2588-238-0x0000000006040000-0x0000000006066000-memory.dmp

Filesize
152KB

Download
memory/2588-241-0x00000000062F0000-0x0000000006362000-memory.dmp

Filesize
456KB

Download
memory/2588-242-0x0000000006360000-0x000000000636A000-memory.dmp

Filesize
40KB

Download
memory/2588-243-0x000000000B3B0000-0x000000000B3BA000-memory.dmp

Filesize
40KB

Download
memory/5192-521-0x0000000000BC0000-0x0000000000BC8000-memory.dmp

Filesize
32KB

Download
memory/5192-532-0x0000000005550000-0x000000000559A000-memory.dmp

Filesize
296KB

Download
memory/5192-525-0x00000000053A0000-0x000000000548A000-memory.dmp

Filesize
936KB

Download
memory/5344-190-0x000001E925370000-0x000001E925371000-memory.dmp

Filesize
4KB

Download
memory/5344-195-0x000001E925370000-0x000001E925371000-memory.dmp

Filesize
4KB

Download
memory/5344-220-0x000001E9250D0000-0x000001E9250D1000-memory.dmp

Filesize
4KB

Download
memory/5344-222-0x000001E9250E0000-0x000001E9250E1000-memory.dmp

Filesize
4KB

Download
memory/5344-223-0x000001E9250E0000-0x000001E9250E1000-memory.dmp

Filesize
4KB

Download
memory/5344-156-0x000001E91CC60000-0x000001E91CC70000-memory.dmp

Filesize
64KB

Download
memory/5344-172-0x000001E91CD60000-0x000001E91CD70000-memory.dmp

Filesize
64KB

Download
memory/5344-188-0x000001E925350000-0x000001E925351000-memory.dmp

Filesize
4KB

Download
memory/5344-199-0x000001E924FA0000-0x000001E924FA1000-memory.dmp

Filesize
4KB

Download
memory/5344-196-0x000001E925370000-0x000001E925371000-memory.dmp

Filesize
4KB

Download
memory/5344-224-0x000001E9251F0000-0x000001E9251F1000-memory.dmp

Filesize
4KB

Download
memory/5344-205-0x000001E924F90000-0x000001E924F91000-memory.dmp

Filesize
4KB

Download
memory/5344-189-0x000001E925370000-0x000001E925371000-memory.dmp

Filesize
4KB

Download
memory/5344-202-0x000001E924FA0000-0x000001E924FA1000-memory.dmp

Filesize
4KB

Download
memory/5344-198-0x000001E925370000-0x000001E925371000-memory.dmp

Filesize
4KB

Download
memory/5344-208-0x000001E924ED0000-0x000001E924ED1000-memory.dmp

Filesize
4KB

Download
memory/5344-197-0x000001E925370000-0x000001E925371000-memory.dmp

Filesize
4KB

Download
memory/5344-200-0x000001E924F90000-0x000001E924F91000-memory.dmp

Filesize
4KB

Download
memory/5344-194-0x000001E925370000-0x000001E925371000-memory.dmp

Filesize
4KB

Download
memory/5344-193-0x000001E925370000-0x000001E925371000-memory.dmp

Filesize
4KB

Download
memory/5344-192-0x000001E925370000-0x000001E925371000-memory.dmp

Filesize
4KB

Download
memory/5344-191-0x000001E925370000-0x000001E925371000-memory.dmp

Filesize
4KB

Download
memory/5868-485-0x0000000009440000-0x0000000009544000-memory.dmp

Filesize
1.0MB

Download
memory/5868-486-0x000000000A170000-0x000000000A186000-memory.dmp

Filesize
88KB

Download
memory/5868-483-0x0000000000CC0000-0x0000000000DB2000-memory.dmp

Filesize
968KB

Download
memory/5868-487-0x000000000A1B0000-0x000000000A1BA000-memory.dmp

Filesize
40KB

Download
memory/5868-488-0x000000000A1F0000-0x000000000A1F8000-memory.dmp

Filesize
32KB

Download
memory/5868-489-0x000000000A250000-0x000000000A26E000-memory.dmp

Filesize
120KB

Download
memory/6068-568-0x000000000FA80000-0x000000000FDD4000-memory.dmp

Filesize
3.3MB

Download
memory/6068-495-0x0000000000B70000-0x00000000012FC000-memory.dmp

Filesize
7.5MB

Download
memory/6068-498-0x00000000062A0000-0x0000000006386000-memory.dmp

Filesize
920KB

Download
memory/6068-506-0x0000000006640000-0x000000000679B000-memory.dmp

Filesize
1.4MB

Download
memory/6068-562-0x000000000DA10000-0x000000000DAC2000-memory.dmp

Filesize
712KB

Download
memory/6068-567-0x000000000DF10000-0x000000000DF32000-memory.dmp

Filesize
136KB

Download
memory/6068-496-0x0000000005B60000-0x0000000005BAA000-memory.dmp

Filesize
296KB

Download
memory/6068-497-0x0000000005ED0000-0x0000000005EF4000-memory.dmp

Filesize
144KB

Download