hxxps://drive[.]google[.]com/file/d/1d-AcYI1SvRj8B-iwa3CP7iaGyuSrBE28/view?usp=sharing

Analysis

max time kernel
536s
max time network
527s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-08-2024 06:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1d-AcYI1SvRj8B-iwa3CP7iaGyuSrBE28/view?usp=sharing

Score

9^/10

discovery evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	wave_bypass (3).exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	wave_bypass (3).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wave_bypass (3).exe

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	CefSharp.BrowserSubprocess.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	WaveInstaller (6).exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	WaveBootstrapper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	WaveWindows.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	Bloxstrap.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	CefSharp.BrowserSubprocess.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	node.exe

Executes dropped EXE 14 IoCs

pid	Process
2268	WaveInstaller (6).exe
3208	WaveBootstrapper.exe
4548	WaveWindows.exe
3672	node.exe
2872	Bloxstrap.exe
4892	CefSharp.BrowserSubprocess.exe
1680	CefSharp.BrowserSubprocess.exe
4872	CefSharp.BrowserSubprocess.exe
5100	CefSharp.BrowserSubprocess.exe
1764	CefSharp.BrowserSubprocess.exe
2520	wave-luau.exe
5192	wave_bypass (3).exe
5740	CefSharp.BrowserSubprocess.exe
6096	CefSharp.BrowserSubprocess.exe

Loads dropped DLL 64 IoCs

pid	Process
3208	WaveBootstrapper.exe
4548	WaveWindows.exe
4548	WaveWindows.exe
4548	WaveWindows.exe
4548	WaveWindows.exe
4548	WaveWindows.exe
4548	WaveWindows.exe
4548	WaveWindows.exe
4548	WaveWindows.exe
4548	WaveWindows.exe
4548	WaveWindows.exe
4548	WaveWindows.exe
4548	WaveWindows.exe
4892	CefSharp.BrowserSubprocess.exe
4892	CefSharp.BrowserSubprocess.exe
4892	CefSharp.BrowserSubprocess.exe
4892	CefSharp.BrowserSubprocess.exe
4892	CefSharp.BrowserSubprocess.exe
4892	CefSharp.BrowserSubprocess.exe
4892	CefSharp.BrowserSubprocess.exe
1680	CefSharp.BrowserSubprocess.exe
1680	CefSharp.BrowserSubprocess.exe
4872	CefSharp.BrowserSubprocess.exe
4872	CefSharp.BrowserSubprocess.exe
4872	CefSharp.BrowserSubprocess.exe
4872	CefSharp.BrowserSubprocess.exe
4872	CefSharp.BrowserSubprocess.exe
1680	CefSharp.BrowserSubprocess.exe
1680	CefSharp.BrowserSubprocess.exe
1680	CefSharp.BrowserSubprocess.exe
4892	CefSharp.BrowserSubprocess.exe
4892	CefSharp.BrowserSubprocess.exe
4892	CefSharp.BrowserSubprocess.exe
4872	CefSharp.BrowserSubprocess.exe
4872	CefSharp.BrowserSubprocess.exe
5100	CefSharp.BrowserSubprocess.exe
5100	CefSharp.BrowserSubprocess.exe
5100	CefSharp.BrowserSubprocess.exe
5100	CefSharp.BrowserSubprocess.exe
5100	CefSharp.BrowserSubprocess.exe
1680	CefSharp.BrowserSubprocess.exe
1680	CefSharp.BrowserSubprocess.exe
4892	CefSharp.BrowserSubprocess.exe
5100	CefSharp.BrowserSubprocess.exe
5100	CefSharp.BrowserSubprocess.exe
1764	CefSharp.BrowserSubprocess.exe
1764	CefSharp.BrowserSubprocess.exe
1764	CefSharp.BrowserSubprocess.exe
1764	CefSharp.BrowserSubprocess.exe
1764	CefSharp.BrowserSubprocess.exe
1764	CefSharp.BrowserSubprocess.exe
1764	CefSharp.BrowserSubprocess.exe
5192	wave_bypass (3).exe
5192	wave_bypass (3).exe
5192	wave_bypass (3).exe
5192	wave_bypass (3).exe
5192	wave_bypass (3).exe
5192	wave_bypass (3).exe
5740	CefSharp.BrowserSubprocess.exe
5740	CefSharp.BrowserSubprocess.exe
5740	CefSharp.BrowserSubprocess.exe
5740	CefSharp.BrowserSubprocess.exe
5740	CefSharp.BrowserSubprocess.exe
5740	CefSharp.BrowserSubprocess.exe

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/5192-689-0x0000000140000000-0x0000000144B43000-memory.dmp	themida
behavioral1/memory/5192-700-0x0000000140000000-0x0000000144B43000-memory.dmp	themida
behavioral1/memory/5192-703-0x0000000140000000-0x0000000144B43000-memory.dmp	themida
behavioral1/memory/5192-701-0x0000000140000000-0x0000000144B43000-memory.dmp	themida
behavioral1/memory/5192-702-0x0000000140000000-0x0000000144B43000-memory.dmp	themida
behavioral1/memory/5192-844-0x0000000140000000-0x0000000144B43000-memory.dmp	themida

Checks for any installed AV software in registry 1 TTPs 31 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\KasperskyLab	WaveWindows.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\KasperskyLab	WaveWindows.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\KasperskyLab\RefreshRate = "60"	WaveWindows.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\KasperskyLab\FontSize	WaveWindows.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\KasperskyLab\FirstHash = "\"8435506daf2f1609706d4b50b15524c0-2\""	WaveWindows.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\KasperskyLab\TopMost = "0"	WaveWindows.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\KasperskyLab\InlayHints = "1"	WaveWindows.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\KasperskyLab\LastUsername	WaveWindows.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\KasperskyLab\RedirectCompilerError = "1"	WaveWindows.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\KasperskyLab\SendCurrentDocument = "1"	WaveWindows.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\KasperskyLab\FirstHash	WaveWindows.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\KasperskyLab\SecondHash	WaveWindows.exe
Key queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\KasperskyLab	WaveWindows.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\KasperskyLab\LastUsername = "5wzx22"	WaveWindows.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\KasperskyLab\SecondHash = "\"664457e9c31d4c1ee4c8ae1e415f01a7-2\""	WaveWindows.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\KasperskyLab\ContinueOnStartUp = "0"	WaveWindows.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\KasperskyLab\RedirectCompilerError	WaveWindows.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\KasperskyLab\Minimap	WaveWindows.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\KasperskyLab\Minimap = "0"	WaveWindows.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\KasperskyLab\InlayHints	WaveWindows.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\KasperskyLab\TopMost	WaveWindows.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\KasperskyLab\UsePerformanceMode = "0"	WaveWindows.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\KasperskyLab\SendCurrentDocument	WaveWindows.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\KasperskyLab\LastUsername	wave_bypass (3).exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\KasperskyLab\Session	WaveWindows.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\KasperskyLab\UsePerformanceMode	WaveWindows.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\KasperskyLab\FontSize = "14"	WaveWindows.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\KasperskyLab\Session = "Bearer 397d4453-24fb-4d16-92cb-a905a24048c3"	WaveWindows.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\KasperskyLab\ContinueOnStartUp	WaveWindows.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\KasperskyLab\RefreshRate	WaveWindows.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\KasperskyLab\Session	wave_bypass (3).exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wave_bypass (3).exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	WaveWindows.exe
File opened (read-only)	\??\L:	WaveWindows.exe
File opened (read-only)	\??\N:	WaveWindows.exe
File opened (read-only)	\??\R:	WaveWindows.exe
File opened (read-only)	\??\W:	WaveWindows.exe
File opened (read-only)	\??\Z:	WaveWindows.exe
File opened (read-only)	\??\X:	WaveWindows.exe
File opened (read-only)	\??\Y:	WaveWindows.exe
File opened (read-only)	\??\G:	WaveWindows.exe
File opened (read-only)	\??\H:	WaveWindows.exe
File opened (read-only)	\??\K:	WaveWindows.exe
File opened (read-only)	\??\Q:	WaveWindows.exe
File opened (read-only)	\??\S:	WaveWindows.exe
File opened (read-only)	\??\V:	WaveWindows.exe
File opened (read-only)	\??\M:	WaveWindows.exe
File opened (read-only)	\??\O:	WaveWindows.exe
File opened (read-only)	\??\P:	WaveWindows.exe
File opened (read-only)	\??\T:	WaveWindows.exe
File opened (read-only)	\??\U:	WaveWindows.exe
File opened (read-only)	\??\B:	WaveWindows.exe
File opened (read-only)	\??\E:	WaveWindows.exe
File opened (read-only)	\??\I:	WaveWindows.exe
File opened (read-only)	\??\J:	WaveWindows.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

flow	ioc
134	raw.githubusercontent.com
135	raw.githubusercontent.com
154	raw.githubusercontent.com
155	raw.githubusercontent.com
156	raw.githubusercontent.com
157	raw.githubusercontent.com
4	drive.google.com
7	drive.google.com

Network Service Discovery 1 TTPs 7 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4872	CefSharp.BrowserSubprocess.exe
1680	CefSharp.BrowserSubprocess.exe
5740	CefSharp.BrowserSubprocess.exe
6096	CefSharp.BrowserSubprocess.exe
4892	CefSharp.BrowserSubprocess.exe
5100	CefSharp.BrowserSubprocess.exe
1764	CefSharp.BrowserSubprocess.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5192	wave_bypass (3).exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4548_1755292965\LICENSE	WaveWindows.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4548_1755292965\manifest.json	WaveWindows.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4548_1755292965\_metadata\verified_contents.json	WaveWindows.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4548_1755292965\manifest.fingerprint	WaveWindows.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4548_1755292965\_platform_specific\win_x86\widevinecdm.dll.sig	WaveWindows.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4548_1755292965\_platform_specific\win_x86\widevinecdm.dll	WaveWindows.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CefSharp.BrowserSubprocess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaveInstaller (6).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaveBootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaveWindows.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CefSharp.BrowserSubprocess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CefSharp.BrowserSubprocess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CefSharp.BrowserSubprocess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CefSharp.BrowserSubprocess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CefSharp.BrowserSubprocess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CefSharp.BrowserSubprocess.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-945322488-2060912225-3527527000-1000\{12FC3F45-BA07-4B36-91EC-3AF146AFAD24}	WaveWindows.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
5400	reg.exe
5432	reg.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
4112	msedge.exe
4112	msedge.exe
1392	identity_helper.exe
1392	identity_helper.exe
3808	msedge.exe
3808	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
4548	WaveWindows.exe
4548	WaveWindows.exe
4548	WaveWindows.exe
4892	CefSharp.BrowserSubprocess.exe
4892	CefSharp.BrowserSubprocess.exe
4872	CefSharp.BrowserSubprocess.exe
4872	CefSharp.BrowserSubprocess.exe
1680	CefSharp.BrowserSubprocess.exe
1680	CefSharp.BrowserSubprocess.exe
5100	CefSharp.BrowserSubprocess.exe
5100	CefSharp.BrowserSubprocess.exe
1764	CefSharp.BrowserSubprocess.exe
1764	CefSharp.BrowserSubprocess.exe
4548	WaveWindows.exe
4548	WaveWindows.exe
5740	CefSharp.BrowserSubprocess.exe
5740	CefSharp.BrowserSubprocess.exe
6096	CefSharp.BrowserSubprocess.exe
6096	CefSharp.BrowserSubprocess.exe
6096	CefSharp.BrowserSubprocess.exe
6096	CefSharp.BrowserSubprocess.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3836	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	3836	7zFM.exe
Token: 35	3836	7zFM.exe
Token: SeSecurityPrivilege	3836	7zFM.exe
Token: SeDebugPrivilege	2268	WaveInstaller (6).exe
Token: SeDebugPrivilege	3208	WaveBootstrapper.exe
Token: SeDebugPrivilege	4548	WaveWindows.exe
Token: SeShutdownPrivilege	4548	WaveWindows.exe
Token: SeCreatePagefilePrivilege	4548	WaveWindows.exe
Token: SeShutdownPrivilege	4548	WaveWindows.exe
Token: SeCreatePagefilePrivilege	4548	WaveWindows.exe
Token: 33	4420	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4420	AUDIODG.EXE
Token: 33	4548	WaveWindows.exe
Token: SeIncBasePriorityPrivilege	4548	WaveWindows.exe
Token: SeShutdownPrivilege	4548	WaveWindows.exe
Token: SeCreatePagefilePrivilege	4548	WaveWindows.exe
Token: SeDebugPrivilege	4892	CefSharp.BrowserSubprocess.exe
Token: SeShutdownPrivilege	4548	WaveWindows.exe
Token: SeCreatePagefilePrivilege	4548	WaveWindows.exe
Token: SeShutdownPrivilege	4548	WaveWindows.exe
Token: SeCreatePagefilePrivilege	4548	WaveWindows.exe
Token: SeDebugPrivilege	4872	CefSharp.BrowserSubprocess.exe
Token: SeDebugPrivilege	1680	CefSharp.BrowserSubprocess.exe
Token: SeDebugPrivilege	5100	CefSharp.BrowserSubprocess.exe
Token: SeShutdownPrivilege	4548	WaveWindows.exe
Token: SeCreatePagefilePrivilege	4548	WaveWindows.exe
Token: SeDebugPrivilege	1764	CefSharp.BrowserSubprocess.exe
Token: SeShutdownPrivilege	4548	WaveWindows.exe
Token: SeCreatePagefilePrivilege	4548	WaveWindows.exe
Token: SeShutdownPrivilege	4548	WaveWindows.exe
Token: SeCreatePagefilePrivilege	4548	WaveWindows.exe
Token: SeShutdownPrivilege	4548	WaveWindows.exe
Token: SeCreatePagefilePrivilege	4548	WaveWindows.exe
Token: SeShutdownPrivilege	4548	WaveWindows.exe
Token: SeCreatePagefilePrivilege	4548	WaveWindows.exe
Token: SeShutdownPrivilege	4548	WaveWindows.exe
Token: SeCreatePagefilePrivilege	4548	WaveWindows.exe
Token: SeShutdownPrivilege	4548	WaveWindows.exe
Token: SeCreatePagefilePrivilege	4548	WaveWindows.exe
Token: SeShutdownPrivilege	4548	WaveWindows.exe
Token: SeCreatePagefilePrivilege	4548	WaveWindows.exe
Token: SeShutdownPrivilege	4548	WaveWindows.exe
Token: SeCreatePagefilePrivilege	4548	WaveWindows.exe
Token: SeShutdownPrivilege	4548	WaveWindows.exe
Token: SeCreatePagefilePrivilege	4548	WaveWindows.exe
Token: SeShutdownPrivilege	4548	WaveWindows.exe
Token: SeCreatePagefilePrivilege	4548	WaveWindows.exe
Token: SeShutdownPrivilege	4548	WaveWindows.exe
Token: SeCreatePagefilePrivilege	4548	WaveWindows.exe
Token: SeShutdownPrivilege	4548	WaveWindows.exe
Token: SeCreatePagefilePrivilege	4548	WaveWindows.exe
Token: SeIncreaseQuotaPrivilege	5916	wmic.exe
Token: SeSecurityPrivilege	5916	wmic.exe
Token: SeTakeOwnershipPrivilege	5916	wmic.exe
Token: SeLoadDriverPrivilege	5916	wmic.exe
Token: SeSystemProfilePrivilege	5916	wmic.exe
Token: SeSystemtimePrivilege	5916	wmic.exe
Token: SeProfSingleProcessPrivilege	5916	wmic.exe
Token: SeIncBasePriorityPrivilege	5916	wmic.exe
Token: SeCreatePagefilePrivilege	5916	wmic.exe
Token: SeBackupPrivilege	5916	wmic.exe
Token: SeRestorePrivilege	5916	wmic.exe
Token: SeShutdownPrivilege	5916	wmic.exe
Token: SeDebugPrivilege	5916	wmic.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
3836	7zFM.exe
3836	7zFM.exe
3836	7zFM.exe
4548	WaveWindows.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3672	node.exe
2872	Bloxstrap.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 3856	4112	msedge.exe	83
PID 4112 wrote to memory of 3856	4112	msedge.exe	83
PID 4112 wrote to memory of 1580	4112	msedge.exe	85
PID 4112 wrote to memory of 1580	4112	msedge.exe	85
PID 4112 wrote to memory of 1580	4112	msedge.exe	85
PID 4112 wrote to memory of 1580	4112	msedge.exe	85
PID 4112 wrote to memory of 1580	4112	msedge.exe	85
PID 4112 wrote to memory of 1580	4112	msedge.exe	85
PID 4112 wrote to memory of 1580	4112	msedge.exe	85
PID 4112 wrote to memory of 1580	4112	msedge.exe	85
PID 4112 wrote to memory of 1580	4112	msedge.exe	85
PID 4112 wrote to memory of 1580	4112	msedge.exe	85
PID 4112 wrote to memory of 1580	4112	msedge.exe	85
PID 4112 wrote to memory of 1580	4112	msedge.exe	85
PID 4112 wrote to memory of 1580	4112	msedge.exe	85
PID 4112 wrote to memory of 1580	4112	msedge.exe	85
PID 4112 wrote to memory of 1580	4112	msedge.exe	85
PID 4112 wrote to memory of 1580	4112	msedge.exe	85
PID 4112 wrote to memory of 1580	4112	msedge.exe	85
PID 4112 wrote to memory of 1580	4112	msedge.exe	85
PID 4112 wrote to memory of 1580	4112	msedge.exe	85
PID 4112 wrote to memory of 1580	4112	msedge.exe	85
PID 4112 wrote to memory of 1580	4112	msedge.exe	85
PID 4112 wrote to memory of 1580	4112	msedge.exe	85
PID 4112 wrote to memory of 1580	4112	msedge.exe	85
PID 4112 wrote to memory of 1580	4112	msedge.exe	85
PID 4112 wrote to memory of 1580	4112	msedge.exe	85
PID 4112 wrote to memory of 1580	4112	msedge.exe	85
PID 4112 wrote to memory of 1580	4112	msedge.exe	85
PID 4112 wrote to memory of 1580	4112	msedge.exe	85
PID 4112 wrote to memory of 1580	4112	msedge.exe	85
PID 4112 wrote to memory of 1580	4112	msedge.exe	85
PID 4112 wrote to memory of 1580	4112	msedge.exe	85
PID 4112 wrote to memory of 1580	4112	msedge.exe	85
PID 4112 wrote to memory of 1580	4112	msedge.exe	85
PID 4112 wrote to memory of 1580	4112	msedge.exe	85
PID 4112 wrote to memory of 1580	4112	msedge.exe	85
PID 4112 wrote to memory of 1580	4112	msedge.exe	85
PID 4112 wrote to memory of 1580	4112	msedge.exe	85
PID 4112 wrote to memory of 1580	4112	msedge.exe	85
PID 4112 wrote to memory of 1580	4112	msedge.exe	85
PID 4112 wrote to memory of 1580	4112	msedge.exe	85
PID 4112 wrote to memory of 5036	4112	msedge.exe	86
PID 4112 wrote to memory of 5036	4112	msedge.exe	86
PID 4112 wrote to memory of 3460	4112	msedge.exe	87
PID 4112 wrote to memory of 3460	4112	msedge.exe	87
PID 4112 wrote to memory of 3460	4112	msedge.exe	87
PID 4112 wrote to memory of 3460	4112	msedge.exe	87
PID 4112 wrote to memory of 3460	4112	msedge.exe	87
PID 4112 wrote to memory of 3460	4112	msedge.exe	87
PID 4112 wrote to memory of 3460	4112	msedge.exe	87
PID 4112 wrote to memory of 3460	4112	msedge.exe	87
PID 4112 wrote to memory of 3460	4112	msedge.exe	87
PID 4112 wrote to memory of 3460	4112	msedge.exe	87
PID 4112 wrote to memory of 3460	4112	msedge.exe	87
PID 4112 wrote to memory of 3460	4112	msedge.exe	87
PID 4112 wrote to memory of 3460	4112	msedge.exe	87
PID 4112 wrote to memory of 3460	4112	msedge.exe	87
PID 4112 wrote to memory of 3460	4112	msedge.exe	87
PID 4112 wrote to memory of 3460	4112	msedge.exe	87
PID 4112 wrote to memory of 3460	4112	msedge.exe	87
PID 4112 wrote to memory of 3460	4112	msedge.exe	87
PID 4112 wrote to memory of 3460	4112	msedge.exe	87
PID 4112 wrote to memory of 3460	4112	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1d-AcYI1SvRj8B-iwa3CP7iaGyuSrBE28/view?usp=sharing
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffac07e46f8,0x7ffac07e4708,0x7ffac07e4718
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,144981966992252714,12253760446196206308,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,144981966992252714,12253760446196206308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2460 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,144981966992252714,12253760446196206308,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2952 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,144981966992252714,12253760446196206308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,144981966992252714,12253760446196206308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,144981966992252714,12253760446196206308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,144981966992252714,12253760446196206308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,144981966992252714,12253760446196206308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,144981966992252714,12253760446196206308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,144981966992252714,12253760446196206308,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,144981966992252714,12253760446196206308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,144981966992252714,12253760446196206308,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,144981966992252714,12253760446196206308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,144981966992252714,12253760446196206308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2024,144981966992252714,12253760446196206308,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4108 /prefetch:8
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,144981966992252714,12253760446196206308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2116 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2024,144981966992252714,12253760446196206308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6552 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,144981966992252714,12253760446196206308,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5516 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,144981966992252714,12253760446196206308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,144981966992252714,12253760446196206308,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,144981966992252714,12253760446196206308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:5704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:776

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3608

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Downloads.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3836

C:\Users\Admin\Downloads\WaveInstaller (6).exe
"C:\Users\Admin\Downloads\WaveInstaller (6).exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2268
- C:\Users\Admin\AppData\Local\Wave\WaveBootstrapper.exe
  "C:\Users\Admin\AppData\Local\Wave\WaveBootstrapper.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3208
- - C:\Users\Admin\AppData\Local\Wave\WaveWindows.exe
    "C:\Users\Admin\AppData\Local\Wave\WaveWindows.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks for any installed AV software in registry
    - Enumerates connected drives
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:4548
  - - C:\Users\Admin\AppData\Local\Luau Language Server\node.exe
      "C:\Users\Admin\AppData\Local\Luau Language Server\node.exe" server --process-id=4548
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3672
    - - C:\Users\Admin\AppData\Local\Luau Language Server\shared\bin\wave-luau.exe
        
        "C:\Users\Admin\AppData\Local\Luau Language Server\shared\bin\wave-luau.exe" lsp "--definitions=C:\Users\Admin\AppData\Local\Luau Language Server\shared\bin\globalTypes.d.luau" "--definitions=C:\Users\Admin\AppData\Local\Luau Language Server\shared\bin\wave.d.luau" "--docs=C:\Users\Admin\AppData\Local\Luau Language Server\shared\bin\en-us.json"
        5⤵
        Executes dropped EXE
        
        PID:2520
  - - C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe
      "C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2872
  - - C:\Users\Admin\AppData\Local\Wave\CefSharp.BrowserSubprocess.exe
      "C:\Users\Admin\AppData\Local\Wave\CefSharp.BrowserSubprocess.exe" --type=gpu-process --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=6728,i,13958229296050067034,14098931661380479426,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --enable-logging=handle --log-file=6736 --mojo-platform-channel-handle=6720 /prefetch:2 --host-process-id=4548
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Network Service Discovery
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4892
  - - C:\Users\Admin\AppData\Local\Wave\CefSharp.BrowserSubprocess.exe
      "C:\Users\Admin\AppData\Local\Wave\CefSharp.BrowserSubprocess.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --field-trial-handle=7096,i,13958229296050067034,14098931661380479426,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --enable-logging=handle --log-file=7100 --mojo-platform-channel-handle=7092 /prefetch:8 --host-process-id=4548
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Network Service Discovery
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1680
  - - C:\Users\Admin\AppData\Local\Wave\CefSharp.BrowserSubprocess.exe
      "C:\Users\Admin\AppData\Local\Wave\CefSharp.BrowserSubprocess.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --field-trial-handle=7568,i,13958229296050067034,14098931661380479426,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --enable-logging=handle --log-file=7572 --mojo-platform-channel-handle=7564 /prefetch:3 --host-process-id=4548
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Network Service Discovery
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4872
  - - C:\Users\Admin\AppData\Local\Wave\CefSharp.BrowserSubprocess.exe
      "C:\Users\Admin\AppData\Local\Wave\CefSharp.BrowserSubprocess.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --no-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=7596,i,13958229296050067034,14098931661380479426,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --enable-logging=handle --log-file=7612 --mojo-platform-channel-handle=7580 --host-process-id=4548 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Network Service Discovery
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1764
  - - C:\Users\Admin\AppData\Local\Wave\CefSharp.BrowserSubprocess.exe
      "C:\Users\Admin\AppData\Local\Wave\CefSharp.BrowserSubprocess.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --no-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=7624,i,13958229296050067034,14098931661380479426,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --enable-logging=handle --log-file=7632 --mojo-platform-channel-handle=7616 --host-process-id=4548 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Network Service Discovery
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5100
  - - C:\Users\Admin\AppData\Local\Wave\CefSharp.BrowserSubprocess.exe
      "C:\Users\Admin\AppData\Local\Wave\CefSharp.BrowserSubprocess.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --field-trial-handle=2764,i,13958229296050067034,14098931661380479426,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --enable-logging=handle --log-file=1508 --mojo-platform-channel-handle=2196 /prefetch:8 --host-process-id=4548
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Network Service Discovery
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5740
  - - C:\Users\Admin\AppData\Local\Wave\CefSharp.BrowserSubprocess.exe
      "C:\Users\Admin\AppData\Local\Wave\CefSharp.BrowserSubprocess.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5588,i,13958229296050067034,14098931661380479426,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --enable-logging=handle --log-file=5168 --mojo-platform-channel-handle=5584 /prefetch:8 --host-process-id=4548
      4⤵
      Executes dropped EXE
      Network Service Discovery
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:6096

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x304 0x2e8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4420

C:\Users\Admin\Downloads\wave_bypass (3).exe
"C:\Users\Admin\Downloads\wave_bypass (3).exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKCU\Console\%%Startup /v DelegationConsole /t REG_SZ /d {B23D10C0-E52E-411E-9D5B-C09FDF709C7D} /f > nul
  2⤵
  PID:5384
- - C:\Windows\system32\reg.exe
    reg add HKCU\Console\%%Startup /v DelegationConsole /t REG_SZ /d {B23D10C0-E52E-411E-9D5B-C09FDF709C7D} /f
    3⤵
    - Modifies registry key
    PID:5400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKCU\Console\%%Startup /v DelegationTerminal /t REG_SZ /d {B23D10C0-E52E-411E-9D5B-C09FDF709C7D} /f > nul
  2⤵
  PID:5416
- - C:\Windows\system32\reg.exe
    reg add HKCU\Console\%%Startup /v DelegationTerminal /t REG_SZ /d {B23D10C0-E52E-411E-9D5B-C09FDF709C7D} /f
    3⤵
    - Modifies registry key
    PID:5432
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:6052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mode con: cols=99 lines=33
  2⤵
  PID:6068
- - C:\Windows\system32\mode.com
    mode con: cols=99 lines=33
    3⤵
    PID:6084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color 09
  2⤵
  PID:6100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c title WAVE BYPASS
  2⤵
  PID:6116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4548_1755292965\manifest.json

Filesize
984B

MD5
0359d5b66d73a97ce5dc9f89ed84c458

SHA1
ce17e52eaac909dd63d16d93410de675d3e6ec0d

SHA256
beeab2f8d3833839399dde15ce9085c17b304445577d21333e883d6db6d0b755

SHA512
8fd94a098a4ab5c0fcd48c2cef2bb03328dd4d25c899bf5ed1ca561347d74a8aab8a214ba2d3180a86df72c52eb26987a44631d0ecd9edc84976c28d6c9dc16a

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.dll

Filesize
4.3MB

MD5
6546ceb273f079342df5e828a60f551b

SHA1
ede41c27df51c39cd731797c340fcb8feda51ea3

SHA256
e440da74de73212d80da3f27661fcb9436d03d9e8dbbb44c9c148aaf38071ca5

SHA512
f0ea83bf836e93ff7b58582329a05ba183a25c92705fab36f576ec0c20cf687ce16a68e483698bda4215d441dec5916ffbdfa1763fb357e14ab5e0f1ffcaf824

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe

Filesize
249KB

MD5
772c9fecbd0397f6cfb3d866cf3a5d7d

SHA1
6de3355d866d0627a756d0d4e29318e67650dacf

SHA256
2f88ea7e1183d320fb2b7483de2e860da13dc0c0caaf58f41a888528d78c809f

SHA512
82048bd6e50d38a863379a623b8cfda2d1553d8141923acf13f990c7245c833082523633eaa830362a12bfff300da61b3d8b3cccbe038ce2375fdfbd20dbca31

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.runtimeconfig.json

Filesize
372B

MD5
d94cf983fba9ab1bb8a6cb3ad4a48f50

SHA1
04855d8b7a76b7ec74633043ef9986d4500ca63c

SHA256
1eca0f0c70070aa83bb609e4b749b26dcb4409784326032726394722224a098a

SHA512
09a9667d4f4622817116c8bc27d3d481d5d160380a2e19b8944bdd1271a83f718415ce5e6d66e82e36819e575ec1b55f19c45213e0013b877b8d61e6feb9d998

Download Submit
C:\Users\Admin\AppData\Local\CEF\User Data\LocalPrefs.json

Filesize
738B

MD5
705ad8b664667348806c85aace579b40

SHA1
5e262610bc88f61eb0244e785b51795b2c627671

SHA256
fb3f2de0e62259c3af896ddd1bf86c02c37e936f2781cdfc941e69937fad15b8

SHA512
3a580a286c528dcb5e36a08eff1fca43136e49e65da44bc89481ff9dbfdd2062879ba5e369d278a33ee68b8e15c9836b67a1ae0c385d89b95f7c88767125300f

Download Submit
C:\Users\Admin\AppData\Local\CEF\User Data\LocalPrefs.json

Filesize
850B

MD5
75c1224441ff0cefa07dda584c845d7a

SHA1
05ddc15f315bec345a56aa5616840ed869b40430

SHA256
c5cfbb17f0ebbb858194ab2a71d50b9675e8f683f3d2d91b3e179a80b132051a

SHA512
a0c6e44f31b4cd8d456a9f79f1a27805c39e7e8c0a38d0d405945f32d4074a8bc3ba2968e4edd58871b0c135639db8de048b03985f188d93f0e8ee4e4598c1dc

Download Submit
C:\Users\Admin\AppData\Local\CEF\User Data\LocalPrefs.json~RFe5cd6a1.TMP

Filesize
529B

MD5
1ea7266c1158ea7e81381f8a1e9bf680

SHA1
30f6a44b1a86d736a033bccd68b11e279adccf68

SHA256
1c020df3bbf6ea5dcc79846d4650d95e2f0ae98da85d0351516b996d902167b3

SHA512
d9fad9db1474525e5e9671369d83e4635828601eea3b10fd0c7a29ef0b35f2c9e1b0efabb80e5342dc46c75578ae230c76457caa5fc2bc71c6bc8290d58c2d83

Download Submit
C:\Users\Admin\AppData\Local\Luau Language Server\server\index.js

Filesize
6.1MB

MD5
6b1cad741d0b6374435f7e1faa93b5e7

SHA1
7b1957e63c10f4422421245e4dc64074455fd62a

SHA256
6f17add2a8c8c2d9f592adb65d88e08558e25c15cedd82e3f013c8146b5d840f

SHA512
a662fc83536eff797b8d59e2fb4a2fb7cd903be8fc4137de8470b341312534326383bb3af58991628f15f93e3bdd57621622d9d9b634fb5e6e03d4aa06977253

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
41KB

MD5
9a25111c0e90867c7b8f41c5462abfaf

SHA1
0619625d479f31cf145c2e3714de0df4a69169d1

SHA256
41bb42020f1beabc9e72913ef6a33aa264556ec829ac70fd92c9c9adfb84803d

SHA512
0fbc3c64d6f5acc2c0dab67924b0c669fefa994f449240d1f6b78dcac3538343938a4fae972726156189f05806d3aae0e333035df52605ffe28886b82f31ccdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
624B

MD5
e60153efc3dc15076ea1729767754ae1

SHA1
ad9204d2bc7505e7f991c7ec9f781b37cf8b6929

SHA256
f23061626e35ca1031869e0b6b7f3e7ed91bf8c2f3bdae5a75defdad16db80f7

SHA512
f4f23e0ee02e9108e0a188071702fb195961811ab1abd27bd10875aa2febb84a689a462481b2473b07052ce001488bc43b0040af21cf646cd1c3faf4738e6b01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
5e8fb44da81d85ecf30939fd3de6e2e4

SHA1
a4dc8825e5d54a3f472b3ff01b0edaec6697e39a

SHA256
9ed906eb2213eafa4bcda2640bc15b646e0b3bfbc2e80d2af0bea443f8610076

SHA512
143b96d913c7d54ab351a6fbd13a57111d3450e915e16f669da90b961dd53dd92210790380e826b26f3551066e60df8b751ccfb6d24870726a225a17c8277ac9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
4c0547dbc78894ab43c747ab1f2bac8a

SHA1
46b816dec5531614289d0b575c32b52b38a4c4aa

SHA256
4300bfb3b9b28c5279474d31622e6442f40b3fc2a06021be9e2f6e5f990858ec

SHA512
d4fa327ef17adf39fe91bac034a85aea77550f606ebce3359907b1fd40983e08d21274b8368a92c23dbf659950120fd02e66a8b61ec28a5d4ae31880850f7e0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
9470b4c263347e69b120912ecbc737fd

SHA1
3f2a648c5b33a32112e8830e95894dd562a84526

SHA256
04f8d6733d846effb841820643de4b022ce7d39652a12dbb93b966d86d919ba9

SHA512
a65386516e1d466aafb1fad77471f24f0388d6f43b991afb5485e6d02f76c6efccb07c4e381b82483192d966b2a1486f7e23cb97e00eb5464e6364bd441cf865

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
d551dd10f5ddde6cacd93df79045c8a6

SHA1
f19fa0a8558f95172fa08b2751808769c0b195ee

SHA256
5fb43423f4bb36fa1a87826549faba17337f81c1b5204103e19d1584170f98e4

SHA512
268c6b556845b38df73689fe69d06867ffd10cead5a15f843e17a410732641d29233ba2a9328a0fe4b9540f35f84fcdc6ebc90e947c46c056d7341be3c3a66ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
2d5a55ead257d83168251230459bfbeb

SHA1
a03c677d15544d4981c9a3c2e36b9b4574d9a7e2

SHA256
bf1586de197dee6f38a4810738dcda994c04e694ead60627a7249369e74a5eba

SHA512
2610b7677a086167e57d289be713a704f4126064b96952a56b3e22d65e28e576319dfbd8e33ae97536aa28c6aadba0064614974bf5e90d4c48018d60e33f4061

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
61b313b634b93e429b475cea998f0776

SHA1
22f0fc128caaf055cd01ba6029a06eef84e78d79

SHA256
85f587974822190d8ddfd20d7bb3c9ff74b970db16e06294230d348b5997eed8

SHA512
44473dbcbdfbd5a9603b29269fbfe4427bc6005c51d3412a47760bc6e80ae0c316be2b2038f4d3e03ab428d347e815e296eeb480f3c974a1f0c351b9121fb96a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
6895eacd15d73b111eb1d974d4fbdf54

SHA1
a6f78f7e56356b65aa12dd3876631dc7dfcc5024

SHA256
4c9d4ba06f6f6d38a13cfbe9deab4997b65e5bfb32e70eb05d85d95c0a77e995

SHA512
8f245be23c16c1a92a202862dfa3cb9054de45f1f1933ded1eb602f1fc7209d402edea9af92829afbe75197d14c239b40b0e33e5c3e690e8234ffc4a9daec3f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
33ccce1d0b86cea296c6c22795dac015

SHA1
7564103885c577699e922103a9f93ea530c40059

SHA256
733c7ce3a12d0750a4e105c3f78eebebf61b63f5d2f140c51b6d907ad835c949

SHA512
3cc3606ff282c20e1a40ad22511ce58fc1aec39ecc6472e584026c6e017420384c8e4b1b054c3d0c3415f8b200f0e3e813661c72bfeb7fdc799b181320696a64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7f48cd23fdb7dc53893560c77d371429

SHA1
03ffdd59ab59134310bc597570d10015f2f46d9b

SHA256
43a7cbca91952bf24e228b412831a37aa0cfe9e332553a07afff908e4bc53bac

SHA512
f1c7fd475f76ae0ce05d47e083671d87dff9915cc008008c77075ba0750c7a3b592c14ccd996c543014c31b73a83f438ed2eb8edfb9ea856a8dccb635768408d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
28364ee5d6a6074985b682b333e04ba6

SHA1
d3f4e9501288494b2df3f7439d5abe32629f74b6

SHA256
3e45b657fc8b3f06fe4d0b4ee99f0573f1680dd3fda1ca6096046bab6b953bdf

SHA512
7b9c57b09655b43426b719411376c7473d7ed6fc46d083f118da408c5db83ca84292e18a9fe880ba078879fdddeba52d789ae93bb321b342517b65ec5e68d085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8c14c4b5a080365aa51f170eb3066905

SHA1
b2bfb89aa3c083b531316fca0e7ce7a292feec46

SHA256
85bfe5341850ae8720ab39a64dc5c2288ad9f723e25823beaf29902da59eae5e

SHA512
065f4aa08351a4b1e1870ac77add7b6d9827c0ad76ce8e0cd643b45fd960f8cbaf6651af6a8068d67159fae105177787716bd52713290923741ac81d8870ee03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8c6daba688ec462c0a4227cb176a613e

SHA1
df41d61466c706c47c01c097979df26134409526

SHA256
8416b937439b95800802ced84a217be1b7257cbc9a24b0a2949642157db81258

SHA512
68d89b41fc2df686ea819cecabc30d222efc79ad8710213c9ca24ab74dc2b34307f3ced19f152ecd2adbd489ccbd830461b420cc521731e9386a921663deb9d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9514846cc2063794aeffcf37ac32f258

SHA1
5574978f1ac1275b91c1644a04be8c76eb5d2b9d

SHA256
e41226e270c240b7c6224a2ab0adab1ff796f7ae0a0c320d643bc5981cf54216

SHA512
4a8508c10fa715e062c83e5bb834fe275f151c0e613f87824ae093aed595df2da66837a59e215b0d72c45bc4a30f117447a6df3aaba2fae2cbcb884c8dc6b718

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59355e.TMP

Filesize
1KB

MD5
8c74a35a48b8bd0e5d3d001ca91c3aed

SHA1
6aec08e71ef330e3dc4d88f0eb670d6800b6653e

SHA256
4df2e1ed633db8cad705161525b1553142facf9afe55590b4e72f36aaad439c1

SHA512
abaf000f8f4e59fc461afb4dbccbe8b90d3b8e6f9c2f0b7b726fd625f194d5b36cad406e273ba58b8643e729152590e84101ab9cf1667902b07bad4ad6c15c90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2c30dc9f940012c397d6cd5653441bea

SHA1
4f353e4ef882cd63716d8153b140081c1449561b

SHA256
0f8c8f79f175c8806d04a144e383ce68d01e33845993b8eea882c7194f01ea92

SHA512
be66fb742b93570d15e091a19bd59422057bd05573391ad84b37fb5a5d29296c85f2c5c025d7c73535a8b2177bb241c5a008a6f1db03eb0845fee9c06b56364c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
7e64a55c96155ea628610ea706c9e53b

SHA1
2338a60f932ea1f54ce510d2de65045dbaf1e675

SHA256
6f7ff79a313a281ba4f9b5cc2bef1972f91468daf6d285acff7521927220ba25

SHA512
fddb10435c74bb7fb1b14a0f7583bd7641ba9eaa44879fba885b6f9e23872f8dc03048335dc57642e740fbb4b81d9c2d1874e8ddc1f352afa07767f83cdafd1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
896KB

MD5
12d21fd472ca3cbcb10dd4130eb8feca

SHA1
d8efe08937dfb2546699f85bd3e0f82db9baa346

SHA256
9cf83b72247a19dea1f0dbc4de7bcd494edca5868c8647e9603579ecb7d48340

SHA512
131ae1a7de9a2a67f92aca1d11029c4fd8a039bd60e632c3c10a6a246131a847662176c11ae218951b34953b770f841c3291f6cb0ade6cb5f3b466b8189a72de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\31840d98.dll

Filesize
10KB

MD5
d0b0669374e69be483c04e0bc7c18caf

SHA1
33dd016fe5ba76ae45c1444a6defa1f5afbd0556

SHA256
c9e3daa7fe44f7599826c93286956b10c452ae5344264b2c751efbd5698f32f5

SHA512
13695a52101da7858acbf2bc26e8d711105e0bcc83f9f8787622a134427ace971f93cae4801b2c7e875b5272795b987cdc9bde06e4b59822dda9e8febab6c529

Download Submit
C:\Users\Admin\AppData\Local\Wave\CefSharp.BrowserSubprocess.Core.dll

Filesize
915KB

MD5
100c32f77e68a2ce962e1a28997567ea

SHA1
a80a1f4019b8d44df6b5833fb0c51b929fa79843

SHA256
c0b9e29b240d8328f2f9a29ca0298ca4d967a926f3174a3442c3730c00d5a926

SHA512
f95530ef439fa5c4e3bc02db249b6a76e9d56849816ead83c9cd9bcd49d3443ccb88651d829165c98a67af40b3ef02b922971114f29c5c735e662ca35c0fb6ed

Download Submit
C:\Users\Admin\AppData\Local\Wave\CefSharp.BrowserSubprocess.exe

Filesize
7KB

MD5
516ff62b2e1f4642caa954c0968719e8

SHA1
e349d0ce82e2109dd0d18416d9cf46e8411b7f15

SHA256
19da58849cec5933860116e60a1e94b08e30d90e0f955768270b47998d612045

SHA512
7aa4a0c87b29c2a84f585a884d8208fc2352a43f2cdb549c100e3b121837ad5f8dadb1101f57d1d3fcb7ebec9d9f22e07dc14239b7d2e2d25793c999becf288b

Download Submit
C:\Users\Admin\AppData\Local\Wave\CefSharp.Core.Runtime.dll

Filesize
1.3MB

MD5
09cba584aa0aae9fc600745567393ef6

SHA1
bbd1f93cb0db9cf9e01071b3bed1b4afd6e31279

SHA256
0babd84d4e7dc2713e7265d5ac25a3c28d412e705870cded6f5c7c550a5bf8d5

SHA512
5f914fa33a63a6d4b46f39c7279687f313728fd5f8437ec592369a2da3256ccff6f325f78ace0e6d3a2c37da1f681058556f7603da13c45b03f2808f779d2aa1

Download Submit
C:\Users\Admin\AppData\Local\Wave\CefSharp.Core.dll

Filesize
898KB

MD5
1bb24b22d9bd996c038d26b600ed18a8

SHA1
c2629a8a26c9c0969501923f84874838087cca2b

SHA256
944b987a0b677d354e24ee15bba65f73b0f051338f576234a975a49493399873

SHA512
38578e0d1a39ccc9851ff80d3a0f5342a34303229e2898c3ca32dad11017d4277720f54b472c2f1a0b73f47d5ba6352aa7be8ae2ed72b3b25a01dd8292591421

Download Submit
C:\Users\Admin\AppData\Local\Wave\CefSharp.Wpf.dll

Filesize
114KB

MD5
ceaf0bad83fac8ce71853cd820e4ed9d

SHA1
4eed686fbba7d4603b596fb8e494b8f452a05886

SHA256
eaced1f76adb8ee756033baee29a47b1f4d4b657ebd105a7e25c8dc4fbc48cba

SHA512
4ed3f83e797eade8f0d1c6b80ce49d18f00daaf5d69421a4920e3cea2e7d78c3622193ca65b6ab1dab14c57e7f893a7b1edb27b83f343ea4df731d80aa21ff82

Download Submit
C:\Users\Admin\AppData\Local\Wave\CefSharp.dll

Filesize
272KB

MD5
9ca06a8f9e5f7239ca225ab810274023

SHA1
e1a219f567a7b7d3af9386df51b14c76e769c044

SHA256
5fd00ae3e83e6ca156647ff6df87b49ffc7cad47c23fe3ae07c067c5adf6f74a

SHA512
430c9bceed5439b987d5bd4840cfe32411ca61594f18597aca1948aa39a22c9d70beadf3bb9b1dd0373f81a94a25dcba17fa8e8c73abf06cba28d0971d5614c5

Download Submit
C:\Users\Admin\AppData\Local\Wave\D3DCOMPILER_47.dll

Filesize
3.9MB

MD5
3b4647bcb9feb591c2c05d1a606ed988

SHA1
b42c59f96fb069fd49009dfd94550a7764e6c97c

SHA256
35773c397036b368c1e75d4e0d62c36d98139ebe74e42c1ff7be71c6b5a19fd7

SHA512
00cd443b36f53985212ac43b44f56c18bf70e25119bbf9c59d05e2358ff45254b957f1ec63fc70fb57b1726fd8f76ccfad8103c67454b817a4f183f9122e3f50

Download Submit
C:\Users\Admin\AppData\Local\Wave\WaveBootstrapper.exe

Filesize
949KB

MD5
8fb51b92d496c6765f7ba44e6d4a8990

SHA1
d3e5a8465622cd5adae05babeb7e34b2b5c777d7

SHA256
ab49d6166a285b747e5f279620ab9cea12f33f7656d732aa75900fcb981a5394

SHA512
20de93a52fff7b092cb9d77bd26944abed5f5cb67146e6d2d70be6a431283b6de52eb37a0e13dc8bc57dcf8be2d5a95b9c11b3b030a3e2f03dd6e4efc23527a6

Download Submit
C:\Users\Admin\AppData\Local\Wave\WaveWindows.exe

Filesize
8.0MB

MD5
b8631bbd78d3935042e47b672c19ccc3

SHA1
cd0ea137f1544a31d2a62aaed157486dce3ecebe

SHA256
9cfda541d595dc20a55df5422001dfb58debd401df3abff21b1eee8ede28451c

SHA512
0c51d6247e39f7851538a5916b24972e845abfe429f0abdc7b532f654b4afe73dc6e1936f1b062da63bfc90273d3cbc297bf6c802e615f3711d0f180c070aa26

Download Submit
C:\Users\Admin\AppData\Local\Wave\bin\Background.mp4

Filesize
4.6MB

MD5
9782180eb68f73030fe24ef6a1735932

SHA1
589827fe098ba048c9f871a28db8eae3e3537ff4

SHA256
3a1cbb800f8f25c2ab703ba8bfdb01e938e4143c3bc0fea8ca734fb5ba779ba7

SHA512
dc768638bae2d6d47d8910252ae64a656d8a6fd88efdf24165ddce51b7afdb4acb3fddd41dfe788737a2cab4fab66174db2f0d2f48bc8669af76d1656bca8be1

Download Submit
C:\Users\Admin\AppData\Local\Wave\chrome_100_percent.pak

Filesize
667KB

MD5
ae195e80859781a20414cf5faa52db06

SHA1
b18ecb5ec141415e3a210880e2b3d37470636485

SHA256
9957802c0792e621f76bbdb1c630fbad519922743b5d193294804164babda552

SHA512
c6fef84615fe20d1760ca496c98629feb4e533556724e9631d4282622748e7601225cf19dfb8351f4b540ae3f83785c1bcea6fe8c246cf70388e527654097c1c

Download Submit
C:\Users\Admin\AppData\Local\Wave\chrome_200_percent.pak

Filesize
1.0MB

MD5
1abf6bad0c39d59e541f04162e744224

SHA1
db93c38253338a0b85e431bd4194d9e7bddb22c6

SHA256
01cb663a75f18bb2d0d800640a114f153a34bd8a5f2aa0ed7daa9b32967dc29e

SHA512
945d519221d626421094316f13b818766826b3bedddab0165c041540dddadc93136e32784c0562d26a420cb29479d04d2aa317b8d605cd242e5152bf05af197e

Download Submit
C:\Users\Admin\AppData\Local\Wave\chrome_elf.dll

Filesize
1020KB

MD5
7191d97ce7886a1a93a013e90868db96

SHA1
52dd736cb589dd1def87130893d6b9449a6a36e3

SHA256
32f925f833aa59e3f05322549fc3c326ac6fc604358f4efbf94c59d5c08b8dc6

SHA512
38ebb62c34d466935eabb157197c7c364d4345f22aa3b2641b636196ca1aeaa2152ac75d613ff90817cb94825189612ddd12fb96df29469511a46a7d9620e724

Download Submit
C:\Users\Admin\AppData\Local\Wave\icudtl.dat

Filesize
10.2MB

MD5
74bded81ce10a426df54da39cfa132ff

SHA1
eb26bcc7d24be42bd8cfbded53bd62d605989bbf

SHA256
7bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9

SHA512
bd7b7b52d31803b2d4b1fd8cb76481931ed8abb98d779b893d3965231177bdd33386461e1a820b384712013904da094e3cd15ee24a679ddc766132677a8be54a

Download Submit
C:\Users\Admin\AppData\Local\Wave\locales\en-US.pak

Filesize
456KB

MD5
4430b1833d56bc8eb1f7dc82bb7f4bc9

SHA1
dc15e6306625f155683326e859d83f846153c547

SHA256
b44ddcfac9df4934007e6c55a3c7f5e7f14c7e5e29f35c81de917fc3b22aabbc

SHA512
faf93bf371b2a88c1b874a5e2c54e4487fd152ad19c2a406a46f55ae75ecd421a779888c2e4c170857b16bfb5d8744bc1815a4732ed50b064b3cbd0c5ffad889

Download Submit
C:\Users\Admin\AppData\Local\Wave\resources.pak

Filesize
8.0MB

MD5
4933d92c99afa246fc59eef010d5c858

SHA1
98d443654e93c73dd317f9f847f71fba3d5b3135

SHA256
62f4674daa15245ee081920b8ee191e72f36ca8fe24f6b986a832f45676915b2

SHA512
a3a69523c8e7310716daeebc06c2ba4fce673eccd1958e824ff179b82f4502d0ec095190179bbb387342e4150f952ea7533182fb6ba90377d17dafba8f4da623

Download Submit
C:\Users\Admin\Downloads\Downloads.zip

Filesize
27.3MB

MD5
6b5720550c71bc12f51bf787f0d44644

SHA1
f8729ea9e25579453ac5bbef03a395104d4b88cc

SHA256
23a106e5e6e12f1b1509cf9ea840a447c266ad930758f0bde1350e41f3abe10b

SHA512
135cb4e736751e7af2cf0e3a3f6d0e73d9046a9680ec87a0d03a2e6fc8d366767f2d3a04bbfd565c20f0b0d501455eb6b98ec1829c94c1b7e65d06f489ebf6f4

Download Submit
C:\Users\Admin\Downloads\WaveInstaller (6).exe

Filesize
2.3MB

MD5
8ad8b6593c91d7960dad476d6d4af34f

SHA1
0a95f110c8264cde7768a3fd76db5687fda830ea

SHA256
43e6ae7e38488e95741b1cad60843e7ce49419889285433eb4e697c175a153ab

SHA512
09b522da0958f8b173e97b31b6c7141cb67de5d30db9ff71bc6e61ca9a97c09bff6b17d6eaa03c840500996aad25b3419391af64de1c59e98ff6a8eac636b686

Download Submit
memory/2268-323-0x0000000001250000-0x000000000125A000-memory.dmp

Filesize
40KB

Download
memory/2268-318-0x000000000B520000-0x000000000B5B6000-memory.dmp

Filesize
600KB

Download
memory/2268-294-0x00000000008F0000-0x0000000000B3A000-memory.dmp

Filesize
2.3MB

Download
memory/2268-295-0x0000000005610000-0x00000000056C2000-memory.dmp

Filesize
712KB

Download
memory/2268-296-0x00000000056C0000-0x0000000005742000-memory.dmp

Filesize
520KB

Download
memory/2268-297-0x00000000055B0000-0x00000000055B8000-memory.dmp

Filesize
32KB

Download
memory/2268-298-0x00000000055C0000-0x00000000055C8000-memory.dmp

Filesize
32KB

Download
memory/2268-299-0x000000000A210000-0x000000000A248000-memory.dmp

Filesize
224KB

Download
memory/2268-300-0x000000000A1E0000-0x000000000A1EE000-memory.dmp

Filesize
56KB

Download
memory/2268-324-0x0000000001260000-0x000000000126A000-memory.dmp

Filesize
40KB

Download
memory/2268-319-0x0000000001200000-0x0000000001226000-memory.dmp

Filesize
152KB

Download
memory/2268-320-0x0000000001230000-0x0000000001238000-memory.dmp

Filesize
32KB

Download
memory/2268-322-0x000000000BD00000-0x000000000BD72000-memory.dmp

Filesize
456KB

Download
memory/3208-552-0x0000000009E30000-0x0000000009E4E000-memory.dmp

Filesize
120KB

Download
memory/3208-538-0x00000000008A0000-0x0000000000992000-memory.dmp

Filesize
968KB

Download
memory/3208-549-0x0000000009020000-0x0000000009124000-memory.dmp

Filesize
1.0MB

Download
memory/3208-550-0x0000000009D50000-0x0000000009D66000-memory.dmp

Filesize
88KB

Download
memory/3208-551-0x0000000009D90000-0x0000000009D9A000-memory.dmp

Filesize
40KB

Download
memory/4548-613-0x000000000AB60000-0x000000000AB70000-memory.dmp

Filesize
64KB

Download
memory/4548-612-0x00000000116A0000-0x00000000116B0000-memory.dmp

Filesize
64KB

Download
memory/4548-619-0x000000000AB60000-0x000000000AB70000-memory.dmp

Filesize
64KB

Download
memory/4548-618-0x000000000AB60000-0x000000000AB70000-memory.dmp

Filesize
64KB

Download
memory/4548-617-0x00000000116A0000-0x00000000116B0000-memory.dmp

Filesize
64KB

Download
memory/4548-616-0x00000000116A0000-0x00000000116B0000-memory.dmp

Filesize
64KB

Download
memory/4548-615-0x000000000E480000-0x000000000E490000-memory.dmp

Filesize
64KB

Download
memory/4548-620-0x00000000116A0000-0x00000000116B0000-memory.dmp

Filesize
64KB

Download
memory/4548-621-0x00000000116A0000-0x00000000116B0000-memory.dmp

Filesize
64KB

Download
memory/4548-571-0x000000000BB10000-0x000000000BE64000-memory.dmp

Filesize
3.3MB

Download
memory/4548-570-0x000000000B5A0000-0x000000000B5C2000-memory.dmp

Filesize
136KB

Download
memory/4548-564-0x000000000A0D0000-0x000000000A182000-memory.dmp

Filesize
712KB

Download
memory/4548-559-0x00000000058C0000-0x0000000005960000-memory.dmp

Filesize
640KB

Download
memory/4548-587-0x000000000B4D0000-0x000000000B50E000-memory.dmp

Filesize
248KB

Download
memory/4548-588-0x000000000D6F0000-0x000000000D756000-memory.dmp

Filesize
408KB

Download
memory/4548-558-0x00000000006A0000-0x0000000000EA2000-memory.dmp

Filesize
8.0MB

Download
memory/4548-614-0x000000000AB60000-0x000000000AB70000-memory.dmp

Filesize
64KB

Download
memory/4548-605-0x000000000AB60000-0x000000000AB70000-memory.dmp

Filesize
64KB

Download
memory/4548-611-0x00000000116A0000-0x00000000116B0000-memory.dmp

Filesize
64KB

Download
memory/4548-610-0x0000000011D00000-0x0000000011E86000-memory.dmp

Filesize
1.5MB

Download
memory/4548-609-0x000000000E480000-0x000000000E490000-memory.dmp

Filesize
64KB

Download
memory/4548-637-0x0000000012950000-0x0000000012AAB000-memory.dmp

Filesize
1.4MB

Download
memory/4548-633-0x0000000014E70000-0x0000000014F56000-memory.dmp

Filesize
920KB

Download
memory/4548-603-0x000000000AB60000-0x000000000AB70000-memory.dmp

Filesize
64KB

Download
memory/4548-629-0x000000000E1A0000-0x000000000E1EA000-memory.dmp

Filesize
296KB

Download
memory/4548-604-0x000000000AB60000-0x000000000AB70000-memory.dmp

Filesize
64KB

Download
memory/4548-625-0x000000000E170000-0x000000000E194000-memory.dmp

Filesize
144KB

Download
memory/4548-601-0x000000000AB60000-0x000000000AB70000-memory.dmp

Filesize
64KB

Download
memory/4548-589-0x000000000DC30000-0x000000000DC38000-memory.dmp

Filesize
32KB

Download
memory/4548-586-0x000000000DC40000-0x000000000E16C000-memory.dmp

Filesize
5.2MB

Download
memory/4548-585-0x000000000AE30000-0x000000000AE68000-memory.dmp

Filesize
224KB

Download
memory/4548-602-0x000000000AB60000-0x000000000AB70000-memory.dmp

Filesize
64KB

Download
memory/4548-608-0x000000000AB60000-0x000000000AB70000-memory.dmp

Filesize
64KB

Download
memory/4548-607-0x000000000AB60000-0x000000000AB70000-memory.dmp

Filesize
64KB

Download
memory/4548-606-0x000000000AB60000-0x000000000AB70000-memory.dmp

Filesize
64KB

Download
memory/4892-674-0x0000000005190000-0x000000000527A000-memory.dmp

Filesize
936KB

Download
memory/4892-670-0x00000000009B0000-0x00000000009B8000-memory.dmp

Filesize
32KB

Download
memory/5192-751-0x0000000003210000-0x000000000323D000-memory.dmp

Filesize
180KB

Download
memory/5192-735-0x00000000031C0000-0x00000000031D6000-memory.dmp

Filesize
88KB

Download
memory/5192-844-0x0000000140000000-0x0000000144B43000-memory.dmp

Filesize
75.3MB

Download
memory/5192-702-0x0000000140000000-0x0000000144B43000-memory.dmp

Filesize
75.3MB

Download
memory/5192-742-0x0000000000E90000-0x0000000000E99000-memory.dmp

Filesize
36KB

Download
memory/5192-721-0x0000000000E70000-0x0000000000E81000-memory.dmp

Filesize
68KB

Download
memory/5192-748-0x0000000003210000-0x000000000323D000-memory.dmp

Filesize
180KB

Download
memory/5192-728-0x0000000000E60000-0x0000000000E68000-memory.dmp

Filesize
32KB

Download
memory/5192-734-0x00000000031C0000-0x00000000031D6000-memory.dmp

Filesize
88KB

Download
memory/5192-727-0x0000000000E60000-0x0000000000E68000-memory.dmp

Filesize
32KB

Download
memory/5192-741-0x0000000000E90000-0x0000000000E99000-memory.dmp

Filesize
36KB

Download
memory/5192-701-0x0000000140000000-0x0000000144B43000-memory.dmp

Filesize
75.3MB

Download
memory/5192-703-0x0000000140000000-0x0000000144B43000-memory.dmp

Filesize
75.3MB

Download
memory/5192-700-0x0000000140000000-0x0000000144B43000-memory.dmp

Filesize
75.3MB

Download
memory/5192-704-0x0000000180000000-0x00000001806A7000-memory.dmp

Filesize
6.7MB

Download
memory/5192-707-0x0000000180000000-0x00000001806A7000-memory.dmp

Filesize
6.7MB

Download
memory/5192-689-0x0000000140000000-0x0000000144B43000-memory.dmp

Filesize
75.3MB

Download
memory/5192-718-0x0000000000E70000-0x0000000000E81000-memory.dmp

Filesize
68KB

Download