hxxps://github[.]com/Hazuki-san/OsuBuddy-reversed

Analysis

max time kernel
46s
max time network
30s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
09-08-2024 00:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Hazuki-san/OsuBuddy-reversed

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OsuBuddy.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\OsuBuddy-Debug.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
1476	msedge.exe
1476	msedge.exe
1624	msedge.exe
1624	msedge.exe
4428	identity_helper.exe
4428	identity_helper.exe
1812	msedge.exe
1812	msedge.exe
1536	msedge.exe
1536	msedge.exe
4536	OsuBuddy.exe
4536	OsuBuddy.exe
4536	OsuBuddy.exe
4536	OsuBuddy.exe
4536	OsuBuddy.exe
4536	OsuBuddy.exe
4536	OsuBuddy.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4536	OsuBuddy.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 796	1624	msedge.exe	78
PID 1624 wrote to memory of 796	1624	msedge.exe	78
PID 1624 wrote to memory of 5020	1624	msedge.exe	79
PID 1624 wrote to memory of 5020	1624	msedge.exe	79
PID 1624 wrote to memory of 5020	1624	msedge.exe	79
PID 1624 wrote to memory of 5020	1624	msedge.exe	79
PID 1624 wrote to memory of 5020	1624	msedge.exe	79
PID 1624 wrote to memory of 5020	1624	msedge.exe	79
PID 1624 wrote to memory of 5020	1624	msedge.exe	79
PID 1624 wrote to memory of 5020	1624	msedge.exe	79
PID 1624 wrote to memory of 5020	1624	msedge.exe	79
PID 1624 wrote to memory of 5020	1624	msedge.exe	79
PID 1624 wrote to memory of 5020	1624	msedge.exe	79
PID 1624 wrote to memory of 5020	1624	msedge.exe	79
PID 1624 wrote to memory of 5020	1624	msedge.exe	79
PID 1624 wrote to memory of 5020	1624	msedge.exe	79
PID 1624 wrote to memory of 5020	1624	msedge.exe	79
PID 1624 wrote to memory of 5020	1624	msedge.exe	79
PID 1624 wrote to memory of 5020	1624	msedge.exe	79
PID 1624 wrote to memory of 5020	1624	msedge.exe	79
PID 1624 wrote to memory of 5020	1624	msedge.exe	79
PID 1624 wrote to memory of 5020	1624	msedge.exe	79
PID 1624 wrote to memory of 5020	1624	msedge.exe	79
PID 1624 wrote to memory of 5020	1624	msedge.exe	79
PID 1624 wrote to memory of 5020	1624	msedge.exe	79
PID 1624 wrote to memory of 5020	1624	msedge.exe	79
PID 1624 wrote to memory of 5020	1624	msedge.exe	79
PID 1624 wrote to memory of 5020	1624	msedge.exe	79
PID 1624 wrote to memory of 5020	1624	msedge.exe	79
PID 1624 wrote to memory of 5020	1624	msedge.exe	79
PID 1624 wrote to memory of 5020	1624	msedge.exe	79
PID 1624 wrote to memory of 5020	1624	msedge.exe	79
PID 1624 wrote to memory of 5020	1624	msedge.exe	79
PID 1624 wrote to memory of 5020	1624	msedge.exe	79
PID 1624 wrote to memory of 5020	1624	msedge.exe	79
PID 1624 wrote to memory of 5020	1624	msedge.exe	79
PID 1624 wrote to memory of 5020	1624	msedge.exe	79
PID 1624 wrote to memory of 5020	1624	msedge.exe	79
PID 1624 wrote to memory of 5020	1624	msedge.exe	79
PID 1624 wrote to memory of 5020	1624	msedge.exe	79
PID 1624 wrote to memory of 5020	1624	msedge.exe	79
PID 1624 wrote to memory of 5020	1624	msedge.exe	79
PID 1624 wrote to memory of 1476	1624	msedge.exe	80
PID 1624 wrote to memory of 1476	1624	msedge.exe	80
PID 1624 wrote to memory of 2616	1624	msedge.exe	81
PID 1624 wrote to memory of 2616	1624	msedge.exe	81
PID 1624 wrote to memory of 2616	1624	msedge.exe	81
PID 1624 wrote to memory of 2616	1624	msedge.exe	81
PID 1624 wrote to memory of 2616	1624	msedge.exe	81
PID 1624 wrote to memory of 2616	1624	msedge.exe	81
PID 1624 wrote to memory of 2616	1624	msedge.exe	81
PID 1624 wrote to memory of 2616	1624	msedge.exe	81
PID 1624 wrote to memory of 2616	1624	msedge.exe	81
PID 1624 wrote to memory of 2616	1624	msedge.exe	81
PID 1624 wrote to memory of 2616	1624	msedge.exe	81
PID 1624 wrote to memory of 2616	1624	msedge.exe	81
PID 1624 wrote to memory of 2616	1624	msedge.exe	81
PID 1624 wrote to memory of 2616	1624	msedge.exe	81
PID 1624 wrote to memory of 2616	1624	msedge.exe	81
PID 1624 wrote to memory of 2616	1624	msedge.exe	81
PID 1624 wrote to memory of 2616	1624	msedge.exe	81
PID 1624 wrote to memory of 2616	1624	msedge.exe	81
PID 1624 wrote to memory of 2616	1624	msedge.exe	81
PID 1624 wrote to memory of 2616	1624	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Hazuki-san/OsuBuddy-reversed
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb8fa23cb8,0x7ffb8fa23cc8,0x7ffb8fa23cd8
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,18283381011319278912,14393989569337377321,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,18283381011319278912,14393989569337377321,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,18283381011319278912,14393989569337377321,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18283381011319278912,14393989569337377321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18283381011319278912,14393989569337377321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,18283381011319278912,14393989569337377321,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2072,18283381011319278912,14393989569337377321,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4600 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18283381011319278912,14393989569337377321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18283381011319278912,14393989569337377321,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18283381011319278912,14393989569337377321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,18283381011319278912,14393989569337377321,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18283381011319278912,14393989569337377321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18283381011319278912,14393989569337377321,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:2584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4184

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4772

C:\Users\Admin\Downloads\OsuBuddy-Debug\OsuBuddy.exe
"C:\Users\Admin\Downloads\OsuBuddy-Debug\OsuBuddy.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e2612636cf368bc811fdc8db09e037d

SHA1
d69e34379f97e35083f4c4ea1249e6f1a5f51d56

SHA256
2eecaacf3f2582e202689a16b0ac1715c628d32f54261671cf67ba6abbf6c9f9

SHA512
b3cc3bf967d014f522e6811448c4792eed730e72547f83eb4974e832e958deb7e7f4c3ce8e0ed6f9c110525d0b12f7fe7ab80a914c2fe492e1f2d321ef47f96d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e8115549491cca16e7bfdfec9db7f89a

SHA1
d1eb5c8263cbe146cd88953bb9886c3aeb262742

SHA256
dfa9a8b54936607a5250bec0ed3e2a24f96f4929ca550115a91d0d5d68e4d08e

SHA512
851207c15de3531bd230baf02a8a96550b81649ccbdd44ad74875d97a700271ef96e8be6e1c95b2a0119561aee24729cb55c29eb0b3455473688ef9132ed7f54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
e637d650e1d482da395936928593b71c

SHA1
4c19d1e90b9bb3d9962b97c087e0efb270b242d0

SHA256
866b3ed98344904feea048ea72892ed1af97a8e2253117d4597c93c6c90ccbe7

SHA512
553662d70ca1990aa05c5de60bc3327a3a18d645cced82472fc6a64d2a7481625962c29e3e818050e7b694e9e8bbdbab17bbe8f5aa8378884a1e7cc5c9919030

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
1b92794633aaa7d8ca83e408ef516a36

SHA1
4ae0678d6cf8abedb3e9819fc9d7d715d3f72bb6

SHA256
0ff76dc871bd6e59abe386781ef988b4c8d734bca726a4d1eb556d3d78f1e7e0

SHA512
698bb4adf1932dd48fbffb344b0053b9dc753b97a92d88a26341e0c3b0fa2e03481c5193bd2b4a1caaa2aa2f00e41eae73c53aaadc1ac6bb8be17d0f229a61bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3762710d38d19b3c8deb0776a262f350

SHA1
fcf0e30a40e63ff84db8af1be339ef3f77217cac

SHA256
5a6d4ce84a5f62e853a42dae5a2d2a0a57f18ad9821813385f75cf453a55658b

SHA512
749530e312599c2c48393055bd0e4a96425fc30fced7a1ae986679f8a035e508bd680ca9f642e414a4abd63476a0874b35fc3370ba0593896999030751197a25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7142187cce785452c94c5eb265b8ddbd

SHA1
bbe44b4a2927f110b42e5e7181c12ddcc01e2d51

SHA256
ce68b7674d73690a207ab38d2bff4848709806cc47c559a64ca7d2c3e3787593

SHA512
95fb7306214f7f317385dcbfbe2cd7f2876bc79f288c44217702907ead133542e6f7ae0c1f205152f4515a89481230b70339d4da2c4b42cd9006c56df065df5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a35233c15ab9e157c3ea54c8284ceeca

SHA1
927216a46dd43a523c5f9e7b6b91eed787e8c970

SHA256
b2809e45da3b355375451efeff4fa3a3cd7b6044823fe29acd66f828cea0918f

SHA512
285457d7fa544bbd437d52e6fe1e4a4291bb4f405df78ee35c4e3dad1d76d73a07b26d1b897d690632e918fd9756e35964704157cad945e199c671036f2e4aff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
2d3d5293b78f569cd87d4629ee85b135

SHA1
6348f67a2381a77e12fbc71280b7d83493f8ae33

SHA256
95cd9441ad24952d5db29f1661e15409db07ece7a32a179c4e9e0357249ff0f7

SHA512
96cc4f56731a5ef96cfe92c5e134ea87a519850de21df6e95e07b1328fbfbf1aa5f8b35d85235659b616662c429d23370a8c0b18c6d7d6a6f1ad37a975b9dd2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f58b.TMP

Filesize
874B

MD5
647126d9987f343552fbe494dca9c04d

SHA1
3c6ec5de7ee2148f8538e0c28e37ff9932386940

SHA256
7df2e177de84ab2780eca451a1f100a25f07c5141d8826a96448ec67bf04bb81

SHA512
132fd7e138e75aa7cadf2de312926f54050e1db7226dd947b9000988342b1c8cd66a70ca4e677417a0b90b6eac4a0603957a22d36906987df64202e9034f0486

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
84ad92ae4879b9006e0ec7bdbfbc8675

SHA1
206914eb8d50eaabde0251b8b4844cabe8f5a498

SHA256
9c1d4abc6f93d734f0d509d0ee60c76bdd120ab061e84fd27a1503aab64ff802

SHA512
a1b2d295e2ef7029a103f4aa8cb7c7e9d98a92d5bc9b8d8026529587b199f21f836ccc859213d86e09773eabb480ed8d0c2b951b1bbd4d4d8e0f296063ff9e08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
742c95a6383ee97b838111f52d9071d9

SHA1
f4eec523d104c8faca3291029e1c5c0147f34de5

SHA256
aa8aff292a448a65bf7e8328037755c68b5cd8efefec7a93ecb53e127d8cdf2d

SHA512
adead9c8cba2a06901122c95d348bfa730376c1dae52a213c3d6fd0988f53491b0e4e1b1266c5a409423f46364c9df2c3665ae19add0dcf007de06a2beb9948b

Download Submit
C:\Users\Admin\Downloads\OsuBuddy-Debug.zip

Filesize
283KB

MD5
e873af38970ccc05fa86e69b0973c31d

SHA1
f4afcd64a536bf12e81cee64c1f26a4395701faf

SHA256
59dcd04d643fc1e02ad46dc0c2722896c53174c6b7ce5432b0f07eb3ddf94c53

SHA512
c4cd257c54882776d30eb1edfa8745924f8a5bb1dcea0bb1924818bfc2ccb3c52913bbdc3607ade7a9d65c9b1d161d8bbbdac0cdc9a255f8b8ea219500c0eb52

Download Submit
memory/4536-339-0x0000000000C60000-0x0000000000C9C000-memory.dmp

Filesize
240KB

Download
memory/4536-340-0x0000000005DA0000-0x0000000006346000-memory.dmp

Filesize
5.6MB

Download
memory/4536-341-0x00000000056B0000-0x00000000056B8000-memory.dmp

Filesize
32KB

Download
memory/4536-342-0x00000000057A0000-0x00000000057BA000-memory.dmp

Filesize
104KB

Download
memory/4536-343-0x0000000005B20000-0x0000000005B42000-memory.dmp

Filesize
136KB

Download
memory/4536-344-0x0000000005790000-0x000000000579C000-memory.dmp

Filesize
48KB

Download
memory/4536-345-0x0000000005BF0000-0x0000000005C82000-memory.dmp

Filesize
584KB

Download
memory/4536-346-0x0000000005B90000-0x0000000005B9A000-memory.dmp

Filesize
40KB

Download