hxxps://getwave[.]gg

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/08/2024, 10:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://getwave.gg

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
1740	WaveInstaller.exe
1964	WaveInstaller.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
96	raw.githubusercontent.com
97	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaveInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaveInstaller.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 82671.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1288	msedge.exe
1288	msedge.exe
1124	msedge.exe
1124	msedge.exe
3288	identity_helper.exe
3288	identity_helper.exe
392	msedge.exe
392	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1740	WaveInstaller.exe
Token: SeDebugPrivilege	1964	WaveInstaller.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 3632	1124	msedge.exe	84
PID 1124 wrote to memory of 3632	1124	msedge.exe	84
PID 1124 wrote to memory of 3308	1124	msedge.exe	85
PID 1124 wrote to memory of 3308	1124	msedge.exe	85
PID 1124 wrote to memory of 3308	1124	msedge.exe	85
PID 1124 wrote to memory of 3308	1124	msedge.exe	85
PID 1124 wrote to memory of 3308	1124	msedge.exe	85
PID 1124 wrote to memory of 3308	1124	msedge.exe	85
PID 1124 wrote to memory of 3308	1124	msedge.exe	85
PID 1124 wrote to memory of 3308	1124	msedge.exe	85
PID 1124 wrote to memory of 3308	1124	msedge.exe	85
PID 1124 wrote to memory of 3308	1124	msedge.exe	85
PID 1124 wrote to memory of 3308	1124	msedge.exe	85
PID 1124 wrote to memory of 3308	1124	msedge.exe	85
PID 1124 wrote to memory of 3308	1124	msedge.exe	85
PID 1124 wrote to memory of 3308	1124	msedge.exe	85
PID 1124 wrote to memory of 3308	1124	msedge.exe	85
PID 1124 wrote to memory of 3308	1124	msedge.exe	85
PID 1124 wrote to memory of 3308	1124	msedge.exe	85
PID 1124 wrote to memory of 3308	1124	msedge.exe	85
PID 1124 wrote to memory of 3308	1124	msedge.exe	85
PID 1124 wrote to memory of 3308	1124	msedge.exe	85
PID 1124 wrote to memory of 3308	1124	msedge.exe	85
PID 1124 wrote to memory of 3308	1124	msedge.exe	85
PID 1124 wrote to memory of 3308	1124	msedge.exe	85
PID 1124 wrote to memory of 3308	1124	msedge.exe	85
PID 1124 wrote to memory of 3308	1124	msedge.exe	85
PID 1124 wrote to memory of 3308	1124	msedge.exe	85
PID 1124 wrote to memory of 3308	1124	msedge.exe	85
PID 1124 wrote to memory of 3308	1124	msedge.exe	85
PID 1124 wrote to memory of 3308	1124	msedge.exe	85
PID 1124 wrote to memory of 3308	1124	msedge.exe	85
PID 1124 wrote to memory of 3308	1124	msedge.exe	85
PID 1124 wrote to memory of 3308	1124	msedge.exe	85
PID 1124 wrote to memory of 3308	1124	msedge.exe	85
PID 1124 wrote to memory of 3308	1124	msedge.exe	85
PID 1124 wrote to memory of 3308	1124	msedge.exe	85
PID 1124 wrote to memory of 3308	1124	msedge.exe	85
PID 1124 wrote to memory of 3308	1124	msedge.exe	85
PID 1124 wrote to memory of 3308	1124	msedge.exe	85
PID 1124 wrote to memory of 3308	1124	msedge.exe	85
PID 1124 wrote to memory of 3308	1124	msedge.exe	85
PID 1124 wrote to memory of 1288	1124	msedge.exe	86
PID 1124 wrote to memory of 1288	1124	msedge.exe	86
PID 1124 wrote to memory of 3052	1124	msedge.exe	87
PID 1124 wrote to memory of 3052	1124	msedge.exe	87
PID 1124 wrote to memory of 3052	1124	msedge.exe	87
PID 1124 wrote to memory of 3052	1124	msedge.exe	87
PID 1124 wrote to memory of 3052	1124	msedge.exe	87
PID 1124 wrote to memory of 3052	1124	msedge.exe	87
PID 1124 wrote to memory of 3052	1124	msedge.exe	87
PID 1124 wrote to memory of 3052	1124	msedge.exe	87
PID 1124 wrote to memory of 3052	1124	msedge.exe	87
PID 1124 wrote to memory of 3052	1124	msedge.exe	87
PID 1124 wrote to memory of 3052	1124	msedge.exe	87
PID 1124 wrote to memory of 3052	1124	msedge.exe	87
PID 1124 wrote to memory of 3052	1124	msedge.exe	87
PID 1124 wrote to memory of 3052	1124	msedge.exe	87
PID 1124 wrote to memory of 3052	1124	msedge.exe	87
PID 1124 wrote to memory of 3052	1124	msedge.exe	87
PID 1124 wrote to memory of 3052	1124	msedge.exe	87
PID 1124 wrote to memory of 3052	1124	msedge.exe	87
PID 1124 wrote to memory of 3052	1124	msedge.exe	87
PID 1124 wrote to memory of 3052	1124	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://getwave.gg
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffade5446f8,0x7ffade544708,0x7ffade544718
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,7340516162467794131,2166887854490601237,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,7340516162467794131,2166887854490601237,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,7340516162467794131,2166887854490601237,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7340516162467794131,2166887854490601237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7340516162467794131,2166887854490601237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,7340516162467794131,2166887854490601237,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,7340516162467794131,2166887854490601237,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7340516162467794131,2166887854490601237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7340516162467794131,2166887854490601237,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7340516162467794131,2166887854490601237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7340516162467794131,2166887854490601237,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7340516162467794131,2166887854490601237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2384 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2148,7340516162467794131,2166887854490601237,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3752 /prefetch:8
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7340516162467794131,2166887854490601237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2148,7340516162467794131,2166887854490601237,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3352 /prefetch:8
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2148,7340516162467794131,2166887854490601237,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:392
- C:\Users\Admin\Downloads\WaveInstaller.exe
  "C:\Users\Admin\Downloads\WaveInstaller.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1740
- C:\Users\Admin\Downloads\WaveInstaller.exe
  "C:\Users\Admin\Downloads\WaveInstaller.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,7340516162467794131,2166887854490601237,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5424 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
0f049ac0af499b721ad1dd927f5676e0

SHA1
598ea2e360b895d25c06a02e3e017dcf4f17aa9c

SHA256
cafddbbac538a21e870fdf0ecea187c5574c1a5777a5cf4a7eb0f4a9d591c218

SHA512
5d23ed9375336ad8d03a9d285553caacdbfcc274105bb68b6d315cdfaef1c6900e1badd196e047ca455c7895000f33ce85cae30924dce587e27cb83d9142f570

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
468B

MD5
fb9a96dfd8414f7f5effdc9a4caa9508

SHA1
7d1d66c741a7c10b7383f4cb7bf0b2c85c3f4685

SHA256
299eea922c67b683a2181c66d012f5cba0138339b3a645cdd6cea1fb74423b38

SHA512
09a9918a29c8338d80ca73343b2f5b8b89386d07a59c88f23bc3fb9c96db13fa2dff6f18364dd05d449b150bc36456487d89c5e461f2752d6d8a6160182abfbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
df019843da43dae1682521d3af8c88c7

SHA1
a796d3f0468dd64c0c1d706a24c822cfb9b341e0

SHA256
18a6f21b404e1ec44e41a1a058f710b4c69ef582e437b29f35e9f6977f17a76f

SHA512
30352598423e720ea9cc00d8d93f803170eff2c4db8808a549af466082e3683e77f7b00c1ef978ebb505248e3a9b562861491420b491871b2192d6620a4c5b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
793fc0f2eabcc4d49e1dca6c6bee4906

SHA1
d95220053f88bbb53db4ac3b9ad074e24e098d34

SHA256
c080b091c41a5d175a31f8470cff2e1266cef208ba41aca16e5c53ead322a42a

SHA512
1fbfb1cd479a3ea1007731e99287e3c284fcc24c09a47f6efbc09613b5ebabd493b7aae7e2f496dde7ca1d3e64075fa23e031d5c5bd1bd2f0807f1568bb21324

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
113f4b99ba79f6ef7b0ed5bd881d1183

SHA1
216f12184a30bd140cd26d9bb4bc6aa23e2a7935

SHA256
9b321542ab28548d09c2ff2827e67eddc10cc47670688908f1f5816be949e3ff

SHA512
ca218881ea2571c619ea6c2471f736dada7cc470d35d765162add0c9a9fb60c30e66ecde12b64bb408430e95393b30079b72d96ca6c4594190c837e2cf5571e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
248f22012eb82f6ac2460164dfa3f0e9

SHA1
2f1959731187b5d1d0c523260983c0eedc8933d2

SHA256
0e2a8e0a4828f19caa099fa6500c3459e99bd43d48ee5217ccf1d38b435c9f0b

SHA512
f1cce30f7d7a09d94c9906caba90fc9a6e86237f3518517e99db3f0c685976de7d08038a770f800769296f6bda557a75c2f7c0eb78cccd1e08d9ef29cc14250c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
44ec5b36448a8039a8a093b45f441a82

SHA1
d7cb88799dd6b93c3a90f736850e529d7221dc36

SHA256
9ba2d0c3ab697c575a600ede6e202e429814a08483c196e6b995b7f17e2f7a9e

SHA512
17c70a0334d17910b326b540a15d16489b02bf8ac1563b6246c25b488e62c25f0b34b3713dc7e41bcf0c780786a66030443b744c1e91dc4535070cb4ded825c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
353046d1e72a4dfa2c2526b6b49542a0

SHA1
871e24f1b1488959a372147d3aef048ee6fe750b

SHA256
79c3c82340f6a9d10afe0e11ee77aca5a7118497514c8bf9566a9c786e0bd5cd

SHA512
46f30de50b2bcd78f1eabd0923ebc88bc08b5595ccd28babfa709b6a0f3611ed22ec86cefb9b63c68aa892764cd41fea5f6a480dce62e44615d157f658308806

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 82671.crdownload

Filesize
2.3MB

MD5
8ad8b6593c91d7960dad476d6d4af34f

SHA1
0a95f110c8264cde7768a3fd76db5687fda830ea

SHA256
43e6ae7e38488e95741b1cad60843e7ce49419889285433eb4e697c175a153ab

SHA512
09b522da0958f8b173e97b31b6c7141cb67de5d30db9ff71bc6e61ca9a97c09bff6b17d6eaa03c840500996aad25b3419391af64de1c59e98ff6a8eac636b686

Download Submit
memory/1740-170-0x0000000000A20000-0x0000000000C6A000-memory.dmp

Filesize
2.3MB

Download
memory/1740-171-0x00000000057E0000-0x0000000005892000-memory.dmp

Filesize
712KB

Download
memory/1740-172-0x0000000005890000-0x0000000005912000-memory.dmp

Filesize
520KB

Download
memory/1740-173-0x00000000056A0000-0x00000000056A8000-memory.dmp

Filesize
32KB

Download
memory/1740-174-0x00000000056B0000-0x00000000056B8000-memory.dmp

Filesize
32KB

Download
memory/1740-177-0x000000000A350000-0x000000000A35E000-memory.dmp

Filesize
56KB

Download
memory/1740-176-0x000000000A380000-0x000000000A3B8000-memory.dmp

Filesize
224KB

Download