43e6ae7e38488e95741b1cad60843e7ce49419889285433eb4e697c175a153ab

Analysis

max time kernel
175s
max time network
175s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
12/09/2024, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

WaveInstaller.exe
Size

2.3MB
MD5

8ad8b6593c91d7960dad476d6d4af34f
SHA1

0a95f110c8264cde7768a3fd76db5687fda830ea
SHA256

43e6ae7e38488e95741b1cad60843e7ce49419889285433eb4e697c175a153ab
SHA512

09b522da0958f8b173e97b31b6c7141cb67de5d30db9ff71bc6e61ca9a97c09bff6b17d6eaa03c840500996aad25b3419391af64de1c59e98ff6a8eac636b686
SSDEEP

49152:6inbT3qpTDQSmanAmwJAaDMg33U2pLYiniT:6inKpTJmWAmmAMPWin

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
984	WaveBootstrapper.exe
4840	WaveBootstrapper.exe
2344	WaveWindows.exe
4936	WaveWindows.exe

Loads dropped DLL 2 IoCs

pid	Process
984	WaveBootstrapper.exe
4840	WaveBootstrapper.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com
6	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3164	4936	WerFault.exe	85
1192	2344	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaveInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaveBootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaveBootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaveWindows.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaveWindows.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4272559161-3282441186-401869126-1000\{75DEF57C-19BB-4D21-BD0A-5FB6CFDDB87E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2344	WaveWindows.exe
4936	WaveWindows.exe
4880	msedge.exe
4880	msedge.exe
4744	msedge.exe
4744	msedge.exe
3884	msedge.exe
3884	msedge.exe
4768	msedge.exe
4768	msedge.exe
2824	identity_helper.exe
2824	identity_helper.exe
3376	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2144	WaveInstaller.exe
Token: SeDebugPrivilege	984	WaveBootstrapper.exe
Token: SeDebugPrivilege	4840	WaveBootstrapper.exe
Token: SeDebugPrivilege	2344	WaveWindows.exe
Token: SeDebugPrivilege	4936	WaveWindows.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 984	2144	WaveInstaller.exe	82
PID 2144 wrote to memory of 984	2144	WaveInstaller.exe	82
PID 2144 wrote to memory of 984	2144	WaveInstaller.exe	82
PID 2144 wrote to memory of 4840	2144	WaveInstaller.exe	83
PID 2144 wrote to memory of 4840	2144	WaveInstaller.exe	83
PID 2144 wrote to memory of 4840	2144	WaveInstaller.exe	83
PID 984 wrote to memory of 2344	984	WaveBootstrapper.exe	84
PID 984 wrote to memory of 2344	984	WaveBootstrapper.exe	84
PID 984 wrote to memory of 2344	984	WaveBootstrapper.exe	84
PID 4840 wrote to memory of 4936	4840	WaveBootstrapper.exe	85
PID 4840 wrote to memory of 4936	4840	WaveBootstrapper.exe	85
PID 4840 wrote to memory of 4936	4840	WaveBootstrapper.exe	85
PID 4744 wrote to memory of 2668	4744	msedge.exe	94
PID 4744 wrote to memory of 2668	4744	msedge.exe	94
PID 4744 wrote to memory of 4716	4744	msedge.exe	95
PID 4744 wrote to memory of 4716	4744	msedge.exe	95
PID 4744 wrote to memory of 4716	4744	msedge.exe	95
PID 4744 wrote to memory of 4716	4744	msedge.exe	95
PID 4744 wrote to memory of 4716	4744	msedge.exe	95
PID 4744 wrote to memory of 4716	4744	msedge.exe	95
PID 4744 wrote to memory of 4716	4744	msedge.exe	95
PID 4744 wrote to memory of 4716	4744	msedge.exe	95
PID 4744 wrote to memory of 4716	4744	msedge.exe	95
PID 4744 wrote to memory of 4716	4744	msedge.exe	95
PID 4744 wrote to memory of 4716	4744	msedge.exe	95
PID 4744 wrote to memory of 4716	4744	msedge.exe	95
PID 4744 wrote to memory of 4716	4744	msedge.exe	95
PID 4744 wrote to memory of 4716	4744	msedge.exe	95
PID 4744 wrote to memory of 4716	4744	msedge.exe	95
PID 4744 wrote to memory of 4716	4744	msedge.exe	95
PID 4744 wrote to memory of 4716	4744	msedge.exe	95
PID 4744 wrote to memory of 4716	4744	msedge.exe	95
PID 4744 wrote to memory of 4716	4744	msedge.exe	95
PID 4744 wrote to memory of 4716	4744	msedge.exe	95
PID 4744 wrote to memory of 4716	4744	msedge.exe	95
PID 4744 wrote to memory of 4716	4744	msedge.exe	95
PID 4744 wrote to memory of 4716	4744	msedge.exe	95
PID 4744 wrote to memory of 4716	4744	msedge.exe	95
PID 4744 wrote to memory of 4716	4744	msedge.exe	95
PID 4744 wrote to memory of 4716	4744	msedge.exe	95
PID 4744 wrote to memory of 4716	4744	msedge.exe	95
PID 4744 wrote to memory of 4716	4744	msedge.exe	95
PID 4744 wrote to memory of 4716	4744	msedge.exe	95
PID 4744 wrote to memory of 4716	4744	msedge.exe	95
PID 4744 wrote to memory of 4716	4744	msedge.exe	95
PID 4744 wrote to memory of 4716	4744	msedge.exe	95
PID 4744 wrote to memory of 4716	4744	msedge.exe	95
PID 4744 wrote to memory of 4716	4744	msedge.exe	95
PID 4744 wrote to memory of 4716	4744	msedge.exe	95
PID 4744 wrote to memory of 4716	4744	msedge.exe	95
PID 4744 wrote to memory of 4716	4744	msedge.exe	95
PID 4744 wrote to memory of 4716	4744	msedge.exe	95
PID 4744 wrote to memory of 4716	4744	msedge.exe	95
PID 4744 wrote to memory of 4716	4744	msedge.exe	95
PID 4744 wrote to memory of 4880	4744	msedge.exe	96
PID 4744 wrote to memory of 4880	4744	msedge.exe	96
PID 4744 wrote to memory of 5108	4744	msedge.exe	97
PID 4744 wrote to memory of 5108	4744	msedge.exe	97
PID 4744 wrote to memory of 5108	4744	msedge.exe	97
PID 4744 wrote to memory of 5108	4744	msedge.exe	97
PID 4744 wrote to memory of 5108	4744	msedge.exe	97
PID 4744 wrote to memory of 5108	4744	msedge.exe	97
PID 4744 wrote to memory of 5108	4744	msedge.exe	97
PID 4744 wrote to memory of 5108	4744	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Users\Admin\AppData\Local\Wave\WaveBootstrapper.exe
  "C:\Users\Admin\AppData\Local\Wave\WaveBootstrapper.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:984
- - C:\Users\Admin\AppData\Local\Wave\WaveWindows.exe
    "C:\Users\Admin\AppData\Local\Wave\WaveWindows.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2344
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 1772
      4⤵
      Program crash
      PID:1192
- C:\Users\Admin\AppData\Local\Wave\WaveBootstrapper.exe
  "C:\Users\Admin\AppData\Local\Wave\WaveBootstrapper.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Users\Admin\AppData\Local\Wave\WaveWindows.exe
    "C:\Users\Admin\AppData\Local\Wave\WaveWindows.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4936
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 1496
      4⤵
      Program crash
      PID:3164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4936 -ip 4936
1⤵
PID:1980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2344 -ip 2344
1⤵
PID:2608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa1c093cb8,0x7ffa1c093cc8,0x7ffa1c093cd8
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1864,11661589760664481756,11578938443971283013,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1888 /prefetch:2
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1864,11661589760664481756,11578938443971283013,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1864,11661589760664481756,11578938443971283013,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,11661589760664481756,11578938443971283013,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,11661589760664481756,11578938443971283013,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,11661589760664481756,11578938443971283013,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,11661589760664481756,11578938443971283013,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,11661589760664481756,11578938443971283013,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1864,11661589760664481756,11578938443971283013,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,11661589760664481756,11578938443971283013,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1864,11661589760664481756,11578938443971283013,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4708 /prefetch:8
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1864,11661589760664481756,11578938443971283013,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4924 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,11661589760664481756,11578938443971283013,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,11661589760664481756,11578938443971283013,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,11661589760664481756,11578938443971283013,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1864,11661589760664481756,11578938443971283013,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,11661589760664481756,11578938443971283013,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,11661589760664481756,11578938443971283013,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,11661589760664481756,11578938443971283013,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,11661589760664481756,11578938443971283013,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2008 /prefetch:1
  2⤵
  PID:72
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,11661589760664481756,11578938443971283013,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,11661589760664481756,11578938443971283013,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaService --field-trial-handle=1864,11661589760664481756,11578938443971283013,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,11661589760664481756,11578938443971283013,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6968 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,11661589760664481756,11578938443971283013,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6888 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,11661589760664481756,11578938443971283013,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6940 /prefetch:1
  2⤵
  PID:3164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\WaveBootstrapper.exe.log

Filesize
2KB

MD5
42e80ac3d4f421f5e920dacdd3ba048d

SHA1
fef20b38c04b51c2e0e32c3cb5237f7b04a916ed

SHA256
2ac4fcd93273523ded3ad821492c8ea58d54ff60d45b9c9431d77b0ae346e98a

SHA512
b66d76fd6b072d047c068fb02cd36d0ccffd285143c199b59d86b1453b178fc2f11fdafa24eedd318e72ef079c8cb5576654c87d42f1a06b7a630c095635abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5578283903c07cc737a43625e2cbb093

SHA1
f438ad2bef7125e928fcde43082a20457f5df159

SHA256
7268c7d8375d50096fd5f773a0685ac724c6c2aece7dc273c7eb96b28e2935b2

SHA512
3b29531c0bcc70bfc0b1af147fe64ce0a7c4d3cbadd2dbc58d8937a8291daae320206deb0eb2046c3ffad27e01af5aceca4708539389da102bff4680afaa1601

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0487ced0fdfd8d7a8e717211fcd7d709

SHA1
598605311b8ef24b0a2ba2ccfedeecabe7fec901

SHA256
76693c580fd4aadce2419a1b80795bb4ff78d70c1fd4330e777e04159023f571

SHA512
16e1c6e9373b6d5155310f64bb71979601852f18ee3081385c17ffb943ab078ce27cd665fb8d6f3bcc6b98c8325b33403571449fad044e22aa50a3bf52366993

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
0cc01319d6b0e388489469779ea74a65

SHA1
69f960a881b5aa896dac926f3b3dbe15f59af251

SHA256
ab1af5bfbe408d7e7f09bcdb2e7e95f354ebd205490910db2a19f4ac15b52db6

SHA512
0ab7ea9d8d69a83ffb12b663af6065998c68ac6a449e6cb68918e45aed07f1eda134c25b67e27f7ec61b11f7fcac77f217e149abd2479f092edae759dcc5d973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
1ed0967b67a526a8dfb708aa91758340

SHA1
8f6659a1db40c645377ac75b493f67652eec0718

SHA256
66853a114bf4e74518fc9bfcc227042bb9b914ac059461658871bdab4d15c7aa

SHA512
34f0caf538706953b0ea9a9842cd0d508f6a8e9c6f50655170f7946a7391fe4f57ec2e2112043f9f249fcf2155811b19095f49c5bdfda5c5f7a129b4a5950ace

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b71658d7314310bf5872d531ec1439dc

SHA1
9176e1e36b3ae68f26bfea170135afad73edac3a

SHA256
19c3bf1d9c2f87d8d04ed765b4c12dc1dc373e8d444721dee0db7d8643a12729

SHA512
59a5cd04991c02ffaa6ef2ed9a350c3bf4cbb95c4fdff18ac41e82d4330305b10b9ab7b4989f04840d5440ff8c9588455525b83300f1b4192bd1e1f2a662933e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
32393cb07dc94a6acccc4ae9179c396f

SHA1
206f434dfeb775b00b19f51690d59a77a341e63a

SHA256
810e069b8c9360e80106470def0823b97e86669be5c9d48e6b6894bd86c72b97

SHA512
0aebc5a2f5442321b104d58dd64b5f3db102249b3d9c20c0afb4b4225bd6d176e3ebcdeeac89c83fec3a56b75d90733ff2ceaadf66d722fa424356cf035aad21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7f0a09023bb7bbd61880cca10bd0d5fd

SHA1
43bf456d5ae375d23c3559e002b4616f84ca20c5

SHA256
7f0e3cb0c876cdd5af4123360b79eb66dab4d4f1fd6bfc0c7a6b503a247c83e1

SHA512
f63516959bdfd0a3dac30dc1b414ba68ad5c2282678681fc875605d35a8f7128ffaf8c89c4d030f7441406499d44377b24e2d0be808ac1078da5354606a06fe1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1f81e98688af790d08a671fd368560f7

SHA1
f913f3631479832d53d9bb86379e1910a6a85106

SHA256
db322e132bd14a2beef4320447c5d123a688d6e9b7936553e385d45f2c6b0872

SHA512
89365977154ae7ef6aee73084f4f1c0597373c710f693576c44dae5224f34032a256a0e175dad589b1662f1e079c269e017fe0eaa427351613a76302eec83e58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
b279357eaed0c3c174d6402d012b84be

SHA1
2bd0d0797197d5a335db3fdf5bb9fe2f1025d51c

SHA256
8df263cd66bf8369bdf8c12a8fff21409e22b4669202e06182b1cd5b4d61b01b

SHA512
fe3ad3e5d97298acc49570ba024c029780724a92b24814367276e895dcf82c0d0b9fdb6d80b99ded57deca3d29374091a6ca9709175c7948126b6e6075cbbffd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
d187557a508fe23c5f6ad060287dc648

SHA1
8289986ff29d59cf9fcf4a3df1d809216997bab8

SHA256
5b02894441511da8b332277b8ef76804c429bd0e14b7ebfde863eb09f5fe919e

SHA512
2864b6e916f62c52ecfd43fe9ad1971e4d676f95ab1aff39c65448b4e0aac942cb0eff093be5f7402f4e55774c2ef7861b6125a040ace47e3c0fc731f68fd2d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
bcb72491f1ffb0f51f6ecb58c96dadfc

SHA1
3abf4dbd7b14374949e24bda8ca49e7d801f2f1a

SHA256
0256be77d869fd7eb498af6ebc13c1c02452eb4323609d2b6b8edc25e81e3323

SHA512
b46d7e1b06ead03460e2d60f2a4c52b022a787560be0ea658bca2ffed03782a6ed4f7e1743283630531b004756b1239963aa47c8e1be111df7ca340d47cf7fde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
347b8b39e76f3254501dd6614b9c3c36

SHA1
e9740b85632b13700e2af82610337c50ee5cfa56

SHA256
9fb8ff6b8f0eb61df63332c3eea555d3b620819c57e47567eda39576a4280a1c

SHA512
6f8c4ab494153d9e2c1bec5667bdcfc6c10aa4989b390358d7d96a14f3ef5562da446a03b5b845fac2c2eaf1d006b030b25c95198c5ab5f9c7972b7d9ddde05b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59a5ac.TMP

Filesize
2KB

MD5
c9cdbd6dd726edd2a2c3c67177198f57

SHA1
e8d2b129957b8aeb345cb67f27f56e84387aae82

SHA256
c9890eeac621f528a7df3c926257dfb83a57cbe2da5a4e3a0f23c4d54a0f8a06

SHA512
6eb8d92aa98873da8f4ac5e4d2524288a03056b79fe4252eb80bc643fb203e1b9382c78cd7282b5a91e388a86a7099c412fa1647350946e8e04c4f2d10817a70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f4964a6ccc635483d6f0369076d60d14

SHA1
3af4cc927f63c6d09c99c68000d075ccccea8f06

SHA256
2daed4de5e9282bfd17f299b8b4d0a1504e99e474cdcecd756a56b6cdabe840e

SHA512
607ec605e4d43748edea327d336b517742917a3fb8132b7b76423f9126b8daaca915d5bbf8edbb71ad69324585be966d6552f94a0ff432462a12538c48c91c54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
869113e3e8e0c58cbd1bbccf0fe2da32

SHA1
1810c6a3cc1dc980963e26a15528068a1deda2ea

SHA256
77aa04705151f5f2326ae46e426aa90f75df9e01f8af392ca0d95706a882b29b

SHA512
b28642c7ba26d65a9e4cc4b52c6a4449cbdae226c845f1d0935b2f937fe7c584017794e380e8701d04646649e8038f910ca317e1d9e2ec2b867b7be0c10f8083

Download Submit
C:\Users\Admin\AppData\Local\Sentry\565BEE8550E2E5F1B7BAFF132ECD72B7217F6160\.installation

Filesize
36B

MD5
db9205b2df551bb4b5d68791ff44b324

SHA1
fa076793772476adb893e52481ab0fa03b94b4d3

SHA256
974e4964d09c286ec5a21d960b9a3fcabf9d5d97df675fba3af61231ce54d55e

SHA512
31def99758ae1ff72ff5dd04064194aa511c9f8c3027a7aba1025f960a4b02be0c875454aaf48a273dbc1fbdb7fec13e5a95b73aed24dfdd93d750446ab58cdb

Download Submit
C:\Users\Admin\AppData\Local\Wave\WaveBootstrapper.exe

Filesize
949KB

MD5
495df8a4dee554179394b33daece4d1e

SHA1
0a67a0e43b4b4e3e25a736d08de4cec22033b696

SHA256
201263498c60fa595f394650c53a08d0b82850349123b97d41565e145ddf2f42

SHA512
ce3bef1038741f7a0f90cc131a4a1883fd84b006654024d591f5451e73166b4cae546e307c358b5b90aa0e6517bf7b6098f1f59a3ecc01598d4feb26e6b6af33

Download Submit
C:\Users\Admin\AppData\Local\Wave\WaveWindows.exe

Filesize
4KB

MD5
17faee086f6a0a359caaa8c099174ccc

SHA1
7cdfdd2adbcd8586a6cc55e4cf387c7151546fc2

SHA256
e2c9222088f4a4250836dc804471b0aa29a1ec0d601c57610ff12290e3c9033c

SHA512
b26777c4e8b017a01d5f85c874cdcd108e06785526c8bc79cc63c735c6ae9237ad0d7cd9840651f45d749b7c35be4f1ba9b5e4b3c8f277bcab9cdf857915be79

Download Submit
C:\Users\Admin\AppData\Local\Wave\WaveWindows.exe

Filesize
8.0MB

MD5
b8631bbd78d3935042e47b672c19ccc3

SHA1
cd0ea137f1544a31d2a62aaed157486dce3ecebe

SHA256
9cfda541d595dc20a55df5422001dfb58debd401df3abff21b1eee8ede28451c

SHA512
0c51d6247e39f7851538a5916b24972e845abfe429f0abdc7b532f654b4afe73dc6e1936f1b062da63bfc90273d3cbc297bf6c802e615f3711d0f180c070aa26

Download Submit
C:\Users\Admin\AppData\Local\Wave\d3dcompiler_47.dll

Filesize
3.9MB

MD5
3b4647bcb9feb591c2c05d1a606ed988

SHA1
b42c59f96fb069fd49009dfd94550a7764e6c97c

SHA256
35773c397036b368c1e75d4e0d62c36d98139ebe74e42c1ff7be71c6b5a19fd7

SHA512
00cd443b36f53985212ac43b44f56c18bf70e25119bbf9c59d05e2358ff45254b957f1ec63fc70fb57b1726fd8f76ccfad8103c67454b817a4f183f9122e3f50

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Desktop\Wave.lnk

Filesize
1KB

MD5
4aa0b56581f163629b6227b7362fbae2

SHA1
531ca4765b985fe94c14832f501fe1952baf520a

SHA256
e6b39c748a84a382825c143e59eb7b3386043ad49eb79a006c0ff9387901198d

SHA512
2cf464232c611c97250f6d3d639f4825fb00f84f2d1ddc5229bbc427476da34212701aebecadd567aa5cd923f50c6bf97fee6ed04bd563cb9f6e91896fef5174

Download Submit
memory/984-241-0x0000000074CB0000-0x0000000075461000-memory.dmp

Filesize
7.7MB

Download
memory/984-242-0x0000000074CB0000-0x0000000075461000-memory.dmp

Filesize
7.7MB

Download
memory/984-246-0x0000000008D10000-0x0000000008E14000-memory.dmp

Filesize
1.0MB

Download
memory/984-248-0x0000000009A50000-0x0000000009A5A000-memory.dmp

Filesize
40KB

Download
memory/984-247-0x0000000009A10000-0x0000000009A26000-memory.dmp

Filesize
88KB

Download
memory/984-249-0x0000000009AF0000-0x0000000009B0E000-memory.dmp

Filesize
120KB

Download
memory/984-240-0x0000000000C40000-0x0000000000D32000-memory.dmp

Filesize
968KB

Download
memory/984-268-0x0000000074CB0000-0x0000000075461000-memory.dmp

Filesize
7.7MB

Download
memory/2144-24-0x0000000001950000-0x00000000019C2000-memory.dmp

Filesize
456KB

Download
memory/2144-12-0x0000000074CB0000-0x0000000075461000-memory.dmp

Filesize
7.7MB

Download
memory/2144-1-0x0000000000F70000-0x00000000011BA000-memory.dmp

Filesize
2.3MB

Download
memory/2144-2-0x0000000074CB0000-0x0000000075461000-memory.dmp

Filesize
7.7MB

Download
memory/2144-3-0x0000000005D90000-0x0000000005E42000-memory.dmp

Filesize
712KB

Download
memory/2144-25-0x0000000001910000-0x000000000191A000-memory.dmp

Filesize
40KB

Download
memory/2144-26-0x0000000001920000-0x000000000192A000-memory.dmp

Filesize
40KB

Download
memory/2144-21-0x0000000006E30000-0x0000000006E56000-memory.dmp

Filesize
152KB

Download
memory/2144-4-0x0000000005C10000-0x0000000005C92000-memory.dmp

Filesize
520KB

Download
memory/2144-22-0x0000000006E60000-0x0000000006E68000-memory.dmp

Filesize
32KB

Download
memory/2144-20-0x000000000C280000-0x000000000C316000-memory.dmp

Filesize
600KB

Download
memory/2144-13-0x0000000074CB0000-0x0000000075461000-memory.dmp

Filesize
7.7MB

Download
memory/2144-0-0x0000000074CBE000-0x0000000074CBF000-memory.dmp

Filesize
4KB

Download
memory/2144-5-0x0000000005E60000-0x0000000005E68000-memory.dmp

Filesize
32KB

Download
memory/2144-11-0x0000000074CBE000-0x0000000074CBF000-memory.dmp

Filesize
4KB

Download
memory/2144-10-0x0000000074CB0000-0x0000000075461000-memory.dmp

Filesize
7.7MB

Download
memory/2144-9-0x0000000074CB0000-0x0000000075461000-memory.dmp

Filesize
7.7MB

Download
memory/2144-245-0x0000000074CB0000-0x0000000075461000-memory.dmp

Filesize
7.7MB

Download
memory/2144-7-0x000000000A7A0000-0x000000000A7D8000-memory.dmp

Filesize
224KB

Download
memory/2144-8-0x000000000A770000-0x000000000A77E000-memory.dmp

Filesize
56KB

Download
memory/2144-6-0x0000000005E70000-0x0000000005E78000-memory.dmp

Filesize
32KB

Download
memory/2344-272-0x0000000005DE0000-0x0000000005E80000-memory.dmp

Filesize
640KB

Download
memory/2344-271-0x0000000000AA0000-0x00000000012A2000-memory.dmp

Filesize
8.0MB

Download
memory/2344-276-0x0000000006AF0000-0x0000000006B66000-memory.dmp

Filesize
472KB

Download
memory/2344-274-0x00000000068A0000-0x00000000068D2000-memory.dmp

Filesize
200KB

Download
memory/2344-273-0x00000000066F0000-0x0000000006766000-memory.dmp

Filesize
472KB

Download