hxxps://www[.]mediafire[.]com/file/9uzztdfbmteljuz/Wave[.]rar

Analysis

max time kernel
1059s
max time network
1064s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
09/04/2024, 03:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/9uzztdfbmteljuz/Wave.rar
Sample240409-dss2wsch32

Score

9^/10

evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Injector.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Injector.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Injector.exe

Executes dropped EXE 2 IoCs

pid	Process
4480	Injector.exe
664	Wave.exe

Loads dropped DLL 6 IoCs

pid	Process
664	Wave.exe
664	Wave.exe
664	Wave.exe
664	Wave.exe
664	Wave.exe
664	Wave.exe

Themida packer 7 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x000100000002a9ba-1313.dat	themida
behavioral1/memory/4480-1315-0x00007FF7910E0000-0x00007FF791A40000-memory.dmp	themida
behavioral1/memory/4480-1317-0x00007FF7910E0000-0x00007FF791A40000-memory.dmp	themida
behavioral1/memory/4480-1318-0x00007FF7910E0000-0x00007FF791A40000-memory.dmp	themida
behavioral1/memory/4480-1319-0x00007FF7910E0000-0x00007FF791A40000-memory.dmp	themida
behavioral1/memory/4480-1320-0x00007FF7910E0000-0x00007FF791A40000-memory.dmp	themida
behavioral1/memory/4480-1321-0x00007FF7910E0000-0x00007FF791A40000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Injector.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4480	Injector.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133571067367967748"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000_Classes\Local Settings	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Wave.rar:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3900	chrome.exe
3900	chrome.exe
3116	chrome.exe
3116	chrome.exe
664	Wave.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 31 IoCs

pid	Process
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3900 wrote to memory of 4724	3900	chrome.exe	79
PID 3900 wrote to memory of 4724	3900	chrome.exe	79
PID 3900 wrote to memory of 1348	3900	chrome.exe	82
PID 3900 wrote to memory of 1348	3900	chrome.exe	82
PID 3900 wrote to memory of 1348	3900	chrome.exe	82
PID 3900 wrote to memory of 1348	3900	chrome.exe	82
PID 3900 wrote to memory of 1348	3900	chrome.exe	82
PID 3900 wrote to memory of 1348	3900	chrome.exe	82
PID 3900 wrote to memory of 1348	3900	chrome.exe	82
PID 3900 wrote to memory of 1348	3900	chrome.exe	82
PID 3900 wrote to memory of 1348	3900	chrome.exe	82
PID 3900 wrote to memory of 1348	3900	chrome.exe	82
PID 3900 wrote to memory of 1348	3900	chrome.exe	82
PID 3900 wrote to memory of 1348	3900	chrome.exe	82
PID 3900 wrote to memory of 1348	3900	chrome.exe	82
PID 3900 wrote to memory of 1348	3900	chrome.exe	82
PID 3900 wrote to memory of 1348	3900	chrome.exe	82
PID 3900 wrote to memory of 1348	3900	chrome.exe	82
PID 3900 wrote to memory of 1348	3900	chrome.exe	82
PID 3900 wrote to memory of 1348	3900	chrome.exe	82
PID 3900 wrote to memory of 1348	3900	chrome.exe	82
PID 3900 wrote to memory of 1348	3900	chrome.exe	82
PID 3900 wrote to memory of 1348	3900	chrome.exe	82
PID 3900 wrote to memory of 1348	3900	chrome.exe	82
PID 3900 wrote to memory of 1348	3900	chrome.exe	82
PID 3900 wrote to memory of 1348	3900	chrome.exe	82
PID 3900 wrote to memory of 1348	3900	chrome.exe	82
PID 3900 wrote to memory of 1348	3900	chrome.exe	82
PID 3900 wrote to memory of 1348	3900	chrome.exe	82
PID 3900 wrote to memory of 1348	3900	chrome.exe	82
PID 3900 wrote to memory of 1348	3900	chrome.exe	82
PID 3900 wrote to memory of 1348	3900	chrome.exe	82
PID 3900 wrote to memory of 1348	3900	chrome.exe	82
PID 3900 wrote to memory of 1348	3900	chrome.exe	82
PID 3900 wrote to memory of 1348	3900	chrome.exe	82
PID 3900 wrote to memory of 1348	3900	chrome.exe	82
PID 3900 wrote to memory of 1348	3900	chrome.exe	82
PID 3900 wrote to memory of 1348	3900	chrome.exe	82
PID 3900 wrote to memory of 1348	3900	chrome.exe	82
PID 3900 wrote to memory of 1348	3900	chrome.exe	82
PID 3900 wrote to memory of 1480	3900	chrome.exe	83
PID 3900 wrote to memory of 1480	3900	chrome.exe	83
PID 3900 wrote to memory of 4060	3900	chrome.exe	84
PID 3900 wrote to memory of 4060	3900	chrome.exe	84
PID 3900 wrote to memory of 4060	3900	chrome.exe	84
PID 3900 wrote to memory of 4060	3900	chrome.exe	84
PID 3900 wrote to memory of 4060	3900	chrome.exe	84
PID 3900 wrote to memory of 4060	3900	chrome.exe	84
PID 3900 wrote to memory of 4060	3900	chrome.exe	84
PID 3900 wrote to memory of 4060	3900	chrome.exe	84
PID 3900 wrote to memory of 4060	3900	chrome.exe	84
PID 3900 wrote to memory of 4060	3900	chrome.exe	84
PID 3900 wrote to memory of 4060	3900	chrome.exe	84
PID 3900 wrote to memory of 4060	3900	chrome.exe	84
PID 3900 wrote to memory of 4060	3900	chrome.exe	84
PID 3900 wrote to memory of 4060	3900	chrome.exe	84
PID 3900 wrote to memory of 4060	3900	chrome.exe	84
PID 3900 wrote to memory of 4060	3900	chrome.exe	84
PID 3900 wrote to memory of 4060	3900	chrome.exe	84
PID 3900 wrote to memory of 4060	3900	chrome.exe	84
PID 3900 wrote to memory of 4060	3900	chrome.exe	84
PID 3900 wrote to memory of 4060	3900	chrome.exe	84
PID 3900 wrote to memory of 4060	3900	chrome.exe	84
PID 3900 wrote to memory of 4060	3900	chrome.exe	84

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/9uzztdfbmteljuz/Wave.rar
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffccf999758,0x7ffccf999768,0x7ffccf999778
  2⤵
  PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1588 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:2
  2⤵
  PID:1348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1860 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:8
  2⤵
  PID:1480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2176 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:8
  2⤵
  PID:4060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2996 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2988 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3892 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:8
  2⤵
  PID:1684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:8
  2⤵
  PID:1488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5328 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4556 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5044 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=1704 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5216 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4860 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5684 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5892 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:8
  2⤵
  PID:1976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5940 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:8
  2⤵
  PID:248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=6092 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=6264 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5788 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=6400 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=6688 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=6820 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=6968 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=6988 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=7124 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=7404 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:1
  2⤵
  PID:392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=7696 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:1
  2⤵
  PID:132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=6824 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=7932 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=8424 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:8
  2⤵
  PID:1100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=8700 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:1
  2⤵
  PID:840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7860 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:8
  2⤵
  PID:5228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7112 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:8
  2⤵
  PID:5268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=9152 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:8
  2⤵
  PID:5288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=5896 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:1
  2⤵
  PID:5472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9912 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:8
  2⤵
  PID:5652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=9972 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:1
  2⤵
  PID:5704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --mojo-platform-channel-handle=9752 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --mojo-platform-channel-handle=7868 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --mojo-platform-channel-handle=10420 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:1
  2⤵
  PID:6012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --mojo-platform-channel-handle=10628 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:1
  2⤵
  PID:5124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --mojo-platform-channel-handle=10616 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:1
  2⤵
  PID:556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --mojo-platform-channel-handle=10636 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8544 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:8
  2⤵
  - NTFS ADS
  PID:3216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1504 --field-trial-handle=1804,i,9257142148627158928,15545388817060721854,131072 /prefetch:8
  2⤵
  PID:5796

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1116

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004AC 0x00000000000004BC
1⤵
PID:1956

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1352

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\Wave\" -spe -an -ai#7zMap4300:70:7zEvent16171
1⤵
PID:5524

C:\Users\Admin\Desktop\Wave\Injector.exe
"C:\Users\Admin\Desktop\Wave\Injector.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4480

C:\Users\Admin\Desktop\Wave\Wave.exe
"C:\Users\Admin\Desktop\Wave\Wave.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

f_000021

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000021
Size 65KB
SHA256 f95947735f1ba1e43b46a1ddc7229b71d37aee7821495f87f1f2d25563d47fcc
MD5 68b24c33a1084c384158245ee07e703f
SHA1 1f40cdfc988534806606faf81344ba79a1528ed9
SHA512 1af1c596736b46a538a06285196d05054c062f29335080d136d325dc305d2d65d266517386d8d54a37de94036c878d9ababa76d9a5f5e8d8d07236d5ac0bb9ed
SSDEEP 1536:v4xfPHzpUMXimceImaQSwCeKudy2YH0po8/lqBY50GSDH8IpaTBktZ:wN/1ZZ+maxDqK0pzxWL8IpAsZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 996345f4c416cc0dd04ce4cece3a7a7ae3c5d5ee684c7a1f41b2691eb0dc4bd2
MD5 b1bdefd820510f576b8e0276f4af573c
SHA1 0ed62f539dc80c5971e157ce7e8a9d4555ddaf6b
SHA512 370615039faf4e349b7f78a86986dbd83f3ae4203c19e17f9ef90ce504bbdb7da6bd5c889cd3af780ff6ceba215409743ca1bf0fc7e469a3e4726e6fd533cc5c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 f9beacda83a329ef81f99483c0d4db37de5c0746b20caca7727c6818eed1648b
MD5 77649f7aa8f7106fcf0c5af7029f9399
SHA1 474b9ba3527d19919c80f90357b88f33a4e0ffd1
SHA512 2c8435e43c223b09897f2887fbf600a09e7baf62f6e54ed3f922d4a91d96edbf3e3ef7558f67ba40a3ec5f6357129b33632bae78d20e5e35a0b4954f091b62e2
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 10e183d20014294a1ca6b12479a559a35691aeec79d4d1afed9ac747f6c7a1fb
MD5 37bbc773a4eb4197eb1b9c752b807a38
SHA1 fe48b5540445ba331024cdd42ac16fa42e366800
SHA512 c3c691bcba554e996fa12c6f400e323f739a93623e4749ef008710f098c1fe0dd29a1b7f0b04a3267266b3d2dfa78f28249bd9715dc7b35b305d68a60dc8aadf
SSDEEP 192:J0nau6zssIF6l6wvfE0G34wncnhhhQ6wmX+7soh8cU7lif1+VmtHAQsivLB24CtK:J0nau6zssE6l6wvfRGowncnhhhQ6wmXa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 21KB
SHA256 25c8ec51512d64b734588dc6461ed9d5b6aa12534be41db38641f6fcffe25932
MD5 4cb633e321ab24481bf9425e9c928dc2
SHA1 9e8e0f3779e66d767f56b56b7e1421cad9a733aa
SHA512 c4e3acd91f7418d8528e798e779fef6fa042d97a0fcb58fcfbb030b3af932553e6e4764d05d6703460e8598b1d04bc373cd1c90fe7a260368efbd775b30e388a
SSDEEP 384:miGE4N0nau6zssE6l6wvfVwihhLJcui8+VmNASN2qYU0y6xeE1XrxaZK3/i676WL:orYtj1v5v+fqMwOqvkY5v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 07ba59d67993f91aa27e1d9ea06bac93793cc6caeb115ca39b7d6d39ec8e1e2d
MD5 58475e32ce90836429bb7ab2f64a99fd
SHA1 b80ed31a8784549e731a7c2f9666b0fd272e32e3
SHA512 5941ba0e50a345f729d216b4ebf7befaa88e7ac925c11b18dad13454d09cb3eb476eff3f40aa0a6d8a2aed703624e35be41c876bb14adbaa1a2795629b332abc
SSDEEP 192:J0+Lau6zssIF6l6wvfE0G34wncnhhhQ6wmX+7soh8cU7lif1+VmtHAQsivLB2k:J0+Lau6zssE6l6wvfRGowncnhhhQ6wmO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 21KB
SHA256 e46a13b2d28c999c94491623343e111d297638243a41e8356aff7b20def0bd99
MD5 2427f18d8464d2f1b2660950f92f51c0
SHA1 2b6daa7ea88cff09c72d24ec59f88c9bdd8a7ead
SHA512 483fccf3578b1747a159ed7ea8bc2bcbbecd5171314c559ed7cf2fb65a736ed9af951d19672de110177b3662366a868b408f14d18f16b29f30d1878347d16c36
SSDEEP 384:qiSFON0nau6zssE6l6wvfVwihhLJcui8+VmNASN2qYcfJYbKXy6xeE1XrxaZK3/m:7rYtj1k5v+fqMgoOqvkYJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 4KB
SHA256 aef08ecc3c9636be8f5a6d3ea8c9b301545920277ef00c9b21f5a11dc8856437
MD5 69b43933b6f024019f645218fd4919e9
SHA1 62b0817561a24051abd5e745c3ca964420d696b1
SHA512 4bc25858b0a811d20ebb9bd5b30c65d0801a7a0bdb15a19ad71d909af1ca55e5cd439497b59b2bbb47e61f981bc3d6d3d33d255fc9a79458315bf06719079c9b
SSDEEP 96:TUYvUUAU+FfIUpUveU8ieUjUYnUVUY+UZnNU4UhUrU0XKUyU5U6SUYjjUxUiHKUj:TUYvUUAU+uUpUveUMUjUYnUVUY+UBNUY
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 7KB
SHA256 0a436b7245e956b7b5a5ae7a0edca05c677be961854e29056b4a89202c987839
MD5 9867d162557d3b6e947151554150652d
SHA1 a8cdf299be3905e5cfcc6b6ba69dedff9271fdd2
SHA512 17d070d641ef9f79222d2bf9f4ad6870cd3486f89c302d04012efec25b2a298a6d46699b4e4a7e00f35aadd621623b2748253703b854e63e4d716dc81847e8bd
SSDEEP 192:TUYvUuUYAUXUxuUpUyqU/eUDUoRsUhUYnUrUcnUVU6UYU2U+UJUkNU2kU1IUFU4u:TlXTAGEuMQR8zRscx8/n8XTxEhRkuI4K
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 6KB
SHA256 06277a115e8c99a8822a8a324cac5b1f909faf9c551169777c03ff5168f1f083
MD5 5dc1778ffadd5c32d0a6b79768748a18
SHA1 9e7e280c79f2fd5b7b5a6013a7549aeff72e62e2
SHA512 4cfee59c547310b4134fc413eda2a4efe67dfa157489033bc5c62f6784e8a4c072ccc6d3e779bed6e0d7866b0f6281eb65403c59cf29bedfe8f722d1153bcdc6
SSDEEP 192:TUYvUuUYAUXUxuUpUveUMUBsUhUYnURUCUnUY+UJUkNU4UUIUFU4UMUYKUBU0U5U:TlXTAGEuMtZuscx6PGsEhnJI4Tx9KOtD
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 935f86d9880a4ce19277245891b5d6e794d22b4c88148b4824c915eaf541e9e8
MD5 3fbc2069fb0d4f2ec00ba7064841e71f
SHA1 5d7d8fa178fc3bc8e625d2448d7072f59cb4dd3c
SHA512 41d6952656aaa945a571b7ffa2d918ccc00e75ffa418fbc5c2c15b58d2bddd4bd90cae698b95bbf9458f3033dc4a971cc1466feebdcbc64190bdd6c487b234a8
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 21a256fe728d02fbf49577ec411313ee66278bed06716aef9bfb8326fea20b9e
MD5 5746c289358303d41961793872d48022
SHA1 c9dfe76517d9ae0950b81040b727adfe554f3013
SHA512 a8e5e3ecdc1629989a3ed0fae6fb78d0dfe26ac5e359d33ba5390af742d04aad50eeda3dbaee7a6ba69bc978c3e0f76ac7751ee6d378b31e49e6e30fc2664d73
SSDEEP 192:eEdd6Gy++yp8ND54qjyy+FVNk3taWtDGotjEsXtScPS:eEdddy9yxMtaWtDZtIsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 205b3f56a564cfbad229113dee923114fe1a4dc67ec013d5714537a24d850a5d
MD5 091db18745e906e1ee8fa827a5b8fae9
SHA1 11a572df9789714a19f2fcaa017d0db6411827ef
SHA512 53103601cf8eeda62871285b24fe2b965ca0bf6d9bcc67f211d44c5b0e771fa29f1e30ad690a39ec218f20709552219c1c20b16363d37dabdbb2223b22eed4f4
SSDEEP 192:eEdp6Gy++yp8ND54qjyy+FVOHNk3taWtDGotjEsXtScPS:eEdpdy9yx0StaWtDZtIsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 6fcef74544b09b25595ae02147bbf4be5a530e078cce924ae3408d9e9e9e5d14
MD5 5cca9e7c6c3072c3b980e3e8da76e63c
SHA1 5b1fd89067e41f964cbb327cafb5768da2e85471
SHA512 671b4ee42601cf3a771f802db0ae0b525a08986cd7eb6db2d341ff4eb6ceb05f97ed50a53171aa056c7d44d747ef205cb4ad3334259df480493d42be73b021e3
SSDEEP 192:eEdd6Gy++yp8ND54qjyy+FVOHNk3taWtDGotjEsXtScPS:eEdddy9yx0StaWtDZtIsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 c016dca1f4d12fdd3c1a7f9dacbb9fb4d9f6900987ea36d4c8b8e0d51003a05a
MD5 efc6c6e9c95fa5411d6ee1392316cfee
SHA1 51213dbac07ce3654a48de32a70a91a375af79fd
SHA512 b1d7d3cfc98d9f8cd66b351054159d0c2bafe736ea1531096733228053241cbbc71eec146416bf7f6f71980a36c8509a874cde1c6f38b8a41de517a7745f4929
SSDEEP 192:0KEdD6Gy++yp8syy+F5kH1SWtDGotjEsXtScPS:0KEdDdymyxa1SWtDZtIsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 9c2ab2ee9d202aeaac7cd22f8c61238ea838f278eea19e65490d636affffa657
MD5 c9a4d7ef9142aa2dd88df858631714a1
SHA1 a1c06f51505b95a96287d861a3f5f2241e8c1477
SHA512 13cc2ccda4d18a14d0bee065e5e7e98594b9bb723443e6ab020e08986d38cc0847e165fc731f43f5d2b92530b3623ff5949b198957c076f1c968bf6b384583c9
SSDEEP 192:eEdA6Gy++yp8ND54qjyy+FVOHNk3taWtDGotjEsXtScPS:eEdAdy9yx0StaWtDZtIsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 4206041806a21aacc6d4fcaa4395f2cecaaee8b9d8ab7d905df7d265ab129f63
MD5 c9b85fec6c777f6b988d1ef7cc104023
SHA1 dab73658f66815482ad5ba1e11a8683c8257db3a
SHA512 3acc86fa0a960ab9c493152a7a818c1bdd75b39be8a9d13c63972ad0cce216c9ebf5ad8ff9ce124366a0de218614b0fef34d68918d5e857c8f7749483e7f9072
SSDEEP 3072:OJ6d7vgj3QHaVRgyKWTHyNiKyc98jbN2/kl4oJLutF/K5L:OJ6d7Yj3Ua9jHThM8fNHK9K5L
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 fed9bcf584a4aba11015616bd49b8ea3a0ce1572f792805feab3850fdee31a37
MD5 abd5e5f708351582f56621fb5e92860d
SHA1 f3b7a3041e0b1963804f3367e8ed4df5427eaf10
SHA512 4b59fca1acc5c4fdc20b68c03638122e8a4ccb72fe1c9cba39fb3098e1df62694f43428adea057d464d8b3621f12e18a46a633bb66d1b85067df908b605d6350
SSDEEP 3072:zJ6d7vgj3QHaVRgyKWTHyNiKyc98jbN2/kl4oJLutF/K5L:zJ6d7Yj3Ua9jHThM8fNHK9K5L
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 b1386b854b7b234f38ebe3596184e01e96224a2cc3ff6170409b4a7c36719893
MD5 403fa455190e50c4b9a22bef455400f4
SHA1 ec19518ffdeb3dff789893b842f4eb1fca65244f
SHA512 e14239e81068901ae28b2a95a58e14b557e50e4e2aee7f4e5ad0c7d8be32e9db77714b3840de0e7e35309317fc33b0bb08ff3742f754484e51a8403606bbf179
SSDEEP 3072:3J6d7vgj3QHaVRgyKWTHyNiKyc98jbN2/kl4oJLutF/K5L:3J6d7Yj3Ua9jHThM8fNHK9K5L
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 99KB
SHA256 3a2df3a664cdf4e2e02bbb69eee19425a3d9ef0b3d6cfcd2115778c7db384e71
MD5 2d42847e58b50c82ef2a976459e42131
SHA1 3a987e36e3105fc20e60c5810b7c3bcbed1ef418
SHA512 72915c4d027f6a3c5e338fef8b0e4ef44637cb2073fa723409b22cc5699d6f76f7a130982ed9c4fdd0ea390914053d6e33d1ea33e681f6a6d39f09d85bb3927c
SSDEEP 384:Bk+X+YpmIjjfU79VW0Mp0AOrwl8F5SoBW6C6WIl87McuLy9DmpzLZ25NyFO7cLTN:n+YnGe39ac0/pwuKeMC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 103KB
SHA256 0435a097ce6d15978697e9707c7325107f98cc277ff9ccb1690c46c8b32565e9
MD5 55b6fc2cea37ba99720551d4a4cc909a
SHA1 6da77c6b45f222aa6884ac0e4977db431d261ac9
SHA512 788d5773c84e7d2f8394c669d78260dc9c208923b41f8e3b239ed46110971a07439daa6b441fd39440a753196b9e88d2459f3e76b4a667247f8294e13f25df56
SSDEEP 384:Yk+X+YpmIjjfU79VW0Mp0AOrwl8F5aSoBW6C6WIl87McuLy9FLZDpzLZ25NupFOi:C+YnGe3YZc6/pwuKeMg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache~RFe612dd6.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe612dd6.TMP
Size 93KB
SHA256 5a91027dfcec27ac73b34d9cdfc93dfe38ab461fbd2c068ddf0c7ff4bb87afbb
MD5 f65929d0b98b2c9b145082b5ad825397
SHA1 19babb057c98ae2cffbabee2653c7ef666d73c6c
SHA512 fe99efe512b0f3a0c06368984da8277c59f2125ce8dbf16c658fe43160524be09f8e16d3e7d35f665b6c97518ab6b24afee4d2a5786a1537ccc5066d78e4a0c6
SSDEEP 384:Ek+X+YpmIjjfU79VW0f0AOrwl8C5SoBW6C6WI87McuLjDmpzLZ25NyFO7cLT5zBZ:++YnGd3STcIJmwuKeMV
MD5 SHA1 SHA512 SSDEEP

Submit Download

persisted_first_party_sets.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

CefSharp.Core.Runtime.dll

Path C:\Users\Admin\Desktop\Wave\CefSharp.Core.Runtime.dll
Size 1.7MB
SHA256 6fd2685e02ef7c92ba5080faadb44f22fee528713f5101e2841c1230cba691e6
MD5 21719cf581f5cc98b21c748498f1cbfe
SHA1 aaada7a02fadcbd25b836c924e936ce7d7ee0c2a
SHA512 6394ddabc7ad03895ecddb9943371935e0a2320e933b380a563eaf03d1a039c7180aee763834170c85485416b1af38b55c1dafff7311b25513369b01dce22598
SSDEEP 49152:CcWYPM4G6kaHqcHCgrZi5C9xh0UsWLgiHesm2qCUD/yNWYxtYtUkjCKf462gQkAD:TP
MD5 SHA1 SHA512 SSDEEP

Submit Download

CefSharp.Core.dll

Path C:\Users\Admin\Desktop\Wave\CefSharp.Core.dll
Size 897KB
SHA256 636f8f865f23f2d47b73f3c16622e10b46437bbf7c89b0a2f70bae6129ab046a
MD5 16f8a4945f5bdd5c1c6c73541e1ebec3
SHA1 4342762c43f54c4caafaae40f933599a9bb93cb5
SHA512 04115c425c3015ee4355cde2a6e5e28ec24745ea77761a40c0986b54dc14bc67cb142986988d79df87e75ea54d21ded9384842e01cf0714b84f7378e6a13400d
SSDEEP 6144:cJXlLt6r1zItQCtpf/Xg8HnJQvq6qea0zWEmjBZre7W0vnlYviqJ9/z8+irWGvgc:c5lLtg8/XIPrsNZ0Kiq8uhtt
MD5 SHA1 SHA512 SSDEEP

Submit Download

CefSharp.Wpf.dll

Path C:\Users\Admin\Desktop\Wave\CefSharp.Wpf.dll
Size 114KB
SHA256 8507a4662220eca49d7d511183be801cd394f13dc0e9898c55361020fe9a4720
MD5 36946182df277e84a313c3811adac855
SHA1 bcd21305861e22878271e37604b7b033ec347eb3
SHA512 80b1e947b1940dccfe5be8a1ba1e8c1d9eacb122d73724a21233164f5b318fa57c249256f621f0f9c1e6a9e4c902eec58827bb899e20f2990f4ade1d685f1abd
SSDEEP 3072:tvd969S0dZqKLfGlAW9mLGKOiGfiVmVgGs0COe5w5tnR:tvb69SSZqKLfGlAW9iGliAVgGp3t
MD5 SHA1 SHA512 SSDEEP

Submit Download

Injector.exe

Path C:\Users\Admin\Desktop\Wave\Injector.exe
Size 3.4MB
SHA256 443b665c5f545a2bdd7855f86bf70a5ee7f35eda1b6b08615161f5809cbda02b
MD5 c6b39ee166d5b0a2c8a9021ccd1593ae
SHA1 e480e7c282f64e8b0179c82afe154dd59d14217d
SHA512 3864aea36c522ca5658412128e6a4c862a647cf3b1054b9adbe418488590a37600d7639c3eba94ca9de76f087b244b95644c667213b1122889cf2d9b7a4652d2
SSDEEP 49152:Kl0nJ28J4VZohYWVGGjW8NhSU7zwo8oXJ2R3KPHsI7coj2J+eNgRpqNc1a:KmnJrJ4DohYWVTJNkIZZ2R6vsmA+FDqN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Wave.exe

Path C:\Users\Admin\Desktop\Wave\Wave.exe
Size 7.0MB
SHA256 2c51f67e236cf95e2d51df4178699da09869ab077924cff0b3df1c512878ef2f
MD5 a8bd4a6b2f1d00928e61870a5688c13d
SHA1 e17646d5279534f2e3eb0e0cfc8b6c536bc0c095
SHA512 6b5175beea4071668c87b16af3177bbb2cbaff6b28909dc1e09ad5b16b449c62d6adc372a0094de627fe9835f0c474d16708c3f698355ba1664bf321fa19f5fb
SSDEEP 98304:37//YITF8r2n8TevxbFKVlXk34tZ+t4+aNG5Lhd+2G4Op0cN+hmdYkvsFLL:37//1xBVqvG5dQ2m0cN+hmdYkvsFLL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Wave.exe.config

Path C:\Users\Admin\Desktop\Wave\Wave.exe.config
Size 4KB
SHA256 50bd62b7fa97cb9564c4b418034138f30af993f84988b085e2b16d39aa74d79f
MD5 ae882f91fe4dc052fabd06774b2d30aa
SHA1 92cbe5c66373ea3682116fab8068534920d281d7
SHA512 3fe7174259817beae8101e2ab7be068b9030bccff00a1f5aee13cfab3585037fdb1f9b470feea212351f85ec96f31da63289e4574d69e4ef413fce3fda3c6c78
SSDEEP 96:wrwvxwDbDPwxOuzhrifBUXAUFUkUYUvUAc:wrw2DIxOEriJXejNGbc
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_elf.dll

Path C:\Users\Admin\Desktop\Wave\chrome_elf.dll
Size 1.3MB
SHA256 9f455612e32e5da431c7636773e34bd08dae79403cc8cf5b782b0ea4f1955799
MD5 5b3802f150c42ad6d24674ae78f9d3e8
SHA1 428139f0a862128e55e5231798f7c8e2df34a92a
SHA512 07afbd49e17d67957c65929ca7bdfe03b33b299c66c48aa738262da480ed945712d891be83d35bd42833d5465ef60e09c7a5956df0a369ec92d3bc2d25a09007
SSDEEP 24576:LcTZORTcbxjPziCdLI3ovs8t8+oaOzjY:LcTZYTOxjPzJdEoNa+2fY
MD5 SHA1 SHA512 SSDEEP

Submit Download

index-daab.js

Path C:\Users\Admin\Desktop\Wave\dist\client\assets\index-daab.js
Size 3.4MB
SHA256 66909b895c0b86eb1edaf95c0d728939a4986f01bf5112023bf52a6afc021155
MD5 a19bf5e804004e0397a4547f9a8568fe
SHA1 daad35851be0986f1a99f5563976309c2f7fc800
SHA512 2e98dedf48e2f16543ef28cdfad832f77a6250f6e71cadd2245e58aa4872a91934f390ad8552a1c59b035ead123904b95c31a1fb3d7ba3dbf49968b018755c5a
SSDEEP 49152:0BVV1PF11UPEowhmFyoSLsr+Wo0bYFEkAu8mHyXsLnFian/rDVslultWDjuOdXTD:g/+a2fB
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcef.dll

Path C:\Users\Admin\Desktop\Wave\libcef.dll
Size 204.4MB
SHA256 e2f3d912e2fa54b2d29330202bfb98394a3086aaff800417e382f772a6b07922
MD5 3f1e12a06149b68ec7ea58486413aac5
SHA1 b5ee4bfb76e53cb50cf0ca9da43659cc67454b12
SHA512 23d45229285bbbdf538fa03e050bd2b6815e446c602c86603b13b0dbb6811d5fe40711f46fd34bca9efbb17af3ab38d466161903b65798400d3ffc24b8945062
SSDEEP 1572864:h90gHOgkN8SpQTT/PG4iRa592G7eZy1aQ3+PcToCptZjUicMTyDBlT5vOIZaJ/Cd:XgNEJ5Ajoq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Wave.rar

Path C:\Users\Admin\Downloads\Wave.rar
Size 157.0MB
SHA256 1ca93fdcc11135777684369edc2bb27d287ffa05d09533c69107e88c153d96c2
MD5 6e2e65438919ca25acc9a35c17260bbd
SHA1 dbecdb58b4141b96fd0866e36b8c8e3c9a4df758
SHA512 89d67b1df8199a0dd91a008cf2b338e22dc843c05b4d4e46360aa09eeb160a9c13bef11eab652e5c0fe97967e910579673eff81862a0590560cdc85fbc9aac8d
SSDEEP 3145728:04FILwoAcr1Nu8WhoUdp27PkF5oeUahBcPVyMVob2f9/nvF2ILW:9oHhioU72TkF5oeVBMXfhnZLW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Wave.rar:Zone.Identifier

Path C:\Users\Admin\Downloads\Wave.rar:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

memory/664-1353-0x00000206FCE90000-0x00000206FCF76000-memory.dmp

Download

memory/664-1357-0x00000206FCF80000-0x00000206FD141000-memory.dmp

Download

memory/664-1366-0x00007FFCBA9F0000-0x00007FFCBB4B2000-memory.dmp

Download

memory/664-1348-0x00007FFCBA9F0000-0x00007FFCBB4B2000-memory.dmp

Download

memory/664-1347-0x00000206E1EC0000-0x00000206E25C8000-memory.dmp

Download

memory/664-1349-0x00000206FCCA0000-0x00000206FCCB0000-memory.dmp

Download

memory/664-1351-0x00000206E4260000-0x00000206E4284000-memory.dmp

Download

memory/664-1365-0x0000020680000000-0x0000020681000000-memory.dmp

Download

memory/4480-1320-0x00007FF7910E0000-0x00007FF791A40000-memory.dmp

Download

memory/4480-1318-0x00007FF7910E0000-0x00007FF791A40000-memory.dmp

Download

memory/4480-1317-0x00007FF7910E0000-0x00007FF791A40000-memory.dmp

Download

memory/4480-1319-0x00007FF7910E0000-0x00007FF791A40000-memory.dmp

Download

memory/4480-1316-0x00007FFCDE700000-0x00007FFCDE909000-memory.dmp

Download

memory/4480-1315-0x00007FF7910E0000-0x00007FF791A40000-memory.dmp

Download

memory/4480-1322-0x00007FFCDE700000-0x00007FFCDE909000-memory.dmp

Download

memory/4480-1321-0x00007FF7910E0000-0x00007FF791A40000-memory.dmp

Download