9bc4a3a6d8703225b3433a5a67c6f4321e49d70ccedbbe3ac122dab331f1e6e3

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/04/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Wave/Wave.exe
Size 8.5MB
Sample260416-e4dl1sax4x
SHA256 9bc4a3a6d8703225b3433a5a67c6f4321e49d70ccedbbe3ac122dab331f1e6e3
MD5 f75863b754f9a4d393f98c1734e3d091
SHA1 ac131b494c296a465a232eb0ee2e4b447f487921
SHA512 9e2298309bd3d851f0a61f5e534b4f278e9b75491601627c8c7240b9eba66e0ecbd09de9dcb9d463d3dd4f24b6e78b7b37ed912db6dc08c14e1f757723a8f5b2
SSDEEP 196608:vGVF5MZhgMNv/dfXPl7OtttdTpY7A8MLybhZ0zLXv2Yrt3KuBbSWxzHKo+r8THXg:vWXMPNXd/hkvTp8DbL0zr1K+bSWxzHKV
TLSH
T12296232467E85663F5BD5776D8714992D7767E0A2A0BA38F2924389C0EF23C1CF32217
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2004	Wave.exe

Loads dropped DLL 9 IoCs

pid	Process
2004	Wave.exe
2004	Wave.exe
2004	Wave.exe
2004	Wave.exe
2004	Wave.exe
2004	Wave.exe
2004	Wave.exe
2004	Wave.exe
2004	Wave.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Wave.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Wave.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
5772	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 48 IoCs

pid	Process
4196	Wave.exe
4196	Wave.exe
4196	Wave.exe
4196	Wave.exe
4196	Wave.exe
4196	Wave.exe
4196	Wave.exe
4196	Wave.exe
4196	Wave.exe
4196	Wave.exe
4196	Wave.exe
4196	Wave.exe
4196	Wave.exe
4196	Wave.exe
4196	Wave.exe
4196	Wave.exe
2004	Wave.exe
2004	Wave.exe
2004	Wave.exe
2004	Wave.exe
2004	Wave.exe
2004	Wave.exe
2004	Wave.exe
2004	Wave.exe
2004	Wave.exe
2004	Wave.exe
2004	Wave.exe
2004	Wave.exe
2004	Wave.exe
2004	Wave.exe
2004	Wave.exe
2004	Wave.exe
2004	Wave.exe
2004	Wave.exe
2004	Wave.exe
2004	Wave.exe
2004	Wave.exe
2004	Wave.exe
2004	Wave.exe
2004	Wave.exe
2004	Wave.exe
2004	Wave.exe
2004	Wave.exe
2004	Wave.exe
2004	Wave.exe
2004	Wave.exe
2004	Wave.exe
2004	Wave.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4020_1808008492\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4020_1808008492\manifest.fingerprint	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4020_321911494\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4020_321911494\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4020_321911494\manifest.fingerprint	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1284	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134207874388980282"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3876	msedgewebview2.exe
3876	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
6128	msedgewebview2.exe
4020	msedgewebview2.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4196	Wave.exe
Token: SeDebugPrivilege	5772	tasklist.exe
Token: SeDebugPrivilege	2004	Wave.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1212	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4536	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 6128	4196	Wave.exe	79
PID 6128 wrote to memory of 5092	6128	msedgewebview2.exe	80
PID 6128 wrote to memory of 1420	6128	msedgewebview2.exe	81
PID 6128 wrote to memory of 1420	6128	msedgewebview2.exe	81
PID 6128 wrote to memory of 1420	6128	msedgewebview2.exe	81
PID 6128 wrote to memory of 5724	6128	msedgewebview2.exe	82
PID 6128 wrote to memory of 5200	6128	msedgewebview2.exe	83
PID 6128 wrote to memory of 5200	6128	msedgewebview2.exe	83
PID 6128 wrote to memory of 6044	6128	msedgewebview2.exe	84
PID 6128 wrote to memory of 6044	6128	msedgewebview2.exe	84
PID 6128 wrote to memory of 6044	6128	msedgewebview2.exe	84
PID 4196 wrote to memory of 3040	4196	Wave.exe	89
PID 3040 wrote to memory of 5772	3040	cmd.exe	91
PID 3040 wrote to memory of 3208	3040	cmd.exe	92
PID 3040 wrote to memory of 6116	3040	cmd.exe	94
PID 3040 wrote to memory of 2004	3040	cmd.exe	95
PID 2004 wrote to memory of 4020	2004	Wave.exe	96
PID 4020 wrote to memory of 5308	4020	msedgewebview2.exe	97
PID 4020 wrote to memory of 4060	4020	msedgewebview2.exe	98
PID 4020 wrote to memory of 4060	4020	msedgewebview2.exe	98
PID 4020 wrote to memory of 4060	4020	msedgewebview2.exe	98
PID 4020 wrote to memory of 5624	4020	msedgewebview2.exe	99
PID 4020 wrote to memory of 3652	4020	msedgewebview2.exe	100
PID 4020 wrote to memory of 3652	4020	msedgewebview2.exe	100
PID 4020 wrote to memory of 1372	4020	msedgewebview2.exe	101
PID 4020 wrote to memory of 1372	4020	msedgewebview2.exe	101
PID 4020 wrote to memory of 1372	4020	msedgewebview2.exe	101
PID 4020 wrote to memory of 1712	4020	msedgewebview2.exe	110
PID 4020 wrote to memory of 1712	4020	msedgewebview2.exe	110
PID 2004 wrote to memory of 1212	2004	Wave.exe	111
PID 1212 wrote to memory of 4132	1212	msedge.exe	112
PID 1212 wrote to memory of 1284	1212	msedge.exe	113
PID 1212 wrote to memory of 4424	1212	msedge.exe	114
PID 1212 wrote to memory of 4424	1212	msedge.exe	114
PID 1212 wrote to memory of 4424	1212	msedge.exe	114
PID 1212 wrote to memory of 3648	1212	msedge.exe	115
PID 1212 wrote to memory of 3648	1212	msedge.exe	115
PID 1212 wrote to memory of 2732	1212	msedge.exe	117
PID 1212 wrote to memory of 2732	1212	msedge.exe	117
PID 1212 wrote to memory of 5084	1212	msedge.exe	118
PID 1212 wrote to memory of 2732	1212	msedge.exe	117
PID 1212 wrote to memory of 5084	1212	msedge.exe	118
PID 1212 wrote to memory of 5084	1212	msedge.exe	118
PID 2004 wrote to memory of 3012	2004	Wave.exe	120
PID 1212 wrote to memory of 1668	1212	msedge.exe	121
PID 1212 wrote to memory of 1668	1212	msedge.exe	121
PID 1212 wrote to memory of 1668	1212	msedge.exe	121
PID 4020 wrote to memory of 916	4020	msedgewebview2.exe	122
PID 4020 wrote to memory of 916	4020	msedgewebview2.exe	122
PID 2004 wrote to memory of 5376	2004	Wave.exe	123
PID 1212 wrote to memory of 5800	1212	msedge.exe	124
PID 1212 wrote to memory of 5800	1212	msedge.exe	124
PID 1212 wrote to memory of 5800	1212	msedge.exe	124
PID 2004 wrote to memory of 4624	2004	Wave.exe	125
PID 1212 wrote to memory of 3004	1212	msedge.exe	126
PID 1212 wrote to memory of 3004	1212	msedge.exe	126
PID 1212 wrote to memory of 3004	1212	msedge.exe	126
PID 4020 wrote to memory of 3876	4020	msedgewebview2.exe	127
PID 1212 wrote to memory of 2264	1212	msedge.exe	128
PID 1212 wrote to memory of 4844	1212	msedge.exe	129
PID 1212 wrote to memory of 5052	1212	msedge.exe	130

C:\Users\Admin\AppData\Local\Temp\Wave\Wave.exe
"C:\Users\Admin\AppData\Local\Temp\Wave\Wave.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=4196.3116.2490378714665621978
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:6128
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x100,0x7ffe42eeb078,0x7ffe42eeb084,0x7ffe42eeb090
    3⤵
    PID:5092
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1716,i,11688543821170534983,6958783681982913314,262144 --variations-seed-version --mojo-platform-channel-handle=1672 /prefetch:2
    3⤵
    PID:1420
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2012,i,11688543821170534983,6958783681982913314,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:11
    3⤵
    PID:5724
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2292,i,11688543821170534983,6958783681982913314,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:13
    3⤵
    PID:5200
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3532,i,11688543821170534983,6958783681982913314,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:6044
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\WaveUpdate_c8ebf2371c524b87bebff5c7915728cf.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "PID eq 4196"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5772
- - C:\Windows\system32\find.exe
    find "4196"
    3⤵
    PID:3208
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\AppData\Local\Temp\WaveUpdate_4490c7784ada4ab78f97bf7e345797db\*" "C:\Users\Admin\AppData\Local\Temp\Wave\" /S /E /Y /R /H /Q
    3⤵
    PID:6116
- - C:\Users\Admin\AppData\Local\Temp\Wave\Wave.exe
    "C:\Users\Admin\AppData\Local\Temp\Wave\Wave.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2004
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=2004.2952.11933938760682692501
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:4020
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x174,0x7ffe42eeb078,0x7ffe42eeb084,0x7ffe42eeb090
        5⤵
        
        PID:5308
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1772,i,10836929986270658107,11495780577083585153,262144 --variations-seed-version --mojo-platform-channel-handle=1768 /prefetch:2
        5⤵
        
        PID:4060
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2000,i,10836929986270658107,11495780577083585153,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:11
        5⤵
        
        PID:5624
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2288,i,10836929986270658107,11495780577083585153,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:13
        5⤵
        
        PID:3652
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3452,i,10836929986270658107,11495780577083585153,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
        5⤵
        
        PID:1372
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4212,i,10836929986270658107,11495780577083585153,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:14
        5⤵
        
        PID:1712
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4664,i,10836929986270658107,11495780577083585153,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:14
        5⤵
        
        PID:916
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4700,i,10836929986270658107,11495780577083585153,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:10
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://getwave.gg/resellers
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1212
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffe2b3dc188,0x7ffe2b3dc194,0x7ffe2b3dc1a0
        5⤵
        
        PID:4132
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,7184454773955212103,9075879750552049694,524288 --field-trial-handle=2100,i,15424783899952053350,3643428954977451413,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:1284
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,6982613823371551223,17738948115451629926,262144 --field-trial-handle=2100,i,15424783899952053350,3643428954977451413,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:2
        5⤵
        
        PID:4424
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2232,i,3081705082044058282,5694409809297338926,524288 --field-trial-handle=2100,i,15424783899952053350,3643428954977451413,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:13
        5⤵
        
        PID:3648
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,7038905200815593381,8707454443434013572,2097152 --field-trial-handle=2100,i,15424783899952053350,3643428954977451413,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
        5⤵
        
        PID:2732
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,5879919162560794017,11708379064416901677,2097152 --field-trial-handle=2100,i,15424783899952053350,3643428954977451413,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
        5⤵
        
        PID:5084
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4784,i,15178054155740565448,18151450566452392952,2097152 --field-trial-handle=2100,i,15424783899952053350,3643428954977451413,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:1
        5⤵
        
        PID:1668
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5116,i,4214178753672364278,6028476432754001042,2097152 --field-trial-handle=2100,i,15424783899952053350,3643428954977451413,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:1
        5⤵
        
        PID:5800
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5356,i,8490738693826939322,12294440497536762575,2097152 --field-trial-handle=2100,i,15424783899952053350,3643428954977451413,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
        5⤵
        
        PID:3004
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,5631924949908742507,3032065472996773120,524288 --field-trial-handle=2100,i,15424783899952053350,3643428954977451413,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
        5⤵
        
        PID:2264
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,15652849741927089831,5355350616340145038,524288 --field-trial-handle=2100,i,15424783899952053350,3643428954977451413,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
        5⤵
        
        PID:4844
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,9430592540086900255,6142470632306177694,524288 --field-trial-handle=2100,i,15424783899952053350,3643428954977451413,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
        5⤵
        
        PID:5052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://getwave.gg/resellers
      4⤵
      PID:3012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://getwave.gg/resellers
      4⤵
      PID:5376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://getwave.gg/resellers
      4⤵
      PID:4624

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\437c37727f3c43399a3f2083d4ae9b2d /t 4192 /p 4196
1⤵
PID:1536

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4536

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2140

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ea750b8ccfa8d7c7a393cdf6c9c8a3be0f2f086fb814bb44905a02c83d9af71f
MD5 697a394c9a3ff43b8925489b648b073c
SHA1 5828315de0bd17378051f664204bff07d8659dea
SHA512 37519d78554ef3947030bf7fc74d2660bf2dc752f04de85daef8079fdce335d2e6ad77071de5a938f7422ad0bdd2acad3963260b61149fc0d91381c007a2514f
TLSH
T173D080115FF27C70D014E8F694187B413A3DA8A68D43A61154B1EA7E4C624D48FD0FE7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9cf5acc3a4797f1d8e969ab1970c2330530e33f7dac25d2b42a810961a67ea68
MD5 6bbadb85852ef58796e988ee6bd3abc6
SHA1 f87a8c99cc4052067a5b532f97bd1ccc92f6a0b9
SHA512 a3813b64d663d976b681f2ced98d428dc47f49c99219d4a147277e7c8375b07692a5a14501eee0df77c86f9da6e3205c49e89510005d4f3b21e3afff243fb088
TLSH
T13CD080155FF27C70D014E8F694187B41392DACA68D43A6115471EA7E4C224D48BD0FE7
MD5 SHA1 SHA512 TLSH

Submit Download

f_00007a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a
Size 47KB
SHA256 881216bba7508196a59da459694f4e32192a344096c999087e978835a312141b
MD5 01f7684d43fe027a617bbcf1b92a46ec
SHA1 64d124eb81141a63aef3703b2da60b0c91ba335a
SHA512 4cde8832a5fdec06d1bf3666de86639fc2519d1a392d62165a3d08df84b232b4246d3025dae91e22bb516de84f924db18212531ddf03d5dbeb92753476ff1042
SSDEEP 768:IIkDHBYoX5Pi4JxTGz9CDR0s1ROSsA8mF77YNt7wFhVq9oN2WfpdqWjBD:2NYoX53xTl/R8W77YNtUFrWoUWvdD
TLSH
T1FF230251F5F8624A7FC3003FBC317BD862909FE5996EE5D91288F30225611DD29EE017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b
Size 35KB
SHA256 0bdfc0c991b7b72ef34722867cf33b35f119434ccaba42c94d4507ea1f39e3c6
MD5 55f356321fe3eb9c22db575a7935b283
SHA1 893d29449c95fbdebd2be270d546d85bb3663030
SHA512 45845f76bcce19185c0a57a04dc309781084c3e2b7aacb74bc94282fd322f0472a24b42de3df8385aba2cf175a2c6567eba429d2bb706e46fbc3f5cb073db089
SSDEEP 768:X3wD33+TM0nFsHvcpBT5eRowmM/x2xHTx7oTUKtAtooUfU:X3wTcRnFsHU39NwxYz72Soq
TLSH
T195F2F2FC622EDE0A3FA92BF1D740D0BE276B2C827B18DB45C615847566AE8C55017DC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c
Size 64KB
SHA256 ebfdb77660da324d5fddd83843fb977aa1ee4bd830102285858b325b203c430d
MD5 6316823ecf554e914c29210bef1c6484
SHA1 30d3b48ed085af9b507add4c1435403b74449a76
SHA512 3205968357155bbe58c6465fc4ec6515ccc5da65a02e7f697f3ee198c27f7086423d95564b5612fc018fc587b0368609d9f318dbf5c91180f9c4ba24fa39a381
SSDEEP 1536:p16gF+zzF0BC18WhBNV9ASs2TfMLh3SWQXoamJPngh5I:p16A+zmBVYp9AS7TGc1mJPQ5I
TLSH
T12C53024536B2D10160C78E20AF45ACABF28125E87C4849CEF0ABE1A6DEC5D84DE5F3D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007d
Size 38KB
SHA256 d4034168cbb5dc880612f08b7c5b9db07fd8559e390f3d80672eaf6de928863b
MD5 971fe2282a18bc2b4b8c13a633636a8e
SHA1 13f478d52def33819c6d2a9c76ac58ec4cd4313d
SHA512 0e5334c8b140cb9bbfc63143c9c113f237e5b983cdb9357d9c10e4dd645325bddc61f7d3e1b6ce6c5e584757a58d8da23f360bab218693d9aa168c1eab4baa9b
SSDEEP 768:S61sIMyxuvOEBl8U74jPnr2Tb7x0fEsmHXYrnr/loKJZELUq:fIHBiY4jax0fEs0SZoKwUq
TLSH
T16003E2A0195C67CFB38C0D5B1C08DA5816A08AAB698ECE56636AF1FC045F06CD355DFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007e
Size 88KB
SHA256 ebe888c3cbc5fd758c734c87e194ed5347442349a5db905c3748b8a99289cff1
MD5 0a38685c4526871dc9e4f7df6f73fa4d
SHA1 260973966a8b37cb741ddec8d791c87b06c53c2f
SHA512 409633f0b3f0c3e0ab8daf6616e9f006f15cbca3e433bc69313ca8ba02aeec883942aa0ab17cad7eb993f1b253235fc4dcc0a30fe6c8c925acfa09c1f176b6ad
SSDEEP 1536:2cOPjz70dUJiSoKu7Q9r/jQ2D2v5ux5p93PugZ1+ISmBFT787S+QfDHT3:y70eiSoKuIr/jbmY5/3PdZ1lksT3
TLSH
T1E293D001C2135FE2C668873BA6490FA4B339436B8B9B572A073BD13D7DA07B58DB6750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4a798d069e01c5024f1181b0cbc7de16cd17e926162fc61c2ca6e963024738ab
MD5 dc6193820fe56adb05fc39e7146099ad
SHA1 5baa76fc24566b749c7189e0f425c6390bc48cb0
SHA512 8f1a7d85db85648332e1a1780f19201ec881d53c986cd28ee03b579a967a5b6357cf38870c6a06f0369a3c969a8881d024589d31b2331775b74d862d5fd7ff98
TLSH
T1F181B8C45187E027E3E784BA46FD1053B2347A6B44F7FE6796E4963C4FCAB12E08A814
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a2442.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a2442.TMP
Size 3KB
SHA256 a62119d0c501e421da599a810bba9c98273e12b1e771e3d1b9a394616b600f9e
MD5 cfa267a27a19609045698926da10657b
SHA1 f466385e425dfc5832c052b84e65b49cfe83022e
SHA512 458686b18a38d302beaf0172bd16a8dc775284eb7fe6a02fa0e7580db8a68fde9b594d90ea62daa4b02ed6f838e88f66b59d1315d995cdaca4d7c48c685a587d
TLSH
T13F7183C421D3E427E3E784B456FE4057B2347A4B44FBBE2716E5863D9FC6B16B08A424
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 041cc803f7eca0470c8c68a94680d60b9ca981f278da66d37b0e2191dc0b6fda
MD5 e68a4f73bfb1f28d1a10d0ffcede62a3
SHA1 8294fc3f230ddff9093460c1a8a5bacc3371886a
SHA512 84057e62c1b3efc618ccae78aa3a41affa62eda9af7df445248fbe0f62c32ebdfa8866f5d3a5e3147dc83488768f102eff439885abbd973801a1d02a18f9334e
SSDEEP 192:sxZdRKUyMqZ/K1Ml8Mcw/f6saYJ3uH/ILcdzodpbL/W6+WNRv3tZY0lizkIgjMJ:sxZdcN0w/f6sZJ3uf32v/bPZ5njw
TLSH
T19B62E946AA3859778CDBD219FA45BF53D7F9156292804E449AFCCB0C04E7BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 267f199f9d6a6a49e28411e29d05e2f58dee0c4a95c0629bd30f7497cd15afda
MD5 533e5107afd7d5c129ebcaa02ac7e658
SHA1 f0f4bfda598aa960e1d6461d83f874c49a1a9e00
SHA512 c33de6def327251941d0ca67ef0f684b6850ac008ef8b211d3156b3faa6270c11126cd753cf673a7e9599b03364ba4650a1a8a9222dd1fc06f05db07f7c1565e
SSDEEP 192:sxZdRKUyMqZ/K1Ml8Mcw/f6sIYJ3uH/ILcdzodpbL/W6+WNRv3tZY0lvzkIg5WMJ:sxZdcv0w/f6sPJ3uf32v/bPZ5SYw
TLSH
T18172E846AA3859778CDBD219FA45BF53D7F9156292844E449AFCCB0C00E7BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 01d85454cd1fedd150f786fffc3d5ecf5c0dbcf9dfa6e14fa3b049dd614fee3e
MD5 0aeab5dc81881d243a8404d1f461b799
SHA1 928435932bb6dff48280f98c95da79794e6a6963
SHA512 6c55ac857ec7e95c4e1e898634c466f0e2340eaa8fc20c0b5647fb9eb35d413e7f770d73cb22715b9e523873cb61a80bd942267ac835db0b435d7339651f6901
SSDEEP 768:EmN9b8PT24f7pLuL/CuWRmCCQx68F1+UoAYDCx9Tuqh0VfUC9xbog/OV3Q7yZLlH:EmN9b8PT24ZE/CuWRmCCQx6u1jaKQ7yr
TLSH
T1D0032B3B280CCB7E4F804E9CDD26BE8E7DE801CB9698899447FA844C03D66EF45165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 f74264d1da45035fd072f9e7f9ae59bb9de78441fc916160b92a56b977f7ed96
MD5 7ae6d67229a583c9ae632b5dd014a4a8
SHA1 64926df23bf50ccd711ad1842252cda61043b567
SHA512 7c0577fd1851ac713f4835faf141f346e352a958d3f730f5211b3beb892cbc0e991dd941ff63c8052dc1fda653fe23961e92d95ae13f84e944e086e0cdab9e5c
SSDEEP 384:niiFxvqMVv8NY8TUNTUlIRY4dPNdP214f1KLLLp//iZni40UrN1k+5vI+GN:pFxyM3wgnJRKjRqti4xSN
TLSH
T150B23971E8A8CEA7ACEB8BC9F75A7647DEE00163998C4ED4D6D81E0D00971DD170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 dd78c304cd1fc9631ae054b54a92984935860c6872d79670a437ca6ce01b82ed
MD5 3903fdb2af41779763a05da4847c9ac8
SHA1 9e6270c7d11ebe323ff544f577f22a76f6894931
SHA512 7337a9fbfb7e521851ab0c79b72627245d710bbf1df6cc1cb45a1d782195f720706ddbd10d595a91eb4d0cfd2ad232b19a2005846eedca31f47a37a749c8723e
SSDEEP 384:ndiFavqMg38NM8TUNTUlIxB4d45ugK14f1KLLLp//tZ3Ra4mprN1k+5vI+l:UFayv3HwgLQglKjR1Z3RaT5
TLSH
T19CC25C75EC58DEBBACEA4FC9A7197607EFE00163959C4AD4DAD82D0E00D719D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 49526894725443e646b67e0b54e59bdbbeca56d6e286231a82ac8336b8aa586d
MD5 8a4113cb8daccfa46191de34588e3aa7
SHA1 1ea586fa936524d420449050a73c5f60e7bda088
SHA512 401fa342aaef2a699fa8f60d9bd506750a55b5985601e4e3cc94fb61de60803a4143ed6ec94ed2f926113ce54001d26dd862ccce86c35ade20c7e61fc5c98a22
SSDEEP 384:n3iFavqMg38NM8TUNTUlIxB4dFnV14f1KLLLp//iZnj43Ra4mprN1k+5vI+l:yFayv3HwgeeKjRqtj43RaT5
TLSH
T1D9C24A72D858CEA7ACEA4FC9F75A7A43EEE041A3998C4FD4DAC81D0D009719D170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d6d24eeacae0edb997e4b402ec088cce687bddd8db70d19169e9e62a0eee75db
MD5 1e1bcbc3bd2bc5907ad063eb6af4e832
SHA1 fdcab33b65486a76c82344a770e8d34887318381
SHA512 ae16743a9f6804a11a4729cae7cc240aa53bd0ecb46a8d46dffea1d624cde04298a198e491fab9ff4710486920b59c5454d62f9e641c569089b4e0ebeb59f0e7
SSDEEP 384:niiFavqMsm38NY8TUNTUlIRH4d3Qdu14f1KLLLp//iZnj43Ra4mprN1k+5vI+A:pFayTm33wg9zKjRqtj43RaTU
TLSH
T1E4D24B72E868CEA7ACEA4BC9F75A7A43EEE05163998C4FD4DAD81D0D00971DD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 4015d63cfe04b20ccfbf72b293073a7cc9c00a8b2cb1fb2c3a7e7696f5ed467b
MD5 3a8ff3b83e0a6a1b5ec1badcf0b66a4f
SHA1 f2309600636a656eb4873e6e1034355c9f97fa3d
SHA512 980ae6b9de0d95d4ff3ea6f44f753c1760b684394546695b3f09ceb85a566c83aedf296954f7498ec00cd0cc1d0e85a557eedb032e42e35e638d1845ec1742cf
SSDEEP 384:niiFRvqMp8NY8TUNTUlIR54dbidP214f1KLLLp//iZn340UrN1k+5vI+GN:pFRyI3wg/JRKjRqt34xSN
TLSH
T13FB23971E868CEA7ACEB8BC9F75A7647DEE00163998C4ED4D6D81E0D00971DD170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 1b1f1e313986e4e900751bd992ee8dcb3197fe08f7386891e37f90d815ce19f0
MD5 ea84ddf3bd98db53bf8b5101972d55a0
SHA1 f56b9e3fcdec1fc567bf3b1fcd90dd2d7d330846
SHA512 80ae3d163f18899eda74ee46dc86ba84a0ee6dfb4ea5c6fbd4d385eaeb42762ed918fc33153c793eab87115be231f2a452ab74a02b1cb8c17b687ebf95caee75
SSDEEP 384:niiFwvqMO8NY8TUNTUlIR54d3Ldi14f1KLLLp//iZn340UrN1k+5vI+GN:pFwy73wggPKjRqt34xSN
TLSH
T1D0B23971E868CEA7ACEB8BC9F75A7643DEE00163998C4ED4D6D81E0D00971DD170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 22KB
SHA256 91c348f1dcf90d5eebebca1c91027315c80821d357a8f5231f857ee5dca86f48
MD5 e218ba795cf0b6ae5c2aef1033e0b8af
SHA1 d3637d415688af6b98fd79bdea30d20d1fc0ccc2
SHA512 49fceefccc1d668f9a962bbbad6b68c98ec1dffd39c26e755493649a97dfd7c080b805167e6e8fbc4df999ead64768dedb2982035dedbba8837c6815d9ab1d01
SSDEEP 384:1JWJLVca12krtuJ1dpmXmlJVjeQ8RJoKCGghsjUFAWA5P5m5/i+GDa50HSCYAVQx:D+LVcWrsbl8RJh5gyjUFA56q+GDa50H+
TLSH
T104A25C743BF41719F3B69F759AF1A95A653AB866AC00DB4D0122028D0937D92CDB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wave.exe

Path C:\Users\Admin\AppData\Local\Temp\WaveUpdate_4490c7784ada4ab78f97bf7e345797db\Wave.exe
Size 8.5MB
SHA256 1d6755b8a73bf46179e26cb3cde2d1c88f0e5abdfb47292de1741a105af25e1a
MD5 66c1385d40a31cbb6f125159769942e0
SHA1 06a21d717064831891f0e0de4fef7e75aaaddc11
SHA512 781c5c7a1bb2eec76d395079341f3e67a3b4e1f0dad4115feeccab189e01f5b7465a7f46f9dcf153dae032f2d4b468546914a7de6ae8dcac73f99ab8a83469b9
SSDEEP 196608:QtzWXlsSh2NBf1a64g+FOvn+Y3+4kXuUmcK1G3xFmkGs3BwU6aNzVCweEpmmXU28:yzsmS21p+FebcK1G3xFmkGs3BwU6aNzc
TLSH
T18996232413D856A3F4BD4779D4754852EBB6BE1A7B0BA78E341838A80FB23C5CA71347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WaveUIAuth.dll

Path C:\Users\Admin\AppData\Local\Temp\WaveUpdate_4490c7784ada4ab78f97bf7e345797db\WaveUIAuth.dll
Size 21.6MB
SHA256 b23756a0ec2efcb706de378d0ef71917c49ae059201d3881d5a699b47c423558
MD5 2ef9a7ed491edb1853cde76d970ccfa6
SHA1 7c0da384b9f4aff28e37f14c3d2e09742a557470
SHA512 d1c266b6419a4ecb830bc3b60f1a93a9e8dd4f2515c2726652431ef7e466a9ebe656bd73d5a818c7913c575da581bdd7c6ba47444fddd70df5a2a4bae3bcaa1f
SSDEEP 393216:dAO3ouELbN/CcGs7BLvvuZ5VrJWcsvlGxil:53EVKcf7BLg5+coGx
TLSH
T1683722D974E491ACC492C631E38A2BECF0D678494E79681BBFC709412A31D86CDB6D37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\Temp\WaveUpdate_4490c7784ada4ab78f97bf7e345797db\WebView2Loader.dll
Size 156KB
SHA256 4cd3ffd5f52122432b6537b360c2317f96650928c927bb3caa59d5807da573a9
MD5 daf9a81004a961e39650a0e2bafe233e
SHA1 62f863adbef09905c75f475cdd5ce68b0aaaf73f
SHA512 95f1ffa93b0c16fdbaf9eb2d9f9fdbe63b1946a7cea0e366a9c68fd4695a97c7681bf9e2b2f372c8ab6430c0a37cac733154e94b1d7a76cbfa3c1de340d5ce33
SSDEEP 3072:8nVs+j4uIGieBiCIV6A9S4arvNQG/pTNgWEtJctHVA9rWt:gj4NCy6A9S4YcWEtJeVAk
TLSH
T174F34B5BB2E90077E17BC278C5A34A16E776B8111750AAEF036447791F237D0AE3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WaveUpdate_c8ebf2371c524b87bebff5c7915728cf.bat

Path C:\Users\Admin\AppData\Local\Temp\WaveUpdate_c8ebf2371c524b87bebff5c7915728cf.bat
Size 683B
SHA256 5333839a7c33beffa5562afb842b61bdc6ae189cb253ff516d0ccc9de876f726
MD5 07d6e7709f3605df063268e0f3ed1199
SHA1 1cc1335566dbfe6bd283998b6d528181a51193dc
SHA512 3b4c8a682955634cc5bcfb345b0a1f130c25ccb8ac6a2de0475aa4f2be41fdcf448fecf9cc9485a2603f58913e6b5e4679b0772175e971ff20a320b741794ffe
TLSH
T1E7012862308A5DC504104F4F07AD9B08DF6FC88F2F0F660D55B5844D322E5077A94DC5
MD5 SHA1 SHA512 TLSH

Submit Download

24792006-a738-4e96-a04a-b55d11e8a386.tmp

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\24792006-a738-4e96-a04a-b55d11e8a386.tmp
Size 1KB
SHA256 2a7ddd85ff68467e4796e7bd440eeb0deef1641dd3374bcdbfae2e3fa0a7f59b
MD5 694c22b599faadc722852c15588f3255
SHA1 8dcf65822bb0a3c4cb609795ed489a4be46ed6f5
SHA512 1fa133682bb26f74915a756e8dbfcc39d6206d6dcb9e23874d9fc829cc5e2b2834c62938ac09ae0b850012ea7482305ddb931ec8afba8224f605b97d4310d9c6
TLSH
T1C43187F3D4A46F775CD29401B1C766872E71107AD3204F4866DE8B1D05E738CA22AC32
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 776b0fd3e6af30e253479361014a774ee5d7ba2347aad102bdb0e5e59dc583f1
MD5 a139d8358e7d358fe41e806ee7f9041a
SHA1 049badeda5abecd1e163cb48d245b7a54ea12dfc
SHA512 8fdaca0f5c32f3723cc55f683ae17cf46caa669c66458e93ba51cbc3127d42071203c21f003d1dadbdb60974dbdd98391eb25ffa7872f33f2bb6f01c8f9521ed
TLSH
T15ED00454DD040714C14015770111475C05005700710101100050300D4DD41451047540
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 da8445f04e692764009eab55ec86eee275d062f8e8efeccb1c3204e3d221fddc
MD5 4462dd55d011b5b51fea1da369c405b3
SHA1 502462bb26979f2af7b89774b53aa1afd94657a7
SHA512 76e0d775a0998ab0606e832b07f6b994a89bd6225d01d4b4c70389b7911aeed06b4adbd82a99dcd633939d2672c26ede45ed9d016ffba7cfc26a057afdc1be0d
TLSH
T1D0D02B5B35120F34C45038770202A34D3D10D30A904380010C2B600F8FB40D23AC7A84
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 64bffb2f32bbc09850066ef7d2ec937d75eef244d3a2ba5b3c3f8b0613afe46c
MD5 da422d9e53e352c611cae90537867ff8
SHA1 025115bc05f2ab9fbb7f049a61613196eb7d7440
SHA512 a1f81a31a5558926e28ffe60f60aa890239021ae541a50bb590a6bfd336d89ea11202fe62198ed8a88bd9ae4c5027bd6735105e29fb886ba67dad27e0d46c19c
TLSH
T1C1D0C03B66324F34C0B03E3B0083D14A3E64920A9483A2120C56510F0DB00C32FC3384
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 8e1c05734b15afa3da43bff3d0ddd6b846995ecf7341089bfc266ced5a7ef431
MD5 47dcc7ef615d9fc9a28caecb2ba0d056
SHA1 a175b427de7fec6d1c4ffdab83133a4a48b0d69b
SHA512 eff8c700271a0b38729f4137d0e49b8bfc588cdff4c6c62df88bec91337de44b8d97906717c7044a4b62f4d649feba3d057f19660cde3989d00bfe818e295ab5
TLSH
T1D2D012167A010738C01025730103664C0800D30B910540005428A51E5F580941907881
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 1b74a4d2a1cacb6efc3e92d82161434c5229f11e150654acd7898d40f030029c
MD5 39aa88b7d93b80eb95d5619e073b6773
SHA1 bb9891a7aadd6f2c321dad1547d73ebf00a3b18c
SHA512 b9611624fb0f4e94fd59730dc55242d6235fb0b53a762676cdd2af59f5337c5f79547981e5231154fd9387c2371d81d0e527d909a0accf41483ae6e6eedc44ac
TLSH
T1FAD0C03B6A325F34C0B03F3B0042D14A3F6491099483A3120C56411F0DB00C32FC3384
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 04d9ea253e6116822ab2d5aac3b03ba2dfb0d058f43443b132e15a5b0737a799
MD5 33db190aaaa6135a6cd0202d05b4ac59
SHA1 22104f7522dc7c40f2d4506a8828b2c60d8ea579
SHA512 e1864ffa18189eaeab50bd32fa0c578da5af4675e954cac55badc34fd556ebaa6d22d561059d9d0872b66818b42644a49b200b61980802142fc958eb45698ee8
SSDEEP 3:LstlNllkll/lE6/:LsX3lEtZ/
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 d8f19344828a50c16b0444f9006f21f8fa4aa74e251235bc269ad3214b74b9ad
MD5 9785a6747a51e404fb96aa1b836d645e
SHA1 4067333f923346096300530958b405ab11a2b949
SHA512 8f3fce871ff914e786feabb59916935f700c93707542d8ed7c926015cdcad6390d276bdd696ca40413aa0c2ea9eced7b57f504b2a32bc544d816b78b3e989acf
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 696B
SHA256 be71a3a4822b3d62f89bc0948c591eca6360b73daa520dd6bd4fdd7858d4c8cd
MD5 1ea22933069d6b69a7882f819a0835aa
SHA1 8ffba099c97752e4fe5aae7b9ade600b507a9177
SHA512 069ebaa78aebed1eb4d595fd264f6c766787394cf2814a250a557db258e4f2ee4a81ba6f582a164fc6093d2f6202690c98f48790b3235d5dc6fcedfa1e5a4dc2
TLSH
T1A701446B5AF5C608FB127DB125E0591277712293851F0B42C0C5C5FF5547781E535C40
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 816B
SHA256 a624faf409e4afdacd3d792dc84b6e035deea3b7529d4242670256207ad89190
MD5 df2c35e5eae0777208c3fb6ca9a96ea5
SHA1 223aa88a225c95b4afb67107c63aa601c92f11d7
SHA512 da9c44a51200e3c2e9a31de0642708b2b4a133ac4f669c1124103248f995e03fc33774d2e9d5c25defca2a7981b6ebea335da580578f334d48bbec180df03ae1
TLSH
T152018B1BCAB5F51DE32A3E7120A0A90163B216534A2E5705C0D5C5DF7567720D278F40
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Extension State\LOG
Size 279B
SHA256 4f1c8e3c724bce06318c72182470f2f67ba88febca1499010cc9baea3f7e6abc
MD5 1d61887c138a771a2b6eba1a77b51da8
SHA1 476ead15be321bed78cd3dcb42034e344739e300
SHA512 02d12ca97fa528b69bb81fbbca442c4855171df23ac364a4a99534e85dbb0509c2f59f99531cd4482b95c39873aad76b50e32c3caddb6b57fb0530f46021a2ac
TLSH
T116D0CD0049DF85F689A98DFBC7B9038AC7A5700E76D537051B9DDD883007518B054302
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Favicons
Size 20KB
SHA256 46b5ecada4edb2585f87953f7847aefc938be2404b9d9455c772b97295b7b1cb
MD5 babd43551f1b29eb82e221460676126a
SHA1 e9bff307613a14b35830893bdb6d1ecc931b425d
SHA512 5ab681c170dbd1d374bd66edd02cbe21272819ef7389ad1e886bcba112deb91eb68fa930747986da5ca794881939570013e38edd9f8e6f718f7d202e74a82f41
SSDEEP 24:LLipxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:UBmw6fU1zBmI
TLSH
T1C292EE075E383407DBA10E7D366B18768E3FE26C5FA29C94347410618CF9482D5394FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\History
Size 184KB
SHA256 845b481eabfdd5924bc03156209d5d1a94edfe39b5803eb5853de1df34ea5fc9
MD5 78bf95881e54792706e71da26f32c9b1
SHA1 6bd50569c648d9a9e617afead40f85cd234568ee
SHA512 fa4c458ee298e81491ae0f9672d2d978289bcce6fd313d1efea3c15c582b22ece20017920128020cbd11ed181914179b58e67b237a4a4c6ba785f5fa814f06ff
SSDEEP 96:HBZzvJejzH+bF+UIYysX0fxQp97vEHt/DfLjLqL/eHibgI4VgNr2jWRk/E0w:HBVEH+bF+UI3iWGVvWN3qL/uVgZQW31
TLSH
T1EE04FD5E5F243612CDBD913A68E745B3587DF02F8B136AC66C6104B1CEE2656B02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe583ec9.TMP

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Network\Network Persistent State~RFe583ec9.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Network\Reporting and NEL
Size 36KB
SHA256 951ea521116baf347ce89b628eabc22479fb8e3edfb7597659db2174fbb59804
MD5 fa739570350b78ef09e5d8ca61d0d71f
SHA1 d4e932ca96e76aeb84d3a151d847658df6a5555e
SHA512 8dc44c2f20c0a051568e7479e4553dbbf8ad4ee6b4d5474d8493c4b957f563f858918d862621ff7ccb190be693877dfb0a1245998925f47f9976d431a007ac86
SSDEEP 48:TqIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:+IEumQv8m1ccnvS6
TLSH
T1BDF2149E0B1D3A10C4F89674EAC10DC37D7D141D8B96EFC45AEC06F2FF866A2A538429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Network\TransportSecurity
Size 188B
SHA256 ddf02143d9998d550dd193522319b597a5c660b7136c8a27804bac559da72673
MD5 a4d9317c2869fe60377b982a48872ee9
SHA1 dd67983dfd03abbad630c0c706435189e7be73f9
SHA512 f0416a6399c95577bfe0b3c298615c5e59a4a728a3a860d44f94c9457e53e696623500f1632a9045681407ab0d4d2918a2c64229e5c35e3a3fd85c2b6f8ae0fe
TLSH
T170C022A240BDA432203C07369C80FD405F76B070008098E897A28ABA52400BA5103003
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Network\TransportSecurity
Size 188B
SHA256 93ccbae90f6ddc199395159d59f4855501e2976ee63f052330a75d0e0422e760
MD5 f516786a0f12a7a792dc7fdb6f5b2217
SHA1 2bb107265eff9bcf4c3ba8f10b7ee7075edfd9ba
SHA512 c903c5f30300656706ad6499cfc072de9508bd5487dcb164a6e96bade9c8e67d9f1e4bef9ef17c5cb3fd382e043277c18bb2b07ff1c78989858a196c6bee60b3
TLSH
T169C0C0E2007DE937303C0E2518C07D66AF7AF030018054E8A797053C90400B761034A3
MD5 SHA1 SHA512 TLSH

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Network\Trust Tokens
Size 36KB
SHA256 19e1e0d60dc0a70455014fec98b5e4b73e93a80651600368745ab0d4a49c9529
MD5 4203aba60fd9de5b4232fc624db3f817
SHA1 1f07dfc552d6b509c83c36cb05986007ce29e250
SHA512 6240f8ef505e093f0ea99306adfa90969b3de094cde08b61076bd2c737763c0815108f532ec17e766fe15f9b1bcb9d82096f799ef04d50c3ce2305d8247bfeb1
SSDEEP 24:TL33lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:TL31DtX5nDOvyKDhU1cSB
TLSH
T15EF2469BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 5cfe3d7dab536d08d2ceb3e4d25d67d48d368eebdc74be828ee8d1aded22842d
MD5 e809b4fd34c02503e6014b97fc3ee038
SHA1 993823f29564d23e3bcc90d02af405cfe58cd61a
SHA512 8778c01301e0c7370e998635c1745f197924ed5230b582e9ea5686c4d0f7540aa47703fe35cb12ae0463ca55d1b9def1f7ba503e70ff6b8c445f7d5d29a2bb42
SSDEEP 96:sth05vsGLCb9PGffqMZ8i0vhEsk6Tm/7qx+WVHMSm+uecj201idQjH+gvszKEB:sth0qDGfrZ8pawi/S+Wih20wd2FszK8
TLSH
T11BD1A8035F68A97B4CC7E2197A25BB47D6FA502266C50E58EBFC861C08E67CD530B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 db3cbbea045d7b75b58811a4b615991df3e3ff83eef324d82eb65bf3caf8d3e7
MD5 3a1417d2259b8a5595df198a61c6bb87
SHA1 b4de86a5433db8bd7d836d84157c78f2050f0b1e
SHA512 eafcc261c04a1bf3a2b9663515d0948aedaf39994c5d7198f15943fc5424b1200164fc0ee958f38f25ea54ffaf9bdcaa3dd392647360918a8ce512ad5eab48fb
SSDEEP 96:sth05vsGLm3bDPGffqMZ8i0vhEpk6Ym/7qx+WVHMSm+uecjb3Mk8dQjH+gUsKMEB:sth0qJfGfrZ8paxR/S+Wihb3Qd2KsKM8
TLSH
T1BCE1A7035E68A97B4CC7E619BA35FB43D6FA502266C50E58EBFCC61C08D66CC530B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 99cb4fe7f31f5a09af05e22917ffb6351772847ccfe3c89b517a0b963bcf7106
MD5 98ea0262dda4dfed65df5481c7fd0cc0
SHA1 7ff3e1bf7c42f2e0546f45b88b50499d3d049404
SHA512 2ec3433e38e7273adc53e034581299dd6cbcbca1a66fd2d956000cbfb5c169fba57868a4ac2e4e0103c62c516ae56fa8598f53888ac80de43120019bffb853bc
SSDEEP 96:sth05vsGLm3bDPnffqMZ8i0vhEpk6Ym/7qx+WVHMSm+uecjb3Mk8dQjH+gksKMOB:sth0qJfnfrZ8paxR/S+Wihb3Qd2usKMC
TLSH
T108E1A8035E68997B4CC7E619BA35BB53E6F6502266C50E58EBFCC60C08D67CD530B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 194939abe18754da5c1fb8a418a666514dc44cc893b97d435a751323ab4ec94c
MD5 a2cd637ca8da60bb8add683db88e6345
SHA1 7db1210e5451c6ae7a31338fef68a709696ae22e
SHA512 95a2c243bbc9b44e187b5344a67a084aec4f7476c55737202f98a18a51829e56949c9defbff311f6d7d229957878963a9a76eb650621c0a3f7262eac87af4ee1
SSDEEP 96:sth05vsGLCb9PGffhZ8i0vhEsk6Tm/7qx+WVHMSm+uecj201idQjH+g3BMEB:sth0qDGfJZ8pawi/S+Wih20wd2NBM8
TLSH
T16AD1A7035F68A9774CC7E2197A35BB46E6FA502266D50E98EBFCC61C08E56CD130B90F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe583d62.TMP

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Preferences~RFe583d62.TMP
Size 6KB
SHA256 082c84eee963b48f0ce2677a145f546ad8bfed69555e8f2b38b47af84f581e79
MD5 d1accb17c547fda883e3e310e1fe806d
SHA1 410b61a19fc026adc1b6d7bd5750b661c86a592a
SHA512 900d4c344a20a95a626d001d31dc98dba81b1f13f7f8920f49ddc72f5d322199e13020e06bdcd2a641d9e093b21147aadea6b029a910560498f71bec88d0e56b
SSDEEP 96:rh05vsGLCb9PGff9dZ8i0vhEsk6Tm/7qx+WVHMSm+uecj201idQjH+g3BMEB:rh0qDGfPZ8pawi/S+Wih20wd2NBM8
TLSH
T1C5D196039F68A9774CC7E2197A35BB46D6FA502266D50E98ABFCC61C08E56CD130B90F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Safe Browsing Cookies

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies
Size 20KB
SHA256 e87b3d155c7582d4c1d889308b58f84e8fe90a1581014b21b785d6694bd156cc
MD5 a156bfab7f06800d5287d4616d6f8733
SHA1 8f365ec4db582dc519774dcbbfcc8001dd37b512
SHA512 6c8eeab3ae6fb0d5be7758cca521665b216f31aed1aeeeaf121c99dc9f0192b385de0da36e94f90dd4a9bbbac6be2c5a55d2f284a24ccb7dec2c5302fb9b027c
SSDEEP 24:TLekLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T66LopFMatSaw/auUOt8B
TLSH
T101928A4E5F346220C0F44B36EDD189672F7C212CD3A72699DE1420F3DE929ABF1095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Secure Preferences
Size 6KB
SHA256 07779a28e0a1060d60222da422abd66848b3c988752a77a9c182ad3373cf15de
MD5 b531cfd8a760414e13a77ee1e4a53fb0
SHA1 98cb26f3b5dac3aec1289985a23db0a74440d449
SHA512 425804749cad9d6f7553928ee0c3a0994464affe16e1296ab7b0bde78be808d208d68f53b2c00ab1f9f3379f92c6e95ccf55918254b90d6f9e316fac9d42422a
SSDEEP 96:Hl3ipPlf/ROoKOpkF5d13is7sMaTEv9V5h5pg5+eeXBVu1l+JJ/NvNR:HcxWGLQ9lBu6T
TLSH
T1B5D1D5A7452CC5397F444BEBDC397ECB9DAA408F98C6480A97E2C44807C2EFD21CE495
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 1c6ced8d4574a60f54410159e0709f64545eeea422922781acaa1ef1b3e55539
MD5 715ca6ed758499e0a17a9e072ed28b76
SHA1 4684113da8cf5650bfb41dcf18582cf0d1d0bf37
SHA512 cdadf8beeeab11a6e286fe00ad85e2f8abb3ca9775ae8c5b725ebbce3a0b72f22b83d5b93fd17411c09be70bbc0c3a851f882efb07a27af5869e60fa03bac55d
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Shared Dictionary\db
Size 44KB
SHA256 f8e7cd835195e4eff7855d20676484ca75f7e7e4fe5b13164fc926b365e1dea0
MD5 b581f0ff8f8aa3371ae47b48c95329e8
SHA1 4f588efadf3675f3526cbe762c50eb8e79d9f2e5
SHA512 e0a79452acb39838afea8ce34e05c7e5cde68f2a786fe4423ddf2588fc6047339e8e4c3140d7e0447f938b2266f52b9ddbdcc0f40c495d833b47b3f27d7996de
SSDEEP 24:TL6xgJhPwMuz6G0ZestjteX4yNQeYlv+1b3IeNS6+6Uwg89oIPq81fBG:TFOIy4m1b3fbUdSo2qSB
TLSH
T16513AA0F1E187551D1BD0235E9E64E6B2E7E204C9B8369D125F01AF24DE251C9D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SharedStorage

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\SharedStorage
Size 4KB
SHA256 1fe8f6113488865c546d2faa55b21482662ce4be19d4f505eeefa09bc3131489
MD5 b9263bbf24428aaca95d04d04f3aeb6f
SHA1 5346015345f6df766df4bc9b42da076f6fdd440f
SHA512 5bc2978bc96e1347500db552e2a2dfd9e5df25c8e16d3ab57e5519de43cb9c08f5aeefd1a6f6947d7fa253505918763b932f622636fc2a7a429fa72a5b49c7cc
TLSH
T1EE810440534000F1D05407F755D1130C0F07D3D4D5410F0355010041CC51D445C70FC4
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 cec721b5e91f74e60a8928fa6c9ee825ddaae2175150396f6cdadd810a9f7ed2
MD5 f6ea68681fb9604a64599fb8536cccb7
SHA1 5c15db6ba1a1e04230c7e2d9da7948282d9a8af1
SHA512 f20eb455788c5504fcf2c7144e65d7e57440310a08acceb0527e0890ad5bd51245e0541979f1819a95d982bdd1c764af9b90215b88d08fa8b3bdc149913f0f25
TLSH
T1A5B012507726F267C5CC4E3402E49F807201E51300900453C83DBF600D8F6F83F048D4
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Site Characteristics Database\LOG
Size 305B
SHA256 ef7514d1651b5b0e592a071d4faad7fefe63b3a2301e59bf958fac823b8b1c6f
MD5 d0dc35d7cd3d826e0e9e456ea7a7b059
SHA1 35b9645041a768c36e2035dd26995db2ce40ca8f
SHA512 0188f6903ece55566fcb1eda69fa676ddaba5ce7cffae258860a23e2c6c6fcab04e30890e630f8ccaef26bd7695b1185d1d3ff7b9ca4ec00e2075863097a26f1
TLSH
T121E020201AD985BB45C609FF43759349C372B006F6D566251E58EA84310F4187051201
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Sync Data\LevelDB\000003.log
Size 46B
SHA256 a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a
MD5 90881c9c26f29fca29815a08ba858544
SHA1 06fee974987b91d82c2839a4bb12991fa99e1bdd
SHA512 15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Sync Data\LevelDB\LOG
Size 281B
SHA256 b8768d8c50222309ed0926e022e85760cd778b05723e2dc7406b3b59bc7007e5
MD5 29a187aa2d79508aaf977ab5d470a662
SHA1 b1cf12d6454d45ca30746e645fff4c2031eb1b32
SHA512 109468d67bbc3bdfcbfbea16bbfb72d78b20a703382ef3adf8e5e4b8fb841907ec850f81902016b65a0cbba23b1837ba08e7db1efb2f86b87cb58f64e948c54e
TLSH
T103D08C305AD985B789858BDA82B9538A82B4B90AB7C53B098F4CA988340B528B070243
MD5 SHA1 SHA512 TLSH

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Visited Links
Size 128KB
SHA256 4cec6d98ceba5199b8274768ef712641b62d1565c2f8f9ca82f87e4ec96c93f7
MD5 6de1685cd59ee1cb091916f27e13ce18
SHA1 35d5a6bd8058638190543f9eb0f791ec00dedbe7
SHA512 90be84f2b4812c72f390347eb0923e6189c893a80fd81deb3ae944f12643d9c45ee971fe0c9ad547071862171574526f970610399fb6a49bb77405fccbcae4ea
SSDEEP 3:ImtVuk5iik7tnC2/t:IiVuk8ik7tC2/t
TLSH
T171D304CD011D0D31D00D1437D4104D4F1451C0170C134041073DD54F4C430010353C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Web Data
Size 216KB
SHA256 2a7b3bb5ac287c4d5fd81c76626b1e8e15f32f34d2b37738fdc98fa6ad43baaf
MD5 4ebc7325aec489f53e4635ea414d14a5
SHA1 c85641375cd9bd4a26922883598a02e8861a6bec
SHA512 a2ad8a907e9d3405fefc533ef4ae65fcb32615914163af646c6af02a412df1d3a2250d0ec8e04ab5d04b6d8453122d43d97aa3340358fe5e7c748e9e2117fb74
SSDEEP 192:njQLsS6Xuv9PhDnLUMjA03VpQYouZtuQKIqJZWTVTdhsrV0dwe:nEL3CuvrDnwMjA0FpQY5Z0QKIqJE6K
TLSH
T14924440A7B746001EDA6E9721CB080771D3C61AD8F22E6826DB254694DF6853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\shared_proto_db\metadata\LOG
Size 297B
SHA256 18f79e167948033d31fd5e3f15175be5e035f3f492be227006f090794a8c2f97
MD5 406105903533408bf3c9cf4f3943887a
SHA1 ecb9fd05d7b1dbb71450dd250e28473e301abefc
SHA512 9f4762175dc3ec3ae8ebd03bea34cf108a136454ab84052166b84eafcb4f95f588d9d67b5a4ed26d4e0cff2c6487f7b25392afa337b7fb17a138ff22c1851f84
TLSH
T1DAE0CD10BDDD85FB859B4ADB46F543CAC355784BBBD41F0B4E44CD487447914B495203
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Last Version
Size 14B
SHA256 06205ebe5acf3073d12a4ac419377a3449e6d6b5fa7fa2b1c4201f007c4ddd91
MD5 96fb5f155aee0f8cd88274656c58ca83
SHA1 1fe86d9df188b0f86ae2d8da8f7c1ef663258baf
SHA512 fee0061ef23ef3fc35d050501b47db921f490c2aec2a016304c9f27228d3ecf7df9641fd681d9babd275ffd3dbd20e33e38fa5bf583c2852ffcd4b04bedf015c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Local State
Size 2KB
SHA256 2fd53be519cb0502807fe07d3c24db22ab87e4b156fa2164583e13e57ec4310b
MD5 3b4804d3ddfdfdaaa19b3a099bea49ea
SHA1 60eb578b1ad74359352f90a0ba4c3aed0fa680de
SHA512 fdfffd4c444580519f5549d8bd4e4a9b03c6468b2d98ec7ba54e034a42d794ebd58dcd63aca02cc8b3604b137f2e013eeee62022b645e06a705d8c862d3aa063
TLSH
T1C951A4B3A928EB778DE38900B58A2F536E766175D7612F549ADD4B0C00EB78C2306C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Local State
Size 3KB
SHA256 2762844f9f9069ca212a526fa1591ef63b4c8f3eae2607eab6c75155dac6b9e9
MD5 d09ab6c71cdb590f4f1a91e5481ae73a
SHA1 2613220a647b7f12c92e2e63cf036d28199338a8
SHA512 8b77ecdbf7f581ab990e96906516be0a4ec5106411400400588372fe5e6471a2c47d4e93a4ce1b16bf40e88a0b76d5cc907c3f457025cae2963da555fb5dc908
TLSH
T166716473A978EA274DE39901B4C62B067AA65136E6953F98DAED0F0D01DB38C2342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Local State
Size 15KB
SHA256 136f365aba81ed322ae82d8cb615d98ad091329e2ea353a5dc68e99e7d0289c9
MD5 13e3ed0fa7432e76fdd21232af574d91
SHA1 7fc5f6daabb11d9a8f1cf0a3211a2fbb67f49505
SHA512 f315b60b812dbfe8b82c8c502c19b539d0e2ff028c078afffc718017f4925bed2d78358799d8f7efec8e6817f9bdc1e9b285d4c0d0098adac9a0a63d800918fe
SSDEEP 384:z8fRE5BdEZfr0kuh9Rt/nP9yxNba26tFSE/HI+KH:sRkurqhNs/w8E/o/H
TLSH
T17472BF634A359D276CE7C106784A6B03ADB8C459A2C16AA86CDD6F0D0AC7BDD1393D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Local State
Size 16KB
SHA256 d06983735586a7a16970198514456a6a188ba0f2fcd401e158285a42bef326f4
MD5 c342e76c6a2baa789c512b0825a69ff7
SHA1 910bd7ff3856cdfc058ed42d11140bc4c79fa164
SHA512 3c8f927d2f4461c9d868972d5b9ce1039bc26de39063e1ec0e14a1bf6a60dc0ab6293d4d551c922c3884341cea22d4ccd62bd900b8a372e5eb600b13639d492c
SSDEEP 384:z8fRE5BdEZfr0kuh9Rt/nP9yz3Nbam6tASE/HI+KH:sRkurqhNszzwhE/o/H
TLSH
T1EB72BF634A319D275CE7C106784A6B076DB8C459A2C16AA86CED6F0D0AC7BDD1393D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe57edfa.TMP

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Local State~RFe57edfa.TMP
Size 1KB
SHA256 9be1e3f36ba75222a181b72315caf93b7e33a5cd06350321fe3b7ab17170134d
MD5 2bd58da8698cbb503718fcb9fbab5922
SHA1 99a752379fcd778040880efb91741fa9d2182451
SHA512 93bb4cb783afd4fa482b909fbe57ce2e9669ab8a78ad01ba01e36ad2e44e680f7d488dcbc3f9108034c2021cdd3d3c37fcad58845038ceb372f2fa33e1f3b37f
TLSH
T1932165F3D4A86FB75D824401B187A7872E61607ED3208F0CA6CE871905EB28D926AC33
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\ShaderCache\index
Size 256KB
SHA256 6aaffab144d82d324c3090d43bd445bc4db2b09861e288afb68f4dbb43364438
MD5 4d5eb9a62e8497809e732dfd0b8ed1ec
SHA1 5cf3a0b48d8af4a60b064442fd1b6428417b6a49
SHA512 bfd3bc1ad12c3a5d8897c545355462e976e3cf6806c0651b5e59a33f36693c8176666ef37cfd36bad37a0e28a61a48bfc2aef1641fb04427616839116ec91952
SSDEEP 3:LsOllllklkXl7l:LsUlP7l
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Variations
Size 85B
SHA256 b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557
MD5 bc6142469cd7dadf107be9ad87ea4753
SHA1 72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c
SHA512 47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182
TLSH
T1F2A0120384738407E4144051C45C1341287C84570119C0012068931304240CB039643A
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4020_1808008492\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

crl-set

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4020_321911494\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4020_321911494\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1420-25-0x00007FFE65B40000-0x00007FFE65B41000-memory.dmp

Download

memory/2004-588-0x0000019B77C40000-0x0000019B77C9D000-memory.dmp

Download

memory/2004-840-0x0000019B77C40000-0x0000019B77C9D000-memory.dmp

Download

memory/2004-971-0x00007FFE25A60000-0x00007FFE281D7000-memory.dmp

Download

memory/2140-656-0x000001AE90C80000-0x000001AE90CDD000-memory.dmp

Download

memory/3876-1044-0x000002F40C0B0000-0x000002F40C0B1000-memory.dmp

Download

memory/3876-1043-0x000002F40C0B0000-0x000002F40C0B1000-memory.dmp

Download

memory/3876-1052-0x000002F409D90000-0x000002F409DED000-memory.dmp

Download

memory/3876-1035-0x000002F40C0B0000-0x000002F40C0B1000-memory.dmp

Download

memory/3876-1039-0x000002F40C0B0000-0x000002F40C0B1000-memory.dmp

Download

memory/3876-1040-0x000002F40C0B0000-0x000002F40C0B1000-memory.dmp

Download

memory/3876-1041-0x000002F40C0B0000-0x000002F40C0B1000-memory.dmp

Download

memory/3876-1042-0x000002F40C0B0000-0x000002F40C0B1000-memory.dmp

Download

memory/3876-1045-0x000002F40C0B0000-0x000002F40C0B1000-memory.dmp

Download

memory/3876-1033-0x000002F40C0B0000-0x000002F40C0B1000-memory.dmp

Download

memory/3876-1034-0x000002F40C0B0000-0x000002F40C0B1000-memory.dmp

Download

memory/4020-589-0x000001DE5F280000-0x000001DE5F2DD000-memory.dmp

Download

memory/4196-263-0x00007FFE269D0000-0x00007FFE29147000-memory.dmp

Download

memory/4196-216-0x0000025983AD0000-0x0000025983B2D000-memory.dmp

Download

memory/4196-302-0x0000025983AD0000-0x0000025983B2D000-memory.dmp

Download

memory/4196-198-0x00007FFE269D0000-0x00007FFE29147000-memory.dmp

Download

memory/4536-618-0x000002639A400000-0x000002639A45D000-memory.dmp

Download

memory/6044-127-0x00007FFE65B40000-0x00007FFE65B41000-memory.dmp

Download

memory/6128-241-0x000001DC59600000-0x000001DC5965D000-memory.dmp

Download

memory/6128-436-0x000001DC59600000-0x000001DC5965D000-memory.dmp

Download