fdddc5f2d005696b1923e8192a0f66b599dbf92aff40447869f2c278a736c50c

Analysis

user interaction
yes
max time kernel
148s
max time network
128s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 04:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Wave.exe
Size 9.6MB
Sample260528-fblycsg13w
SHA256 fdddc5f2d005696b1923e8192a0f66b599dbf92aff40447869f2c278a736c50c
MD5 1852c2d25f644263c7beb6fd8183e3bd
SHA1 380d73cc5e4edb0640a8911fcf39846974c734ca
SHA512 d7e49f7d0fe95c1f0f00a9ab815e121024d327c28aa66e2646b2366b0f0e702ccec741d7f0adae8c236f489d423e4eb3dc51410aa395bba42943363190069b19
SSDEEP 196608:2DyDXOliXInuU6ljcYtRRoyqgFk99AamtOjNswoTu5evlQm2mtnMUwEa9BeLibsF:2aKnd6lLBSgC99Ai5sw0u5evlQm2mtnj
TLSH
T128A6011897E85552D73E9B7CC126C543FEB1B886032592CF0818FD582FEB7C2A636636
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2780	Wave.exe

Loads dropped DLL 5 IoCs

pid	Process
2780	Wave.exe
2780	Wave.exe
2780	Wave.exe
2780	Wave.exe
2780	Wave.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Wave.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
5660	tasklist.exe
2036	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs

pid	Process
2780	Wave.exe
2780	Wave.exe
2780	Wave.exe
2780	Wave.exe
2780	Wave.exe
2780	Wave.exe
2780	Wave.exe
2780	Wave.exe
2780	Wave.exe
2780	Wave.exe
2780	Wave.exe
2780	Wave.exe
2780	Wave.exe
2780	Wave.exe
2780	Wave.exe
2780	Wave.exe

Drops file in Windows directory 62 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_1868151694\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_1868151694\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_1868151694\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-or.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_1178526510\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-as.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-it.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-da.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-be.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-la.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-te.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-nl.hyb	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-af.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-et.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-el.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_1178526510\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_1178526510\manifest.fingerprint	msedgewebview2.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2160	PING.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134244169437007593"	msedgewebview2.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2160	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4772	msedgewebview2.exe
4772	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5668	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1192	Wave.exe
Token: SeDebugPrivilege	5660	tasklist.exe
Token: SeDebugPrivilege	2036	tasklist.exe
Token: SeDebugPrivilege	2780	Wave.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 5460	1192	Wave.exe	80
PID 5460 wrote to memory of 5660	5460	cmd.exe	82
PID 5460 wrote to memory of 3392	5460	cmd.exe	83
PID 5460 wrote to memory of 2160	5460	cmd.exe	85
PID 5460 wrote to memory of 2036	5460	cmd.exe	86
PID 5460 wrote to memory of 5192	5460	cmd.exe	87
PID 5460 wrote to memory of 4476	5460	cmd.exe	88
PID 5460 wrote to memory of 2780	5460	cmd.exe	89
PID 2780 wrote to memory of 5668	2780	Wave.exe	90
PID 5668 wrote to memory of 5476	5668	msedgewebview2.exe	91
PID 5668 wrote to memory of 5580	5668	msedgewebview2.exe	92
PID 5668 wrote to memory of 5580	5668	msedgewebview2.exe	92
PID 5668 wrote to memory of 5580	5668	msedgewebview2.exe	92
PID 5668 wrote to memory of 5272	5668	msedgewebview2.exe	93
PID 5668 wrote to memory of 1308	5668	msedgewebview2.exe	94
PID 5668 wrote to memory of 1308	5668	msedgewebview2.exe	94
PID 5668 wrote to memory of 5336	5668	msedgewebview2.exe	95
PID 5668 wrote to memory of 5336	5668	msedgewebview2.exe	95
PID 5668 wrote to memory of 5336	5668	msedgewebview2.exe	95
PID 5668 wrote to memory of 5020	5668	msedgewebview2.exe	97
PID 5668 wrote to memory of 5020	5668	msedgewebview2.exe	97
PID 5668 wrote to memory of 4332	5668	msedgewebview2.exe	98
PID 5668 wrote to memory of 4332	5668	msedgewebview2.exe	98
PID 5668 wrote to memory of 4724	5668	msedgewebview2.exe	99
PID 5668 wrote to memory of 4724	5668	msedgewebview2.exe	99
PID 5668 wrote to memory of 4772	5668	msedgewebview2.exe	100

C:\Users\Admin\AppData\Local\Temp\Wave.exe
"C:\Users\Admin\AppData\Local\Temp\Wave.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\WaveUpdate_bdfcb9d9e7784d9a8afae63d5bb35d4b.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5460
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "PID eq 1192"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5660
- - C:\Windows\system32\find.exe
    find "1192"
    3⤵
    PID:3392
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2160
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "PID eq 1192"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2036
- - C:\Windows\system32\find.exe
    find "1192"
    3⤵
    PID:5192
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\AppData\Local\Temp\WaveUpdate_c56b11ce2452487c8335cc4e23030d91\*" "C:\Users\Admin\AppData\Local\Temp\" /S /E /Y /R /H /Q
    3⤵
    PID:4476
- - C:\Users\Admin\AppData\Local\Temp\Wave.exe
    "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2780
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=2780.5312.14770481965249394586
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:5668
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7fff0b2bb078,0x7fff0b2bb084,0x7fff0b2bb090
        5⤵
        
        PID:5476
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1672,i,9121240716408885882,16574451215775855087,262144 --variations-seed-version --mojo-platform-channel-handle=1676 /prefetch:2
        5⤵
        
        PID:5580
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2020,i,9121240716408885882,16574451215775855087,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:11
        5⤵
        
        PID:5272
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2300,i,9121240716408885882,16574451215775855087,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:13
        5⤵
        
        PID:1308
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3536,i,9121240716408885882,16574451215775855087,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
        5⤵
        
        PID:5336
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2232,i,9121240716408885882,16574451215775855087,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:14
        5⤵
        
        PID:5020
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4504,i,9121240716408885882,16574451215775855087,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:14
        5⤵
        
        PID:4332
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4360,i,9121240716408885882,16574451215775855087,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:14
        5⤵
        
        PID:4724
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4632,i,9121240716408885882,16574451215775855087,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:10
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WaveUpdate_bdfcb9d9e7784d9a8afae63d5bb35d4b.bat

Path C:\Users\Admin\AppData\Local\Temp\WaveUpdate_bdfcb9d9e7784d9a8afae63d5bb35d4b.bat
Size 673B
SHA256 1df56261b8264ac9756e6fced07bca0291e3be6041f4690342d6f9d4d49aaf6f
MD5 ddb86bcede4cd97a8b477818beebd088
SHA1 cb876353f0b16b8ccfb50de16b71f35ace0c7a0b
SHA512 d1fbdf0a6a64d24553a2b2e47226983ea98d0fe91da87f57a1387e4295945e37a5ea79d969bc4062a87f0f8bc753fa5db7a18704952330d8ead08170c2f22857
TLSH
T1210123A2254A5D8A04114E4F0BAE9708DFAFC4CF2F0E610C65B8854A322E54BBAA89C0
MD5 SHA1 SHA512 TLSH

Submit Download

Wave.exe

Path C:\Users\Admin\AppData\Local\Temp\WaveUpdate_c56b11ce2452487c8335cc4e23030d91\Wave.exe
Size 9.6MB
SHA256 fdddc5f2d005696b1923e8192a0f66b599dbf92aff40447869f2c278a736c50c
MD5 1852c2d25f644263c7beb6fd8183e3bd
SHA1 380d73cc5e4edb0640a8911fcf39846974c734ca
SHA512 d7e49f7d0fe95c1f0f00a9ab815e121024d327c28aa66e2646b2366b0f0e702ccec741d7f0adae8c236f489d423e4eb3dc51410aa395bba42943363190069b19
SSDEEP 196608:2DyDXOliXInuU6ljcYtRRoyqgFk99AamtOjNswoTu5evlQm2mtnMUwEa9BeLibsF:2aKnd6lLBSgC99Ai5sw0u5evlQm2mtnj
TLSH
T128A6011897E85552D73E9B7CC126C543FEB1B886032592CF0818FD582FEB7C2A636636
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WaveUIAuth.dll

Path C:\Users\Admin\AppData\Local\Temp\WaveUpdate_c56b11ce2452487c8335cc4e23030d91\WaveUIAuth.dll
Size 20.6MB
SHA256 2f0941e4c4714d207f866861555e1606fd54e12b865b9f4d3d50ceb9f78fd403
MD5 91ec65fcb1665c1f55198a868bb8224f
SHA1 c244ec97d014809e568ef3611fb1bd625b52a35f
SHA512 e1f49032fb739b7dec9f2cb17c32828c0e9117b64a44d39d9d25c82fa838a48f3dca98a153917729130ac9dc9dbdbcdee538cc0a6ed40e06d3a46f8abcb99104
SSDEEP 393216:DBt6fSdHPPmgT9x/5qecpP3QU2cV6OkI/x0wlIWy3ZAHPoK3e3UAFW:T+2PFx/8NPsQ3x7+fIYrF
TLSH
T1B42723E524D411FCD896C630E25E2BEDF1D578494DB9A82E7FC608012F31E9BC9A2937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\Temp\WaveUpdate_c56b11ce2452487c8335cc4e23030d91\WebView2Loader.dll
Size 156KB
SHA256 4cd3ffd5f52122432b6537b360c2317f96650928c927bb3caa59d5807da573a9
MD5 daf9a81004a961e39650a0e2bafe233e
SHA1 62f863adbef09905c75f475cdd5ce68b0aaaf73f
SHA512 95f1ffa93b0c16fdbaf9eb2d9f9fdbe63b1946a7cea0e366a9c68fd4695a97c7681bf9e2b2f372c8ab6430c0a37cac733154e94b1d7a76cbfa3c1de340d5ce33
SSDEEP 3072:8nVs+j4uIGieBiCIV6A9S4arvNQG/pTNgWEtJctHVA9rWt:gj4NCy6A9S4YcWEtJeVAk
TLSH
T174F34B5BB2E90077E17BC278C5A34A16E776B8111750AAEF036447791F237D0AE3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\CertificateRevocation\6498.2025.9.4\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5a7d5b3917d086edd7eabe0546201ccaa086f5eb76448c236c590c8639790b2e
MD5 eb3dee54e5fbd30252923bb6f32eab3e
SHA1 55d2e8949830e1f0ccfeeb0c7f6f445f6bc7bc62
SHA512 3a11443180acaf2be987fa23db30df1e46ca72227b929654fe31d7450fdc2f3e4dc4c23b5f4b446363472d9a3bafe5db07d05a935e3c874427b0cdee96f7bb3e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 fee16a03c767cbc042f992963fea504f340ca1dce63b087ffc55ff8a8f2bd955
MD5 780806e004437e6accd1e1d473105ebe
SHA1 3508543d1db5fbf49e111d387a0f529af091e4f6
SHA512 6c9dd262ba20f5870630c193da9578590941a2b18c5db3c26cf6705424e50a51b842567b5758d232d40fe02fb71fa7e479da734feffc8322ca165a90463bae75
TLSH
T1B6D0121632120534C11030334002A50C0801E50B42054104982D853D1A0C5542923442
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 696B
SHA256 b5f3d6076cd12243540ede0a8e319fc7c6d4d537c0e04be398e751b54118916a
MD5 34b90a73c6abccba418efa3e5bf8c38f
SHA1 96594ff09cddc85c6a3854c118ea9e5d4e292cb2
SHA512 773bb929e0d44bf72342c1f86863197013f6a7f9d7a35d6cfe84f9eadc1846f1ea9647b1c7754e41b720e392fff23713e0a709412f9328d67df7cc778eeb0851
TLSH
T171019A949AC4BE09FF1491715DD21D5EB77211008E134F43D3410CBBAB437805715D73
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585a02.TMP

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe585a02.TMP
Size 48B
SHA256 97ced73e22c3006d2100b09fe391b5b33f2553c7e89346c32f60ccecfc0197e1
MD5 25cb70d3ee27117d401886ffeac56c1b
SHA1 2f6615e5d95e50c9c88ec6bfcb0a3aad55f2a5ca
SHA512 5f8957ec31a16b591df58cdbdcb548442d3dae060651d8568de5d2cf3c4f5d2ac5b5214a2aa15b745ff4f0b434c375442f1f26453e14005c3aac00db5c8c6bb8
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe591747.TMP

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Network\Network Persistent State~RFe591747.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 7f3b321caacaad8a86aec1ebbd637d807356fd2f773490751f4ce0f6522f7c06
MD5 fef652f0788110cd9e8afc69f74e9a74
SHA1 172df929e05590bd1b96a777c80d50c824956fd3
SHA512 0c521f92f3f91c8b5dfeebcae47583d053e1d2b9aa3ddfc693c9fb24d07df31408d51609e30bd093b4c4d13255c4c8b51ccfa9deceac2bafdca3db11ec286dad
SSDEEP 96:sttSY05vscLWb9oU1ffLZ8i0vhE3k6Lm/7qx+WVHMSm+uecjBZla1idQjCH+gVWu:sttSY0qqkfTZ8paPa/S+Wih7owdViqMC
TLSH
T154D185425F68697B4CC7F61D7B25BB12E2F9506666C40E98ABFCC71C08E66CC620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe588f2b.TMP

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Preferences~RFe588f2b.TMP
Size 6KB
SHA256 b74835d0a9472a419b3477030d397c6dc03817beb310d8d582d630eefb8d7089
MD5 af25853f14b7e7a07a2e0035841fb294
SHA1 9a28ff854a4f167fb19d3c2030143c021d727082
SHA512 4bdf1a666da7f566a634c26eeca1bee7b2f3818994589630cf9f4eb35f296c968f430f4b8815095607e808c315f7d0fac48cb8150db2d5b714de51b2038ebc97
SSDEEP 96:sttSY05vscLWb9ox1ffLZ8i0vhE3k6Lm/7qx+WVHMSm+uecjBZla1idQjCH+gVPY:sttSY0qqHfTZ8paPa/S+Wih7owdV7qM8
TLSH
T1F0D1A8035F68697B4CC7E61D7B35BB12E2F9506566D40E98ABFCC61C08E56CC630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Local State
Size 1KB
SHA256 9afed77c098ed448bcfe5132fdc9340d0e10281591391fa844d4596b993f98fe
MD5 a06f38092b2f36e17135d7c6c5f845cb
SHA1 5badabfecb0f5eb52154a2c05e122f2c33c1c0b2
SHA512 f4ba1095263ac298fd960ae94c70f063a6b5689bcac58027c36b33a71bcc20ea8217f43375defbef57b128a00fbdb84dccb2135e62868930e16bcc6501c9bc70
TLSH
T12431A773D5E03F335C529AA7B3822F5B1F641079C2115E84A5DE4B5D11D76CC5227D32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Local State
Size 2KB
SHA256 94c8cf9e166c4d930a649cbe19a99453ab297ca1efbab174bec8fd0b0487f3e1
MD5 fc74bded221b3196f6ea8729543e89c4
SHA1 f5a32d8851ff0a2f26d8e253d94156e71a0b81e7
SHA512 9fd85de742e1e2494fefd44d4e6c756a41ffe4f06461887f7e035f8b1d6b2f83a7297bbd94b2ded6268353f08ecd0e7dfcbec264f25158c7c5ab577250239d84
TLSH
T14B5194336954BB3749A38AA9BB863F175E7950A5CA612F9099DD0B0C01DB6DC2303C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Local State
Size 3KB
SHA256 475e4fe766ebc0b974e26f70c7bde041b6558d86ad7a7c2a591171adaf9987aa
MD5 b1c5219e1ed8f0e73df2277ac3135891
SHA1 06ffdb69bf560709f32b0dc00b84afc63ebc8f2a
SHA512 ad4b64c369e7f7e5766e3e9a6185595840e1e0cd656cc39db28b12a4ffaa83e08b574cdb133d8e2e5430fdfdc05a99f28fe9673ebf90ad30502fef980e0a3342
TLSH
T18671A52269A4BA374DE39E55BAC52F0A7BA55037D6953F94C9EC0F0D01DB3D82302C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Local State
Size 15KB
SHA256 b8f1f93f88268ed2e39c407eaaa7161310157db669d8ceb3e12892403fc1164e
MD5 e94e55708d01da15bbd3b84d8b2ec965
SHA1 e78ffb98d859236861279fca36700a1fb7351ae9
SHA512 10a1dd2beddfd4ed0f4da82e894401b2ca8cf774f26f475db2e5a106b521c1ca195443a976defe9c4087a45f6a327ad47a254633f2a772662a97c11b868041ad
SSDEEP 384:znsr8vAVy7dG5UI6limIfB8pNb61EUCK0S2UOO5V4:Ir84y74GVlUN0S2UOO5V4
TLSH
T1A472AF3566346F374CD3CD11FE0A2A1F7DB8418ACA961FB8D9ED1B08439B2C90352D62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe57f0c8.TMP

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Local State~RFe57f0c8.TMP
Size 1KB
SHA256 d64223b25718b9a7f7be056a10415097e7d44c6eb40a0ddc6e25da2cec2571e0
MD5 84b47169328de37f1daf8534b54604e2
SHA1 b0ffcb4694b9bb6b87c511af269b0826cfd08fe8
SHA512 9f16cf947ae3458d4bce1ec1f27d1e5f7347986d8824cf57a491ccbb9178604738c363463d4d22338ea898317544e0991fc91848097e3b7733b73187f1956541
TLSH
T1A0216233C5A47F336C518EA6B3826F8F1E906079C2149E48A9DE475912DB6DD4237D32
MD5 SHA1 SHA512 TLSH

Submit Download

Untitled 1.json

Path C:\Users\Admin\AppData\Local\Wave\Recent\Untitled 1.json
Size 161B
SHA256 20915b1141c51bf6c778f1fcf2d86d4e8dfb364073f5eab73ece274f3bc099d8
MD5 603e53aaafb804dfa348be11bac8bbc0
SHA1 4106735d6a6de43049f5bd51d16a8a13c0767477
SHA512 b973201de704001eb0be66d88274d223019471660989cdfd25eb5285bba300afb157149e0da3fd18bd1abee46a842177205e96c03393b08d845ad1da12b0d1e5
TLSH
T148C0123396F1244B45E087669B541883B8802E1648600C15BB7F93480092470084BBAD
MD5 SHA1 SHA512 TLSH

Submit Download

-407775608.json

Path C:\Users\Admin\AppData\Local\Wave\Tabs\-407775608.json
Size 160B
SHA256 5f04553baae06253429e3d80816a9700e9b8cfed9998da354dc6865f8c01dfe2
MD5 66aa4a30a39ed0adf97ef60b85436403
SHA1 3bfd82f36e6acefcc7fbf9bb1350d32fe8eb2284
SHA512 deb431ac0671f8ba825db5aebcd3bd25594aba3b0da84ab2eab211f7766a64290be6d77132ab3004139030935feb58ba7739036779dabea158814f7a9ba61f5c
TLSH
T150C08031CC44547D63BD468E955064C73C001B5303B04C57397B465E017225016487CC
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_1178526510\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_1868151694\manifest.fingerprint
Size 66B
SHA256 c236a2ac7741d48e1c56980652331cb3f1f12baf937baf0b280600fbafb143e3
MD5 c28ffa45708f10e3a35143ed2708782f
SHA1 84a03f2615333c9311dbf79d6f58f56b5c009163
SHA512 beac0eacff45a152eb2a50f4d72db2933b8f8ba97e6f0a9f6811abe866fef5c7c83068151915dbdffaccaee5d0cd335d182671f44dbab6da2222266ff8a28ff0
TLSH
T169A022F3F000F02030022F8A80203C00C8A23BA80C8020808000BEE0200322A3A0C820
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_1868151694\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-as.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5668_985135099\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2780-284-0x00007FFEEE580000-0x00007FFEF0B5D000-memory.dmp

Download

memory/2780-341-0x00007FFEEE580000-0x00007FFEF0B5D000-memory.dmp

Download

memory/4772-666-0x000001D5025C0000-0x000001D5025C1000-memory.dmp

Download

memory/4772-667-0x000001D5025C0000-0x000001D5025C1000-memory.dmp

Download

memory/4772-665-0x000001D5025C0000-0x000001D5025C1000-memory.dmp

Download

memory/4772-677-0x000001D5025C0000-0x000001D5025C1000-memory.dmp

Download

memory/4772-676-0x000001D5025C0000-0x000001D5025C1000-memory.dmp

Download

memory/4772-675-0x000001D5025C0000-0x000001D5025C1000-memory.dmp

Download

memory/4772-674-0x000001D5025C0000-0x000001D5025C1000-memory.dmp

Download

memory/4772-672-0x000001D5025C0000-0x000001D5025C1000-memory.dmp

Download

memory/4772-673-0x000001D5025C0000-0x000001D5025C1000-memory.dmp

Download

memory/4772-671-0x000001D5025C0000-0x000001D5025C1000-memory.dmp

Download

memory/5336-164-0x00007FFF2F790000-0x00007FFF2F791000-memory.dmp

Download

memory/5580-324-0x000002661E0E0000-0x000002661E1FE000-memory.dmp

Download

memory/5580-53-0x00007FFF2F790000-0x00007FFF2F791000-memory.dmp

Download