hxxps://getwave[.]gg/

Analysis

user interaction
yes
max time kernel
748s
max time network
488s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/06/2026, 17:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://getwave.gg/
Sample260621-vx7jhsfs21

Score

6^/10

discovery

Malware Config

Signatures

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs

pid	Process
1644	Wave.exe
1644	Wave.exe
1644	Wave.exe
1644	Wave.exe
1644	Wave.exe
1644	Wave.exe
1644	Wave.exe
1644	Wave.exe
1644	Wave.exe
1644	Wave.exe
1644	Wave.exe
1644	Wave.exe
1644	Wave.exe
1644	Wave.exe
1644	Wave.exe
1644	Wave.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2792	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134265362065172490"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{17DAEE62-ABFB-485E-B0FA-98ACC2859EB6}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1512	msedge.exe
1512	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
3184	msedgewebview2.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1644	Wave.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
1644	Wave.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 4924	884	msedge.exe	87
PID 884 wrote to memory of 2792	884	msedge.exe	88
PID 884 wrote to memory of 2196	884	msedge.exe	89
PID 884 wrote to memory of 2196	884	msedge.exe	89
PID 884 wrote to memory of 2196	884	msedge.exe	89
PID 884 wrote to memory of 3876	884	msedge.exe	90
PID 884 wrote to memory of 3876	884	msedge.exe	90
PID 884 wrote to memory of 2768	884	msedge.exe	91
PID 884 wrote to memory of 4884	884	msedge.exe	92
PID 884 wrote to memory of 2768	884	msedge.exe	91
PID 884 wrote to memory of 2768	884	msedge.exe	91
PID 884 wrote to memory of 4884	884	msedge.exe	92
PID 884 wrote to memory of 4884	884	msedge.exe	92
PID 884 wrote to memory of 4684	884	msedge.exe	94
PID 884 wrote to memory of 3732	884	msedge.exe	95
PID 884 wrote to memory of 4684	884	msedge.exe	94
PID 884 wrote to memory of 4684	884	msedge.exe	94
PID 884 wrote to memory of 3732	884	msedge.exe	95
PID 884 wrote to memory of 3732	884	msedge.exe	95
PID 884 wrote to memory of 3404	884	msedge.exe	99
PID 884 wrote to memory of 3404	884	msedge.exe	99
PID 884 wrote to memory of 3148	884	msedge.exe	100
PID 884 wrote to memory of 3148	884	msedge.exe	100
PID 884 wrote to memory of 2936	884	msedge.exe	101
PID 884 wrote to memory of 2936	884	msedge.exe	101
PID 884 wrote to memory of 2936	884	msedge.exe	101
PID 884 wrote to memory of 4996	884	msedge.exe	103
PID 884 wrote to memory of 4996	884	msedge.exe	103
PID 884 wrote to memory of 4996	884	msedge.exe	103
PID 884 wrote to memory of 4364	884	msedge.exe	102
PID 884 wrote to memory of 4364	884	msedge.exe	102
PID 884 wrote to memory of 2500	884	msedge.exe	105
PID 884 wrote to memory of 5016	884	msedge.exe	106
PID 884 wrote to memory of 5652	884	msedge.exe	121
PID 884 wrote to memory of 5660	884	msedge.exe	122
PID 884 wrote to memory of 5668	884	msedge.exe	123
PID 884 wrote to memory of 5524	884	msedge.exe	128
PID 884 wrote to memory of 5524	884	msedge.exe	128
PID 1644 wrote to memory of 3184	1644	Wave.exe	132
PID 3184 wrote to memory of 3148	3184	msedgewebview2.exe	133
PID 3184 wrote to memory of 6100	3184	msedgewebview2.exe	134
PID 3184 wrote to memory of 6100	3184	msedgewebview2.exe	134
PID 3184 wrote to memory of 6100	3184	msedgewebview2.exe	134
PID 3184 wrote to memory of 3996	3184	msedgewebview2.exe	135
PID 3184 wrote to memory of 4780	3184	msedgewebview2.exe	136
PID 3184 wrote to memory of 4780	3184	msedgewebview2.exe	136
PID 3184 wrote to memory of 4976	3184	msedgewebview2.exe	137
PID 3184 wrote to memory of 4976	3184	msedgewebview2.exe	137
PID 3184 wrote to memory of 4976	3184	msedgewebview2.exe	137
PID 1644 wrote to memory of 1812	1644	Wave.exe	140
PID 1812 wrote to memory of 1312	1812	msedge.exe	141
PID 884 wrote to memory of 3632	884	msedge.exe	142
PID 884 wrote to memory of 3632	884	msedge.exe	142
PID 884 wrote to memory of 3632	884	msedge.exe	142
PID 884 wrote to memory of 5232	884	msedge.exe	143
PID 884 wrote to memory of 5232	884	msedge.exe	143
PID 884 wrote to memory of 5232	884	msedge.exe	143
PID 884 wrote to memory of 1512	884	msedge.exe	144
PID 884 wrote to memory of 3928	884	msedge.exe	147
PID 884 wrote to memory of 3928	884	msedge.exe	147
PID 884 wrote to memory of 3928	884	msedge.exe	147

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://getwave.gg/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffd9d47c188,0x7ffd9d47c194,0x7ffd9d47c1a0
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,17134392749552683319,7890481648907162666,524288 --field-trial-handle=2212,i,7272094110124471151,16593703090769157780,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1864,i,15740231952637751022,13481294463671032127,262144 --field-trial-handle=2212,i,7272094110124471151,16593703090769157780,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,13371007398214230938,4408631186140588096,524288 --field-trial-handle=2212,i,7272094110124471151,16593703090769157780,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,5628301140338275147,3402428473763908817,2097152 --field-trial-handle=2212,i,7272094110124471151,16593703090769157780,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,7649493484327572399,10504345791710387986,2097152 --field-trial-handle=2212,i,7272094110124471151,16593703090769157780,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4128,i,9757880127482466944,2056504455217152679,2097152 --field-trial-handle=2212,i,7272094110124471151,16593703090769157780,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4144,i,5686249403774429737,4747988504693974834,2097152 --field-trial-handle=2212,i,7272094110124471151,16593703090769157780,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:2
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,4595370188445053938,11185779413022412442,524288 --field-trial-handle=2212,i,7272094110124471151,16593703090769157780,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:8
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,1051863578749372068,223067026824215514,524288 --field-trial-handle=2212,i,7272094110124471151,16593703090769157780,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5484,i,15312930983524967387,15784402335734430184,2097152 --field-trial-handle=2212,i,7272094110124471151,16593703090769157780,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4120,i,9952535823475702569,18333269807421964556,524288 --field-trial-handle=2212,i,7272094110124471151,16593703090769157780,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5824,i,18246167086757821791,14686774636657999148,2097152 --field-trial-handle=2212,i,7272094110124471151,16593703090769157780,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,18265465725594187796,14145530670295150217,524288 --field-trial-handle=2212,i,7272094110124471151,16593703090769157780,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:8
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,18265465725594187796,14145530670295150217,524288 --field-trial-handle=2212,i,7272094110124471151,16593703090769157780,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:8
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,1758473503535768609,15067841438915844014,524288 --field-trial-handle=2212,i,7272094110124471151,16593703090769157780,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,7537365375515877289,16217875368651984560,524288 --field-trial-handle=2212,i,7272094110124471151,16593703090769157780,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:8
  2⤵
  PID:5652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,171311855346750328,16365737911627863423,524288 --field-trial-handle=2212,i,7272094110124471151,16593703090769157780,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:8
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,5504420755177870031,1243652473592640148,524288 --field-trial-handle=2212,i,7272094110124471151,16593703090769157780,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:8
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,24385923069940556,10339390640434502323,524288 --field-trial-handle=2212,i,7272094110124471151,16593703090769157780,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6320,i,3457241761939256645,2138676386866258607,2097152 --field-trial-handle=2212,i,7272094110124471151,16593703090769157780,262144 --variations-seed-version --mojo-platform-channel-handle=752 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6964,i,4566367060759203290,15697753608472889801,2097152 --field-trial-handle=2212,i,7272094110124471151,16593703090769157780,262144 --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:1
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5648,i,17589359377757205558,7911826108645030809,262144 --field-trial-handle=2212,i,7272094110124471151,16593703090769157780,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=4880,i,6109864949652210379,13268546911354842045,2097152 --field-trial-handle=2212,i,7272094110124471151,16593703090769157780,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:1
  2⤵
  PID:3928

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3088

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
1⤵
PID:5936

C:\Users\Admin\Desktop\New folder\Wave.exe
"C:\Users\Admin\Desktop\New folder\Wave.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=1644.3092.14090117816879514335
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3184
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x178,0x17c,0x180,0x154,0x188,0x7ffd9083b078,0x7ffd9083b084,0x7ffd9083b090
    3⤵
    PID:3148
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1776,i,8177053015634864163,10408664587333145805,262144 --variations-seed-version --mojo-platform-channel-handle=1772 /prefetch:2
    3⤵
    PID:6100
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2092,i,8177053015634864163,10408664587333145805,262144 --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:3
    3⤵
    PID:3996
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2420,i,8177053015634864163,10408664587333145805,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:8
    3⤵
    PID:4780
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3692,i,8177053015634864163,10408664587333145805,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
    3⤵
    PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://getwave.gg/resellers
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://getwave.gg/resellers
    3⤵
    PID:1312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 38cbf5b6a486ee67c58f888162c4b1efc73934f894d8c8462a1c1a39d1b30632
MD5 66a0f3aa6408ea757521465ce118ccdf
SHA1 fb52b5c1b41c3d2d991460584025a99538470d98
SHA512 05d2f868c0717a99c0517d94ee0fc4d82c92c243f52729cb715cc5e34e940e5ac2bf3b72d8d96667282a3e5da4563755f5768150c86f290b4409047310f4fb8e
TLSH
T1EBD097303559BCD1C038007084210220AD99864B22A2820B3000840AC8A62C0B2C68A3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 32e1e66a9c4b36db9f14ed87855db8bf1cfafabb5b893cf68245647cb921bddc
MD5 6e607c7796ccbba3823e0465444cf6ad
SHA1 a579d0dadb2ae36b3f85c557070a17a73bdba9cc
SHA512 4d024fedfa3a0d3785c844ffda92ed5d38820646252fd09f8a73c4b5ecd7887438d80a41901994fb26f2576060e52d9c5585d7d77cde3e6ac8e8eaae000b611f
SSDEEP 192:9TLjYBodHnNILubQk1k8zj39VzCKG037LLUQL6R:pL0B4HKSbQklv3GKGsHAQu
TLSH
T1FCD1DBE44BCD15A2DF6119FAC9F018C6337470DACD238F86704A573E69776E2C896688
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1edfcd8ae3ed13345e54e821acae75b3dc785f44bdd3165950d4478a3676800c
MD5 01f24cba25935a545c3f4fafa6b2df2d
SHA1 0918531c9203b25a400de42c41d6fb80dc711eba
SHA512 4d5acdf13364cb33cf1ed84c7f891798677c2d144418b78f9ded7d1e13df45b86751a789671e7fc7a474303a9121caf59eb68bcc76e600448cea25e5b375c0d9
TLSH
T16B811BC906814442E7A21533DAF11AC8337260D0CE379ED5A247993E96BB732CD67B4C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2c8662f57d0834fd7156179e434e0b431cc47f12654aa35ef7a4d79569aec4f3
MD5 b775eb4c95a928b8115bdf57adef6df0
SHA1 a1bf7a17a41217997126db58693b27fb56ec6bff
SHA512 dfd6a316f7afbc5c95421bb54be1990d9804de07a4a9f28a75374e87d105eead41456e12c5a3f865a06d68df4f142c88a5ddf5f8e14b70952af478e09d225e22
TLSH
T188713CC506954041EBB11573DAF00AC83274B0E0DE378EC6E246993E99BBB32CD2BB4C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bb8b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bb8b.TMP
Size 3KB
SHA256 01fa43667fcc6439ff0799369c8795f95bb4f6cb9b242b6632cf5e01173724f7
MD5 24649a8e8644868fbc3700d49ea60803
SHA1 f2445a07bacb1d22f1d135274f6ee0499b803b1e
SHA512 95e0124905f4c6df1c4c47e6c46339c4080c112df4aefa7cf4159dbf4065ebf21f215dd107604fcd284f4a2a2ee59cd4c19097e10be506c79effa610ac6ca1f8
TLSH
T13E61D7C506810541E7611173C6F01AC836B1B0E1CE378EC5D246997E9AFB732CD2BB4C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 c9cff2b418e257ac211aec09fd400d7781b6a96dd37aeb90d957c79d0214b6d5
MD5 73fc8fed69247586beb8b1670b3cd3fb
SHA1 e2974e004051a3802f6869417d144cd89a76cff2
SHA512 acf2f67a5861aedc59143bb37f1701353aaf29ba13c4cdfc41b86a8e9e61eac62dd5d0aa210b775c47a265630815f3d36e75d5afe4216ecfb4ee8c97400f43c7
SSDEEP 96:DsuOhlm3KRPjC8zzjpqJFZ/GZ5paDcuw3tO:Dsdhlm3KRPjC8znpqJFZ/GZ5paDcuw3M
TLSH
T16CC19DB7C3E9862DD91156F0AA14BE1BCE19095943683D2AC8D4BF4BE3F18B1E21174F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a416e973b704de5e31585fb2af2fc93c0ae85d1ad6a6ec06ee2cd0dd407df918
MD5 c0d77e10677ebe1ef0ff9cf46092240d
SHA1 d262ca93ac150ea9daea49ca234ad834faaaa189
SHA512 3474bddfbc79814abbd86a14b1996bd83a901b191d0e061b04e473acc03968882b5b5d549ebf3177f8c5459bb6546b176d8c80dd22c20d63e3d645cc25492cdf
TLSH
T1762178B3C2D98A6E8A0116F06B24BE2BCE1D0D0583283C1AD8D4EF1BE3E2476E10155E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ba7245ee3f474aa892d53329a11a57d094ae90e276bef494a976a246a4b61fe3
MD5 d0c1791030d18644bac48933da8e5728
SHA1 2e4b9ae8d6ac4bed22c6be39567813fa040d8812
SHA512 e4f2af6aae610bf06c002e2074c8e749904b086c1d9029f57c8a7ead121d67501a28f819b09fe3ec337a8685e9304bfced3a6450323d47b5e00000e33d867151
SSDEEP 192:sxZ2RpyM/jK1Ml8M98/fPsbYorEdpY5HW6+WNn75/YwTaaiIgrJ:sxZ2H18/fPs0ooYHbd/Q9
TLSH
T11E42FA126A34997BCDCBD20DFA45BB53DAF54562A2940D44E9FCDA0C04E6EED231381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 af774968b83273b8c2a146fd2ed4d90a13f15b87aceea98ec30788a31f501d8d
MD5 1f846e4e3babb8c9298d159de9005695
SHA1 b169ae29f4449d8d8e05317efed69fd2c285f7e0
SHA512 ede51a5efea47ff3a6f146e57ceb6decc83e1c881e2ea78206c134f13fb6694e541269b44e50790d5202657c82c02ef7783f73cb3e9840b0d8e1ddd5f12a4dc2
SSDEEP 192:sxZ4QUnfRpyM/jK1Ml8UQ798/fPs+VWpVn5ObZCddp4XAHHW6+WN35Kvkb439/Yh:sxZunfHqJ8/fPs0Wvn5W81HbZK/F8
TLSH
T1BA82F612A534497FCDD7D21DF906BB67DAF81062A6940E44EAFC9A0C04E6BED2313C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4d5f77b5718138f313f889f048fc31cff35cf150b1bf7e95708cb1dc96a4bc08
MD5 0b89b2c125d7bd0527aaa30c89d357f9
SHA1 90dbe6a7722b6de60da319ddeac4c06a5e030b7c
SHA512 375b53e693b38e80720c605d87d736cf963aacc263d0551b5ec3ba8cf9d4ad49d1b755af22f9281b9e6330405ecdfa697a3cbf00aebedef0c980872e6c759c10
SSDEEP 192:sxZ2RpyM/jK1Ml8Mj8/fPs+YorIdpY5HW6+WNn75/YwT1ViIg5OJ:sxZ2Hb8/fPspo0YHbd/4Y
TLSH
T1B552E912AA345A7BCCCBD209BA457B53DAF54562A2940D44EAFCDA0C05E6FED231381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 233961ee200bd802a0b1dc3538aac255f8b269cd5aba8b562b5ccce94736a35d
MD5 bc9a018e914458c22252c19a38bf877f
SHA1 3ed1f05fa3353ea6407a1db53e48bf427624e51e
SHA512 cba2b9a0a5527a15e4ab054e5b79be3dab2e344beac9cee231798a8c62e8d19ac55de70d5801fb3bee07ec27ecd321a8fcc80d4697a2da1e6896855056abf1eb
SSDEEP 192:sxZ2RpyM/jK1Ml8UQr98/fPs+Y5cIdpdAHHW6+WNnkbdYwNN+IiIg5kJ:sxZ2HqZ8/fPsp5FAHbIdoC
TLSH
T14A52EA126A34597BCCDBD20DB945BB53D6F54472A2940E44AAFCDA0C05E6FED231381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 361a260ffcba8eb2df21d7c69ade1bf9f497526874e4e8bece853631c7729c8a
MD5 b21d2b62393b69a453f8f5bb6868dccc
SHA1 c15110792b32a7c1cc59f7dc3576304d258921a1
SHA512 baa79da1be684898a30ab068bd4083b0f9a8518ac19876e3726adca5344a6e7d62652afe52c33f001946b50dfc1364b78063c99ce425a2e691e0c7c3e37a43a4
SSDEEP 768:524jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dyrohbcmas:524jeXmWvmKLEu1jacPLZQdpaq
TLSH
T12FD20A3B240CCB7E4F844E5CED2AAF976ED801CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index
Size 1KB
SHA256 133a4492a1d53acd9ac4f22ed7f405197efda83c2265a198dba0e32706202916
MD5 b125f17c071f95619a5b91143029a8f4
SHA1 616ff5d3ac1b7a8ab8f91f33f50c46b28f3094ac
SHA512 6566fe07447b8405152edcdd1eef2eb0a13d920475d12ca471b8d41c581d961cd893b7f58106327a779028b84b2abb093e196128f6ddcb087567611529b2e550
TLSH
T1E531934E8E80DD9FE45845B314B7B8F8333089CC5720E7239C2C62313E2675A1A5B1EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index
Size 4KB
SHA256 59a434dc1bb5af40a7f4f606b750fb3fc511f76c2c64a3f4375231254156b187
MD5 31b73ee38234ccd7f5503e10cbf9b114
SHA1 d4e3cb5496a90e13075c69e5746b45c602699832
SHA512 7ba5aa76eb8b640225004e1ac07f1db1d8cbf57f19d0e0e1e295935f243ed926d5de576b67587ce20436c1c45db90d03f6eb007ef4285476e1cae98ba1d1f78c
SSDEEP 96:u20KBiMFPjA2sE3Pht/a0um/UlapRjzl+EAYF/n:uqBisL9t3fkC8avj2YF/
TLSH
T12F91DA8D8C466A1FEC7C017315B614D83371A9CC5B248B13387C52389D43B69199A7DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a5545.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index~RFe5a5545.TMP
Size 1KB
SHA256 56746b6dc569929bbe91597b827a5e94842fa5b46bed2d9d8fad57165bc14aad
MD5 81c1c3e4573ca7b5128ee275eb713b68
SHA1 1f1895e8418e3325322f479232940c485d4531a1
SHA512 68dbb30dce3faa65ee84bb2e57e12df34d9ca876bf86ede29b83cdd91ec9e57c0046293ce0b3db98c311dc808826d467a2acf392504e08964b982fc7a84f8df3
TLSH
T1C331464B4A808A1BF4C450771DA3B4BC7336C9408321B793A87C6239AD31B9E1E5F0DD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\834819d4-20b9-424f-9271-71c3bb438301\index-dir\the-real-index
Size 72B
SHA256 6109e301f37afda7cb1675fbb096f67448f0b865dcfaa6b866dc7f521075fe49
MD5 bb3e716e05ccf9d5d1ea1161e14d6b43
SHA1 35f24ef31569d98573b7dfd11f2a8cb032a69f2e
SHA512 c205cfd079b14175bc1e828a560848de34c0f921c5b9cbf4cbba2d666767e94311c7594439bf83c5ae321259c5f71f1663ba8e643fc002f124750a16ab4b126d
TLSH
T14EA0021503D00042D00351B11DEA016216504A20E120D729A2952644C8E04E68B5704C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\834819d4-20b9-424f-9271-71c3bb438301\index-dir\the-real-index
Size 72B
SHA256 6c9374ed5482f14097dc0865fb7a006b4fbceebe3b71a0794fa2d6e6bf2f53ff
MD5 200f70b7b3442995afc5aa38a872de23
SHA1 5069546e4ac4a2dfb94819093c19c437ec10092c
SHA512 5f3fa8fdb486f2ec6e89c4841d06f3c1f96f7f0c630857800c6270c2157d977652e3c83817efe6120b7cf1aeca6ee937d37081b6f1933925ffd83367785eed87
TLSH
T11EA00211ABD48006C11311B1555303421715CDD12145131740E20149DD614418D8200C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 3cb24c37dda123b2512eed1ad54d0f0a7c9d9b16e0a7625fbae69ca03cec0fbd
MD5 35926487073ae1ac2c8788969a8f18ac
SHA1 08416c36e3648bb15a6f19f27f953eb6c87d1b73
SHA512 37082e0a96de97ee9d3de8bcfcede599cb9d457fa84a5daaee28aacd2c067d714da6fcfaad1a8aa13cb97dcfd65e9b8801af4dd083694babfca0dbbb241bce88
TLSH
T169E0D8F62DD72D20AC7F87E628B245A44156B468C555EC8E2416E2E751B02682016D61
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 8e5cfd4d53f3f01f5d736bffd6ae24de1d3a0861133bcd0f7ac97e8820648a8e
MD5 6cc0be7463c75143610851d58b068688
SHA1 867bbf3cab68a4ee457b949406e3c560e61b6ba1
SHA512 e7a765d982f245cb69a45eb6ca35135b5f2b18831d39270829d6246e2a63d4124cc8ab405ea13d45f785163d39799253bb7261b94c73d97ff45ba33037c05230
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5a7550.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a7550.TMP
Size 48B
SHA256 7379679c3fe3a5ec3a9b3145b4ef5d6fe6cfabfb1d6938ffcb0e4e978fa4ac7a
MD5 b97e078002d01be0cf6be2833c0b0145
SHA1 f2708292cc9eee83db29fa0fd16227da00e4dc7d
SHA512 79509357aa3e32cc7d5082b2db6551abab269a3bea8082aeb1ead5fc42eea11acfa43d30729c582799e3ec74fa8b0b18aa81ebadba4ed2fd1a6f01d184bb5b93
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6f7a2a5d43fc12162f8ad6068a20f2b61c04cf160f7201c78a07ebf46622d65f
MD5 4d706d63cb3d21b91636b73d8eaa04e3
SHA1 4371490cc4e7dc8e4aa9ec0fa231317f10498781
SHA512 c3ae0cb03bbe22564d05b452b6e3e968fe51ac72786f51982b386f489302be25c30660550956bee7dedb6e0b9d0521cdda6d988a9b91951103c92c6a3655db2d
SSDEEP 48:KIdItKmIoXyJWI3Kvqw5lCRVnrHITTMbI4tIK9N1fIpNYu8fVFyDS7Ic6s4bTIF:KIdKKmIyaWEKvqg+cK7aWec
TLSH
T1EC91310130FB16023EBD391991E0A65B5751716330ADA83B7FB820A20E6AE255DFDBDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe592272.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592272.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 ca9d072a001b3c1388188db7a17c0d51e15118cfa3cd055d7a1bb42d6b41fa2a
MD5 4e658f41c4aa1e830b04010be3c25098
SHA1 0a725d25271ecdc34e32497b89e561f47912a45b
SHA512 cfaafe8c96c7594f35de866ad5147d1c5212895cd8473865ab7aad5767483774189aeabbb5a84134fc7eacdd502d9c2eb5bd78f282b14a095657ea96f9efa55e
SSDEEP 384:2tNn/s3n9SfsNGQFix322f+c8sJ8Xl+24F7ITGT0Ivx9I:2j+9UQQ2m72llm7i+0OvI
TLSH
T1BA928D335839AC3B4DD29595F40F32174EF845ABA6C67F84E6EC6F0C04CA7AC231A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 52d572659434d270c905dea5ee171ba06869c9c655ef02528f57a82218472c2c
MD5 54fa0d617912a7962098d6968c9f24ea
SHA1 40576c0a8d720046002b691fc3f8716903e082aa
SHA512 39b4a12f3115f44e35fd79aac7b8686476c54c92b27ff55384510dc10b8b460b0b0ceed66edc751399962f73cd6217a11269d282c20ad6982712a73d3deb5d60
SSDEEP 384:SiFytNn/s3n9Sk2sNG8TUNTUlIlpFim322f+c8sJ8Xl+2pF7ITGT0Ivx9I:ZFyj+9S7wgxv2m72llD7i+0OvI
TLSH
T1FEA24B335868D87F9EE69A95F50E22174EF441ABD5C6BB95E3EC5F0C008A2EC130AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fcaed35191ac1a99881d4b4a1e49a72e3d35e6a73bb02d1339b8c88cac229b16
MD5 661c9992984d6b921170b3992585cfa9
SHA1 1b0bf1a7e7f5cb077709b5f6ae7a00e5ef0d7e4d
SHA512 4e5f0b476ef1fc44382d133b27c6328f091bb37ec6beed9c1460a0abcf2c0d76ae68156f6443e53b6f7327ddebe8a3c8ab986af4dcb46491c8dd5d8b6822cce4
SSDEEP 192:EONC6hZ0QmiUyVFpc/+jVKjzorDoJmt5wOZCUU6:EONC6o8pu+c8sJmc2bU6
TLSH
T1F302D93568786C7B8EE2AE45F48727235FD8112BEA956F84D6F81B1C00C779C2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 02bd948512e005e14d13bafe4a54576bbedfef30d2f8c3730508b7626e64bf46
MD5 e25ae8c09e3d56d9830bf9552efa9e74
SHA1 342734d63ad08c5be355223e0890f0a9eced4057
SHA512 01d801badae106723d06091a2c2cb9071170b7982cf476ae6f2ad9c20e123a9c4f68a6b840d5ca0716dc4addc6d6c043e9be9a544d7d656fd8830bb0ccbc5bd9
SSDEEP 384:SiFKtNn/s3n9Sk2sNl8TUNTUlIlpFiLp22f+c8sJ8Xl+2PhF7ITGT0Ivx9I:ZFKj+9S+wgx22m72llP77i+0OvI
TLSH
T13DC229F348D7983AD99D4747B73E2D164EBCC0A7B5856A84B3D85A0CCC862BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 8185c261c687875b348f3308960f88c513e41493676b0fec80ba0d9aebdfdbd3
MD5 a5b31ccce23ada67a1cdf8a164d8680d
SHA1 343bd54910abfc752e23284fda2f06988b622ee0
SHA512 1793bab8c75593ff25a607e5a89c31bafbf4721339fff2c2d2669739cccee361bba30d1c0e084439fa26e5301f617e11b7709eb100a9be48528496327053c880
SSDEEP 768:ZFrj+9S/wgimJ72llP7VCWSVXqt0i+0OvI:G9SbadRW6t0i6vI
TLSH
T17EF27CE284D79CBAC89C87C7633DAC0619BCC177B5895548B3E86A2CEC4B1BFD356850
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 8e8416166afa5c8c2f5aa381a07a49efc00a39d1b11caa8c90109ede41e2c2b6
MD5 d3017bcbb8c2506b25e5a14bbc772239
SHA1 b86ff4c21b5c78cb509109854e92dedc9a90dea5
SHA512 f21cdc0360fdcaccf382b3d1b0f0a8735e74bf731eb213066a39b73ec0d5ab98a24d12259da3b8f1e62ea76315eb48afd338fc69bbf1cdf63b84d37e9da22077
SSDEEP 384:/tNn/s3n9SSsNGMFim322f+c8sJ8Xl+2LF7ITGT0Ivx9I:/j+9Vgv2m72ll57i+0OvI
TLSH
T18B927D335839AC3B4DD29595F40F32174EF845ABA6C67F85E6EC6F0C04CA7AC231A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 d04b3e46a6deab7cd43bbe2b77029dd1b0a4f5833ddf0349b792c56667aff49f
MD5 d722c51674d9c04fcc970029d9f7d487
SHA1 b34c141da04d4df5e5a31943fdc699053e981bd2
SHA512 2c907a9be5cab0876dc67b13a82d234ced01d56a0b14fa8805d9ef841b73f43361d621e3c05047cac1346178e253059138544afad01f2571465dae9a7a0eb739
SSDEEP 384:stNn/s3n9SSsNGpFim322f+c8sJ8Xl+2LF7ITGT0Ivx9I:sj+9Vlv2m72ll57i+0OvI
TLSH
T1FE927D335839AC2B4DD29595F40F32174EF845ABA6C67F85E6EC6F0C04CA7AC231B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 73339ab72888bb708517e05ec78d9effc85b13895ac7174d9458aefae4f31d3d
MD5 c8c830a4a64d99dc2e03d1ef581ea3c1
SHA1 944a122465b105ff56303763a2c972f77de11a8a
SHA512 decea4702ee5d6d3cabf157dc3ab5f15dc72fc9fcc3887df16329f57fe2d6ee1952bc8a65a1e04e34257b32284017e75f3f926616442171c1b37366fee83bb3c
SSDEEP 192:3ONP6hZCQmiUyXFPc/+jVKjzorDoJ8Xl+2Z5cOqrqoU6:3ONP6KUPu+c8sJ8Xl+2M97U6
TLSH
T19D12FD366868AC6B5DD2AA55F44B31134ED85117EBCA7B94D6FC1F1C00DF6AC230A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 fc816d567247e416c39ed5ac61f51d4bef45d3c7e196bb1962689c678e1545a7
MD5 0c19127fd9a78de1e5bc8eb29a947d7d
SHA1 cb8418e71364a8a8b5ebfcef0fc03d058a5cf2a1
SHA512 611456e17e7568357782ba291168f329cc8280d38bae91bf0095acd2e68a71fc54dea4bf078005bc7270a7ea9e4ef936d26c904cfbe3c7f3ec57151f3b6aa0ce
TLSH
T130E001029302456AC02C023000971B607FE1C02041A303070A2001682C62350BE60A88
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a661e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a661e.TMP
Size 392B
SHA256 7468d0a76326cd2b09896b378308c4027db04fe0acfaeb2b8b25197e67a6d91a
MD5 86d951fc361a93eeef8a052a9124044a
SHA1 a72604288def766d58973b1e3b907579e9301f1c
SHA512 6cac81e759e253b8ca6beab7df1fe42ffbea3a353c29becaa1fe37d1f09657430cf0d20cb41d7e993962fad6a4f13bb2d01b108a3d59dbdfc01fc3fbf4527381
TLSH
T15CE0020293024566C01C033000971B507FE1C03001B303070A2001682C63350BD60A48
MD5 SHA1 SHA512 TLSH

Submit Download

a150b62d-6d07-472e-a58d-ae178c7b9e84.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a150b62d-6d07-472e-a58d-ae178c7b9e84.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ec9662187428ed344495c023593a22492ab6a7d79403bc8f5da4c6e84fbabe4f
MD5 ff27582b998e0ee09eb6285520a8528d
SHA1 ab428fa0a49f5a314c8512b1642fce70b1d35350
SHA512 f2885d9bc81d53d01b476662c0e10b03e353baba07ecefa1216bdf7fb954cba8b05bb40af22d089f6b37dbc00f74c98ec762f0215bb3da4d18c443549ad407fd
TLSH
T117412B5CA6F91148B3B76E5AAFF6A86D847B78732E06C45E10120E4F0A22B01D962737
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 636928e997b876af3d55e00119ab5f58d18cab68951fea13e7eb7e6383f63c9d
MD5 d45838b8d29da632e103689223108ca2
SHA1 b5633323929ad29c2d706fd4ec1f2aa108ec04e3
SHA512 d29cc502b740be29fcaab75c78feeea48ff4cadd26ce720418a121a5b57e146716b922fddc285d2dc6e9a45518f4922f6e2389a2426f6ffbcd559ade7426935e
TLSH
T12DD0047551403400D030D733305DC510410445C0C745411530150544044555D0007054
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5c715d7b360401ccf4432bf13a99f040d6dddb424f53b197ab2c114914e64571
MD5 5c892d87c64135978097eab286169e4a
SHA1 7fc030a82b26c41e380b8b02e05b8becb729d861
SHA512 f3387c6921029f7345786203ed0c7526b6e8ba5a010ce6d09c1b76ebd2a321cf66dca9252b476f9f172eb1b86cf405ed748ee7a636be728a03788f67b7f3c9b8
TLSH
T1CBD0122732411534C03066332047A5080400C24BC2498005742D8A5D1A084A80907491
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 696B
SHA256 f4751487c50de416b72cceebcc98897a5211c9e9849b916e7a1f2fa68504db0c
MD5 0fed374c2526dd919a3e13e2148d10bf
SHA1 51f7d62d54e3b98c8a697c065c1b261cf0f2e389
SHA512 5d125435d37f8088c529609243282ac15b6c20bf070dc291c42da4d8c82c87dbad34483e4a8d762d9aa0c27c3f8f014fb572d1f2d84eb7b5c3feceb40a69e30c
TLSH
T16C0155A4CBCAB219FB035CF163C12D25B7B213E098231F83B04605B8AA4B7E12220A47
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e3ee.TMP

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59e3ee.TMP
Size 48B
SHA256 8aa090c32eb14f74f5f94d182e8951b2df52fdd9a8d0cdff0320e48e3dfe0934
MD5 41f203426b0c4fb42852851850c2b41b
SHA1 5b7dce250f964fe4f53dc9027577f4b947c668fb
SHA512 9cfe0dc56f6a03f7856330768f3f95460822ee8f94dc29396dd355e2c1a0abb0c48b1d89782181177efca836783d65cfab91fb6ad36045246c2424a9a400c9fd
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State~RFe5a828f.TMP

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Network\Network Persistent State~RFe5a828f.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 307412ddbde6e7160e5cfedd185fddba766661daaef254cd44b14d8b3379acb3
MD5 fff7514f5598710ffe2a482699b6211b
SHA1 4335ec6fdddeafb8d2411b663ca3376a4b2ae021
SHA512 07fbbde08fcbd52ee40f852d0506de0ea02db28cd940b79237b3ba2678768f9faead54e317cf1e445393ceb4d2173c0f99b61ef7fd19ec14011e31c0c65c4be0
SSDEEP 192:stXC0p/8fMZ8paam/S+WihTMwdTivDMKC:stXnp/8bC/VOwsnC
TLSH
T12EE1B8435E28597B4CC7E21DBE35FB56E6F5202266C51E48EBFC8A0C05E66CD630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 069dac5b6630727f21fd13a8cee57821d2a7d6f13d343e89409c7b913d582b89
MD5 83bdfabb128bb11125f5422af7ef199e
SHA1 4ede34269eb4964b5b488e48b787658e72b915c0
SHA512 a58e9324e3e23b2d3187731e2a619deb2e1f12217e0674c1f8945def015c7751dc08742cb29037ae7aa4d0499911805c34858af445c4cabf619b2d42397205ae
SSDEEP 192:stXC0p/HfNZ8paam/S+WihTMwdTieDFM8:stXnp/HwC/VOwD68
TLSH
T112D185439E28697B4CC7E21DBE35BB46D5F6206166D51D58EBFC860C08D56CC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 a818bae6f9be9a059d2cf01efb57e7a4898238f5f8bf645336c097f163fb6b56
MD5 ee29245d848458fe91e11eb64da26afd
SHA1 a85964fd8d8fa25282b56cab499af5cc7c7f9748
SHA512 9ac83fd0f60df8363d6e6e6d28f148889abf6637e8569034ebc06bb7aa01701986af6b6a0134934535311510f6f61ce6dc872dabf61ef339efca1fda3d8dbfb9
SSDEEP 192:stXC0p/8fNZ8paam/S+WihTMwdTigDFMC:stXnp/8wC/VOwp6C
TLSH
T191D1A7435E28697B4CC7E21D7E35FB56E6F6602266C51E54EBFC8A0C05E66CC630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59e2f4.TMP

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Preferences~RFe59e2f4.TMP
Size 6KB
SHA256 713a98a86190456c1ee24c4ba11d032e4363c3fff03492b12b57aa70bd054ec0
MD5 d1c929eabf3dfc5b44a77ffd92408761
SHA1 282bc59bf8e3de86be6120b414c2943c9259d737
SHA512 60de93317ed2091d6732681a876cad96a1565a1633e3ddbc06da73cf91c808721fe1f5944bfb62d46152e455d0e3bad7e0f41cb84b7fe249456d0af993bb7213
SSDEEP 192:stXC0p/HfLZ8pFam/S+WihTMwdTieDFM8:stXnp/HaV/VOwD68
TLSH
T169D1A7439E28697B4CC7E21DBE35BB46D6F6206176D51D58EBFC8A1C08E96CC630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Local State
Size 1KB
SHA256 c3c5140c1e7a1aaa45864174d00ed247cfefd47bdbccd20d8e05c584404da11e
MD5 cf5a378ba4b7b75e9a8cc073da3e24b0
SHA1 69407f5e2ecd05e036f18bc81b95f43499fc0d94
SHA512 71f4529ef235ed4c25a3bc9fdf5851410fe7effc8a44f01697f6ea17b1634e4df004be0d6c7cb59de4e6e815a6f8030a05c0b9007528fb53630c2b74b29e403c
TLSH
T15E31B773E4912A3659C26A4BB681BF5B2E226055C1515E54E2CF0F0803D35CDDB3ED33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Local State
Size 2KB
SHA256 40fb634da487b255469fa502036eb757c375634230dfac3892d317d6446d54c9
MD5 76004097d9ed0fbff17a386f405d70d3
SHA1 3cbde1ecb767bb27d7e91cc791a49cf37fbb200d
SHA512 bb0c583dbb5ef791bcb5138ff289f7b7505a07f7690c5d8a342427d5e2d5c791f801cf30dd2987c433eaf3d0aa9dc9d87b3ab51e672ea109442fce4744206c3a
TLSH
T12851D733B800AA3B49D35A4ABE857F22AE36A155D6523F60EADE0F0C02C759C1706C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Local State
Size 3KB
SHA256 10394049efd597465b8bdac2dfe251d42b53ffe07362d58daa37ed292eaaefa4
MD5 ac38f1b07bac188095e85177401aded6
SHA1 2635117a270558a8eeaa21dd33d5a125ac53febc
SHA512 0354fa85bba7dc860d43913c60760b6497f442e199d8851188328b12b178bfeeb36b11e890451d1bf5d4bd2daaef35c615b8f8b37d1ef0cdc66db1a247848432
TLSH
T1DB71C833A864A93B4DE39A0ABDC53F167A615127E1953FA8DAED0F0C02C76C81302C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Local State
Size 4KB
SHA256 617af34ba878165a8427bfb5da389f71d140bef0dcb6dc533f158752c9583e2b
MD5 5f2b7e16a1b27393a134777647cf8524
SHA1 3796c13aad06683fb47c90ce0dd7e2a9a4eff92d
SHA512 c15e6da53841f2d03b55305fa166a697a13d58bfe51dd0762909131b0e3b69776d88dd7052f59751d764a03efd2d0723ddf7f0dbf1cf270f1cb27698ca6eaa80
SSDEEP 96:zu+bNkCEjKHfrztXV58Frh/cInURoDotoicQnzDCB2Zi6YfZfsT4Jlsa:z7bNb4wztUooDUDc6HC2Zc04/
TLSH
T15881D732A471992B4DE3D90ABD853F177A61A027E1953FACDAED0F0C02C72C90302D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Local State
Size 15KB
SHA256 bf51da8cc3a690c1418179676f3fa729639e480654db1a07cee615c094c87c4f
MD5 676b4686654a2bb1c0ebcafb0b24ef88
SHA1 4b25efd771d550cef066686faec287aa65c73a5b
SHA512 d61c0228c21ff5e2210aabbd6f7f4d0cdd1aaab6af1b900a725f8a5bfd62409b885642d0c5e971566dc49eb8b07ef301354ca090d4b319d567a3065eb112c3d5
SSDEEP 384:z1Ojae3af7pOMe4tyUOh8iqLyWpMmGrNb44S4i5mwjAMC:kjaeqD4MlshiLdMmAwcwjA7
TLSH
T1E172AE9F59B42D7B8C73A80ABE452A5B5E304199C2963F9EEDD91F0E029B1CD1702C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe596f79.TMP

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Local State~RFe596f79.TMP
Size 1KB
SHA256 7c8f201c0867e64daa872553b22fac3143ad75048c077f3cbc06466e3b4862ce
MD5 de2c6f49c900fdbddff316085390a526
SHA1 f742d156541a2910942885d69001748e667beba1
SHA512 ce99bbe20b821fdc0ab2332db6bebe942c08ea33e23a7165c44a39076bd862598383f8160193a831dd7d53159a9fd3b9a1dd48b6ded6cb763705f4bc7cb4d302
TLSH
T16E219573D491293A69C1594BB691BF8A2E616165D1545E18E2CF0B0803C78CDCB3ED33
MD5 SHA1 SHA512 TLSH

Submit Download

Wave.zip

Path C:\Users\Admin\Downloads\Wave.zip
Size 26.9MB
SHA256 910be06d676caddaac3e2adb0f1556dc83c31c752d43d08218111de25cd0cc45
MD5 5aeb4075d4b966b671f2a86420a8189e
SHA1 ca9fde95b716382a0beb9e652e779e62b945421b
SHA512 893af84d874eb9ddbd9e2682301f4c14fd22a5784c97520516e018f14dc6401f615afe9ab3100777c92a6683a8111e9a665e7f97e51b2b77d354739ecff4ddbc
SSDEEP 393216:aRvVDdIgrZTCgQ3JG8Jw92zzMxJW04/pvJ7TIykvrz2W64bwQaIDFkAZG1KmWVf6:a1VDdNOgsJrJM2UPWpJ7U5rQg1FRo966
TLSH
T16D5733CBD4FB55E62A3B1913A5CD84D85ED4ECC863ACCA65A2770F1F036E3D3616408A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1644-538-0x00007FFD630C0000-0x00007FFD6569D000-memory.dmp

Download

memory/1644-611-0x00007FFD630C0000-0x00007FFD6569D000-memory.dmp

Download

memory/4780-435-0x00007FFDB88F0000-0x00007FFDB88F1000-memory.dmp

Download

memory/4780-434-0x00007FFDB87B0000-0x00007FFDB87B1000-memory.dmp

Download

memory/4976-465-0x00007FFDB8BD0000-0x00007FFDB8BD1000-memory.dmp

Download

memory/6100-363-0x00007FFDB8BD0000-0x00007FFDB8BD1000-memory.dmp

Download