9bc4a3a6d8703225b3433a5a67c6f4321e49d70ccedbbe3ac122dab331f1e6e3

Analysis

user interaction
yes
max time kernel
210s
max time network
190s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/06/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Wave.exe
Size 8.5MB
Sample260630-pmpcase151
SHA256 9bc4a3a6d8703225b3433a5a67c6f4321e49d70ccedbbe3ac122dab331f1e6e3
MD5 f75863b754f9a4d393f98c1734e3d091
SHA1 ac131b494c296a465a232eb0ee2e4b447f487921
SHA512 9e2298309bd3d851f0a61f5e534b4f278e9b75491601627c8c7240b9eba66e0ecbd09de9dcb9d463d3dd4f24b6e78b7b37ed912db6dc08c14e1f757723a8f5b2
SSDEEP 196608:vGVF5MZhgMNv/dfXPl7OtttdTpY7A8MLybhZ0zLXv2Yrt3KuBbSWxzHKo+r8THXg:vWXMPNXd/hkvTp8DbL0zr1K+bSWxzHKV
TLSH
T12296232467E85663F5BD5776D8714992D7767E0A2A0BA38F2924389C0EF23C1CF32217
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5500	Wave.exe

Loads dropped DLL 6 IoCs

pid	Process
5500	Wave.exe
5500	Wave.exe
5500	Wave.exe
5500	Wave.exe
5500	Wave.exe
1892	msedge.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Wave.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
4892	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs

pid	Process
5500	Wave.exe
5500	Wave.exe
5500	Wave.exe
5500	Wave.exe
5500	Wave.exe
5500	Wave.exe
5500	Wave.exe
5500	Wave.exe
5500	Wave.exe
5500	Wave.exe
5500	Wave.exe
5500	Wave.exe
5500	Wave.exe
5500	Wave.exe
5500	Wave.exe
5500	Wave.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_1579846838\male_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_69309392\Part-FR	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_1579846838\english_wikipedia.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_2110771101\hyph-it.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_411591140\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_2110771101\hyph-bg.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_2110771101\hyph-hy.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_2110771101\hyph-nl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_2110771101\hyph-as.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_411591140\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_69309392\Part-DE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_2110771101\hyph-mn-cyrl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_2110771101\hyph-tk.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1784356043\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_2110771101\hyph-de-1901.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_2110771101\hyph-lt.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_2110771101\hyph-nn.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_69309392\Part-ZH	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_1579846838\ranked_dicts	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_411591140\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_69309392\Filtering Rules	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1444392714\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_1422430403\well_known_domains.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_910354547\Microsoft.CognitiveServices.Speech.core.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_2110771101\hyph-cy.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_2110771101\hyph-gu.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_894275102\shopping.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_69309392\Filtering Rules-AA	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_2110771101\hyph-de-1996.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_2110771101\hyph-ta.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_2110771101\hyph-und-ethi.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_411591140\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_411591140\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_69309392\Filtering Rules-CA	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_1579846838\model.markov	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_1579846838\test.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_2110771101\hyph-fr.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1492257626\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_2110771101\hyph-be.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_2110771101\hyph-de-ch-1901.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_2110771101\hyph-ga.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_2110771101\hyph-la.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_2110771101\hyph-ru.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_2110771101\hyph-sq.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_2110771101\hyph-te.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1784356043\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1784356043\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_894275102\edge_checkout_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_894275102\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_894275102\shopping.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_411591140\Part-RU	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_2110771101\hyph-pt.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_411591140\Part-ZH	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_1579846838\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_2110771101\hyph-et.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_2110771101\hyph-hr.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_894275102\shopping_fre.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_2110771101\hyph-lv.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_2110771101\hyph-sv.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1784356043\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_910354547\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_2110771101\hyph-af.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_2110771101\hyph-gl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_2110771101\hyph-pa.hyb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3808	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134272961222033019"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1935666426-3801330415-1166019131-1000\{3F89001C-109D-4FF9-9DB3-6AD581696619}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3912	msedgewebview2.exe
3912	msedgewebview2.exe
5952	msedge.exe
5952	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5004	msedgewebview2.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	6136	Wave.exe
Token: SeDebugPrivilege	4892	tasklist.exe
Token: SeDebugPrivilege	5500	Wave.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1892	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6136 wrote to memory of 792	6136	Wave.exe	89
PID 792 wrote to memory of 4892	792	cmd.exe	91
PID 792 wrote to memory of 4560	792	cmd.exe	92
PID 792 wrote to memory of 6456	792	cmd.exe	94
PID 792 wrote to memory of 5500	792	cmd.exe	95
PID 5500 wrote to memory of 5004	5500	Wave.exe	97
PID 5004 wrote to memory of 3540	5004	msedgewebview2.exe	98
PID 5004 wrote to memory of 6612	5004	msedgewebview2.exe	99
PID 5004 wrote to memory of 6612	5004	msedgewebview2.exe	99
PID 5004 wrote to memory of 6612	5004	msedgewebview2.exe	99
PID 5004 wrote to memory of 6612	5004	msedgewebview2.exe	99
PID 5004 wrote to memory of 7136	5004	msedgewebview2.exe	100
PID 5004 wrote to memory of 2720	5004	msedgewebview2.exe	101
PID 5004 wrote to memory of 2720	5004	msedgewebview2.exe	101
PID 5004 wrote to memory of 2720	5004	msedgewebview2.exe	101
PID 5004 wrote to memory of 6608	5004	msedgewebview2.exe	102
PID 5004 wrote to memory of 6608	5004	msedgewebview2.exe	102
PID 5004 wrote to memory of 6608	5004	msedgewebview2.exe	102
PID 5004 wrote to memory of 6608	5004	msedgewebview2.exe	102
PID 5004 wrote to memory of 6608	5004	msedgewebview2.exe	102
PID 5500 wrote to memory of 1892	5500	Wave.exe	104
PID 1892 wrote to memory of 4284	1892	msedge.exe	105
PID 1892 wrote to memory of 3808	1892	msedge.exe	107
PID 1892 wrote to memory of 2432	1892	msedge.exe	108
PID 1892 wrote to memory of 3060	1892	msedge.exe	109
PID 1892 wrote to memory of 2432	1892	msedge.exe	108
PID 1892 wrote to memory of 2432	1892	msedge.exe	108
PID 1892 wrote to memory of 3060	1892	msedge.exe	109
PID 1892 wrote to memory of 6896	1892	msedge.exe	110
PID 1892 wrote to memory of 7036	1892	msedge.exe	111
PID 1892 wrote to memory of 6896	1892	msedge.exe	110
PID 1892 wrote to memory of 6896	1892	msedge.exe	110
PID 1892 wrote to memory of 7036	1892	msedge.exe	111
PID 1892 wrote to memory of 7036	1892	msedge.exe	111
PID 1892 wrote to memory of 6504	1892	msedge.exe	112
PID 1892 wrote to memory of 5576	1892	msedge.exe	113
PID 1892 wrote to memory of 2728	1892	msedge.exe	114
PID 5004 wrote to memory of 6696	5004	msedgewebview2.exe	116
PID 5004 wrote to memory of 6696	5004	msedgewebview2.exe	116
PID 5004 wrote to memory of 6696	5004	msedgewebview2.exe	116
PID 1892 wrote to memory of 6684	1892	msedge.exe	117
PID 1892 wrote to memory of 6940	1892	msedge.exe	118
PID 1892 wrote to memory of 6684	1892	msedge.exe	117
PID 1892 wrote to memory of 6940	1892	msedge.exe	118
PID 1892 wrote to memory of 6724	1892	msedge.exe	119
PID 1892 wrote to memory of 6724	1892	msedge.exe	119
PID 1892 wrote to memory of 3940	1892	msedge.exe	122
PID 1892 wrote to memory of 1256	1892	msedge.exe	125
PID 1892 wrote to memory of 1256	1892	msedge.exe	125
PID 1892 wrote to memory of 2004	1892	msedge.exe	126
PID 1892 wrote to memory of 2004	1892	msedge.exe	126
PID 5004 wrote to memory of 5648	5004	msedgewebview2.exe	127
PID 5004 wrote to memory of 5648	5004	msedgewebview2.exe	127
PID 5004 wrote to memory of 5648	5004	msedgewebview2.exe	127
PID 1892 wrote to memory of 5460	1892	msedge.exe	128
PID 1892 wrote to memory of 5460	1892	msedge.exe	128
PID 5004 wrote to memory of 3912	5004	msedgewebview2.exe	129
PID 1892 wrote to memory of 6548	1892	msedge.exe	130
PID 1892 wrote to memory of 6548	1892	msedge.exe	130
PID 5004 wrote to memory of 252	5004	msedgewebview2.exe	131
PID 5004 wrote to memory of 252	5004	msedgewebview2.exe	131
PID 5004 wrote to memory of 252	5004	msedgewebview2.exe	131
PID 1892 wrote to memory of 5952	1892	msedge.exe	132
PID 1892 wrote to memory of 3440	1892	msedge.exe	133

C:\Users\Admin\AppData\Local\Temp\Wave.exe
"C:\Users\Admin\AppData\Local\Temp\Wave.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6136
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\WaveUpdate_dd0783ab355a470fbbc11f1f6f41b490.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:792
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "PID eq 6136"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4892
- - C:\Windows\system32\find.exe
    find "6136"
    3⤵
    PID:4560
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\AppData\Local\Temp\WaveUpdate_f454fdeb29e0415aa84a9831b2c8826f\*" "C:\Users\Admin\AppData\Local\Temp\" /S /E /Y /R /H /Q
    3⤵
    PID:6456
- - C:\Users\Admin\AppData\Local\Temp\Wave.exe
    "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5500
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5500.6240.6502407183880605185 /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:5004
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView /prefetch:4 /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x164,0x188,0x18c,0x50,0x194,0x7ff99bbf5fd8,0x7ff99bbf5fe4,0x7ff99bbf5ff0
        5⤵
        
        PID:3540
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1988 --field-trial-handle=1992,i,15281408754244940928,17887753349847622205,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374
        5⤵
        
        PID:6612
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2280 --field-trial-handle=1992,i,15281408754244940928,17887753349847622205,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374
        5⤵
        
        PID:7136
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2340 --field-trial-handle=1992,i,15281408754244940928,17887753349847622205,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374
        5⤵
        
        PID:2720
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3456 --field-trial-handle=1992,i,15281408754244940928,17887753349847622205,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374 /prefetch:1
        5⤵
        
        PID:6608
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4500 --field-trial-handle=1992,i,15281408754244940928,17887753349847622205,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374
        5⤵
        
        PID:6696
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4612 --field-trial-handle=1992,i,15281408754244940928,17887753349847622205,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374
        5⤵
        
        PID:5648
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4716 --field-trial-handle=1992,i,15281408754244940928,17887753349847622205,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3912
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4120 --field-trial-handle=1992,i,15281408754244940928,17887753349847622205,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374
        5⤵
        
        PID:252
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4516 --field-trial-handle=1992,i,15281408754244940928,17887753349847622205,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374
        5⤵
        
        PID:5592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://getwave.gg/resellers
      4⤵
      Loads dropped DLL
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1892
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff9984cc188,0x7ff9984cc194,0x7ff9984cc1a0
        5⤵
        
        PID:4284
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,16691268545185396554,5670966466920012387,524288 --field-trial-handle=2240,i,17873850526564030834,10558072055598914430,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:3808
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,3814128008128827545,15616242827004731498,262144 --field-trial-handle=2240,i,17873850526564030834,10558072055598914430,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
        5⤵
        
        PID:2432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2536,i,17194429363918907081,4572025359690412893,524288 --field-trial-handle=2240,i,17873850526564030834,10558072055598914430,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:13
        5⤵
        
        PID:3060
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3520,i,16417917367327666450,5271674074796563893,2097152 --field-trial-handle=2240,i,17873850526564030834,10558072055598914430,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
        5⤵
        
        PID:6896
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,5253142354723463100,10582842251731145920,2097152 --field-trial-handle=2240,i,17873850526564030834,10558072055598914430,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
        5⤵
        
        PID:7036
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,16495573884297226953,9584408144274246331,524288 --field-trial-handle=2240,i,17873850526564030834,10558072055598914430,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
        5⤵
        
        PID:6504
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,8454281346379588360,5861483977954923106,524288 --field-trial-handle=2240,i,17873850526564030834,10558072055598914430,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
        5⤵
        
        PID:5576
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,1086533732581463518,8267050863573390226,524288 --field-trial-handle=2240,i,17873850526564030834,10558072055598914430,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
        5⤵
        
        PID:2728
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,1554601378902573217,2193452965298744482,524288 --field-trial-handle=2240,i,17873850526564030834,10558072055598914430,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
        5⤵
        
        PID:6684
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,12582732354500771540,10940506687179202746,524288 --field-trial-handle=2240,i,17873850526564030834,10558072055598914430,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:14
        5⤵
        
        PID:6940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5564,i,7627076014023132436,8553223844541064312,524288 --field-trial-handle=2240,i,17873850526564030834,10558072055598914430,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:14
        5⤵
        
        PID:6724
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,15267113918263568533,5305818539904999446,524288 --field-trial-handle=2240,i,17873850526564030834,10558072055598914430,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
        5⤵
        
        PID:5632
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,15267113918263568533,5305818539904999446,524288 --field-trial-handle=2240,i,17873850526564030834,10558072055598914430,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
        5⤵
        
        PID:3940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,4075981183050817298,8669030524264214,524288 --field-trial-handle=2240,i,17873850526564030834,10558072055598914430,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:14
        5⤵
        
        PID:1256
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,16663506289001569878,13521030363917848639,524288 --field-trial-handle=2240,i,17873850526564030834,10558072055598914430,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:14
        5⤵
        
        PID:2004
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,9244488182023924683,14219969678151901241,524288 --field-trial-handle=2240,i,17873850526564030834,10558072055598914430,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
        5⤵
        
        PID:5460
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,3299171642160148881,14969200836863263576,524288 --field-trial-handle=2240,i,17873850526564030834,10558072055598914430,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
        5⤵
        
        PID:6548
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6368,i,8059481465662180385,2287380949875755646,262144 --field-trial-handle=2240,i,17873850526564030834,10558072055598914430,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:10
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5952
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,9020524125715991103,8533168949391770570,524288 --field-trial-handle=2240,i,17873850526564030834,10558072055598914430,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:14
        5⤵
        
        PID:3440
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,5966409907723382514,18031248275054063557,524288 --field-trial-handle=2240,i,17873850526564030834,10558072055598914430,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:14
        5⤵
        
        PID:7140

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9ac04be28534ffc90f065c5357ca3a80ca723726cde5efb88f8a7e1a6b44baca
MD5 b73ee45352458e50358c0ccfe08f6cf9
SHA1 c9670f21ef5a19258323e88f363ca274d9b861a3
SHA512 a0988cd4a43f2f8fe9ab537054ce760518819b4a5b241855d7dd15687bd71afc74fa5b853542182d12a3a9aebcf68ff8590341f7237f1283b2b611b7b5610238
TLSH
T11DD012143718648BCD1A2571D8318381A666846125598F4560A1924D9D69493539A396
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7207f4c246d3ac882ff42358926e52b8316dd22bb03c5644ebc6f2dbc1168a28
MD5 b7329a74f1fa351c02d17b8e2692e575
SHA1 ef3d4b0eaaee583b5233cc6fc44fd331077feaf2
SHA512 650d63f3a2e065e3c2e4933483e10d79ab609f116a4e0bf7e107adff2025a85d1c77c68f86e7604724ab7da540f31911cd91f5e49bbae26354b6446fe249827e
TLSH
T146D012143718648BC91A2571D4318381A6668421215A8F4564A1D24D9D69493A39A392
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 8c4b769c1e7c5f26039ea4be106634cc912eb02aad1b0f2d75b356b0294a628c
MD5 a4f289a957aab40ba7039a912912fcf2
SHA1 02b7edea627ec0efa57ad2abab0f9ed649a6bddf
SHA512 39e208ce589363d4f9856d117971515078d4be279b9351733bcec0cf950bbf8957b0b1edd9ec10a79ba7b87f727a797cfa30d996106a7f581850433668c94f1c
TLSH
T1A5E022A6C861EC2F08F91B192170569FEB54131A2B40594BBB3C820C8FB163F098692C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 b4c08dc391996bea571ac82642914665c0b40f07d84f5d2f139f4e9fb65bd7f9
MD5 e015eec2d4d000ec5d6b2c3410f4f1f1
SHA1 856fcda8f40965ca5aeb99d81812a543df7abbfd
SHA512 7e2f0d06f7354e6514eb5ad9108b52c7a63f6cca99e2563f502886668b0542866b1b3286666b88f2f4fa74cf86a28f8dd6c46cb67861707c52728f7de067de64
TLSH
T1EC51514446B01A55D7A81D3A14E265967B78C4AE0687AF2705BBB9B8FCE774CE0C70F0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c366.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59c366.TMP
Size 2KB
SHA256 2599ab1259c4b6f57a70a76ed25365c72f06c9b78492c2e379d31946a4d37df5
MD5 4dbf3b9da56b4a079932aa2060b79d4f
SHA1 3fc95abd31c8d2d01485e329a14226993266b7d1
SHA512 b951352a59a2752954d10b83ea51985de29a7907aac657266d13644090af5a6a2147c10b52acea8b5d0abb0f187541eba0ac1e328cce80277780f7e9d96b114a
TLSH
T162512D9845B01A59D36A6D3A14E271A47B74C8AE0687AF1704BBB8B8FCD770CE0C61F0
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0c012519aa31d67ba01dedbd511439bfd5dcf2be233fbaf7465122d63b35d576
MD5 071a571094885bbe923045f0ca913fc0
SHA1 ef7c5a41136612f9ded933defb15bab0797702dc
SHA512 e7c85396c9d844fcb5dd7f13d870ab2936173e92be45417c4e420bde93cd98ffd7914c69387856826fae60649e9300248d8a3254f4f53c99bd0b250aaea914d9
TLSH
T14651D0F7C3E8866DD90155F0AA187E2BCE1D0914832C3D5AC9E4EF5BA3E3471E141A5E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7b9412bb8263b63e1d7b1778a82a5689a854d861f8460ade4a29d066044f08bb
MD5 3f862dd286f2613a13a0b3440e0cd21f
SHA1 6ff2f70afe53b1091b3055ddb23214b3e8d074a0
SHA512 957bda6b441b9bc8f1dd11910233b4047da6d529d0bf1c92cb347189158a09e1dd9447f59dddac6a6a1481147b6bc0de4f55c5907d9a98b0558ee520c84bbbbb
TLSH
T17751C0F7C3E4856DDA1195F0BA187E2BCE1C0915432C7D5AC9E09E1B93E3471E181A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 022fa4e3790286d35f8c3db1660d7ec374c382e776685f3596afce2d7784cb9f
MD5 af04c7b0b423472c031a191a5843d3fd
SHA1 e9c64746e403f07eb5609ce4d344ab07bb8e0a39
SHA512 4912515451cfd3a3c44567f75c888e352ef10bee28140eb2e079f61ae879868076593a654b9c97bc86c169df4d1c3d2a1de49713995346b48b4d0f49b7199da5
TLSH
T18651F0F7C7E8866DD90185F0AA187E2BCE1D0914832C3C5AC8E0EF1BA3E3471E141A5E
MD5 SHA1 SHA512 TLSH

Submit Download

e0b3dc7d-1c4a-4fc0-80e4-29e726439b0e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e0b3dc7d-1c4a-4fc0-80e4-29e726439b0e.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 428049852f5bf3441ded41d6f5d910d481834a68a806331976a02ea065faa5ef
MD5 4002f3ef7e01229be88997d2b47af35e
SHA1 edb86540b87d0d38adbfe67bc2e6897ea6631e7b
SHA512 1c17e973ba2357d94d56f35c5781d0844951b588d4506515d8fea77279edd9235c4b62b0a87140c2e49d7f240add9d10d49610f491a5cbcdd2919297a5dd0623
SSDEEP 192:sxRyR+yMqZjK1Ml8UQM2o/f+sBLrAZUBMhzoA8ptN/g6+WNloX/YULhy+G04IgDi:sxRybqlo/f+sBLreUBjD/5q/5yTja
TLSH
T1AE72EB16A924997B8CC7D219FA85BB53D7FD1163A2905E04AEFC8B0C01E76DD221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 2fea9f1cd7da709eb8b17c8f1debd666f657f02690676961d4651a8daa47ca94
MD5 a0ebf37b4756521fb7dc1f4adf79c406
SHA1 7bcdd58db123857dbd481447b8f1867703747ba3
SHA512 09d0a248c367fcae04295685adf32ed3619947185b643e338dc1325a8956c7f875467efba51531cb5b0e568fea61209b205b80719cc71074cb262700072e3aed
SSDEEP 192:sxRmR+yMqZjK1Ml8w2o/f+snLiAZUBMhzoA8ptN/g6+WNloX/YUvhy+G04IgjUJ:sxRmbYo/f+snLieUBjD/5q/FyTjY
TLSH
T1FB72EA166934997B8CC7D219FA85BB53D7F91123A2905E04AEFC8B0C05E76ED221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 984b2ed17361be6cd097c26155512c76e534ac8c80144ec69a03a3bbb5df1db9
MD5 effa5b911a21c1408f2b70d285c913d5
SHA1 03db2686832fa83428dcdfc07bd1d48fa5b54a37
SHA512 7e8fdfb6cb206be5902a90d475690c9ced70b528090a3a2a97b37d04b50731de51f8f94a3577b4430f64d7ca07b199547948a6ab082767d35921a55d7c3809dd
SSDEEP 192:sxRyR+yMqZjK1Ml8w2o/f+sBLrAZUBMhzoA8ptN/g6+WNloX/YULhy+G04IgDfOJ:sxRybYo/f+sBLreUBjD/5q/5yTja
TLSH
T18872EA16A924997B8CC7D219FA85BB53D7FD1123A2905E04AEFC8B0C11E76DD221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 f9ca29ea26153dfe30b57f09f1cf183c14e9a2088349807db2c67a99cf301733
MD5 93a2de17199896d1c5dc139dfbde6f2b
SHA1 651ae42c06debffe04c36952f403865ddc7418b4
SHA512 80e512c24cec16bd0fc580ca20ca821f20878818694251a372172831c9f465ca3c86279f522d1e8143597190b3a48437d5910aee071834853370c0dd54a7718d
SSDEEP 768:4eOlrA7pLuL7P6WgSYf9S8F1+UoAYDCx9Tuqh0VfUC9xbog/OVoFpuOGirocg:4eOlrME7P6WgSYf9Su1jaDFpTG5j
TLSH
T167E2FC3B680CCB7E4F84499CED29BD8A6DE802CF5ADCCD5447EA440C03C66EB561A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 f859151f9418e832cc736aa231c93487b8b8492b894616548aee05c02cf47b09
MD5 838a431fa9bae4875e0e367f443cfbb0
SHA1 8352f0b7c271779d01b4295c19af12e44d809b5d
SHA512 72e3b63b38047e51aa2c1f496942dd5fa5d88d54b994420c05af3e602ef0adc7b789d1f2546ca2816389c4ceed989175ea9398b94335e759fcb11ae1816cb082
SSDEEP 384:9WhIEeUI94LU82K3iXGuTQIVlgBFTzTyLuFVdv3n+FNmP13ObHd59wh8r/j931IB:UVI1zrZi+JK9ALXE6PW
TLSH
T114B28F5171BB1700387D290E93B9842F164630A230DEA97B7BA931E56F67E004FFCAD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 2efd04b2d84c633df1125e55751c03d0882d90b7e4e44556bb1a8a835d4ca17b
MD5 ed913130d317fd884e67fd3a71667253
SHA1 259e875cc7917bffdaaf12ad5dc4922842a617ad
SHA512 425ed702a1938db3b1f49054839794f4d8aa055622e0747404dd4327e35ac4bf19d1b466327d21ec9fdc58f0fc41da341f2df08e7bb3dae2f36cb2e7bfff04a7
SSDEEP 768:mF1j+9KFwgkHean9FGReOYx5mn12bfJueg:T9KQStY70yJdg
TLSH
T1A4C24A36DC64CAB7ECE78FC9B70A7646EEE0126781D859D8DAD84D4D01D329D130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 0822859eec414bf57fefe4cc53a263af0878911b4dc4774eb976e6cf220d8971
MD5 beff35392bd6f0b903aad4aec3d2e907
SHA1 a73591dc85e9853b079d83b470e1b8c181dacaf5
SHA512 295a9d147a0849d506e4bdafc915929a02481adde4f09144f7b56616ca1493b65a66e9b162e8af98ef9d9815538c1061c95d7cc775f5a5ff1f0ef7080d12897e
SSDEEP 384:n2LiF1tNn/s3n9S/8N08TUNTUlIRLPlc9qS2kWBn9cfcGLNJ8zC8fizUGFdqdz94:BF1j+9+JwgzvSFan9FGReO8fVGnAzy
TLSH
T152B23A36DC94CEB7ACE68BD5B70A3686EEE4116384C89DD4E9D95D0C00C72DD134BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c1d7cdbe74d87bc23583dcc0057075cdc60250acb315e775164ce0f8106a33aa
MD5 46f1de586c240b61037bd08688e30eb6
SHA1 9ba1ec509bba1d49cd67b77124aefeda42be3f6e
SHA512 3550e2375ef7bfca78fdab663decf9cbb52590473f3e798df5252b4762856a5c7775dbcdb7e85afaf023fd65d4eb6dedad873510dc0694d7847313fe7fb42bdf
SSDEEP 768:EFIj+9GJwgzvSFan9FGReO8fVGnmn12bfeG:g9GrCt8fV40yeG
TLSH
T182D24B36DC54CEB3ACE78BD9B74A3686EEE4116385C859D8EAD84D4D00D72DD130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 760ba44297a6b97ebf606a432a168d392de3bfdb2c54e69f1c89bd7e36833d4f
MD5 ab2270eb9222e654a544550109ae140a
SHA1 9ef6d5a627d061238c86731fd6aa32a8e1ea97ed
SHA512 3f348df5dc5440d0f9314a807b4fd2b23443bc05c2e42cb7fe018f0acdb5b81a1fec9b84919a5d0f3216ba047f004e6e0227e196b864c9d14992da26e36a9a62
SSDEEP 384:n2LiFItNn/s3n9S/8N08TUNTUlIRLPlc9qS2kWBn9cfcGLNJ8zC8fizUGFdqdz94:BFIj+9+JwgzvSFan9FGReO8fVGnAzy
TLSH
T19FB22A36DC94CEB7ACE68BD5B74A3686EEE4116384C89DD4EAD95D0C00C72DD134BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

well_known_domains.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll
Size 572KB
SHA256 2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e
MD5 f5f5b37fd514776f455864502c852773
SHA1 8d5ed434173fd77feb33cb6cb0fad5e2388d97c6
SHA512 b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6
SSDEEP 6144:XbBXgDO9CyiiKPFv3GPkDNiTHoIDiXkCBIvzVXCfwX5pWr+W1gUe3h576:XbBQDwi5FvGPkDNirYBIvzVXCoXWiWr
TLSH
T130C49E02B7D846A8D07AD0748A574642EA76BC950F74A6DF02E0B27D2F77BE45B3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 96c761a72ef1c39a46b9cdd2fd6d8c4a65f07a2cbce3eeba218d2e0466a2612f
MD5 03dfedf0eb35bc8d5f468df3a6ed3d27
SHA1 f953c0b8aaabeb0d6247fc16238f6ae122b8c5e5
SHA512 a6a9992cd102e8d632674a29ab95ba4ca4560f6d118a6c2e32f0df557742a8ced76e937dfd4f5605545c97c1cf109e137bc135f9c1b03af4a4ab618988b3f9ba
TLSH
T1DF4162E05C382ED2D4BD0D6EB09B38FC94E8C725F594347E6868E988467E64D608083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 0872e6d6fb6783cf09dad787d1169683292b0cff435a57c1a74e686fcdc8722e
MD5 829eac5e8c7ee5955e940f47b36cc728
SHA1 a750f05ff721329c939a50fc41045f4ae1b75e96
SHA512 c34182726ca1a8490b02d385cb9e0685e52a52342f1a37755d108de803284acd8623558f8df095f56c5f44dcac61b4e0a5311901ca2653ba01d25f3ddc3562a2
TLSH
T1154142E05C382AD5D4BD0A7EB09B74FCD5E8C725F490347E6818E988597A65D708083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 d9a9a394baf8cecc4c7ed1f93cce54bebb6dd174913272f0cc69513f919fbf8b
MD5 20f2cee336071b5fed6e8978595ad286
SHA1 eef22ed13f62b0c3f234f7c4e4012850b72581ff
SHA512 0741b64c317110d8f4a7aadb14628a0109fe91cb18c60276096302de4b3dc08cb93480bcf311609e846fecb82d964d53b9d349b891958f293b4f683815bd4696
TLSH
T1F43142E09C382DD1D4BD0D6FB49738FC94E8C72AF494747D6858E888467D64DA58083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 3d5b793bc14450310539479190dcada90f8efbc46e09a6aec3779a76f46ed772
MD5 4fed55854fbdbe8f3a0093efabc80e26
SHA1 49c26cd5b419411b1d59661a27eaff4ede360f54
SHA512 3c362b9ff07fef22b15cab8c6800112985e73b5358caa558a11183bef128f6c0b289d382b67ba8b209e9a2836f8b6028bf06cbc7f098b5c2e60cd0ca5d8eab54
TLSH
T1364130E05C386AD1D4BD0A7EB09B34FCD4E8CB25F590347E6818E988597E65D648083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 755663602f4fda70e3f0b076bfe2538aef334015ecd5725265fa401c04ec3e98
MD5 3b5f9c11e0d5906a8b7b5323714066b0
SHA1 08c8418346d196952c00fb6a991643fd84da65f3
SHA512 0452810b098066773860e0ee6f490e26486a7391b2cd3c4cdb4ea18e3b09d8c49cbd2125340ed86814cc844274c42bf9fa74e6164cda9784e221cbc614d76741
TLSH
T104410FE05C3C2AD1D4BD0A7EB09B78EC95E8C625B590387D6828E9885A7A75D708083F
MD5 SHA1 SHA512 TLSH

Submit Download

WaveUpdate_dd0783ab355a470fbbc11f1f6f41b490.bat

Path C:\Users\Admin\AppData\Local\Temp\WaveUpdate_dd0783ab355a470fbbc11f1f6f41b490.bat
Size 673B
SHA256 c947440a08d610441a3bc62a5084467da807cd59614fd9e2d902a0ac8616ab15
MD5 ece3f73f74fcb8be37e3fc129189f7cd
SHA1 1ace5c6a78697b5c80832ab622648cc37f475a95
SHA512 a44a8317be6d2bb922984523cadf695c9d7964493a506e92598d9db3046dd8d709b045978e2ee073178368bfcb49821f51e12e1f414107a99c1150c6ed938766
TLSH
T123012861314A4E8604104E4F0BAD9708DF6FC48F6F0E610C55B48449312E407B7A89C1
MD5 SHA1 SHA512 TLSH

Submit Download

Wave.exe

Path C:\Users\Admin\AppData\Local\Temp\WaveUpdate_f454fdeb29e0415aa84a9831b2c8826f\Wave.exe
Size 9.6MB
SHA256 fdddc5f2d005696b1923e8192a0f66b599dbf92aff40447869f2c278a736c50c
MD5 1852c2d25f644263c7beb6fd8183e3bd
SHA1 380d73cc5e4edb0640a8911fcf39846974c734ca
SHA512 d7e49f7d0fe95c1f0f00a9ab815e121024d327c28aa66e2646b2366b0f0e702ccec741d7f0adae8c236f489d423e4eb3dc51410aa395bba42943363190069b19
SSDEEP 196608:2DyDXOliXInuU6ljcYtRRoyqgFk99AamtOjNswoTu5evlQm2mtnMUwEa9BeLibsF:2aKnd6lLBSgC99Ai5sw0u5evlQm2mtnj
TLSH
T128A6011897E85552D73E9B7CC126C543FEB1B886032592CF0818FD582FEB7C2A636636
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WaveUIAuth.dll

Path C:\Users\Admin\AppData\Local\Temp\WaveUpdate_f454fdeb29e0415aa84a9831b2c8826f\WaveUIAuth.dll
Size 20.6MB
SHA256 2f0941e4c4714d207f866861555e1606fd54e12b865b9f4d3d50ceb9f78fd403
MD5 91ec65fcb1665c1f55198a868bb8224f
SHA1 c244ec97d014809e568ef3611fb1bd625b52a35f
SHA512 e1f49032fb739b7dec9f2cb17c32828c0e9117b64a44d39d9d25c82fa838a48f3dca98a153917729130ac9dc9dbdbcdee538cc0a6ed40e06d3a46f8abcb99104
SSDEEP 393216:DBt6fSdHPPmgT9x/5qecpP3QU2cV6OkI/x0wlIWy3ZAHPoK3e3UAFW:T+2PFx/8NPsQ3x7+fIYrF
TLSH
T1B42723E524D411FCD896C630E25E2BEDF1D578494DB9A82E7FC608012F31E9BC9A2937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\Temp\WaveUpdate_f454fdeb29e0415aa84a9831b2c8826f\WebView2Loader.dll
Size 156KB
SHA256 4cd3ffd5f52122432b6537b360c2317f96650928c927bb3caa59d5807da573a9
MD5 daf9a81004a961e39650a0e2bafe233e
SHA1 62f863adbef09905c75f475cdd5ce68b0aaaf73f
SHA512 95f1ffa93b0c16fdbaf9eb2d9f9fdbe63b1946a7cea0e366a9c68fd4695a97c7681bf9e2b2f372c8ab6430c0a37cac733154e94b1d7a76cbfa3c1de340d5ce33
SSDEEP 3072:8nVs+j4uIGieBiCIV6A9S4arvNQG/pTNgWEtJctHVA9rWt:gj4NCy6A9S4YcWEtJeVAk
TLSH
T174F34B5BB2E90077E17BC278C5A34A16E776B8111750AAEF036447791F237D0AE3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 24fb60fd67a4bcb9a18aeb7802b6a83d5866b13907a311441a707d6d7cf78d04
MD5 007f34d07c788174de6a990002aa866d
SHA1 d76bacd7a12ebb48d7bdca4facaf2d1ad8e5e2a8
SHA512 78433145f307e9b615286baf3e539d7467e981165e925af95b162e4dee3ca5d047ab1f1433c139c467f56dbc8a5ac2941da15831579fb1a53b6b6b4a49c9131c
TLSH
T1A1D0043CD1001501C41514330334D1D5C351C510004D13111450075744444D44453111
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f8c4e3beedef7de8cea6c35818bc191be467a592b95aa0da3be9f7fc1c61e409
MD5 e77993f8d8f41a66a88071ed58da9526
SHA1 a2b2d5b9d695503f44f0120c0248909c7b119b82
SHA512 bba67acc1cbb357f56bfcd7e0d9df79c502bf288433f208fac9116b5979ef62bada39bfad0139a5185773560751081bc1729b504ef3d9e858b8f7f279884b8e2
TLSH
T1AED0122A72010634C42024330212B1CD8541C21B404D410168288B6F5A084E40D13452
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 696B
SHA256 60246ade3c3a7fa77949c2c1fee9bb673a1975232cfcb2f6c22a5804a64172a6
MD5 f39f0d1095eaea4f3618aa3fc1d74019
SHA1 d41a6887eb57f0b20a291cf0fa48f01318b33d6d
SHA512 0984c5ae2ee12e0fd01334cd97104c79d753f2d9ac7ede9da9d6ef42ac32420017e2902c13b164a48079bad00e16f0aacf6b574970a326be8b9dda1260bf65d8
TLSH
T1B401ECB54BC406C8EB04A0B262F0DEEBBE32215C45374F43A0C1C7BCD4833905AA5AF1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592977.TMP

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe592977.TMP
Size 48B
SHA256 99019de70118d768b2ceefd3b68e7b9b5139b4ae88ffc8b3cc3ca625af6c51d4
MD5 6c0dfb0099f68d54b18fb1fca19f7d17
SHA1 dd2e173831f5e10ad7a7d296434e6bddf83d753b
SHA512 f2c67f0bd83bf2b8a624383a6a56b3002bc71314d677d72635257ffe9fa35c34e4540b911d4c4f7812d7d5590e97fbdbc3f43cc717760edb138ac05d9ba7b829
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59fd81.TMP

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Network\Network Persistent State~RFe59fd81.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 05571631493a7cb9d6c45ed0369c0ca2a7eac6c4a1f44f4c425253992bf4a3b7
MD5 3321905bcca076270e99f9fe0bd00cfe
SHA1 7caf324ac84cd1dd3528aa787100c721cc63c3aa
SHA512 04e2d51a8927c5fd7148357f8f423b2a64630d56623c59c3cfb07d59f29db1579729d89c1275e73b4149d33d6f3e25d3d64d5409101e2b644b9d7cc017411e94
SSDEEP 96:stT/dhsTRGSb96kkPo5h16ZdCs7/x+6MhmuecjrZ1ejewK+gjRI28XM1C7K:stLgJiooCsV+F3rZQjUcG6K
TLSH
T11CD1B9029E64A9BB4CC7E108BA35BB13E2FA503266D15E48EFF8461C05D76DD2307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Sync Data\LevelDB\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

cd8588ca-a38c-43d7-9581-d0dd4c5f99ea.tmp

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\cd8588ca-a38c-43d7-9581-d0dd4c5f99ea.tmp
Size 6KB
SHA256 e6e229625cde8d50bcaf2d4a8a73025795409ffa761d7c9512b72557660f1600
MD5 da5654f21940cc03276b09acb84d9c7c
SHA1 304e70f5b1ce51e5b901f1552f7c108704f701f8
SHA512 5dc133574f0bf72f7f4ec5f7c0b4b6ed496b12f19a2a702d3f0e3d0ec9cdf4558c4a6c4483592f6f29a6dbff3b5150f0ceac4f4b3309d4d52a8d434ddfeb1908
SSDEEP 96:stT/dhsTKSb96kkPo5h16ZdCs7/x+6MhmuecjrZ1ejewK+gqJ28XM1C7K:stLgXiooCsV+F3rZQjUeG6K
TLSH
T187D1B8029E68A9BB4CC7F109BA35BA02E2FA503266D15E54EFF8461C15D76DC2307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Local State
Size 2KB
SHA256 e54fc1215b1f79f291dd1389a39503cdf8b6cee91df48c88b18f0724e68acacf
MD5 7c88f4edc2fe01225012ef5065068afb
SHA1 5e8a68f1a4ef1b323db8ad904cb4fad9eae654da
SHA512 12fd6cf842226f06b13a12757a0698d558ea62f56b1a9b3d18dd8e92cfcda72f827f4c4cd912d33ef25d781f16a293b9c96b8f48fa3e4a17445ab6a3a1ac9b74
TLSH
T1765186336850AA768AF396087E4A6F63DE7A5065AB526F50ADCC0B0C03D745D1313C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Local State
Size 3KB
SHA256 3d94b6b3480a2798f839da2c1ce1cc13c8ce09a8c0c891aeecae032968d3df4c
MD5 1ba196d9306b008bd2cc99ca88c98367
SHA1 3a0b588f3fba56801a7c97047ff1c974307322ec
SHA512 f7a41e29d111ac1485d250955b44f8702074f155db040f9e7c00d4538b230848e7e95e7941810408095450671324f0e7cc9515e5ca491a52eca255683a01e1b7
TLSH
T11971743B68A0A9778EE39A047E852F16EBA55026A6817F94D9DC0F0C12D72981353C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Local State
Size 15KB
SHA256 4fab8ee6279dcd8e9fc2cb94072ed58c10cd5c0544897f6ae479f34104f82650
MD5 2b6ef88f333a11add480d94d51db1c8d
SHA1 e89667442b3d6715802f03c10410c53e455a2fda
SHA512 7edce4f95af09969fabcf83fc5571ab49bd3cec1ea0d9e78605f45c68e44d9511530b24aa60a28f51dcef76e7b80cf78d9b3ff3b205627d1bbe6f3c415cbc728
SSDEEP 384:vsrv+89zHqlDNP9oid6NBSV2jDrisd9NK:0rv+4UNbd+vrisvNK
TLSH
T19B72AF33A978A6338EF39904B48A6E177F7C609656C29BA4DDD91B4C43CB0DA2307D13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58d5f8.TMP

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Local State~RFe58d5f8.TMP
Size 1KB
SHA256 7271a215b4bf384b165c73aac42819612172985920e555fefa895a642e9637b4
MD5 0dde79edc3b1b099f7ae9003f2951802
SHA1 bead8dd3d979232b3c722bd76c9841d8831272d9
SHA512 845141bbe3e33cd0ae9007a86f4847e2e4ee55efcbcb0724eb06d3798a459324733adb942702ef03c171ed2c0d30ca65fd1470a3344cd7a064f0d418ab7c2449
TLSH
T1A031777294E06A729DA2A60A3745AF979F21206D53019F4478CD4B0C03D704D5A3BC36
MD5 SHA1 SHA512 TLSH

Submit Download

Untitled 1.json

Path C:\Users\Admin\AppData\Local\Wave\Recent\Untitled 1.json
Size 161B
SHA256 ab8082ad51752bcdd7e48960566bc75fbc95e3e82b77abb79bb738291a456d45
MD5 88568098baeb69a04b0f2014e9a5d257
SHA1 ab6667949d02351e0240de4218291fc5307ba8c9
SHA512 0e343e33f8148d4c5d77cddbd116b41b9de8ccf855ba40714744a92f4b22c79c10417bb14614003f034fdc8580ce23dd9513572b8e5da3342bfde5d14f40e438
TLSH
T1BAC08CB781F0280B1AE90267A484188EB680AE3B40E10C41B77B678501C28B6490FBA8
MD5 SHA1 SHA512 TLSH

Submit Download

1403240088.json

Path C:\Users\Admin\AppData\Local\Wave\Tabs\1403240088.json
Size 160B
SHA256 5f04553baae06253429e3d80816a9700e9b8cfed9998da354dc6865f8c01dfe2
MD5 66aa4a30a39ed0adf97ef60b85436403
SHA1 3bfd82f36e6acefcc7fbf9bb1350d32fe8eb2284
SHA512 deb431ac0671f8ba825db5aebcd3bd25594aba3b0da84ab2eab211f7766a64290be6d77132ab3004139030935feb58ba7739036779dabea158814f7a9ba61f5c
TLSH
T150C08031CC44547D63BD468E955064C73C001B5303B04C57397B465E017225016487CC
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_2110771101\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_2110771101\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_2110771101\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Filtering Rules

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_69309392\Filtering Rules
Size 2.1MB
SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
MD5 43f62d9f35fa6597cec4e2ad5643e282
SHA1 8dba6404724ffd6a2e89901e8dc6e5e55fed3374
SHA512 91891d23464f89e6769d9ec7a28867e28f77925e6e3b3b75fb628d8672157ba239676c07699c931ac307a21ccc4dae95dd707d410f988ff82be4015103d4d6a3
SSDEEP 49152:ua2qP9SKIrivd04TxN/7Uw+zJEhs6dl61n4Kmq9SL6bbBT0HjTsQc8cxjw:u8d
TLSH
T1BAA55D237518BDF45BB31F3EA44B6D48823962A483E3EDC5EA2BD10ED5E014F79601B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Filtering Rules-AA

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_69309392\Filtering Rules-AA
Size 2.3MB
SHA256 95beb1f39b4cd5b29f5ebaced4a33753fb0bb876f078ed3de041f12be16cec5c
MD5 b91a6cf79bedefedcb5603d3477cc3ed
SHA1 b3512a426a6a613f8cdf7f9ae3a0d02b700d1843
SHA512 9d85945f7f963fd9277adc20a0af459e8bb5904ef7038584e510ebd041b3029bf24ecae2047b24ecfa853154beef7e2bc5bd34ff8d90aeda000fbcdde741341d
SSDEEP 12288:DUoPNPlfiCBGkqNEWymqMD2N3FRgVfFRg3oFRgHsFRg/sFRg7dFRgImFRgJ1FRgs:JNhiSGkqdT5+9
TLSH
T189B51BF69947509145B9631938ADB2C82B14A28147ECCBF2EBB4C4AA2791DC737C05FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Filtering Rules-CA

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_69309392\Filtering Rules-CA
Size 11KB
SHA256 65aa171487dca70aad69973d0459c6a4b0882fcc6223bdfb53cd9ab711c5b125
MD5 40b3ba01a09be340fdf879f97b31c867
SHA1 b6ac58d1653c1b76e0e9898b17cfea3e6b56de94
SHA512 97f82f162588a761a13a2efd38d2c9518954400c7898cdd12923ce26e90818d94310b4a9f2a2cb2f55f5101c9a2e177dc1b14de8c9486eafc910271e2991dea9
SSDEEP 96:MKSlCviF3P2DoTc+cTKSlCviF3P2Do3lTKSlCviF3P2DoT:MaviVucryaviVualTaviVuC
TLSH
T17C3275333E488D6792A4C1A0DC92752C9E3087D98C9CBEC31235B9776BD1E6A508B5F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_69309392\LICENSE
Size 24KB
SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
MD5 aad9405766b20014ab3beb08b99536de
SHA1 486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA512 bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
SSDEEP 384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm9:mvagXreRnTqzazWgj0v6XqK
TLSH
T140B2526EB64903731AF30116AA4B64DBF31ED03F362A4564346CC1481FB6E7443FA6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Part-DE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_69309392\Part-DE
Size 305KB
SHA256 367ad4a5699a69499d13e8bf9ed5e8bab3573e3731ff8127178e539735ba46a8
MD5 fa08e85d713ad46803e924d443e4bf7e
SHA1 bbcce20f5ce73be4b34cf5c43d6f71bb4ae2c5ff
SHA512 884314e04cab57c9907f90525a4fea7710fdff5e47db4500c03d4dc6c5491a3f4df4868620a2a1817444ee75bfc913e79f9a414e3a68108deb7abab700ae9f85
SSDEEP 6144:7FjHKfRBie5M0SPtVRY7od0x6qNgKWIescUHVTl1dKcJEtmmt4l843NWKOb2P5+S:5T41N/IuscpL1Kxa
TLSH
T10264C693296AFAB12A320E7D600A1C4C5322F111C2C7DDD9F775C98DD1E468BBAC16F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Part-ES

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_69309392\Part-ES
Size 137KB
SHA256 55e005c8aea4180093fcb56f4ddeb9fc763892d8cf1fcc840f612a7531b7ed18
MD5 6e8f660d075254a08948dc3517304256
SHA1 bc8abaa82d6d555ee9482c568a1d661453fbc956
SHA512 cc3484fe628e4242eeec2ce969c51e817ec9ab3feecec8d8097f43a319c9dc226771eefe63316d8ec2ad895f23ed4603c4836faa49369db785580455ecf21f37
SSDEEP 3072:NiZ3EhHST197h/6Jl06bBeS1G56asSnGpFrUboki9a8jRU+Zw1:/RxbR1EnYpLv/Vy
TLSH
T166D30D55AADCA8B55A73102C64D9254C911772D082CECDE4FB6686CECAE05CF3BA03FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Part-FR

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_69309392\Part-FR
Size 528KB
SHA256 56e80041432156be4f08bac11e3494f2f06f65b61a60b7dcb61d15debb7b318c
MD5 6804859c589fa0ce46529c3a53b882d6
SHA1 70ffd62bb826e29500d36bbdd7c8d9c6895e2d1d
SHA512 3a659c284f55d203fded7f2754673e55a43d2c131b4790fcfe374af138158a690b5a330d4e720348c03aabb561b0aee7d818dcc111698c05ecd99c239d07735c
SSDEEP 6144:zfi0kH6u1I6c2Qiw934vv8gxK2SzX6rDVu9cBwZp0CiEksn7p0heBB6pHIgnb3hc:aT43+R5I7p0ABaIgne
TLSH
T114B45D136619F9F11FB31E3D640B5C088235B2A183E3EDD5EA67C14DD4E468FB9A02B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Part-IT

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_69309392\Part-IT
Size 216KB
SHA256 e1552312fc16e0f279e72f7eb4189a47e0beb36733220b0ef605f66defcc5fa7
MD5 268f6a3c0990d434175268cf09cfa6ad
SHA1 464e10c57c536e6bb55a326a48469246a9241505
SHA512 5154048a794227c45b950ec2d2ca378f9e7a9542b9fc79c1fef1f1615e97a263168927d883967b06f8b52227a47e3ac75ac7061b25400ebaa63e4536a368d50a
SSDEEP 6144:1quRAGty7QiWYIeezuu2CGiXTyRl+XPWRq14T/KfY:HRZtQl+XPWRS4T/5
TLSH
T16524E9176A54EDBE4E22156CA09F5E0C7225758182C7CED4F3D5C08DE5F827A2BA03EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Part-NL

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_69309392\Part-NL
Size 79KB
SHA256 935465fc40adbb4ae89ba37542ed37609014666c67fdf5115927809d69144b41
MD5 65126d1e76de4f0872e6cfa96609beba
SHA1 95268d3b2134894040afd0530d062a3b836f63c7
SHA512 0c6dd17cf622ad1a1a4ddc43fdc6f36567a98309e145e16d95edf38e9b21905867b28865bee591b52eecaa371138ac436eee6d18ff8d78f4c8f7031ba4e7ad84
SSDEEP 1536:x3ACbKFpRTfKGy7Dpj+u9huKCe/MELfmoRyQpnokj:x3ACbYpxfKGy7Dpj++hu8/L7moRyQpnv
TLSH
T14A83D70AAD68F8754A331D2FA4990D1C9625B600C7CAFDC4E725908EC9F52DF2AD07ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Part-RU

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_69309392\Part-RU
Size 1.2MB
SHA256 f8abf856660805e271d9d2033accf4f8cc43b19b7662fc2b96f56739229a90fe
MD5 e946014ae78f059f0698731a745a3f00
SHA1 afeb8dc2d86d2763b69f97717e454a7c6b8a267a
SHA512 3c699d3205c3a000c13d20411a0e958f2107f62d813591652cfc573f9a29647badfb1703e499a8896644f1485ecc19cdcaca0c6bd5ec1e5e328339c95784cfa3
SSDEEP 12288:4o9g8Q9u1Xku8Uc24wpDs2zGFtyKnVgLxB7rsvAyLuQCdj9/CwYJWj0Ek0ozM/vQ:4Oe9u1Xn1KFtyKnKq1CvH0Ra3Rnkd
TLSH
T1F44560137254F9F04F734E7E549A9C089275B1A083D7EDC5CA29C19C98F2A9FFA402B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Part-ZH

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_69309392\Part-ZH
Size 686KB
SHA256 9645edd48b978354345b657bacb3f30be1f450300856a82ba4d5dbf1236c7c9e
MD5 3e8cbee42dcb97db0df88cb96643e3fc
SHA1 94cd9e2bc876e04bfd2f311cdc160b6ae1d3c9f3
SHA512 319c69fcba623a0fea9ba4e1dcfabe3e9bd47f31dce7146e317835331217730fb61d0449abe7e66b1bc6f06a50c12269f7f09dbb633c85b4fd8dcc7b21c95304
SSDEEP 12288:g3gaBN1zyZzxT04duSeYXzhW+svzgAfk+XTAdXUd84nT4x09/xSE8Y:CgaBN1zyZzxT0N9YVW+sv8Afk+XTAdXy
TLSH
T114E491132168FCF51EB21E7D284B6D48813A76A047E3ECC6D62BD54ED6F025F39A01B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adblock_snippet.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_69309392\adblock_snippet.js
Size 2KB
SHA256 9aa899e0bf660ee8f894b97c28f05db06cc486915953b7f3b2ff9902fa8da690
MD5 f5c93c471485f4b9ab45260518c30267
SHA1 ee6e09fb23b6f3f402e409a2272521fdd7ad89ed
SHA512 e50a1baf20db9bc867e85ab72f9976430e87d8516ca552f9342a5c91822c9e1404e4f915042d48d841cca3fb16fd969bf0aa01195791ce29de63c45814fcdcda
TLSH
T1C541F146AB3477B703EC24D158271C03B3684494562CE519FB51EBAEAE1C46B4EEED23
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_69309392\manifest.json
Size 116B
SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
MD5 daf93729356a67ea1f849554827fdab1
SHA1 17dad0cbc82d5e04fb068896a5832f983e124c01
SHA512 473d9d608f2f3324d5db6eddeb4554a7271df4a6b62377820d935c001a8a2376479aa4d3e3b80ffbfdd3ba80f56fe72f1bc9dd020bcb396182b753353b883a30
TLSH
T1FBB09262A8084633249523F4A2639363CBA86D4A91346606091B9480659E73B22A5219
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_894275102\edge_checkout_page_validator.js
Size 1009KB
SHA256 04047fbad72cb02b113ee3a1f1823227aac74e1615fc5fa359d11776c727259c
MD5 21147b0280aa959a020d50a7d5738f17
SHA1 2e57c2a0e0b2c1f1cc78acf1a8fbb833c01b984f
SHA512 92db10d864968ee94156df795552867723aeb7ef03341e00c7f8cf11542a8443f83e1eb2487631ed38b441d4af751c8f4b3f99319312e50d8501df74263c01a4
SSDEEP 24576:cs4ymRAbsvvG3kJ6ARjiQixwaErg/OUfWEo0EQ1Xp8C9T0dK/vzHEiJsfaG81E9/:cs4ymRAgvvG3kJ6ARjiQixwaErg/OUfq
TLSH
T1B5252B84E1E2253466D74CB960B7D2C4B5DC04583399F1E8FA6C68CADB0F94723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.CognitiveServices.Speech.core.dll

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_910354547\Microsoft.CognitiveServices.Speech.core.dll
Size 2.6MB
SHA256 62a13d8459e0992c311dc3551bf3c2d1ce167ea7fa40f0ec62193f3bd760b36e
MD5 0ee2b50c85a110689352fccfa77b5b18
SHA1 d9ecc4b12d2d50e3cbce40e75edad804c9988b25
SHA512 a4f94a05a69b5ae3a0ecf8bdb7592f698d0df81e2f1fae679f38890ad04a2384883837bc792c73848955ff4af7afed49d38839f7ab174454e61919ed78655bff
SSDEEP 49152:NodIJ85qaIU7ui8DDR5s8L0Oty8CvFqwsNcrCY2/YUZzQ7L9qhV6O8mOn0k10:gEDRwrcAwDl
TLSH
T188C54C1FA64951E6C07AD138C543550BE2B27C60CB7263CB1BA7038A1FA37E2557FB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1892_910354547\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3912-704-0x000001A584600000-0x000001A584601000-memory.dmp

Download

memory/3912-707-0x000001A584600000-0x000001A584601000-memory.dmp

Download

memory/3912-697-0x000001A584600000-0x000001A584601000-memory.dmp

Download

memory/3912-699-0x000001A584600000-0x000001A584601000-memory.dmp

Download

memory/3912-708-0x000001A584600000-0x000001A584601000-memory.dmp

Download

memory/3912-703-0x000001A584600000-0x000001A584601000-memory.dmp

Download

memory/3912-706-0x000001A584600000-0x000001A584601000-memory.dmp

Download

memory/3912-705-0x000001A584600000-0x000001A584601000-memory.dmp

Download

memory/5500-235-0x00007FF995F20000-0x00007FF9984FD000-memory.dmp

Download

memory/5500-211-0x00007FF995F20000-0x00007FF9984FD000-memory.dmp

Download

memory/5500-201-0x00007FF995F20000-0x00007FF9984FD000-memory.dmp

Download

memory/6608-117-0x00007FF9C1C60000-0x00007FF9C1C61000-memory.dmp

Download

memory/6612-45-0x00007FF9C1C60000-0x00007FF9C1C61000-memory.dmp

Download

memory/6696-483-0x00007FF9C1F60000-0x00007FF9C1F61000-memory.dmp

Download

memory/6696-482-0x00007FF9C2B40000-0x00007FF9C2B41000-memory.dmp

Download