34e4857e59c56dc488185bde93eac78c97f2ccb2f64e9aa1dd7ddb4f91e69611

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 22:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Wave.exe
Size 8.5MB
Sample260710-2wc2vadz2m
SHA256 34e4857e59c56dc488185bde93eac78c97f2ccb2f64e9aa1dd7ddb4f91e69611
MD5 94d216a9d2432a5ec36a227212666c35
SHA1 aa129d643dec5e0de8ea6bdbc5a2c6294deca9f5
SHA512 ee2047cf7925011a2dfe43c232f62e834f25052f35b3190a2d803bf3ae8109885b0f31dde6b7723f55b01e57a925ca951df8a2d4cb793137082ced275b35182a
SSDEEP 196608:4xiWjBzGQi0za4NbVy3K5jtyVc0G3S9j7e0UGpF7bhqil0CFXiv42pXdvGFnxRdr:g/jBGx0zawwc0G3Uj7AGpF7bhqil0CF1
TLSH
T1CC96233823E81BA7E4FE4BB5D0714893CB75BE16260AD38E295439990F753D5CB32227
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
1256	Wave.exe
4608	Wave.exe
5636	Wave.exe
3768	Wave.exe
5864	Wave.exe
5604	Wave.exe

Loads dropped DLL 6 IoCs

pid	Process
1256	Wave.exe
4608	Wave.exe
5636	Wave.exe
3768	Wave.exe
5864	Wave.exe
5604	Wave.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Wave.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Wave.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Wave.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Wave.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Wave.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Wave.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates processes with tasklist 1 TTPs 12 IoCs

discovery

Process Discovery

T1057

pid	Process
5068	tasklist.exe
3768	tasklist.exe
5252	tasklist.exe
3404	tasklist.exe
2340	tasklist.exe
2020	tasklist.exe
4884	tasklist.exe
3564	tasklist.exe
5732	tasklist.exe
1224	tasklist.exe
4188	tasklist.exe
5840	tasklist.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1196	PING.EXE
3592	PING.EXE
4692	PING.EXE
2336	PING.EXE
3540	PING.EXE
3440	PING.EXE

Enumerates system info in registry 2 TTPs 18 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Runs ping.exe 1 TTPs 6 IoCs

Remote System Discovery

T1018

pid	Process
4692	PING.EXE
2336	PING.EXE
3540	PING.EXE
3440	PING.EXE
1196	PING.EXE
3592	PING.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5940	msedgewebview2.exe
2116	msedgewebview2.exe
1676	msedgewebview2.exe
696	msedgewebview2.exe
1224	msedgewebview2.exe
4472	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3412	Wave.exe
Token: SeDebugPrivilege	5068	tasklist.exe
Token: SeDebugPrivilege	2020	tasklist.exe
Token: SeDebugPrivilege	1256	Wave.exe
Token: SeDebugPrivilege	4884	tasklist.exe
Token: SeDebugPrivilege	3564	tasklist.exe
Token: SeDebugPrivilege	4608	Wave.exe
Token: SeDebugPrivilege	3768	tasklist.exe
Token: SeDebugPrivilege	5732	tasklist.exe
Token: SeDebugPrivilege	5636	Wave.exe
Token: SeDebugPrivilege	1224	tasklist.exe
Token: SeDebugPrivilege	4188	tasklist.exe
Token: SeDebugPrivilege	3768	Wave.exe
Token: SeDebugPrivilege	5252	tasklist.exe
Token: SeDebugPrivilege	5840	tasklist.exe
Token: SeDebugPrivilege	5864	Wave.exe
Token: SeDebugPrivilege	3404	tasklist.exe
Token: SeDebugPrivilege	2340	tasklist.exe
Token: SeDebugPrivilege	5604	Wave.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 5188	3412	Wave.exe	87
PID 5188 wrote to memory of 5068	5188	cmd.exe	89
PID 5188 wrote to memory of 4972	5188	cmd.exe	90
PID 5188 wrote to memory of 4692	5188	cmd.exe	92
PID 5188 wrote to memory of 2020	5188	cmd.exe	93
PID 5188 wrote to memory of 1692	5188	cmd.exe	94
PID 5188 wrote to memory of 4880	5188	cmd.exe	95
PID 5188 wrote to memory of 1256	5188	cmd.exe	96
PID 1256 wrote to memory of 5940	1256	Wave.exe	97
PID 5940 wrote to memory of 2680	5940	msedgewebview2.exe	98
PID 5940 wrote to memory of 396	5940	msedgewebview2.exe	99
PID 5940 wrote to memory of 396	5940	msedgewebview2.exe	99
PID 5940 wrote to memory of 396	5940	msedgewebview2.exe	99
PID 5940 wrote to memory of 396	5940	msedgewebview2.exe	99
PID 5940 wrote to memory of 1756	5940	msedgewebview2.exe	100
PID 5940 wrote to memory of 1956	5940	msedgewebview2.exe	101
PID 5940 wrote to memory of 1956	5940	msedgewebview2.exe	101
PID 5940 wrote to memory of 1956	5940	msedgewebview2.exe	101
PID 5940 wrote to memory of 2836	5940	msedgewebview2.exe	102
PID 5940 wrote to memory of 2836	5940	msedgewebview2.exe	102
PID 5940 wrote to memory of 2836	5940	msedgewebview2.exe	102
PID 5940 wrote to memory of 2836	5940	msedgewebview2.exe	102
PID 5940 wrote to memory of 2836	5940	msedgewebview2.exe	102
PID 1256 wrote to memory of 2484	1256	Wave.exe	103
PID 2484 wrote to memory of 4884	2484	cmd.exe	105
PID 2484 wrote to memory of 5740	2484	cmd.exe	106
PID 2484 wrote to memory of 2336	2484	cmd.exe	107
PID 2484 wrote to memory of 3564	2484	cmd.exe	108
PID 2484 wrote to memory of 4824	2484	cmd.exe	109
PID 2484 wrote to memory of 3836	2484	cmd.exe	110
PID 2484 wrote to memory of 4608	2484	cmd.exe	111
PID 4608 wrote to memory of 2116	4608	Wave.exe	112
PID 2116 wrote to memory of 4672	2116	msedgewebview2.exe	113
PID 2116 wrote to memory of 5276	2116	msedgewebview2.exe	114
PID 2116 wrote to memory of 5276	2116	msedgewebview2.exe	114
PID 2116 wrote to memory of 5276	2116	msedgewebview2.exe	114
PID 2116 wrote to memory of 5276	2116	msedgewebview2.exe	114
PID 2116 wrote to memory of 5876	2116	msedgewebview2.exe	115
PID 2116 wrote to memory of 1768	2116	msedgewebview2.exe	116
PID 2116 wrote to memory of 1768	2116	msedgewebview2.exe	116
PID 2116 wrote to memory of 1768	2116	msedgewebview2.exe	116
PID 2116 wrote to memory of 3736	2116	msedgewebview2.exe	117
PID 2116 wrote to memory of 3736	2116	msedgewebview2.exe	117
PID 2116 wrote to memory of 3736	2116	msedgewebview2.exe	117
PID 2116 wrote to memory of 3736	2116	msedgewebview2.exe	117
PID 2116 wrote to memory of 3736	2116	msedgewebview2.exe	117
PID 4608 wrote to memory of 4164	4608	Wave.exe	118
PID 4164 wrote to memory of 3768	4164	cmd.exe	120
PID 4164 wrote to memory of 4936	4164	cmd.exe	121
PID 4164 wrote to memory of 3540	4164	cmd.exe	122
PID 4164 wrote to memory of 5732	4164	cmd.exe	123
PID 4164 wrote to memory of 4784	4164	cmd.exe	124
PID 4164 wrote to memory of 1668	4164	cmd.exe	125
PID 4164 wrote to memory of 5636	4164	cmd.exe	126
PID 5636 wrote to memory of 1676	5636	Wave.exe	128
PID 1676 wrote to memory of 5116	1676	msedgewebview2.exe	129
PID 1676 wrote to memory of 952	1676	msedgewebview2.exe	130
PID 1676 wrote to memory of 952	1676	msedgewebview2.exe	130
PID 1676 wrote to memory of 952	1676	msedgewebview2.exe	130
PID 1676 wrote to memory of 952	1676	msedgewebview2.exe	130
PID 1676 wrote to memory of 2088	1676	msedgewebview2.exe	131
PID 1676 wrote to memory of 1900	1676	msedgewebview2.exe	132
PID 1676 wrote to memory of 1900	1676	msedgewebview2.exe	132
PID 1676 wrote to memory of 1900	1676	msedgewebview2.exe	132

C:\Users\Admin\AppData\Local\Temp\Wave.exe
"C:\Users\Admin\AppData\Local\Temp\Wave.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\WaveUpdate_0096ddd579824bfb932683335c6b3da1.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5188
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "PID eq 3412"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5068
- - C:\Windows\system32\find.exe
    find "3412"
    3⤵
    PID:4972
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4692
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "PID eq 3412"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2020
- - C:\Windows\system32\find.exe
    find "3412"
    3⤵
    PID:1692
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\AppData\Local\Temp\WaveUpdate_2d862fe9fa2d46fb9d9dde51a4cfdd02\*" "C:\Users\Admin\AppData\Local\Temp\" /S /E /Y /R /H /Q
    3⤵
    PID:4880
- - C:\Users\Admin\AppData\Local\Temp\Wave.exe
    "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1256
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=1256.1416.13686924361965545391 /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:5940
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView /prefetch:4 /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x160,0x16c,0x7ffb65e45fd8,0x7ffb65e45fe4,0x7ffb65e45ff0
        5⤵
        
        PID:2680
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1760 --field-trial-handle=1764,i,4346196040016906537,9244122494323883630,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374
        5⤵
        
        PID:396
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2160 --field-trial-handle=1764,i,4346196040016906537,9244122494323883630,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374
        5⤵
        
        PID:1756
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2300 --field-trial-handle=1764,i,4346196040016906537,9244122494323883630,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374
        5⤵
        
        PID:1956
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3360 --field-trial-handle=1764,i,4346196040016906537,9244122494323883630,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374 /prefetch:1
        5⤵
        
        PID:2836
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\WaveUpdate_22e3c5c9fa4542a6b653915f7148d2cd.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2484
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "PID eq 1256"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4884
    - - C:\Windows\system32\find.exe
        
        find "1256"
        5⤵
        
        PID:5740
    - - C:\Windows\system32\PING.EXE
        
        ping -n 2 127.0.0.1
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2336
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "PID eq 1256"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3564
    - - C:\Windows\system32\find.exe
        
        find "1256"
        5⤵
        
        PID:4824
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\WaveUpdate_1aa0fed9326a409db3469593f3c51d0d\*" "C:\Users\Admin\AppData\Local\Temp\" /S /E /Y /R /H /Q
        5⤵
        
        PID:3836
    - - C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4608
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4608.4412.12573520944539122852 /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374
        6⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of WriteProcessMemory
        
        PID:2116
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView /prefetch:4 /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x1c8,0x7ffb65e45fd8,0x7ffb65e45fe4,0x7ffb65e45ff0
        7⤵
        
        PID:4672
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1780 --field-trial-handle=1784,i,9201627605956728189,16163417076482400217,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374
        7⤵
        
        PID:5276
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2008 --field-trial-handle=1784,i,9201627605956728189,16163417076482400217,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374
        7⤵
        
        PID:5876
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2416 --field-trial-handle=1784,i,9201627605956728189,16163417076482400217,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374
        7⤵
        
        PID:1768
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3544 --field-trial-handle=1784,i,9201627605956728189,16163417076482400217,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374 /prefetch:1
        7⤵
        
        PID:3736
      - C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\WaveUpdate_fc9520d539c7461b8ce9705c3274b744.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4164
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "PID eq 4608"
        7⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3768
        
        C:\Windows\system32\find.exe
        
        find "4608"
        7⤵
        
        PID:4936
        
        C:\Windows\system32\PING.EXE
        
        ping -n 2 127.0.0.1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3540
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "PID eq 4608"
        7⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5732
        
        C:\Windows\system32\find.exe
        
        find "4608"
        7⤵
        
        PID:4784
        
        C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\WaveUpdate_c5244a6b8b1f445ab27bba6b37358648\*" "C:\Users\Admin\AppData\Local\Temp\" /S /E /Y /R /H /Q
        7⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5636
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5636.3872.13737686375226553106 /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374
        8⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of WriteProcessMemory
        
        PID:1676
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView /prefetch:4 /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x1c8,0x7ffb65e45fd8,0x7ffb65e45fe4,0x7ffb65e45ff0
        9⤵
        
        PID:5116
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2692 --field-trial-handle=2696,i,1463585779340478443,11849466360172014760,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374
        9⤵
        
        PID:952
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3264 --field-trial-handle=2696,i,1463585779340478443,11849466360172014760,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374
        9⤵
        
        PID:2088
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3276 --field-trial-handle=2696,i,1463585779340478443,11849466360172014760,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374
        9⤵
        
        PID:1900
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3508 --field-trial-handle=2696,i,1463585779340478443,11849466360172014760,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374 /prefetch:1
        9⤵
        
        PID:4748
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\WaveUpdate_e48e884d10084c0bbb8d721039f3c81d.bat"
        8⤵
        
        PID:3900
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "PID eq 5636"
        9⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1224
        
        C:\Windows\system32\find.exe
        
        find "5636"
        9⤵
        
        PID:2072
        
        C:\Windows\system32\PING.EXE
        
        ping -n 2 127.0.0.1
        9⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3440
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "PID eq 5636"
        9⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4188
        
        C:\Windows\system32\find.exe
        
        find "5636"
        9⤵
        
        PID:4108
        
        C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\WaveUpdate_c2752fe5323549b4bdf09355769f0c82\*" "C:\Users\Admin\AppData\Local\Temp\" /S /E /Y /R /H /Q
        9⤵
        
        PID:716
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        
        PID:3768
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=3768.2016.10263138511290955267 /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374
        10⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:696
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView /prefetch:4 /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x198,0x7ffb65e45fd8,0x7ffb65e45fe4,0x7ffb65e45ff0
        11⤵
        
        PID:5184
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1924 --field-trial-handle=1928,i,2224321966096245441,14160175291845236976,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374
        11⤵
        
        PID:4212
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2016 --field-trial-handle=1928,i,2224321966096245441,14160175291845236976,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374
        11⤵
        
        PID:4472
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2424 --field-trial-handle=1928,i,2224321966096245441,14160175291845236976,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374
        11⤵
        
        PID:3908
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3524 --field-trial-handle=1928,i,2224321966096245441,14160175291845236976,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374 /prefetch:1
        11⤵
        
        PID:1200
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\WaveUpdate_08932158c6c846f38ff125d63eabd3a2.bat"
        10⤵
        
        PID:3612
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "PID eq 3768"
        11⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5252
        
        C:\Windows\system32\find.exe
        
        find "3768"
        11⤵
        
        PID:5452
        
        C:\Windows\system32\PING.EXE
        
        ping -n 2 127.0.0.1
        11⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1196
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "PID eq 3768"
        11⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5840
        
        C:\Windows\system32\find.exe
        
        find "3768"
        11⤵
        
        PID:2396
        
        C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\WaveUpdate_515fd99ad3a749e6bf9f0ddd9635bf43\*" "C:\Users\Admin\AppData\Local\Temp\" /S /E /Y /R /H /Q
        11⤵
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        
        PID:5864
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5864.1780.7801318712724940068 /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374
        12⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:1224
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView /prefetch:4 /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x18c,0x190,0x194,0x11c,0x168,0x7ffb65e45fd8,0x7ffb65e45fe4,0x7ffb65e45ff0
        13⤵
        
        PID:2688
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1772 --field-trial-handle=1780,i,4683510543103001777,8742526757821294738,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374
        13⤵
        
        PID:1076
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1828 --field-trial-handle=1780,i,4683510543103001777,8742526757821294738,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374
        13⤵
        
        PID:796
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2412 --field-trial-handle=1780,i,4683510543103001777,8742526757821294738,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374
        13⤵
        
        PID:892
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3536 --field-trial-handle=1780,i,4683510543103001777,8742526757821294738,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374 /prefetch:1
        13⤵
        
        PID:4308
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\WaveUpdate_125acfffba764dbc9f86098ef9172022.bat"
        12⤵
        
        PID:3152
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "PID eq 5864"
        13⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3404
        
        C:\Windows\system32\find.exe
        
        find "5864"
        13⤵
        
        PID:5012
        
        C:\Windows\system32\PING.EXE
        
        ping -n 2 127.0.0.1
        13⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3592
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "PID eq 5864"
        13⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2340
        
        C:\Windows\system32\find.exe
        
        find "5864"
        13⤵
        
        PID:3044
        
        C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\WaveUpdate_2b4ceb545a3046939475e52c290570d0\*" "C:\Users\Admin\AppData\Local\Temp\" /S /E /Y /R /H /Q
        13⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        13⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        
        PID:5604
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5604.1300.3629326810354039596 /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374
        14⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:4472
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView /prefetch:4 /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x1c8,0x7ffb65e45fd8,0x7ffb65e45fe4,0x7ffb65e45ff0
        15⤵
        
        PID:3324
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2032 --field-trial-handle=1988,i,7893649294383465219,2294487713456271678,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374
        15⤵
        
        PID:5796
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2496 --field-trial-handle=1988,i,7893649294383465219,2294487713456271678,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374
        15⤵
        
        PID:4212
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2528 --field-trial-handle=1988,i,7893649294383465219,2294487713456271678,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374
        15⤵
        
        PID:6000
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3496 --field-trial-handle=1988,i,7893649294383465219,2294487713456271678,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:1600c373424bd5dc782779f1975d1dd3c5037374 /prefetch:1
        15⤵
        
        PID:3164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WaveUpdate_0096ddd579824bfb932683335c6b3da1.bat

Path C:\Users\Admin\AppData\Local\Temp\WaveUpdate_0096ddd579824bfb932683335c6b3da1.bat
Size 673B
SHA256 04a72b9085cd9505264aeb5bd32f13820b1fc87d74e7aafce41f57aa036d62a8
MD5 11f3c48a22ae24f7f6e48e7ec510b407
SHA1 0ec4cad714618fde6f465931fcfd016574641f7a
SHA512 5bd8af5e78158f6169514b0bf381e44a1eef19fd25da43eff2678b0039e76d3abe2d419d0d3920e4daa4d053f2046a6c3d0bff9ab7a3f8477517b18f8509c7f8
TLSH
T11201D372354E5D8A0421494F0BBEA718DFBFC48F3F0BA50D95B9844A326E50BB6A8DC5
MD5 SHA1 SHA512 TLSH

Submit Download

WaveUpdate_22e3c5c9fa4542a6b653915f7148d2cd.bat

Path C:\Users\Admin\AppData\Local\Temp\WaveUpdate_22e3c5c9fa4542a6b653915f7148d2cd.bat
Size 673B
SHA256 750042fcf655408893ebc67d249ece7f20ef2f709ef10b5ab418afc4b5782502
MD5 b1cc1cf0d438b141a0e842c76c3a2263
SHA1 0cf12686a15f473142ab07c9c6dcdf8c871a1209
SHA512 98aaee1b33526e951a7a502838550b2bd33b7b7c048c48b4dd70592f23e486dafa8f26a0caed6b837f92e3b8b655edbbba9982535f33f59415aa91dc4007dc67
TLSH
T12401D362354A5EC714104E4F0FAE9718DFBFC48F2F0B610D9AB88449326E5477AAC9C1
MD5 SHA1 SHA512 TLSH

Submit Download

Wave.exe

Path C:\Users\Admin\AppData\Local\Temp\WaveUpdate_2d862fe9fa2d46fb9d9dde51a4cfdd02\Wave.exe
Size 8.5MB
SHA256 34e4857e59c56dc488185bde93eac78c97f2ccb2f64e9aa1dd7ddb4f91e69611
MD5 94d216a9d2432a5ec36a227212666c35
SHA1 aa129d643dec5e0de8ea6bdbc5a2c6294deca9f5
SHA512 ee2047cf7925011a2dfe43c232f62e834f25052f35b3190a2d803bf3ae8109885b0f31dde6b7723f55b01e57a925ca951df8a2d4cb793137082ced275b35182a
SSDEEP 196608:4xiWjBzGQi0za4NbVy3K5jtyVc0G3S9j7e0UGpF7bhqil0CFXiv42pXdvGFnxRdr:g/jBGx0zawwc0G3Uj7AGpF7bhqil0CF1
TLSH
T1CC96233823E81BA7E4FE4BB5D0714893CB75BE16260AD38E295439990F753D5CB32227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\Temp\WaveUpdate_2d862fe9fa2d46fb9d9dde51a4cfdd02\WebView2Loader.dll
Size 156KB
SHA256 4cd3ffd5f52122432b6537b360c2317f96650928c927bb3caa59d5807da573a9
MD5 daf9a81004a961e39650a0e2bafe233e
SHA1 62f863adbef09905c75f475cdd5ce68b0aaaf73f
SHA512 95f1ffa93b0c16fdbaf9eb2d9f9fdbe63b1946a7cea0e366a9c68fd4695a97c7681bf9e2b2f372c8ab6430c0a37cac733154e94b1d7a76cbfa3c1de340d5ce33
SSDEEP 3072:8nVs+j4uIGieBiCIV6A9S4arvNQG/pTNgWEtJctHVA9rWt:gj4NCy6A9S4YcWEtJeVAk
TLSH
T174F34B5BB2E90077E17BC278C5A34A16E776B8111750AAEF036447791F237D0AE3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpnhnjhq.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpnhnjhq.tmp
Size 8.0MB
SHA256 95c577e85fb632a585430c2d10c48821eda4103016f8700d942f136b83234b0d
MD5 905910ccd89b8fc069750edd10d47946
SHA1 624e7a7a14ebd1ffe6c146ccf3c62b24e0a29895
SHA512 9da8d00f3fee7e6e0e332e9e8cc77858038daba8feb73f3f60ac844b2573c785632c8eeb5b0eeabf763516f14260275e6c5896ec549f7b54b28b32c4fdcea895
SSDEEP 196608:4grrHdLOYPVe9zLFWh/TS/c/styvI+hk8V:4gXNR9epV/KstKD26
TLSH
T16886333C423B66F9F2CA7833B1F5854989B3E75E3568DD74FF4881A117229C5BC62A20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 da936e361dd9c3a659dfeda945a4d9b9e9cdb1e94ac82369cfee790671cc4086
MD5 f009bbd0e4bb5d264b021a8632e79a7e
SHA1 f37adf07c5f7d41e01def6148d8a8bd7a0c5168d
SHA512 29dd0dbe8d2b258209a14e20fc3500f1529d6078fe73838b79b4b1b8828d74b21a8af924540b1087e82aa990960bfc34755ec1bd0bb41e698da07e97330c7f5a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 36d01f8ba337b89af261a0705599d90b0c25f7f99d6b561607d9a349a0d97e34
MD5 2cca041512f97b618f65800325cf9827
SHA1 03fa970a7e293dbab1e69370e34ef7d5cce0e6bf
SHA512 e76930bd609686d6dde835b67fa60d06bae0052b926ca0896e3a19ba080058d1c80bdf97226bcc18fc0a850d6bd8f47b57131322f39fee622a164f1ad7f51529
TLSH
T11CD0122237014338C41036330102710C2A01C00B454661445828852E1E04260AD0EC52
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 89fdf8978553486e68164713e2f1b404f63e9ca2f15515be0f761c4d18993576
MD5 52f398c3abda9335eeefa18744abaf7e
SHA1 314ab085983e2749e1357d92911f17da5948c3e6
SHA512 92e3a510b0de99c637041c99381f7e905f448c8606fbd7b373ad8c74b6a570e4579edde651517846f7b80a248b05e6a73fd64e599f9d19428f49c8ec707a42b1
TLSH
T11BD0122233014338C41035330103710C2901C10B444660445828851E1E042606D0EC52
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 d34f5814eceb62525f8f83b3a0b666265b88ae99a350404108a76e8410f3964a
MD5 891cddc3f76d5d83d2eaefc91c52ef71
SHA1 3466cc3d383e35d0b9aab6e8c8d10dbc598a8756
SHA512 3d46b58e3118953301f988c5f2f4622658cb837e0248fb58f05f90d90a1dd63961419d39a00bcaafd9642f569daebc6bab450709d64b99eef3f6c39e39a714e2
TLSH
T16AD02B3172010238D01133321A2371AD2B00E60F0906E2C4942DC22D8E05050AE4FCD3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 aeb5070978e68253821e367d70a940cd0293b51c808836d84a91d9992f2ab49e
MD5 8ce3649363b01771354158a65e58dc3b
SHA1 1392dbafef19489c318822ccd33386504b325707
SHA512 f63519fd100a9dee8f57ef3b4b7ab562fcb931fbe4506a7414824f51396fbe7b0c60ce2fdc06f28c59034eff58caae647c471ad5897d89eba47b00dfa63590ac
TLSH
T13CD02B3172010238D01132321A2371AD3A00E60F0C06E1C4942DC22D8A040606E0FCD3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f4703c22199c28ccf4206500d10c2696c6bd7687221e259a385d95105e62e7f5
MD5 40a98484337a9985475a9639117a34b9
SHA1 9951baf2e3e83f861bc21b59e426f4e60456d41a
SHA512 194a4bc140ec025eabbcd1ebe38ec8fe47546ba425d6b2ebd892b9a0d94b69025c2452025be38adaf188c61d780d40e97be102ef9888e0e5ab0dc77afc775fd3
TLSH
T1B7D02B3172010238D41132321A2371AE2A00E60F0806E1C4942DC31D8A050506E0FDD3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f56fd87d76cb82fbb811b85e8374abc446b6300058c333693275a39df844a28f
MD5 85c592a72c9d83d025b42386fd88075b
SHA1 e308c67c191627c2c2d1fd051e078de49075d312
SHA512 a5bbe14ed7c0b016dc1ad73eafcd8cc900158d1c66dd7832aee9f550266599cde10ea1645fc398b051c352e0cea3e69ef6ab9481d2348932064636440a739a72
TLSH
T137D02B31B2010238D01132321A2371AD2A00EA0F0806E1C4942EC31D9A04050AE0FCD3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 6eb0f33d7f913992f927d1d48dcf5ce596a4b1461771f11e9a7accc891c2c9e2
MD5 a9eba19eedff8ad8c9914f5cdb43f911
SHA1 bd7e3efad9a07444e70e832b32f4b001701bb6bf
SHA512 4ebe356bfabf98d35edee8c0d8c3536026eeef10175486d4acb2c953be05dddba7bcce8055a68c88c21bb937b435c753ef386abec62d3d32938d0fbfe8f36330
TLSH
T166D02B3172010238E01132322A3371AD2A00E60F0806E1C4942DC21D8A040606E0FDD3
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

0d231bd3a333b8eb_0

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Code Cache\js\0d231bd3a333b8eb_0
Size 261B
SHA256 96bf6937153728ffb90286e8b1950144f47da0a45ea3b70c2df2149518ec0acd
MD5 a164fb15fa809a723110e3fb8292060d
SHA1 77aaf8b327c402bd93e22e929db783e94fe8324d
SHA512 75bd6636639a323e0050725632c89f5e396d2937f19798227a0e563caebde62ddb2741a284a60fa012ca24e113986450fb0491a16607a0aac63ff66f008d5484
TLSH
T179D0A76B82437553D35E91FCFB992285AF47C1471F8CEC804660E0E32921B38796E94D
MD5 SHA1 SHA512 TLSH

Submit Download

2111c0e0cd715f61_0

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Code Cache\js\2111c0e0cd715f61_0
Size 250B
SHA256 497cb2ea750a5f572426a9b0ad6ff0d20d3a2db664b6eec99f86615839537cf8
MD5 e9b1bff38b86cb3480fa5a4969fe7446
SHA1 e4c914edcc5c5d60f9b03826f031840f90ff3c5f
SHA512 ebc9e751f89649cad44d816aa7a0b27321ea8b4fac323135adf262571ca9d8dbc601cde76356c023ce3bf177acd3fa44305b78f2b9029cd50dc0a7bab26a5b7f
TLSH
T1F8D0A74341391B41D64E9AFFDF3F2249674285A82D6DDE410820F9621D21A74A53569D
MD5 SHA1 SHA512 TLSH

Submit Download

34172a61f398c545_0

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Code Cache\js\34172a61f398c545_0
Size 246B
SHA256 99d3a28d38a0249c107dd4b6a421c0a15a7c4769982f3f9450cad179e52703e9
MD5 92e43a1c34cc79376c3a5eda3ef26708
SHA1 1ae13781ba537d11efcad11a75d285e493a041ef
SHA512 da73478d3d034cc0e21009bab942b346ad6cd3479eafc8ab64241fdaabb97539d83661b7c81ffe03d8a31ac7561e68dc548fea15bfd077c7ea8a3835a4deeda7
TLSH
T1F6D0972324063700E11425FFDC272289938B8000AF6C8D80C4A0FD832E00E38827A69D
MD5 SHA1 SHA512 TLSH

Submit Download

35447c90235c8f42_0

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Code Cache\js\35447c90235c8f42_0
Size 274B
SHA256 48ae0fe338fde940fdbee03382b6bcb844f16d4e35d0d231df809b6a63fbf0b7
MD5 f32273c7389c8616cb4f99af498e7391
SHA1 9f1eaebef4629448487e7441c40fadaaf9b23c54
SHA512 6bb1b07967e9105bf0fe16568ab0a36acd8f92ba2c1a2b9454f7291bf76332c8e9201101c4da6a82104f93248c644103ad4acc09e48617c1fe3a62671fffde1b
TLSH
T12CD09587C6033601E70C74FD8E039721C5C7C0501D5CCD838904F1836921D7C316CB45
MD5 SHA1 SHA512 TLSH

Submit Download

44a35ab935c3b4de_0

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Code Cache\js\44a35ab935c3b4de_0
Size 274B
SHA256 6801dbe1aa91eb18a16951b5673bf6f7fde1073c21ca08894c16549192591937
MD5 897e53657615def02c0a3f016d3cb044
SHA1 560a1b5181889b1b028b6f135945cb46ddce3520
SHA512 a5252c1908ee46cdbd525f19d144cff682633d251be6fabfc611d0d5865cfddd727b1b9c100d7a5b114db065a1dc5f02d9380f3ae0ce3d2b4fbe17c3a302e49b
TLSH
T103D02E876482320ADEA4A8FC8E1B3201C303C0423FC8CE8A4401E0AA0C91A7874AA98E
MD5 SHA1 SHA512 TLSH

Submit Download

460e8f59bf69a5c4_0

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Code Cache\js\460e8f59bf69a5c4_0
Size 279B
SHA256 a8ee470fdd550e2be29ccbd41be7bb6dbbf637f90870912f7e5b31de870b875d
MD5 4129da207c205ef07abc2ea3b65bda66
SHA1 45dbff87677a9059040ebe0bc0aad91592897ad6
SHA512 f4a6b7a13e6d3b17830a60d662e4075b158ded26bb6e3dd201ea66ea6e7368d056d4cc582ea0b16134b62719249e802cbef54a93f89c289346f74e6ee94fc886
TLSH
T1DCD09597C4453957CD5C6CFCC52B7305E507C4845F58CD029151F1521950F7424E949E
MD5 SHA1 SHA512 TLSH

Submit Download

46a906a06bf6b348_0

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Code Cache\js\46a906a06bf6b348_0
Size 284B
SHA256 a4ed0913b1833bc46bcf730bca34e597b0e834e072dabeff25564c3f14446a00
MD5 d68947ded184c291b771674bb95e41af
SHA1 fe020e7ffa68484c594ac421a4d4117f67032425
SHA512 100d92857b7f219440ccbe763207056b9b0b1c30a06bdabbbdf3c49ef25db5197bf9580eb90eba8cb8579c4dc25ce1d305932877700c08333d0b6caac4447c21
TLSH
T133D0955FC5623505FA5525FF5F9359048113C0405D9D9C415819E033DAD1D74BCDF64D
MD5 SHA1 SHA512 TLSH

Submit Download

5588d1f53550af08_0

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Code Cache\js\5588d1f53550af08_0
Size 278B
SHA256 9af44bf6a1c2463d9a78d950f78da66b1d81e2e285cf201cc12554f6bba1e5e9
MD5 e8fbe994fb20a343031591ac7e3e4789
SHA1 31a02b3aec9b12ca51af8fc79b09341571d3c73a
SHA512 705491dac00a8a6eaff1a76614e25ce366851d0049c6bf5aaa5429c77fbd2074049e98c0c6294a1a32cd17fa051456614176fb26619f62df1f130c5fcdd8dd54
TLSH
T13BD09557C5545946C705F5FDDF575749D723D44D4FC88C070210F0860811A7878F5D4D
MD5 SHA1 SHA512 TLSH

Submit Download

6c19a8da5e1f86d4_0

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Code Cache\js\6c19a8da5e1f86d4_0
Size 286B
SHA256 9b72cd23ba35587c2fde28d0c3dd38db838abb53d17a1e1a2a30bd425284e99e
MD5 8dc59ebb10b258eb9c38e912e20ce6e4
SHA1 eadb4106dcdbb3c49e29cdc3230dc5f9bb0566aa
SHA512 bbde67e5884ffe1dc73c053de23243ec95d9f07b7f09a0e89365dbc9f5e30c30c7532bec695e9dae0f3d4d928bf17d67715adef6317840c3348b136cfa7863eb
TLSH
T14ED02B1782322502C60428FCD765A204DB03C0122ECCD9910911F2631454E757978498
MD5 SHA1 SHA512 TLSH

Submit Download

8e5ec9b6aa4c52f5_0

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Code Cache\js\8e5ec9b6aa4c52f5_0
Size 270B
SHA256 fb0c718f971d82ca807cbfb462ba9ecc6242b0dca817b30c611cddbfad98155c
MD5 ddb7d630cde579fcf4d09105ea79d2e5
SHA1 0372df7a0938d37984aba2989e57acaadad9ca5c
SHA512 66e08dc2f32199d2cc7864c13d032f0209c6ef95e4c80c752d41f94fe340d717697ef233e967f1d2e304fa4e5ef7b75fde857e4edc73c600eeb449117406d128
TLSH
T139D02E8B82822602C6082CFEDAA2674A8223C4402E8C8C520B14E2A39804AB8B11D98C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 696B
SHA256 69e27b94022b63d138f633db23e1ebf8a9a631bfbbda52c1271417981bc3e986
MD5 5e83572329d82243098a91d805a9ca23
SHA1 43ede316b378325c30304b2029d1ffa36ff8ec3a
SHA512 e4efc620a0339122a06dc5d3a638d73e97af0101203cfac5ca9933b872ee1f1d020f83ea6689ffa0656449ef43370307c1b1585a7a227389684c1ceab066ca42
TLSH
T1990155A90BCE76C8DF20697242C72CA2F1332B2316038F73D001047CB94F3D0CA2A901
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 792B
SHA256 5e4e85987bdd6018b0897f350e5d007360858521b2b25b9fa3551f001e4f5699
MD5 0c0233a5403611d86d6a07be9773aab9
SHA1 4f9c98d813b09c3c4ca462f5c01b4c260753bfcf
SHA512 2a7923f2e48f86bc2d4b3514ffbdba94582732ea828a738d7cf144cb9ba6e25f4cba572d6963a3814572b4b7e47dc81a5be46744ae4fab0e91ccba108b643740
TLSH
T10501D4FCCFCEBA48DF205D73028B2351B3326773560686B1D01156A5B94F560C5BDD11
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 792B
SHA256 2a924a05210c19884ca4fd41cb126d34cd2b63a9860a189108a58a3372895a45
MD5 c45930badc1fb1c8ea7de83126d4a424
SHA1 3e2753213c474b82ed92bc87d27f1c18dab29eef
SHA512 55584d6af06b39c36f5f9c32bdf8eed21d9c082cb09f37fc3a096926217da67e3e1fba54326ccc4f1fc3950c1afe99685766f8c7c5589682f8695edd3f220fd3
TLSH
T126019EF8CFCE7A48DF205D72038B6B51A2322FB326059672C0822095F98E250DA6D901
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 792B
SHA256 26de2f96103d18045ee0bce2ee2caa44316bde23be671100336d4d8d592dc70e
MD5 3841384057a5b792d983e110f85e212d
SHA1 3b682b70b8203d9b4c694534597d20f2823796c5
SHA512 68fda6c9dce3c06bddec6066db47674bcf13bb1d668ccaa0b0cce927a19914f0eb63f3b5c2894ec36d3630d520c46a49c0b4ab75f1c19069573a6e6d89038277
TLSH
T1E1019EE9CFCE7B48DF305D72018F2B92F332677356068671C01110B5BB4E650C56D901
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 792B
SHA256 4bd0ee023618bba59d135dff559ff7045a5b584f2fdd69981109d2cf5e76db7d
MD5 ba9d50ec2b005e23096ecefe43ed0dc4
SHA1 b0c309ab73c47ef8ed1abfda86df955d6c73d420
SHA512 fffdbfbe5570813b0ab7e12651c0d414975c7ff74aaac813d9acb425a9b162fa2e9cad933327aeaf200717b3e618a646243772abf7806d71dc846c3f7192ed3d
TLSH
T1F3019EADCFCE7B48DF306972068723A3E3322B7316028671C00214B5B94E554C56DD11
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 792B
SHA256 012bf5e194ca4cc24b2f6d8acd9d88dcf3ef8920f46b60be41a1336f38a1c153
MD5 7ff0e42111af1c7418fd569b3763e9f5
SHA1 0a099f97a7a1f25ab879a5eaa68d683b1980b195
SHA512 03662cd13f660ea73d03103a0eb7a5d66c86140c71002768ca185ba9a38e368ee60be408a609bd747a74003f0293343e4b66d82c86ffb918325f9295f3e1d898
TLSH
T105019EBCDFCE7A48EF305D72118723A1F23267B316028772D4021195F88F564D76E901
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591d71.TMP

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe591d71.TMP
Size 48B
SHA256 d1e4d3d9e3f3188f12f2b84ad7aed29110afe85d02c0c77a730073eef4edc38a
MD5 2bb9351c8262444202c8e6d8b191a265
SHA1 668f1d2521ded59d783a8f1f49bdb06108388bd7
SHA512 66f5f71220486324918281e3b54c8a4b6a27f457bea1c8e1ddf2948fbae8ef36546c8fe0282e3391da49bd8e3740ae27043c0c210f0e04cd09c78d9533d32e6a
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Favicons
Size 20KB
SHA256 2db221a44885c046a4b116717721b688f9a026c4cae3a17cf61ba9bef3ad97f4
MD5 b40e1be3d7543b6678720c3aeaf3dec3
SHA1 7758593d371b07423ba7cb84f99ebe3416624f56
SHA512 fb0664c1c83043f7c41fd0f1cc0714d81ecd71a07041233fb16fefeb25a3e182a77ac8af9910eff81716b1cceee8a7ee84158a564143b0e0d99e00923106cc16
SSDEEP 24:LLiXxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:iBmw6fU1zBmI
TLSH
T1AA92EE075E383407DBA10E7D266B187A8E3FE26C5FA29C94347410618CF9482D5394FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\History
Size 164KB
SHA256 a8035eb8c8f88dcb4e282bd726cb2f566579f83a260defae863203570b897aff
MD5 30b734df37290c2a7cfab3e59f2ae965
SHA1 62eb9d01ce0f7af867150cd13f05726c88f8225a
SHA512 c1d29c6369f9cff45da516dc7f711e4d54e6fc2895fc0721cc3b28ad996bef1cb2dfeb4007b1e47760f73f983e2d4181e8c057467322ed59ee35b5c5bd668914
SSDEEP 96:8BJtX0LqL/uejzH+bF+UIYysX0fxQp97zEHt/DfLVVVN6zRk/E0rQ:8BAqL/tH+bF+UI3iWGVzWNVVV63R
TLSH
T114F3FB5E5F243312CDBD913B68E645B3587DF03F8B2366C66C6214B1CEE2656A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Network\Trust Tokens
Size 36KB
SHA256 2d4ccf8ac8ae4f5c6ec8e0566210ff56585b6ba0290501a1a11ed9b23bfc226e
MD5 7289d4bdfbd73ed571278f95cb4c1939
SHA1 7c911f54243d9777a34666f4526a49c7e7aea244
SHA512 6e7d48e18b0317449807c4ac2c377b3cccf5bd6121077d51152d7e188ba1ea3cf62372b7611036938986dd0c84465dbd747fe8580e3a699f8470229a6d57a749
SSDEEP 24:TLB3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T131DtX5nDOvyKDhU1cSB
TLSH
T1D8F2689BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 e00056ad97b19c924e5b73b19a1b23fb952026725da93238fa29885d9feb8391
MD5 b1b321357e0d3c160fb717133c31f26b
SHA1 13f05e74c268c92c474b2fba60a200facf3a47df
SHA512 ff961c73f9a89fb1744ec0754c982ec0da5a27d78f3d17104a5b17c5c2d885f8e67f431c95e38b3fdd94455ee1cc2b3bafc9e295d7bd7f21b15be8f53cc7c980
SSDEEP 96:r8/dhsHTrUYCb9Jkqkdo5h16ZdUs7/x+6Mhmuecj/V1ejeFK+gbI8XM1C7K:rwgHfCoooUsV+F3/VQjrhg6K
TLSH
T133D1A8026E34697B4CCAF518BA29BB57D2F9902275D51E88EBF84A1C08D76DC6307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 ad94e0573e7c123bfeac1528a200041d4e7bd1879cbc494cdef29e5056c1ff52
MD5 3f0108312a17fde50e99c1f3cdd5889a
SHA1 fdbf3f7f1b32f16c8fc5ae41828d932dd95be69d
SHA512 c08b0ae815b5280e34abf0c80f9fae75cbc8b0b820345df625bafa5617d1e8bba629c2e2eac75edd41f8a92706c842027390307e61016cdd431eded98447543e
SSDEEP 96:r8/dhsHTrU1bDJkqbdo5h16ZdQs7/x+6MhmuecjW6MkkjeFK+ggWI8XM1C7K:rwgH4TooQsV+F3W6wjr2Wg6K
TLSH
T1B5D1A7065D34A97B4CCAE518FA29BB57D2F9D03275C51E88EBF84A1C08DB6CC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 2a98f586897ab30403753d9408fedbc7d3273cd2f0d01cc983f6bef2a1a66d4f
MD5 5ae1902e52970b7039fc97fdf01eaf0f
SHA1 aab88e5ef3388cc125f4d76f6b36c18ac9e3c301
SHA512 38cf6310ed4ce1683c51df33af493201cd36cad9606f98b4224d2ee9fefcfe692f44e7d4074b40699aa9d7fa2b5d575b4b280d07a3a9e5e2b4d18cf5d82ea8eb
SSDEEP 96:r8/dhsHTrULbDJkqDwdo5h16ZdXs7/x+6Mhmuecj4x8OdjeFK+geJ6I8XM1C7K:rwgHW0ooXsV+F34x82jr4J6g6K
TLSH
T1E0D1B6065E34993F4CCAE518FA2ABB57D2F9903275C55E88EBF84A1C48D76CC620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Preferences
Size 7KB
SHA256 4cb5be6a839ebfda41b070ab38b39997dd1600f30d56b713e980b6e7531ad08e
MD5 26448f4876d189cd73d31f7915800a37
SHA1 ee3cd7e9ea38e72b53a46b1490faeb56922e14f8
SHA512 353a0273c2a65274e9f96e9d0e42930f192e715d8e7ba840a70835810285092fada879785abb69a2c3e20cd8f9e89388bfcecc282344b714a915df57865831e4
SSDEEP 96:st8/dhsHTrUnZbDJkqMdo5h16ZdVs7/x+6MhmuecjJpK7jeFK+g4JzTU28XM1C7K:stwgHUPwooVsV+F3JpmjriJzTUG6K
TLSH
T194E1B6065D24993F5C8AE418FA26BB97D3F9903335C56E88EBF84E1C58D76CC220390B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 bb67f54a83b2287dee73b3c2b4a55bf8fce64c005ca327adbc9ec8cbcfd7ce79
MD5 f833e084438426890785fbd3182f42e9
SHA1 40ecc94abc2d041559c3bd4064aa02e38f47e54a
SHA512 54a5995ef784a73946f13643f0023f8aeaebfdc115139c789d399bddf8f0a3246ed25eeab68965b23d963086065563017fdbf91b0657fe14754b850350ecf5aa
SSDEEP 96:r8/dhsHTrUyf3bDJkqYdo5h16Zdans7/x+6MhmuecjaQe7uljeFK+ghKJzWI8XMz:rwgHh0oo0sV+F3FC2jrGJzWg6K
TLSH
T12FE1A7065D34593F5CCAE518FA2ABB97D2F9902275C16E88EBF84A1C48D76CC620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 6466b61663c6b70928e6ddfbca2467ff824fc621f109ab2ac373a0e7c29999a1
MD5 e5f1b17a5880e0cc0edcaed6233450d2
SHA1 c3a47f2ba1af0a976070136426b95abd0c650637
SHA512 8be3772ffad929e26b4cb8912a98862b1453900ee146b439c51312799281c46bf1016fcad76a48d47d7e3f808da8f511aabed250422607ad20fb0f97481512a7
SSDEEP 96:r8/dhsHTrU/bDJkqMdo5h16ZdZs7/x+6MhmuecjjxrrYjeFK+giJzTgI8XM1C7K:rwgH+wooZsV+F3jxrcjr8JzTgg6K
TLSH
T1A1E196065D34993F1CCAE818FA66BB97D2F9903275C16E88EBF84A1C58D75CC620790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Safe Browsing Cookies

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies
Size 20KB
SHA256 0628922305d2478ba75a48efadf932d439616eaf1ff908be334793f7bde28107
MD5 91dbaf73c1a8c55254d90272f998e412
SHA1 2b86b31c8c00c937291e5ac3b1d134a5df959acf
SHA512 109f4f59616cc1d1682b4d9468804f7668c77ce1878afec06a57037193f31a9c1c39f5d269277462936373b129d26488cddcc34d455c27185534e7754baaa988
SSDEEP 24:TLWr6bXYFpFNYJqH1kwIY6UwpQ9YH8rwZ6HfB:T+6LopFS+awWUOh8B
TLSH
T126926B4E5F346221C0F48B36EDE1855B2F7C201CD3B32655DA5860F3DE9299BF10956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Secure Preferences
Size 6KB
SHA256 52bd44e991506fe8d5876d3b6a63ac65a8784842506b81d4991f32c7da976a55
MD5 aef19b0ba27700314daf4df545e8790c
SHA1 3c0df28b08fde63100d68eb59a10fdd90326f103
SHA512 bb83cad79b7f427908938b0b6f75fe47297640b22cc34d8b4399b35276bf6fd78a79d821c57735ad2dda04efa160ea799a91f965abcb2b9a17f8ff4baf50ed16
SSDEEP 96:vNinPlf/ROo1pkF5d1NiS7VaTEv9V5h5pg5+e02VNHG7jcXUPGp:snvBK9lWVN3XUM
TLSH
T19DC1C5A34539C175AF444AFEDC393FCED9A600DF89D64C0AA7E2C58806C1EFC21DA495
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 ea3208ebd5fe81f3ef81f9de7b7540b9adf91a353f36cc4f352b055ecd790c4d
MD5 94bc467bd03c8a10aa5573594639a86d
SHA1 48254f4a98812e6db38abdda72c0714deb6568f4
SHA512 f1d3d9f9a2e6c56f4d6d73661b487857c3db1b0ac0e5491f84abce4111cd0c10d0f484c7fde4be93852287d6c48815e5c11683ba5520e839604d62e11591e863
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Shared Dictionary\db
Size 44KB
SHA256 79b107307408e5ad9a145c87533316174fd13f4ad943497d079522fbe325b3b1
MD5 71ccdda9f3186c8e729bb559f93bb992
SHA1 3712c11bb21b8e2a74bb879d47b2819ed1ac14a8
SHA512 19f8134fcd1211964111b07884b52878b1649644b6ec623bb586df1a9b7dabc7f8c8a755d2a52c908b563bdd968135f4f703cc35103696e40d0ab0020c8dc4bd
SSDEEP 24:TL6iuaJhPwMuz6G0ZestjteXUSQeCl7ZIeNa6+6Uwg8hPq81fBG:T2TaOk17ZfnUdoqSB
TLSH
T1B0139A0F2E587564D1BD0635E9A34E6B2B7E30489B8329D125F02AF24DE251C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 c9fcd6198db8f140249754aca26d48381ad7d5410e1fe6f305ada2391845246f
MD5 9f1e39fcd925aa8ae32e017b68f2e373
SHA1 3f458c9de6f91269eeb85f7432cf0f5a0ebe8039
SHA512 53bae59b5e58d3da9538335fffe71a67c4c9727bfab0a911aa2dd03f7a03eeec7d0bc253a0096899c6da236467bbea63dbdbbcf053920919aecc6e587304e2a0
TLSH
T165B012507705F66BC4CC4A3402F18F447241E60200C04427C868BF108D4F6B82F48888
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Site Characteristics Database\LOG
Size 305B
SHA256 b4deebbb63141276818de717267c4b3722e58efc5609868567ed0e5ce1d0ab37
MD5 0a780ea1c9c75b6ce6ed91e19f740df5
SHA1 00b0df8483995329beade607a3230aa63d37781f
SHA512 23df3ae37dec2bc906c7917081df2d14c461f3b3f7518cc981a66d50fb8ca18601233fdddf45e3ff6478dd4f0e144a728dad9b2bbfe89319f2a06d4cbec171b7
TLSH
T156E0262015CACAAB45CA08EF4171A34FC7627002FACD1B215D1DF6883147408B503612
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Sync Data\LevelDB\000003.log
Size 46B
SHA256 a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a
MD5 90881c9c26f29fca29815a08ba858544
SHA1 06fee974987b91d82c2839a4bb12991fa99e1bdd
SHA512 15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Sync Data\LevelDB\LOG
Size 281B
SHA256 a4bc6e3ea14a3d5171652ad01e0a606c7853b81ebfec46701e8742835e8c865b
MD5 3a7bc77a0c05713aef45e1aa16a5e416
SHA1 7b1ae80fe6a88d5b8a4931e0ef7bc7ce14183595
SHA512 47944e4917a27026bf3e291395a3137501c7509bddd1a1fc0b5c0fe55e0f391a9f6d3f2207e6c00fda2b1745739e3599c3da924a9f3ba341eb8b8e1bc0655a3e
TLSH
T19AD0C27099C9CAB648C589EB85B1536FC7B47807B7DD3B098E4CA998340361CB925287
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Visited Links
Size 128KB
SHA256 38480b0abf70eb9f77877efbbc73bf205768680ff3cc69e42a304f3dba9ba96a
MD5 486f5d73d70cfc0cdcf4976adbff4541
SHA1 47e6f14109cac9455ef2576cd7827906657c9d88
SHA512 2faa4958ec09b45e6fbb658c83fd0bebf4e2219aa1fb5d23cf13869a126fcdbb348dbce25b7044297e178653d88601c2d0f1221dae4b73a53287ad855497da52
SSDEEP 3:ImtVuW8g+0lT2l:IiVuW8g+OC
TLSH
T1CFD30404113744D4D40401F4451CDD0D0471C00413D31443433C1D354FC11034753C30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Web Data
Size 210KB
SHA256 db93cc6874e6ae80c9a151c1dd6a326ffee07b127e5899438873c19399c79b85
MD5 de64b3487ba692a60d246d8fecc05bbb
SHA1 e2c1d6c0c2ef943be79fee667d2895d5579f279f
SHA512 13e75703aa5562b559896e564a264385fddfcde4ca29de673c1ba7582425776f51c6aeda5a324d89207b0d69b0c915284a1290577774220302a45d3b0fae8f1a
SSDEEP 384:FihpPI2DnEDsKc1IysvHEBMehIv0QKIqJOw:wzPDDnEAKc1Iys/LIIvfKIqJOw
TLSH
T1A724554A7B746100DDE2D9B21CB080771A3CB16D8F22E6925DB264694DF7853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Last Version
Size 14B
SHA256 d75607a88bb0f572f8863a3ea4737b635664178e97e0b7cb057887f2736fe3fe
MD5 3b746b6e8b8e101ee7cd41df1bb565d0
SHA1 ff5ff645ada097814fb4890d00dba8a309e1a506
SHA512 71d487cff7f744f046d993889c770a877075378b8d47d6c2f80fd94a5c1150a627f4a69d9e55f272f3aa4257e5dbb5296643591d5d23804a95550a3f2d91e2d9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Local State
Size 3KB
SHA256 395224a5eac9667fe1edd7337d0accd10cbffa635ba86342581a6debda27957e
MD5 1c1c1b90d121918efe03db0e4841fbff
SHA1 33b5bcea9f89d82c793355e80ca1027b355b19a1
SHA512 58b1fad22691011168a42ce0d9984463d906c61c40d7e0fa157bcb48c7ed4e34ad7c8c42b5fb9063c1368cad74035ba93541a417fa02f0140e3d1027f62e9d62
TLSH
T14481B62759B4A93799F3890979863F17A7659033AAC57FD8DAEC0F0C01CB68C1357C22
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Local State
Size 4KB
SHA256 33b0bd47646798ceeaef9148c4e424a393759ccb62fabe74f7cff4a162682130
MD5 12c76f4f9098b1f1ff0cada0710242b5
SHA1 1abe57f3871c48c270334f0002bf4a433039b5f9
SHA512 bab42702f7abb23ef99cf3044194e7fcedfdf3458361bfc3d3acfa25f32ae1588b9da619a2b5414e2a2a556a7fe1f3067e4b750b1e240bcf2d604f71b14a4ccc
SSDEEP 96:KB3NkGSC6qffXwc58kh/cI9URLl8DotoT7fBwZtP6vbZA7i3IJNa:23NBSaXdeiDU4FwZJmL
TLSH
T1C981A62759B4A92799F3890979863F17A7A59033AAC56FD8DAEC0F0C01CB69C1357C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Local State
Size 5KB
SHA256 0bcac2a6bbc08db4265bef4d428957e89e051efac84d7eb73cdf1ca0e55638e1
MD5 bd0d23990708007e99a80bb1dd253552
SHA1 5dad5d5993fd66d7391da5aae9ecb87e30343f40
SHA512 c499a79a3ff7e8f86176beb2efb2c11db9bedd7d37df998f89bcf997df5fb6f2169947296d6cbee43d0df56851e794aaa0eb4632eec8b047ae1e19019ba5ffeb
SSDEEP 96:K7NkGSC2ffXwc58kh/cI9URLl8DotoT7uBwotP6vbZ/Z7if0L7MipLsZczaa:kNBStXdeiDU4CwoUmU7XeZcF
TLSH
T170C10A6758B4AD27A9E78509B9866F576AB4C0639AC52FD4EADC0F0D01CF2CC1312D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Local State
Size 6KB
SHA256 b2683a2958a2e8b26cc6585ba0a8b8a23e49fa837da4ef6577fecf0cfd6e49ce
MD5 5ba9f654128b41cbe0ecab896e44cacc
SHA1 941ff114c8fb7245864a1193a69e7c60bfc668fa
SHA512 1cc6fd05c73d9843e0fd6712d79b7c28f5fcd7c970814660933573cb2042909ea0a8b33e8a5fb3c0d9b66bb226b9212f78fdf867f55f2e31354cd6dd0806f0ca
SSDEEP 96:KpNkGSCuffXwc58kh/cI9URLl8DotoT7KKBwotP6vbZ/Z7ln0L7MipLsZc3Cu3+r:eNBSJXdeiDU4mawoU5c7XeZcSuuDz7
TLSH
T1AAD10A6754B4AD2769E78509BA9A2F477AF5C0638A852FE4EADC1F0E11CB2C81313813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Local State
Size 2KB
SHA256 d91d351ad2d00288a8a762cb26da03da30251a78707fd2fc7a5723d488ec7dde
MD5 562eb004823a9475f9baeabf7465cf53
SHA1 bdd2f08a2f1695fa01547d9d33d132a39900dcf6
SHA512 3bc95d35b3dbec27a08e50beaa4d5ce0021127f598f6f429d2286ba863e793ae633a3b253230a904566d33806d1a5a61030a658c18c78cf83cded76aeff34e6b
TLSH
T16C51843369A45A36D6F64A08798A7F679F3690656F921FA49ACC0F0800CF98C2317C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Local State
Size 6KB
SHA256 f46367d4f195ffba8ddb5a5903d6d13323628537adb392c47cc4fa9163df6406
MD5 17b678740d0acbaff5473e039b62516a
SHA1 c5e764ede987103d12f820f17d4b9a93bcdaeb6b
SHA512 6eeb3f8a915113b4506c302738ac64222f80b6355f17b8e8542904257dad3f42c04ba800ea4857f5f98a2c501ca81861a527d194d428bddbb95aa3e18e9a5a8e
SSDEEP 96:KTNkGSCmuffXwc58kh/cI9URLl8DotoT74BwotP6vbZ/Z7EI0L7MipLsZc3Cu3+6:oNBSJIXdeiDU4wwoUI37XeZcSuuDzK
TLSH
T194D11C675474AD676CE78509BA992F477AF4C063CA852FE4EADC1F0E11CB2C81313C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Local State
Size 3KB
SHA256 222e2a007c3420d863ffb1135471f8475b0014f05a10fc4b86e3738f74a673be
MD5 a77dc63ff8d881761af670f365a4f4f6
SHA1 26d0277af6579e17c21a9af9014242342d940c08
SHA512 583a5e32bc7d5d8b7a50426352241921ebad300f58d2e5a59fb607e500783d52fcd1586219bc16804b9b5868da401b1a24c07aa64024f2491e48f5a34d0122e2
TLSH
T1A771863769B499379AF39904788A3F17A7619036AAC57FE5DAEC0F0C01CB68C1353C26
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Local State
Size 16KB
SHA256 3a4f059db32ede18cf21e0fa2c0600bc742c6af05b83fdbb523a6a8bb9aa35c6
MD5 f6437aab55679d931acf3fcdd5904dd5
SHA1 1398a08a6040c633ecad1a6ec59ced3ffa639f76
SHA512 33cda7c8521bbd2b2dcc388e800745dd6baf6380bd3a477e2ee6e0d4729e4bb4e62d2326b82eecc0b6dacbda93be85713572fd74ed85172ba40caa45e438ec86
SSDEEP 384:Psrv+89zHqlDNP9oidJNBSoqb5QOuSuuDzONN:Urv+4UNbd+FibNN
TLSH
T125729F33A47CE677ADF38508B59A6F073FB8A06696C10AE0E5981F8E51CE4C92313D53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Local State
Size 6KB
SHA256 5bc8051137e1ca619d3421e43f04144e157b070152686b174c6878003702739a
MD5 7abce19092c06634991ff27e2d99bd11
SHA1 da5ca1270478aaf8d81f7d617d3aeb726be1c525
SHA512 6d1dec348942b363c58b5daac56c3c0cbadf6c2d9e6eac088b5c9623d4b3fea8979817c12f4b1087270fb8b54bd0acc84679eeffd71b1f39722357242517b023
SSDEEP 96:K7NkGSC2ffXwc58kh/cI9URLl8DotoT7EBwotP6vbZ/Z7lk0L7MipLsZc3Cu3+D8:kNBStXdeiDU4EwoU5j7XeZcSuuDzg
TLSH
T16AD10A6754B4AD6769E78509BA9A2F477AF4C063CAC52FE4DADC1F0E11CB2C81313813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Local State
Size 6KB
SHA256 866b01e604af9e1b510a8c38dc7e7aa1683b9a8de2a463873f656531d042ee11
MD5 88ca0546bd8dd6e930a8361f1b807bc3
SHA1 72c6d5f3c73a88bfe7b71691a4e1a91af8b61b2a
SHA512 cfa21b1d4abad70f58869d09e82914633f527b31813c862d09c1595548465a5fe951198db61ba7616afb7609b8018184189c05fabdee5565a044d9bc499e0f37
SSDEEP 96:KpNkGSCuffXwc58kh/cI9URLl8DotoT7/tKBwotP6vbZ/Z7ENg0L7MipLsZc3Cuo:eNBSJXdeiDU4rtawoUIB7XeZcSuuDz7
TLSH
T124D11A775874AD6769E78509BA9A2F077AF5C0638A852FE4EADC1F0E11CB2C81313C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Local State
Size 6KB
SHA256 1e98a64d1b7b01116de78f6b7a948e5f924f95c8d9be4a80df52b20cd8ec71a4
MD5 6c0a0be51e4e3313577f645d3b5e1c97
SHA1 840696936dda56d729af75bb1c9562259154ae9a
SHA512 47d5b6bca00b3961fc4063e2b38d48000274ac7e1bf3e0b42fe3aa407db2a26be19c24c44ec534ad059ca5fa87e7dfc24ec23a5ecfae05335cd1fb42fc2ca125
SSDEEP 96:K9NkGSC5ffXwc58kh/cI9URLl8DotoT7sBwotP6vbZ/Z7e50L7MipLsZc3Cu3+DB:GNBSqXdeiDU48woUKa7XeZcSuuDz5v
TLSH
T1EFD11A675874AD6768E78509BAA92F477AF4C063DA852FE4EADC1F0E11CB2C81313813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Local State
Size 6KB
SHA256 c7dd0a0bdffd76b92fe5c4c52dcac0fa26e0bf7bee529d7887186c339b06cd36
MD5 2f15fc0dcd7a9537e64445e2ca723592
SHA1 b5c78965b1abec499707b816e65c32b84fdd132f
SHA512 d31d407a2750ad9786ea38c3a6781a0a98ee30cb98d8cc72c182c1b038f468cda90d2d7bb9aff09d2ea4fbb86f4fe2b92d8f4835ec387b6638e8d82e0ff4c8ee
SSDEEP 96:KTNkGSCmuffXwc58kh/cI9URLl8DotoT7UBwotP6vbZ/Z7/c0L7MipLsZc3Cu3+6:oNBSJIXdeiDU4UwoU777XeZcSuuDzK
TLSH
T172D10A6754B4AD6769E78509BAA92F477AF4C063DA852FE4EADC1F0E11CB2C81313C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe590e00.TMP

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Local State~RFe590e00.TMP
Size 1KB
SHA256 4ce8692b3c19352fd6ed894f60457cadb794755983923dac792bf37d593667c5
MD5 c0e84af00dd23f023b95bec716b47b84
SHA1 21de3d6e19fb6eb7b6cd2b76c0212fb64103f3fa
SHA512 4f4cc0396998a2e3feb25c395c871c5aea66ac8a6fd2270b68bd7fd4fe48f5f6fc92bd886727f76a10f816bef02f627ad0d53d69171e9dea7bab080113f1a225
TLSH
T1C331547399F41732F99619193156BF9B5F3140755A414F88A6CD4B0811CF88CA67BC32
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\ShaderCache\index
Size 256KB
SHA256 887778a5ab2aeca2488ef2c2741a98e1d85d3e427894ddfc38931ea1ee3a2da3
MD5 ad4c6dfa02e9fe3076bec0865730c6f9
SHA1 636fbe3ef613811442b1d412a3ac25e6ef268063
SHA512 b5aca7814dfddc82eaf16cfd5cca2e789e8259ecf0365db8138e7657d06b5484d600d67ab4dc1be72bf6fca76cc044c2f8c2c8c4dd04ea29f0e374b8d584e719
SSDEEP 3:LsOllllklkXlz+K:LsUlP6K
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Variations
Size 85B
SHA256 b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557
MD5 bc6142469cd7dadf107be9ad87ea4753
SHA1 72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c
SHA512 47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182
TLSH
T1F2A0120384738407E4144051C45C1341287C84570119C0012068931304240CB039643A
MD5 SHA1 SHA512 TLSH

Submit Download

b5172760-c55a-46ac-b39b-7ce3d91e141d.tmp

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\b5172760-c55a-46ac-b39b-7ce3d91e141d.tmp
Size 6KB
SHA256 ed12df258e087585de8f327657ff129d637fb82eab2eb6c4933c2c1f2cf7971b
MD5 ffb413d2ed6c086547b4577b9e005d3b
SHA1 007f270c9a42ac1eaa98fa8fb6647940ff196fae
SHA512 8b7de2310628cc1db9104143acf407b9e386e6988e26dcaf01100991ce976e8207e7b929c77d069fd698c99fbf681c3af937c58a3006cb208b1e5cedfade79e3
SSDEEP 96:K9NkGSC5ffXwc58kh/cI9URLl8DotoT7VBwotP6vbZ/Z7/W0L7MipLsZc3Cu3+DB:GNBSqXdeiDU4/woU7B7XeZcSuuDz5v
TLSH
T120D11B675874AD6768D38509BA992F077AF4C063DA852FE4D9DC1F0E11CB2C81313812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Untitled 1.json

Path C:\Users\Admin\AppData\Local\Wave\Recent\Untitled 1.json
Size 161B
SHA256 4179d47183357ef5e8a352f8be355396ae890325413ba5313f1ee6d357734d55
MD5 ff52c09f7e88e00a11f8c58215dd4e06
SHA1 b9896f8c03d2d1243bc82f9294be7b7f49a599f0
SHA512 d619e4ac8bcddc1b779b9ba5515eae28d1abbcd48c57fec9352491db23405bdb9ee6b7adc6551c072d07e52087efd03df2c106716cd54ecf4d2f2cfd83eff61f
TLSH
T155C08C3B88E018DB07A0026FE7980A41B690AE2F20BC0C01BB7B5B5412C18B7850FE7C
MD5 SHA1 SHA512 TLSH

Submit Download

-1468442336.json

Path C:\Users\Admin\AppData\Local\Wave\Tabs\-1468442336.json
Size 160B
SHA256 5f04553baae06253429e3d80816a9700e9b8cfed9998da354dc6865f8c01dfe2
MD5 66aa4a30a39ed0adf97ef60b85436403
SHA1 3bfd82f36e6acefcc7fbf9bb1350d32fe8eb2284
SHA512 deb431ac0671f8ba825db5aebcd3bd25594aba3b0da84ab2eab211f7766a64290be6d77132ab3004139030935feb58ba7739036779dabea158814f7a9ba61f5c
TLSH
T150C08031CC44547D63BD468E955064C73C001B5303B04C57397B465E017225016487CC
MD5 SHA1 SHA512 TLSH

Submit Download

memory/396-40-0x00007FFB8C4F0000-0x00007FFB8C4F1000-memory.dmp

Download

memory/2836-74-0x00007FFB8C4F0000-0x00007FFB8C4F1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads