hxxps://getwave[.]gg

Resubmissions

08/08/2026, 22:47

260808-2qx5tsek5z7

08/08/2026, 22:43

260808-2ncfcazvbz7

08/08/2026, 22:41

260808-2l8e1awarg3

Analysis

geolocation tags

eueuropelondonukunited-kingdom
user interaction
yes
max time kernel
128s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 22:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://getwave.gg
Sample260808-2ncfcazvbz

Score

7^/10

discovery execution themida

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3680	Wave.exe

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x0003000000000707-615.dat	themida

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
568	tasklist.exe
4236	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 18 IoCs

pid	Process
3300	Wave.exe
3300	Wave.exe
3300	Wave.exe
3300	Wave.exe
3300	Wave.exe
3300	Wave.exe
3300	Wave.exe
3300	Wave.exe
3300	Wave.exe
3300	Wave.exe
3300	Wave.exe
3300	Wave.exe
3300	Wave.exe
3300	Wave.exe
3300	Wave.exe
3300	Wave.exe
3680	Wave.exe
3680	Wave.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2380	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4088	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4632	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307026290819362"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4088	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4300	chrome.exe
4300	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4300	chrome.exe
4300	chrome.exe
828	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4300	chrome.exe
Token: SeCreatePagefilePrivilege	4300	chrome.exe
Token: SeShutdownPrivilege	4300	chrome.exe
Token: SeCreatePagefilePrivilege	4300	chrome.exe
Token: SeShutdownPrivilege	4300	chrome.exe
Token: SeCreatePagefilePrivilege	4300	chrome.exe
Token: SeShutdownPrivilege	4300	chrome.exe
Token: SeCreatePagefilePrivilege	4300	chrome.exe
Token: SeShutdownPrivilege	4300	chrome.exe
Token: SeCreatePagefilePrivilege	4300	chrome.exe
Token: SeShutdownPrivilege	4300	chrome.exe
Token: SeCreatePagefilePrivilege	4300	chrome.exe
Token: SeShutdownPrivilege	4300	chrome.exe
Token: SeCreatePagefilePrivilege	4300	chrome.exe
Token: SeShutdownPrivilege	4300	chrome.exe
Token: SeCreatePagefilePrivilege	4300	chrome.exe
Token: SeShutdownPrivilege	4300	chrome.exe
Token: SeCreatePagefilePrivilege	4300	chrome.exe
Token: SeShutdownPrivilege	4300	chrome.exe
Token: SeCreatePagefilePrivilege	4300	chrome.exe
Token: SeShutdownPrivilege	4300	chrome.exe
Token: SeCreatePagefilePrivilege	4300	chrome.exe
Token: SeShutdownPrivilege	4300	chrome.exe
Token: SeCreatePagefilePrivilege	4300	chrome.exe
Token: SeShutdownPrivilege	4300	chrome.exe
Token: SeCreatePagefilePrivilege	4300	chrome.exe
Token: SeShutdownPrivilege	4300	chrome.exe
Token: SeCreatePagefilePrivilege	4300	chrome.exe
Token: SeShutdownPrivilege	4300	chrome.exe
Token: SeCreatePagefilePrivilege	4300	chrome.exe
Token: SeShutdownPrivilege	4300	chrome.exe
Token: SeCreatePagefilePrivilege	4300	chrome.exe
Token: SeShutdownPrivilege	4300	chrome.exe
Token: SeCreatePagefilePrivilege	4300	chrome.exe
Token: SeShutdownPrivilege	4300	chrome.exe
Token: SeCreatePagefilePrivilege	4300	chrome.exe
Token: SeShutdownPrivilege	4300	chrome.exe
Token: SeCreatePagefilePrivilege	4300	chrome.exe
Token: SeShutdownPrivilege	4300	chrome.exe
Token: SeCreatePagefilePrivilege	4300	chrome.exe
Token: SeShutdownPrivilege	4300	chrome.exe
Token: SeCreatePagefilePrivilege	4300	chrome.exe
Token: SeShutdownPrivilege	4300	chrome.exe
Token: SeCreatePagefilePrivilege	4300	chrome.exe
Token: SeShutdownPrivilege	4300	chrome.exe
Token: SeCreatePagefilePrivilege	4300	chrome.exe
Token: SeShutdownPrivilege	4300	chrome.exe
Token: SeCreatePagefilePrivilege	4300	chrome.exe
Token: SeShutdownPrivilege	4300	chrome.exe
Token: SeCreatePagefilePrivilege	4300	chrome.exe
Token: SeShutdownPrivilege	4300	chrome.exe
Token: SeCreatePagefilePrivilege	4300	chrome.exe
Token: SeShutdownPrivilege	4300	chrome.exe
Token: SeCreatePagefilePrivilege	4300	chrome.exe
Token: SeShutdownPrivilege	4300	chrome.exe
Token: SeCreatePagefilePrivilege	4300	chrome.exe
Token: SeShutdownPrivilege	4300	chrome.exe
Token: SeCreatePagefilePrivilege	4300	chrome.exe
Token: SeShutdownPrivilege	4300	chrome.exe
Token: SeCreatePagefilePrivilege	4300	chrome.exe
Token: SeShutdownPrivilege	4300	chrome.exe
Token: SeCreatePagefilePrivilege	4300	chrome.exe
Token: SeShutdownPrivilege	4300	chrome.exe
Token: SeCreatePagefilePrivilege	4300	chrome.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
3300	Wave.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe
4300	chrome.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 4344	4300	chrome.exe	86
PID 4300 wrote to memory of 4780	4300	chrome.exe	88
PID 4300 wrote to memory of 4780	4300	chrome.exe	88
PID 4300 wrote to memory of 4632	4300	chrome.exe	89
PID 4300 wrote to memory of 796	4300	chrome.exe	91
PID 4300 wrote to memory of 796	4300	chrome.exe	91
PID 4300 wrote to memory of 3440	4300	chrome.exe	92
PID 4300 wrote to memory of 3440	4300	chrome.exe	92
PID 4300 wrote to memory of 1640	4300	chrome.exe	93
PID 4300 wrote to memory of 1640	4300	chrome.exe	93
PID 4300 wrote to memory of 3192	4300	chrome.exe	94
PID 4300 wrote to memory of 3192	4300	chrome.exe	94
PID 4300 wrote to memory of 1172	4300	chrome.exe	95
PID 4300 wrote to memory of 3976	4300	chrome.exe	100
PID 4300 wrote to memory of 4604	4300	chrome.exe	106
PID 4300 wrote to memory of 1060	4300	chrome.exe	107
PID 4300 wrote to memory of 4700	4300	chrome.exe	108
PID 3300 wrote to memory of 828	3300	Wave.exe	114
PID 828 wrote to memory of 3964	828	msedgewebview2.exe	115
PID 828 wrote to memory of 1080	828	msedgewebview2.exe	116
PID 828 wrote to memory of 1080	828	msedgewebview2.exe	116
PID 828 wrote to memory of 1080	828	msedgewebview2.exe	116
PID 828 wrote to memory of 3324	828	msedgewebview2.exe	117
PID 828 wrote to memory of 5020	828	msedgewebview2.exe	118
PID 828 wrote to memory of 5020	828	msedgewebview2.exe	118
PID 828 wrote to memory of 3824	828	msedgewebview2.exe	119
PID 828 wrote to memory of 3824	828	msedgewebview2.exe	119
PID 828 wrote to memory of 3824	828	msedgewebview2.exe	119
PID 3300 wrote to memory of 2380	3300	Wave.exe	122
PID 2380 wrote to memory of 568	2380	cmd.exe	124
PID 2380 wrote to memory of 4048	2380	cmd.exe	125
PID 2380 wrote to memory of 4088	2380	cmd.exe	127
PID 2380 wrote to memory of 4236	2380	cmd.exe	128
PID 2380 wrote to memory of 1640	2380	cmd.exe	129
PID 2380 wrote to memory of 1832	2380	cmd.exe	130
PID 2380 wrote to memory of 3680	2380	cmd.exe	131

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://getwave.gg
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xf8,0x108,0x7ff9b2fbc728,0x7ff9b2fbc734,0x7ff9b2fbc740
  2⤵
  PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,5289563862513803784,3814398743992813546,262144 --field-trial-handle=2004,i,2564433011445434944,5253873455939207124,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  PID:4780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2252,i,13564113547004991853,6495020585267058608,524288 --field-trial-handle=2004,i,2564433011445434944,5253873455939207124,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,16144094729119307974,10204528559774484069,524288 --field-trial-handle=2004,i,2564433011445434944,5253873455939207124,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3084,i,11216418254200496398,11188892322444807455,2097152 --field-trial-handle=2004,i,2564433011445434944,5253873455939207124,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3124 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3088,i,17640130485892000147,8126488140451498016,2097152 --field-trial-handle=2004,i,2564433011445434944,5253873455939207124,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4552,i,14990297591829728232,9576771680196861962,524288 --field-trial-handle=2004,i,2564433011445434944,5253873455939207124,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4544 /prefetch:8
  2⤵
  PID:3192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5596,i,10080779256383059299,11647932758407300315,524288 --field-trial-handle=2004,i,2564433011445434944,5253873455939207124,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  PID:1172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5480,i,3708685477538589351,15986094287565218560,524288 --field-trial-handle=2004,i,2564433011445434944,5253873455939207124,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:3976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5440,i,11971406130782671073,11028874470486393029,524288 --field-trial-handle=2004,i,2564433011445434944,5253873455939207124,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4688 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4568,i,10714784548588296777,17757162184846207897,524288 --field-trial-handle=2004,i,2564433011445434944,5253873455939207124,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:1060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5496,i,16549125320670641805,13230459419893275933,524288 --field-trial-handle=2004,i,2564433011445434944,5253873455939207124,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:4700

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5024

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1060

C:\Users\Admin\Downloads\Wave\Wave.exe
"C:\Users\Admin\Downloads\Wave\Wave.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=3300.2084.5704738742582958514
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:828
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x178,0x17c,0x180,0x154,0x188,0x7ff99b71b078,0x7ff99b71b084,0x7ff99b71b090
    3⤵
    PID:3964
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1772,i,16913253088271294498,6279703958757137089,262144 --variations-seed-version --mojo-platform-channel-handle=1764 /prefetch:2
    3⤵
    PID:1080
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2088,i,16913253088271294498,6279703958757137089,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:3
    3⤵
    PID:3324
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2424,i,16913253088271294498,6279703958757137089,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:8
    3⤵
    PID:5020
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView" --webview-exe-name=Wave.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3708,i,16913253088271294498,6279703958757137089,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:1
    3⤵
    PID:3824
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\WaveUpdate_2a32593bfe8245449b7cbd62de8d77af.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "PID eq 3300"
    3⤵
    - Discovers running processes
    PID:568
- - C:\Windows\system32\find.exe
    find "3300"
    3⤵
    PID:4048
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4088
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "PID eq 3300"
    3⤵
    - Discovers running processes
    PID:4236
- - C:\Windows\system32\find.exe
    find "3300"
    3⤵
    PID:1640
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\AppData\Local\Temp\WaveUpdate_5630887e47bd4585a0c16c3a26791cc4\*" "C:\Users\Admin\Downloads\Wave\" /S /E /Y /R /H /Q
    3⤵
    PID:1832
- - C:\Users\Admin\Downloads\Wave\Wave.exe
    "C:\Users\Admin\Downloads\Wave\Wave.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:3680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 0e2e8a0b3e8be8ad7e0337dd33d11029d3596f266f18710bde875ed5a58e28b5
MD5 0df32cd82f621bad197be3e69f613861
SHA1 0a08893330dd6b4d7b7939cfd07618751d3d2796
SHA512 2126e623edac5bd0324c50e459099ad8a00e81972f22a4ec77a94d364748bc7db1906edec47592634b8fc966bf0b02f0a0c06575324defa9b240fb5d89e3ad63
TLSH
T192E02BBAD935AC2B28F9176C50504746DB4013573B40895F3A3C8109CFF5A37069581C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 c83d067298fdba9b4b422a0435771161bfcd40b0fa776329c73d2056c7a9e28a
MD5 fbaac997973a07bd4a5d7a7ef0b5a418
SHA1 2f6f46e54e4f6a396857aa1b14373e7f735f7460
SHA512 dcedada8f5451194728b7f154cbb09215ba05138825a3f8b019f77e4e587197b4b2a0ab5c1b452c17aff8862e1d1596a9b33738b7dcb646fcaf71a9050382104
TLSH
T1A3D0A938009A0372FF4032FDF8C21A9838763104F2130EA583B40E30B82AB510286CE1
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 792a3f97e9ebcba484ec94d55c6edf75a480ac191e70bc10f8ac11361e4cd180
MD5 d952ad3b0c586724cdcb958eab4a24cc
SHA1 b200112b2d171372d85ecd772a1b88d93aef804e
SHA512 7319e67ccf5ac572a8868f5e644fb0068b392be54e0243446fb50fe1bd2c47a717afb49d217455612c263eff70ee8f94e6cc7d5a6d2e3757dbec9443eb9937dc
SSDEEP 3:MsEllllkEthXllkl2zEklEK1:/M/xT02znEe
TLSH
T14F4404047FC00C57C5401130D011C35003F0FC501F71574374710C53DCF55440CC4000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3ce5792ec6742ff7ed0c799c5e70893e6b4b0a265500baae8d4b6deafba9c2e3
MD5 93b2da6bd0c9caa84d8b8a54a80abd12
SHA1 418a340609ef7f49f1d9cc55a6320a4d0776d131
SHA512 1c1728b994663ce78435fd4fe040399235b22fbc5fa9290cd827708f18ccc49ab217b2f8dca8377cccdbaee04d910185956ac9114cc43bb80c4ddddb91c22a4d
TLSH
T17E51A2F793E8963D9A1152F49711AE1FCE6D0924431D3C26C8E4AF1B93E2972D10174E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 341f18bda9f0843d252e96e84427672ae6981ece17c83d35aa7e93cfd0d64800
MD5 437cf0308eea9cde39116456ab1bd11c
SHA1 260e2ae8417e6d126a0c31cdacd7531977c632a9
SHA512 abff169748ca1046e5fbc8a6738158d322f6c0424876e8b24263e408d43f62e8ad0617fd55c2db0f8885610713ed4f6d68ef6a6934d340a9475b84f48b6470a5
TLSH
T1CFF0597BA2AFB427127D55FB1D007C0E15B5A835058558F0CF7B826DD0814E72F02463
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 536311ac65f3aa032ffd25ab3be6d99b473bd5cfcaf165301b4ff4c59e454ba3
MD5 8109344c8aab737800880c8686cebb14
SHA1 ab0086f6eccbd8ba6909dd22fdd63b2a7722a2ed
SHA512 0acd2cb2152f132d32e44f5703df6f6575753d169b94548001c62b8b9ba87df23f929d60ac68b2bf6dfcc26ab0c23fdccfcf49b1618f3335ab0274775b796684
SSDEEP 192:/R0CxEQv78pAPRp2pKY9DHsb+WNnJfhi32ok38eEh9alVyIsnAUge:/R0CGM4UXq5wt62R3WaTe
TLSH
T1B442D62EA914793B6DDBC219FE657753D3F6102260E02E94EAFC892C14E79CC322711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6ef008bb2337395fc0c0093fc919c96371016704f9c87ad6d32d1025268ee051
MD5 5d3c928d6fd7f18ad229a092230bb57b
SHA1 c64dec112eece167037c928c8cfb25fc7bd23b1d
SHA512 3f81791adba92672d404306d991cfff2e40cf94a3f359720463ff49cbd04977aa044682d4e78f00c8ec710fbba2882adbf0cfa0512b695ff4c01c7ba5dee9b54
SSDEEP 192:/R0SxEQv78pAPRp2pKY9DHsb+WNnJfh1CE5k38eEh9alVyIsnAUge:/R0SGM4UXq5wtyEe3WaTe
TLSH
T10F42D72EA914793B6DDBC219FE657753D7F6102260E02E94EAFC892C14E79CC322711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
MD5 be6f9d6a2cbcb56c02708e735863c266
SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
TLSH
T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 34ea5c314c3a1cfafcf24e5415655f8555b62597c223df29d20339f21e69f690
MD5 93b30c7a877ca4b4fd40a00fcb1f736f
SHA1 2fe6c28c4771bc962c10e759b9fb73bed02e07db
SHA512 6398e30a5d171e303a924d1393d64fd640982cb62d5491e9e374adfff081a6bdf01f687f32bfa03920b0cf52f890545f1f4a106922a65dd3a04575474e52650b
SSDEEP 3072:hGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:wm7Rkm1tYpBeh2BAoO
TLSH
T12AC3123B5D75E9375978A70EB48E0B1E1EF249A6C930DE42C8D86A0433FA7CC1A44A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 940ae73c6e5f01c364f172596f58d8bd90311edc74f62882b88020d9af8f5661
MD5 bcd011a3fb74a889ed6d89b42f8a655b
SHA1 e9d6d264cbe4c62ebbc8d938e279af5df8fca1d2
SHA512 b2dfa1863647db441427e394affbe246cefc40c9b105a95a66b850b71314c22028e767b472982730e27a339b24e576c854833891e53fb99dc3f0e57915434040
SSDEEP 3072:baGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:b9m7Rkm1tYpBeh2BAoO
TLSH
T126C3123B9D75E93759B9BB1AB04E0A1F1DF14DA6C930DE52C8D86B0433EA7CC1A48934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 24d61563ef0fb7c3299a89dc7cbd4904fae48c769455f281fbc903f055de1dbe
MD5 fc8994ea06a157c81ff2ac5c62d01e31
SHA1 9047117590987ac1fb3c777e8f47a44d7dcab88b
SHA512 783010740311b789442a50a6dc898536c0e81cf9683dd58ba6cdeab3f28df3f1bd0dc820f88bf6d803c8b2d5f8a35799966bfb147dde8f5b7e6faa389ca09b66
SSDEEP 3072:7aGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:79m7Rkm1tYpBeh2BAoO
TLSH
T128C3123BAD75E93759B9BB1AB04E0A1F1DF14DA6C930DE52C8D86B0433EA7CC1A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WaveUpdate_2a32593bfe8245449b7cbd62de8d77af.bat

Path C:\Users\Admin\AppData\Local\Temp\WaveUpdate_2a32593bfe8245449b7cbd62de8d77af.bat
Size 665B
SHA256 47273ae6e8943d89549ac8a06bbf4f49c54a90be48d4f4d81e53c0e622bffb67
MD5 3b3a9c272b1afc124f322c2e1d35fc60
SHA1 214c8df78999466b1bbc36aaf6f0ded0603e66b6
SHA512 5be999e93e14776c2bcd09052421426b41894bd46d4bc85f896b105d278d37a59bc2c2999c1450347be5afabe4b7a0a00bfd90a677d32f1e64dcb6e1d947168a
TLSH
T1D90123B2348E5DC61420494E07AD5704DF9FC48B2F0AA04C54F84C86372D51776ACCC2
MD5 SHA1 SHA512 TLSH

Submit Download

Wave.exe

Path C:\Users\Admin\AppData\Local\Temp\WaveUpdate_5630887e47bd4585a0c16c3a26791cc4\Wave.exe
Size 13.2MB
SHA256 cb3fdd72eeb1e87df8414ccc105814eae2d491498334bd6516bc97f00d80324e
MD5 771152b26aff891eca8cec1e2779e04a
SHA1 c6d67415702bca39019126d96872e07a27f8afba
SHA512 d52289ebc1ccd56485d84971ec4b8a3b22f709886b5fdffe4bcea8b50886517cdbb8681910ce5fc64373e4bde45d83026e6e5bcf4eb49e55c8f963fdb484fe72
SSDEEP 196608:62OV7xf5MqPa9QyS6GBKwophvvi/H7bJR6B3BkamaJU8Al2vw0pETwnrZfVnXGt7:CoqPzfKp6vxR6l6aJYEPTNn2tScT0K
TLSH
T11ED612D526C4927DC4818238E54516F8F0D57CC89CF9842AFFC76A217A71CAAC8B6B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c0d580c11abf04a93c11afe5929e7e844a5f120d5b540bbf8764184e915c39b9
MD5 0f2bfb4530715982891a16b46967c3e4
SHA1 77ffe2d825135f9df279c0ac2825668bfc673cfb
SHA512 3e646a00c09a878ce632e027ed182ab52723c6752a81494924a8c78c1196334d08ce05692d8506bf7f150c9760d863f33ca2de83be09fc3a52683a19e6d32e2c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 68c76d416d3197f48a0a8866b52705ea26413c11e1e19241fc3797db8fe66321
MD5 e1a2ddd18c69485cb21e1771c9d7c7ea
SHA1 5dc66da81b12dc9c78d7441f8327700ddb04be7b
SHA512 6bd781bd867d9be70e41e22fe4900dd9e9fdf29f35ae2db21d68eac9cf3ec0cb04fb88f5304e85eec4ad37d91f09f93f7b05a2d5f380af443c25226d12cca8ab
TLSH
T168D0122236014174C42021330013A1080A01D50B4047C1049438C55D7E144906A06882
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 696B
SHA256 b917f8fe3b7dc182c8c4653e9255eacd082219783033152cca5f52d3bad98ccf
MD5 20cb8efdc134327d325465e7394e4215
SHA1 c92aeb2c271138c91b1299b16ca4922465aeb4f6
SHA512 7aa37855e277da0ef95678562816e05bead3a19021e36e41682a5a6410103eb74ec6b907bc3adb897475621013dab804852fd87808830e13c2909d44d319acb7
TLSH
T14F015228DBDB8138EB205072D2C16D2375F22193768B8F03D33A0E70C94BBC0942E886
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b685.TMP

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59b685.TMP
Size 48B
SHA256 d3414e0cf009538a6aadc21b79261fa6e886018d30a86ed26c7321bde82681d5
MD5 2c7694b9fcfb3a1fb185c4140f0d70a8
SHA1 2081bfe35ea044bce0081edb3ebc4a7c149484bd
SHA512 c8871dada002ae742879d307fc229839879da84948e8c532dbc8d6ad479e875801cd680ff45c1e1920123c0372423b6e8832f3bb59c0f2f52f7e0875ebe163c1
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59b702.TMP

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Network\Network Persistent State~RFe59b702.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 03dc2fc7ad0ab224a9ecd4bdcbda30b48f4b14ea5453dd63ed23150edb60559f
MD5 407e9ca8c26bab0e0ef5ca64ce039271
SHA1 e18b97fc96e120d053d76d93d866665ca8cad29a
SHA512 674b0555122e9b52c81413358b6eec3a84444bcf653b2c616c6bfa1cc8be7b8ebbaf9a9f67a63fbcfab12d70778b25b0132d0ddbdbac3b56f191741d4f808526
SSDEEP 96:stw052sd588b9hffqrZ8i0vhEJk6pm/7qx+WVHMSm+uecjuo1idQj3+gIUndKEB:stw0psKfIZ8paRs/S+WihuowdyKUndK8
TLSH
T149D1A9036E68697B4CC7E25D7A36BB17D2FA506166C40E68EBFC451C08D76CC531790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59b685.TMP

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Preferences~RFe59b685.TMP
Size 6KB
SHA256 eecccb5316375024e982264fdbbea047d3d838de8d48253ac481423022df8122
MD5 40aba25e50f8d8fda57e1bbbd1d82663
SHA1 6cecf85723a1c751165785f189123d62c2149a90
SHA512 72a57e3c9a16c24f3d41e8ba49c755edd4c503509a82c3bc45071f508a9e3f5582ba18aa17f3cf725bca30cea463d505a528d97a2b4fa213bcffe12008d883e2
SSDEEP 96:stw052sd588b9hfftdZ8i0vhEJk6pm/7qx+WVHMSm+uecjuo1idQj3+gIknDMEB:stw0psKffZ8paRs/S+WihuowdyKknDM8
TLSH
T1B0D1C8036E68697B4CCBF21D7A35BB16D2FA506166C40E68EBFC851C08D76CC231790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Local State
Size 1KB
SHA256 3cf52f81df746c11f58b15eb0a8560f2e8cd827baec089ef6f6d7a5755a7abd9
MD5 1cb447d2dda1de331b34bea0806fd8be
SHA1 b039325cbec04a82b0a73756cd682fcb92e6ae13
SHA512 11c3c20acb766ab21c43e294ba822ed0ec228001e627133dc5e3aa83810af958c17522f20e92b53423f009b173f8ff6708d8ca0d86110df04cce3dbee3e67362
TLSH
T18D3177B3B4903B73698177C5B6027F676E606025C1514F68A1FE4B1D01E76CC263AC37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Local State
Size 2KB
SHA256 1487330a23f2a4afd511627f013f018f35008be5a7b4e5174d2ef6027162c2c0
MD5 f41cd29475c67bdd75a0882077d33336
SHA1 437ac3ab5567055385ede0d542aacb92d4308355
SHA512 407f04ad2f8cf8d0cfa62474f34cbd225d07881f06823860c5a6bf4e35f33f9eeaef8d5e391fe659a080ce6e020ec2f3fb9ad487d541d7d41fb5f82b74f1a84f
TLSH
T14A51C873B8547B3789E36A88BD453F23AAB59161C6522F74A6FD0B1C00D769C2312C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Local State
Size 3KB
SHA256 c75b0839ab53a89a8cd6283cf46ef72fbc0e41a71d2fe560dd492b8139c6d24f
MD5 9426cd435421e11465c7078eb6173be4
SHA1 94b41dfab25d8f45940559fc0951633e454a4d55
SHA512 c62367a427745876965097813c3729ce54fe87c6d0a27a56cad3ca6a84ed545b549aab8c8ac9b516f2a9a0e09b76e5e551df958bcbd8d84b3e671d207f14ab91
TLSH
T1C2719473B864BA374DE2AA44B9852B26B7A15132D1913FB8D6FC0F1D01D73C82352C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Local State
Size 4KB
SHA256 4d84682d0b9bac599e2545972554662bc3e024bc272e1d5c64642cbe4101b0d3
MD5 3113b21ca13ef90c4fc7f4e9d6abe583
SHA1 2ab22d1e500299ade3462498baab8d1fba6613b0
SHA512 efd61526964240980fbc91cfb8086728bfaad9a73b123b2eca189fbfc53a1c4c5ca7fdfb022c9dd5764a6a5b62b084a2f58cbee85835fa8e7a7576033d401f74
SSDEEP 96:zuBmbNkCEYf1gW58Frh/cInURoDotoiyFTDmBhZ167DZIKT4lqa:z3bNb/QooDUDyx2hZRS0
TLSH
T1BD8184327874AA374DF2EA49B9463B17B6A19023D5953FACD9EC0F0D01DB29C1352C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Local State
Size 16KB
SHA256 60a017fae1a7117703ba5363695e156a9cd6da23f5183b5640da843900b40eab
MD5 742e6106992bd50ffb64648986d817a8
SHA1 da6eecdc8e2900464a88c2c0bea26a957c9e8c19
SHA512 073e1e9b8877f5705b7670d773b4c70ec161cc9e7469c5ca7f5f800128defc1019c13f82b78ff8cd502ea2de8a0e81163bd0ed05c9060595c006b2fb90a0e04b
SSDEEP 384:zz+aQikB+z/xvxjg/qhEm3NbWCF61r09z1:O/UxvxjgC+mxF8YF1
TLSH
T183728D2B65683E3395F3FA457A48075FDBB994B290C26FB849FD5F0A069B3D80302D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe596884.TMP

Path C:\Users\Admin\AppData\Local\Wave.WebView2\EBWebView\Local State~RFe596884.TMP
Size 1KB
SHA256 774d982b1d294df8e8fbb4ea7fae69c050b439d62e672a5f79e5ac5fbec13179
MD5 8afcde74d533bd9c937b9d750ad07036
SHA1 2ec2e56f397ecd6249759e5e3e093daa95347801
SHA512 f81401c7316d127b2543fed65bca427e489326946652241430c67d6d6b334bfa2a6d23d805fd03217ec9a0069398ca9f4411f0ae88ecee0a46d4074285ea4408
TLSH
T1472154B3F8943A73B9816A84F602BB5B2EA06125C2504F2CE1EE471911D75DC163AC37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1080-445-0x0000024CE6850000-0x0000024CE68EB000-memory.dmp

Download

memory/1080-216-0x00007FF9C0880000-0x00007FF9C0881000-memory.dmp

Download

memory/3300-453-0x00007FF9939F0000-0x00007FF995FCD000-memory.dmp

Download

memory/3300-391-0x00007FF9939F0000-0x00007FF995FCD000-memory.dmp

Download

memory/3824-446-0x0000028E66540000-0x0000028E665DB000-memory.dmp

Download

memory/3824-320-0x00007FF9C0880000-0x00007FF9C0881000-memory.dmp

Download

memory/5020-282-0x00007FF9C1270000-0x00007FF9C1271000-memory.dmp

Download

memory/5020-283-0x00007FF9C2230000-0x00007FF9C2231000-memory.dmp

Download