Overview
overview
8Static
static
3Wave-Setup.exe
windows10-2004-x64
$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3LICENSES.c...m.html
windows10-2004-x64
3resources/...mon.js
windows10-2004-x64
3resources/...ll.exe
windows10-2004-x64
1resources/...dex.js
windows10-2004-x64
3resources/...rse.js
windows10-2004-x64
3resources/...and.js
windows10-2004-x64
3resources/...lts.js
windows10-2004-x64
3resources/...xec.js
windows10-2004-x64
3resources/...dex.js
windows10-2004-x64
3resources/...oad.js
windows10-2004-x64
3resources/...dex.js
windows10-2004-x64
3resources/...dex.js
windows10-2004-x64
3resources/...dex.js
windows10-2004-x64
3resources/...tch.js
windows10-2004-x64
3resources/...run.js
windows10-2004-x64
3resources/...als.js
windows10-2004-x64
3resources/...tch.js
windows10-2004-x64
3resources/...mon.js
windows10-2004-x64
3resources/...add.js
windows10-2004-x64
3resources/...dex.js
windows10-2004-x64
3resources/...rse.js
windows10-2004-x64
3resources/...awn.js
windows10-2004-x64
3resources/...bus.js
windows10-2004-x64
3resources/...one.js
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...7z.dll
windows10-2004-x64
3$R0/Uninst...ve.exe
windows10-2004-x64
7Resubmissions
27/10/2024, 23:24
241027-3d31zsvele727/10/2024, 22:52
241027-2txcpsvfkk827/10/2024, 22:45
241027-2pv9vavamh8Analysis
- max time kernel
266s - max time network
258s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
27/10/2024, 22:52
Static task
static1
Behavioral task
behavioral1
Sample
Wave-Setup.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
LICENSES.chromium.html
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
resources/app.asar.unpacked/node_modules/nodemon/bin/nodemon.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
resources/app.asar.unpacked/node_modules/nodemon/bin/windows-kill.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/cli/index.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/cli/parse.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/command.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/defaults.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/exec.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/index.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/load.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/help/index.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/index.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/monitor/index.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/monitor/match.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/monitor/run.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/monitor/signals.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/monitor/watch.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/nodemon.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/rules/add.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/rules/index.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/rules/parse.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/spawn.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/utils/bus.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/utils/clone.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
$R0/Uninstall Wave.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
General
- Target LICENSES.chromium.html
- Size 9.0MB
- Sample241027-2txcpsvfkk
- SHA256 c6737ef4ed9de369077718824f76c5e7026d0e39163e26af8606783e41c93e18
- MD5 ae174699b663bd90d8d06c68c6952477
- SHA1 8c76eda61d320779909adc541593b8e26b24815a
- SHA512 3fb72dcd790464dde34978c9d0895376827f4d839b4a199c6e9fe77ab810d62b960babc4b21f6e189dc70147b5fb4334815730f4d1cdec05489c19e0725c2158
- SSDEEP 24576:h+QQf6Ox6x5n1nZwReXe1Gmfh6k6T6W6r656+eGj/dBIp+:oAPeGLp
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4564 msedge.exe 4564 msedge.exe 2116 msedge.exe 2116 msedge.exe 3704 identity_helper.exe 3704 identity_helper.exe 1256 msedge.exe 1256 msedge.exe 1256 msedge.exe 1256 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe 2116 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2116 wrote to memory of 4168 2116 msedge.exe 88 PID 2116 wrote to memory of 4168 2116 msedge.exe 88 PID 2116 wrote to memory of 2424 2116 msedge.exe 89 PID 2116 wrote to memory of 2424 2116 msedge.exe 89 PID 2116 wrote to memory of 2424 2116 msedge.exe 89 PID 2116 wrote to memory of 2424 2116 msedge.exe 89 PID 2116 wrote to memory of 2424 2116 msedge.exe 89 PID 2116 wrote to memory of 2424 2116 msedge.exe 89 PID 2116 wrote to memory of 2424 2116 msedge.exe 89 PID 2116 wrote to memory of 2424 2116 msedge.exe 89 PID 2116 wrote to memory of 2424 2116 msedge.exe 89 PID 2116 wrote to memory of 2424 2116 msedge.exe 89 PID 2116 wrote to memory of 2424 2116 msedge.exe 89 PID 2116 wrote to memory of 2424 2116 msedge.exe 89 PID 2116 wrote to memory of 2424 2116 msedge.exe 89 PID 2116 wrote to memory of 2424 2116 msedge.exe 89 PID 2116 wrote to memory of 2424 2116 msedge.exe 89 PID 2116 wrote to memory of 2424 2116 msedge.exe 89 PID 2116 wrote to memory of 2424 2116 msedge.exe 89 PID 2116 wrote to memory of 2424 2116 msedge.exe 89 PID 2116 wrote to memory of 2424 2116 msedge.exe 89 PID 2116 wrote to memory of 2424 2116 msedge.exe 89 PID 2116 wrote to memory of 2424 2116 msedge.exe 89 PID 2116 wrote to memory of 2424 2116 msedge.exe 89 PID 2116 wrote to memory of 2424 2116 msedge.exe 89 PID 2116 wrote to memory of 2424 2116 msedge.exe 89 PID 2116 wrote to memory of 2424 2116 msedge.exe 89 PID 2116 wrote to memory of 2424 2116 msedge.exe 89 PID 2116 wrote to memory of 2424 2116 msedge.exe 89 PID 2116 wrote to memory of 2424 2116 msedge.exe 89 PID 2116 wrote to memory of 2424 2116 msedge.exe 89 PID 2116 wrote to memory of 2424 2116 msedge.exe 89 PID 2116 wrote to memory of 2424 2116 msedge.exe 89 PID 2116 wrote to memory of 2424 2116 msedge.exe 89 PID 2116 wrote to memory of 2424 2116 msedge.exe 89 PID 2116 wrote to memory of 2424 2116 msedge.exe 89 PID 2116 wrote to memory of 2424 2116 msedge.exe 89 PID 2116 wrote to memory of 2424 2116 msedge.exe 89 PID 2116 wrote to memory of 2424 2116 msedge.exe 89 PID 2116 wrote to memory of 2424 2116 msedge.exe 89 PID 2116 wrote to memory of 2424 2116 msedge.exe 89 PID 2116 wrote to memory of 2424 2116 msedge.exe 89 PID 2116 wrote to memory of 4564 2116 msedge.exe 90 PID 2116 wrote to memory of 4564 2116 msedge.exe 90 PID 2116 wrote to memory of 4492 2116 msedge.exe 91 PID 2116 wrote to memory of 4492 2116 msedge.exe 91 PID 2116 wrote to memory of 4492 2116 msedge.exe 91 PID 2116 wrote to memory of 4492 2116 msedge.exe 91 PID 2116 wrote to memory of 4492 2116 msedge.exe 91 PID 2116 wrote to memory of 4492 2116 msedge.exe 91 PID 2116 wrote to memory of 4492 2116 msedge.exe 91 PID 2116 wrote to memory of 4492 2116 msedge.exe 91 PID 2116 wrote to memory of 4492 2116 msedge.exe 91 PID 2116 wrote to memory of 4492 2116 msedge.exe 91 PID 2116 wrote to memory of 4492 2116 msedge.exe 91 PID 2116 wrote to memory of 4492 2116 msedge.exe 91 PID 2116 wrote to memory of 4492 2116 msedge.exe 91 PID 2116 wrote to memory of 4492 2116 msedge.exe 91 PID 2116 wrote to memory of 4492 2116 msedge.exe 91 PID 2116 wrote to memory of 4492 2116 msedge.exe 91 PID 2116 wrote to memory of 4492 2116 msedge.exe 91 PID 2116 wrote to memory of 4492 2116 msedge.exe 91 PID 2116 wrote to memory of 4492 2116 msedge.exe 91 PID 2116 wrote to memory of 4492 2116 msedge.exe 91
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffefd8046f8,0x7ffefd804708,0x7ffefd8047182⤵PID:4168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,8401643327613553540,4355819693011675436,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:22⤵PID:2424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,8401643327613553540,4355819693011675436,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,8401643327613553540,4355819693011675436,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:82⤵PID:4492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8401643327613553540,4355819693011675436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:5084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8401643327613553540,4355819693011675436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:4156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,8401643327613553540,4355819693011675436,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:82⤵PID:1528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,8401643327613553540,4355819693011675436,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8401643327613553540,4355819693011675436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:12⤵PID:3552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8401643327613553540,4355819693011675436,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:12⤵PID:2968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8401643327613553540,4355819693011675436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:1068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8401643327613553540,4355819693011675436,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:12⤵PID:4744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,8401643327613553540,4355819693011675436,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2732 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1256
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:992
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1224
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151
- MD5 0a9dc42e4013fc47438e96d24beb8eff
- SHA1 806ab26d7eae031a58484188a7eb1adab06457fc
- SHA512 868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e
- MD5 61cef8e38cd95bf003f5fdd1dc37dae1
- SHA1 11f2f79ecb349344c143eea9a0fed41891a3467f
- SHA512 6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 fbe4a3cb8c9618dacb3a65350b6ab0747314fdbf407cd3bb6b3d3c26ffd62b48
- MD5 dfc051c5fde82d2d1f1fff408d532dd7
- SHA1 2960cfd1212a499a1ea01b83abd786e646134f4e
- SHA512 fc597767e2043742f778bbbfeae2e32a5b3bec162eb11203dffa8f6bfdf3b159e20e24700196538150211e812350ad47e9b1b9e8743796db2cf00a236f53050e
- SSDEEP 96:nWkSu16f6VwwpvWMoiVmdeH7CkgUWQyV+VDCziEwb:nWk1Ef6VwGWMX6ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 73c361af2bc5f78c4849f77ecda155e9ae6726dac6e1af0efb8c683a7322eb60
- MD5 77b1f4d30b8a149fcd0ae3a4eae32e22
- SHA1 e53622b82c79de441142c3698f09813b649c272d
- SHA512 70377e4820ad3ca8aa65027ba4b1f1f4357fbb93e3a585eb74669e368ca871d8ec5327fae1762c55ffb91606a8fa587e2431facd2253f56d695b8de170ff117c
- SSDEEP 96:nWkcu16f69wwpvWMoiVmdeH7CkgUWQyV+VD7AiEwb:nWkPEf69wGWMX6rg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 ee09381cffcb0f289f5564b85c3295eb28f25ffa628f23ff8f1ee2b7d4fc3c4e
- MD5 8bb6eb7c5c1b1fb5d32afea62233c51b
- SHA1 5de927fbb9c5c33c1565479b260ff1b4f9c0a261
- SHA512 126689574895fb282773b9efd13ade033ab33155cf38b49b5af07e4870341ef12a0884e6f21d6651a6a9c9f27a5632b58d3732b082df39f4a7438603e3ce37a0
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupO5Ye2RUV4nDlHqRUx3GPOw:A9iIxuERzA83h09RZxYO5WDQSFGmx8oS
- MD5 SHA1 SHA512 SSDEEP