Overview
overview
7Static
static
3Wave-Setup.exe
windows7-x64
7Wave-Setup.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3LICENSES.c...m.html
windows7-x64
3LICENSES.c...m.html
windows10-2004-x64
3Wave.exe
windows10-2004-x64
7resources/...mon.js
ubuntu-18.04-amd64
3resources/...mon.js
debian-9-armhf
4resources/...mon.js
debian-9-mips
3resources/...mon.js
debian-9-mipsel
3resources/...ll.exe
windows7-x64
1resources/...ll.exe
windows10-2004-x64
1resources/...dex.js
windows7-x64
3resources/...dex.js
windows10-2004-x64
3resources/...rse.js
windows7-x64
3resources/...rse.js
windows10-2004-x64
3resources/...and.js
windows7-x64
3resources/...and.js
windows10-2004-x64
3resources/...lts.js
windows7-x64
3resources/...lts.js
windows10-2004-x64
3resources/...xec.js
windows7-x64
3resources/...xec.js
windows10-2004-x64
3resources/...dex.js
windows7-x64
3resources/...dex.js
windows10-2004-x64
3resources/...oad.js
windows7-x64
3Analysis
- max time kernel
147s - max time network
159s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
30/10/2024, 01:28
Static task
static1
Behavioral task
behavioral1
Sample
Wave-Setup.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
Wave-Setup.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/WinShell.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
LICENSES.chromium.html
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
LICENSES.chromium.html
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Wave.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
resources/app.asar.unpacked/node_modules/nodemon/bin/nodemon.js
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
Behavioral task
behavioral15
Sample
resources/app.asar.unpacked/node_modules/nodemon/bin/nodemon.js
Resource
debian9-armhf-20240611-en
debian-9-armhf
Behavioral task
behavioral16
Sample
resources/app.asar.unpacked/node_modules/nodemon/bin/nodemon.js
Resource
debian9-mipsbe-20240611-en
debian-9-mips
Behavioral task
behavioral17
Sample
resources/app.asar.unpacked/node_modules/nodemon/bin/nodemon.js
Resource
debian9-mipsel-20240611-en
debian-9-mipsel
Behavioral task
behavioral18
Sample
resources/app.asar.unpacked/node_modules/nodemon/bin/windows-kill.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral19
Sample
resources/app.asar.unpacked/node_modules/nodemon/bin/windows-kill.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/cli/index.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral21
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/cli/index.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/cli/parse.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral23
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/cli/parse.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/command.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral25
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/command.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/defaults.js
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral27
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/defaults.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/exec.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral29
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/exec.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/index.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral31
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/index.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/load.js
Resource
win7-20240903-en
windows7-x64
General
- Target LICENSES.chromium.html
- Size 9.0MB
- Sample241030-bvv8xstdra
- SHA256 c6737ef4ed9de369077718824f76c5e7026d0e39163e26af8606783e41c93e18
- MD5 ae174699b663bd90d8d06c68c6952477
- SHA1 8c76eda61d320779909adc541593b8e26b24815a
- SHA512 3fb72dcd790464dde34978c9d0895376827f4d839b4a199c6e9fe77ab810d62b960babc4b21f6e189dc70147b5fb4334815730f4d1cdec05489c19e0725c2158
- SSDEEP 24576:h+QQf6Ox6x5n1nZwReXe1Gmfh6k6T6W6r656+eGj/dBIp+:oAPeGLp
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2800 msedge.exe 2800 msedge.exe 2432 msedge.exe 2432 msedge.exe 2548 identity_helper.exe 2548 identity_helper.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe 2432 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2432 wrote to memory of 2592 2432 msedge.exe 88 PID 2432 wrote to memory of 2592 2432 msedge.exe 88 PID 2432 wrote to memory of 3080 2432 msedge.exe 89 PID 2432 wrote to memory of 3080 2432 msedge.exe 89 PID 2432 wrote to memory of 3080 2432 msedge.exe 89 PID 2432 wrote to memory of 3080 2432 msedge.exe 89 PID 2432 wrote to memory of 3080 2432 msedge.exe 89 PID 2432 wrote to memory of 3080 2432 msedge.exe 89 PID 2432 wrote to memory of 3080 2432 msedge.exe 89 PID 2432 wrote to memory of 3080 2432 msedge.exe 89 PID 2432 wrote to memory of 3080 2432 msedge.exe 89 PID 2432 wrote to memory of 3080 2432 msedge.exe 89 PID 2432 wrote to memory of 3080 2432 msedge.exe 89 PID 2432 wrote to memory of 3080 2432 msedge.exe 89 PID 2432 wrote to memory of 3080 2432 msedge.exe 89 PID 2432 wrote to memory of 3080 2432 msedge.exe 89 PID 2432 wrote to memory of 3080 2432 msedge.exe 89 PID 2432 wrote to memory of 3080 2432 msedge.exe 89 PID 2432 wrote to memory of 3080 2432 msedge.exe 89 PID 2432 wrote to memory of 3080 2432 msedge.exe 89 PID 2432 wrote to memory of 3080 2432 msedge.exe 89 PID 2432 wrote to memory of 3080 2432 msedge.exe 89 PID 2432 wrote to memory of 3080 2432 msedge.exe 89 PID 2432 wrote to memory of 3080 2432 msedge.exe 89 PID 2432 wrote to memory of 3080 2432 msedge.exe 89 PID 2432 wrote to memory of 3080 2432 msedge.exe 89 PID 2432 wrote to memory of 3080 2432 msedge.exe 89 PID 2432 wrote to memory of 3080 2432 msedge.exe 89 PID 2432 wrote to memory of 3080 2432 msedge.exe 89 PID 2432 wrote to memory of 3080 2432 msedge.exe 89 PID 2432 wrote to memory of 3080 2432 msedge.exe 89 PID 2432 wrote to memory of 3080 2432 msedge.exe 89 PID 2432 wrote to memory of 3080 2432 msedge.exe 89 PID 2432 wrote to memory of 3080 2432 msedge.exe 89 PID 2432 wrote to memory of 3080 2432 msedge.exe 89 PID 2432 wrote to memory of 3080 2432 msedge.exe 89 PID 2432 wrote to memory of 3080 2432 msedge.exe 89 PID 2432 wrote to memory of 3080 2432 msedge.exe 89 PID 2432 wrote to memory of 3080 2432 msedge.exe 89 PID 2432 wrote to memory of 3080 2432 msedge.exe 89 PID 2432 wrote to memory of 3080 2432 msedge.exe 89 PID 2432 wrote to memory of 3080 2432 msedge.exe 89 PID 2432 wrote to memory of 2800 2432 msedge.exe 90 PID 2432 wrote to memory of 2800 2432 msedge.exe 90 PID 2432 wrote to memory of 4664 2432 msedge.exe 91 PID 2432 wrote to memory of 4664 2432 msedge.exe 91 PID 2432 wrote to memory of 4664 2432 msedge.exe 91 PID 2432 wrote to memory of 4664 2432 msedge.exe 91 PID 2432 wrote to memory of 4664 2432 msedge.exe 91 PID 2432 wrote to memory of 4664 2432 msedge.exe 91 PID 2432 wrote to memory of 4664 2432 msedge.exe 91 PID 2432 wrote to memory of 4664 2432 msedge.exe 91 PID 2432 wrote to memory of 4664 2432 msedge.exe 91 PID 2432 wrote to memory of 4664 2432 msedge.exe 91 PID 2432 wrote to memory of 4664 2432 msedge.exe 91 PID 2432 wrote to memory of 4664 2432 msedge.exe 91 PID 2432 wrote to memory of 4664 2432 msedge.exe 91 PID 2432 wrote to memory of 4664 2432 msedge.exe 91 PID 2432 wrote to memory of 4664 2432 msedge.exe 91 PID 2432 wrote to memory of 4664 2432 msedge.exe 91 PID 2432 wrote to memory of 4664 2432 msedge.exe 91 PID 2432 wrote to memory of 4664 2432 msedge.exe 91 PID 2432 wrote to memory of 4664 2432 msedge.exe 91 PID 2432 wrote to memory of 4664 2432 msedge.exe 91
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x10c,0xd8,0xdc,0x108,0x110,0x7ffa97c046f8,0x7ffa97c04708,0x7ffa97c047182⤵PID:2592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,11049780554556700847,13909478658820747423,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:22⤵PID:3080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,11049780554556700847,13909478658820747423,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2468 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,11049780554556700847,13909478658820747423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:82⤵PID:4664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11049780554556700847,13909478658820747423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:3440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11049780554556700847,13909478658820747423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,11049780554556700847,13909478658820747423,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:82⤵PID:1140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,11049780554556700847,13909478658820747423,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11049780554556700847,13909478658820747423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:12⤵PID:3596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11049780554556700847,13909478658820747423,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:12⤵PID:620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11049780554556700847,13909478658820747423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:2460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11049780554556700847,13909478658820747423,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:12⤵PID:644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,11049780554556700847,13909478658820747423,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4764 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3432
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2172
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4432
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a
- MD5 dc058ebc0f8181946a312f0be99ed79c
- SHA1 0c6f376ed8f2d4c275336048c7c9ef9edf18bff0
- SHA512 36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be
- MD5 a0486d6f8406d852dd805b66ff467692
- SHA1 77ba1f63142e86b21c951b808f4bc5d8ed89b571
- SHA512 065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 f22b629247ecaf683c94429a9d3bffa66a90180a48e732ec482c6a9372f7dbb4
- MD5 8e4a959bfe16f5a43daac9fe296b35ce
- SHA1 abc9de2e6e3de30c0b14c6f4aa285e97e9aa68ee
- SHA512 7b46b1e362c694b987119a099af9c728c9fc9a3d377a68569078d24a79f1eae526236255b1b7fa9f65aef60fe926c96fe8150710fa47031caa1552e1c27087d6
- SSDEEP 96:nwkeI1SNwpvWMoiVmdeH5eyUWQyV+VD7AiEwb:nwkn0NGWMX7rg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 cf99b85a4b99a06751d05fc9fb49e701844e7fae603fd841f6131edff648d1d7
- MD5 2dc46377339be2328fac7acfd382a842
- SHA1 3707f0ca29c4d98cc8137a92223aee2802d9621c
- SHA512 b195edbb8a4e8c5fc7dad6099ad165ed09740855096817a2f10d424efb209435da4e59f4ca87fafdcec1863b3b49e2ac50a6c96277f3549e6435aee2d76249e5
- SSDEEP 96:nwk0I1S9wpvWMoiVmdeH5eyUWQyV+VDCziEwb:nwk509GWMX7ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 a380618f9659c4d5cd13948a29a8165052b3a60ba5ee10acd496ff891aaec723
- MD5 eb342cb6e7ca3636386d8861d07253db
- SHA1 6bdf3b6afae8c209f655427e94956871c7d9d16a
- SHA512 c42098b2875886f6d1e0df5161973ec6e02fb09c775f7e0ed019dfac35a1704ab76ba612b74e7b33cad3e1f128ada746e5d09f90c04d907a19a874224e5723fe
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupDe2RUYLkyonHqRUx3GPOxt:A9iIxuERzA83h09RZxYTl6KSFGmx8oFj
- MD5 SHA1 SHA512 SSDEEP