Overview
overview
7Static
static
3Wave-Setup.exe
windows7-x64
7Wave-Setup.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3LICENSES.c...m.html
windows7-x64
3LICENSES.c...m.html
windows10-2004-x64
3Wave.exe
windows10-2004-x64
7d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows10-2004-x64
1resources/...vc.dll
windows7-x64
1resources/...vc.dll
windows10-2004-x64
1resources/...mon.js
ubuntu-18.04-amd64
3resources/...mon.js
debian-9-armhf
4resources/...mon.js
debian-9-mips
3resources/...mon.js
debian-9-mipsel
3resources/...ll.exe
windows7-x64
1resources/...ll.exe
windows10-2004-x64
1resources/...dex.js
windows7-x64
3resources/...dex.js
windows10-2004-x64
3resources/...rse.js
windows7-x64
3resources/...rse.js
windows10-2004-x64
3resources/...and.js
windows7-x64
3resources/...and.js
windows10-2004-x64
3resources/...lts.js
windows7-x64
3Analysis
- max time kernel
145s - max time network
161s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
04/11/2024, 22:34
Static task
static1
Behavioral task
behavioral1
Sample
Wave-Setup.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
Wave-Setup.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/WinShell.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
LICENSES.chromium.html
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral12
Sample
LICENSES.chromium.html
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Wave.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
d3dcompiler_47.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
ffmpeg.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
libEGL.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
libGLESv2.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
resources/app.asar.unpacked/node_modules/@next/swc-win32-x64-msvc/next-swc.win32-x64-msvc.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral19
Sample
resources/app.asar.unpacked/node_modules/@next/swc-win32-x64-msvc/next-swc.win32-x64-msvc.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
resources/app.asar.unpacked/node_modules/nodemon/bin/nodemon.js
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
Behavioral task
behavioral21
Sample
resources/app.asar.unpacked/node_modules/nodemon/bin/nodemon.js
Resource
debian9-armhf-20240729-en
debian-9-armhf
Behavioral task
behavioral22
Sample
resources/app.asar.unpacked/node_modules/nodemon/bin/nodemon.js
Resource
debian9-mipsbe-20240611-en
debian-9-mips
Behavioral task
behavioral23
Sample
resources/app.asar.unpacked/node_modules/nodemon/bin/nodemon.js
Resource
debian9-mipsel-20240611-en
debian-9-mipsel
Behavioral task
behavioral24
Sample
resources/app.asar.unpacked/node_modules/nodemon/bin/windows-kill.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral25
Sample
resources/app.asar.unpacked/node_modules/nodemon/bin/windows-kill.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/cli/index.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral27
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/cli/index.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/cli/parse.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral29
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/cli/parse.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/command.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral31
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/command.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/defaults.js
Resource
win7-20241010-en
windows7-x64
General
- Target LICENSES.chromium.html
- Size 9.0MB
- Sample241104-2g7mxayemd
- SHA256 c6737ef4ed9de369077718824f76c5e7026d0e39163e26af8606783e41c93e18
- MD5 ae174699b663bd90d8d06c68c6952477
- SHA1 8c76eda61d320779909adc541593b8e26b24815a
- SHA512 3fb72dcd790464dde34978c9d0895376827f4d839b4a199c6e9fe77ab810d62b960babc4b21f6e189dc70147b5fb4334815730f4d1cdec05489c19e0725c2158
- SSDEEP 24576:h+QQf6Ox6x5n1nZwReXe1Gmfh6k6T6W6r656+eGj/dBIp+:oAPeGLp
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3604 msedge.exe 3604 msedge.exe 4488 msedge.exe 4488 msedge.exe 4648 identity_helper.exe 4648 identity_helper.exe 5724 msedge.exe 5724 msedge.exe 5724 msedge.exe 5724 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4488 wrote to memory of 1452 4488 msedge.exe 85 PID 4488 wrote to memory of 1452 4488 msedge.exe 85 PID 4488 wrote to memory of 4432 4488 msedge.exe 86 PID 4488 wrote to memory of 4432 4488 msedge.exe 86 PID 4488 wrote to memory of 4432 4488 msedge.exe 86 PID 4488 wrote to memory of 4432 4488 msedge.exe 86 PID 4488 wrote to memory of 4432 4488 msedge.exe 86 PID 4488 wrote to memory of 4432 4488 msedge.exe 86 PID 4488 wrote to memory of 4432 4488 msedge.exe 86 PID 4488 wrote to memory of 4432 4488 msedge.exe 86 PID 4488 wrote to memory of 4432 4488 msedge.exe 86 PID 4488 wrote to memory of 4432 4488 msedge.exe 86 PID 4488 wrote to memory of 4432 4488 msedge.exe 86 PID 4488 wrote to memory of 4432 4488 msedge.exe 86 PID 4488 wrote to memory of 4432 4488 msedge.exe 86 PID 4488 wrote to memory of 4432 4488 msedge.exe 86 PID 4488 wrote to memory of 4432 4488 msedge.exe 86 PID 4488 wrote to memory of 4432 4488 msedge.exe 86 PID 4488 wrote to memory of 4432 4488 msedge.exe 86 PID 4488 wrote to memory of 4432 4488 msedge.exe 86 PID 4488 wrote to memory of 4432 4488 msedge.exe 86 PID 4488 wrote to memory of 4432 4488 msedge.exe 86 PID 4488 wrote to memory of 4432 4488 msedge.exe 86 PID 4488 wrote to memory of 4432 4488 msedge.exe 86 PID 4488 wrote to memory of 4432 4488 msedge.exe 86 PID 4488 wrote to memory of 4432 4488 msedge.exe 86 PID 4488 wrote to memory of 4432 4488 msedge.exe 86 PID 4488 wrote to memory of 4432 4488 msedge.exe 86 PID 4488 wrote to memory of 4432 4488 msedge.exe 86 PID 4488 wrote to memory of 4432 4488 msedge.exe 86 PID 4488 wrote to memory of 4432 4488 msedge.exe 86 PID 4488 wrote to memory of 4432 4488 msedge.exe 86 PID 4488 wrote to memory of 4432 4488 msedge.exe 86 PID 4488 wrote to memory of 4432 4488 msedge.exe 86 PID 4488 wrote to memory of 4432 4488 msedge.exe 86 PID 4488 wrote to memory of 4432 4488 msedge.exe 86 PID 4488 wrote to memory of 4432 4488 msedge.exe 86 PID 4488 wrote to memory of 4432 4488 msedge.exe 86 PID 4488 wrote to memory of 4432 4488 msedge.exe 86 PID 4488 wrote to memory of 4432 4488 msedge.exe 86 PID 4488 wrote to memory of 4432 4488 msedge.exe 86 PID 4488 wrote to memory of 4432 4488 msedge.exe 86 PID 4488 wrote to memory of 3604 4488 msedge.exe 87 PID 4488 wrote to memory of 3604 4488 msedge.exe 87 PID 4488 wrote to memory of 3168 4488 msedge.exe 88 PID 4488 wrote to memory of 3168 4488 msedge.exe 88 PID 4488 wrote to memory of 3168 4488 msedge.exe 88 PID 4488 wrote to memory of 3168 4488 msedge.exe 88 PID 4488 wrote to memory of 3168 4488 msedge.exe 88 PID 4488 wrote to memory of 3168 4488 msedge.exe 88 PID 4488 wrote to memory of 3168 4488 msedge.exe 88 PID 4488 wrote to memory of 3168 4488 msedge.exe 88 PID 4488 wrote to memory of 3168 4488 msedge.exe 88 PID 4488 wrote to memory of 3168 4488 msedge.exe 88 PID 4488 wrote to memory of 3168 4488 msedge.exe 88 PID 4488 wrote to memory of 3168 4488 msedge.exe 88 PID 4488 wrote to memory of 3168 4488 msedge.exe 88 PID 4488 wrote to memory of 3168 4488 msedge.exe 88 PID 4488 wrote to memory of 3168 4488 msedge.exe 88 PID 4488 wrote to memory of 3168 4488 msedge.exe 88 PID 4488 wrote to memory of 3168 4488 msedge.exe 88 PID 4488 wrote to memory of 3168 4488 msedge.exe 88 PID 4488 wrote to memory of 3168 4488 msedge.exe 88 PID 4488 wrote to memory of 3168 4488 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff99dbd46f8,0x7ff99dbd4708,0x7ff99dbd47182⤵PID:1452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,7182190104464758884,8626843438940822891,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:22⤵PID:4432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,7182190104464758884,8626843438940822891,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2524 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,7182190104464758884,8626843438940822891,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:82⤵PID:3168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7182190104464758884,8626843438940822891,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:2516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7182190104464758884,8626843438940822891,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:4892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,7182190104464758884,8626843438940822891,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:82⤵PID:4776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,7182190104464758884,8626843438940822891,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7182190104464758884,8626843438940822891,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:12⤵PID:1256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7182190104464758884,8626843438940822891,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:12⤵PID:3896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7182190104464758884,8626843438940822891,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:12⤵PID:4776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7182190104464758884,8626843438940822891,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:12⤵PID:3872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,7182190104464758884,8626843438940822891,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2640 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5724
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:776
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:932
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574
- MD5 e55832d7cd7e868a2c087c4c73678018
- SHA1 ed7a2f6d6437e907218ffba9128802eaf414a0eb
- SHA512 897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66
- MD5 c2d9eeb3fdd75834f0ac3f9767de8d6f
- SHA1 4d16a7e82190f8490a00008bd53d85fb92e379b0
- SHA512 d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 7632b1335690f5f90561b67a49a59e463a0a8011b3327f2dd74c76e1af9fb26b
- MD5 46af544fd212f2b014fab07331fb08f9
- SHA1 078b0b3a5c2554a3db209c4d0e026450ced80e5b
- SHA512 ede1612d36d04d9c5b53ed50f43effa70e8f49a488434957866db3d03cae94b449b26a7755acf5b6fe0bd3f228dc5dd9f23c52b163e83927cc9d88a84600ea56
- SSDEEP 96:nykPS160PfkwpvWMoiVmdeHycaeUWQyV+VDCziEwb:nykKw0UGWMXyero
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 53570fd70deb0018554cd829712ccd07feddbbaf2137a8c8eef90793b3575b1e
- MD5 6d7760b9d7f95e29e476f69adc68869f
- SHA1 53f91e514115cd1bdb6102f09079124152906370
- SHA512 2dd323da0cc1b27a527b7241395f403e64091e4e854f9f7f762685ecbddb0c0dde70f41c1e66f3892c1d0130a27eb026effeb690ac12fffc18fcca1d854bbd58
- SSDEEP 96:nykHS16cPfkwpvWMoiVmdeHycaeUWQyV+VD7AiEwb:nykywcUGWMXyerg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
- MD5 206702161f94c5cd39fadd03f4014d98
- SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
- SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 1cfac9f72e0f7d85dcb279ec0c0e510446dd7bf8eec711fe6c3889339e50fa43
- MD5 55bcb48bb18322102c6e10299f346d96
- SHA1 cee1b10c8dced2fb9901233048b29d30d594946f
- SHA512 c78710763e34b85f4377b99d7fcd54f0903b5b905703457de620db0d20e7027c647078ca589cc264edc0cb47edf1ec7ce87a6bfe559ab1dc1a1f8f039d42c5cf
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupze2RU9p4ztHqRUx3GPOx9d:A9iIxuERzA83h09RZxYjJISFGmx8oOLu
- MD5 SHA1 SHA512 SSDEEP