Overview
overview
8Static
static
3Wave-Setup.exe
windows7-x64
8Wave-Setup.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3LICENSES.c...m.html
windows7-x64
3LICENSES.c...m.html
windows10-2004-x64
3Wave.exe
windows10-2004-x64
7resources/...mon.js
ubuntu-18.04-amd64
3resources/...mon.js
debian-9-armhf
4resources/...mon.js
debian-9-mips
3resources/...mon.js
debian-9-mipsel
3resources/...ll.exe
windows7-x64
1resources/...ll.exe
windows10-2004-x64
1resources/...dex.js
windows7-x64
3resources/...dex.js
windows10-2004-x64
3resources/...rse.js
windows7-x64
3resources/...rse.js
windows10-2004-x64
3resources/...and.js
windows7-x64
3resources/...and.js
windows10-2004-x64
3resources/...lts.js
windows7-x64
3resources/...lts.js
windows10-2004-x64
3resources/...xec.js
windows7-x64
3resources/...xec.js
windows10-2004-x64
3resources/...dex.js
windows7-x64
3resources/...dex.js
windows10-2004-x64
3resources/...oad.js
windows7-x64
3Analysis
- max time kernel
145s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
06/11/2024, 01:22
Static task
static1
Behavioral task
behavioral1
Sample
Wave-Setup.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral2
Sample
Wave-Setup.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/WinShell.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
LICENSES.chromium.html
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral12
Sample
LICENSES.chromium.html
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Wave.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
resources/app.asar.unpacked/node_modules/nodemon/bin/nodemon.js
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
Behavioral task
behavioral15
Sample
resources/app.asar.unpacked/node_modules/nodemon/bin/nodemon.js
Resource
debian9-armhf-20240418-en
debian-9-armhf
Behavioral task
behavioral16
Sample
resources/app.asar.unpacked/node_modules/nodemon/bin/nodemon.js
Resource
debian9-mipsbe-20240611-en
debian-9-mips
Behavioral task
behavioral17
Sample
resources/app.asar.unpacked/node_modules/nodemon/bin/nodemon.js
Resource
debian9-mipsel-20240226-en
debian-9-mipsel
Behavioral task
behavioral18
Sample
resources/app.asar.unpacked/node_modules/nodemon/bin/windows-kill.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral19
Sample
resources/app.asar.unpacked/node_modules/nodemon/bin/windows-kill.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/cli/index.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral21
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/cli/index.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/cli/parse.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral23
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/cli/parse.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/command.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral25
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/command.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/defaults.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral27
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/defaults.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/exec.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral29
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/exec.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/index.js
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral31
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/index.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/load.js
Resource
win7-20241010-en
windows7-x64
General
- Target LICENSES.chromium.html
- Size 9.0MB
- Sample241106-brmsdavmfr
- SHA256 c6737ef4ed9de369077718824f76c5e7026d0e39163e26af8606783e41c93e18
- MD5 ae174699b663bd90d8d06c68c6952477
- SHA1 8c76eda61d320779909adc541593b8e26b24815a
- SHA512 3fb72dcd790464dde34978c9d0895376827f4d839b4a199c6e9fe77ab810d62b960babc4b21f6e189dc70147b5fb4334815730f4d1cdec05489c19e0725c2158
- SSDEEP 24576:h+QQf6Ox6x5n1nZwReXe1Gmfh6k6T6W6r656+eGj/dBIp+:oAPeGLp
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4444 msedge.exe 4444 msedge.exe 1064 msedge.exe 1064 msedge.exe 4536 identity_helper.exe 4536 identity_helper.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1064 wrote to memory of 404 1064 msedge.exe 89 PID 1064 wrote to memory of 404 1064 msedge.exe 89 PID 1064 wrote to memory of 2012 1064 msedge.exe 90 PID 1064 wrote to memory of 2012 1064 msedge.exe 90 PID 1064 wrote to memory of 2012 1064 msedge.exe 90 PID 1064 wrote to memory of 2012 1064 msedge.exe 90 PID 1064 wrote to memory of 2012 1064 msedge.exe 90 PID 1064 wrote to memory of 2012 1064 msedge.exe 90 PID 1064 wrote to memory of 2012 1064 msedge.exe 90 PID 1064 wrote to memory of 2012 1064 msedge.exe 90 PID 1064 wrote to memory of 2012 1064 msedge.exe 90 PID 1064 wrote to memory of 2012 1064 msedge.exe 90 PID 1064 wrote to memory of 2012 1064 msedge.exe 90 PID 1064 wrote to memory of 2012 1064 msedge.exe 90 PID 1064 wrote to memory of 2012 1064 msedge.exe 90 PID 1064 wrote to memory of 2012 1064 msedge.exe 90 PID 1064 wrote to memory of 2012 1064 msedge.exe 90 PID 1064 wrote to memory of 2012 1064 msedge.exe 90 PID 1064 wrote to memory of 2012 1064 msedge.exe 90 PID 1064 wrote to memory of 2012 1064 msedge.exe 90 PID 1064 wrote to memory of 2012 1064 msedge.exe 90 PID 1064 wrote to memory of 2012 1064 msedge.exe 90 PID 1064 wrote to memory of 2012 1064 msedge.exe 90 PID 1064 wrote to memory of 2012 1064 msedge.exe 90 PID 1064 wrote to memory of 2012 1064 msedge.exe 90 PID 1064 wrote to memory of 2012 1064 msedge.exe 90 PID 1064 wrote to memory of 2012 1064 msedge.exe 90 PID 1064 wrote to memory of 2012 1064 msedge.exe 90 PID 1064 wrote to memory of 2012 1064 msedge.exe 90 PID 1064 wrote to memory of 2012 1064 msedge.exe 90 PID 1064 wrote to memory of 2012 1064 msedge.exe 90 PID 1064 wrote to memory of 2012 1064 msedge.exe 90 PID 1064 wrote to memory of 2012 1064 msedge.exe 90 PID 1064 wrote to memory of 2012 1064 msedge.exe 90 PID 1064 wrote to memory of 2012 1064 msedge.exe 90 PID 1064 wrote to memory of 2012 1064 msedge.exe 90 PID 1064 wrote to memory of 2012 1064 msedge.exe 90 PID 1064 wrote to memory of 2012 1064 msedge.exe 90 PID 1064 wrote to memory of 2012 1064 msedge.exe 90 PID 1064 wrote to memory of 2012 1064 msedge.exe 90 PID 1064 wrote to memory of 2012 1064 msedge.exe 90 PID 1064 wrote to memory of 2012 1064 msedge.exe 90 PID 1064 wrote to memory of 4444 1064 msedge.exe 91 PID 1064 wrote to memory of 4444 1064 msedge.exe 91 PID 1064 wrote to memory of 4528 1064 msedge.exe 92 PID 1064 wrote to memory of 4528 1064 msedge.exe 92 PID 1064 wrote to memory of 4528 1064 msedge.exe 92 PID 1064 wrote to memory of 4528 1064 msedge.exe 92 PID 1064 wrote to memory of 4528 1064 msedge.exe 92 PID 1064 wrote to memory of 4528 1064 msedge.exe 92 PID 1064 wrote to memory of 4528 1064 msedge.exe 92 PID 1064 wrote to memory of 4528 1064 msedge.exe 92 PID 1064 wrote to memory of 4528 1064 msedge.exe 92 PID 1064 wrote to memory of 4528 1064 msedge.exe 92 PID 1064 wrote to memory of 4528 1064 msedge.exe 92 PID 1064 wrote to memory of 4528 1064 msedge.exe 92 PID 1064 wrote to memory of 4528 1064 msedge.exe 92 PID 1064 wrote to memory of 4528 1064 msedge.exe 92 PID 1064 wrote to memory of 4528 1064 msedge.exe 92 PID 1064 wrote to memory of 4528 1064 msedge.exe 92 PID 1064 wrote to memory of 4528 1064 msedge.exe 92 PID 1064 wrote to memory of 4528 1064 msedge.exe 92 PID 1064 wrote to memory of 4528 1064 msedge.exe 92 PID 1064 wrote to memory of 4528 1064 msedge.exe 92
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbfd7246f8,0x7ffbfd724708,0x7ffbfd7247182⤵PID:404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,2182023892280315796,16465176427815103369,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:22⤵PID:2012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,2182023892280315796,16465176427815103369,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,2182023892280315796,16465176427815103369,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:82⤵PID:4528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2182023892280315796,16465176427815103369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:3604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2182023892280315796,16465176427815103369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:4760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,2182023892280315796,16465176427815103369,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:82⤵PID:4456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,2182023892280315796,16465176427815103369,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2182023892280315796,16465176427815103369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:12⤵PID:1160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2182023892280315796,16465176427815103369,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:12⤵PID:552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2182023892280315796,16465176427815103369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:12⤵PID:1020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2182023892280315796,16465176427815103369,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:12⤵PID:4296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,2182023892280315796,16465176427815103369,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2872
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3432
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1340
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea
- MD5 fab8d8d865e33fe195732aa7dcb91c30
- SHA1 2637e832f38acc70af3e511f5eba80fbd7461f2c
- SHA512 39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6
- MD5 36988ca14952e1848e81a959880ea217
- SHA1 a0482ef725657760502c2d1a5abe0bb37aebaadb
- SHA512 d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 6b344e67ed96e9cf02c4d9ee748353b9f083f1235ebafb7151224d12e18c3774
- MD5 951f5760a371a0d5220985121e496a92
- SHA1 31dcf108f9c47bca03960b97ff2102356ee65576
- SHA512 12ef3510d88265f74a2dba3b58eb05c8b49e643f698e3929d490b99b34579a59d0a4c929c0a2911470c260ca0400d2042e3c468ccedb9a8c0244806a8727a35e
- SSDEEP 96:nKkto1etiSwpvWMoiVmdeHBjsIUWQyV+VDCziEwb:nKk2otZGWMXB5ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 a7ae400238c861625dc7cd30af0604d74cb4e6b7d84f7f28df38848219bd9057
- MD5 62bb3e19ee42bb3c16c1b7d0d1943821
- SHA1 df692fdc3f100e7f7b1bcf602327fb4fc66edbf8
- SHA512 44cb8d55aa22a033d5c892a2b6f46093b5abb22a06d6b940e785e77ecbc5ef9558892c7b50b2de708b7a491505680ff77521390fb6492c4f19499b2203b9ae09
- SSDEEP 96:nKkto1etySwpvWMoiVmdeHBjsIUWQyV+VD7AiEwb:nKk2otpGWMXB5rg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 41d01ea28f625a74c3e2fa87562aab1869269eeba530f24b666d29c7d5ce3669
- MD5 6079a62c53044f3de240a381903d004b
- SHA1 334222f220826d74eff90c508463419b7cbd93a3
- SHA512 643119285f142ed235aeb6eca1e5e27050acd563d396399f95919becf882d6976e517251f0ea06ddd01c4e601c7496284cf50487f713cab7317254698fc28724
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupZe2RU4K/ch2HqRUx3GPOxm:A9iIxuERzA83h09RZxYNpKIpSFGmx8oe
- MD5 SHA1 SHA512 SSDEEP