Overview
overview
8Static
static
3Wave-Setup.exe
windows7-x64
7Wave-Setup.exe
windows10-2004-x64
8$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3LICENSES.c...m.html
windows7-x64
3LICENSES.c...m.html
windows10-2004-x64
3resources/...mon.js
ubuntu-18.04-amd64
3resources/...mon.js
debian-9-armhf
4resources/...mon.js
debian-9-mips
3resources/...mon.js
debian-9-mipsel
3resources/...ll.exe
windows7-x64
1resources/...ll.exe
windows10-2004-x64
1resources/...dex.js
windows7-x64
3resources/...dex.js
windows10-2004-x64
3resources/...rse.js
windows7-x64
3resources/...rse.js
windows10-2004-x64
3resources/...and.js
windows7-x64
3resources/...and.js
windows10-2004-x64
3resources/...lts.js
windows7-x64
3resources/...lts.js
windows10-2004-x64
3resources/...xec.js
windows7-x64
3resources/...xec.js
windows10-2004-x64
3resources/...dex.js
windows7-x64
3resources/...dex.js
windows10-2004-x64
3resources/...oad.js
windows7-x64
3resources/...oad.js
windows10-2004-x64
3Analysis
- max time kernel
145s - max time network
161s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
12/11/2024, 07:29
Static task
static1
Behavioral task
behavioral1
Sample
Wave-Setup.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral2
Sample
Wave-Setup.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/WinShell.dll
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
LICENSES.chromium.html
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral12
Sample
LICENSES.chromium.html
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
resources/app.asar.unpacked/node_modules/nodemon/bin/nodemon.js
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
Behavioral task
behavioral14
Sample
resources/app.asar.unpacked/node_modules/nodemon/bin/nodemon.js
Resource
debian9-armhf-20240611-en
debian-9-armhf
Behavioral task
behavioral15
Sample
resources/app.asar.unpacked/node_modules/nodemon/bin/nodemon.js
Resource
debian9-mipsbe-20240418-en
debian-9-mips
Behavioral task
behavioral16
Sample
resources/app.asar.unpacked/node_modules/nodemon/bin/nodemon.js
Resource
debian9-mipsel-20240729-en
debian-9-mipsel
Behavioral task
behavioral17
Sample
resources/app.asar.unpacked/node_modules/nodemon/bin/windows-kill.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
resources/app.asar.unpacked/node_modules/nodemon/bin/windows-kill.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/cli/index.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/cli/index.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/cli/parse.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral22
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/cli/parse.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/command.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral24
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/command.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/defaults.js
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral26
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/defaults.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/exec.js
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral28
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/exec.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/index.js
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral30
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/index.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/load.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral32
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/load.js
Resource
win10v2004-20241007-en
windows10-2004-x64
General
- Target LICENSES.chromium.html
- Size 9.0MB
- Sample241112-jbbdea1kdk
- SHA256 c6737ef4ed9de369077718824f76c5e7026d0e39163e26af8606783e41c93e18
- MD5 ae174699b663bd90d8d06c68c6952477
- SHA1 8c76eda61d320779909adc541593b8e26b24815a
- SHA512 3fb72dcd790464dde34978c9d0895376827f4d839b4a199c6e9fe77ab810d62b960babc4b21f6e189dc70147b5fb4334815730f4d1cdec05489c19e0725c2158
- SSDEEP 24576:h+QQf6Ox6x5n1nZwReXe1Gmfh6k6T6W6r656+eGj/dBIp+:oAPeGLp
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4984 msedge.exe 4984 msedge.exe 2120 msedge.exe 2120 msedge.exe 3864 identity_helper.exe 3864 identity_helper.exe 2764 msedge.exe 2764 msedge.exe 2764 msedge.exe 2764 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2120 wrote to memory of 4876 2120 msedge.exe 87 PID 2120 wrote to memory of 4876 2120 msedge.exe 87 PID 2120 wrote to memory of 840 2120 msedge.exe 88 PID 2120 wrote to memory of 840 2120 msedge.exe 88 PID 2120 wrote to memory of 840 2120 msedge.exe 88 PID 2120 wrote to memory of 840 2120 msedge.exe 88 PID 2120 wrote to memory of 840 2120 msedge.exe 88 PID 2120 wrote to memory of 840 2120 msedge.exe 88 PID 2120 wrote to memory of 840 2120 msedge.exe 88 PID 2120 wrote to memory of 840 2120 msedge.exe 88 PID 2120 wrote to memory of 840 2120 msedge.exe 88 PID 2120 wrote to memory of 840 2120 msedge.exe 88 PID 2120 wrote to memory of 840 2120 msedge.exe 88 PID 2120 wrote to memory of 840 2120 msedge.exe 88 PID 2120 wrote to memory of 840 2120 msedge.exe 88 PID 2120 wrote to memory of 840 2120 msedge.exe 88 PID 2120 wrote to memory of 840 2120 msedge.exe 88 PID 2120 wrote to memory of 840 2120 msedge.exe 88 PID 2120 wrote to memory of 840 2120 msedge.exe 88 PID 2120 wrote to memory of 840 2120 msedge.exe 88 PID 2120 wrote to memory of 840 2120 msedge.exe 88 PID 2120 wrote to memory of 840 2120 msedge.exe 88 PID 2120 wrote to memory of 840 2120 msedge.exe 88 PID 2120 wrote to memory of 840 2120 msedge.exe 88 PID 2120 wrote to memory of 840 2120 msedge.exe 88 PID 2120 wrote to memory of 840 2120 msedge.exe 88 PID 2120 wrote to memory of 840 2120 msedge.exe 88 PID 2120 wrote to memory of 840 2120 msedge.exe 88 PID 2120 wrote to memory of 840 2120 msedge.exe 88 PID 2120 wrote to memory of 840 2120 msedge.exe 88 PID 2120 wrote to memory of 840 2120 msedge.exe 88 PID 2120 wrote to memory of 840 2120 msedge.exe 88 PID 2120 wrote to memory of 840 2120 msedge.exe 88 PID 2120 wrote to memory of 840 2120 msedge.exe 88 PID 2120 wrote to memory of 840 2120 msedge.exe 88 PID 2120 wrote to memory of 840 2120 msedge.exe 88 PID 2120 wrote to memory of 840 2120 msedge.exe 88 PID 2120 wrote to memory of 840 2120 msedge.exe 88 PID 2120 wrote to memory of 840 2120 msedge.exe 88 PID 2120 wrote to memory of 840 2120 msedge.exe 88 PID 2120 wrote to memory of 840 2120 msedge.exe 88 PID 2120 wrote to memory of 840 2120 msedge.exe 88 PID 2120 wrote to memory of 4984 2120 msedge.exe 89 PID 2120 wrote to memory of 4984 2120 msedge.exe 89 PID 2120 wrote to memory of 1236 2120 msedge.exe 90 PID 2120 wrote to memory of 1236 2120 msedge.exe 90 PID 2120 wrote to memory of 1236 2120 msedge.exe 90 PID 2120 wrote to memory of 1236 2120 msedge.exe 90 PID 2120 wrote to memory of 1236 2120 msedge.exe 90 PID 2120 wrote to memory of 1236 2120 msedge.exe 90 PID 2120 wrote to memory of 1236 2120 msedge.exe 90 PID 2120 wrote to memory of 1236 2120 msedge.exe 90 PID 2120 wrote to memory of 1236 2120 msedge.exe 90 PID 2120 wrote to memory of 1236 2120 msedge.exe 90 PID 2120 wrote to memory of 1236 2120 msedge.exe 90 PID 2120 wrote to memory of 1236 2120 msedge.exe 90 PID 2120 wrote to memory of 1236 2120 msedge.exe 90 PID 2120 wrote to memory of 1236 2120 msedge.exe 90 PID 2120 wrote to memory of 1236 2120 msedge.exe 90 PID 2120 wrote to memory of 1236 2120 msedge.exe 90 PID 2120 wrote to memory of 1236 2120 msedge.exe 90 PID 2120 wrote to memory of 1236 2120 msedge.exe 90 PID 2120 wrote to memory of 1236 2120 msedge.exe 90 PID 2120 wrote to memory of 1236 2120 msedge.exe 90
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb2a2046f8,0x7ffb2a204708,0x7ffb2a2047182⤵PID:4876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,8453286544163481218,10537961369389182790,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1992 /prefetch:22⤵PID:840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1980,8453286544163481218,10537961369389182790,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1980,8453286544163481218,10537961369389182790,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:82⤵PID:1236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,8453286544163481218,10537961369389182790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:2196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,8453286544163481218,10537961369389182790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:3028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,8453286544163481218,10537961369389182790,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:82⤵PID:4572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,8453286544163481218,10537961369389182790,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,8453286544163481218,10537961369389182790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:12⤵PID:3952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,8453286544163481218,10537961369389182790,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:12⤵PID:1272
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,8453286544163481218,10537961369389182790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:12⤵PID:3456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,8453286544163481218,10537961369389182790,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:12⤵PID:1776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,8453286544163481218,10537961369389182790,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2808 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2764
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1336
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4552
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb
- MD5 56a4f78e21616a6e19da57228569489b
- SHA1 21bfabbfc294d5f2aa1da825c5590d760483bc76
- SHA512 c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b
- MD5 e443ee4336fcf13c698b8ab5f3c173d0
- SHA1 9bf70b16f03820cbe3158e1f1396b07b8ac9d75a
- SHA512 cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 5d67f7682d8ff2e800b67810f26df0c29a17bb8d21a9d87540e6626b283f2fe9
- MD5 4e32eace124d40bbd57dcce2e1c9beab
- SHA1 c7235332feefe25d4ab49e846a76ddae68295f61
- SHA512 9fb04a6a201fea51cd5e7b481469dfe73105bac3775eae8cf513714bf52e6079f2b8c2362acc8f0f072f949fdf06e9f75d75d22fbfa9789ea4924a1991b75def
- SSDEEP 96:ntkAX1yM/wpvWMoiVmdeHPApLUWQyV+VDCziEwb:ntkOh/GWMXcro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 4daedc713222a9a81ec3553e849760498598728ce79d55da19af4dd985b65ebf
- MD5 c8d8dd94ce12221daf9c3f4f4745806d
- SHA1 cc9f9b0c4940b56646a5440315d1dc562a93cdc8
- SHA512 9bbc9ca2407ddf18a5e6201de726bb979a81f6b9a38d7d5cb1dfcf00bcd96ad209857c4ee28396dc95804784c1c77e1b0efec93d0ca9f3137b53bf5888ee5df4
- SSDEEP 96:ntkyX1yMnwpvWMoiVmdeHPApLUWQyV+VD7AiEwb:ntk0hnGWMXcrg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 658adcf589575606288d369dac7428811225d3f247e1ecd60ee52b7d560137f8
- MD5 9149616dfe634990cf7c863f5d96a3ae
- SHA1 7ebcc2a8a8635b31f3bcb225b5787b853a6e3de9
- SHA512 4a11aaf68152b417022fb2dc39352e09170fe777f21dc2ec0f0371605b6128cf769890f9f2d719f1fee2dc04481c5cb3f3ab0603a28e3a559bb70a10204f1d8e
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup1AiCVe2RU98m0HHqRUx3Gm:A9iIxuERzA83h09RZxYOzy0qSFGmx8oH
- MD5 SHA1 SHA512 SSDEEP