Overview
overview
7Static
static
3Wave-Setup.exe
windows7-x64
7Wave-Setup.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3LICENSES.c...m.html
windows7-x64
3LICENSES.c...m.html
windows10-2004-x64
3resources/...mon.js
ubuntu-18.04-amd64
3resources/...mon.js
debian-9-armhf
4resources/...mon.js
debian-9-mips
3resources/...mon.js
debian-9-mipsel
3resources/...ll.exe
windows7-x64
1resources/...ll.exe
windows10-2004-x64
1resources/...dex.js
windows7-x64
3resources/...dex.js
windows10-2004-x64
3resources/...rse.js
windows7-x64
3resources/...rse.js
windows10-2004-x64
3resources/...and.js
windows7-x64
3resources/...and.js
windows10-2004-x64
3resources/...lts.js
windows7-x64
3resources/...lts.js
windows10-2004-x64
3resources/...xec.js
windows7-x64
3resources/...xec.js
windows10-2004-x64
3resources/...dex.js
windows7-x64
3resources/...dex.js
windows10-2004-x64
3resources/...oad.js
windows7-x64
3resources/...oad.js
windows10-2004-x64
3Analysis
- max time kernel
147s - max time network
163s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
20/11/2024, 14:27
Static task
static1
Behavioral task
behavioral1
Sample
Wave-Setup.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral2
Sample
Wave-Setup.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/WinShell.dll
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
LICENSES.chromium.html
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral12
Sample
LICENSES.chromium.html
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
resources/app.asar.unpacked/node_modules/nodemon/bin/nodemon.js
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
Behavioral task
behavioral14
Sample
resources/app.asar.unpacked/node_modules/nodemon/bin/nodemon.js
Resource
debian9-armhf-20240729-en
debian-9-armhf
Behavioral task
behavioral15
Sample
resources/app.asar.unpacked/node_modules/nodemon/bin/nodemon.js
Resource
debian9-mipsbe-20240418-en
debian-9-mips
Behavioral task
behavioral16
Sample
resources/app.asar.unpacked/node_modules/nodemon/bin/nodemon.js
Resource
debian9-mipsel-20240611-en
debian-9-mipsel
Behavioral task
behavioral17
Sample
resources/app.asar.unpacked/node_modules/nodemon/bin/windows-kill.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral18
Sample
resources/app.asar.unpacked/node_modules/nodemon/bin/windows-kill.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/cli/index.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/cli/index.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/cli/parse.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral22
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/cli/parse.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/command.js
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral24
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/command.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/defaults.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral26
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/defaults.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/exec.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral28
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/exec.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/index.js
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral30
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/index.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/load.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral32
Sample
resources/app.asar.unpacked/node_modules/nodemon/lib/config/load.js
Resource
win10v2004-20241007-en
windows10-2004-x64
General
- Target LICENSES.chromium.html
- Size 9.0MB
- Sample241120-rsplcssngp
- SHA256 c6737ef4ed9de369077718824f76c5e7026d0e39163e26af8606783e41c93e18
- MD5 ae174699b663bd90d8d06c68c6952477
- SHA1 8c76eda61d320779909adc541593b8e26b24815a
- SHA512 3fb72dcd790464dde34978c9d0895376827f4d839b4a199c6e9fe77ab810d62b960babc4b21f6e189dc70147b5fb4334815730f4d1cdec05489c19e0725c2158
- SSDEEP 24576:h+QQf6Ox6x5n1nZwReXe1Gmfh6k6T6W6r656+eGj/dBIp+:oAPeGLp
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4988 msedge.exe 4988 msedge.exe 2960 msedge.exe 2960 msedge.exe 3144 identity_helper.exe 3144 identity_helper.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe 2960 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2960 wrote to memory of 4876 2960 msedge.exe 83 PID 2960 wrote to memory of 4876 2960 msedge.exe 83 PID 2960 wrote to memory of 220 2960 msedge.exe 84 PID 2960 wrote to memory of 220 2960 msedge.exe 84 PID 2960 wrote to memory of 220 2960 msedge.exe 84 PID 2960 wrote to memory of 220 2960 msedge.exe 84 PID 2960 wrote to memory of 220 2960 msedge.exe 84 PID 2960 wrote to memory of 220 2960 msedge.exe 84 PID 2960 wrote to memory of 220 2960 msedge.exe 84 PID 2960 wrote to memory of 220 2960 msedge.exe 84 PID 2960 wrote to memory of 220 2960 msedge.exe 84 PID 2960 wrote to memory of 220 2960 msedge.exe 84 PID 2960 wrote to memory of 220 2960 msedge.exe 84 PID 2960 wrote to memory of 220 2960 msedge.exe 84 PID 2960 wrote to memory of 220 2960 msedge.exe 84 PID 2960 wrote to memory of 220 2960 msedge.exe 84 PID 2960 wrote to memory of 220 2960 msedge.exe 84 PID 2960 wrote to memory of 220 2960 msedge.exe 84 PID 2960 wrote to memory of 220 2960 msedge.exe 84 PID 2960 wrote to memory of 220 2960 msedge.exe 84 PID 2960 wrote to memory of 220 2960 msedge.exe 84 PID 2960 wrote to memory of 220 2960 msedge.exe 84 PID 2960 wrote to memory of 220 2960 msedge.exe 84 PID 2960 wrote to memory of 220 2960 msedge.exe 84 PID 2960 wrote to memory of 220 2960 msedge.exe 84 PID 2960 wrote to memory of 220 2960 msedge.exe 84 PID 2960 wrote to memory of 220 2960 msedge.exe 84 PID 2960 wrote to memory of 220 2960 msedge.exe 84 PID 2960 wrote to memory of 220 2960 msedge.exe 84 PID 2960 wrote to memory of 220 2960 msedge.exe 84 PID 2960 wrote to memory of 220 2960 msedge.exe 84 PID 2960 wrote to memory of 220 2960 msedge.exe 84 PID 2960 wrote to memory of 220 2960 msedge.exe 84 PID 2960 wrote to memory of 220 2960 msedge.exe 84 PID 2960 wrote to memory of 220 2960 msedge.exe 84 PID 2960 wrote to memory of 220 2960 msedge.exe 84 PID 2960 wrote to memory of 220 2960 msedge.exe 84 PID 2960 wrote to memory of 220 2960 msedge.exe 84 PID 2960 wrote to memory of 220 2960 msedge.exe 84 PID 2960 wrote to memory of 220 2960 msedge.exe 84 PID 2960 wrote to memory of 220 2960 msedge.exe 84 PID 2960 wrote to memory of 220 2960 msedge.exe 84 PID 2960 wrote to memory of 4988 2960 msedge.exe 85 PID 2960 wrote to memory of 4988 2960 msedge.exe 85 PID 2960 wrote to memory of 4152 2960 msedge.exe 86 PID 2960 wrote to memory of 4152 2960 msedge.exe 86 PID 2960 wrote to memory of 4152 2960 msedge.exe 86 PID 2960 wrote to memory of 4152 2960 msedge.exe 86 PID 2960 wrote to memory of 4152 2960 msedge.exe 86 PID 2960 wrote to memory of 4152 2960 msedge.exe 86 PID 2960 wrote to memory of 4152 2960 msedge.exe 86 PID 2960 wrote to memory of 4152 2960 msedge.exe 86 PID 2960 wrote to memory of 4152 2960 msedge.exe 86 PID 2960 wrote to memory of 4152 2960 msedge.exe 86 PID 2960 wrote to memory of 4152 2960 msedge.exe 86 PID 2960 wrote to memory of 4152 2960 msedge.exe 86 PID 2960 wrote to memory of 4152 2960 msedge.exe 86 PID 2960 wrote to memory of 4152 2960 msedge.exe 86 PID 2960 wrote to memory of 4152 2960 msedge.exe 86 PID 2960 wrote to memory of 4152 2960 msedge.exe 86 PID 2960 wrote to memory of 4152 2960 msedge.exe 86 PID 2960 wrote to memory of 4152 2960 msedge.exe 86 PID 2960 wrote to memory of 4152 2960 msedge.exe 86 PID 2960 wrote to memory of 4152 2960 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff0db746f8,0x7fff0db74708,0x7fff0db747182⤵PID:4876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,12615066571460452846,8390262886017385711,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:22⤵PID:220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,12615066571460452846,8390262886017385711,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,12615066571460452846,8390262886017385711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:82⤵PID:4152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,12615066571460452846,8390262886017385711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:3128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,12615066571460452846,8390262886017385711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:2324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,12615066571460452846,8390262886017385711,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:82⤵PID:3956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,12615066571460452846,8390262886017385711,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,12615066571460452846,8390262886017385711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:12⤵PID:4632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,12615066571460452846,8390262886017385711,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:12⤵PID:524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,12615066571460452846,8390262886017385711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:12⤵PID:3556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,12615066571460452846,8390262886017385711,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:12⤵PID:2436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,12615066571460452846,8390262886017385711,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4188 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1120
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4720
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:60
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304
- MD5 8749e21d9d0a17dac32d5aa2027f7a75
- SHA1 a5d555f8b035c7938a4a864e89218c0402ab7cde
- SHA512 c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33
- MD5 34d2c4f40f47672ecdf6f66fea242f4a
- SHA1 4bcad62542aeb44cae38a907d8b5a8604115ada2
- SHA512 50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 bfac9f2eeae92009a57a656b9f393eabd9d65164c3c3db27271b3ccc2f9cf57e
- MD5 4d8bd52e2d4148cba9fdedf6909b3cbb
- SHA1 2f83fa202d1812ee0f1716a41973118d418044bc
- SHA512 8f4379e92ce5fe7a9ac34bb9adaa514b4b8852c2a34870f8f829ee275b9a876b9981fd9a45f17b54ae9e2b8ade044141bed02c94dbcf6b72d2b8f5581501689e
- SSDEEP 96:n+kds1F0TwpvWMoiVmdeHhOMwUWQyV+VDCziEwb:n+kGgTGWMXcpro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 87726d85da1a6a66402eac589c847fdd6d5b00eb55a63fe23ef41fb45e5aa8e8
- MD5 245eb786f665fb97be10a8e0788b7f7c
- SHA1 588539ecf76cf789b7179925760a53fa70c45e52
- SHA512 7b8ce1c02c94863fff9b0dc301e1a133f911370d3b18ce706bc3a1e7aa672c108e0dd032d666eced595d22c9b80737ae2e21c54923e2a10d279f94b8e4937463
- SSDEEP 96:n+k4s1F07wpvWMoiVmdeHhOMwUWQyV+VD7AiEwb:n+klg7GWMXcprg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 90d0f95d35b033321eae081b0734bf82999b15ec64669ec56751aed440e2e1c2
- MD5 cc6b9f42c1eee98e4ac4d652c8510105
- SHA1 7691a45b126ddf4ce89a04bd8becba71c2cb0cf7
- SHA512 40d36b4935a071a99f701ac71f16a56d9f5c098918bb01b55a41f0acbc310c4562dc3e2550e2d45163022fc8644483d321f689007564ccc376cd06c76eaf1a7c
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupgn8Pe2RUhIsmYdF980JQwD:A9iIxuERzA83h09RZxYYI+mYi0Yzu
- MD5 SHA1 SHA512 SSDEEP