Overview
overview
10Static
static
3SnSetup1.7.exe
windows7-x64
7SnSetup1.7.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3Data/regis...US.htm
windows7-x64
3Data/regis...US.htm
windows10-2004-x64
3Data/regis...CN.htm
windows7-x64
3Data/regis...CN.htm
windows10-2004-x64
3Data/regis...TW.htm
windows7-x64
3Data/regis...TW.htm
windows10-2004-x64
3SerialNull.exe
windows7-x64
10SerialNull.exe
windows10-2004-x64
10SnBus.sys
windows7-x64
1SnBus.sys
windows10-2004-x64
1SnSerial.sys
windows7-x64
1SnSerial.sys
windows10-2004-x64
1install.exe
windows7-x64
5install.exe
windows10-2004-x64
5ȿ˶.url
windows7-x64
1ȿ˶.url
windows10-2004-x64
1Analysis
- max time kernel
145s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
14/12/2024, 00:09
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
SnSetup1.7.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
SnSetup1.7.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20241010-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
Data/register-en-US.htm
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral6
Sample
Data/register-en-US.htm
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral7
Sample
Data/register-zh-CN.htm
Resource
win7-20241010-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral8
Sample
Data/register-zh-CN.htm
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral9
Sample
Data/register-zh-TW.htm
Resource
win7-20240729-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral10
Sample
Data/register-zh-TW.htm
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral11
Sample
SerialNull.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral12
Sample
SerialNull.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral13
Sample
SnBus.sys
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
SnBus.sys
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
SnSerial.sys
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
SnSerial.sys
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
install.exe
Resource
win7-20241010-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral18
Sample
install.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral19
Sample
ȿ˶.url
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
ȿ˶.url
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target Data/register-zh-TW.htm
- Size 12KB
- Sample241214-afpbdstmgr
- SHA256 abceb3e0851e769983f69dd7fc32e951fdbc1b07498649d6b8106691dedb7489
- MD5 74906a9d26f06dea02d4c2129c34b000
- SHA1 47eed5eccc4feb0bedb81f222a91914970395011
- SHA512 081d55b6cc5eaad96f874e46b249fc9ab8b4a33f3522a47f57d79e1b52c4a0824082f1f53c3c127e60a8988410ae1ad21dc94f280544ca6681701a9f1dcbf03f
- SSDEEP 384:4vE+YYg5qTuhQw+wSwoC2+FwkwZw6wsSxZTokYYDDTlgA:KbgkTuhQw+wSwot+FwkwZw6wsmZEkYY/
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4200 msedge.exe 4200 msedge.exe 2412 msedge.exe 2412 msedge.exe 1520 identity_helper.exe 1520 identity_helper.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2412 wrote to memory of 2456 2412 msedge.exe 82 PID 2412 wrote to memory of 2456 2412 msedge.exe 82 PID 2412 wrote to memory of 1856 2412 msedge.exe 83 PID 2412 wrote to memory of 1856 2412 msedge.exe 83 PID 2412 wrote to memory of 1856 2412 msedge.exe 83 PID 2412 wrote to memory of 1856 2412 msedge.exe 83 PID 2412 wrote to memory of 1856 2412 msedge.exe 83 PID 2412 wrote to memory of 1856 2412 msedge.exe 83 PID 2412 wrote to memory of 1856 2412 msedge.exe 83 PID 2412 wrote to memory of 1856 2412 msedge.exe 83 PID 2412 wrote to memory of 1856 2412 msedge.exe 83 PID 2412 wrote to memory of 1856 2412 msedge.exe 83 PID 2412 wrote to memory of 1856 2412 msedge.exe 83 PID 2412 wrote to memory of 1856 2412 msedge.exe 83 PID 2412 wrote to memory of 1856 2412 msedge.exe 83 PID 2412 wrote to memory of 1856 2412 msedge.exe 83 PID 2412 wrote to memory of 1856 2412 msedge.exe 83 PID 2412 wrote to memory of 1856 2412 msedge.exe 83 PID 2412 wrote to memory of 1856 2412 msedge.exe 83 PID 2412 wrote to memory of 1856 2412 msedge.exe 83 PID 2412 wrote to memory of 1856 2412 msedge.exe 83 PID 2412 wrote to memory of 1856 2412 msedge.exe 83 PID 2412 wrote to memory of 1856 2412 msedge.exe 83 PID 2412 wrote to memory of 1856 2412 msedge.exe 83 PID 2412 wrote to memory of 1856 2412 msedge.exe 83 PID 2412 wrote to memory of 1856 2412 msedge.exe 83 PID 2412 wrote to memory of 1856 2412 msedge.exe 83 PID 2412 wrote to memory of 1856 2412 msedge.exe 83 PID 2412 wrote to memory of 1856 2412 msedge.exe 83 PID 2412 wrote to memory of 1856 2412 msedge.exe 83 PID 2412 wrote to memory of 1856 2412 msedge.exe 83 PID 2412 wrote to memory of 1856 2412 msedge.exe 83 PID 2412 wrote to memory of 1856 2412 msedge.exe 83 PID 2412 wrote to memory of 1856 2412 msedge.exe 83 PID 2412 wrote to memory of 1856 2412 msedge.exe 83 PID 2412 wrote to memory of 1856 2412 msedge.exe 83 PID 2412 wrote to memory of 1856 2412 msedge.exe 83 PID 2412 wrote to memory of 1856 2412 msedge.exe 83 PID 2412 wrote to memory of 1856 2412 msedge.exe 83 PID 2412 wrote to memory of 1856 2412 msedge.exe 83 PID 2412 wrote to memory of 1856 2412 msedge.exe 83 PID 2412 wrote to memory of 1856 2412 msedge.exe 83 PID 2412 wrote to memory of 4200 2412 msedge.exe 84 PID 2412 wrote to memory of 4200 2412 msedge.exe 84 PID 2412 wrote to memory of 3404 2412 msedge.exe 85 PID 2412 wrote to memory of 3404 2412 msedge.exe 85 PID 2412 wrote to memory of 3404 2412 msedge.exe 85 PID 2412 wrote to memory of 3404 2412 msedge.exe 85 PID 2412 wrote to memory of 3404 2412 msedge.exe 85 PID 2412 wrote to memory of 3404 2412 msedge.exe 85 PID 2412 wrote to memory of 3404 2412 msedge.exe 85 PID 2412 wrote to memory of 3404 2412 msedge.exe 85 PID 2412 wrote to memory of 3404 2412 msedge.exe 85 PID 2412 wrote to memory of 3404 2412 msedge.exe 85 PID 2412 wrote to memory of 3404 2412 msedge.exe 85 PID 2412 wrote to memory of 3404 2412 msedge.exe 85 PID 2412 wrote to memory of 3404 2412 msedge.exe 85 PID 2412 wrote to memory of 3404 2412 msedge.exe 85 PID 2412 wrote to memory of 3404 2412 msedge.exe 85 PID 2412 wrote to memory of 3404 2412 msedge.exe 85 PID 2412 wrote to memory of 3404 2412 msedge.exe 85 PID 2412 wrote to memory of 3404 2412 msedge.exe 85 PID 2412 wrote to memory of 3404 2412 msedge.exe 85 PID 2412 wrote to memory of 3404 2412 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\Data\register-zh-TW.htm1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdc45246f8,0x7ffdc4524708,0x7ffdc45247182⤵PID:2456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,5521649260938505300,2633040143306203574,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:22⤵PID:1856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,5521649260938505300,2633040143306203574,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,5521649260938505300,2633040143306203574,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:82⤵PID:3404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5521649260938505300,2633040143306203574,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:2208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5521649260938505300,2633040143306203574,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,5521649260938505300,2633040143306203574,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 /prefetch:82⤵PID:2160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,5521649260938505300,2633040143306203574,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5521649260938505300,2633040143306203574,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:12⤵PID:3964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5521649260938505300,2633040143306203574,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:12⤵PID:1568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5521649260938505300,2633040143306203574,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:12⤵PID:1844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5521649260938505300,2633040143306203574,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:12⤵PID:5000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,5521649260938505300,2633040143306203574,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2748 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4760
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5108
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2836
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea
- MD5 fab8d8d865e33fe195732aa7dcb91c30
- SHA1 2637e832f38acc70af3e511f5eba80fbd7461f2c
- SHA512 39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6
- MD5 36988ca14952e1848e81a959880ea217
- SHA1 a0482ef725657760502c2d1a5abe0bb37aebaadb
- SHA512 d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 1c8d3c00ac7ec67d70c592ed750b126f50bb572c92a6ad18d94d562f486eeeb8
- MD5 c413a71f70c2a336f48e3a1c449d2d72
- SHA1 266a61abd4597759427cee7587818b8700fe8676
- SHA512 efb5be1de486ff20ec98edce3ccfc83604596886f4dae0b9753b4ce534ecf6d059b40322c67c2cdd6c0e1fb843b44cc23891dddceba4d5ea470a4cbcb7484365
- SSDEEP 96:nhy2k7xE1NlSwpvWMoiVmdeHBjsSA8UWQyV+VD7AiEwb:nh9kFEbAGWMXB9A8rg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 191d50de73555b79aa8536d587988ee2bcbf424498ad207b50d1f592b72ebe25
- MD5 8f91f6902c64fdd49cc928278d304621
- SHA1 595dc413b52bc91722fb3e42733a3eec0422b837
- SHA512 87b5b56bc06bd5d1b7e16a71ce5349c660cf0de38f9e014c222236df7e4ccf141620d9c4dd5974f2459dcdc87bbe049a9399820e7ad5b381c6d7b4296e4dd5c8
- SSDEEP 96:nhy2k7xE1NiSwpvWMoiVmdeHBjsSA8UWQyV+VDCziEwb:nh9kFEbZGWMXB9A8ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 98e944d5f6acb9e255e38d101b70179d5a3041af5cbbbc505fef878aadca8eeb
- MD5 e8dfb4bc947712b18e7b7314bff64460
- SHA1 c745628eb1fa39483efec74dae4fbcdc674e930f
- SHA512 4e3132469f630c3740b60f36e67078fd1f18e8784fee5b9c5f1cf47899a097fffd3c361ae1d7180ed11c8faca35636070dfed4525218c7ba02408bb0cfbce9ab
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup1yxHKe2RUXCjchOOYdF98/:A9iIxuERzA83h09RZxY1wEwCkOOYi0Yd
- MD5 SHA1 SHA512 SSDEEP