Overview
overview
10Static
static
3SnSetup1.7.exe
windows7-x64
7SnSetup1.7.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3Data/regis...US.htm
windows7-x64
3Data/regis...US.htm
windows10-2004-x64
3Data/regis...CN.htm
windows7-x64
3Data/regis...CN.htm
windows10-2004-x64
3Data/regis...TW.htm
windows7-x64
3Data/regis...TW.htm
windows10-2004-x64
3SerialNull.exe
windows7-x64
10SerialNull.exe
windows10-2004-x64
10SnBus.sys
windows7-x64
1SnBus.sys
windows10-2004-x64
1SnSerial.sys
windows7-x64
1SnSerial.sys
windows10-2004-x64
1install.exe
windows7-x64
5install.exe
windows10-2004-x64
5ȿ˶.url
windows7-x64
1ȿ˶.url
windows10-2004-x64
1Analysis
- max time kernel
145s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
14/12/2024, 00:09
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
SnSetup1.7.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
SnSetup1.7.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20241010-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
Data/register-en-US.htm
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral6
Sample
Data/register-en-US.htm
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral7
Sample
Data/register-zh-CN.htm
Resource
win7-20241010-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral8
Sample
Data/register-zh-CN.htm
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral9
Sample
Data/register-zh-TW.htm
Resource
win7-20240729-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral10
Sample
Data/register-zh-TW.htm
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral11
Sample
SerialNull.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral12
Sample
SerialNull.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral13
Sample
SnBus.sys
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
SnBus.sys
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
SnSerial.sys
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
SnSerial.sys
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
install.exe
Resource
win7-20241010-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral18
Sample
install.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral19
Sample
ȿ˶.url
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
ȿ˶.url
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target Data/register-zh-CN.htm
- Size 11KB
- Sample241214-afpbdstmgr
- SHA256 f7efbed02bea5432387cf8dcc6f1a59eca4b91c26db36d50ced0e070e31b88ac
- MD5 d635ec9c62de6f0d8d72ce36fe08b7bb
- SHA1 30b814eaf61ffe8b8309456adbea947eb046b22d
- SHA512 244d1033a8091d9a9fbc6a3407c534ce7e586e67cc56273efd618422646238e3a4473e4663d0828ca8907c8952421b7a2902afb88aff1e574c927b2cbce8ffc3
- SSDEEP 192:9F/w/oEKPj0VlSk8vVPzYYj1qnPsTTniQiTHVlJ+TlB:XrjNPz5aPsTTn8VlJ+TlB
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3044 msedge.exe 3044 msedge.exe 632 msedge.exe 632 msedge.exe 2052 identity_helper.exe 2052 identity_helper.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 632 wrote to memory of 2332 632 msedge.exe 82 PID 632 wrote to memory of 2332 632 msedge.exe 82 PID 632 wrote to memory of 3788 632 msedge.exe 83 PID 632 wrote to memory of 3788 632 msedge.exe 83 PID 632 wrote to memory of 3788 632 msedge.exe 83 PID 632 wrote to memory of 3788 632 msedge.exe 83 PID 632 wrote to memory of 3788 632 msedge.exe 83 PID 632 wrote to memory of 3788 632 msedge.exe 83 PID 632 wrote to memory of 3788 632 msedge.exe 83 PID 632 wrote to memory of 3788 632 msedge.exe 83 PID 632 wrote to memory of 3788 632 msedge.exe 83 PID 632 wrote to memory of 3788 632 msedge.exe 83 PID 632 wrote to memory of 3788 632 msedge.exe 83 PID 632 wrote to memory of 3788 632 msedge.exe 83 PID 632 wrote to memory of 3788 632 msedge.exe 83 PID 632 wrote to memory of 3788 632 msedge.exe 83 PID 632 wrote to memory of 3788 632 msedge.exe 83 PID 632 wrote to memory of 3788 632 msedge.exe 83 PID 632 wrote to memory of 3788 632 msedge.exe 83 PID 632 wrote to memory of 3788 632 msedge.exe 83 PID 632 wrote to memory of 3788 632 msedge.exe 83 PID 632 wrote to memory of 3788 632 msedge.exe 83 PID 632 wrote to memory of 3788 632 msedge.exe 83 PID 632 wrote to memory of 3788 632 msedge.exe 83 PID 632 wrote to memory of 3788 632 msedge.exe 83 PID 632 wrote to memory of 3788 632 msedge.exe 83 PID 632 wrote to memory of 3788 632 msedge.exe 83 PID 632 wrote to memory of 3788 632 msedge.exe 83 PID 632 wrote to memory of 3788 632 msedge.exe 83 PID 632 wrote to memory of 3788 632 msedge.exe 83 PID 632 wrote to memory of 3788 632 msedge.exe 83 PID 632 wrote to memory of 3788 632 msedge.exe 83 PID 632 wrote to memory of 3788 632 msedge.exe 83 PID 632 wrote to memory of 3788 632 msedge.exe 83 PID 632 wrote to memory of 3788 632 msedge.exe 83 PID 632 wrote to memory of 3788 632 msedge.exe 83 PID 632 wrote to memory of 3788 632 msedge.exe 83 PID 632 wrote to memory of 3788 632 msedge.exe 83 PID 632 wrote to memory of 3788 632 msedge.exe 83 PID 632 wrote to memory of 3788 632 msedge.exe 83 PID 632 wrote to memory of 3788 632 msedge.exe 83 PID 632 wrote to memory of 3788 632 msedge.exe 83 PID 632 wrote to memory of 3044 632 msedge.exe 84 PID 632 wrote to memory of 3044 632 msedge.exe 84 PID 632 wrote to memory of 2396 632 msedge.exe 85 PID 632 wrote to memory of 2396 632 msedge.exe 85 PID 632 wrote to memory of 2396 632 msedge.exe 85 PID 632 wrote to memory of 2396 632 msedge.exe 85 PID 632 wrote to memory of 2396 632 msedge.exe 85 PID 632 wrote to memory of 2396 632 msedge.exe 85 PID 632 wrote to memory of 2396 632 msedge.exe 85 PID 632 wrote to memory of 2396 632 msedge.exe 85 PID 632 wrote to memory of 2396 632 msedge.exe 85 PID 632 wrote to memory of 2396 632 msedge.exe 85 PID 632 wrote to memory of 2396 632 msedge.exe 85 PID 632 wrote to memory of 2396 632 msedge.exe 85 PID 632 wrote to memory of 2396 632 msedge.exe 85 PID 632 wrote to memory of 2396 632 msedge.exe 85 PID 632 wrote to memory of 2396 632 msedge.exe 85 PID 632 wrote to memory of 2396 632 msedge.exe 85 PID 632 wrote to memory of 2396 632 msedge.exe 85 PID 632 wrote to memory of 2396 632 msedge.exe 85 PID 632 wrote to memory of 2396 632 msedge.exe 85 PID 632 wrote to memory of 2396 632 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\Data\register-zh-CN.htm1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff874cb46f8,0x7ff874cb4708,0x7ff874cb47182⤵PID:2332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,15770840008365187700,3564024329619581205,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:22⤵PID:3788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,15770840008365187700,3564024329619581205,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,15770840008365187700,3564024329619581205,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:82⤵PID:2396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15770840008365187700,3564024329619581205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15770840008365187700,3564024329619581205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:2020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,15770840008365187700,3564024329619581205,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 /prefetch:82⤵PID:4644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,15770840008365187700,3564024329619581205,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15770840008365187700,3564024329619581205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:12⤵PID:1648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15770840008365187700,3564024329619581205,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:12⤵PID:1756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15770840008365187700,3564024329619581205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:12⤵PID:1596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15770840008365187700,3564024329619581205,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:12⤵PID:1828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,15770840008365187700,3564024329619581205,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1916
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3908
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:452
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812
- MD5 b8880802fc2bb880a7a869faa01315b0
- SHA1 51d1a3fa2c272f094515675d82150bfce08ee8d3
- SHA512 e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73
- MD5 ba6ef346187b40694d493da98d5da979
- SHA1 643c15bec043f8673943885199bb06cd1652ee37
- SHA512 2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 8baef4fe57a63e81753e3837b38768da6749af17d0f8310db7085106018dd504
- MD5 6758e112b79891ce83e37741f394cc68
- SHA1 75ccb6bd65ca9c947c63f1a2d7624884ca9acd7e
- SHA512 69ae37aff23fd9a5d3bfae51af682cf3a797de06ac1715917d29dd5f6f1235042c721b64d30ef25b81d73b073be4f427182975014b84892592cfd1482a858f26
- SSDEEP 96:nhxk9xw1NqphMFwpvWMoiVmdeHAnKeSaoUWQyV+VDCziEwb:nhxkjwzkMFGWMXGK7aoro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 dbcb168946a28deace10f7c4237b8a75325903f632c1a5d7925cf38ae5b58234
- MD5 fd78fb5f1e025309ed289cba7c165207
- SHA1 240e7b15de57c3f6c63ecc89c72f05bba548e762
- SHA512 cf12d84db55b99c0d73b8dacf131227d6aa8f94584ff2ed2d79bbc2ed970abacec125d55f9c6259af00843108d3f78f126c2d76701d5621490c900b53b908dea
- SSDEEP 96:nhxkdxw1NqphpFwpvWMoiVmdeHAnKeSaoUWQyV+VD7AiEwb:nhxkDwzkpFGWMXGK7aorg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 c0d28e7c9d6ceb865b21d75b5cd2d3fed19f0a514d3d4ee6b3bb1e4b149f4cfa
- MD5 90a0576db95c2e161299785e3ab6feaf
- SHA1 86cc33cb7a15ee73cacc044a8236c3453a06d1bf
- SHA512 1fa8320da8be26d6a6b3f970b949290bed12c9184a59e53d3bf4b9fbd2d96b20f1424779e25489c4a9c2626db8781de8070a12e163ca052f949336a3a94cabac
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup1S65aSe2RUXehkNOiYdF9w:A9iIxuERzA83h09RZxY1lasweWOiYi0S
- MD5 SHA1 SHA512 SSDEEP