227e7f3e154885b39c181699d2d3aa15d367b034ed1d7e313f990a5e6ea8dd62

Analysis

max time kernel
215s
max time network
236s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
08/10/2023, 01:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

227e7f3e154885b39c181699d2d3aa15d367b034ed1d7e313f990a5e6ea8dd62.dll
Size

15.1MB
MD5

9b5b856cdcf194c490671a75f495f922
SHA1

d2df494c768ba8d1b4453a162ff01b386e157b18
SHA256

227e7f3e154885b39c181699d2d3aa15d367b034ed1d7e313f990a5e6ea8dd62
SHA512

03e5b2ed0c8155bab76549452a9b7aec33ac885dc88bbba0f03421aa6834c43b74324ca358a3de3474d2ff5ab5e9d9daa635ebd03fa6d1fd861f2b277356abd3
SSDEEP

393216:PSkkYTAgAtFuyh8vTS6ppcyUyKP3QNOcCShPX2B0t0DCtey:c0CFufDpHtS3MOchq0t0DFy

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3424-0-0x0000000002DB0000-0x0000000003352000-memory.dmp	upx
behavioral2/memory/3424-1-0x0000000002DB0000-0x0000000003352000-memory.dmp	upx
behavioral2/memory/3424-2-0x0000000002DB0000-0x0000000003352000-memory.dmp	upx
behavioral2/memory/3424-4-0x0000000002DB0000-0x0000000003352000-memory.dmp	upx
behavioral2/memory/3424-3-0x0000000002DB0000-0x0000000003352000-memory.dmp	upx
behavioral2/memory/3424-5-0x0000000002DB0000-0x0000000003352000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Î´ÑëÅäÖÃ.ini	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E403A1DFC8F377E0F4AA43A83EE9EA079A1F55F2	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E403A1DFC8F377E0F4AA43A83EE9EA079A1F55F2\Blob = 5300000001000000230000003021301f060960864801a4a227020130123010060a2b0601040182373c0101030200c05c000000010000000400000000100000030000000100000014000000e403a1dfc8f377e0f4aa43a83ee9ea079a1f55f219000000010000001000000079d8e39856b0540913defb485e73ed621400000001000000140000000525862f6536a1e59d9eca5c0919ad0e3d96261d0f000000010000001400000052bf462203121ab271f48ff1a32d373fd9f12399040000000100000010000000dc911e8da3a186bb4d52eec0e57b515509000000010000004c000000304a060a2b0601040182370a0602060a2b0601040182370a060106082b0601050507030806082b0601050507030406082b0601050507030306082b0601050507030206082b060105050703012000000001000000d3050000308205cf308203b7a00302010202041eb132d5300d06092a864886f70d01010505003076310b300906035504061302434e31233021060355040a0c1a4a656d6d794c6f76654a656e6e7920504b492053657276696365311e301c060355040b0c15706b692e6a656d6d796c6f76656a656e6e792e746b3122302006035504030c194a656d6d794c6f76654a656e6e7920455620526f6f742043413020170d3030303130313030303030305a180f32303939313233313233353935395a3076310b300906035504061302434e31233021060355040a0c1a4a656d6d794c6f76654a656e6e7920504b492053657276696365311e301c060355040b0c15706b692e6a656d6d796c6f76656a656e6e792e746b3122302006035504030c194a656d6d794c6f76654a656e6e7920455620526f6f7420434130820222300d06092a864886f70d01010105000382020f003082020a0282020100b5bf164ce267332d80ffed87e949041ea0b8dd6e4389cc2ece1e2606c7dc4085d75631f5bf99e3b60a4dbe48dc7337e8edc95dd02aca568a119c2884dd8cecd0c174585e1b6ec89e47f37f28626bb42abb0f7cb0ee0f25d11e268026937bfc4587de5d7cd89d9cd3fee634120724a3771d3dec3ba265398f84274bc72d683be7982706d99e24f4ffe84370fb7b0c8d56449c1bdb2d53ca85a55ea12b4cb65aa691fbbceb57c3cb924ded732c252a968069030dbd3a2bf0c8fa027b7ab6afc325b439d4edc7bad1d3e57dfa244705d36bae516daa94378ea3a87e54aad21deb547b1bc659ca611b05da6f473f6dedfc7616bb9a86838cb2b1be86ff2169d4bcc9078527fa4e579acfc1d649339751c2e6521432cf6b5f26666f2c732ec567a2f5c89f62a34b4a73352238b02d981eaf905c6a66ebe570b20d6ae57d978420f34ab679268d8910217031fa6c69831f485eab30c445789242977e2c9d2df3f0f1aa4ec0cae5612418ffdf0127b7d5809e7a1803121d5b0ff82537ab112a49d7946a51ec8c4691332d5ffa415471f2d95e104400776c21250ae00d587b233b22a596db169e0583c0027c59814544963e66a5eb293ea11523e338d924244bd36b6d27227eecf848c3aef39b756123595c646d36d6cdf570b72fe9fbef779e0afa1db7cf4cc81964b366441f8032337a328f3c988997d0a27d2d8dce891c221a514ab30203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604140525862f6536a1e59d9eca5c0919ad0e3d96261d301f0603551d230418301680140525862f6536a1e59d9eca5c0919ad0e3d96261d300d06092a864886f70d01010505000382020100ad21caaf24b3bfa5ae380783453b61419a4625b1adf976ca6ee77f802063842fd2ca4879ddf39df1a0ca779bb313fb86d1241607b6df5e868ad9cddb69e19baf3107c22cf951569dc8d5f89db4b4ab7b859b61482b10df9bfcce81c4f1b86c77d40a5ee2805a460dd0d6ea165f86e67085097d159090416b07de58ece97764bd1ab9d3c197d1e52aa132182f68fe1962f194b22e1a5a9d4d25c46c9e97a8a6fde4ec57296b4a509eb6dcc8be7b25ff104ef9892d413c93662351b7f3bab4725aaadd18adf65efba74224dbd1dd718356d68e205046d648ac74e11d3be7494d0dba37c51a467af57c721a25968ab1e6a48416009cfb2ac1c063245d93ec2459ac262778e907e4b9aa5bf666db808344c83857d632ae46fe2daba83d1497a155bb9da767ca7fe567b218dffda7aa61055501b2f515cd0fd8b830a67c82b765f52cf80f077ea177480395a29c8dbe9cd572715257a7cef58ad63218e05d16f0096bd496e12d17bf7790b9ddb6318fb91a2a3f3395dd55e4ba739c2c8d15442fbc8de41bade132d1a23fb5a2844e6b08062208f9191e1f3ca0a5504e07cf4b3f2baa683bdc0dc10a8a6631b3d46481641798a4a37b35ada800104d8bc70c0fc31f6615284cb1229592ee072139b6a15a8ad9e1a8135bb4fe7b426d5e69ca1a9a420d7ce3612490d4d9421835a89a05f14e3ca3fd987c51cd62f2926945cfbff32caa	rundll32.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5084	msedge.exe
5084	msedge.exe
500	msedge.exe
500	msedge.exe
4844	identity_helper.exe
4844	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3424	rundll32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 3424	2308	rundll32.exe	86
PID 2308 wrote to memory of 3424	2308	rundll32.exe	86
PID 2308 wrote to memory of 3424	2308	rundll32.exe	86
PID 3424 wrote to memory of 500	3424	rundll32.exe	92
PID 3424 wrote to memory of 500	3424	rundll32.exe	92
PID 500 wrote to memory of 4904	500	msedge.exe	93
PID 500 wrote to memory of 4904	500	msedge.exe	93
PID 500 wrote to memory of 2608	500	msedge.exe	95
PID 500 wrote to memory of 2608	500	msedge.exe	95
PID 500 wrote to memory of 2608	500	msedge.exe	95
PID 500 wrote to memory of 2608	500	msedge.exe	95
PID 500 wrote to memory of 2608	500	msedge.exe	95
PID 500 wrote to memory of 2608	500	msedge.exe	95
PID 500 wrote to memory of 2608	500	msedge.exe	95
PID 500 wrote to memory of 2608	500	msedge.exe	95
PID 500 wrote to memory of 2608	500	msedge.exe	95
PID 500 wrote to memory of 2608	500	msedge.exe	95
PID 500 wrote to memory of 2608	500	msedge.exe	95
PID 500 wrote to memory of 2608	500	msedge.exe	95
PID 500 wrote to memory of 2608	500	msedge.exe	95
PID 500 wrote to memory of 2608	500	msedge.exe	95
PID 500 wrote to memory of 2608	500	msedge.exe	95
PID 500 wrote to memory of 2608	500	msedge.exe	95
PID 500 wrote to memory of 2608	500	msedge.exe	95
PID 500 wrote to memory of 2608	500	msedge.exe	95
PID 500 wrote to memory of 2608	500	msedge.exe	95
PID 500 wrote to memory of 2608	500	msedge.exe	95
PID 500 wrote to memory of 2608	500	msedge.exe	95
PID 500 wrote to memory of 2608	500	msedge.exe	95
PID 500 wrote to memory of 2608	500	msedge.exe	95
PID 500 wrote to memory of 2608	500	msedge.exe	95
PID 500 wrote to memory of 2608	500	msedge.exe	95
PID 500 wrote to memory of 2608	500	msedge.exe	95
PID 500 wrote to memory of 2608	500	msedge.exe	95
PID 500 wrote to memory of 2608	500	msedge.exe	95
PID 500 wrote to memory of 2608	500	msedge.exe	95
PID 500 wrote to memory of 2608	500	msedge.exe	95
PID 500 wrote to memory of 2608	500	msedge.exe	95
PID 500 wrote to memory of 2608	500	msedge.exe	95
PID 500 wrote to memory of 2608	500	msedge.exe	95
PID 500 wrote to memory of 2608	500	msedge.exe	95
PID 500 wrote to memory of 2608	500	msedge.exe	95
PID 500 wrote to memory of 2608	500	msedge.exe	95
PID 500 wrote to memory of 2608	500	msedge.exe	95
PID 500 wrote to memory of 2608	500	msedge.exe	95
PID 500 wrote to memory of 2608	500	msedge.exe	95
PID 500 wrote to memory of 2608	500	msedge.exe	95
PID 500 wrote to memory of 5084	500	msedge.exe	94
PID 500 wrote to memory of 5084	500	msedge.exe	94
PID 500 wrote to memory of 4972	500	msedge.exe	96
PID 500 wrote to memory of 4972	500	msedge.exe	96
PID 500 wrote to memory of 4972	500	msedge.exe	96
PID 500 wrote to memory of 4972	500	msedge.exe	96
PID 500 wrote to memory of 4972	500	msedge.exe	96
PID 500 wrote to memory of 4972	500	msedge.exe	96
PID 500 wrote to memory of 4972	500	msedge.exe	96
PID 500 wrote to memory of 4972	500	msedge.exe	96
PID 500 wrote to memory of 4972	500	msedge.exe	96
PID 500 wrote to memory of 4972	500	msedge.exe	96
PID 500 wrote to memory of 4972	500	msedge.exe	96
PID 500 wrote to memory of 4972	500	msedge.exe	96
PID 500 wrote to memory of 4972	500	msedge.exe	96
PID 500 wrote to memory of 4972	500	msedge.exe	96
PID 500 wrote to memory of 4972	500	msedge.exe	96

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\227e7f3e154885b39c181699d2d3aa15d367b034ed1d7e313f990a5e6ea8dd62.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\227e7f3e154885b39c181699d2d3aa15d367b034ed1d7e313f990a5e6ea8dd62.dll,#1
  2⤵
  - Drops file in System32 directory
  - Modifies system certificate store
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.huorong.cn/
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffc14446f8,0x7fffc1444708,0x7fffc1444718
      4⤵
      PID:4904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,12221139648977969185,4119683732056216462,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,12221139648977969185,4119683732056216462,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
      4⤵
      PID:2608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,12221139648977969185,4119683732056216462,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
      4⤵
      PID:4972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12221139648977969185,4119683732056216462,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
      4⤵
      PID:1052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12221139648977969185,4119683732056216462,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
      4⤵
      PID:1996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12221139648977969185,4119683732056216462,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
      4⤵
      PID:5020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12221139648977969185,4119683732056216462,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
      4⤵
      PID:3660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12221139648977969185,4119683732056216462,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
      4⤵
      PID:3488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12221139648977969185,4119683732056216462,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
      4⤵
      PID:3796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,12221139648977969185,4119683732056216462,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3096 /prefetch:8
      4⤵
      PID:2144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,12221139648977969185,4119683732056216462,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3096 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
db9dbef3f8b1f616429f605c1ebca2f0

SHA1
ffba76f0836c024828d4ff1982cc4240c41a8f16

SHA256
3e0297327872058355ac041a5e0fc83ed017faee0f6c0105b44bb3e5399a93a1

SHA512
4eedc387fe304f27f9d52ff5d71461c7f22147f7a8c18b8e7982acb76515528a36486a567451daafe093f9563b133c6799f2ad046e04256ccb46c83eb99e86c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ae48e7108e074d6e1b78821913f4222e

SHA1
553d579bafef163ed903ef81472875a07fb15090

SHA256
6979a6c3e4b993fc03e2d704f476529bd3c792dc7028b5b848bd29c7efe23aab

SHA512
98c976d4fb0ae04158e7aaf8baaaf369bb27592b2c006a3c79909cd4131cd4d0b5ba52b0e8dd8a30eabd9f0b5832e1ede7791cd91319f55620b7ac1e548e2779

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e8c32676e43ac2a8dcfd9fe4e2382433

SHA1
0e3224cf776aaed299caef1e20f1a84221550927

SHA256
d15342655fcaa9617e92d680627aab92bb669b7fa94753ab24a1b76c83d88577

SHA512
d33c25df5fa73f616ecf9d9d23fd23b7ed18b18eca6f2041de0474e5e7f67a91c188aff011c56825d4645d5d43c1a16cbf9e8be93f344f233b8f26f1e0cbbbf8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
6dcb90ba1ba8e06c1d4f27ec78f6911a

SHA1
71e7834c7952aeb9f1aa6eb88e1959a1ae4985d9

SHA256
30d89e5026668c5a58bef231930a8bfb27ca099b24399a2615b210210d418416

SHA512
dc31807eaeb5221ac60d598035ca3ccab1dbeecc95caaff5e1f5a2a89ba1c83ef0a708ee0b8ed05b588ea5d50e360032a534356f84c89d3791df91d419daeff9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
3KB

MD5
52e7f2f687837f0ef1aa0b0417b9a7b9

SHA1
583abf2c8d71cd255a6af5b2e2a65b3758edf4f6

SHA256
675a29f2c14e431d497d63e680765429db24067c9c71cb3dc608ec7e78820cf0

SHA512
2bfb3a76b14c813ea482b431be54af66c5e89a28797ab9f5718f4651055b8718a358ca70e711868f4cd9b962c28df53174eb6d64253f29541dead1216570c185

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
aafb66ae47206ad4ab87cedfeb22c4cf

SHA1
07c3aed5249df7cd52e3a4b316e55fcd1e1f8d6b

SHA256
587d74bb2965ce20ea44d838db614089e3134403272b440187e12c5175621cf1

SHA512
c5da3bf186455e2720a8c55cf76bd1d02a3a5a42c14712b941a66714f60d14e52f43663368dd354929956df039a6bc64b7934d6ec3c521d9722fb98ea5e0f310

Download Submit
C:\Windows\SysWOW64\Î´ÑëÅäÖÃ.ini

Filesize
1KB

MD5
07b0c8ffdb5bdc094aa92c2a61d1542d

SHA1
3fec287e4b171e86dd6cab6e3ac2b8073316bcd6

SHA256
a2c3de2ad9ae54c4cb604d7f8fd9b7f3842c11b302030cf6440bdd88be5f5668

SHA512
7b60db0645b697a3dfa570172a9e9ac1e98ead327da30454f8d919ce0e744509fbc31f33ecf84a97041a021c861dc7c3fa653c59ccd9415869fc836588046073

Download Submit
memory/3424-26-0x0000000002DB0000-0x0000000003352000-memory.dmp

Filesize
5.6MB

Download
memory/3424-5-0x0000000002DB0000-0x0000000003352000-memory.dmp

Filesize
5.6MB

Download
memory/3424-3-0x0000000002DB0000-0x0000000003352000-memory.dmp

Filesize
5.6MB

Download
memory/3424-0-0x0000000002DB0000-0x0000000003352000-memory.dmp

Filesize
5.6MB

Download
memory/3424-4-0x0000000002DB0000-0x0000000003352000-memory.dmp

Filesize
5.6MB

Download
memory/3424-2-0x0000000002DB0000-0x0000000003352000-memory.dmp

Filesize
5.6MB

Download
memory/3424-1-0x0000000002DB0000-0x0000000003352000-memory.dmp

Filesize
5.6MB

Download