blackmoon | 97d1f96fc0b6f143e003389c52edb73442169f7b98cf4eed16a97bc8cb196124

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2024, 23:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

造梦西游5魂殇修改器.exe
Size

468KB
MD5

59d71e81bca65c7f790d33d317dbe4cc
SHA1

01fa3b6561274da9d1c5550679e092033a3bb2af
SHA256

fe5fa6f567d0d5b03e1e38d922fbbfab5f687e2192ffc0585c87dea14f00146c
SHA512

d7a6990b6298e812ca014521a2a4a0976654eb8fb9d0a4911a1576f37b393d70a7f245e9b52aa074e1c3d9fe917093319f32c70017eb7e911f3937be67d4ff21
SSDEEP

6144:6a4f07to4inSxvRUNzasgXO88SqER3GsAp5/pv:N4f0a4iSxgzasgP75RNA

Score

10^/10

blackmoon banker discovery trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
behavioral4/files/0x0009000000023442-1.dat	family_blackmoon

Executes dropped EXE 1 IoCs

pid	Process
1416	ÔìÃÎÎ÷ÓÎ4»êéäÐÞ¸ÄÆ÷6.3.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	造梦西游5魂殇修改器.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ÔìÃÎÎ÷ÓÎ4»êéäÐÞ¸ÄÆ÷6.3.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2332	msedge.exe
2332	msedge.exe
4352	msedge.exe
4352	msedge.exe
1352	identity_helper.exe
1352	identity_helper.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2916	造梦西游5魂殇修改器.exe
1416	ÔìÃÎÎ÷ÓÎ4»êéäÐÞ¸ÄÆ÷6.3.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2320	2916	造梦西游5魂殇修改器.exe	82
PID 2916 wrote to memory of 2320	2916	造梦西游5魂殇修改器.exe	82
PID 2916 wrote to memory of 2320	2916	造梦西游5魂殇修改器.exe	82
PID 4496 wrote to memory of 1416	4496	explorer.exe	84
PID 4496 wrote to memory of 1416	4496	explorer.exe	84
PID 4496 wrote to memory of 1416	4496	explorer.exe	84
PID 1416 wrote to memory of 4352	1416	ÔìÃÎÎ÷ÓÎ4»êéäÐÞ¸ÄÆ÷6.3.exe	93
PID 1416 wrote to memory of 4352	1416	ÔìÃÎÎ÷ÓÎ4»êéäÐÞ¸ÄÆ÷6.3.exe	93
PID 4352 wrote to memory of 2740	4352	msedge.exe	94
PID 4352 wrote to memory of 2740	4352	msedge.exe	94
PID 4352 wrote to memory of 2084	4352	msedge.exe	95
PID 4352 wrote to memory of 2084	4352	msedge.exe	95
PID 4352 wrote to memory of 2084	4352	msedge.exe	95
PID 4352 wrote to memory of 2084	4352	msedge.exe	95
PID 4352 wrote to memory of 2084	4352	msedge.exe	95
PID 4352 wrote to memory of 2084	4352	msedge.exe	95
PID 4352 wrote to memory of 2084	4352	msedge.exe	95
PID 4352 wrote to memory of 2084	4352	msedge.exe	95
PID 4352 wrote to memory of 2084	4352	msedge.exe	95
PID 4352 wrote to memory of 2084	4352	msedge.exe	95
PID 4352 wrote to memory of 2084	4352	msedge.exe	95
PID 4352 wrote to memory of 2084	4352	msedge.exe	95
PID 4352 wrote to memory of 2084	4352	msedge.exe	95
PID 4352 wrote to memory of 2084	4352	msedge.exe	95
PID 4352 wrote to memory of 2084	4352	msedge.exe	95
PID 4352 wrote to memory of 2084	4352	msedge.exe	95
PID 4352 wrote to memory of 2084	4352	msedge.exe	95
PID 4352 wrote to memory of 2084	4352	msedge.exe	95
PID 4352 wrote to memory of 2084	4352	msedge.exe	95
PID 4352 wrote to memory of 2084	4352	msedge.exe	95
PID 4352 wrote to memory of 2084	4352	msedge.exe	95
PID 4352 wrote to memory of 2084	4352	msedge.exe	95
PID 4352 wrote to memory of 2084	4352	msedge.exe	95
PID 4352 wrote to memory of 2084	4352	msedge.exe	95
PID 4352 wrote to memory of 2084	4352	msedge.exe	95
PID 4352 wrote to memory of 2084	4352	msedge.exe	95
PID 4352 wrote to memory of 2084	4352	msedge.exe	95
PID 4352 wrote to memory of 2084	4352	msedge.exe	95
PID 4352 wrote to memory of 2084	4352	msedge.exe	95
PID 4352 wrote to memory of 2084	4352	msedge.exe	95
PID 4352 wrote to memory of 2084	4352	msedge.exe	95
PID 4352 wrote to memory of 2084	4352	msedge.exe	95
PID 4352 wrote to memory of 2084	4352	msedge.exe	95
PID 4352 wrote to memory of 2084	4352	msedge.exe	95
PID 4352 wrote to memory of 2084	4352	msedge.exe	95
PID 4352 wrote to memory of 2084	4352	msedge.exe	95
PID 4352 wrote to memory of 2084	4352	msedge.exe	95
PID 4352 wrote to memory of 2084	4352	msedge.exe	95
PID 4352 wrote to memory of 2084	4352	msedge.exe	95
PID 4352 wrote to memory of 2084	4352	msedge.exe	95
PID 4352 wrote to memory of 2332	4352	msedge.exe	96
PID 4352 wrote to memory of 2332	4352	msedge.exe	96
PID 4352 wrote to memory of 4060	4352	msedge.exe	97
PID 4352 wrote to memory of 4060	4352	msedge.exe	97
PID 4352 wrote to memory of 4060	4352	msedge.exe	97
PID 4352 wrote to memory of 4060	4352	msedge.exe	97
PID 4352 wrote to memory of 4060	4352	msedge.exe	97
PID 4352 wrote to memory of 4060	4352	msedge.exe	97
PID 4352 wrote to memory of 4060	4352	msedge.exe	97
PID 4352 wrote to memory of 4060	4352	msedge.exe	97
PID 4352 wrote to memory of 4060	4352	msedge.exe	97
PID 4352 wrote to memory of 4060	4352	msedge.exe	97
PID 4352 wrote to memory of 4060	4352	msedge.exe	97
PID 4352 wrote to memory of 4060	4352	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\造梦西游5魂殇修改器.exe
"C:\Users\Admin\AppData\Local\Temp\造梦西游5魂殇修改器.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\SysWOW64\Explorer.exe
  Explorer /n,C:\Users\Admin\AppData\Local\Temp\ÔìÃÎÎ÷ÓÎ4»êéäÐÞ¸ÄÆ÷6.3.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2320

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Users\Admin\AppData\Local\Temp\ÔìÃÎÎ÷ÓÎ4»êéäÐÞ¸ÄÆ÷6.3.exe
  "C:\Users\Admin\AppData\Local\Temp\ÔìÃÎÎ÷ÓÎ4»êéäÐÞ¸ÄÆ÷6.3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.4399hs.com/
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff5c5646f8,0x7fff5c564708,0x7fff5c564718
      4⤵
      PID:2740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,15733658125330210162,14819239638277271362,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2016 /prefetch:2
      4⤵
      PID:2084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,15733658125330210162,14819239638277271362,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2444 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,15733658125330210162,14819239638277271362,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
      4⤵
      PID:4060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15733658125330210162,14819239638277271362,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
      4⤵
      PID:948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15733658125330210162,14819239638277271362,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
      4⤵
      PID:2788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15733658125330210162,14819239638277271362,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:1
      4⤵
      PID:3616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15733658125330210162,14819239638277271362,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:1
      4⤵
      PID:4344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,15733658125330210162,14819239638277271362,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4228 /prefetch:8
      4⤵
      PID:4784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,15733658125330210162,14819239638277271362,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4228 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15733658125330210162,14819239638277271362,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:1
      4⤵
      PID:4424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15733658125330210162,14819239638277271362,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
      4⤵
      PID:2708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15733658125330210162,14819239638277271362,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
      4⤵
      PID:4628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15733658125330210162,14819239638277271362,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
      4⤵
      PID:2472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15733658125330210162,14819239638277271362,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3008 /prefetch:1
      4⤵
      PID:2516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15733658125330210162,14819239638277271362,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
      4⤵
      PID:3964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,15733658125330210162,14819239638277271362,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4984 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:536

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e936e24d67d2a60dd2ac55f8f223a03d

SHA1
673ae4fdeb17a6ec1268741a54e7244e35b59a4d

SHA256
16f0ceff75368c9800028d628c84b8123dc907771ddf2aa3bd920486401efd8c

SHA512
4ac3b8867f719550ac359d577ba658568701cbc17b772ada587453964d615e01b2e98b9b5dbdd5498347b51cd79c3bfc8ffe1d390997ca61c1b61e0765ec0ab8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
32c6dcbe7fd97bdabddcdc4df41bbb0e

SHA1
14d207dd90dcead0a1e21dffaed8e61e274563fb

SHA256
2d1c4e744bbbf8e18dc3680493cb21611938e6a242176b9137084cf2ac348261

SHA512
42ba11c044703c18e5a63d691772d419559907196684f9bb035fa0c935c6a0b6003911bea80dbc5994218cab1f8efb1e0d2134d9acee4334e21071ee707dfbfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a62d770f3b4e82f40585a88a6a099e25

SHA1
900e517c1ce330610d40c84fbe902cd1a91fe581

SHA256
aad2c764ab037da502d71b170fd6b3acc077fcb4b4c242fdcb9b4f482c9e2c89

SHA512
c30cb6e762178a4f10f4ad62386c1d39f6455f10eaa84b72a0507f23f201707e502c97e5566828b6089c8f35793c7d843cfeb516b535b83fd995dbd8d27dcdea

Download Submit
C:\Users\Admin\AppData\Local\Temp\ÔìÃÎÎ÷ÓÎ4»êéäÐÞ¸ÄÆ÷6.3.exe

Filesize
268KB

MD5
d4345448976df15d4338d411583217d8

SHA1
83f405499bd649c5744fe4f6eb1abea8828487dc

SHA256
6cc67524aacded7fdd197048881a68fb21278dd9e20a73b57d7a11550fc736e9

SHA512
b6ff0b28aff3663b49156d1f6e3c75dd994e3ff70a92ff7914128473ab886aedec8cd2dd6018fd99e62ad7294bb808c5c4c5ad5a6713ba41df09b0b16d960385

Download Submit