c57ebe60385417074c0a168cc79ebe356038206199117852a0fb0afeb550c789

Analysis

max time kernel
38s
max time network
47s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10-08-2024 14:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

529a41cd-5c0c-4cd0-8061-b71feaa8a336.exe
Size

164.6MB
MD5

11e4eb3b3c34f48d72230928953cf8af
SHA1

f27b5f891d2fa49c38a4a7f648a214297e63a277
SHA256

c57ebe60385417074c0a168cc79ebe356038206199117852a0fb0afeb550c789
SHA512

82f38356e0c065821dc8e8df2b92ad71530c59ac542c4e81cf61878d1df6ebbe658f6bb21645251705604ea4818ccecf927efaf842595feaf7d8426ad5f5ca92
SSDEEP

3145728:NJrPQ9xczROdBB1tmAHPg51Ol4QbgMO4tAykxRIi/jNGOzCG9T:NJrPQssdT1tmAHPQ1OCsglakxRF/RGOv

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	529a41cd-5c0c-4cd0-8061-b71feaa8a336.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\fabcb999-e294-4c5b-9815-01ae4a2b99af.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20240810144527.pma	setup.exe

Executes dropped EXE 2 IoCs

pid	Process
924	setup.exe
2504	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4404	msedge.exe
4404	msedge.exe
3116	msedge.exe
3116	msedge.exe
4076	identity_helper.exe
4076	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 564 wrote to memory of 924	564	529a41cd-5c0c-4cd0-8061-b71feaa8a336.exe	87
PID 564 wrote to memory of 924	564	529a41cd-5c0c-4cd0-8061-b71feaa8a336.exe	87
PID 924 wrote to memory of 2504	924	setup.exe	88
PID 924 wrote to memory of 2504	924	setup.exe	88
PID 924 wrote to memory of 3116	924	setup.exe	89
PID 924 wrote to memory of 3116	924	setup.exe	89
PID 3116 wrote to memory of 5008	3116	msedge.exe	90
PID 3116 wrote to memory of 5008	3116	msedge.exe	90
PID 3116 wrote to memory of 1136	3116	msedge.exe	91
PID 3116 wrote to memory of 1136	3116	msedge.exe	91
PID 3116 wrote to memory of 1136	3116	msedge.exe	91
PID 3116 wrote to memory of 1136	3116	msedge.exe	91
PID 3116 wrote to memory of 1136	3116	msedge.exe	91
PID 3116 wrote to memory of 1136	3116	msedge.exe	91
PID 3116 wrote to memory of 1136	3116	msedge.exe	91
PID 3116 wrote to memory of 1136	3116	msedge.exe	91
PID 3116 wrote to memory of 1136	3116	msedge.exe	91
PID 3116 wrote to memory of 1136	3116	msedge.exe	91
PID 3116 wrote to memory of 1136	3116	msedge.exe	91
PID 3116 wrote to memory of 1136	3116	msedge.exe	91
PID 3116 wrote to memory of 1136	3116	msedge.exe	91
PID 3116 wrote to memory of 1136	3116	msedge.exe	91
PID 3116 wrote to memory of 1136	3116	msedge.exe	91
PID 3116 wrote to memory of 1136	3116	msedge.exe	91
PID 3116 wrote to memory of 1136	3116	msedge.exe	91
PID 3116 wrote to memory of 1136	3116	msedge.exe	91
PID 3116 wrote to memory of 1136	3116	msedge.exe	91
PID 3116 wrote to memory of 1136	3116	msedge.exe	91
PID 3116 wrote to memory of 1136	3116	msedge.exe	91
PID 3116 wrote to memory of 1136	3116	msedge.exe	91
PID 3116 wrote to memory of 1136	3116	msedge.exe	91
PID 3116 wrote to memory of 1136	3116	msedge.exe	91
PID 3116 wrote to memory of 1136	3116	msedge.exe	91
PID 3116 wrote to memory of 1136	3116	msedge.exe	91
PID 3116 wrote to memory of 1136	3116	msedge.exe	91
PID 3116 wrote to memory of 1136	3116	msedge.exe	91
PID 3116 wrote to memory of 1136	3116	msedge.exe	91
PID 3116 wrote to memory of 1136	3116	msedge.exe	91
PID 3116 wrote to memory of 1136	3116	msedge.exe	91
PID 3116 wrote to memory of 1136	3116	msedge.exe	91
PID 3116 wrote to memory of 1136	3116	msedge.exe	91
PID 3116 wrote to memory of 1136	3116	msedge.exe	91
PID 3116 wrote to memory of 1136	3116	msedge.exe	91
PID 3116 wrote to memory of 1136	3116	msedge.exe	91
PID 3116 wrote to memory of 1136	3116	msedge.exe	91
PID 3116 wrote to memory of 1136	3116	msedge.exe	91
PID 3116 wrote to memory of 1136	3116	msedge.exe	91
PID 3116 wrote to memory of 1136	3116	msedge.exe	91
PID 3116 wrote to memory of 4404	3116	msedge.exe	92
PID 3116 wrote to memory of 4404	3116	msedge.exe	92
PID 3116 wrote to memory of 4032	3116	msedge.exe	93
PID 3116 wrote to memory of 4032	3116	msedge.exe	93
PID 3116 wrote to memory of 4032	3116	msedge.exe	93
PID 3116 wrote to memory of 4032	3116	msedge.exe	93
PID 3116 wrote to memory of 4032	3116	msedge.exe	93
PID 3116 wrote to memory of 4032	3116	msedge.exe	93
PID 3116 wrote to memory of 4032	3116	msedge.exe	93
PID 3116 wrote to memory of 4032	3116	msedge.exe	93
PID 3116 wrote to memory of 4032	3116	msedge.exe	93
PID 3116 wrote to memory of 4032	3116	msedge.exe	93
PID 3116 wrote to memory of 4032	3116	msedge.exe	93
PID 3116 wrote to memory of 4032	3116	msedge.exe	93
PID 3116 wrote to memory of 4032	3116	msedge.exe	93
PID 3116 wrote to memory of 4032	3116	msedge.exe	93

C:\Users\Admin\AppData\Local\Temp\529a41cd-5c0c-4cd0-8061-b71feaa8a336.exe
"C:\Users\Admin\AppData\Local\Temp\529a41cd-5c0c-4cd0-8061-b71feaa8a336.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:564
- C:\Users\Admin\AppData\Local\Temp\EDGEMITMP_C7F51.tmp\setup.exe
  "C:\Users\Admin\AppData\Local\Temp\EDGEMITMP_C7F51.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\529a41cd-5c0c-4cd0-8061-b71feaa8a336.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:924
- - C:\Users\Admin\AppData\Local\Temp\EDGEMITMP_C7F51.tmp\setup.exe
    C:\Users\Admin\AppData\Local\Temp\EDGEMITMP_C7F51.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.100 --annotation=exe=C:\Users\Admin\AppData\Local\Temp\EDGEMITMP_C7F51.tmp\setup.exe --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.98 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ff6b649b7d0,0x7ff6b649b7dc,0x7ff6b649b7e8
    3⤵
    - Executes dropped EXE
    PID:2504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --force-first-run
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffdf4b46f8,0x7fffdf4b4708,0x7fffdf4b4718
      4⤵
      PID:5008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,15380652423921779177,7217556332474031778,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
      4⤵
      PID:1136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,15380652423921779177,7217556332474031778,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,15380652423921779177,7217556332474031778,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2992 /prefetch:8
      4⤵
      PID:4032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15380652423921779177,7217556332474031778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
      4⤵
      PID:4024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15380652423921779177,7217556332474031778,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
      4⤵
      PID:4244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15380652423921779177,7217556332474031778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
      4⤵
      PID:3604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15380652423921779177,7217556332474031778,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
      4⤵
      PID:2108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,15380652423921779177,7217556332474031778,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3548 /prefetch:8
      4⤵
      PID:3924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      PID:4684
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff797ad5460,0x7ff797ad5470,0x7ff797ad5480
        5⤵
        
        PID:1876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,15380652423921779177,7217556332474031778,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3548 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15380652423921779177,7217556332474031778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
      4⤵
      PID:3924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15380652423921779177,7217556332474031778,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
      4⤵
      PID:3456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15380652423921779177,7217556332474031778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
      4⤵
      PID:4556
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "564" "692" "536" "688" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:5892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3304

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
76999d1e13d833576703d21b6f9d8998

SHA1
1d870ea6c1d98aae001e6dd356165598787adc79

SHA256
5f74c9181a8b4664f37326f4e2ad5c9b4b952582ed0659f1405a9633c0910555

SHA512
72dd95e79bb33e1ce412c7a71d09e987822c1b32513b614a7b5790b321b27b33bb3f442226e15fe23038c8c5565fa407c6b8e029443be5cc1c56b2459daa6744

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
16446c287e60655cb075c5279bd6bbc9

SHA1
9ec0956837aa5cac88039a761928f1b7cf733535

SHA256
fb67e5cfb78083605639425b8d2eab49961a5bc85d4e0eceecd0a95af0ae372b

SHA512
666e75ebb760c2187b56a3cf4c119dd88e5eee2a6a061a221b53e4dbdd3270d44275b4be3d0de6caa05ffc72c1fdf8d16b1b69e44664db93443ceff403764d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7cdf8a6783a3cebafa8267ffaa7b8a00

SHA1
14f2cbb275e3f750367aecfa19ad1856cdee56f0

SHA256
1e36bd92266acc0104125e08acbff668f07f3df194efcc2ad65bffbc32e2efd2

SHA512
445b287a73b2725db2d32ea79acc54f74fa0669169e84626a07e6a2b9a181d6eac5afca091b1f7e7550f64a2ded8ff23d78fea331eef5d91eed6d094c1b09da1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6010a7fe3c206e980f138a513a568455

SHA1
a66e244a47dc8416fc36721c0625824c2145af5a

SHA256
d833151e6fbdcf563236a6ff3cfd9b552b071abcd104b83a783d3ac8b5c73470

SHA512
ca3d347dc39244d7f9309e971872981c5171480d6687d23ca4949e6920e15265f747a07980277c1ff5f07cb422e2709e20871ae91fbc1405d6ffbaac2c63c6d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6f99eb04aec793fee61855456353bf7e

SHA1
18608867db2b0d7458c77b9081f68cc1170c84fc

SHA256
bec715edb346e91b955f4e02af3c17d758c2fb724794298c68c16e025dab651e

SHA512
77918443d118ecc07e47fa2afc47b1d47dbda08af681c1389495992048689d29568157297cacab7591d09d89c919e49065e64fec759224177a8641beca7f9a89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3d34cb9a12e415fe17d8523e7eeb9c9d

SHA1
add3eafb7909ae56e0eb4fbddcb52ae551657696

SHA256
7bee33226ed2aa27d1a4c7a0b42937b6014e1093462fc0ca230420c1930e14c5

SHA512
f146a6f5e64f74e2c4d5042a29a8015d770e25c5eb98e63ec9aaca26170401c1fd087d7dd749545107dcb45e1d124c561f40370a07d652ed4ee5dd142de093fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
43eaa3fb1d02bcbf655dafd3f513d76a

SHA1
e0dc61a544768fdddd44982a4666b203f591cabe

SHA256
8e4e26fb173a7225e4593db066d815d1f03925e64912aba5e2a88dac66f2f810

SHA512
fb3fa4ddee61bcb6b3b9ff4af673d2b9d0be5e1bd4124d931318fe632dcaadc50f9de8100824a42ea4ccce89bf8f91cd6884f8c26bc645e888b8ccdd6c260f5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f21bb584282b5fe44a534862144e8dd7

SHA1
f7cefb7566fc263655dae288f7401d69cb1cb4f1

SHA256
638491f0031f9de8b323bc144191e6774fa62063f73777beecf3a563d17dd020

SHA512
9158e086331d7d7a41defa9ceabd1c08bd35ae9bac9de5ce59b17af84a8aa075242777fa6911794a2e437c313ab3224a33c111059f11a31fc47a6501a0c348b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
6656aaf3c32ccdeb7cc1d18b5f776713

SHA1
b5748cea87f6c89ad81dbf62d4934cbd03266a36

SHA256
21010a1aa164155b3509eb0cbc35ae20f1de2d961c036b889bd2ff439116f47c

SHA512
4f19a8345afc12a97c91a53a0c90125bae5e75daedcb7a7ba427ede2998e371d0335f98873a90aed3577e194e5cee93aad2ad1df5c04fb26a719170b2116481a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
31d7721426bfdaaaa7cd1aaff9a4f718

SHA1
b66e4e282186f9554c5585795502b22ee599b76c

SHA256
baf0fa8fde8c0996b4b8f482b107b5a157262e48e295a506daf51b0ec4d9477a

SHA512
dd5ffb1160a1c1fae0409f0decbdf0aab8dbfcefb906ba8e2efd355d16c06cef225594b968ea974e0c43fffe0be86937c5ef121dfa9d4cda3c83baffd63c7135

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
fd4cb871972404b60b9ef43f44886ea9

SHA1
a656a0bda89ad7a379d6d07407b971b55b451f06

SHA256
beaf55671777d4574124180d60aed108c3db18089e30beb042d71ce0845fc193

SHA512
54cb55269ee629ac38e7940f2919ee10aefbff7b88a5fbddac3b44fcfa6ff68160a73ee1416d875b4567a0281e1742c72a8f5ddab4f3a04a214f0b94c87c699d

Download Submit
C:\Users\Admin\AppData\Local\Temp\EDGEMITMP_C7F51.tmp\setup.exe

Filesize
6.6MB

MD5
527503f430c5fd4a542f8c0f163fde47

SHA1
6b4db644895df6c71b547d8b147ef3e327418f9d

SHA256
d1d9b6fa51141f58b95191c8a62cc5a4c9568ba4b70e3deba4e1929df9a97628

SHA512
ece940340ba2216966b6d4b28a950826b55f8987998c101c534331674376b148dfbfacaf5c78695944bf940dea07ed4887f9572e09c118e307752036679850b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\msedge_installer.log

Filesize
4KB

MD5
82c89c0c8ecca630f0dcbac9a55a9f8f

SHA1
1977c0273373a6ff8d2f4ddc71ff3ec72a0da86a

SHA256
447fc0a17d69a7cec0ed46c197ca85e5fd2d145b261d9453727cf3c44473d948

SHA512
6172fe03831bbecb75a1f8496e4e67e537beecee1f9333d3d53574897cb50905e3914defb56d5577c5b4703208054b636216698c1444a5ae1a88ced7e9a8553a

Download Submit
C:\Users\Admin\AppData\Local\Temp\msedge_installer.log

Filesize
6KB

MD5
451491961a72c71206402994c4dff645

SHA1
640341620de179674b6b989094786d78bf8eb218

SHA256
b8c98222ec631b81457652fff815305e37dc3734c1f7c62fc0a6ec37a01189e4

SHA512
479f6b531188cb2761f2744bc9d30728ba90b06bd391acbee7ca07e5bb9870da754963896730dfdec1d21c62211787be76b5ddabb82f77d0db603f68c3705ea1

Download Submit