meduza | hxxps://github[.]com/fdh54h54h54hg/57547547g/releases/download/Download/Setup7[.]0[.]zip

Analysis

max time kernel
33s
max time network
35s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
08-10-2024 14:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/fdh54h54h54hg/57547547g/releases/download/Download/Setup7.0.zip

Score

10^/10

meduza collection discovery spyware stealer

Malware Config

Extracted

Family

meduza

109.107.181.162

Attributes

anti_dbg
true
anti_vm
true
build_name
153
extensions
none
grabber_max_size
1.048576e+06
links
none
port
15666
self_destruct
true

Signatures

Meduza
Meduza is a crypto wallet and info stealer written in C++.
stealer meduza

Meduza Stealer payload 2 IoCs

resource	yara_rule
behavioral1/memory/660-175-0x0000000140000000-0x000000014013B000-memory.dmp	family_meduza
behavioral1/memory/660-170-0x0000000140000000-0x000000014013B000-memory.dmp	family_meduza

Executes dropped EXE 1 IoCs

pid	Process
660	setup7.0.exe

Loads dropped DLL 1 IoCs

pid	Process
2748	setup7.0.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	setup7.0.exe
Key opened	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	setup7.0.exe
Key opened	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	setup7.0.exe
Key opened	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	setup7.0.exe
Key opened	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	setup7.0.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	api.ipify.org
18	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2748 set thread context of 660	2748	setup7.0.exe	96

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4236	PING.EXE
4324	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Setup7.0.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Setup7.0\setup7.0.exe:a.dll	setup7.0.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4236	PING.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3100	msedge.exe
3100	msedge.exe
640	msedge.exe
640	msedge.exe
660	msedge.exe
660	msedge.exe
2792	identity_helper.exe
2792	identity_helper.exe
2376	msedge.exe
2376	msedge.exe
660	setup7.0.exe
660	setup7.0.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
640	msedge.exe
640	msedge.exe
640	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	660	setup7.0.exe
Token: SeImpersonatePrivilege	660	setup7.0.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1628	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 2380	640	msedge.exe	77
PID 640 wrote to memory of 2380	640	msedge.exe	77
PID 640 wrote to memory of 2212	640	msedge.exe	78
PID 640 wrote to memory of 2212	640	msedge.exe	78
PID 640 wrote to memory of 2212	640	msedge.exe	78
PID 640 wrote to memory of 2212	640	msedge.exe	78
PID 640 wrote to memory of 2212	640	msedge.exe	78
PID 640 wrote to memory of 2212	640	msedge.exe	78
PID 640 wrote to memory of 2212	640	msedge.exe	78
PID 640 wrote to memory of 2212	640	msedge.exe	78
PID 640 wrote to memory of 2212	640	msedge.exe	78
PID 640 wrote to memory of 2212	640	msedge.exe	78
PID 640 wrote to memory of 2212	640	msedge.exe	78
PID 640 wrote to memory of 2212	640	msedge.exe	78
PID 640 wrote to memory of 2212	640	msedge.exe	78
PID 640 wrote to memory of 2212	640	msedge.exe	78
PID 640 wrote to memory of 2212	640	msedge.exe	78
PID 640 wrote to memory of 2212	640	msedge.exe	78
PID 640 wrote to memory of 2212	640	msedge.exe	78
PID 640 wrote to memory of 2212	640	msedge.exe	78
PID 640 wrote to memory of 2212	640	msedge.exe	78
PID 640 wrote to memory of 2212	640	msedge.exe	78
PID 640 wrote to memory of 2212	640	msedge.exe	78
PID 640 wrote to memory of 2212	640	msedge.exe	78
PID 640 wrote to memory of 2212	640	msedge.exe	78
PID 640 wrote to memory of 2212	640	msedge.exe	78
PID 640 wrote to memory of 2212	640	msedge.exe	78
PID 640 wrote to memory of 2212	640	msedge.exe	78
PID 640 wrote to memory of 2212	640	msedge.exe	78
PID 640 wrote to memory of 2212	640	msedge.exe	78
PID 640 wrote to memory of 2212	640	msedge.exe	78
PID 640 wrote to memory of 2212	640	msedge.exe	78
PID 640 wrote to memory of 2212	640	msedge.exe	78
PID 640 wrote to memory of 2212	640	msedge.exe	78
PID 640 wrote to memory of 2212	640	msedge.exe	78
PID 640 wrote to memory of 2212	640	msedge.exe	78
PID 640 wrote to memory of 2212	640	msedge.exe	78
PID 640 wrote to memory of 2212	640	msedge.exe	78
PID 640 wrote to memory of 2212	640	msedge.exe	78
PID 640 wrote to memory of 2212	640	msedge.exe	78
PID 640 wrote to memory of 2212	640	msedge.exe	78
PID 640 wrote to memory of 2212	640	msedge.exe	78
PID 640 wrote to memory of 3100	640	msedge.exe	79
PID 640 wrote to memory of 3100	640	msedge.exe	79
PID 640 wrote to memory of 3560	640	msedge.exe	80
PID 640 wrote to memory of 3560	640	msedge.exe	80
PID 640 wrote to memory of 3560	640	msedge.exe	80
PID 640 wrote to memory of 3560	640	msedge.exe	80
PID 640 wrote to memory of 3560	640	msedge.exe	80
PID 640 wrote to memory of 3560	640	msedge.exe	80
PID 640 wrote to memory of 3560	640	msedge.exe	80
PID 640 wrote to memory of 3560	640	msedge.exe	80
PID 640 wrote to memory of 3560	640	msedge.exe	80
PID 640 wrote to memory of 3560	640	msedge.exe	80
PID 640 wrote to memory of 3560	640	msedge.exe	80
PID 640 wrote to memory of 3560	640	msedge.exe	80
PID 640 wrote to memory of 3560	640	msedge.exe	80
PID 640 wrote to memory of 3560	640	msedge.exe	80
PID 640 wrote to memory of 3560	640	msedge.exe	80
PID 640 wrote to memory of 3560	640	msedge.exe	80
PID 640 wrote to memory of 3560	640	msedge.exe	80
PID 640 wrote to memory of 3560	640	msedge.exe	80
PID 640 wrote to memory of 3560	640	msedge.exe	80
PID 640 wrote to memory of 3560	640	msedge.exe	80

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	setup7.0.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	setup7.0.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/fdh54h54h54hg/57547547g/releases/download/Download/Setup7.0.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbea2c3cb8,0x7ffbea2c3cc8,0x7ffbea2c3cd8
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,6874846109303939599,8247085418641019237,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,6874846109303939599,8247085418641019237,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,6874846109303939599,8247085418641019237,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 /prefetch:8
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,6874846109303939599,8247085418641019237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,6874846109303939599,8247085418641019237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,6874846109303939599,8247085418641019237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,6874846109303939599,8247085418641019237,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,6874846109303939599,8247085418641019237,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,6874846109303939599,8247085418641019237,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1472

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1628

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1656

C:\Users\Admin\Downloads\Setup7.0\setup7.0.exe
"C:\Users\Admin\Downloads\Setup7.0\setup7.0.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- NTFS ADS
PID:2748
- C:\Users\Admin\Downloads\Setup7.0\setup7.0.exe
  "C:\Users\Admin\Downloads\Setup7.0\setup7.0.exe"
  2⤵
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:660
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\Downloads\Setup7.0\setup7.0.exe"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4324
  - - C:\Windows\system32\PING.EXE
      ping 1.1.1.1 -n 1 -w 3000
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
826c7cac03e3ae47bfe2a7e50281605e

SHA1
100fbea3e078edec43db48c3312fbbf83f11fca0

SHA256
239b1d7cc6f76e1d1832b0587664f114f38a21539cb8548e25626ed5053ea2ab

SHA512
a82f3c817a6460fd8907a4ac6ab37c2129fb5466707edcfb565c255680d7f7212a5669fe2a42976150f16e4e549ea8310078f22ed35514ee1b7b45b46d8cc96e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
02a4b762e84a74f9ee8a7d8ddd34fedb

SHA1
4a870e3bd7fd56235062789d780610f95e3b8785

SHA256
366e497233268d7cdf699242e4b2c7ecc1999d0a84e12744f5af2b638e9d86da

SHA512
19028c45f2e05a0cb32865a2554513c1536bf9da63512ff4e964c94a3e171f373493c7787d2d2a6df8012648bbefab63a9de924f119c50c39c727cf81bdc659f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
116KB

MD5
27f8b22ae5d65b7a0a963633030cfbce

SHA1
69ac50fb760788a0db3e5cbdc0f23c99001e0486

SHA256
8fbdfe7bf03c4ceb8b905d980dfba2a1aa5876c21545c61ec17335d444c1ce67

SHA512
db30e39dbd156eefbf19b6f66c2909ba65490324beba96870cdbdcd88da7410c9ebb45e933438222f1da5da1c19ed6e5f9d33f68a74b49ffd1e4eb2d33eac054

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
334B

MD5
abcaea02e73806cb7786b41f0801943c

SHA1
4bcda9216be57c746e0242aa2f50a3d67b0febaa

SHA256
d391829d7df0b44ea3d605fb0927c10d71302607c1bdd33923b34e04db83ee9a

SHA512
643677d15b6e4c28bb2e39ac5b901d22acee99c0141d7f4898d6848ac8665bb6b680718cdeda68feb14f250eefd1813fdd333b99ef731005eb04013fb24f34c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
265B

MD5
f5cd008cf465804d0e6f39a8d81f9a2d

SHA1
6b2907356472ed4a719e5675cc08969f30adc855

SHA256
fcea95cc39dc6c2a925f5aed739dbedaa405ee4ce127f535fcf1c751b2b8fb5d

SHA512
dc97034546a4c94bdaa6f644b5cfd1e477209de9a03a5b02a360c254a406c1d647d6f90860f385e27387b35631c41f0886cb543ede9116436941b9af6cd3285d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a7ba087cb8fad7ec0745e23a7c81797b

SHA1
29a91e09f033291dbda6fe62cd16fc94c20d6f19

SHA256
01c4d6fb8abf2954976eb2373120100aaad6c160846b2534459d84c9d154c4ff

SHA512
436e25f13e86bf8d7757d693d76151729a6dda8c4b547893cd375c0adc371df91583bdfe6ec2eb3182b565c24715515be6baba9aa5347c76828bb8fab7d29785

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b264dece628b51f3ce5953396a565999

SHA1
70219dd465381982aa24c4f96bf52c98d44b740e

SHA256
43952ca5dd408facecb40a897988d0f4b6b043055f74b67e922ca37a079e3848

SHA512
2ea374350565577323e3ec17fcf67191f62cdf1ce187bd2bc4a8ff810b50f6f3765b92f72ecd0085b575265469738e103c344e2c9741cb41e8f50596ac5e3877

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ab4576c853a09ab487904d3fdc2a4c56

SHA1
8536e1dba2f1df0ce48b92b541dfdc174783b933

SHA256
41045d7d49b82f68aebf73f05c3aec42635b30af841682adbe8650d1602160c0

SHA512
62c92f0df03fbe110f152a1361d0da18dfb7ba110bfcb00b3578a9b11caf69c981c7f75a2109a98ad1b486e48848205c7d48ad1361f7b3c09b31bb315f28e06d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
348227869b98e806ab52fce93049b16e

SHA1
5a392bf480d89452998019f15a460d46b1b42529

SHA256
8bb5e361059af520c95b4867df6012646a7064941abf9de07fcd6c1b04c67887

SHA512
0a2c9fe70276443c21163c784ea63e37664157462b11c2f58b3aaebfb4c1ac96f792c4b5583e81a8ddfb99173aa4be102369516cef240dac61354e14c1817762

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cac0395f300d8db0b50470ab677c0689

SHA1
91b5c5fe22e9d2d1bcdf0ce573e2aff30730764e

SHA256
748a0d94f61bbe415d4ceeb1ea098c85a22b2e358f939d632804cc65a61f2e07

SHA512
840194dbf9b69c8da09feaf2538baf6699161b21c7547c1ba8e53b7f1919b404f6c7568b9d4f68ee0e8e75a7dddb5375db716ce6e1961eaf3e526cf7b74cc8b5

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
71a6b59e08e25451e52675c842fae23c

SHA1
565a97673954a9209c7a05fba20b89d10b88025f

SHA256
5b96212d3d1347b76c8c1c64b2f7ef981242bedd3b84b766b543d56dbbf8dbd6

SHA512
5cc98eb2aa02e2e69165170451d89dd880893e6b07440bb84fbab6cf92cb558bd58c2235d8d64ff43d380c5e9869827800d310ee67950bb21b498d89fbb5aab3

Download Submit
C:\Users\Admin\Downloads\Setup7.0.zip

Filesize
1.3MB

MD5
caf07843d0eec5fd5d9b131256361752

SHA1
1ce0acf5f2b521752440ce6d1c108a365a1dca50

SHA256
abdc12b4bb4b9a7309bc067be6b097a4e11b0dccbf19494edb971b510303c923

SHA512
b72e81797f4d3264b12675e2d35c56d76ec9110c3814776068d23a51c5de20ed3bd0dd414fb3f0564633b408dc040eaf8407c5e319df7014c9249e5fbaea2839

Download Submit
C:\Users\Admin\Downloads\Setup7.0.zip:Zone.Identifier

Filesize
545B

MD5
bd351cfb4347c0a828ea61183ba0e059

SHA1
281a000ef4e73c44216e4af87dc87166fd7b0c9e

SHA256
52b00e5fca47e413b41e6183e538d409f9de52eb4a26c36d0cfac2bb89ce7ba3

SHA512
10579a9473c067874c95f0dc43989539016c1e42973149bfa77c6bb6277f95af4418bad1e7578d1b9b5a40943d4e51733529406174cf9d8c9e1ebc73ecdf3e4e

Download Submit
C:\Users\Admin\Downloads\Setup7.0\setup7.0.exe

Filesize
1.7MB

MD5
2c685fc5572fee6107d76c17fa873a45

SHA1
05436164ce59ab80e0bcae7aa779b2426866446e

SHA256
f585f729ebcdaf7a70e16690398cca0036d1dd4c398b4044004e7ab0ccc6bf56

SHA512
6bd9fbf04c75c0a6a07846233e5cb31f7f8373f3bd2fc62f70f27c34d37d640d80647ca980530ba99d77586a954c73899a257e1dc2e422279a0c46f69e2107e3

Download Submit
C:\Users\Admin\Downloads\Setup7.0\setup7.0.exe:a.dll

Filesize
1.4MB

MD5
d9a74092beacfbf63708895c03774dce

SHA1
44b28f038e8aabd1718b904ebc58a91b7f8be103

SHA256
6abbad8087891836e562bdf0420ce019471b649574caf68a938e300e9c546793

SHA512
4dec51a48b700ec4585bef9edd6d329dca1b562eae7e0609dd05462b4810f457e94fbefcd25e2853f27f36c4b8707676f34075cfe1ce2f00830d23a4a3a32f2e

Download Submit
memory/660-175-0x0000000140000000-0x000000014013B000-memory.dmp

Filesize
1.2MB

Download
memory/660-170-0x0000000140000000-0x000000014013B000-memory.dmp

Filesize
1.2MB

Download
memory/2748-174-0x00007FFBE9D80000-0x00007FFBE9EE4000-memory.dmp

Filesize
1.4MB

Download
memory/2748-173-0x00007FF602F00000-0x00007FF6030B5000-memory.dmp

Filesize
1.7MB

Download