lucastealer | hxxps://github[.]com/Gl0bster/Clipper/blob/main/Clipper_Builder[.]exe

Analysis

max time kernel
281s
max time network
281s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
29-09-2023 15:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Gl0bster/Clipper/blob/main/Clipper_Builder.exe

Score

10^/10

lucastealer stealer

Malware Config

Signatures

Luca Stealer
Info stealer written in Rust first seen in July 2022.
stealer lucastealer

Luca Stealer payload 10 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023239-203.dat	family_lucastealer
behavioral1/files/0x0008000000023239-247.dat	family_lucastealer
behavioral1/files/0x0008000000023239-249.dat	family_lucastealer
behavioral1/files/0x0008000000023239-295.dat	family_lucastealer
behavioral1/files/0x0008000000023239-296.dat	family_lucastealer
behavioral1/files/0x0008000000023239-297.dat	family_lucastealer
behavioral1/files/0x0008000000023239-298.dat	family_lucastealer
behavioral1/files/0x0008000000023239-299.dat	family_lucastealer
behavioral1/files/0x0008000000023239-313.dat	family_lucastealer
behavioral1/files/0x0008000000023239-316.dat	family_lucastealer

Downloads MZ/PE file

Executes dropped EXE 8 IoCs

pid	Process
1520	Clipper_Builder.exe
4932	Clipper_Builder.exe
2636	Clipper_Builder.exe
540	Clipper_Builder.exe
4340	Clipper_Builder.exe
4664	Clipper_Builder.exe
3808	Clipper_Builder.exe
4780	Clipper_Builder.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 595166.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2356	msedge.exe
2356	msedge.exe
2940	msedge.exe
2940	msedge.exe
3436	identity_helper.exe
3436	identity_helper.exe
456	msedge.exe
456	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 1280	2940	msedge.exe	50
PID 2940 wrote to memory of 1280	2940	msedge.exe	50
PID 2940 wrote to memory of 1896	2940	msedge.exe	86
PID 2940 wrote to memory of 1896	2940	msedge.exe	86
PID 2940 wrote to memory of 1896	2940	msedge.exe	86
PID 2940 wrote to memory of 1896	2940	msedge.exe	86
PID 2940 wrote to memory of 1896	2940	msedge.exe	86
PID 2940 wrote to memory of 1896	2940	msedge.exe	86
PID 2940 wrote to memory of 1896	2940	msedge.exe	86
PID 2940 wrote to memory of 1896	2940	msedge.exe	86
PID 2940 wrote to memory of 1896	2940	msedge.exe	86
PID 2940 wrote to memory of 1896	2940	msedge.exe	86
PID 2940 wrote to memory of 1896	2940	msedge.exe	86
PID 2940 wrote to memory of 1896	2940	msedge.exe	86
PID 2940 wrote to memory of 1896	2940	msedge.exe	86
PID 2940 wrote to memory of 1896	2940	msedge.exe	86
PID 2940 wrote to memory of 1896	2940	msedge.exe	86
PID 2940 wrote to memory of 1896	2940	msedge.exe	86
PID 2940 wrote to memory of 1896	2940	msedge.exe	86
PID 2940 wrote to memory of 1896	2940	msedge.exe	86
PID 2940 wrote to memory of 1896	2940	msedge.exe	86
PID 2940 wrote to memory of 1896	2940	msedge.exe	86
PID 2940 wrote to memory of 1896	2940	msedge.exe	86
PID 2940 wrote to memory of 1896	2940	msedge.exe	86
PID 2940 wrote to memory of 1896	2940	msedge.exe	86
PID 2940 wrote to memory of 1896	2940	msedge.exe	86
PID 2940 wrote to memory of 1896	2940	msedge.exe	86
PID 2940 wrote to memory of 1896	2940	msedge.exe	86
PID 2940 wrote to memory of 1896	2940	msedge.exe	86
PID 2940 wrote to memory of 1896	2940	msedge.exe	86
PID 2940 wrote to memory of 1896	2940	msedge.exe	86
PID 2940 wrote to memory of 1896	2940	msedge.exe	86
PID 2940 wrote to memory of 1896	2940	msedge.exe	86
PID 2940 wrote to memory of 1896	2940	msedge.exe	86
PID 2940 wrote to memory of 1896	2940	msedge.exe	86
PID 2940 wrote to memory of 1896	2940	msedge.exe	86
PID 2940 wrote to memory of 1896	2940	msedge.exe	86
PID 2940 wrote to memory of 1896	2940	msedge.exe	86
PID 2940 wrote to memory of 1896	2940	msedge.exe	86
PID 2940 wrote to memory of 1896	2940	msedge.exe	86
PID 2940 wrote to memory of 1896	2940	msedge.exe	86
PID 2940 wrote to memory of 1896	2940	msedge.exe	86
PID 2940 wrote to memory of 2356	2940	msedge.exe	87
PID 2940 wrote to memory of 2356	2940	msedge.exe	87
PID 2940 wrote to memory of 4008	2940	msedge.exe	88
PID 2940 wrote to memory of 4008	2940	msedge.exe	88
PID 2940 wrote to memory of 4008	2940	msedge.exe	88
PID 2940 wrote to memory of 4008	2940	msedge.exe	88
PID 2940 wrote to memory of 4008	2940	msedge.exe	88
PID 2940 wrote to memory of 4008	2940	msedge.exe	88
PID 2940 wrote to memory of 4008	2940	msedge.exe	88
PID 2940 wrote to memory of 4008	2940	msedge.exe	88
PID 2940 wrote to memory of 4008	2940	msedge.exe	88
PID 2940 wrote to memory of 4008	2940	msedge.exe	88
PID 2940 wrote to memory of 4008	2940	msedge.exe	88
PID 2940 wrote to memory of 4008	2940	msedge.exe	88
PID 2940 wrote to memory of 4008	2940	msedge.exe	88
PID 2940 wrote to memory of 4008	2940	msedge.exe	88
PID 2940 wrote to memory of 4008	2940	msedge.exe	88
PID 2940 wrote to memory of 4008	2940	msedge.exe	88
PID 2940 wrote to memory of 4008	2940	msedge.exe	88
PID 2940 wrote to memory of 4008	2940	msedge.exe	88
PID 2940 wrote to memory of 4008	2940	msedge.exe	88
PID 2940 wrote to memory of 4008	2940	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Gl0bster/Clipper/blob/main/Clipper_Builder.exe
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffba27c46f8,0x7ffba27c4708,0x7ffba27c4718
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,4614490710916325326,6038645976929542043,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,4614490710916325326,6038645976929542043,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2496 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,4614490710916325326,6038645976929542043,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4614490710916325326,6038645976929542043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4614490710916325326,6038645976929542043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,4614490710916325326,6038645976929542043,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,4614490710916325326,6038645976929542043,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4614490710916325326,6038645976929542043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4614490710916325326,6038645976929542043,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4614490710916325326,6038645976929542043,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4614490710916325326,6038645976929542043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4614490710916325326,6038645976929542043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2108,4614490710916325326,6038645976929542043,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2108,4614490710916325326,6038645976929542043,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2108,4614490710916325326,6038645976929542043,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:456
- C:\Users\Admin\Downloads\Clipper_Builder.exe
  "C:\Users\Admin\Downloads\Clipper_Builder.exe"
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Users\Admin\Downloads\Clipper_Builder.exe
  "C:\Users\Admin\Downloads\Clipper_Builder.exe"
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Users\Admin\Downloads\Clipper_Builder.exe
  "C:\Users\Admin\Downloads\Clipper_Builder.exe"
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Users\Admin\Downloads\Clipper_Builder.exe
  "C:\Users\Admin\Downloads\Clipper_Builder.exe"
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Users\Admin\Downloads\Clipper_Builder.exe
  "C:\Users\Admin\Downloads\Clipper_Builder.exe"
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Users\Admin\Downloads\Clipper_Builder.exe
  "C:\Users\Admin\Downloads\Clipper_Builder.exe"
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,4614490710916325326,6038645976929542043,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2820 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3776

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3408

C:\Users\Admin\Downloads\Clipper_Builder.exe
"C:\Users\Admin\Downloads\Clipper_Builder.exe"
1⤵
- Executes dropped EXE
PID:3808

C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Windows\system32\PcaSvc.dll,PcaPatchSdbTask
1⤵
PID:2460

C:\Users\Admin\Downloads\Clipper_Builder.exe
"C:\Users\Admin\Downloads\Clipper_Builder.exe"
1⤵
- Executes dropped EXE
PID:4780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
db9dbef3f8b1f616429f605c1ebca2f0

SHA1
ffba76f0836c024828d4ff1982cc4240c41a8f16

SHA256
3e0297327872058355ac041a5e0fc83ed017faee0f6c0105b44bb3e5399a93a1

SHA512
4eedc387fe304f27f9d52ff5d71461c7f22147f7a8c18b8e7982acb76515528a36486a567451daafe093f9563b133c6799f2ad046e04256ccb46c83eb99e86c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\65fc2d6c-e852-44ec-b09d-f14438061d60.tmp

Filesize
5KB

MD5
c1c1ccc016ca062f37d4fb9eb211af65

SHA1
998e3718a6e2fc3f856e7a2beeeb2def506ab265

SHA256
587f41008ad3de880936429d023a1dfe25aa8c87bef8ebda3da2ea3296669507

SHA512
6f83068973d069b3b492950e929696854be22f578cf9c716cec4fe09af400900a57a906cfc741f243b1f5bfc6e2cd7818f44038b5c2eb55e3c5ae5feca61382a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
f382193afab7d4ae1afb00ff3a6b8a55

SHA1
fa46aa8a2fb456ebf5839b349ee2a715a0b2ae2f

SHA256
867e8199493b599b4561a1e3bd89d36d256c833cb52c3a4888ecd9fc6f56a266

SHA512
0b89c819f0d3a3f9f537a82c22f670967ff0210aca022341aea58ee1ede34bdbc9e0ba682e7924f17050f946b24bd5dbfbd5cfcfbe2ca90bd5d43f2a1e8cf5ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
454e7cd4fbb0751ffa354ec86870a258

SHA1
716d6739a2a278446c3e9c16cb72d996d042bc89

SHA256
9cbad050449dd86a473ca97a90c4b4f6076f3174f52ae515de52cb4793f3d5ca

SHA512
83e6e36c576ef32a555d6a6e3ed9fe4ad51d7681bbfcc6421c29b15cadb0bcc918e4a9d6388ca0e1a1ca750830164ef64ca8015d07a0a2b8ec81fb17c5bc6f87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ea6c8a22da6dd3b766b18b7e94b05db1

SHA1
9c8f5e2866eb1d90a7209b6b3d4287ff7a6323e7

SHA256
b9ca18c313186c564c9ced1ab8825c4881f528104b2250c308ea1f9dc6d95a8e

SHA512
57555c34959aa3e010cedda9228f523bcd133c34dfc9414f4d4f7fe73cb37406ece401452e4a9733df5597e10ddf8c7f108a6c459bac0eee833dfb324a34feef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
aa2b61012f75e5d8d83c5c52cfb2b6c4

SHA1
89920c81c9902266b5c8a4cc8b47d8cbd32a1c86

SHA256
2617e8c9581c9055702d0e3ff98c63a89f37e35584712e2f049b6918c59058e4

SHA512
ddb895e636278ea3836ea1208157a0b24705c82dc6afcf0eb53d080f75fba3143b382c6e261004f54f580e76b753a473f5371346eccd0f7dec40cbcfc4243762

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8e1ebb3de80fd9fb122a512988c368fb

SHA1
7932d98d48b0d0e30108744a366021f39a570e39

SHA256
ffd4c1f019abfa2626f927406d80d1e13b7fadce329b504fbd563ceb054ea150

SHA512
6f891ee8f3d843a2dbf1517283ad2c062931bc6a8c700f7ef17637af88a9f0c1068f92e7685d83e58985103eba8df1325b46c89fb6e1442283f58a98232942d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
6dcb90ba1ba8e06c1d4f27ec78f6911a

SHA1
71e7834c7952aeb9f1aa6eb88e1959a1ae4985d9

SHA256
30d89e5026668c5a58bef231930a8bfb27ca099b24399a2615b210210d418416

SHA512
dc31807eaeb5221ac60d598035ca3ccab1dbeecc95caaff5e1f5a2a89ba1c83ef0a708ee0b8ed05b588ea5d50e360032a534356f84c89d3791df91d419daeff9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7fee2aa6ed83cb6d3ef2620113e3948b

SHA1
8b8f1b14d5046c5c7d9d56f731c3da8369a0b36a

SHA256
ae44b232990e05e199e1b1f278c112b8db838c9f1e9d753647dd3cb7b2894314

SHA512
cf655a59d5c9672bf9eda677f239ebd8c36c9cae08f41987d267d8d4837b481af0c88bd719b0bf0c18f92892293d9d1167d83abc541bbc1b212b0d1d4f5f4919

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0b6949c2db40bf9a0f79cbc2ffc5b575

SHA1
9a5f2c805ecb6bfd5052692590a5537819de70f2

SHA256
36ab3e6900fb0414b39bc2ed52d0a99383d1afa42b2017d50b457ffd26b986ea

SHA512
29c1e09f82e119df6f55ee484514df2941d56f2462d81b8d2729b5fb7ad67778aaf03385c0c777fe08824ba81fa4327f0a1f149208199a56900dcea9d589d42a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584ca4.TMP

Filesize
874B

MD5
4991911d820dfb43bd468fe89db3c85d

SHA1
84b5e002aa7d937fa26d3c2a25f6bd2e853a3db4

SHA256
d9e42a1e8b385a1205570181bfdf32cd45beb36913d25a47caa04d05f2efab14

SHA512
88bd8fda392d86e7a0930c26fc75af412faa262d835f8fa8973e1a723dc401f86da4cf3e365b0b840de86314478009fc170ee06a046ca007d38cdb8ac089bdd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
3KB

MD5
6ad3f360519db948f2e47d76cc372a4a

SHA1
1075cf864ce95af4a50e0c9264368ce4d0681413

SHA256
d7d97fcd6d13d761056718de0e11a00756a975f473a59bcd3be2635c6a876b5c

SHA512
5a88887b09e18b7718448f03e55084afd537f470ab112369b51d241f6727a30b3fb26a77a3d65b8fa6694c24f0eea1c12ce264f9f7932d7a9303be07fcf216d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fd4e631b72320ac3c0861da5aeab1108

SHA1
b8437fc1bbae5e4975dbf46fff01907519568d08

SHA256
8be9ac0f8ae39682b3b27d66da04e4eb4da0d68747bf94758079c5646fe7cfad

SHA512
f3ddf2eb7c18b9f91f96fd7c93ec97c4954e42b4278d8981a2656aaaeecdcde7db856d3a0f9c930844e026f98f95c97fea4d0fe3840c78fa2ad144a52bf1a1fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f8a7615f6ffb677200a9bd32f5adaab5

SHA1
c5a12d920664f5914113867e28055c001695c581

SHA256
3fba2443bd2e8cb21734613e2d42032dda0544212cf5513c5d3b2e5e7b9aecd3

SHA512
d577db98be40e885463dd80f7be4f92c524badbe61b4b1b08483a5c07e2074c910d8cd675849f6b21e84ba46428facb8c53a3abdc9579c35dbc47f86f0d24e0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
16a6f6966de4813d755cf23dfb250efa

SHA1
3a71bf0499abdf16d10d4b7a857d81e19a226635

SHA256
08d2d4278c6b8773643b1ce5f54dd179afa3242446b346e823f193f9617c2af5

SHA512
a9173711572a7e7d629fcf1e38883f05e3ced23e4e97daf04ea0033b12e04d12a4a0cfb14f1290a1bf3135aa52dddbb726588361cf995f511f30a185ada75b52

Download Submit
C:\Users\Admin\Downloads\Clipper_Builder.exe

Filesize
4.3MB

MD5
5de32d7f9611c2c9e4dc5320a492733b

SHA1
dc8c07fd970b59314f1a370c530af0c7a8ce5b44

SHA256
ae3cbc402fd619db699f5646542b84c00f791fcb740ec4b4ad2b6595070afa67

SHA512
3d1675e1c796e555aa00465c35ae6a707d2ba613da8f9ff62443eaac26e4aa0c79c816dc68638d21416bf446bad4910a2bedc52564b7b062b4a22a88103ffef3

Download Submit
C:\Users\Admin\Downloads\Clipper_Builder.exe

Filesize
4.3MB

MD5
5de32d7f9611c2c9e4dc5320a492733b

SHA1
dc8c07fd970b59314f1a370c530af0c7a8ce5b44

SHA256
ae3cbc402fd619db699f5646542b84c00f791fcb740ec4b4ad2b6595070afa67

SHA512
3d1675e1c796e555aa00465c35ae6a707d2ba613da8f9ff62443eaac26e4aa0c79c816dc68638d21416bf446bad4910a2bedc52564b7b062b4a22a88103ffef3

Download Submit
C:\Users\Admin\Downloads\Clipper_Builder.exe

Filesize
4.3MB

MD5
5de32d7f9611c2c9e4dc5320a492733b

SHA1
dc8c07fd970b59314f1a370c530af0c7a8ce5b44

SHA256
ae3cbc402fd619db699f5646542b84c00f791fcb740ec4b4ad2b6595070afa67

SHA512
3d1675e1c796e555aa00465c35ae6a707d2ba613da8f9ff62443eaac26e4aa0c79c816dc68638d21416bf446bad4910a2bedc52564b7b062b4a22a88103ffef3

Download Submit
C:\Users\Admin\Downloads\Clipper_Builder.exe

Filesize
4.3MB

MD5
5de32d7f9611c2c9e4dc5320a492733b

SHA1
dc8c07fd970b59314f1a370c530af0c7a8ce5b44

SHA256
ae3cbc402fd619db699f5646542b84c00f791fcb740ec4b4ad2b6595070afa67

SHA512
3d1675e1c796e555aa00465c35ae6a707d2ba613da8f9ff62443eaac26e4aa0c79c816dc68638d21416bf446bad4910a2bedc52564b7b062b4a22a88103ffef3

Download Submit
C:\Users\Admin\Downloads\Clipper_Builder.exe

Filesize
4.3MB

MD5
5de32d7f9611c2c9e4dc5320a492733b

SHA1
dc8c07fd970b59314f1a370c530af0c7a8ce5b44

SHA256
ae3cbc402fd619db699f5646542b84c00f791fcb740ec4b4ad2b6595070afa67

SHA512
3d1675e1c796e555aa00465c35ae6a707d2ba613da8f9ff62443eaac26e4aa0c79c816dc68638d21416bf446bad4910a2bedc52564b7b062b4a22a88103ffef3

Download Submit
C:\Users\Admin\Downloads\Clipper_Builder.exe

Filesize
4.3MB

MD5
5de32d7f9611c2c9e4dc5320a492733b

SHA1
dc8c07fd970b59314f1a370c530af0c7a8ce5b44

SHA256
ae3cbc402fd619db699f5646542b84c00f791fcb740ec4b4ad2b6595070afa67

SHA512
3d1675e1c796e555aa00465c35ae6a707d2ba613da8f9ff62443eaac26e4aa0c79c816dc68638d21416bf446bad4910a2bedc52564b7b062b4a22a88103ffef3

Download Submit
C:\Users\Admin\Downloads\Clipper_Builder.exe

Filesize
4.3MB

MD5
5de32d7f9611c2c9e4dc5320a492733b

SHA1
dc8c07fd970b59314f1a370c530af0c7a8ce5b44

SHA256
ae3cbc402fd619db699f5646542b84c00f791fcb740ec4b4ad2b6595070afa67

SHA512
3d1675e1c796e555aa00465c35ae6a707d2ba613da8f9ff62443eaac26e4aa0c79c816dc68638d21416bf446bad4910a2bedc52564b7b062b4a22a88103ffef3

Download Submit
C:\Users\Admin\Downloads\Clipper_Builder.exe

Filesize
4.3MB

MD5
5de32d7f9611c2c9e4dc5320a492733b

SHA1
dc8c07fd970b59314f1a370c530af0c7a8ce5b44

SHA256
ae3cbc402fd619db699f5646542b84c00f791fcb740ec4b4ad2b6595070afa67

SHA512
3d1675e1c796e555aa00465c35ae6a707d2ba613da8f9ff62443eaac26e4aa0c79c816dc68638d21416bf446bad4910a2bedc52564b7b062b4a22a88103ffef3

Download Submit
C:\Users\Admin\Downloads\Clipper_Builder.exe

Filesize
4.3MB

MD5
5de32d7f9611c2c9e4dc5320a492733b

SHA1
dc8c07fd970b59314f1a370c530af0c7a8ce5b44

SHA256
ae3cbc402fd619db699f5646542b84c00f791fcb740ec4b4ad2b6595070afa67

SHA512
3d1675e1c796e555aa00465c35ae6a707d2ba613da8f9ff62443eaac26e4aa0c79c816dc68638d21416bf446bad4910a2bedc52564b7b062b4a22a88103ffef3

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 595166.crdownload

Filesize
4.3MB

MD5
5de32d7f9611c2c9e4dc5320a492733b

SHA1
dc8c07fd970b59314f1a370c530af0c7a8ce5b44

SHA256
ae3cbc402fd619db699f5646542b84c00f791fcb740ec4b4ad2b6595070afa67

SHA512
3d1675e1c796e555aa00465c35ae6a707d2ba613da8f9ff62443eaac26e4aa0c79c816dc68638d21416bf446bad4910a2bedc52564b7b062b4a22a88103ffef3

Download Submit