Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-02-2024 10:10

General

  • Target

    https://shorten.world/Qda4K

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://questbehavixoporpo.shop/api

https://technologyenterdo.shop/api

https://detectordiscusser.shop/api

https://turkeyunlikelyofw.shop/api

https://associationokeo.shop/api

Signatures

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • Executes dropped EXE 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 39 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://shorten.world/Qda4K
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1124
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd9d7846f8,0x7ffd9d784708,0x7ffd9d784718
      2⤵
        PID:5096
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,16426151728055538619,16854066390357095709,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1892
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,16426151728055538619,16854066390357095709,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
        2⤵
          PID:3784
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,16426151728055538619,16854066390357095709,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
          2⤵
            PID:4160
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16426151728055538619,16854066390357095709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
            2⤵
              PID:1676
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16426151728055538619,16854066390357095709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
              2⤵
                PID:4836
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,16426151728055538619,16854066390357095709,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
                2⤵
                  PID:3056
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,16426151728055538619,16854066390357095709,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3052
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16426151728055538619,16854066390357095709,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
                  2⤵
                    PID:4572
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16426151728055538619,16854066390357095709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
                    2⤵
                      PID:2892
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2088,16426151728055538619,16854066390357095709,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4736 /prefetch:8
                      2⤵
                        PID:2724
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16426151728055538619,16854066390357095709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
                        2⤵
                          PID:2884
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,16426151728055538619,16854066390357095709,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3420 /prefetch:8
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1928
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16426151728055538619,16854066390357095709,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
                          2⤵
                            PID:4384
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16426151728055538619,16854066390357095709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
                            2⤵
                              PID:4980
                            • C:\Program Files\7-Zip\7zFM.exe
                              "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Setup.rar"
                              2⤵
                              • Suspicious behavior: GetForegroundWindowSpam
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of FindShellTrayWindow
                              PID:2500
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,16426151728055538619,16854066390357095709,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2652 /prefetch:2
                              2⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4480
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:1344
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:3304
                              • C:\Windows\System32\rundll32.exe
                                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                1⤵
                                  PID:4480
                                • C:\Program Files\7-Zip\7zFM.exe
                                  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Setup.rar"
                                  1⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of FindShellTrayWindow
                                  PID:4808
                                • C:\Program Files\7-Zip\7zG.exe
                                  "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Setup\" -ad -an -ai#7zMap19806:72:7zEvent9872
                                  1⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of FindShellTrayWindow
                                  PID:2416
                                • C:\Users\Admin\Downloads\Setup\Setup\Setup.exe
                                  "C:\Users\Admin\Downloads\Setup\Setup\Setup.exe"
                                  1⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  PID:4168
                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe
                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe"
                                    2⤵
                                      PID:2376
                                  • C:\Windows\system32\taskmgr.exe
                                    "C:\Windows\system32\taskmgr.exe" /0
                                    1⤵
                                    • Checks SCSI registry key(s)
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of FindShellTrayWindow
                                    • Suspicious use of SendNotifyMessage
                                    PID:4592
                                  • C:\Users\Admin\Downloads\Setup\Setup\Setup.exe
                                    "C:\Users\Admin\Downloads\Setup\Setup\Setup.exe"
                                    1⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    PID:3848
                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe
                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe"
                                      2⤵
                                        PID:4472
                                    • C:\Windows\system32\taskmgr.exe
                                      "C:\Windows\system32\taskmgr.exe" /0
                                      1⤵
                                      • Checks SCSI registry key(s)
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of SendNotifyMessage
                                      PID:4256
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault8c46d374h5128h4937h8093hc355b2346fdf
                                      1⤵
                                        PID:4808
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffd9d7846f8,0x7ffd9d784708,0x7ffd9d784718
                                          2⤵
                                            PID:64
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,16311619357239854838,4374322960190044576,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
                                            2⤵
                                              PID:4076
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,16311619357239854838,4374322960190044576,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
                                              2⤵
                                                PID:3576

                                            Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

                                              Filesize

                                              64KB

                                              MD5

                                              d2fb266b97caff2086bf0fa74eddb6b2

                                              SHA1

                                              2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

                                              SHA256

                                              b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

                                              SHA512

                                              c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

                                            • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

                                              Filesize

                                              4B

                                              MD5

                                              f49655f856acb8884cc0ace29216f511

                                              SHA1

                                              cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                              SHA256

                                              7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                              SHA512

                                              599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                            • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

                                              Filesize

                                              944B

                                              MD5

                                              6bd369f7c74a28194c991ed1404da30f

                                              SHA1

                                              0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

                                              SHA256

                                              878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

                                              SHA512

                                              8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                              Filesize

                                              152B

                                              MD5

                                              cbec32729772aa6c576e97df4fef48f5

                                              SHA1

                                              6ec173d5313f27ba1e46ad66c7bbe7c0a9767dba

                                              SHA256

                                              d34331aa91a21e127bbe68f55c4c1898c429d9d43545c3253d317ffb105aa24e

                                              SHA512

                                              425b3638fed70da3bc16bba8b9878de528aca98669203f39473b931f487a614d3f66073b8c3d9bc2211e152b4bbdeceb2777001467954eec491f862912f3c7a0

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                              Filesize

                                              152B

                                              MD5

                                              279e783b0129b64a8529800a88fbf1ee

                                              SHA1

                                              204c62ec8cef8467e5729cad52adae293178744f

                                              SHA256

                                              3619c3b82a8cbdce37bfd88b66d4fdfcd728a1112b05eb26998bea527d187932

                                              SHA512

                                              32730d9124dd28c196bd4abcfd6a283a04553f3f6b050c057264bc883783d30d6602781137762e66e1f90847724d0e994bddf6e729de11a809f263f139023d3b

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                              Filesize

                                              257B

                                              MD5

                                              8a1f6aaca0c7cd27e56df23fa976329b

                                              SHA1

                                              0fe9f0b8465e703bc4295ba57c87612f0e02f887

                                              SHA256

                                              b17dbf6b2aa09a7c7e18d7caa8a94b6aaaa32808ba1cce16d6a9c782b5f4f716

                                              SHA512

                                              fa771e644cdaad410acdc0535370096fe85362d2504b507f60d42ad0656517ef496d443f38d7b4459638df04b13a5b29451c8b329a93be2bc923edfb3d9938c9

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              6KB

                                              MD5

                                              2e6b47d9ccc6fa935813107b3eeabea6

                                              SHA1

                                              baca58491f6ae7bfaea059ad54c7867114157fdc

                                              SHA256

                                              38177618c2bacda02565c4a72b033bd158036d338f99087c23499ee74192f62b

                                              SHA512

                                              ef1cdf092c629136b1bb2f02f5567718ff6d75e1ecec0d2c660bae94fa064140ef7cde6d5c4d485dcccd8a582bf0a4ab32d72913d90d117a07f46ed33591da06

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              6KB

                                              MD5

                                              8878bfbee05ec6a58764d56264dc864c

                                              SHA1

                                              5598b67d76efb7d87c5bcab467fa2ef03cc1a1ef

                                              SHA256

                                              a0822e727ea28f4ed5b60135678f4135b12aeb4e0b034040c09b473a69466d5b

                                              SHA512

                                              2e03f99901e33458259497293208a904c588a530a3d0d2972d7cc46c1f3fb07ad4980ed3f9cb33d06ab0b158ef1802abc51295ed9444495f0f9b190d8b4d8e2a

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                              Filesize

                                              16B

                                              MD5

                                              6752a1d65b201c13b62ea44016eb221f

                                              SHA1

                                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                              SHA256

                                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                              SHA512

                                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                              Filesize

                                              11KB

                                              MD5

                                              23ba711b07d396d918729095235b36ce

                                              SHA1

                                              f15f3dcc7bd93174267d63b1c1d143f3db5c7aae

                                              SHA256

                                              3d86295ac53fbddc211e97413101884f4d4b823047fb6c9728e1073928011023

                                              SHA512

                                              163c9e3d718307ffaedc45a538ee8dd67ccf4138235ea359006f5fbdbc8ec64582bd0ec36c400b99e7518dc4dbbd7c1e5905404c4fc858c895e39be4f33eb0b3

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                              Filesize

                                              12KB

                                              MD5

                                              c1082646b01661637f0fbc2d00ecb1db

                                              SHA1

                                              663079fbc99e25a4a1924ca9b9955bc469ae56dc

                                              SHA256

                                              dac22570f79aee7a32b9a7b5991be3ec0c819d824443a7e2b17c09aee0fa46bf

                                              SHA512

                                              9545bae242ea1b0139746ef702dd840f3d063f838a1dd1768116112fe38a7828c28974b821d82595463f07e9adcab803900c5da7a4788824d61195200378d7c5

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                              Filesize

                                              11KB

                                              MD5

                                              0ca60f8c97e2d104a1f1281b22fedf37

                                              SHA1

                                              cb672cb258b7429ed82dda2c3f05e0c5cd75ba44

                                              SHA256

                                              9829e608b818b91813d77c91b24ce72c619b4091e5eb792758122111d1ad68ea

                                              SHA512

                                              e89720500314924721ec97ba8b5232d987ea343df9c62f03137ea17ede891328539c0151c962fce633a1d5aca1fab21aae53bcf0c13c0538643cc92af2a7958c

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                              Filesize

                                              12KB

                                              MD5

                                              3d47b15998f10b8fd113b7079e351702

                                              SHA1

                                              e950c76c56cbf41d0268136cc967326c35ad2a2e

                                              SHA256

                                              d81735e43fe5b86901032b1d35ace69f44b3d224b972e01250e795139cee6e14

                                              SHA512

                                              93a93b85dba4095c826a357e38e012e48eb9639a1bae7887c59ccd539d0c18d2725e3016ff234547266dec71e43d65d46e13ed9446011ab802cb716bdb44185f

                                            • C:\Users\Admin\Downloads\Setup.rar

                                              Filesize

                                              3.8MB

                                              MD5

                                              ee6365ac77db4cf9f9709196c147e470

                                              SHA1

                                              2ef880fedfc81eb2169f3b8bfe9cbdce2eae6384

                                              SHA256

                                              523386bc7f1312f9542c55790fa4ca7e4421760fa5e993e3be4091117ec71510

                                              SHA512

                                              6797b3c8289d473136db5ec27b60f9a81b3b39754d5a4a1a5de249926431403f1bda2bb36553375b041af8be88a33d6f61b52737967639eeff991ec7ccf72ca8

                                            • C:\Users\Admin\Downloads\Setup\Setup\Setup.exe

                                              Filesize

                                              3.3MB

                                              MD5

                                              2db05ff7f2567f56a96818abe1e93404

                                              SHA1

                                              aa4180760834bdfd81610efa92a19bfda2d26736

                                              SHA256

                                              ca1740fe705be7202345394844ecf37af3f904bea7b95a936b08e61742a8ba77

                                              SHA512

                                              4686afba484d5731db9f4cdd2314d016031c48cab142990135e36ba01d35aa8883d3e094b2aa1d28948228253e4ca2a78af1e2d29e1eb7f524b243af8c926bd0

                                            • \??\pipe\LOCAL\crashpad_1124_DYJBEQOXUSJKSOFQ

                                              MD5

                                              d41d8cd98f00b204e9800998ecf8427e

                                              SHA1

                                              da39a3ee5e6b4b0d3255bfef95601890afd80709

                                              SHA256

                                              e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                              SHA512

                                              cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                            • memory/2376-154-0x0000000000CB0000-0x0000000000CF6000-memory.dmp

                                              Filesize

                                              280KB

                                            • memory/2376-157-0x0000000000CB0000-0x0000000000CF6000-memory.dmp

                                              Filesize

                                              280KB

                                            • memory/2376-159-0x0000000000CB0000-0x0000000000CF6000-memory.dmp

                                              Filesize

                                              280KB

                                            • memory/3848-180-0x00007FF7E9870000-0x00007FF7E9C16000-memory.dmp

                                              Filesize

                                              3.6MB

                                            • memory/4168-155-0x00007FF7E9870000-0x00007FF7E9C16000-memory.dmp

                                              Filesize

                                              3.6MB

                                            • memory/4256-197-0x00000140A0940000-0x00000140A0941000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4256-190-0x00000140A0940000-0x00000140A0941000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4256-199-0x00000140A0940000-0x00000140A0941000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4256-202-0x00000140A0940000-0x00000140A0941000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4256-200-0x00000140A0940000-0x00000140A0941000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4256-201-0x00000140A0940000-0x00000140A0941000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4256-198-0x00000140A0940000-0x00000140A0941000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4256-191-0x00000140A0940000-0x00000140A0941000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4256-192-0x00000140A0940000-0x00000140A0941000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4472-183-0x0000000000A60000-0x0000000000A61000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4472-207-0x0000000000A60000-0x0000000000A61000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4472-186-0x0000000000A60000-0x0000000000A92000-memory.dmp

                                              Filesize

                                              200KB

                                            • memory/4472-184-0x0000000000A60000-0x0000000000A61000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4472-223-0x0000000000A60000-0x0000000000A92000-memory.dmp

                                              Filesize

                                              200KB

                                            • memory/4472-222-0x0000000000A60000-0x0000000000A92000-memory.dmp

                                              Filesize

                                              200KB

                                            • memory/4472-221-0x0000000000A60000-0x0000000000A92000-memory.dmp

                                              Filesize

                                              200KB

                                            • memory/4472-182-0x0000000000580000-0x00000000005C6000-memory.dmp

                                              Filesize

                                              280KB

                                            • memory/4472-185-0x0000000000A60000-0x0000000000A92000-memory.dmp

                                              Filesize

                                              200KB

                                            • memory/4472-206-0x0000000000580000-0x00000000005C6000-memory.dmp

                                              Filesize

                                              280KB

                                            • memory/4472-178-0x0000000000580000-0x00000000005C6000-memory.dmp

                                              Filesize

                                              280KB

                                            • memory/4472-181-0x0000000000580000-0x00000000005C6000-memory.dmp

                                              Filesize

                                              280KB

                                            • memory/4592-170-0x0000023B27AC0000-0x0000023B27AC1000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4592-168-0x0000023B27AC0000-0x0000023B27AC1000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4592-172-0x0000023B27AC0000-0x0000023B27AC1000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4592-162-0x0000023B27AC0000-0x0000023B27AC1000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4592-166-0x0000023B27AC0000-0x0000023B27AC1000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4592-161-0x0000023B27AC0000-0x0000023B27AC1000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4592-167-0x0000023B27AC0000-0x0000023B27AC1000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4592-171-0x0000023B27AC0000-0x0000023B27AC1000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4592-169-0x0000023B27AC0000-0x0000023B27AC1000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4592-160-0x0000023B27AC0000-0x0000023B27AC1000-memory.dmp

                                              Filesize

                                              4KB