lumma | hxxps://drive[.]google[.]com/file/d/1D8OJJsMf-yxG5IUu6O4zl9cp3zNh3c6e/view?usp=drive_link

Analysis

max time kernel
113s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
29-07-2024 21:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1D8OJJsMf-yxG5IUu6O4zl9cp3zNh3c6e/view?usp=drive_link

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://kaminiasbbefow.shop/api

https://horizonvxjis.shop/api

https://effectivedoxzj.shop/api

https://parntorpkxzlp.shop/api

https://stimultaionsppzv.shop/api

https://grassytaisol.shop/api

https://broccoltisop.shop/api

https://shellfyyousdjz.shop/api

https://bravedreacisopm.shop/api

Extracted

Family

lumma

https://horizonvxjis.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma

Executes dropped EXE 1 IoCs

pid	Process
4328	Main.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
13	drive.google.com
15	drive.google.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4328 set thread context of 5276	4328	Main.exe	133

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2188	5276	WerFault.exe	133

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Main.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
624	msedge.exe
624	msedge.exe
1988	msedge.exe
1988	msedge.exe
2492	msedge.exe
2492	msedge.exe
5296	identity_helper.exe
5296	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	5628	7zG.exe
Token: 35	5628	7zG.exe
Token: SeSecurityPrivilege	5628	7zG.exe
Token: SeSecurityPrivilege	5628	7zG.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
5628	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 4736	1988	msedge.exe	85
PID 1988 wrote to memory of 4736	1988	msedge.exe	85
PID 1988 wrote to memory of 4204	1988	msedge.exe	87
PID 1988 wrote to memory of 4204	1988	msedge.exe	87
PID 1988 wrote to memory of 4204	1988	msedge.exe	87
PID 1988 wrote to memory of 4204	1988	msedge.exe	87
PID 1988 wrote to memory of 4204	1988	msedge.exe	87
PID 1988 wrote to memory of 4204	1988	msedge.exe	87
PID 1988 wrote to memory of 4204	1988	msedge.exe	87
PID 1988 wrote to memory of 4204	1988	msedge.exe	87
PID 1988 wrote to memory of 4204	1988	msedge.exe	87
PID 1988 wrote to memory of 4204	1988	msedge.exe	87
PID 1988 wrote to memory of 4204	1988	msedge.exe	87
PID 1988 wrote to memory of 4204	1988	msedge.exe	87
PID 1988 wrote to memory of 4204	1988	msedge.exe	87
PID 1988 wrote to memory of 4204	1988	msedge.exe	87
PID 1988 wrote to memory of 4204	1988	msedge.exe	87
PID 1988 wrote to memory of 4204	1988	msedge.exe	87
PID 1988 wrote to memory of 4204	1988	msedge.exe	87
PID 1988 wrote to memory of 4204	1988	msedge.exe	87
PID 1988 wrote to memory of 4204	1988	msedge.exe	87
PID 1988 wrote to memory of 4204	1988	msedge.exe	87
PID 1988 wrote to memory of 4204	1988	msedge.exe	87
PID 1988 wrote to memory of 4204	1988	msedge.exe	87
PID 1988 wrote to memory of 4204	1988	msedge.exe	87
PID 1988 wrote to memory of 4204	1988	msedge.exe	87
PID 1988 wrote to memory of 4204	1988	msedge.exe	87
PID 1988 wrote to memory of 4204	1988	msedge.exe	87
PID 1988 wrote to memory of 4204	1988	msedge.exe	87
PID 1988 wrote to memory of 4204	1988	msedge.exe	87
PID 1988 wrote to memory of 4204	1988	msedge.exe	87
PID 1988 wrote to memory of 4204	1988	msedge.exe	87
PID 1988 wrote to memory of 4204	1988	msedge.exe	87
PID 1988 wrote to memory of 4204	1988	msedge.exe	87
PID 1988 wrote to memory of 4204	1988	msedge.exe	87
PID 1988 wrote to memory of 4204	1988	msedge.exe	87
PID 1988 wrote to memory of 4204	1988	msedge.exe	87
PID 1988 wrote to memory of 4204	1988	msedge.exe	87
PID 1988 wrote to memory of 4204	1988	msedge.exe	87
PID 1988 wrote to memory of 4204	1988	msedge.exe	87
PID 1988 wrote to memory of 4204	1988	msedge.exe	87
PID 1988 wrote to memory of 4204	1988	msedge.exe	87
PID 1988 wrote to memory of 624	1988	msedge.exe	88
PID 1988 wrote to memory of 624	1988	msedge.exe	88
PID 1988 wrote to memory of 232	1988	msedge.exe	89
PID 1988 wrote to memory of 232	1988	msedge.exe	89
PID 1988 wrote to memory of 232	1988	msedge.exe	89
PID 1988 wrote to memory of 232	1988	msedge.exe	89
PID 1988 wrote to memory of 232	1988	msedge.exe	89
PID 1988 wrote to memory of 232	1988	msedge.exe	89
PID 1988 wrote to memory of 232	1988	msedge.exe	89
PID 1988 wrote to memory of 232	1988	msedge.exe	89
PID 1988 wrote to memory of 232	1988	msedge.exe	89
PID 1988 wrote to memory of 232	1988	msedge.exe	89
PID 1988 wrote to memory of 232	1988	msedge.exe	89
PID 1988 wrote to memory of 232	1988	msedge.exe	89
PID 1988 wrote to memory of 232	1988	msedge.exe	89
PID 1988 wrote to memory of 232	1988	msedge.exe	89
PID 1988 wrote to memory of 232	1988	msedge.exe	89
PID 1988 wrote to memory of 232	1988	msedge.exe	89
PID 1988 wrote to memory of 232	1988	msedge.exe	89
PID 1988 wrote to memory of 232	1988	msedge.exe	89
PID 1988 wrote to memory of 232	1988	msedge.exe	89
PID 1988 wrote to memory of 232	1988	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1D8OJJsMf-yxG5IUu6O4zl9cp3zNh3c6e/view?usp=drive_link
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c47d46f8,0x7ff8c47d4708,0x7ff8c47d4718
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,9978705374193610274,16898069526052453670,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,9978705374193610274,16898069526052453670,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,9978705374193610274,16898069526052453670,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9978705374193610274,16898069526052453670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9978705374193610274,16898069526052453670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9978705374193610274,16898069526052453670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2136,9978705374193610274,16898069526052453670,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9978705374193610274,16898069526052453670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,9978705374193610274,16898069526052453670,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9978705374193610274,16898069526052453670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9978705374193610274,16898069526052453670,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,9978705374193610274,16898069526052453670,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,9978705374193610274,16898069526052453670,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9978705374193610274,16898069526052453670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6460 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9978705374193610274,16898069526052453670,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:5332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1688

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5256

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Main (1)\" -ad -an -ai#7zMap1438:78:7zEvent13115
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5628

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Main (1)\Main\Instruction.txt
1⤵
PID:5844

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Main (1)\Main\proxy.txt
1⤵
PID:3944

C:\Users\Admin\Downloads\Main (1)\Main\Main.exe
"C:\Users\Admin\Downloads\Main (1)\Main\Main.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4328
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5276
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5276 -s 868
    3⤵
    - Program crash
    PID:2188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5276 -ip 5276
1⤵
PID:6112

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Main (1)\Main\output.txt
1⤵
PID:5648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bafce9e4c53a0cb85310891b6b21791b

SHA1
5d70027cc137a7cbb38f5801b15fd97b05e89ee2

SHA256
71fb546b5d2210a56e90b448ee10120cd92c518c8f79fb960f01b918f89f2b00

SHA512
c0e4d3eccc0135ac92051539a18f64b8b8628cfe74e5b019d4f8e1dcbb51a9b49c486a1523885fe6be53da7118c013852e753c26a5490538c1e721fd0188836c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a499254d6b5d91f97eb7a86e5f8ca573

SHA1
03dbfebfec8c94a9c06f9b0cd81ebe0a2b8be3d1

SHA256
fb87b758c2b98989df851380293ff6786cb9a5cf2b3a384cec70d9f3eb064499

SHA512
d7adcc76d0470bcd68d7644de3c8d2b6d61df8485979a4752ceea3df4d85bd1c290f72b3d8d5c8d639d5a10afa48d80e457f76b44dd8107ac97eb80fd98c7b0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
5ad903ece2c437acbc57f1ef88d9ad65

SHA1
6a87fc1461a28401b643bae36832ff985d853351

SHA256
81fbd8ec45296bd367ee0e1b3ef8c6020d4268b9109ff30952fbabc4b65a822b

SHA512
7db330c6e4c26586c71d461a5777ba26f13fc1e4d8c4f0567e54acd75947b16f79e221cd3d0915b6f13ee978b731ae03fdfbf9014fd42ff51302258a63c19d28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
637c4510c2cf03667aeb58167dd9fb06

SHA1
7ca53525dca8608813d3695dde075e1aeef11023

SHA256
18a272472237e4c882c82cf7bfc512ff4a0ee934330906412cbf0144ff5bfb29

SHA512
9ad64ba0276cd282faa7c6551c9e323ddf70670b0227d5bcf46a8cfbf8048cc0a696bebe64ed7acaa1bac6cbf4280085db35fff322380728c9494f5b7908cb73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b4d4f539de02b64a04ee69103f8265a0

SHA1
b93534da0a96b3a49f216b1eadf2b1795e939814

SHA256
96777b01c06dde3bddc5a0cdb6422f14fa7ba2055f134611fac2182500306695

SHA512
a21b9f3fca8bc83f5d4c867a9f8c216b719f8aa44c8f2c1f8fb1439332c26b23f09f6de4bfa506c108e7ec0b6e2d1b2db55e286ce2c632dc8fc39a03708a94b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
44789a8b7f8511290238ded2fc54dbe3

SHA1
79d3a5742fc4eea4ad23a51cb4f264612f3253ac

SHA256
7e03464ca3f54f545c839620b6c6fa17f3bc083b74ae3b5889a02289fe833b33

SHA512
8a6bf19dd620598a70ab0acc5956ddb771da386d293d908c907cfafa15cbd7417ac917a82f8d3198e2a467109ba8b5888775bdd22dbfcb38a6de12110fa918c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
77e8fc55c366d21a7600572cf7bc1a1f

SHA1
241c08be1b8b6fc31b28ef1efa9303d19c7711e0

SHA256
2d94dd97aa2a498d631abbed7b87c6464c018c51da11a117f73f94abe1d337dd

SHA512
2856224765f0582196d37b1ea6b241c3e743b6e9fafb4aef20abbc9d890b5c1226b8fa8defb2a700da79a2daafdd414fabe55002b5f86f848e520c7a5af5b486

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a805c8758feaf0a830d0eacff430b796

SHA1
fcaebd3bad757ab1d630e38ad9f75efd8bd74416

SHA256
16e87f80101084dcb353272954d19947e6ec29a0b2ef667fb9b9557f9f99b38c

SHA512
64210a40b9a0c87e30b7970e2206de52dfa72e3f1fccfcfb03f485546dfceb5ffca074d273e6476ab2238116d65d1b225bdec11c47b922fbdf2fee12089f6cca

Download Submit
C:\Users\Admin\Downloads\Main (1)\Main\Instruction.txt

Filesize
154B

MD5
8e19bd05b12065a4c547a6e919eb4e42

SHA1
c2381ebebb3fefcd4c3625b6dcad86557e692234

SHA256
5c03dcdda71119fa5bfad076bec87320295c3ae601151382c44a894bdaf0d21f

SHA512
61b874eacd350a9feb571058d4096a42ffae6b141dab5391c77898b60c3d035807221735467af56ccb957394b7f87499df7f41c6f46cd7c5a368fc90d412782f

Download Submit
C:\Users\Admin\Downloads\Main (1)\Main\Main.exe

Filesize
521KB

MD5
98455c0df4aae673a4715d71afad2c5f

SHA1
da48917d453ca73fbaeea46e7e857af0b9402112

SHA256
c16f0c5883cf636187f80467435851e2f966e47d9797e6a7b0be44d61018f5bc

SHA512
11bd87ea1606f7592f09b07aea73485624a4590f209e64514643680bc2775f0d1a5ff1bb1d492476d654c27994ee38c083f83322d27dc69fdd7d1082468830b4

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 999601.crdownload

Filesize
419KB

MD5
11e40cd744c1b342988a44c3632b360d

SHA1
6377ebcf8b46eb0bef07321c4ebebb29f1b13565

SHA256
f00c12f1feff9ffc6822df557ddfdcef9202e9262169cd3073a64560159efcc6

SHA512
59ad5d806273828c7e5aca95d3fe9181128c8f92e7da561f663718002a4067e5ce061b18a3993ef7931fcb0289d1361c9000cb4175d600f138de4d6ebda05392

Download Submit
memory/5276-180-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/5276-181-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download