lumma | hxxps://github[.]com/kelm75reallystrike/Roblox-Menu/releases/download/1/git[.]software[.]1[.]0[.]8[.]7z

Analysis

max time kernel
74s
max time network
70s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-08-2024 13:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/kelm75reallystrike/Roblox-Menu/releases/download/1/git.software.1.0.8.7z

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://sensitivyitszv.shop/api

https://applyzxcksdia.shop/api

https://replacedoxcjzp.shop/api

https://declaredczxi.shop/api

https://catchddkxozvp.shop/api

https://arriveoxpzxo.shop/api

https://contemplateodszsv.shop/api

https://bindceasdiwozx.shop/api

https://conformfucdioz.shop/api

Extracted

Family

lumma

https://sensitivyitszv.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma

Executes dropped EXE 1 IoCs

pid	Process
4068	git.software.1.0.8.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4068 set thread context of 3824	4068	git.software.1.0.8.exe	118

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2636	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
220	msedge.exe
220	msedge.exe
4896	msedge.exe
4896	msedge.exe
2092	identity_helper.exe
2092	identity_helper.exe
2624	msedge.exe
2624	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeRestorePrivilege	700	7zG.exe
Token: 35	700	7zG.exe
Token: SeSecurityPrivilege	700	7zG.exe
Token: SeSecurityPrivilege	700	7zG.exe
Token: SeRestorePrivilege	1336	7zG.exe
Token: 35	1336	7zG.exe
Token: SeSecurityPrivilege	1336	7zG.exe
Token: SeSecurityPrivilege	1336	7zG.exe
Token: SeRestorePrivilege	812	7zG.exe
Token: 35	812	7zG.exe
Token: SeSecurityPrivilege	812	7zG.exe
Token: SeSecurityPrivilege	812	7zG.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
700	7zG.exe
1336	7zG.exe
812	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 3252	4896	msedge.exe	83
PID 4896 wrote to memory of 3252	4896	msedge.exe	83
PID 4896 wrote to memory of 2316	4896	msedge.exe	84
PID 4896 wrote to memory of 2316	4896	msedge.exe	84
PID 4896 wrote to memory of 2316	4896	msedge.exe	84
PID 4896 wrote to memory of 2316	4896	msedge.exe	84
PID 4896 wrote to memory of 2316	4896	msedge.exe	84
PID 4896 wrote to memory of 2316	4896	msedge.exe	84
PID 4896 wrote to memory of 2316	4896	msedge.exe	84
PID 4896 wrote to memory of 2316	4896	msedge.exe	84
PID 4896 wrote to memory of 2316	4896	msedge.exe	84
PID 4896 wrote to memory of 2316	4896	msedge.exe	84
PID 4896 wrote to memory of 2316	4896	msedge.exe	84
PID 4896 wrote to memory of 2316	4896	msedge.exe	84
PID 4896 wrote to memory of 2316	4896	msedge.exe	84
PID 4896 wrote to memory of 2316	4896	msedge.exe	84
PID 4896 wrote to memory of 2316	4896	msedge.exe	84
PID 4896 wrote to memory of 2316	4896	msedge.exe	84
PID 4896 wrote to memory of 2316	4896	msedge.exe	84
PID 4896 wrote to memory of 2316	4896	msedge.exe	84
PID 4896 wrote to memory of 2316	4896	msedge.exe	84
PID 4896 wrote to memory of 2316	4896	msedge.exe	84
PID 4896 wrote to memory of 2316	4896	msedge.exe	84
PID 4896 wrote to memory of 2316	4896	msedge.exe	84
PID 4896 wrote to memory of 2316	4896	msedge.exe	84
PID 4896 wrote to memory of 2316	4896	msedge.exe	84
PID 4896 wrote to memory of 2316	4896	msedge.exe	84
PID 4896 wrote to memory of 2316	4896	msedge.exe	84
PID 4896 wrote to memory of 2316	4896	msedge.exe	84
PID 4896 wrote to memory of 2316	4896	msedge.exe	84
PID 4896 wrote to memory of 2316	4896	msedge.exe	84
PID 4896 wrote to memory of 2316	4896	msedge.exe	84
PID 4896 wrote to memory of 2316	4896	msedge.exe	84
PID 4896 wrote to memory of 2316	4896	msedge.exe	84
PID 4896 wrote to memory of 2316	4896	msedge.exe	84
PID 4896 wrote to memory of 2316	4896	msedge.exe	84
PID 4896 wrote to memory of 2316	4896	msedge.exe	84
PID 4896 wrote to memory of 2316	4896	msedge.exe	84
PID 4896 wrote to memory of 2316	4896	msedge.exe	84
PID 4896 wrote to memory of 2316	4896	msedge.exe	84
PID 4896 wrote to memory of 2316	4896	msedge.exe	84
PID 4896 wrote to memory of 2316	4896	msedge.exe	84
PID 4896 wrote to memory of 220	4896	msedge.exe	85
PID 4896 wrote to memory of 220	4896	msedge.exe	85
PID 4896 wrote to memory of 1396	4896	msedge.exe	86
PID 4896 wrote to memory of 1396	4896	msedge.exe	86
PID 4896 wrote to memory of 1396	4896	msedge.exe	86
PID 4896 wrote to memory of 1396	4896	msedge.exe	86
PID 4896 wrote to memory of 1396	4896	msedge.exe	86
PID 4896 wrote to memory of 1396	4896	msedge.exe	86
PID 4896 wrote to memory of 1396	4896	msedge.exe	86
PID 4896 wrote to memory of 1396	4896	msedge.exe	86
PID 4896 wrote to memory of 1396	4896	msedge.exe	86
PID 4896 wrote to memory of 1396	4896	msedge.exe	86
PID 4896 wrote to memory of 1396	4896	msedge.exe	86
PID 4896 wrote to memory of 1396	4896	msedge.exe	86
PID 4896 wrote to memory of 1396	4896	msedge.exe	86
PID 4896 wrote to memory of 1396	4896	msedge.exe	86
PID 4896 wrote to memory of 1396	4896	msedge.exe	86
PID 4896 wrote to memory of 1396	4896	msedge.exe	86
PID 4896 wrote to memory of 1396	4896	msedge.exe	86
PID 4896 wrote to memory of 1396	4896	msedge.exe	86
PID 4896 wrote to memory of 1396	4896	msedge.exe	86
PID 4896 wrote to memory of 1396	4896	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/kelm75reallystrike/Roblox-Menu/releases/download/1/git.software.1.0.8.7z
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe65f946f8,0x7ffe65f94708,0x7ffe65f94718
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,1925038863244463941,7505373408133107156,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,1925038863244463941,7505373408133107156,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,1925038863244463941,7505373408133107156,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1925038863244463941,7505373408133107156,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1925038863244463941,7505373408133107156,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,1925038863244463941,7505373408133107156,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,1925038863244463941,7505373408133107156,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1925038863244463941,7505373408133107156,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1925038863244463941,7505373408133107156,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,1925038863244463941,7505373408133107156,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1925038863244463941,7505373408133107156,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,1925038863244463941,7505373408133107156,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1925038863244463941,7505373408133107156,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1925038863244463941,7505373408133107156,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:3168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1000

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5072

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\git.software.1.0.8\" -spe -an -ai#7zMap10530:96:7zEvent3403
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:700

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\git.software.1.0.8\Setup\" -spe -an -ai#7zMap10777:108:7zEvent11104
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1336

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\git.software.1.0.8\Read me.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2636

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\git.software.1.0.8\Setup\" -spe -an -ai#7zMap20297:108:7zEvent14524
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:812

C:\Users\Admin\Downloads\git.software.1.0.8\Setup\git.software.1.0.8.exe
"C:\Users\Admin\Downloads\git.software.1.0.8\Setup\git.software.1.0.8.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4068
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
265B

MD5
f5cd008cf465804d0e6f39a8d81f9a2d

SHA1
6b2907356472ed4a719e5675cc08969f30adc855

SHA256
fcea95cc39dc6c2a925f5aed739dbedaa405ee4ce127f535fcf1c751b2b8fb5d

SHA512
dc97034546a4c94bdaa6f644b5cfd1e477209de9a03a5b02a360c254a406c1d647d6f90860f385e27387b35631c41f0886cb543ede9116436941b9af6cd3285d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
23cf229b553ca8a646a606b644705a2b

SHA1
d6de8acbe10ad17594064f7e1a0e6eee3c75026c

SHA256
b40d68be9a7c8f5832f51e45e5b8ad865c426a33f7aa552c46da6b9a842c2365

SHA512
d899d07aa01003ceaa94075e7fc4f4d5fc040f3efa65d32e7ce14c16d1484b450a45c5ad829cacf59b2dddd1107896d8bde6d4dbeb8d7ad138b25f241540e509

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9a0b72570554c289f1b8461cfe479709

SHA1
ccdf43f822049427ab57c44b02c2d315b2e9a63d

SHA256
05a2989915b779c15e3a6963ca271339b3cf94543994eca56a14588033f6d36d

SHA512
a967c8731afbbf053e9a973146301068a9b9606554c8577877ab7786a671101a173d277144ec12da6454ebcbc3e49ccfcc16fe87980956cc5441edf1b48d441e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2a5d44fda7e52282016827fc6c539dac

SHA1
92ea1a1bac73a4f646a755a07426e52f31318076

SHA256
d644ed961756bacc60a7c7f7fc7297148336cae00904ac6f561f12b318647c17

SHA512
f294edcdf73484d5f66acae3ce69b41fda7cc8371752dcf3839ecefd3f23fd5bc586588073f49ba920c9a8378304d984bc3fafa5f0b3266f177e7f9c6f5de49f

Download Submit
C:\Users\Admin\Downloads\git.software.1.0.8.7z

Filesize
13.2MB

MD5
c178442c44e04cbed972add08715117c

SHA1
adee67b21a33bd23b87abb3b8a04a509a7d8cdb1

SHA256
74973d097e33d980e29f7a9021fc07801af2c516756e50d84d7083dd81b66af3

SHA512
f900841d77b5412b70420603aea6e88561839ae2e0bc3206381d084eb6bb3be41d1fdb68fcd0f7aee66260a7f60a682ee48b4ed183c0a911b884552b89d98ac4

Download Submit
C:\Users\Admin\Downloads\git.software.1.0.8\Read me.txt

Filesize
263B

MD5
7516383e703dd516b7018165c3d37d9f

SHA1
7ac43348403c4a0524fbec39db9cbec26e762d64

SHA256
c7a93f7026c17223b889f7520978c1ba42546cb00e5c562431b5b7a1ac8c2db8

SHA512
e476ab957149648dc58fed94d9b99ea9005f96133cea9cc175642980fe5e288fdfde3545cbe244c983a197c20f17fe8d308af4cf0c4014859fb292a737df15c9

Download Submit
C:\Users\Admin\Downloads\git.software.1.0.8\Setup.7z

Filesize
13.2MB

MD5
1d29b4ba00de15e7ec29ce5ab78353eb

SHA1
94139a3c41191fa66b5fea59cabf0aa1d02b3d16

SHA256
1844b22fbcfbb427b02f3a4457504db75546d8214074834bc6de19f4d5bb6c47

SHA512
56af6ce02a6512479f7d478ee4baa7535f4185cffa1026685082cfe117a3e6327edc9d1f0e49a5df21e1c80b739e2f5037c67eba6fab609e447c84a8666c472b

Download Submit
C:\Users\Admin\Downloads\git.software.1.0.8\Setup\git.software.1.0.8.exe

Filesize
47.9MB

MD5
cd4725748c7b99b0f82e34e94bff3592

SHA1
7cca63071d2c95272ae41265aee19abb9716bb51

SHA256
51ea6da9e4214f34681d5db1cf721b047ad7bab96bfe43c29f76356e5028fc32

SHA512
3f1a4f4b323184742110a9cb0afa7434c401c7c1b89a20ef93fc6b2bd8a3036ad6b2bc615e90292929fd40c18b40b9201861c72a8e46a18c51c6c6947b0daaeb

Download Submit
memory/3824-480-0x0000000000E10000-0x0000000000E65000-memory.dmp

Filesize
340KB

Download
memory/3824-482-0x0000000000E10000-0x0000000000E65000-memory.dmp

Filesize
340KB

Download
memory/4068-479-0x00007FF61B830000-0x00007FF61E8CD000-memory.dmp

Filesize
48.6MB

Download
memory/4068-481-0x00007FF61B830000-0x00007FF61E8CD000-memory.dmp

Filesize
48.6MB

Download