lumma | 4379f092a839e8169f3ba75cd4acab87067bd570a5299a1a04c5086e7aa9d509

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2024 16:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Loader.exe
Size

454KB
MD5

5cf227fa034cb7aa9ba60a5482892bc7
SHA1

ad20e86a5800b50e9d8153a4e97c417aa135fec9
SHA256

4379f092a839e8169f3ba75cd4acab87067bd570a5299a1a04c5086e7aa9d509
SHA512

882b4e08adccef91e2c78b2ae123d8e625b93ce5775be625fd7bf09ffb08d3fcb7b7ece3bf614eae0e23281b00781792447a684c86631360fb1102aaf84a3b62
SSDEEP

12288:EDBE7f710fngOy4TPDM+szGaSNDYQdwA8wiLTT8lr7v:EC7WPTrE+iQlL6LTTIr7v

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://powerful-avoids.sbs

https://motion-treesz.sbs

https://disobey-curly.sbs

https://leg-sate-boat.sbs

https://story-tense-faz.sbs

https://blade-govern.sbs

https://occupy-blushi.sbs

https://frogs-severz.sbs

https://fumblingactor.cyou

Extracted

Family

lumma

https://blade-govern.sbs/api

https://story-tense-faz.sbs/api

https://disobey-curly.sbs/api

https://motion-treesz.sbs/api

https://powerful-avoids.sbs/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Suspicious use of SetThreadContext 1 IoCs

Processes:

Loader.exe

description	pid	Process	procid_target
PID 2016 set thread context of 2764	2016	Loader.exe	84

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Loader.exeLoader.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	Process
3876	msedge.exe
3876	msedge.exe
4644	msedge.exe
4644	msedge.exe
2184	identity_helper.exe
2184	identity_helper.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid	Process
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	Process
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	Process
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Loader.exemsedge.exe

description	pid	Process	procid_target
PID 2016 wrote to memory of 2764	2016	Loader.exe	84
PID 2016 wrote to memory of 2764	2016	Loader.exe	84
PID 2016 wrote to memory of 2764	2016	Loader.exe	84
PID 2016 wrote to memory of 2764	2016	Loader.exe	84
PID 2016 wrote to memory of 2764	2016	Loader.exe	84
PID 2016 wrote to memory of 2764	2016	Loader.exe	84
PID 2016 wrote to memory of 2764	2016	Loader.exe	84
PID 2016 wrote to memory of 2764	2016	Loader.exe	84
PID 2016 wrote to memory of 2764	2016	Loader.exe	84
PID 2016 wrote to memory of 2764	2016	Loader.exe	84
PID 4644 wrote to memory of 3192	4644	msedge.exe	104
PID 4644 wrote to memory of 3192	4644	msedge.exe	104
PID 4644 wrote to memory of 396	4644	msedge.exe	105
PID 4644 wrote to memory of 396	4644	msedge.exe	105
PID 4644 wrote to memory of 396	4644	msedge.exe	105
PID 4644 wrote to memory of 396	4644	msedge.exe	105
PID 4644 wrote to memory of 396	4644	msedge.exe	105
PID 4644 wrote to memory of 396	4644	msedge.exe	105
PID 4644 wrote to memory of 396	4644	msedge.exe	105
PID 4644 wrote to memory of 396	4644	msedge.exe	105
PID 4644 wrote to memory of 396	4644	msedge.exe	105
PID 4644 wrote to memory of 396	4644	msedge.exe	105
PID 4644 wrote to memory of 396	4644	msedge.exe	105
PID 4644 wrote to memory of 396	4644	msedge.exe	105
PID 4644 wrote to memory of 396	4644	msedge.exe	105
PID 4644 wrote to memory of 396	4644	msedge.exe	105
PID 4644 wrote to memory of 396	4644	msedge.exe	105
PID 4644 wrote to memory of 396	4644	msedge.exe	105
PID 4644 wrote to memory of 396	4644	msedge.exe	105
PID 4644 wrote to memory of 396	4644	msedge.exe	105
PID 4644 wrote to memory of 396	4644	msedge.exe	105
PID 4644 wrote to memory of 396	4644	msedge.exe	105
PID 4644 wrote to memory of 396	4644	msedge.exe	105
PID 4644 wrote to memory of 396	4644	msedge.exe	105
PID 4644 wrote to memory of 396	4644	msedge.exe	105
PID 4644 wrote to memory of 396	4644	msedge.exe	105
PID 4644 wrote to memory of 396	4644	msedge.exe	105
PID 4644 wrote to memory of 396	4644	msedge.exe	105
PID 4644 wrote to memory of 396	4644	msedge.exe	105
PID 4644 wrote to memory of 396	4644	msedge.exe	105
PID 4644 wrote to memory of 396	4644	msedge.exe	105
PID 4644 wrote to memory of 396	4644	msedge.exe	105
PID 4644 wrote to memory of 396	4644	msedge.exe	105
PID 4644 wrote to memory of 396	4644	msedge.exe	105
PID 4644 wrote to memory of 396	4644	msedge.exe	105
PID 4644 wrote to memory of 396	4644	msedge.exe	105
PID 4644 wrote to memory of 396	4644	msedge.exe	105
PID 4644 wrote to memory of 396	4644	msedge.exe	105
PID 4644 wrote to memory of 396	4644	msedge.exe	105
PID 4644 wrote to memory of 396	4644	msedge.exe	105
PID 4644 wrote to memory of 396	4644	msedge.exe	105
PID 4644 wrote to memory of 396	4644	msedge.exe	105
PID 4644 wrote to memory of 3876	4644	msedge.exe	106
PID 4644 wrote to memory of 3876	4644	msedge.exe	106
PID 4644 wrote to memory of 4784	4644	msedge.exe	107
PID 4644 wrote to memory of 4784	4644	msedge.exe	107
PID 4644 wrote to memory of 4784	4644	msedge.exe	107
PID 4644 wrote to memory of 4784	4644	msedge.exe	107
PID 4644 wrote to memory of 4784	4644	msedge.exe	107
PID 4644 wrote to memory of 4784	4644	msedge.exe	107
PID 4644 wrote to memory of 4784	4644	msedge.exe	107
PID 4644 wrote to memory of 4784	4644	msedge.exe	107
PID 4644 wrote to memory of 4784	4644	msedge.exe	107
PID 4644 wrote to memory of 4784	4644	msedge.exe	107

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Users\Admin\AppData\Local\Temp\Loader.exe
  "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2764

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa80c546f8,0x7ffa80c54708,0x7ffa80c54718
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,16821509309930915307,15121307819671706368,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,16821509309930915307,15121307819671706368,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,16821509309930915307,15121307819671706368,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,16821509309930915307,15121307819671706368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,16821509309930915307,15121307819671706368,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,16821509309930915307,15121307819671706368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,16821509309930915307,15121307819671706368,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,16821509309930915307,15121307819671706368,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,16821509309930915307,15121307819671706368,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,16821509309930915307,15121307819671706368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,16821509309930915307,15121307819671706368,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,16821509309930915307,15121307819671706368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,16821509309930915307,15121307819671706368,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3040 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0eaee38d2b3794d430314c46d53aea0f

SHA1
b93438cef0117223800060299893ff2be60e2e2c

SHA256
e2694585f25b2cf14e0bc9f64c03a037ba29f9f86b4fc79662b14448fa187534

SHA512
1b6913467b6391033ecd4d1f2486ea71b0b81704e2d3f73d1b694b2675615be6e55a604b8141cea89c9216ae852637a323278c63135620b6361955516925e6bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aed20418252217e0157d5a35f4ff8f68

SHA1
114e9d68ef5d8403cb2157d48fea6aa3735efead

SHA256
b5bd0dfb543320677eb31c8470b6c2174c60ddbac6f60d562aa6b8d5218acadb

SHA512
420517c3fe7ca7b3da4f0df56bc581de5bca1ecccf361ee607d012b976209c30c0e666b58c04da6d78e20b4d64a8569d5912a5e0ae16ecb4dd0c46da1fe88f71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7ab759231ab09dd8c6acc22d0a9fb065

SHA1
b2022196be0833494cc7a8ab57cebf7b742976d8

SHA256
5ed0a9b883dc8a6a759dc7f4e1389c37b6d28538e266dcac695d6a4108ee2719

SHA512
e91e56a5ad2f64be269bfe590be73aa0a8954ac6f5e7de99a14fa9fb5394394806173caae7f8f863706dd67a83d32e279c7cac0ade80e68a04ecd96da9f5748b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c81fdeaa3b88babeec30485a6fbe2779

SHA1
d088eef9be25c8adab3e1dd35262894d26f19e50

SHA256
85a72958519a030858ea26c54abcb410b169d478861184c8665332bf81eafd82

SHA512
6ad76da8b2aacc4effe91de06f3c161acef1955a7d9ddfedb8369777b72c4ba37924a8540f0dccd4175cef1113f91373e971adbab41abf7185c7893702558c45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4a46ad8563e4e1d7f6ed17aaea2071c5

SHA1
3a4090e46788ecff20d92e645814caf968e8c4fa

SHA256
0181ebfe979b8584a2af5066273b8e950c8ebc8a662bc48ea2fe3977a0898b77

SHA512
486166374285f649ef6486f5292567bb75591a48e6061cead916f23292b1b8fc48c7bbd080fb4618af997aadb030a0fbb738538b9aaccea175ec09fcc80f523b

Download Submit
\??\pipe\LOCAL\crashpad_4644_LHPQERGKIJNNYRWY

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2016-0-0x0000000000FB3000-0x0000000000FB4000-memory.dmp

Filesize
4KB

Download
memory/2764-1-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2764-3-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2764-4-0x0000000000F90000-0x0000000001005000-memory.dmp

Filesize
468KB

Download