lumma | e1def2eee311dc5f67ecced7e584dd2d25bd6b0262bfaeec5f8f49393ae5056b

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/12/2024, 10:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6f478add759b6179c8814603fe60927d.exe
Size 359KB
Sample241218-l4hpasvreq
SHA256 e1def2eee311dc5f67ecced7e584dd2d25bd6b0262bfaeec5f8f49393ae5056b
MD5 6f478add759b6179c8814603fe60927d
SHA1 dd4dd72734c9d3b4fa8bf9299b688880cf17b4fc
SHA512 7682750ac87ae95750c7d86f0e08f8ebb6c2e82abefb7101ec376655af5af869d4abd82caee841dce08cd0178ec611aabcb5cfbf91e2ad3d7f8a52b367dfae49
SSDEEP 6144:X1ji2T2y7w2Puksw4bjGeztTO6h5XTwdR:X1jfql2GksvFNh5Dw3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma discovery spyware stealer

Malware Config

Extracted

Family

lumma

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Downloads MZ/PE file
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6f478add759b6179c8814603fe60927d.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2972	6f478add759b6179c8814603fe60927d.exe
2972	6f478add759b6179c8814603fe60927d.exe
2972	6f478add759b6179c8814603fe60927d.exe
2972	6f478add759b6179c8814603fe60927d.exe
3936	msedge.exe
3936	msedge.exe
404	msedge.exe
404	msedge.exe
336	identity_helper.exe
336	identity_helper.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 404	2972	6f478add759b6179c8814603fe60927d.exe	85
PID 2972 wrote to memory of 404	2972	6f478add759b6179c8814603fe60927d.exe	85
PID 404 wrote to memory of 2068	404	msedge.exe	86
PID 404 wrote to memory of 2068	404	msedge.exe	86
PID 404 wrote to memory of 5080	404	msedge.exe	87
PID 404 wrote to memory of 5080	404	msedge.exe	87
PID 404 wrote to memory of 5080	404	msedge.exe	87
PID 404 wrote to memory of 5080	404	msedge.exe	87
PID 404 wrote to memory of 5080	404	msedge.exe	87
PID 404 wrote to memory of 5080	404	msedge.exe	87
PID 404 wrote to memory of 5080	404	msedge.exe	87
PID 404 wrote to memory of 5080	404	msedge.exe	87
PID 404 wrote to memory of 5080	404	msedge.exe	87
PID 404 wrote to memory of 5080	404	msedge.exe	87
PID 404 wrote to memory of 5080	404	msedge.exe	87
PID 404 wrote to memory of 5080	404	msedge.exe	87
PID 404 wrote to memory of 5080	404	msedge.exe	87
PID 404 wrote to memory of 5080	404	msedge.exe	87
PID 404 wrote to memory of 5080	404	msedge.exe	87
PID 404 wrote to memory of 5080	404	msedge.exe	87
PID 404 wrote to memory of 5080	404	msedge.exe	87
PID 404 wrote to memory of 5080	404	msedge.exe	87
PID 404 wrote to memory of 5080	404	msedge.exe	87
PID 404 wrote to memory of 5080	404	msedge.exe	87
PID 404 wrote to memory of 5080	404	msedge.exe	87
PID 404 wrote to memory of 5080	404	msedge.exe	87
PID 404 wrote to memory of 5080	404	msedge.exe	87
PID 404 wrote to memory of 5080	404	msedge.exe	87
PID 404 wrote to memory of 5080	404	msedge.exe	87
PID 404 wrote to memory of 5080	404	msedge.exe	87
PID 404 wrote to memory of 5080	404	msedge.exe	87
PID 404 wrote to memory of 5080	404	msedge.exe	87
PID 404 wrote to memory of 5080	404	msedge.exe	87
PID 404 wrote to memory of 5080	404	msedge.exe	87
PID 404 wrote to memory of 5080	404	msedge.exe	87
PID 404 wrote to memory of 5080	404	msedge.exe	87
PID 404 wrote to memory of 5080	404	msedge.exe	87
PID 404 wrote to memory of 5080	404	msedge.exe	87
PID 404 wrote to memory of 5080	404	msedge.exe	87
PID 404 wrote to memory of 5080	404	msedge.exe	87
PID 404 wrote to memory of 5080	404	msedge.exe	87
PID 404 wrote to memory of 5080	404	msedge.exe	87
PID 404 wrote to memory of 5080	404	msedge.exe	87
PID 404 wrote to memory of 5080	404	msedge.exe	87
PID 404 wrote to memory of 3936	404	msedge.exe	88
PID 404 wrote to memory of 3936	404	msedge.exe	88
PID 404 wrote to memory of 2140	404	msedge.exe	89
PID 404 wrote to memory of 2140	404	msedge.exe	89
PID 404 wrote to memory of 2140	404	msedge.exe	89
PID 404 wrote to memory of 2140	404	msedge.exe	89
PID 404 wrote to memory of 2140	404	msedge.exe	89
PID 404 wrote to memory of 2140	404	msedge.exe	89
PID 404 wrote to memory of 2140	404	msedge.exe	89
PID 404 wrote to memory of 2140	404	msedge.exe	89
PID 404 wrote to memory of 2140	404	msedge.exe	89
PID 404 wrote to memory of 2140	404	msedge.exe	89
PID 404 wrote to memory of 2140	404	msedge.exe	89
PID 404 wrote to memory of 2140	404	msedge.exe	89
PID 404 wrote to memory of 2140	404	msedge.exe	89
PID 404 wrote to memory of 2140	404	msedge.exe	89
PID 404 wrote to memory of 2140	404	msedge.exe	89
PID 404 wrote to memory of 2140	404	msedge.exe	89
PID 404 wrote to memory of 2140	404	msedge.exe	89
PID 404 wrote to memory of 2140	404	msedge.exe	89

C:\Users\Admin\AppData\Local\Temp\6f478add759b6179c8814603fe60927d.exe
"C:\Users\Admin\AppData\Local\Temp\6f478add759b6179c8814603fe60927d.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=6f478add759b6179c8814603fe60927d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa14dd46f8,0x7ffa14dd4708,0x7ffa14dd4718
    3⤵
    PID:2068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,1272722157175222083,8038995837295269149,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1984 /prefetch:2
    3⤵
    PID:5080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1972,1272722157175222083,8038995837295269149,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1972,1272722157175222083,8038995837295269149,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
    3⤵
    PID:2140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,1272722157175222083,8038995837295269149,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
    3⤵
    PID:2700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,1272722157175222083,8038995837295269149,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
    3⤵
    PID:4600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,1272722157175222083,8038995837295269149,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
    3⤵
    PID:2028
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1972,1272722157175222083,8038995837295269149,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:8
    3⤵
    PID:4348
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1972,1272722157175222083,8038995837295269149,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,1272722157175222083,8038995837295269149,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4020 /prefetch:1
    3⤵
    PID:876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,1272722157175222083,8038995837295269149,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
    3⤵
    PID:4848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,1272722157175222083,8038995837295269149,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
    3⤵
    PID:2776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,1272722157175222083,8038995837295269149,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
    3⤵
    PID:4556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,1272722157175222083,8038995837295269149,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
    3⤵
    PID:1420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,1272722157175222083,8038995837295269149,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
    3⤵
    PID:2284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,1272722157175222083,8038995837295269149,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=6f478add759b6179c8814603fe60927d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:2496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa14dd46f8,0x7ffa14dd4708,0x7ffa14dd4718
    3⤵
    PID:4348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e
MD5 7de1bbdc1f9cf1a58ae1de4951ce8cb9
SHA1 010da169e15457c25bd80ef02d76a940c1210301
SHA512 e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617
MD5 85ba073d7015b6ce7da19235a275f6da
SHA1 a23c8c2125e45a0788bac14423ae1f3eab92cf00
SHA512 eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 ac2ad7bec87fb50be8a333f255229377d95968c2295bbae07d68637a9cb152e7
MD5 695be37a3abd300fcceb5572c1337822
SHA1 a2934121b93f9d606326befef80de9be0ef080c9
SHA512 e329beb3d85c265ac478c14100fe866092953e6f5414295570a78c57d3df3bad67dff665943256834430b2b0bcc4720ed7d242e9dd5c490ca7d1d9d98dd63db6
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 1817cebb95721ea10e415219ca4407606cdf2256ab2e8f7d9ce273db90d4f409
MD5 218f06f5284567a75f5a19f7233173cd
SHA1 5c8ca8ff21f05079b9766ff49e1b48efde553e7f
SHA512 c4de5c3d407b6cda3d7a6bbd47a1507a1d4e6b602d9dab17c60836013ec7d8a8e48105b035c17718c2416194cdb64b4d989cf8ec61e20e9efbfa9a2acebc1e83
SSDEEP 96:nAkXN718VKX9wpvWMoiVmde1HYoIMkdfspEyHAdyUWQyV+VD7AiEwb:nAkd7qVKtGWMdYoIBkm+iyrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 a54b9b5e74d20ac315d895057172556dca8d356d8c800185f3e81ae7ef8e3186
MD5 886b330dc5bf81c3b1764c064bb12a52
SHA1 0084cf59a5b749f1d8b3bd587830f4f4859029d1
SHA512 1615bbbd0d367e3007ffc46387e93deb634665df3f1624e5bf408d1d79548a6ed286f6ba778d713f35afb0424ab267a4cba62eaa82250b374d198388f9e38c00
SSDEEP 96:nAk9N71YmKX9wpvWMoiVmdeHtyHVdgUWQyV+VDCziEwb:nAkD76mKtGWMXt+zgro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 fdf7f91de436e1a84d4690ea8eccc7ca326a1b6e32a052d0ffcac223f44999b2
MD5 463d22c495db3f5456683d10007df8c7
SHA1 57a3541c5f97559274294993f12b19127ebdf2e0
SHA512 50e8d0114f56277ff6f17e61c4474e06dd9251c7cc4029bd40e3d4c7941812902588af36e796764aecde87134d53ec8b63a8a9d97894102537b9b0eb08ab6cd7
SSDEEP 96:nAkXN71YWKX9wpvWMoiVmde1V4u3S1jtyHpXdgUWQyV+VD7AiEwb:nAkd76WKtGWMP4uiht+ptgrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 8aee12b5398fbebf8dbd727faca8c11b35e3938dcdd6469070e5511d9e432378
MD5 94021c059e408458bdb3c27cc2f9142d
SHA1 c7725d2bece791c0519173b390bd8395a0c95591
SHA512 fb8042bd9ed1a97460852e7e7aaf800d71111521a7248cd3d0ff8377cad04849e49f73687e3afe7701f0dc2df5baf1e5e53567c2c75e1da5ffbc424b0dd92219
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe58294d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58294d.TMP
Size 369B
SHA256 2faf020c68a410408ad1de44f1b8e5904d740695bcf97ccfdbc1578f736ee9b0
MD5 616869d81be301e5b6f1d79ab6c411db
SHA1 840a189b013b27a75115689897a6b085373d5ce1
SHA512 f20d244fb8812d02fccb0c3ce9baaac1ee1686dd9347771aedd8807286194d44cf5edbcbf8b9504b91308bf2a06f50f721abe1d905bb7e2970ff15d5556da15c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 60257d3a7664d476258b2dd1405c6318e70772eed5c7d87dd503ef8bb05fd1e2
MD5 378e3fca6328553ec41fb6e501bc1b63
SHA1 ee852c4b765e53d7ca9c519f3cf227852f34d047
SHA512 3b4f1660c6d031d647887e42b26d1edb42af683a7591d26a32ce9ea5327f2fa0bca59bfa8b523148991de25cb255bdad1c94b3048334552a7b6d3ded59e83b23
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupmoFTye2RUsqmVyYdF980J6:A9iIxuERzA83h09RZxYTMfVyYi0YIu
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2972-57-0x0000000002580000-0x00000000025CB000-memory.dmp

Download

memory/2972-60-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/2972-56-0x0000000000400000-0x0000000000832000-memory.dmp

Download

memory/2972-1-0x0000000000930000-0x0000000000A30000-memory.dmp

Download

memory/2972-4-0x00000000031F0000-0x0000000003210000-memory.dmp

Download

memory/2972-30-0x0000000000930000-0x0000000000A30000-memory.dmp

Download

memory/2972-5-0x00000000031F0000-0x0000000003210000-memory.dmp

Download

memory/2972-3-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/2972-2-0x0000000002580000-0x00000000025CB000-memory.dmp

Download