lumma | fdcae90a93bc31967bfefa7ccbb093e2bd084e94959d72d3676c48fa7108d697

Analysis

max time kernel
106s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01-01-2025 20:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Set-up.exe
Size

800.0MB
MD5

789f5d29d14845fcd589b2fc0b851334
SHA1

94a07132472f16b411333111c2d0f6057329088f
SHA256

fdcae90a93bc31967bfefa7ccbb093e2bd084e94959d72d3676c48fa7108d697
SHA512

36666deae33a8e1838183ee7100e8fdd56b7ef67eae0922fe4286d789ede47cd0cffaf46a953f3a212bfef4435e00ee59e73518530c8fc6b1a09dda74de35397
SSDEEP

24576:oJyQxTjqSG9r9B4Qr26l3jHxJ6Bb92rNJUoF72SauEEO7b9yHh3H:2bqSKnxl3jHSMl1EjMX

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

Extracted

Family

lumma

https://abruptyopsn.shop/api

https://wholersorie.shop/api

https://framekgirus.shop/api

https://tirepublicerj.shop/api

https://noisycuttej.shop/api

https://rabidcowse.shop/api

https://cloudewahsj.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Set-up.exe

Executes dropped EXE 1 IoCs

pid	Process
3352	Tracked.com

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
3260	tasklist.exe
904	tasklist.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\RetrieveSoap	Set-up.exe
File opened for modification	C:\Windows\MissedRespective	Set-up.exe
File opened for modification	C:\Windows\ZumTexts	Set-up.exe
File opened for modification	C:\Windows\SheetFrost	Set-up.exe
File opened for modification	C:\Windows\DifferentlyCounted	Set-up.exe
File opened for modification	C:\Windows\ColoredIndustries	Set-up.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tracked.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2208	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1648	vlc.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
3352	Tracked.com
3352	Tracked.com
3352	Tracked.com
3352	Tracked.com
3352	Tracked.com
3352	Tracked.com
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2728	taskmgr.exe
1648	vlc.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3260	tasklist.exe
Token: SeDebugPrivilege	904	tasklist.exe
Token: SeDebugPrivilege	2728	taskmgr.exe
Token: SeSystemProfilePrivilege	2728	taskmgr.exe
Token: SeCreateGlobalPrivilege	2728	taskmgr.exe
Token: 33	2728	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2728	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3352	Tracked.com
3352	Tracked.com
3352	Tracked.com
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
1648	vlc.exe
1648	vlc.exe
1648	vlc.exe
1648	vlc.exe
1648	vlc.exe
1648	vlc.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3352	Tracked.com
3352	Tracked.com
3352	Tracked.com
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
1648	vlc.exe
1648	vlc.exe
1648	vlc.exe
1648	vlc.exe
1648	vlc.exe
1648	vlc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1648	vlc.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3344 wrote to memory of 2024	3344	Set-up.exe	85
PID 3344 wrote to memory of 2024	3344	Set-up.exe	85
PID 3344 wrote to memory of 2024	3344	Set-up.exe	85
PID 2024 wrote to memory of 3260	2024	cmd.exe	90
PID 2024 wrote to memory of 3260	2024	cmd.exe	90
PID 2024 wrote to memory of 3260	2024	cmd.exe	90
PID 2024 wrote to memory of 2948	2024	cmd.exe	91
PID 2024 wrote to memory of 2948	2024	cmd.exe	91
PID 2024 wrote to memory of 2948	2024	cmd.exe	91
PID 2024 wrote to memory of 904	2024	cmd.exe	92
PID 2024 wrote to memory of 904	2024	cmd.exe	92
PID 2024 wrote to memory of 904	2024	cmd.exe	92
PID 2024 wrote to memory of 3996	2024	cmd.exe	93
PID 2024 wrote to memory of 3996	2024	cmd.exe	93
PID 2024 wrote to memory of 3996	2024	cmd.exe	93
PID 2024 wrote to memory of 1948	2024	cmd.exe	94
PID 2024 wrote to memory of 1948	2024	cmd.exe	94
PID 2024 wrote to memory of 1948	2024	cmd.exe	94
PID 2024 wrote to memory of 728	2024	cmd.exe	95
PID 2024 wrote to memory of 728	2024	cmd.exe	95
PID 2024 wrote to memory of 728	2024	cmd.exe	95
PID 2024 wrote to memory of 1932	2024	cmd.exe	96
PID 2024 wrote to memory of 1932	2024	cmd.exe	96
PID 2024 wrote to memory of 1932	2024	cmd.exe	96
PID 2024 wrote to memory of 1848	2024	cmd.exe	97
PID 2024 wrote to memory of 1848	2024	cmd.exe	97
PID 2024 wrote to memory of 1848	2024	cmd.exe	97
PID 2024 wrote to memory of 3332	2024	cmd.exe	98
PID 2024 wrote to memory of 3332	2024	cmd.exe	98
PID 2024 wrote to memory of 3332	2024	cmd.exe	98
PID 2024 wrote to memory of 3352	2024	cmd.exe	99
PID 2024 wrote to memory of 3352	2024	cmd.exe	99
PID 2024 wrote to memory of 3352	2024	cmd.exe	99
PID 2024 wrote to memory of 220	2024	cmd.exe	100
PID 2024 wrote to memory of 220	2024	cmd.exe	100
PID 2024 wrote to memory of 220	2024	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\Set-up.exe
"C:\Users\Admin\AppData\Local\Temp\Set-up.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c move Motel Motel.cmd & Motel.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3260
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2948
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:904
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3996
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 312875
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1948
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Memorial
    3⤵
    - System Location Discovery: System Language Discovery
    PID:728
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "Direct" Reception
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1932
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 312875\Tracked.com + Pike + Propecia + Bite + Kit + Encoding + Epinions + Bool + Back + Halfcom + Remind + Patient 312875\Tracked.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1848
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Ingredients + ..\Dying + ..\Postage + ..\Inner + ..\Efficient + ..\Browse + ..\Riding I
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3332
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\312875\Tracked.com
    Tracked.com I
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:3352
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:220

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2728

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\ResumeUnregister.bat
1⤵
- Opens file in notepad (likely ransom note)
PID:2208

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UnprotectWrite.wma"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1648

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ResizeRestart.mp3"
1⤵
PID:5116

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ResizeRestart.mp3"
1⤵
PID:3236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\312875\I

Filesize
493KB

MD5
2b4d1db384602401d735c6905423079f

SHA1
7f9f42c963f689742f71fad001572f65a6f37f78

SHA256
0d0795b6da3c9b2c17e1fadd183dff36739118e222a0825d5084e1970ebfab50

SHA512
dab02f1e1d7689da73cf6b3a4b34f7afadfdf6e96de05a423948224c18704b5c02a7be60c4ce59f2298790cc668a7835672ad7bf48b529c23c7e8242c49b46c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\312875\Tracked.com

Filesize
157KB

MD5
7cae1b21a3a5ded4949fb64f74372b73

SHA1
3ecb504113c489cc88843c67a5d2774a411c3b93

SHA256
49e76cb2aabc1c0d0501d00f4ee8c6d9f272729b18a69d302a1fa4dac6551f61

SHA512
6a042476bdc6c36f7181f922526fc842e653639149585ae9ff4690f5656597b302c8d9dfa764895bb321b5e8319d31faa84b323b5271538d37669b9981c0d185

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\312875\Tracked.com

Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Back

Filesize
88KB

MD5
23d6c3e976d447f6d1e7b2d3596f4131

SHA1
13a95e867e16b9b7d70f2a0364047c22fd83037e

SHA256
89d61b14665d159a9e048e9d190c62aa435b0a19f855477ac5c411de25377fb7

SHA512
fbc7f09857ad43edf90ae5a33b812620e016558320cf6a64a86da060c07f7bd25215c7da8d93128318471b2499f2b20daae9e5a3fbdf8ea928a2a33c3704c044

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Bite

Filesize
56KB

MD5
06f59a44c4bbb3d39cbe72bebf550d64

SHA1
91fc5aa4837b8200f98964bde18f1dde9db05910

SHA256
b07124480898677fd977d040a47ed079c3b0296e2721ef9708e756be71e723d6

SHA512
029968c019783ae75f14dba50a529936a17fae3dffd0604788d65cf240b63da7d4bd307138bb8650b98b0b6ac5e3f68ee887d1ac96a3aa6c2253d516ab4d62ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Bool

Filesize
118KB

MD5
afe0d49037508182811d23258b102ec9

SHA1
206ba4dfbfea8fabf55524901c13cce4c33d8487

SHA256
635dd1439e87abefbd638abe39158e8bfda6110cc4ca894b59c002017209a52a

SHA512
dcd2a606628d44e112d761c7000f5bd27a728431d8344afef28c3086a37dc500ec29c883eba81ad44395d30ee1240d5a726b9e7596aee8b5708db50c8088e3a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Browse

Filesize
53KB

MD5
5b569853af53d13f1f5e33da504962ba

SHA1
bcec41c860091d94c0ef504a5736e0acf925b357

SHA256
0b3d6c0cb76a475bfaf20c163bdb405112b779c05a7f857946eb2bb88c4b4443

SHA512
dc959fbcaa2eafb9c16a065d0c0aa6e18b7d326aebfdf9a87f52354bd86c00b4980265de26fdfab07f56f3718f02f6507e8e73d9a9cc214402405f6d3e3eb33d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Dying

Filesize
87KB

MD5
d1774561f82eb00effdf402cab18ae70

SHA1
da33bc96c96da1a3fd15c1fa525d939461b78aea

SHA256
6c6ece0de41b5f33dc52ddfe5908130e71a1c3c7245fa3cff0e2b020d1f061c5

SHA512
febe3ea3a3ffbb24fd270c935fcbc3cdb319a10043254864cf6ebfcdd8236488d8f9c84fc390208f30aade982427f9dbc65fd8f083b5ad6c20c8aa100e4b77ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Efficient

Filesize
91KB

MD5
482d1ead5b6f6ce894e8042a264ac9e1

SHA1
525b058e0c3fee2eec8a134fb7be25b1e57f343c

SHA256
05f6e70a77434e805846fd02b3f6b20a59965d698901dc5371d995ab31cf4b04

SHA512
0a1c622d10241a4c399bb11562f4961a00b5848f13cff67ce9c299fe39e0525fd6239cdeaa1195bf23a2a1d53b7982e87763ab0706d9bdf6686b52ab6e12a308

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Encoding

Filesize
64KB

MD5
73aa51e3b9bbe1c129c64c11e1f3b0e2

SHA1
d2b00635ac7bd65b131e571ff727d61aed2c1f20

SHA256
8294f9119b6073d0f830deaac65f3f8d47c1d654196b4b5dd7f56b3728d404db

SHA512
f8d33a6d887c2d41360ddc06cd71f71e5007b1b58cf99e74db95d41b4d41758b0f32d3d520d4643efbf164740c7d45911a600af043db82025427f3535c6ca78a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Epinions

Filesize
112KB

MD5
3b4d81abe994cd49de719b68a953d78c

SHA1
ea77bb52b4820b7abfaa510bda7cd14aa85929d9

SHA256
e66c6c168dbd5a8d552f230e0a7314355f6d72ed7623428769bf85dbb649f21b

SHA512
ea8814c9b77c56224ae0fc6b393d519cacf7e81050e21cd904cd50b9a4fe51e88c63ce4fc73583d85a4372e99a6e5c00e59f2c061537a87581d2d9fbcfc7838a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Halfcom

Filesize
133KB

MD5
0544c7badbe97c4d56e72d7d7242e98b

SHA1
9b117815db490af6d31d75772ec93b26b1330f3d

SHA256
333323a0e718c711ae6097df85a5c59f336698723c6aeb02dd184b78e3baaa06

SHA512
7ce51468881d12c925e989110096e46fd1eebc7a77cd483a9da9ed0c1b58c78c89c9a5865df62512446138116b24a7d7b70fa53b84c7176a7a4b0a1557678ca9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Ingredients

Filesize
90KB

MD5
2adcadab494462fba495d5ce3706d5e3

SHA1
2ea7293d91cb152c793fe4d3e5d829dd6bb6ba64

SHA256
47fc6ac29d8fcd5b54f93126cbe669f40caf9d5741b64ce4b83942933e148864

SHA512
9ebdeb2323bdbebc97ff58e812e928445d5664f570e4d5be0ea6219af2a19f8122efdd9f85dba713b576d37a4c0a3076437ce5b12971c2e1b747f8f9f099bda3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Inner

Filesize
57KB

MD5
dfdd5dfc5e5c40fa85686921dbcc9ce2

SHA1
4da2e5a9609c1936573261c498b9d4f20191a67b

SHA256
eea452360928a61c788aa5c25aaad7c1beb2ed214a336fc74f469d5e9febf29d

SHA512
bd11468006656e01694396c8ee02188e4ad5a20e30b35ce49b02cdf1103343054cd18e494703fdd06df237788e166ac4a8cb7f01ef7e7ea21a44a5cd1089aa18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Kit

Filesize
77KB

MD5
53a8aa9271206f34628122273cbfa8a0

SHA1
8287cc19f9eed1d3f8cf43e67e149601ecaf263a

SHA256
69139c3dc00b0c3db2ce4ded69c4571cf3fb5460d06d0afc6cc8aec8951585ff

SHA512
0c78cd217f1a40e467bb1241acd31e5ce8e1b57203e6fea5334972e141619276f6aa1fb0c5a64431dec2d2ef753a7ddcfaf92aa1a627e4a652d5d1d4746e3f1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Memorial

Filesize
477KB

MD5
b094861fa938bedf7f31665429edbd3f

SHA1
34f7f7f994ee8bbe5d485224dae3a9cf54e619ee

SHA256
ec3fe76c5434b5a2ab018926eb2e4e831a6c050c328d047c1964505a6274e140

SHA512
45cc2bd22bf75d1a0002ec1f680edbb8505e414169b4f80e960aad86a7455abce52a19380a536800e20dda01dd0d7044bedf219e5cedfd4d3c0e4d886f8ac0bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Motel

Filesize
15KB

MD5
2c068f885d810cd34c5f470703fff7bc

SHA1
b64de9c841cfafbc22a67d3d75e347f199ffc470

SHA256
248cd8cf8ec0ab284667a874fc5d2cd4bb92cbb3806dc9474086834eb5ee0720

SHA512
f7bfcccec497d0514eb7580d4add5b119a10e77412b617b3af4329f9a32886b8766cdea259af1aa7608ad3d690b16790836b86073dd4648aee54cabdf48f672b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Patient

Filesize
64KB

MD5
7b9d8bc02137a80208c6552147488b2d

SHA1
37409108155824a9d7f9a878925f0b09642d2310

SHA256
3859ea981318f558de97061df761f8750b5d6680c7e9d8eb7c7a86832b01c910

SHA512
f7c669a7ffa26f89d4cfe350050d8a4f9165b8100e47dba6c9a2e2579f8cb35b1575c5b5b36a875dc7e59232c2fb6b4d47395185aad6caaf0fbe046a78d7a8f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Pike

Filesize
59KB

MD5
33425334f413ff941dbe56b47b3e0747

SHA1
656836d03682237892316251f342aff2d3a74811

SHA256
74ef38bec95ead303e5b824f44065930c5183d10206b6653a960e672ec374851

SHA512
4865e765ecb3c8fa799e27bcb9003b11848b8e0a88aa18ea7957bc959d829826a7b0c423b32adc19481a1826495e76afaaabd65eee5c9de179d449d1aefe63bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Postage

Filesize
92KB

MD5
d0d3d3f8fa8e3aa72405d0fb9b1587ea

SHA1
c5e78f6bfa2c053c27db2f5ae70eb04814937d5c

SHA256
541d1303370a41bb377d3f28796ad1e1f4225e73b3ce324891d37250db8f7864

SHA512
f3019d48635de8a58f5f7ebdc4b56778ad7894ed3d077a359e3a551a34d867b5e91314ea5f58701ab8b178487e9b680792c4c348a1e7d4abd6463ef1a41defba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Propecia

Filesize
96KB

MD5
3dc43b59ebd8419fbe78840edf0f4948

SHA1
10b307d7333e03edc72629dc0a1b169be90ddb76

SHA256
7e37730b24244d097b74bdce7062a61556e18040d548cb3b818a440f267b1c8d

SHA512
c645d745e3390ed0d471057a6c816697c6fbdfaa0da5db92e09ff623ff729f4d57be5ad402dfa3e3f8de59bdc18b40a5d714a843248da52fe5cb7c3daf9458f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Reception

Filesize
2KB

MD5
27c586be31c9542b70ab377e58a0f72a

SHA1
27412114d7836cc80f13c49ed19ec7946934834e

SHA256
cecf4a764e4e12fc614fa784c4a96cda7127636ac3484093b1089d5aafcdb432

SHA512
6b80ddf66cc514617cdf44c483d03bd657189a1329af70d30dc8018a7cc729bab81901987342198df2a180937348b383671b619e5e9f68ea58df408745aae179

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Remind

Filesize
55KB

MD5
8a73509163198a881058e44e07ba3875

SHA1
543bbcf5d4eba4bed5a2233fdc0032cacbaa3074

SHA256
709279d5a4e77e5a59d434a90c7f6006f17211dd7053c8dab7463e54c4ae74f5

SHA512
b0d432e0ffbf879de22592bd131d4b9eb7a99e4ddb55b2291cc13f31f08acc5804ad09b1db625f843c44b6823d56f6f85cc62f41c0d1af286cc09856b71cd858

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Riding

Filesize
23KB

MD5
61f93b2b59d9b35aa31f77e3cc7f4b65

SHA1
e05fe48381692d16884d979620e9d41b29abd7a4

SHA256
e689f665043b3723ace59e4b8b29c8741bfb0d5effce2c3d03945a62c2b0dee9

SHA512
c8f6e93f4b437988407a5649ffc9ee6819fa52ced04b628dfdad7fa2a8d0937a4c24f40b06688facb23be893070e78346c42f1cf256d81f1d561ed9f43e9eba9

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini

Filesize
79B

MD5
39f12d3a79296bbe0fa1eea2dff04b6a

SHA1
5c7e4c3bcddf253f78405a25612111aa3ce086d1

SHA256
9eec818c6151ef1c9c3d6e9e7a12f18df1ca877927b61efd90f63dfacc106013

SHA512
66c6647534a92d3d8eabd70a6c839d8ce05d496d608e5396c85ad9e3238ce244788381225db79c92c1b53567e558bf4e107bc17dbcf154b67be33982b4992398

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlcrc

Filesize
94KB

MD5
7b37c4f352a44c8246bf685258f75045

SHA1
817dacb245334f10de0297e69c98b4c9470f083e

SHA256
ec45f6e952b43eddc214dba703cf7f31398f3c9f535aad37f42237c56b9b778e

SHA512
1e8d675b3c6c9ba257b616da268cac7f1c7a9db12ffb831ed5f8d43c0887d711c197ebc9daf735e3da9a0355bf21c2b29a2fb38a46482a2c5c8cd5628fea4c02

Download Submit
memory/1648-124-0x00007FF8BB990000-0x00007FF8BB9A1000-memory.dmp

Filesize
68KB

Download
memory/1648-119-0x00007FF8BBAE0000-0x00007FF8BBB21000-memory.dmp

Filesize
260KB

Download
memory/1648-151-0x00007FF8A8AD0000-0x00007FF8A9B80000-memory.dmp

Filesize
16.7MB

Download
memory/1648-149-0x00007FF8BC180000-0x00007FF8BC1B4000-memory.dmp

Filesize
208KB

Download
memory/1648-150-0x00007FF8AC390000-0x00007FF8AC646000-memory.dmp

Filesize
2.7MB

Download
memory/1648-148-0x00007FF710BC0000-0x00007FF710CB8000-memory.dmp

Filesize
992KB

Download
memory/1648-126-0x0000016A661D0000-0x0000016A67A3F000-memory.dmp

Filesize
24.4MB

Download
memory/1648-118-0x00007FF8A8AD0000-0x00007FF8A9B80000-memory.dmp

Filesize
16.7MB

Download
memory/1648-120-0x00007FF8BBDC0000-0x00007FF8BBDE1000-memory.dmp

Filesize
132KB

Download
memory/1648-121-0x00007FF8BBA40000-0x00007FF8BBA58000-memory.dmp

Filesize
96KB

Download
memory/1648-122-0x00007FF8BBA20000-0x00007FF8BBA31000-memory.dmp

Filesize
68KB

Download
memory/1648-123-0x00007FF8BBA00000-0x00007FF8BBA11000-memory.dmp

Filesize
68KB

Download
memory/1648-125-0x00007FF8A8870000-0x00007FF8A8AC3000-memory.dmp

Filesize
2.3MB

Download
memory/1648-108-0x00007FF8BC180000-0x00007FF8BC1B4000-memory.dmp

Filesize
208KB

Download
memory/1648-109-0x00007FF8AC390000-0x00007FF8AC646000-memory.dmp

Filesize
2.7MB

Download
memory/1648-110-0x00007FF8BC350000-0x00007FF8BC368000-memory.dmp

Filesize
96KB

Download
memory/1648-111-0x00007FF8BC240000-0x00007FF8BC257000-memory.dmp

Filesize
92KB

Download
memory/1648-112-0x00007FF8BC160000-0x00007FF8BC171000-memory.dmp

Filesize
68KB

Download
memory/1648-114-0x00007FF8BBE30000-0x00007FF8BBE41000-memory.dmp

Filesize
68KB

Download
memory/1648-117-0x00007FF8A9DA0000-0x00007FF8A9FAB000-memory.dmp

Filesize
2.0MB

Download
memory/1648-107-0x00007FF710BC0000-0x00007FF710CB8000-memory.dmp

Filesize
992KB

Download
memory/1648-113-0x00007FF8BBE50000-0x00007FF8BBE67000-memory.dmp

Filesize
92KB

Download
memory/1648-116-0x00007FF8BBDF0000-0x00007FF8BBE01000-memory.dmp

Filesize
68KB

Download
memory/1648-115-0x00007FF8BBE10000-0x00007FF8BBE2D000-memory.dmp

Filesize
116KB

Download
memory/2728-89-0x000001D21BD90000-0x000001D21BD91000-memory.dmp

Filesize
4KB

Download
memory/2728-80-0x000001D21BD90000-0x000001D21BD91000-memory.dmp

Filesize
4KB

Download
memory/2728-81-0x000001D21BD90000-0x000001D21BD91000-memory.dmp

Filesize
4KB

Download
memory/2728-82-0x000001D21BD90000-0x000001D21BD91000-memory.dmp

Filesize
4KB

Download
memory/2728-86-0x000001D21BD90000-0x000001D21BD91000-memory.dmp

Filesize
4KB

Download
memory/2728-92-0x000001D21BD90000-0x000001D21BD91000-memory.dmp

Filesize
4KB

Download
memory/2728-91-0x000001D21BD90000-0x000001D21BD91000-memory.dmp

Filesize
4KB

Download
memory/2728-90-0x000001D21BD90000-0x000001D21BD91000-memory.dmp

Filesize
4KB

Download
memory/2728-87-0x000001D21BD90000-0x000001D21BD91000-memory.dmp

Filesize
4KB

Download
memory/2728-88-0x000001D21BD90000-0x000001D21BD91000-memory.dmp

Filesize
4KB

Download
memory/3236-137-0x00007FF8BC240000-0x00007FF8BC257000-memory.dmp

Filesize
92KB

Download
memory/3236-133-0x00007FF710BC0000-0x00007FF710CB8000-memory.dmp

Filesize
992KB

Download
memory/3236-135-0x00007FF8AC390000-0x00007FF8AC646000-memory.dmp

Filesize
2.7MB

Download
memory/3236-138-0x00007FF8BC160000-0x00007FF8BC171000-memory.dmp

Filesize
68KB

Download
memory/3236-136-0x00007FF8BC350000-0x00007FF8BC368000-memory.dmp

Filesize
96KB

Download
memory/3236-134-0x00007FF8BC180000-0x00007FF8BC1B4000-memory.dmp

Filesize
208KB

Download
memory/3352-76-0x0000000004410000-0x0000000004466000-memory.dmp

Filesize
344KB

Download
memory/3352-78-0x0000000004410000-0x0000000004466000-memory.dmp

Filesize
344KB

Download
memory/3352-77-0x0000000004410000-0x0000000004466000-memory.dmp

Filesize
344KB

Download
memory/3352-75-0x0000000004410000-0x0000000004466000-memory.dmp

Filesize
344KB

Download
memory/3352-74-0x0000000004410000-0x0000000004466000-memory.dmp

Filesize
344KB

Download
memory/5116-96-0x00007FF710BC0000-0x00007FF710CB8000-memory.dmp

Filesize
992KB

Download
memory/5116-99-0x00007FF8BC350000-0x00007FF8BC368000-memory.dmp

Filesize
96KB

Download
memory/5116-98-0x00007FF8AC390000-0x00007FF8AC646000-memory.dmp

Filesize
2.7MB

Download
memory/5116-101-0x00007FF8BC160000-0x00007FF8BC171000-memory.dmp

Filesize
68KB

Download
memory/5116-100-0x00007FF8BC240000-0x00007FF8BC257000-memory.dmp

Filesize
92KB

Download
memory/5116-97-0x00007FF8BC180000-0x00007FF8BC1B4000-memory.dmp

Filesize
208KB

Download