lumma | hxxps://www[.]mediafire[.]com/folder/63kcyg5gwp45u

Analysis

max time kernel
215s
max time network
215s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
04-01-2025 18:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/folder/63kcyg5gwp45u

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Executes dropped EXE 3 IoCs

pid	Process
1868	EZLauncher.exe
3704	keygen.exe
3648	EZLauncher.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1868 set thread context of 1280	1868	EZLauncher.exe	107
PID 3648 set thread context of 3816	3648	EZLauncher.exe	110

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EZLauncher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EZLauncher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\EZLauncher v1.0.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
2616	msedge.exe
2616	msedge.exe
4600	msedge.exe
4600	msedge.exe
4836	identity_helper.exe
4836	identity_helper.exe
1332	msedge.exe
1332	msedge.exe
1384	msedge.exe
1384	msedge.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeRestorePrivilege	2908	7zG.exe
Token: 35	2908	7zG.exe
Token: SeSecurityPrivilege	2908	7zG.exe
Token: SeSecurityPrivilege	2908	7zG.exe
Token: SeDebugPrivilege	2808	taskmgr.exe
Token: SeSystemProfilePrivilege	2808	taskmgr.exe
Token: SeCreateGlobalPrivilege	2808	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe
2808	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 2196	4600	msedge.exe	78
PID 4600 wrote to memory of 2196	4600	msedge.exe	78
PID 4600 wrote to memory of 3384	4600	msedge.exe	79
PID 4600 wrote to memory of 3384	4600	msedge.exe	79
PID 4600 wrote to memory of 3384	4600	msedge.exe	79
PID 4600 wrote to memory of 3384	4600	msedge.exe	79
PID 4600 wrote to memory of 3384	4600	msedge.exe	79
PID 4600 wrote to memory of 3384	4600	msedge.exe	79
PID 4600 wrote to memory of 3384	4600	msedge.exe	79
PID 4600 wrote to memory of 3384	4600	msedge.exe	79
PID 4600 wrote to memory of 3384	4600	msedge.exe	79
PID 4600 wrote to memory of 3384	4600	msedge.exe	79
PID 4600 wrote to memory of 3384	4600	msedge.exe	79
PID 4600 wrote to memory of 3384	4600	msedge.exe	79
PID 4600 wrote to memory of 3384	4600	msedge.exe	79
PID 4600 wrote to memory of 3384	4600	msedge.exe	79
PID 4600 wrote to memory of 3384	4600	msedge.exe	79
PID 4600 wrote to memory of 3384	4600	msedge.exe	79
PID 4600 wrote to memory of 3384	4600	msedge.exe	79
PID 4600 wrote to memory of 3384	4600	msedge.exe	79
PID 4600 wrote to memory of 3384	4600	msedge.exe	79
PID 4600 wrote to memory of 3384	4600	msedge.exe	79
PID 4600 wrote to memory of 3384	4600	msedge.exe	79
PID 4600 wrote to memory of 3384	4600	msedge.exe	79
PID 4600 wrote to memory of 3384	4600	msedge.exe	79
PID 4600 wrote to memory of 3384	4600	msedge.exe	79
PID 4600 wrote to memory of 3384	4600	msedge.exe	79
PID 4600 wrote to memory of 3384	4600	msedge.exe	79
PID 4600 wrote to memory of 3384	4600	msedge.exe	79
PID 4600 wrote to memory of 3384	4600	msedge.exe	79
PID 4600 wrote to memory of 3384	4600	msedge.exe	79
PID 4600 wrote to memory of 3384	4600	msedge.exe	79
PID 4600 wrote to memory of 3384	4600	msedge.exe	79
PID 4600 wrote to memory of 3384	4600	msedge.exe	79
PID 4600 wrote to memory of 3384	4600	msedge.exe	79
PID 4600 wrote to memory of 3384	4600	msedge.exe	79
PID 4600 wrote to memory of 3384	4600	msedge.exe	79
PID 4600 wrote to memory of 3384	4600	msedge.exe	79
PID 4600 wrote to memory of 3384	4600	msedge.exe	79
PID 4600 wrote to memory of 3384	4600	msedge.exe	79
PID 4600 wrote to memory of 3384	4600	msedge.exe	79
PID 4600 wrote to memory of 3384	4600	msedge.exe	79
PID 4600 wrote to memory of 2616	4600	msedge.exe	80
PID 4600 wrote to memory of 2616	4600	msedge.exe	80
PID 4600 wrote to memory of 3724	4600	msedge.exe	81
PID 4600 wrote to memory of 3724	4600	msedge.exe	81
PID 4600 wrote to memory of 3724	4600	msedge.exe	81
PID 4600 wrote to memory of 3724	4600	msedge.exe	81
PID 4600 wrote to memory of 3724	4600	msedge.exe	81
PID 4600 wrote to memory of 3724	4600	msedge.exe	81
PID 4600 wrote to memory of 3724	4600	msedge.exe	81
PID 4600 wrote to memory of 3724	4600	msedge.exe	81
PID 4600 wrote to memory of 3724	4600	msedge.exe	81
PID 4600 wrote to memory of 3724	4600	msedge.exe	81
PID 4600 wrote to memory of 3724	4600	msedge.exe	81
PID 4600 wrote to memory of 3724	4600	msedge.exe	81
PID 4600 wrote to memory of 3724	4600	msedge.exe	81
PID 4600 wrote to memory of 3724	4600	msedge.exe	81
PID 4600 wrote to memory of 3724	4600	msedge.exe	81
PID 4600 wrote to memory of 3724	4600	msedge.exe	81
PID 4600 wrote to memory of 3724	4600	msedge.exe	81
PID 4600 wrote to memory of 3724	4600	msedge.exe	81
PID 4600 wrote to memory of 3724	4600	msedge.exe	81
PID 4600 wrote to memory of 3724	4600	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.mediafire.com/folder/63kcyg5gwp45u
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb35b13cb8,0x7ffb35b13cc8,0x7ffb35b13cd8
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,5453600539908355416,5480079616745501509,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1956 /prefetch:2
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1928,5453600539908355416,5480079616745501509,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1928,5453600539908355416,5480079616745501509,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,5453600539908355416,5480079616745501509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,5453600539908355416,5480079616745501509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1928,5453600539908355416,5480079616745501509,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6376 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1928,5453600539908355416,5480079616745501509,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,5453600539908355416,5480079616745501509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,5453600539908355416,5480079616745501509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6568 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,5453600539908355416,5480079616745501509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7040 /prefetch:1
  2⤵
  PID:248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,5453600539908355416,5480079616745501509,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6968 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,5453600539908355416,5480079616745501509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,5453600539908355416,5480079616745501509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6540 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,5453600539908355416,5480079616745501509,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,5453600539908355416,5480079616745501509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,5453600539908355416,5480079616745501509,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7928 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2908

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3808

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\EZLauncher v1.0\" -spe -an -ai#7zMap7460:92:7zEvent14606
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2908

C:\Users\Admin\Downloads\EZLauncher v1.0\EZLauncher v1.0\EZLauncher.exe
"C:\Users\Admin\Downloads\EZLauncher v1.0\EZLauncher v1.0\EZLauncher.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1868
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1280

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\EZLauncher v1.0\EZLauncher v1.0\README.txt
1⤵
PID:3168

C:\Users\Admin\Downloads\EZLauncher v1.0\EZLauncher v1.0\Debug\lib\CGI Keygen\Windows\keygen.exe
"C:\Users\Admin\Downloads\EZLauncher v1.0\EZLauncher v1.0\Debug\lib\CGI Keygen\Windows\keygen.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3704

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\EZLauncher v1.0\EZLauncher v1.0\Debug\lib\CGI Keygen\Windows\readme.txt
1⤵
PID:4740

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:2808

C:\Users\Admin\Downloads\EZLauncher v1.0\EZLauncher v1.0\EZLauncher.exe
"C:\Users\Admin\Downloads\EZLauncher v1.0\EZLauncher v1.0\EZLauncher.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3648
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d53f4d836e2571ad2df7e03d177a3090

SHA1
92b8403445936b304bda8ec0e6ac2d61f98b5fc4

SHA256
84cd2d6ddd480bf3e6d7dd87d830026d18da0588e831c27e21f365d3d9cb40a3

SHA512
f96ea17c87b58eb7840b4accff2006eb0c4721bd00ee4103bebb8bf680e6085ed522f5f5e0b20b8f99b00f38f468c58d72fd324a8d7e7a4d766a7c5a7a4de0f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
30a3d46144770a2ddc321ed69a8ace2b

SHA1
97b5ad312b5ea5be2d74389467bc9b19e6844f69

SHA256
33b42bb3fd35b5602f994b0557b4fa6d6613decce4e50f1d7d33c2c7f1556f76

SHA512
64bd2f4ff346b68d92a4730763e33f9dafb2af03bf71b619c6f9b393f02dfaa7d378b72c93b33d731417394c373ab7be51c3bbeaa93802302e5ec68fd7f7ff45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
d60eb29be5d8c7bff295340cbc1bdcd3

SHA1
ea6ab1a3332a85df8fb8f53335b7d43cdf7a46cf

SHA256
2c56dc077b2d41e8bfeca988ea6732ff7d65ceba4d07a755417c9edb4b50a231

SHA512
552cd2a830db1db0fe7f8b48742d47267a2ab3fd440815179b7f35af58c62ce1a4c8b0ba21d6cf7554b2b9de23ce17ac3eccabe216da39d376797a35b6aa0f35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
8fba5a6edd423978e596d698cced7764

SHA1
7e396a651aaa37a0868ff2b49e96e49359776b92

SHA256
60d33916dd595abcc03ad43c503a79d66fdb2ff4beae350ccf2ecfe5dbfc6f29

SHA512
c9224038423519edc781b0ff9625975aed806a0ff515c514615018ae379a2ec088408d6f0da7200027afd883d605462ce40e3b0b70dd147b6b7d34984d3b5661

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
c7e9cbfee6f62fae756f8460ac585761

SHA1
db96ebae01efd52fe4ebce89890746afc2b0aa5b

SHA256
bc44a276bb5db43e5f51b157f425a79046c16673defe798bcc9d9a44896f1b27

SHA512
6a340bb2be650df219aaed2374e9cd5667a964920d44aeab3040ad15810ae2ea3fefd762bf68cbe11b63c07d2de97202b6a98063eb68a6f5ad2a82bfe1cf1018

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
17e7d16124654d1b04b9ff7536e15df3

SHA1
4e43d9a423336528947818ccb16dc436291442e6

SHA256
0217804162e3a8ec64df6b03beced1ab65d3b4ca84990c0cbcb3a9fa13c090cd

SHA512
66c2dcfbbd9e976490052c609a7e0c9b1eb09027cee6c7ae723e739b4150cfad168d78a5b50cedac58f0f9c91a5f0dd1d0f964ef28bb718eec4377fe262e5652

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
fa55aa357db12d0e5be5552aa04acef7

SHA1
c3d9f95a42452e40873321f2756d7b91b9d6ea35

SHA256
f2a408a700f2ad5e346764608b527d92373e12f2cd1431270bf466ad3875664e

SHA512
a7ef0e27043227bcbb5254cd94b03fef64c67c902b4e7d976af0f4291abbf95de4c9dcc178bea6d6ea7c7780433dd1f4cf1f629c8e3e4b434edd0c2d8cfce6f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0637b2d7efc8e8edeb9c7f8e2bce7bdf

SHA1
6436628e7cf47721ebc55daf74da46f9aef2b724

SHA256
2d23c0f0e30857ee2aa96ab5868ae6c576357d07fbaa4c59d75f20c2335be2ff

SHA512
0ed03b3876989eb4ce5a620e4279117c527f439d1fc0cefa8e5283d44b3a077d51fbd95ab9b030c5edce5946dfb41ab7a620470391327d135adcdb7f98ccbcc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
90cc1263edf1669c494a0c44b0e93681

SHA1
d9cc50c185f51ae13a37e73c915ba5ae5be89929

SHA256
9cbedce4074f687c96370810ab0e152ad76b9fcb6cca9cea33d378b9f9365f4d

SHA512
67555dddaeaa9172380c014915a9c46e8c750026f802b4ed58e6ae92d4f3eb90d8c31e663f0e832f24716a196219fb5aef0d856548e8cdfdbdf5bde1a3943353

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0bfcc895b10281558252fc286d8b3b2d

SHA1
8f07f9e5a2a4b7229f916bb48d8e94fc19bbc739

SHA256
c8d37241d6b776273ac98dfe64e1e1238f8f4dd0a4e6ed5b980917bffa2ab143

SHA512
27cd52689bcff2113cd1b10032707dd5815db1c2a1d8a81463ab7111ec7486048e112b46b3143a9878e1d01f0b4cc64d31f021155ccc915d2293a9d505c4bb1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6832cae813b120470d1eb7d2423d0b8c

SHA1
f838388bde98bb9c34a482659d0fa824c8a8a327

SHA256
eb5f660c464045d6e41fe7bb0d8ecb0a5c3f5775e91e57a8398364ed030eb274

SHA512
e71643df7374f1faf09d9553b13ff5212028b35d09011ede046243ec4d7d2ecaa236a07904308916d25070b21b63a3a2e2fb8976c47887c9df6b47cd9754c74b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
dd8c2c4c0903495c66a6ea4c70f8f189

SHA1
5f5599bc5c88f6c58be786b3046feb51d89e85a5

SHA256
561c737e9aebedc1b73855c2fe8321f88e52762758eacf009d8ca371aebddc0c

SHA512
ed04ed800c507e4de827ebae0eb6b00a75bbe4a4ca4c2c5755e5bae067759f57de924fe1365ce32a21d910683e7f353c633b300484989daa81ffc6487617337d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
dc785cefd19b82f9d2db56f22249003e

SHA1
dec5216149767ccbeaa713c8bb74aa27bcfd396f

SHA256
730edb21e78df15dd9db7b13fb4bad0c0184a75469f0c431f6c5965c7f6fbb6a

SHA512
f3bb0510b6359204522516d076994e764fc418fe6623e17984ce771ef42dbf0f4335e6b890036f763b2e33a69a5b35f101fa3b9cef89790c4312a41ab7cb691f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f6616bdf27d148babf7afc1062c831c6

SHA1
a0b1faa87f28e8c8536466398cb18ff244ff65e0

SHA256
bd7d06d64692cfadaad3094278b5a73435fbb421c689ef0c1f5dfb978c64133e

SHA512
7f74172db35b44e6918e61cc66fe700e4a4f11fdad92f6d73adc70a2c962602970979300fc03e024f374807e7306e801a53b4e04481e84ee172e6696e3f268cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
344b320be38f4f98752e508730e549e0

SHA1
6d97ea6d3a4cf2a68b58d5d0b59e1ff28cb19678

SHA256
084c72828fb11545c4c5e6404a14991fd5d749ba6699e55fef34696bbabfc8e9

SHA512
4a0d1be492600bd51ff4de23a8883bf1d611ce7f665183314c828d427744a06b23f0556a3790fffa27060c1a655df67d57dc7a37f243f405707eb13dffe43860

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e473c15f7e3bc1f059e626407183c0b8

SHA1
979d7f0ec3831ef28efaad03e03ac9311f690728

SHA256
e1db0e129536133f00d43557a865b669bf8f91d4f50a0630f75f27c6890aea41

SHA512
faa8b7f75820d49c067d9140e2e5e075252742f9dd12a61bacc1cb8a82b8a995fb36fede46b450a9a8677fcbc9912bc1ff7b41be99ae77f1516e5c20cf852eaa

Download Submit
C:\Users\Admin\Downloads\EZLauncher v1.0.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\EZLauncher v1.0\EZLauncher v1.0\Debug\Backup\IconGroup1.ico

Filesize
66KB

MD5
053b3dfe87447c1e859d45bcdd9396a6

SHA1
da3221f70bec387b2cffc1a2ffc1a3168f5c046c

SHA256
2aee2a6c17821effd355068a7583d80fd5aec51576340c587f3af1e7b7d8ccff

SHA512
3defb31a85c16a77fa62aa8f8804658cb05e53901e1f33f35d7996ececc35150f25704456124d3f3e8a5a11165a2e868b1781904232722ac7d1ee041652f629f

Download Submit
C:\Users\Admin\Downloads\EZLauncher v1.0\EZLauncher v1.0\Debug\jre\VB\enigma_ide.dll

Filesize
18KB

MD5
b7b200d4c9716ea98858570e9cb53658

SHA1
19d145b80a7367b4845f1cc1528b9238d9836add

SHA256
e2ee71162fa60d278b8c833a4487e33fcef771e485a350f3e9fb2365909f214e

SHA512
5b26ebcabd2dcf7350444f781d1b6d81e12aa4c4fd3aa101e0978f57146f2fd9a532daaa4e3d83ed828ae6afc56cbd35db2b2c26c84081ecfd148b5f3a5611f6

Download Submit
C:\Users\Admin\Downloads\EZLauncher v1.0\EZLauncher v1.0\Debug\jre\VB\keygen.dll

Filesize
399KB

MD5
8becc7c08dfdc3393394eaa01f650f24

SHA1
e35101d1c44941517e89f26f68c21a9e482670ed

SHA256
b6ea52cf3eea4ac29c7bd1b57ac86cc7b204483fac157dccf71613224a086a93

SHA512
9056ef357e8190dd11376d8c509d190ebbf68b8d9f964c59262e831b31b20aefd331f80b921294f319371bb3da90fe11314389665eb4093f776b3558377a7606

Download Submit
C:\Users\Admin\Downloads\EZLauncher v1.0\EZLauncher v1.0\Debug\lib\CGI Keygen\Windows\keygen.exe

Filesize
391KB

MD5
453233ee787770a067006ac73b28c603

SHA1
22fa59c57ae2e110b05a5150eef37d0852e52dee

SHA256
a81fb75a8336a394f9c6b83dccc40bceda7ef4e1e0ac51a3c4ffc9dee720868d

SHA512
fb0fc950014f9f2d3380a92aaaff9b569da9b1196fad2852a4ec1007cdb223252eb0836295646afee42de354b9caeb897261d5e6726303e9afac32531e723960

Download Submit
C:\Users\Admin\Downloads\EZLauncher v1.0\EZLauncher v1.0\Debug\lib\CGI Keygen\Windows\readme.txt

Filesize
4KB

MD5
578eb99e9d24cdeeb6e4ff1d7135ba5b

SHA1
13e29aeb0f1fdf909dbd422a829e192d50941b64

SHA256
3056d8b3327d1257b8460d65e3e4b01339687b5a8120e514f7ecb29ea79dad57

SHA512
4c3dbd0f0d87c73a272a4c0d237269e57cb04ae6ab036eea901f6216c728c7a24dd92d55395b9c701f91bc2d752f67de0e36ac68e4dc20d0b8a3e4fcc1263309

Download Submit
C:\Users\Admin\Downloads\EZLauncher v1.0\EZLauncher v1.0\Debug\lib\FPCx64\enigma_ide64.dll

Filesize
41KB

MD5
39db21ffd436484891026a5e99710b26

SHA1
2b736f826bd2d7ce215f8048b5f73d0b330b12b0

SHA256
5141f9f501eb6c8f402db79f99b5a21998bd7ce1e28eb077c565e34b2a2be891

SHA512
47debf6588f27454414a0a2b4eae6ba2ade7ecd00802ad1bf8f6c52a3b1a64a025149a953743587d46dc5e392e12350329465b31c206a40ace64c77a33d4705e

Download Submit
C:\Users\Admin\Downloads\EZLauncher v1.0\EZLauncher v1.0\Debug\lib\FPCx64\keygen64.dll

Filesize
728KB

MD5
dea22b33482f032612e58f88c93e54e6

SHA1
ffb57a9633b14ba1497b1fcede2cce115d96fd39

SHA256
3b0548b40876b07c8c7dc124c4525693dccb1f01f61646c812b3c6e9e3cec1ec

SHA512
e1491ca8710feba3ee1de2163c5f1fdb02e19af196b4373fb06c1369d237eae528ca830b0cc97bd464fe8303812897a294c60578e31c17807cf28fe21a1bd67a

Download Submit
C:\Users\Admin\Downloads\EZLauncher v1.0\EZLauncher v1.0\EZLauncher.exe

Filesize
11.7MB

MD5
8ca1871f59e12e4d8d7cae814956bf8c

SHA1
6c33fc74658b1e8088d0037f279449e3560b86e5

SHA256
48f2f430f385e1311e55df44128f8a3ef67654d2a81ae3a63f92ddb8cd745525

SHA512
6865ba771c8ebc450f04b3cad356af300ef84096e6fa250477c5c27660f849e19edbfea759254ad30a765853d9baae64229366f9565e9d8611e0984de0ea2b52

Download Submit
C:\Users\Admin\Downloads\EZLauncher v1.0\EZLauncher v1.0\Packaged\App\Debug\jre\Delphi\check_protection_begin.inc

Filesize
64B

MD5
881f316764c639a1f0be23fe7d29f2b7

SHA1
113a61196bb7a90c191ecf3b178502b463012a84

SHA256
567cabe34c0b7bec7cb054f1128c8b0e0bf8a9ba831874a74d854f5c681d00ce

SHA512
f312dc21fb24445412abf8a251a57fdfe4f0fca3fb70496480f54b51a53bb0bd85c0053469aab4946e116bdf79a259a15a7d570e9e76a82d1baf1eadda572ead

Download Submit
C:\Users\Admin\Downloads\EZLauncher v1.0\EZLauncher v1.0\Packaged\App\Debug\jre\Delphi\check_protection_end.inc

Filesize
64B

MD5
3d3f7d0a6b8325d6668993dacc8de192

SHA1
8624f02facd93abbbf6b41c0367047a598d7abce

SHA256
2ce76d9de3f7527289fc886473172e06f4064dff1d74307b472f1a5e1f4d774e

SHA512
b066b36ab520b3464e5815242da3f7fd0d484382086181afb8042caa2e17d31689727a66bab11fa78b22df94149686d0c060470fa18d58c9ddb5f0dddefed06a

Download Submit
C:\Users\Admin\Downloads\EZLauncher v1.0\EZLauncher v1.0\Packaged\App\Debug\jre\Delphi\decrypt_on_execute_begin.inc

Filesize
84B

MD5
5300c17f03eea548f834b226c843e43b

SHA1
73fcd47b61386713350aa42514dd004675bf7723

SHA256
d1baeecc82315cf7404df30eaebb85c9b3c65feb1a8f5a8a1cb3dff01983aadb

SHA512
311113458f1a328a2a59df4d4d76a17c5f57a4ec3af40b96ff16c2f699bdb8cee949e47148c7ef7edaf0151a9ac2b39854d93bf36be8c50d5347f61dffc62c90

Download Submit
C:\Users\Admin\Downloads\EZLauncher v1.0\EZLauncher v1.0\Packaged\App\Debug\jre\Delphi\decrypt_on_execute_end.inc

Filesize
84B

MD5
a83c02d286a2af3bf8539a802dd421e6

SHA1
b57d2973d9c80de638c266202cb58bf66b38e6f2

SHA256
7c841d406870eb0dfad46477467e891e8f17b0c3541f498e17fa8bd06b8eadbd

SHA512
eeaad7982c00a98255b03fefd1847ddd8968a6b70374d983b3476582945db7bc0a073254064a981fb23124144f73b2ecf0c4362bb7230302bc336c76fa225da2

Download Submit
C:\Users\Admin\Downloads\EZLauncher v1.0\EZLauncher v1.0\Packaged\App\Debug\jre\Delphi\vm_begin.inc

Filesize
64B

MD5
eb604d2cc02383e75ba53768e570e542

SHA1
4713c7753cdbc5570bf33434911f0139331c702e

SHA256
b24a40006b4d250bbc9ef2c5a5df00c89992a1ce95762b39d651ca21bc1049ee

SHA512
22da70e2866689d0fd9bf87ecca50834fea1f6879a2b6de11075bd86880d6270aa647ecd4e7f112c79a345b01b8836964fe3d2a5bbb82e245c522e85714cc43b

Download Submit
C:\Users\Admin\Downloads\EZLauncher v1.0\EZLauncher v1.0\Packaged\App\Debug\jre\Delphi\vm_end.inc

Filesize
64B

MD5
d9fd9b600d011415dfdad572607a25c7

SHA1
32476ea0d23e0d4b950287f05168a05badc4da05

SHA256
4f5b7b31d08f466251cdbd7d74ac7592dd27f35957f718f57ecc5a7437604cb5

SHA512
287c1e2abecd2fc083a2a173f02a978842fb78a8b99548f2bc447e64b11c716d740a9aa68d13ead41ed1ee5f6af06b09ce33ea0df0d4baf3c3ef87b932f73bfb

Download Submit
C:\Users\Admin\Downloads\EZLauncher v1.0\EZLauncher v1.0\README.txt

Filesize
51B

MD5
3039cebfd225a1fd46eb92072221b23c

SHA1
c46b6e14fdf0cfd699cd573b064cb4ba8b2ca02f

SHA256
b7a7395ca29798a0bd0759bdc9c8fe871d121d95968d69437d09fa6282ed9d57

SHA512
6ecd7f2ab9e324df4cbabe27ab464edc8f571e943fd3d28088a02ccf858fc3a9e2093bdb77c4f80f250b36b17147f85e171968b2d77cd2f708346562c376090b

Download Submit
memory/1280-1662-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1280-1659-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1280-1660-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2808-1671-0x0000025AAB0F0000-0x0000025AAB0F1000-memory.dmp

Filesize
4KB

Download
memory/2808-1674-0x0000025AAB0F0000-0x0000025AAB0F1000-memory.dmp

Filesize
4KB

Download
memory/2808-1665-0x0000025AAB0F0000-0x0000025AAB0F1000-memory.dmp

Filesize
4KB

Download
memory/2808-1664-0x0000025AAB0F0000-0x0000025AAB0F1000-memory.dmp

Filesize
4KB

Download
memory/2808-1669-0x0000025AAB0F0000-0x0000025AAB0F1000-memory.dmp

Filesize
4KB

Download
memory/2808-1675-0x0000025AAB0F0000-0x0000025AAB0F1000-memory.dmp

Filesize
4KB

Download
memory/2808-1670-0x0000025AAB0F0000-0x0000025AAB0F1000-memory.dmp

Filesize
4KB

Download
memory/2808-1663-0x0000025AAB0F0000-0x0000025AAB0F1000-memory.dmp

Filesize
4KB

Download
memory/2808-1673-0x0000025AAB0F0000-0x0000025AAB0F1000-memory.dmp

Filesize
4KB

Download
memory/2808-1672-0x0000025AAB0F0000-0x0000025AAB0F1000-memory.dmp

Filesize
4KB

Download
memory/3704-1657-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3816-1678-0x0000000000450000-0x00000000004AA000-memory.dmp

Filesize
360KB

Download
memory/3816-1681-0x0000000000450000-0x00000000004AA000-memory.dmp

Filesize
360KB

Download
memory/3816-1682-0x0000000000450000-0x00000000004AA000-memory.dmp

Filesize
360KB

Download