lumma | hxxps://roxplolts[.]net

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-01-2025 20:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://roxplolts.net

Score

10^/10

lumma discovery phishing stealer

Malware Config

Extracted

Family

lumma

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

Extracted

Family

lumma

https://abruptyopsn.shop/api

https://wholersorie.shop/api

https://framekgirus.shop/api

https://tirepublicerj.shop/api

https://noisycuttej.shop/api

https://rabidcowse.shop/api

https://cloudewahsj.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
A potential corporate email address has been identified in the URL: [email protected]
phishing
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 2 IoCs

pid	pid_target	Process	procid_target
652	4180	WerFault.exe	127
2956	4048	WerFault.exe	136

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapp.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4100	msedge.exe
4100	msedge.exe
548	msedge.exe
548	msedge.exe
4668	identity_helper.exe
4668	identity_helper.exe
1304	msedge.exe
1304	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 1680	548	msedge.exe	84
PID 548 wrote to memory of 1680	548	msedge.exe	84
PID 548 wrote to memory of 2164	548	msedge.exe	85
PID 548 wrote to memory of 2164	548	msedge.exe	85
PID 548 wrote to memory of 2164	548	msedge.exe	85
PID 548 wrote to memory of 2164	548	msedge.exe	85
PID 548 wrote to memory of 2164	548	msedge.exe	85
PID 548 wrote to memory of 2164	548	msedge.exe	85
PID 548 wrote to memory of 2164	548	msedge.exe	85
PID 548 wrote to memory of 2164	548	msedge.exe	85
PID 548 wrote to memory of 2164	548	msedge.exe	85
PID 548 wrote to memory of 2164	548	msedge.exe	85
PID 548 wrote to memory of 2164	548	msedge.exe	85
PID 548 wrote to memory of 2164	548	msedge.exe	85
PID 548 wrote to memory of 2164	548	msedge.exe	85
PID 548 wrote to memory of 2164	548	msedge.exe	85
PID 548 wrote to memory of 2164	548	msedge.exe	85
PID 548 wrote to memory of 2164	548	msedge.exe	85
PID 548 wrote to memory of 2164	548	msedge.exe	85
PID 548 wrote to memory of 2164	548	msedge.exe	85
PID 548 wrote to memory of 2164	548	msedge.exe	85
PID 548 wrote to memory of 2164	548	msedge.exe	85
PID 548 wrote to memory of 2164	548	msedge.exe	85
PID 548 wrote to memory of 2164	548	msedge.exe	85
PID 548 wrote to memory of 2164	548	msedge.exe	85
PID 548 wrote to memory of 2164	548	msedge.exe	85
PID 548 wrote to memory of 2164	548	msedge.exe	85
PID 548 wrote to memory of 2164	548	msedge.exe	85
PID 548 wrote to memory of 2164	548	msedge.exe	85
PID 548 wrote to memory of 2164	548	msedge.exe	85
PID 548 wrote to memory of 2164	548	msedge.exe	85
PID 548 wrote to memory of 2164	548	msedge.exe	85
PID 548 wrote to memory of 2164	548	msedge.exe	85
PID 548 wrote to memory of 2164	548	msedge.exe	85
PID 548 wrote to memory of 2164	548	msedge.exe	85
PID 548 wrote to memory of 2164	548	msedge.exe	85
PID 548 wrote to memory of 2164	548	msedge.exe	85
PID 548 wrote to memory of 2164	548	msedge.exe	85
PID 548 wrote to memory of 2164	548	msedge.exe	85
PID 548 wrote to memory of 2164	548	msedge.exe	85
PID 548 wrote to memory of 2164	548	msedge.exe	85
PID 548 wrote to memory of 2164	548	msedge.exe	85
PID 548 wrote to memory of 4100	548	msedge.exe	86
PID 548 wrote to memory of 4100	548	msedge.exe	86
PID 548 wrote to memory of 3452	548	msedge.exe	87
PID 548 wrote to memory of 3452	548	msedge.exe	87
PID 548 wrote to memory of 3452	548	msedge.exe	87
PID 548 wrote to memory of 3452	548	msedge.exe	87
PID 548 wrote to memory of 3452	548	msedge.exe	87
PID 548 wrote to memory of 3452	548	msedge.exe	87
PID 548 wrote to memory of 3452	548	msedge.exe	87
PID 548 wrote to memory of 3452	548	msedge.exe	87
PID 548 wrote to memory of 3452	548	msedge.exe	87
PID 548 wrote to memory of 3452	548	msedge.exe	87
PID 548 wrote to memory of 3452	548	msedge.exe	87
PID 548 wrote to memory of 3452	548	msedge.exe	87
PID 548 wrote to memory of 3452	548	msedge.exe	87
PID 548 wrote to memory of 3452	548	msedge.exe	87
PID 548 wrote to memory of 3452	548	msedge.exe	87
PID 548 wrote to memory of 3452	548	msedge.exe	87
PID 548 wrote to memory of 3452	548	msedge.exe	87
PID 548 wrote to memory of 3452	548	msedge.exe	87
PID 548 wrote to memory of 3452	548	msedge.exe	87
PID 548 wrote to memory of 3452	548	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://roxplolts.net
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa048146f8,0x7ffa04814708,0x7ffa04814718
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,13564015453752725532,6268001087826403112,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,13564015453752725532,6268001087826403112,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,13564015453752725532,6268001087826403112,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2632 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13564015453752725532,6268001087826403112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13564015453752725532,6268001087826403112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13564015453752725532,6268001087826403112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13564015453752725532,6268001087826403112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,13564015453752725532,6268001087826403112,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,13564015453752725532,6268001087826403112,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13564015453752725532,6268001087826403112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13564015453752725532,6268001087826403112,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13564015453752725532,6268001087826403112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13564015453752725532,6268001087826403112,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2104,13564015453752725532,6268001087826403112,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3992 /prefetch:8
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13564015453752725532,6268001087826403112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2104,13564015453752725532,6268001087826403112,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3972

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3888

C:\Users\Admin\Downloads\Release-x64\Release\Bootstrapp.exe
"C:\Users\Admin\Downloads\Release-x64\Release\Bootstrapp.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4180 -s 1372
  2⤵
  - Program crash
  PID:652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4180 -ip 4180
1⤵
PID:2384

C:\Users\Admin\Downloads\Release-x64\Release\Bootstrapp.exe
"C:\Users\Admin\Downloads\Release-x64\Release\Bootstrapp.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4048
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 1312
  2⤵
  - Program crash
  PID:2956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4048 -ip 4048
1⤵
PID:3756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
792B

MD5
5003ecfb6ef519193e8a025bde2f63d3

SHA1
ccd74a23e87637859f7afa6458416ddfb8985bbd

SHA256
818e4c66d14df17a328de98d15d2c6a0196d923ac70fc82557acc535ba84ae80

SHA512
afbd524919685ac1b007fae0d6e873ac764b9c8d1c476220aede2429ed41c1a27e3236f283e1697fd163df7114f647e27e2ef570db4d05cdbe7ba6228c7a7aad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
dcaeb13f574609216218549141feedd4

SHA1
4873000aff86beca869c94bcae5d6f0e702a1f8a

SHA256
d60e8e28add58ccb2140cfc9d0882a621ba19305368f6cfebf7cbd193a0ae7f9

SHA512
683c92ed9b0c357074253e15b7c072ac07622c74552b8f042d8160a0ed022ae86a9524ff21ab4567be6a9db23217f1991fbd277ae49cd53d3cfa0786efcf7242

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a834d0d4f4cf15bce6fd579690cab6d9

SHA1
fe194ba944b955048cea0599b568d70336407207

SHA256
be888173ae9db34294b556b381cfda0049a92a4c0e78f59baad4cd16d9076699

SHA512
fa78c9580354b4338915d64da9caaccc71b58a91fd99fbf4f377024fb811b14725b64f04fd393cff586719c2183696fdec5c5d6193d0d27616bdae77c250d00b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f0e12a9fb91afc0e44f569cb8094df95

SHA1
00d9183bad4b05abfeeaf04324abca6f70c50359

SHA256
9b2b0c0ca17f948f2be4c4b500a6449544ce631c99ef9b33d3cca33010d36b47

SHA512
762d166da8e51b1eb40cc37fc90903ef41c6ddf1da7abb78cf40c482cc841597d9557e045f71aabc724eb2512e9639a0c83ea63bbad716c27105bd5634fefc3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e47337e0d342cceddb4e94f5694bb84c

SHA1
8dfd6c0c1db90c2cc07999582583b11f5f8185fc

SHA256
13a65501f805daa72f7727dea949e2dd818d9495f06c76fa2578e30a6aa0e41f

SHA512
f225b0f2fcac36cc8d8bc18fd45db967609ad3260b2d881e14430ae1d30035690777c6b06d0109f4d06bd3cba18f88c57bbf825781aee1c825fae9e68a867355

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3ecfb7264b03ad1a99cabaa503c518b0

SHA1
287c09fc988f4e52629039bfc754f4dba70924a2

SHA256
385ee7ccc57ac9fc78873bd46a01e0ce53ffd968b107dbcf8682f07bafd9cbb5

SHA512
694e6617946db083033c9846e49dec4a65228519ec1451d87fb3a7e3bd63960f4550e15d121699272c094390548cf49317d24a356b61bbb6d1a4c4bfd3bb67b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c791ac6ba644d656dfbefaf36e435d94

SHA1
ccda22284d67c5fbea1fafe053c7b9b8843ea344

SHA256
d423dd7c62c048d5d8460104c303e1df136ac4b97f05289a5e4328a58675cd26

SHA512
87598ef4c61a13129f5de5167eee4bd4ee7e96b60da50ebbd5c1beb179cd10bf7749574ed778c7af2913c25d2984c89d26d69e2255c3417309925a9367c531d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e465.TMP

Filesize
1KB

MD5
316e63b6aa3555ede3eda053ea3d5080

SHA1
1ca0dcfd797da1a640f272526b5e94f4d44d3885

SHA256
9862a0218622a7f7ac5f0da2b13fe88bbc8b41b90e174c74527e9a313171d0f3

SHA512
1543ee34be8d0fea9ccecbbc3652e7a9012f44bda9312a955852582dbb1fd470bee7d4621d3a9d4e3bd37be5e46f100eba4b8273b6964531f16ed7f497f9432e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fd2bb9d6bdbbea497f46d499b60523ff

SHA1
d63e092e06613ed9641d067c368eea537f99e3ee

SHA256
a861a1d93804cbed75780ba7587ee109ea7fa9b105425a140f3428ea7bf7bcf9

SHA512
c1db4169d12ae056789084f0be0de2a63260505c01fb11cc6c7147fdb2435242e98cf6fa1f11b946be689841bafd2ee2ca7879da4e82097b7f4145ef77cb0fe2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7aa8244b275b6d1922484264e4f9f13f

SHA1
08878ce617856703912e09d3cad3985f541ddc48

SHA256
35343519cbbdc9242e259b30e57b4f7131f6cfb1832a6cfa473a6653e63fd528

SHA512
67b8854779c7b03226874fa4e8106f2910e5f21b9cb3082ed131db85399856e67950dc2054a86e64b10b9f430232e2654ed3c1d866fee551ff3809b5012f73e6

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 10358.crdownload

Filesize
19.6MB

MD5
25493ab271580066a0d5e8d43b25e055

SHA1
f2a8336d1e6a75233f796fe37ec00aa204fb6907

SHA256
5281883011b847e4ab3f68c7488a47fb8489ac802c558a2cb1e5bef588f06269

SHA512
41728fc89da12faca4fa738f5ef48cd1d7fd1c9b82151f9d011f4079611d0e7fdc7a06503a07a469a89b9de0424404b547bd89e5678da73a8dfa89668932deb1

Download Submit
memory/4048-260-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/4180-228-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download