lumma | hxxps://github[.]com/stanl1esh/FiveM-TZ-Project-PVP-TOOL

Resubmissions

04-01-2025 19:40

250104-ydz7wawkcq 10

Analysis

max time kernel
87s
max time network
89s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
04-01-2025 19:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/stanl1esh/FiveM-TZ-Project-PVP-TOOL

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://sordid-snaked.cyou/api

https://awake-weaves.cyou/api

https://wrathful-jammy.cyou/api

https://debonairnukk.xyz/api

https://diffuculttan.xyz/api

https://effecterectz.xyz/api

https://deafeninggeh.biz/api

https://immureprech.biz/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	camo.githubusercontent.com
17	camo.githubusercontent.com

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 3652 set thread context of 4884	3652	TZProject.exe	96
PID 3592 set thread context of 5316	3592	TZProject.exe	99
PID 5976 set thread context of 3620	5976	TZProject.exe	109
PID 1000 set thread context of 5108	1000	TZProject.exe	112
PID 5628 set thread context of 4780	5628	TZProject.exe	115

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TZProject.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TZProject.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TZProject.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TZProject.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TZProject.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TZProject.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133804932745523628"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\FiveM-TZ-Project-PVP-TOOL-main.zip:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5448	chrome.exe
5448	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
5448	chrome.exe
5448	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5448	chrome.exe
Token: SeCreatePagefilePrivilege	5448	chrome.exe
Token: SeShutdownPrivilege	5448	chrome.exe
Token: SeCreatePagefilePrivilege	5448	chrome.exe
Token: SeShutdownPrivilege	5448	chrome.exe
Token: SeCreatePagefilePrivilege	5448	chrome.exe
Token: SeShutdownPrivilege	5448	chrome.exe
Token: SeCreatePagefilePrivilege	5448	chrome.exe
Token: SeShutdownPrivilege	5448	chrome.exe
Token: SeCreatePagefilePrivilege	5448	chrome.exe
Token: SeShutdownPrivilege	5448	chrome.exe
Token: SeCreatePagefilePrivilege	5448	chrome.exe
Token: SeShutdownPrivilege	5448	chrome.exe
Token: SeCreatePagefilePrivilege	5448	chrome.exe
Token: SeShutdownPrivilege	5448	chrome.exe
Token: SeCreatePagefilePrivilege	5448	chrome.exe
Token: SeShutdownPrivilege	5448	chrome.exe
Token: SeCreatePagefilePrivilege	5448	chrome.exe
Token: SeShutdownPrivilege	5448	chrome.exe
Token: SeCreatePagefilePrivilege	5448	chrome.exe
Token: SeShutdownPrivilege	5448	chrome.exe
Token: SeCreatePagefilePrivilege	5448	chrome.exe
Token: SeShutdownPrivilege	5448	chrome.exe
Token: SeCreatePagefilePrivilege	5448	chrome.exe
Token: SeShutdownPrivilege	5448	chrome.exe
Token: SeCreatePagefilePrivilege	5448	chrome.exe
Token: SeShutdownPrivilege	5448	chrome.exe
Token: SeCreatePagefilePrivilege	5448	chrome.exe
Token: SeShutdownPrivilege	5448	chrome.exe
Token: SeCreatePagefilePrivilege	5448	chrome.exe
Token: SeShutdownPrivilege	5448	chrome.exe
Token: SeCreatePagefilePrivilege	5448	chrome.exe
Token: SeShutdownPrivilege	5448	chrome.exe
Token: SeCreatePagefilePrivilege	5448	chrome.exe
Token: SeShutdownPrivilege	5448	chrome.exe
Token: SeCreatePagefilePrivilege	5448	chrome.exe
Token: SeShutdownPrivilege	5448	chrome.exe
Token: SeCreatePagefilePrivilege	5448	chrome.exe
Token: SeShutdownPrivilege	5448	chrome.exe
Token: SeCreatePagefilePrivilege	5448	chrome.exe
Token: SeShutdownPrivilege	5448	chrome.exe
Token: SeCreatePagefilePrivilege	5448	chrome.exe
Token: SeShutdownPrivilege	5448	chrome.exe
Token: SeCreatePagefilePrivilege	5448	chrome.exe
Token: SeShutdownPrivilege	5448	chrome.exe
Token: SeCreatePagefilePrivilege	5448	chrome.exe
Token: SeShutdownPrivilege	5448	chrome.exe
Token: SeCreatePagefilePrivilege	5448	chrome.exe
Token: SeShutdownPrivilege	5448	chrome.exe
Token: SeCreatePagefilePrivilege	5448	chrome.exe
Token: SeShutdownPrivilege	5448	chrome.exe
Token: SeCreatePagefilePrivilege	5448	chrome.exe
Token: SeShutdownPrivilege	5448	chrome.exe
Token: SeCreatePagefilePrivilege	5448	chrome.exe
Token: SeShutdownPrivilege	5448	chrome.exe
Token: SeCreatePagefilePrivilege	5448	chrome.exe
Token: SeShutdownPrivilege	5448	chrome.exe
Token: SeCreatePagefilePrivilege	5448	chrome.exe
Token: SeShutdownPrivilege	5448	chrome.exe
Token: SeCreatePagefilePrivilege	5448	chrome.exe
Token: SeShutdownPrivilege	5448	chrome.exe
Token: SeCreatePagefilePrivilege	5448	chrome.exe
Token: SeShutdownPrivilege	5448	chrome.exe
Token: SeCreatePagefilePrivilege	5448	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
5448	chrome.exe
5448	chrome.exe
5448	chrome.exe
5448	chrome.exe
5448	chrome.exe
5448	chrome.exe
5448	chrome.exe
5448	chrome.exe
5448	chrome.exe
5448	chrome.exe
5448	chrome.exe
5448	chrome.exe
5448	chrome.exe
5448	chrome.exe
5448	chrome.exe
5448	chrome.exe
5448	chrome.exe
5448	chrome.exe
5448	chrome.exe
5448	chrome.exe
5448	chrome.exe
5448	chrome.exe
5448	chrome.exe
5448	chrome.exe
5448	chrome.exe
5448	chrome.exe
5448	chrome.exe
5448	chrome.exe
5448	chrome.exe
5448	chrome.exe
5448	chrome.exe
5448	chrome.exe
5448	chrome.exe
5448	chrome.exe
5448	chrome.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
5448	chrome.exe
5448	chrome.exe
5448	chrome.exe
5448	chrome.exe
5448	chrome.exe
5448	chrome.exe
5448	chrome.exe
5448	chrome.exe
5448	chrome.exe
5448	chrome.exe
5448	chrome.exe
5448	chrome.exe
5448	chrome.exe
5448	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5448 wrote to memory of 3248	5448	chrome.exe	77
PID 5448 wrote to memory of 3248	5448	chrome.exe	77
PID 5448 wrote to memory of 4856	5448	chrome.exe	78
PID 5448 wrote to memory of 4856	5448	chrome.exe	78
PID 5448 wrote to memory of 4856	5448	chrome.exe	78
PID 5448 wrote to memory of 4856	5448	chrome.exe	78
PID 5448 wrote to memory of 4856	5448	chrome.exe	78
PID 5448 wrote to memory of 4856	5448	chrome.exe	78
PID 5448 wrote to memory of 4856	5448	chrome.exe	78
PID 5448 wrote to memory of 4856	5448	chrome.exe	78
PID 5448 wrote to memory of 4856	5448	chrome.exe	78
PID 5448 wrote to memory of 4856	5448	chrome.exe	78
PID 5448 wrote to memory of 4856	5448	chrome.exe	78
PID 5448 wrote to memory of 4856	5448	chrome.exe	78
PID 5448 wrote to memory of 4856	5448	chrome.exe	78
PID 5448 wrote to memory of 4856	5448	chrome.exe	78
PID 5448 wrote to memory of 4856	5448	chrome.exe	78
PID 5448 wrote to memory of 4856	5448	chrome.exe	78
PID 5448 wrote to memory of 4856	5448	chrome.exe	78
PID 5448 wrote to memory of 4856	5448	chrome.exe	78
PID 5448 wrote to memory of 4856	5448	chrome.exe	78
PID 5448 wrote to memory of 4856	5448	chrome.exe	78
PID 5448 wrote to memory of 4856	5448	chrome.exe	78
PID 5448 wrote to memory of 4856	5448	chrome.exe	78
PID 5448 wrote to memory of 4856	5448	chrome.exe	78
PID 5448 wrote to memory of 4856	5448	chrome.exe	78
PID 5448 wrote to memory of 4856	5448	chrome.exe	78
PID 5448 wrote to memory of 4856	5448	chrome.exe	78
PID 5448 wrote to memory of 4856	5448	chrome.exe	78
PID 5448 wrote to memory of 4856	5448	chrome.exe	78
PID 5448 wrote to memory of 4856	5448	chrome.exe	78
PID 5448 wrote to memory of 4856	5448	chrome.exe	78
PID 5448 wrote to memory of 4868	5448	chrome.exe	79
PID 5448 wrote to memory of 4868	5448	chrome.exe	79
PID 5448 wrote to memory of 1016	5448	chrome.exe	80
PID 5448 wrote to memory of 1016	5448	chrome.exe	80
PID 5448 wrote to memory of 1016	5448	chrome.exe	80
PID 5448 wrote to memory of 1016	5448	chrome.exe	80
PID 5448 wrote to memory of 1016	5448	chrome.exe	80
PID 5448 wrote to memory of 1016	5448	chrome.exe	80
PID 5448 wrote to memory of 1016	5448	chrome.exe	80
PID 5448 wrote to memory of 1016	5448	chrome.exe	80
PID 5448 wrote to memory of 1016	5448	chrome.exe	80
PID 5448 wrote to memory of 1016	5448	chrome.exe	80
PID 5448 wrote to memory of 1016	5448	chrome.exe	80
PID 5448 wrote to memory of 1016	5448	chrome.exe	80
PID 5448 wrote to memory of 1016	5448	chrome.exe	80
PID 5448 wrote to memory of 1016	5448	chrome.exe	80
PID 5448 wrote to memory of 1016	5448	chrome.exe	80
PID 5448 wrote to memory of 1016	5448	chrome.exe	80
PID 5448 wrote to memory of 1016	5448	chrome.exe	80
PID 5448 wrote to memory of 1016	5448	chrome.exe	80
PID 5448 wrote to memory of 1016	5448	chrome.exe	80
PID 5448 wrote to memory of 1016	5448	chrome.exe	80
PID 5448 wrote to memory of 1016	5448	chrome.exe	80
PID 5448 wrote to memory of 1016	5448	chrome.exe	80
PID 5448 wrote to memory of 1016	5448	chrome.exe	80
PID 5448 wrote to memory of 1016	5448	chrome.exe	80
PID 5448 wrote to memory of 1016	5448	chrome.exe	80
PID 5448 wrote to memory of 1016	5448	chrome.exe	80
PID 5448 wrote to memory of 1016	5448	chrome.exe	80
PID 5448 wrote to memory of 1016	5448	chrome.exe	80
PID 5448 wrote to memory of 1016	5448	chrome.exe	80
PID 5448 wrote to memory of 1016	5448	chrome.exe	80

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/stanl1esh/FiveM-TZ-Project-PVP-TOOL
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc69d1cc40,0x7ffc69d1cc4c,0x7ffc69d1cc58
  2⤵
  PID:3248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1776,i,9982946391030497591,12430984903427662283,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1764 /prefetch:2
  2⤵
  PID:4856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2032,i,9982946391030497591,12430984903427662283,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2044 /prefetch:3
  2⤵
  PID:4868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2112,i,9982946391030497591,12430984903427662283,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2336 /prefetch:8
  2⤵
  PID:1016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3064,i,9982946391030497591,12430984903427662283,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3104 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3084,i,9982946391030497591,12430984903427662283,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3132 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4744,i,9982946391030497591,12430984903427662283,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4752 /prefetch:8
  2⤵
  PID:2400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4912,i,9982946391030497591,12430984903427662283,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4924 /prefetch:8
  2⤵
  - NTFS ADS
  PID:5728

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4036

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3868

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:3124

C:\Users\Admin\Desktop\FiveM-TZ-Project-PVP-TOOL-main\TZProject.exe
"C:\Users\Admin\Desktop\FiveM-TZ-Project-PVP-TOOL-main\TZProject.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3652
- C:\Users\Admin\Desktop\FiveM-TZ-Project-PVP-TOOL-main\TZProject.exe
  "C:\Users\Admin\Desktop\FiveM-TZ-Project-PVP-TOOL-main\TZProject.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4884

C:\Users\Admin\Desktop\FiveM-TZ-Project-PVP-TOOL-main\TZProject.exe
"C:\Users\Admin\Desktop\FiveM-TZ-Project-PVP-TOOL-main\TZProject.exe"
1⤵
- Suspicious use of SetThreadContext
PID:3592
- C:\Users\Admin\Desktop\FiveM-TZ-Project-PVP-TOOL-main\TZProject.exe
  "C:\Users\Admin\Desktop\FiveM-TZ-Project-PVP-TOOL-main\TZProject.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:5464

C:\Users\Admin\Desktop\FiveM-TZ-Project-PVP-TOOL-main\TZProject.exe
"C:\Users\Admin\Desktop\FiveM-TZ-Project-PVP-TOOL-main\TZProject.exe"
1⤵
- Suspicious use of SetThreadContext
PID:5976
- C:\Users\Admin\Desktop\FiveM-TZ-Project-PVP-TOOL-main\TZProject.exe
  "C:\Users\Admin\Desktop\FiveM-TZ-Project-PVP-TOOL-main\TZProject.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3620

C:\Users\Admin\Desktop\FiveM-TZ-Project-PVP-TOOL-main\TZProject.exe
"C:\Users\Admin\Desktop\FiveM-TZ-Project-PVP-TOOL-main\TZProject.exe"
1⤵
- Suspicious use of SetThreadContext
PID:1000
- C:\Users\Admin\Desktop\FiveM-TZ-Project-PVP-TOOL-main\TZProject.exe
  "C:\Users\Admin\Desktop\FiveM-TZ-Project-PVP-TOOL-main\TZProject.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5108

C:\Users\Admin\Desktop\FiveM-TZ-Project-PVP-TOOL-main\TZProject.exe
"C:\Users\Admin\Desktop\FiveM-TZ-Project-PVP-TOOL-main\TZProject.exe"
1⤵
- Suspicious use of SetThreadContext
PID:5628
- C:\Users\Admin\Desktop\FiveM-TZ-Project-PVP-TOOL-main\TZProject.exe
  "C:\Users\Admin\Desktop\FiveM-TZ-Project-PVP-TOOL-main\TZProject.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
8a9b98b99121a816d3e84399cc7d6a8d

SHA1
eb6cfe1b49d18031f4de4b13f5696504ef5389f2

SHA256
ad3409938d781beb26f42dccd6a5454b55c5fba485fc4f41d0bc68dd65a2a92a

SHA512
960ffb11f4ff372fd4aca1998af96f39b4695dc06210b974330de4272a17ea87a9369f720a5c2ab8d9f505f05445c7e209a9da9a0aaa920e796debccac804eeb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
0cf9de404d3fdcecbaf1247bce5e66a7

SHA1
bc5cc81e0b6f9c2febde83b2e6aada7c8db63091

SHA256
40572aef7ea1b9e158938e109bedba31a9fecf855256067a00a2ba8c9506352b

SHA512
8edc87e8c38dbc2e064169597ab9f25c6616dcd6323e50ff41e4f5d33ba5eb0540910e79b1ceeb93505da40e2f393bef6a755c029eda4172831db50680ad735f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
3b819dd20e4c4306bac28e5ca61c0977

SHA1
35556b99c1223ce1b544f96c6b00170b8db3ca78

SHA256
f1871f509a57eeff1c06d896256d18265f1bf334b86dc2941d69f93ff2325a39

SHA512
9b1e96740b26b22937f00e78cf50751d49309294e90d9ae26ead677e2e90a52f1148a6c820b7e1aea87d4049f880180158f4b6fed032d97cdda2baa3af207f5f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
96b53f040ef33ea107b6044e59435450

SHA1
1d2f381e0cd3103b4fb85663607f6e14986d29bc

SHA256
6e338b09d3dae62c8f200bdad73c018491df289917e596b2bae8665807709086

SHA512
6b9a56f59db6d0fdd62b9cfd6ae7bb15f35b0b82926c081930d5c061bbe6bbd4f0ca56eb9a084e56213fcceac8b8ef4239cbbd88d99b68073618b1df34b77f9b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
1790b8a1efa7496e7ad51a7d3f96c33d

SHA1
daf1d31f5d1eaab28a6dfaeb4275479c516aad94

SHA256
b0ca871da67314c41cec3297d9b97f862422476284b1e15a0c4353893e3d72fb

SHA512
d7995ed4c1f45da7133cb8c02b602d357ee098d860c942ec66824532ca7651cc6286cf5f99615bea70ce3df099cc6c2d4750ab0217451e7772a017a06048de77

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
51c965485f9ed96337aa4a4cc8356670

SHA1
04f13d4cb9b10d4c8593c3dcef40099fb0f7e2d9

SHA256
f806b5dc7a2504c6b204a83e1d77980ae478e936f20ef87d7eb92242957aacfb

SHA512
4c070612e85d20a2b2204bc9c370ad326b0f1c1cfa7c2108dacb1b02ecb9d6ef8740b9110e366db9219bc21566ab1731a490b3dd91cacba6d980fc7fa611aa24

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
926daecba7c18de1d792ae82835b4f20

SHA1
573c4670549a1f58a7cd2f0a5d26c13432f6557c

SHA256
f1c62aac6b28580f76fc00cc8019132d28410e998e164588fd3454310840c29c

SHA512
78505d33e8555df49723fd0eaa5c41ecdab567da86cf3d4fc05338a8c64f9a42b866e7ed6f7fac9d5cae5293cf0d419440438b23201ce84b06bdf08809381396

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
fefcd7817032081ceef50271b34e5ef2

SHA1
528a9a7db1e6d207264871006234f6cfe1e5d401

SHA256
414af3e34b47de3c9f6f325c599f670a3754bfe62e4fdb912154bc47ba29b5aa

SHA512
5bcea152963bcdbb3f19af4115083a52f60d18a98f6789cf2be38496db39c914a981e0edd6b77bc75d4e10ae1ae75b6ce35fe82d32b4bca4e465cd2c7b9f5eda

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
8c11ff803825119f5f3664c8b07d6d7e

SHA1
e362df926f77287b18399a28de926a2f1674a9f4

SHA256
556c24a4f4613c759bcde91f2ec2285a5a5fceb1b0260f531e6782f2ee2f3034

SHA512
53e5fef859d8c2d551b623d1c1931008a35880639632332c734cbca5ee3143ffded47177d4fa7ae8b2320bf695aa24c011f12616ca47a2da07b82914fe1eb26c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
7c25a17bad2f65094111132e5def72f2

SHA1
524a415a885f9d9cd097dca2406de0e22bd8365a

SHA256
0f9cc7e034ba816002a57aac373621cf1f7cf45a9e1ef5cb4cc1013962b6c9c1

SHA512
2f148198ce4ecd9852cf2201c5531604bbf6df017a03528b1fe65f4bcef0107f6fbc5935d73de2573cc20f2bdf1ae2277337e901b0d408dd9f863e2a43ec9227

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
380000fdb39cddfc82f1bfee62f00bd7

SHA1
1bbcd3f82639030ed155566dca691fbfe5a09879

SHA256
ebf757722c8a92db3859fe788f027bfa207b75f5ca20ee472e95595e2f8a78a4

SHA512
dc074b088ba48f964a2f9f2ca8e600639a553f9edb89971b2fd800413fb8eb31f0db4145c0af592667503023847d9c84b9b237fa49d3bc23e83b75fbb64e2d76

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
aa32547abdfb10b19cbfca070b89fe2e

SHA1
58fd8e7d4503388b5fe62c617da81d1c6a93c949

SHA256
7dedfea05c9170466e1360044b39021aaf945319949557eb21c71883fc2e631b

SHA512
197a3ab4f96d7461aeb4824f57f34dad3e79a5f55bcbe4fef74684b1f0802e09964d14cd1e4ad7ea28a039a7af771c2e85f9dcbb9b20b5a548caf7456eb1d73c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
228KB

MD5
d862619ad437deade95bdbcbd98ba56b

SHA1
2ef52906adf060d5ae93643cbc134d7c655cfc27

SHA256
c88f58a26320d2a2d3773f0f8ce777196f2df1ddf7d907f20b651459d6ff4b0d

SHA512
e960bde5d2956018f7b829b816338ed0b2e16fb05f3b330151b25afc17985107a74889a53bc0c2afec83c4f5c7b4138bcf1672c58a34ec4d79359c97d4c73da5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
228KB

MD5
d9020d4a0c66bfa46fdb46db106b9347

SHA1
ffcfbd2e4285c8820015b259d7cfbaa7c6d799e0

SHA256
c5ea88f88b73e457ff9e3ab7714f657b18073a317b68236ba23df301ba15a2c9

SHA512
ba6acc2089526e23a1dadde24f734dcfd98a6bc6c074050c65d899073693c4e6d7c47ef5b4081790f0a9f5bd6500f0d8fe5a9e21461346bd644f33f8101a97fa

Download Submit
C:\Users\Admin\Downloads\FiveM-TZ-Project-PVP-TOOL-main.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
memory/3652-212-0x000000000024A000-0x000000000024B000-memory.dmp

Filesize
4KB

Download
memory/4884-216-0x0000000000230000-0x0000000000298000-memory.dmp

Filesize
416KB

Download
memory/4884-215-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/4884-213-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download