lumma | hxxps://roxplolts[.]net

Analysis

max time kernel
63s
max time network
64s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-01-2025 04:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://roxplolts.net

Score

10^/10

lumma discovery phishing stealer

Malware Config

Extracted

Family

lumma

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

Extracted

Family

lumma

https://abruptyopsn.shop/api

https://wholersorie.shop/api

https://framekgirus.shop/api

https://tirepublicerj.shop/api

https://noisycuttej.shop/api

https://rabidcowse.shop/api

https://cloudewahsj.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
A potential corporate email address has been identified in the URL: [email protected]
phishing
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 2 IoCs

pid	pid_target	Process	procid_target
840	2084	WerFault.exe	125
2040	1344	WerFault.exe	133

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapp.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3156	msedge.exe
3156	msedge.exe
1808	msedge.exe
1808	msedge.exe
1672	identity_helper.exe
1672	identity_helper.exe
2084	msedge.exe
2084	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 1544	1808	msedge.exe	83
PID 1808 wrote to memory of 1544	1808	msedge.exe	83
PID 1808 wrote to memory of 2276	1808	msedge.exe	84
PID 1808 wrote to memory of 2276	1808	msedge.exe	84
PID 1808 wrote to memory of 2276	1808	msedge.exe	84
PID 1808 wrote to memory of 2276	1808	msedge.exe	84
PID 1808 wrote to memory of 2276	1808	msedge.exe	84
PID 1808 wrote to memory of 2276	1808	msedge.exe	84
PID 1808 wrote to memory of 2276	1808	msedge.exe	84
PID 1808 wrote to memory of 2276	1808	msedge.exe	84
PID 1808 wrote to memory of 2276	1808	msedge.exe	84
PID 1808 wrote to memory of 2276	1808	msedge.exe	84
PID 1808 wrote to memory of 2276	1808	msedge.exe	84
PID 1808 wrote to memory of 2276	1808	msedge.exe	84
PID 1808 wrote to memory of 2276	1808	msedge.exe	84
PID 1808 wrote to memory of 2276	1808	msedge.exe	84
PID 1808 wrote to memory of 2276	1808	msedge.exe	84
PID 1808 wrote to memory of 2276	1808	msedge.exe	84
PID 1808 wrote to memory of 2276	1808	msedge.exe	84
PID 1808 wrote to memory of 2276	1808	msedge.exe	84
PID 1808 wrote to memory of 2276	1808	msedge.exe	84
PID 1808 wrote to memory of 2276	1808	msedge.exe	84
PID 1808 wrote to memory of 2276	1808	msedge.exe	84
PID 1808 wrote to memory of 2276	1808	msedge.exe	84
PID 1808 wrote to memory of 2276	1808	msedge.exe	84
PID 1808 wrote to memory of 2276	1808	msedge.exe	84
PID 1808 wrote to memory of 2276	1808	msedge.exe	84
PID 1808 wrote to memory of 2276	1808	msedge.exe	84
PID 1808 wrote to memory of 2276	1808	msedge.exe	84
PID 1808 wrote to memory of 2276	1808	msedge.exe	84
PID 1808 wrote to memory of 2276	1808	msedge.exe	84
PID 1808 wrote to memory of 2276	1808	msedge.exe	84
PID 1808 wrote to memory of 2276	1808	msedge.exe	84
PID 1808 wrote to memory of 2276	1808	msedge.exe	84
PID 1808 wrote to memory of 2276	1808	msedge.exe	84
PID 1808 wrote to memory of 2276	1808	msedge.exe	84
PID 1808 wrote to memory of 2276	1808	msedge.exe	84
PID 1808 wrote to memory of 2276	1808	msedge.exe	84
PID 1808 wrote to memory of 2276	1808	msedge.exe	84
PID 1808 wrote to memory of 2276	1808	msedge.exe	84
PID 1808 wrote to memory of 2276	1808	msedge.exe	84
PID 1808 wrote to memory of 2276	1808	msedge.exe	84
PID 1808 wrote to memory of 3156	1808	msedge.exe	85
PID 1808 wrote to memory of 3156	1808	msedge.exe	85
PID 1808 wrote to memory of 3036	1808	msedge.exe	86
PID 1808 wrote to memory of 3036	1808	msedge.exe	86
PID 1808 wrote to memory of 3036	1808	msedge.exe	86
PID 1808 wrote to memory of 3036	1808	msedge.exe	86
PID 1808 wrote to memory of 3036	1808	msedge.exe	86
PID 1808 wrote to memory of 3036	1808	msedge.exe	86
PID 1808 wrote to memory of 3036	1808	msedge.exe	86
PID 1808 wrote to memory of 3036	1808	msedge.exe	86
PID 1808 wrote to memory of 3036	1808	msedge.exe	86
PID 1808 wrote to memory of 3036	1808	msedge.exe	86
PID 1808 wrote to memory of 3036	1808	msedge.exe	86
PID 1808 wrote to memory of 3036	1808	msedge.exe	86
PID 1808 wrote to memory of 3036	1808	msedge.exe	86
PID 1808 wrote to memory of 3036	1808	msedge.exe	86
PID 1808 wrote to memory of 3036	1808	msedge.exe	86
PID 1808 wrote to memory of 3036	1808	msedge.exe	86
PID 1808 wrote to memory of 3036	1808	msedge.exe	86
PID 1808 wrote to memory of 3036	1808	msedge.exe	86
PID 1808 wrote to memory of 3036	1808	msedge.exe	86
PID 1808 wrote to memory of 3036	1808	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://roxplolts.net
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd7c1246f8,0x7ffd7c124708,0x7ffd7c124718
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,4805930144123042930,9461758952658028063,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,4805930144123042930,9461758952658028063,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,4805930144123042930,9461758952658028063,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,4805930144123042930,9461758952658028063,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,4805930144123042930,9461758952658028063,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,4805930144123042930,9461758952658028063,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,4805930144123042930,9461758952658028063,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,4805930144123042930,9461758952658028063,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,4805930144123042930,9461758952658028063,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,4805930144123042930,9461758952658028063,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,4805930144123042930,9461758952658028063,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,4805930144123042930,9461758952658028063,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2036,4805930144123042930,9461758952658028063,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3348 /prefetch:8
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,4805930144123042930,9461758952658028063,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2036,4805930144123042930,9461758952658028063,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3124

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:452

C:\Users\Admin\Downloads\Release-x64\Release\Bootstrapp.exe
"C:\Users\Admin\Downloads\Release-x64\Release\Bootstrapp.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 1316
  2⤵
  - Program crash
  PID:840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2084 -ip 2084
1⤵
PID:2040

C:\Users\Admin\Downloads\Release-x64\Release\Bootstrapp.exe
"C:\Users\Admin\Downloads\Release-x64\Release\Bootstrapp.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1344
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 1352
  2⤵
  - Program crash
  PID:2040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 1344 -ip 1344
1⤵
PID:4396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
792B

MD5
39ce8a7c5a0245ba8222a09e5bf257d0

SHA1
61c9a91cf6aa5b074a3b908f0fdaecf73c017c96

SHA256
9555cef737713cd4eb58a6e2368ef38c43861309353319cfee65c7214e35ea69

SHA512
b3f69f377d3c5f432556ef8049bfe54c98b206da4f53dd6380783529c6b1556e1a4be038b16b836e4ac5636ec13fc97f4ce2af62627101bf6f1b7d7768c3143a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8ea077c7ae6b3f5ca9d63080c0a4457e

SHA1
7fd2382c77cd51781f1d68d0a39136904c305957

SHA256
83ca3bd26fd8a8180395304075f00a3bb2e253f4d53cd727f1027e4eb19be83b

SHA512
da4ae7a17174a79032eb97ae078911c1cd1e1f59cce179bd1c4d56e85d0822983e1e1ace9bc9518162e6e52e4e6c7ad41ebc6841484448c3c04794b39c44ce03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7c890feae54bceaded8cd1e94e5b29b0

SHA1
a53e614102bc3ff9f72f1faa3bce4ae0401df1f0

SHA256
fb7a4d7e2fd28b0cd2719f5e730d1bc73168ea51b85b68d4f55c2de766c81bcb

SHA512
06c0252b501553f6cf175d1749f82ace3cbd116bf28b25ae795997cd33d2e6e6e15fbe567ef191c78a34804ce826a088503775d525fd417a5755c0ac1e5a2572

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
50027ef9e7cb0b6a1ff30f407bc6e757

SHA1
e2e4adc5b5c6376e056b0b736cab40cf1e612bbb

SHA256
929ab0141fb94efbbb3d0a6c2841bb9ed93656dbbe3e898413f8028b85cfd955

SHA512
f9df50411eb562f00950dd30b0f49b768fe76ce2cc4f60c7352bc015e7136645f80e21311c6c63954d776dd2c95e6779200d8d6a80e27e7227f6cb9c178d7889

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d9d1ef935852069ac9e60c3902fed14d

SHA1
7bf0295f5401671b8c422f0b44026529d541e3e0

SHA256
66157fe05fbd91e0b29306d03dc5fa9cf32f9b5c6cbff3945da5c863c9c3872f

SHA512
fcc9da7887007cf2ac11f10a8491ffe6656d6b1386eec8bfa580a48900689bee9f554d3b0f4547c9ea8ad9dabad017c11810ed057cdf90e7958b400127aa0f63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57dfe0.TMP

Filesize
1KB

MD5
9b454c53bef1cee870d0c3b9e2b03c98

SHA1
50f08cc0d6775b7ea9baa4091fda44c01a3c1eab

SHA256
7bdeb98db749e92914e14d20d775c6d19d77183f44890d00fc09a9d4b03c6541

SHA512
e5aa1b539b794277188b5e3ac8afe2d58116bd7ae0e413ab279b1a0b2480edd500ad621b25628a14101ca67d7a2b4ad4f3574ec55fab08656b6c96bf3a4f28b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2d0970d4508b7f61212b5c05f5b55385

SHA1
5b8a8b6188037205da53ef7ef2f5ff595820400b

SHA256
8e0b38e085c333357074b365c00e2fd2cd5b589c5d118efdff2312cc873c7f6f

SHA512
db12cf503920e2503741a6b5f32249e2530b42f2ceb18d9c547427e896cb6e29eeb31b15261167adf3c95ff930e86da9af38258316fc63eef3a1ad29269bbfe8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b469e1574fc74a2b9c173d7a071fd851

SHA1
d5514ba992511b8e3b77351353723fd517d4968b

SHA256
fab960ccff51b82affdc24982d32e971efeafb43fa0e3a9031164d9546c920ae

SHA512
21f0ec8ec14f34fc03a2e916cccf8f7d349481b165abadaef2730edc40460d34814f0138ef0d12d9d3d495fdf267f86d3badb8d8feb9a2406a82bede20129f47

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 86879.crdownload

Filesize
19.6MB

MD5
25493ab271580066a0d5e8d43b25e055

SHA1
f2a8336d1e6a75233f796fe37ec00aa204fb6907

SHA256
5281883011b847e4ab3f68c7488a47fb8489ac802c558a2cb1e5bef588f06269

SHA512
41728fc89da12faca4fa738f5ef48cd1d7fd1c9b82151f9d011f4079611d0e7fdc7a06503a07a469a89b9de0424404b547bd89e5678da73a8dfa89668932deb1

Download Submit
memory/1344-230-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2084-227-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download