lumma | hxxps://github[.]com/Ruq20/counter-str1ke-2-h4ck?tab=readme-ov-file

Analysis

max time kernel
40s
max time network
40s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-01-2025 20:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Ruq20/counter-str1ke-2-h4ck?tab=readme-ov-file

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://hummskitnj.buzz/api

https://cashfuzysao.buzz/api

https://appliacnesot.buzz/api

https://screwamusresz.buzz/api

https://inherineau.buzz/api

https://scentniej.buzz/api

https://rebuildeso.buzz/api

https://prisonyfork.buzz/api

https://ingreem-eilish.biz/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Loads dropped DLL 1 IoCs

pid	Process
1368	Loader.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
34	camo.githubusercontent.com
54	raw.githubusercontent.com
55	raw.githubusercontent.com
32	camo.githubusercontent.com
33	camo.githubusercontent.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1368 set thread context of 2252	1368	Loader.exe	112

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_regiis.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1220	msedge.exe
1220	msedge.exe
3584	msedge.exe
3584	msedge.exe
1744	identity_helper.exe
1744	identity_helper.exe
2112	msedge.exe
2112	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3584 wrote to memory of 4836	3584	msedge.exe	83
PID 3584 wrote to memory of 4836	3584	msedge.exe	83
PID 3584 wrote to memory of 5004	3584	msedge.exe	84
PID 3584 wrote to memory of 5004	3584	msedge.exe	84
PID 3584 wrote to memory of 5004	3584	msedge.exe	84
PID 3584 wrote to memory of 5004	3584	msedge.exe	84
PID 3584 wrote to memory of 5004	3584	msedge.exe	84
PID 3584 wrote to memory of 5004	3584	msedge.exe	84
PID 3584 wrote to memory of 5004	3584	msedge.exe	84
PID 3584 wrote to memory of 5004	3584	msedge.exe	84
PID 3584 wrote to memory of 5004	3584	msedge.exe	84
PID 3584 wrote to memory of 5004	3584	msedge.exe	84
PID 3584 wrote to memory of 5004	3584	msedge.exe	84
PID 3584 wrote to memory of 5004	3584	msedge.exe	84
PID 3584 wrote to memory of 5004	3584	msedge.exe	84
PID 3584 wrote to memory of 5004	3584	msedge.exe	84
PID 3584 wrote to memory of 5004	3584	msedge.exe	84
PID 3584 wrote to memory of 5004	3584	msedge.exe	84
PID 3584 wrote to memory of 5004	3584	msedge.exe	84
PID 3584 wrote to memory of 5004	3584	msedge.exe	84
PID 3584 wrote to memory of 5004	3584	msedge.exe	84
PID 3584 wrote to memory of 5004	3584	msedge.exe	84
PID 3584 wrote to memory of 5004	3584	msedge.exe	84
PID 3584 wrote to memory of 5004	3584	msedge.exe	84
PID 3584 wrote to memory of 5004	3584	msedge.exe	84
PID 3584 wrote to memory of 5004	3584	msedge.exe	84
PID 3584 wrote to memory of 5004	3584	msedge.exe	84
PID 3584 wrote to memory of 5004	3584	msedge.exe	84
PID 3584 wrote to memory of 5004	3584	msedge.exe	84
PID 3584 wrote to memory of 5004	3584	msedge.exe	84
PID 3584 wrote to memory of 5004	3584	msedge.exe	84
PID 3584 wrote to memory of 5004	3584	msedge.exe	84
PID 3584 wrote to memory of 5004	3584	msedge.exe	84
PID 3584 wrote to memory of 5004	3584	msedge.exe	84
PID 3584 wrote to memory of 5004	3584	msedge.exe	84
PID 3584 wrote to memory of 5004	3584	msedge.exe	84
PID 3584 wrote to memory of 5004	3584	msedge.exe	84
PID 3584 wrote to memory of 5004	3584	msedge.exe	84
PID 3584 wrote to memory of 5004	3584	msedge.exe	84
PID 3584 wrote to memory of 5004	3584	msedge.exe	84
PID 3584 wrote to memory of 5004	3584	msedge.exe	84
PID 3584 wrote to memory of 5004	3584	msedge.exe	84
PID 3584 wrote to memory of 1220	3584	msedge.exe	85
PID 3584 wrote to memory of 1220	3584	msedge.exe	85
PID 3584 wrote to memory of 876	3584	msedge.exe	86
PID 3584 wrote to memory of 876	3584	msedge.exe	86
PID 3584 wrote to memory of 876	3584	msedge.exe	86
PID 3584 wrote to memory of 876	3584	msedge.exe	86
PID 3584 wrote to memory of 876	3584	msedge.exe	86
PID 3584 wrote to memory of 876	3584	msedge.exe	86
PID 3584 wrote to memory of 876	3584	msedge.exe	86
PID 3584 wrote to memory of 876	3584	msedge.exe	86
PID 3584 wrote to memory of 876	3584	msedge.exe	86
PID 3584 wrote to memory of 876	3584	msedge.exe	86
PID 3584 wrote to memory of 876	3584	msedge.exe	86
PID 3584 wrote to memory of 876	3584	msedge.exe	86
PID 3584 wrote to memory of 876	3584	msedge.exe	86
PID 3584 wrote to memory of 876	3584	msedge.exe	86
PID 3584 wrote to memory of 876	3584	msedge.exe	86
PID 3584 wrote to memory of 876	3584	msedge.exe	86
PID 3584 wrote to memory of 876	3584	msedge.exe	86
PID 3584 wrote to memory of 876	3584	msedge.exe	86
PID 3584 wrote to memory of 876	3584	msedge.exe	86
PID 3584 wrote to memory of 876	3584	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Ruq20/counter-str1ke-2-h4ck?tab=readme-ov-file
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc8e1646f8,0x7ffc8e164708,0x7ffc8e164718
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,5600826768422240758,12361528887717139223,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,5600826768422240758,12361528887717139223,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,5600826768422240758,12361528887717139223,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5600826768422240758,12361528887717139223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5600826768422240758,12361528887717139223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,5600826768422240758,12361528887717139223,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,5600826768422240758,12361528887717139223,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2068,5600826768422240758,12361528887717139223,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5600826768422240758,12361528887717139223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2068,5600826768422240758,12361528887717139223,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5600826768422240758,12361528887717139223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5600826768422240758,12361528887717139223,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5600826768422240758,12361528887717139223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5600826768422240758,12361528887717139223,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:5184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2424

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4420

C:\Users\Admin\Desktop\Loader\Loader.exe
"C:\Users\Admin\Desktop\Loader\Loader.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1368
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e4f2dcb2038acf2e1fb575f23e6dac49

SHA1
60afeb42edce018543721f9a59b7d859ed346c28

SHA256
0353aeafd87b5bb3d90648538a1618d4828cf85384af7e810c2cb20c9e2a8ca8

SHA512
957e889aaf1bfdf1c1bbbcf03297334d536b53619abdabb2c2ecc2606cf67ed41beec20ac16c47d79a8cc1ad367c3a673ce291194c72a2ee6418b9bbcd7265a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
363562055aa7a01e3fde0dbd87f7591b

SHA1
bef9e6107fe4a47dd77e72a5b66d0464322b6100

SHA256
079b82104a789fb598d337f8a76e8eb1325b4a74722b5ef79c4e816c1559e272

SHA512
9fb0a8f646d067ac7421ad70bb286e1232cdb36ee60b6f52352af0401458261e48c519353c16be2b5540cac7a85c2be6d12991d62885a36ac4106c272b7e1891

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
144f03b5b843628f24a5e6208be1341a

SHA1
c46164d511495f3896625cd2c20583a375f7a422

SHA256
6490b5ba45183e003aea61862a3807eb1082942b37824731499400796e4f54d3

SHA512
17b9c15036f372c364c835c89dd44777d2a3581d3aadefe6ef9053d6e1847a8e2745cf995fff4b2c6f503e2aa662d9cdcd3ae600970b1fe806165b5df58759a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1df162de2ce87527dcdf860610a975e0

SHA1
ec9dce0b77bb99c11bde70f93a4f677d6203073c

SHA256
8b47661239f88e943f630534b4d1b824c90c8a73bd214ba8698d20ac9e6926e2

SHA512
6dbbe7954b60ba4e1af3c4bd2ede22b3bbecf4ef092bd10465a6fc6ef457519f57d0fffdf5f4aed16fc01d89718076578fef211db325d3f26c5fd1c6728997bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fad204935e419459ccd70f3f95d88e1b

SHA1
f34a097940235cf3e773e41439e401e0fd53e4fb

SHA256
9a6970d84db9d6d3f808b2d667d69ec26c1d77843ed709ac92c763fb96a7cf19

SHA512
ca60b6a1d7a3f436da502fd0749dbfe202efeaa661c2c08cbd864f2a7dd4d5b343af6eff9e53c08d4f0d335241f8780f73bbbea5c2e5af8e0d62a86897393a5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57eba8.TMP

Filesize
1KB

MD5
6401d2f22e3cfe9913280aa3bd598d8a

SHA1
a90f56fe2706b5c45001ccdf8e5fd5152d726b89

SHA256
cd06181f34b350dc23fed78f5b87d45508787afd72c2ee4ec5337dc1e3f6c3a4

SHA512
565f2474241ef31694c18131ef6d7cbc8531ff10d8f846fd3958c0b1f16bc815342a8f5cb4feeb79ee88669a8bd8a8dbb33ec88f1123d34c23b85abd9e77547c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c156dc7ffc5d6508b55001b22a84e402

SHA1
01aa9806dc03588535e8b57cef04a1142b064b94

SHA256
273f6188e6997a69fb7b86cb46bb315f4f84fd7f813e5a744cd704d1996ccd4e

SHA512
d01e4067ece09057a667a7c884f2dc340c5129a12a9fbc50f9c3f776b53346d6c9e610a5de8811cab646a47568c56a9500d237be1ffdb1e69d40a1e70df6ed36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e61d200d6ac48a5423cb89e0f2b15439

SHA1
ac31769ef0032a6107524f198d081c95de1513ea

SHA256
8dcbaf971a32d200f1567248a8ed35c859ea00cbe6d4156c8eaada38d3ecb3be

SHA512
601423dd1aeefe1511237dbb0b2767edbe294f5b15852d38f57732433b39f569739513f940c82e547f3e4f6fe246717a6754b21d9ad2bdc1984ee036efdbd71c

Download Submit
C:\Users\Admin\AppData\Roaming\gdi32.dll

Filesize
635KB

MD5
037bf337c4de4bc965e3200beb1a5be8

SHA1
317dc2ffca68cf71652cffe75d9d2a341a09cda8

SHA256
29c961ee9f77637c881d9193c6499a84b1320372f3edc9b8337ab03fb8b8f589

SHA512
10767a9b988843d5ed27c6509ce8801a2a604c5298cd602b4d26e1ab0957e837e1531f60dc37b3ec1de7ee0a1378e2250d3d737e58926f4d4b0e7cd1fb8275d9

Download Submit
C:\Users\Admin\Downloads\Loader.zip

Filesize
356KB

MD5
9cdb64fc1bf6d4703410b2acccc3850c

SHA1
398b3598206a36bb455535a8ef753f581d78f8a2

SHA256
54c847c93bcc25fbb25d341063a1e83d90382a709222915dd2b1b9b972f8919e

SHA512
213a2ee4e8d33076c2856df7d2fa976488c57c15d2b5975acd64baaa8a1cea57abd068dde44eec662162e4715aedcb5ac3c288b0864c9345792c763192ba43cc

Download Submit
memory/1368-236-0x0000000000F60000-0x0000000001008000-memory.dmp

Filesize
672KB

Download
memory/2252-244-0x0000000074D60000-0x0000000074DBF000-memory.dmp

Filesize
380KB

Download
memory/2252-243-0x0000000074D60000-0x0000000074DBF000-memory.dmp

Filesize
380KB

Download
memory/2252-248-0x0000000074D60000-0x0000000074DBF000-memory.dmp

Filesize
380KB

Download
memory/2252-260-0x0000000002490000-0x0000000002504000-memory.dmp

Filesize
464KB

Download