lumma | hxxps://www[.]mediafire[.]com/file/jp39je7o7rbt9yy/Extreme_Injector[.]rar/file

Resubmissions

07-01-2025 17:05

250107-vl5wjsznhy 10

07-01-2025 16:47

250107-vaq81szka1 3

07-01-2025 16:17

250107-trvgbszphp 10

07-01-2025 16:15

250107-tp7zmszpdq 3

Analysis

max time kernel
88s
max time network
86s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-01-2025 16:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/jp39je7o7rbt9yy/Extreme_Injector.rar/file

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/memory/4172-200-0x0000000000F30000-0x0000000000F90000-memory.dmp	net_reactor

Executes dropped EXE 2 IoCs

pid	Process
4172	Extreme Injector.exe
5144	Extreme Injector.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4172 set thread context of 5144	4172	Extreme Injector.exe	128

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5540	4172	WerFault.exe	124

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Extreme Injector.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Extreme Injector.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3964	msedge.exe
3964	msedge.exe
2080	msedge.exe
2080	msedge.exe
2748	identity_helper.exe
2748	identity_helper.exe
5820	msedge.exe
5820	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	6048	7zG.exe
Token: 35	6048	7zG.exe
Token: SeSecurityPrivilege	6048	7zG.exe
Token: SeSecurityPrivilege	6048	7zG.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 3800	2080	msedge.exe	84
PID 2080 wrote to memory of 3800	2080	msedge.exe	84
PID 2080 wrote to memory of 232	2080	msedge.exe	85
PID 2080 wrote to memory of 232	2080	msedge.exe	85
PID 2080 wrote to memory of 232	2080	msedge.exe	85
PID 2080 wrote to memory of 232	2080	msedge.exe	85
PID 2080 wrote to memory of 232	2080	msedge.exe	85
PID 2080 wrote to memory of 232	2080	msedge.exe	85
PID 2080 wrote to memory of 232	2080	msedge.exe	85
PID 2080 wrote to memory of 232	2080	msedge.exe	85
PID 2080 wrote to memory of 232	2080	msedge.exe	85
PID 2080 wrote to memory of 232	2080	msedge.exe	85
PID 2080 wrote to memory of 232	2080	msedge.exe	85
PID 2080 wrote to memory of 232	2080	msedge.exe	85
PID 2080 wrote to memory of 232	2080	msedge.exe	85
PID 2080 wrote to memory of 232	2080	msedge.exe	85
PID 2080 wrote to memory of 232	2080	msedge.exe	85
PID 2080 wrote to memory of 232	2080	msedge.exe	85
PID 2080 wrote to memory of 232	2080	msedge.exe	85
PID 2080 wrote to memory of 232	2080	msedge.exe	85
PID 2080 wrote to memory of 232	2080	msedge.exe	85
PID 2080 wrote to memory of 232	2080	msedge.exe	85
PID 2080 wrote to memory of 232	2080	msedge.exe	85
PID 2080 wrote to memory of 232	2080	msedge.exe	85
PID 2080 wrote to memory of 232	2080	msedge.exe	85
PID 2080 wrote to memory of 232	2080	msedge.exe	85
PID 2080 wrote to memory of 232	2080	msedge.exe	85
PID 2080 wrote to memory of 232	2080	msedge.exe	85
PID 2080 wrote to memory of 232	2080	msedge.exe	85
PID 2080 wrote to memory of 232	2080	msedge.exe	85
PID 2080 wrote to memory of 232	2080	msedge.exe	85
PID 2080 wrote to memory of 232	2080	msedge.exe	85
PID 2080 wrote to memory of 232	2080	msedge.exe	85
PID 2080 wrote to memory of 232	2080	msedge.exe	85
PID 2080 wrote to memory of 232	2080	msedge.exe	85
PID 2080 wrote to memory of 232	2080	msedge.exe	85
PID 2080 wrote to memory of 232	2080	msedge.exe	85
PID 2080 wrote to memory of 232	2080	msedge.exe	85
PID 2080 wrote to memory of 232	2080	msedge.exe	85
PID 2080 wrote to memory of 232	2080	msedge.exe	85
PID 2080 wrote to memory of 232	2080	msedge.exe	85
PID 2080 wrote to memory of 232	2080	msedge.exe	85
PID 2080 wrote to memory of 3964	2080	msedge.exe	86
PID 2080 wrote to memory of 3964	2080	msedge.exe	86
PID 2080 wrote to memory of 4276	2080	msedge.exe	87
PID 2080 wrote to memory of 4276	2080	msedge.exe	87
PID 2080 wrote to memory of 4276	2080	msedge.exe	87
PID 2080 wrote to memory of 4276	2080	msedge.exe	87
PID 2080 wrote to memory of 4276	2080	msedge.exe	87
PID 2080 wrote to memory of 4276	2080	msedge.exe	87
PID 2080 wrote to memory of 4276	2080	msedge.exe	87
PID 2080 wrote to memory of 4276	2080	msedge.exe	87
PID 2080 wrote to memory of 4276	2080	msedge.exe	87
PID 2080 wrote to memory of 4276	2080	msedge.exe	87
PID 2080 wrote to memory of 4276	2080	msedge.exe	87
PID 2080 wrote to memory of 4276	2080	msedge.exe	87
PID 2080 wrote to memory of 4276	2080	msedge.exe	87
PID 2080 wrote to memory of 4276	2080	msedge.exe	87
PID 2080 wrote to memory of 4276	2080	msedge.exe	87
PID 2080 wrote to memory of 4276	2080	msedge.exe	87
PID 2080 wrote to memory of 4276	2080	msedge.exe	87
PID 2080 wrote to memory of 4276	2080	msedge.exe	87
PID 2080 wrote to memory of 4276	2080	msedge.exe	87
PID 2080 wrote to memory of 4276	2080	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.mediafire.com/file/jp39je7o7rbt9yy/Extreme_Injector.rar/file
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb0ca46f8,0x7ffcb0ca4708,0x7ffcb0ca4718
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,5887549494545406920,3935817884931963499,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,5887549494545406920,3935817884931963499,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,5887549494545406920,3935817884931963499,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5887549494545406920,3935817884931963499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5887549494545406920,3935817884931963499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5887549494545406920,3935817884931963499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,5887549494545406920,3935817884931963499,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,5887549494545406920,3935817884931963499,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2124,5887549494545406920,3935817884931963499,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5887549494545406920,3935817884931963499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5887549494545406920,3935817884931963499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7060 /prefetch:1
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5887549494545406920,3935817884931963499,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5887549494545406920,3935817884931963499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6508 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5887549494545406920,3935817884931963499,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6932 /prefetch:1
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2124,5887549494545406920,3935817884931963499,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6608 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1904

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6004

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Extreme Injector\" -ad -an -ai#7zMap32707:94:7zEvent19519
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6048

C:\Users\Admin\Downloads\Extreme Injector\Extreme Injector.exe
"C:\Users\Admin\Downloads\Extreme Injector\Extreme Injector.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4172
- C:\Users\Admin\Downloads\Extreme Injector\Extreme Injector.exe
  "C:\Users\Admin\Downloads\Extreme Injector\Extreme Injector.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5144
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 812
  2⤵
  - Program crash
  PID:5540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4172 -ip 4172
1⤵
PID:5512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\25b7dc27-dd0c-43fb-8e45-0a4b7a83473e.tmp

Filesize
8KB

MD5
cf3d7d8c8bfebdd0cb2c9256f51d9cda

SHA1
c5ac5c6e9fd0a813930b9b15c6df9c0a2d986156

SHA256
c1648b75d1ec5bccdde0e154dcdc6dc18b85203636a457118c1a202b5e0b4386

SHA512
f41ca3cb64f8cfb0bfd683c7edb0351e7f73f50c1a7371c0fb357e71ea692bba1a0b3e91791c34c73cb1c4be78d7dfe51b88082cec8784618c42a44bd5d0a80c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
768B

MD5
0bf541e7ac47b17d0371baf8b21474dc

SHA1
35f30bd122292ef7f83e3d3d25cc499990af85a8

SHA256
4bb252ecf9be13e7fc88de56caf9c09fa76a412e7b2c2737bc9b2194392e0738

SHA512
ed09dbe313fef177805e5a9a8813b901b11158df5fa9f793b27c86757661cd375c1ab5c66e36595889a4f44f79deeb8baa6956b4c6bff5f49aa0dfaa5499b69d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
720B

MD5
796d60cac8b79a0d9834323cb6735402

SHA1
791f94c7786aebecfe06fdb0666e60a45e0b5870

SHA256
22247438e28947ec7d088e4b78f5f47d6cd72cee66963a965dd78d5e14191509

SHA512
e85a3f8535dbe9e34582f39bce346c14f6025a3e2da20ba770d5f9d4f614f5255aaab8f214682469fa1b40861925bcc853d52ff315b69d11a5a01976df36573c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
744B

MD5
8450432606e239cc3c6095fe503fb6c4

SHA1
67afeb58924ff4c805324bef1db479ad15b8d165

SHA256
7dc5b39e0b1f594f4483f3e63d899ceb2ba08cadd35567dd3425ad2645f7435c

SHA512
f3a561ec364b71dd1e30cd6fd877ad12f66bbb36f43cd1522972ac45106787599748fbcb113f76c9877ecdac7c8a427e52bdfb54b7b1455c01b67849d399ffd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
9c5bd620bb2d2d423b6a2fbc17ebca49

SHA1
4a59b88df2e6923f45a73d72141f5d919bc3170b

SHA256
9c745a516d5239ab97dd4c86ea351c99457a74a47966eeeddf339b65570848e7

SHA512
edc996d6b06eda23a34d1dab77d1f9564e25b276cd5357bf2d511338e9d57b04f976bf9d1a49cbf14cd2b70e97d66faf77cd1faa0994bd6ed1994adec06faf10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8c82eb9b30c01c9ceb41c92901a169df

SHA1
981d1caaa87eaa97b79de892d984268013016140

SHA256
d6f5e54bb380d6e23cf9ad5775d47ef6adab4f3c8de4901f2586fc81aa22a776

SHA512
451479026be9830dbfc2e3ae234fe160ef2a11f18b7dd888185b866556bc92461bea079e1c7f2485e22e341b284780e7c0871ad2c9e7d79934ad01b6a09d35fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2a966f41ffc9ff038f125836509f2445

SHA1
ed97d6c7386b5cca43ab2ead383dfee895a8d499

SHA256
296b09f67a30fe6547ffb84283d54d335c01560a395a70f78c7b034e58ec9410

SHA512
8def62f0186dba2b9d8a9dcbf433158b58e50c53c4e163da4b1a5efc93044c9be154de207e51d944510215f0a54a8f2d3d07dc9624d8060041411f6ba55b72eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2b10b35d58070f611bcebe1958ea870d

SHA1
c66c55cbb80036fcd271d2eaaac725b164a41206

SHA256
9753f72809a7486ea109dfd07603908d24b77b7b467008feddf0cd2030ab3e5a

SHA512
a09db272bf7b39f434edbd8e80fe435fba9c3803b3abb75916b061acc4c7edb8c3893f264eb053d978f07f8dd9bc2ed5337404881cd2015d62b2aed2b0c193ce

Download Submit
memory/4172-200-0x0000000000F30000-0x0000000000F90000-memory.dmp

Filesize
384KB

Download
memory/4172-201-0x0000000005E00000-0x00000000063A4000-memory.dmp

Filesize
5.6MB

Download
memory/5144-203-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/5144-205-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download