lumma | hxxps://www[.]youtube[.]com/redirect?event=comments&redir_token=QUFFLUhqbGdCLTFYdnZsZW80OGd0VlhLcE95c3ZpRTdMd3xBQ3Jtc0ttWGg1cjYxVS0zRHFZTVBlaUhGcmhRUlNKV0p1RVJoYXdwNEtfVGVEMENTdDVEcHN3VzhEUUNsa0tSOFcwUElqbFRfNElyclBxZWRpT2d6WEx2TkxVV2E4Unh2dkJZdWpjQ3g4WjFZNGhWX2lRanNtYw&q=https%3A%2F%2Froxplolts[.]net%2F

Analysis

max time kernel
73s
max time network
66s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
09-01-2025 08:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.youtube.com/redirect?event=comments&redir_token=QUFFLUhqbGdCLTFYdnZsZW80OGd0VlhLcE95c3ZpRTdMd3xBQ3Jtc0ttWGg1cjYxVS0zRHFZTVBlaUhGcmhRUlNKV0p1RVJoYXdwNEtfVGVEMENTdDVEcHN3VzhEUUNsa0tSOFcwUElqbFRfNElyclBxZWRpT2d6WEx2TkxVV2E4Unh2dkJZdWpjQ3g4WjFZNGhWX2lRanNtYw&q=https%3A%2F%2Froxplolts.net%2F

Score

10^/10

lumma discovery phishing stealer

Malware Config

Extracted

Family

lumma

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

https://fastysticke.sbs/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
A potential corporate email address has been identified in the URL: [email protected]
phishing
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4080	1676	WerFault.exe	99

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Вootstrapper.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Вootstrapper-x64.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2556	msedge.exe
2556	msedge.exe
3448	msedge.exe
3448	msedge.exe
3176	identity_helper.exe
3176	identity_helper.exe
1444	msedge.exe
1444	msedge.exe
3304	msedge.exe
3304	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 2440	3448	msedge.exe	77
PID 3448 wrote to memory of 2440	3448	msedge.exe	77
PID 3448 wrote to memory of 2884	3448	msedge.exe	78
PID 3448 wrote to memory of 2884	3448	msedge.exe	78
PID 3448 wrote to memory of 2884	3448	msedge.exe	78
PID 3448 wrote to memory of 2884	3448	msedge.exe	78
PID 3448 wrote to memory of 2884	3448	msedge.exe	78
PID 3448 wrote to memory of 2884	3448	msedge.exe	78
PID 3448 wrote to memory of 2884	3448	msedge.exe	78
PID 3448 wrote to memory of 2884	3448	msedge.exe	78
PID 3448 wrote to memory of 2884	3448	msedge.exe	78
PID 3448 wrote to memory of 2884	3448	msedge.exe	78
PID 3448 wrote to memory of 2884	3448	msedge.exe	78
PID 3448 wrote to memory of 2884	3448	msedge.exe	78
PID 3448 wrote to memory of 2884	3448	msedge.exe	78
PID 3448 wrote to memory of 2884	3448	msedge.exe	78
PID 3448 wrote to memory of 2884	3448	msedge.exe	78
PID 3448 wrote to memory of 2884	3448	msedge.exe	78
PID 3448 wrote to memory of 2884	3448	msedge.exe	78
PID 3448 wrote to memory of 2884	3448	msedge.exe	78
PID 3448 wrote to memory of 2884	3448	msedge.exe	78
PID 3448 wrote to memory of 2884	3448	msedge.exe	78
PID 3448 wrote to memory of 2884	3448	msedge.exe	78
PID 3448 wrote to memory of 2884	3448	msedge.exe	78
PID 3448 wrote to memory of 2884	3448	msedge.exe	78
PID 3448 wrote to memory of 2884	3448	msedge.exe	78
PID 3448 wrote to memory of 2884	3448	msedge.exe	78
PID 3448 wrote to memory of 2884	3448	msedge.exe	78
PID 3448 wrote to memory of 2884	3448	msedge.exe	78
PID 3448 wrote to memory of 2884	3448	msedge.exe	78
PID 3448 wrote to memory of 2884	3448	msedge.exe	78
PID 3448 wrote to memory of 2884	3448	msedge.exe	78
PID 3448 wrote to memory of 2884	3448	msedge.exe	78
PID 3448 wrote to memory of 2884	3448	msedge.exe	78
PID 3448 wrote to memory of 2884	3448	msedge.exe	78
PID 3448 wrote to memory of 2884	3448	msedge.exe	78
PID 3448 wrote to memory of 2884	3448	msedge.exe	78
PID 3448 wrote to memory of 2884	3448	msedge.exe	78
PID 3448 wrote to memory of 2884	3448	msedge.exe	78
PID 3448 wrote to memory of 2884	3448	msedge.exe	78
PID 3448 wrote to memory of 2884	3448	msedge.exe	78
PID 3448 wrote to memory of 2884	3448	msedge.exe	78
PID 3448 wrote to memory of 2556	3448	msedge.exe	79
PID 3448 wrote to memory of 2556	3448	msedge.exe	79
PID 3448 wrote to memory of 3164	3448	msedge.exe	80
PID 3448 wrote to memory of 3164	3448	msedge.exe	80
PID 3448 wrote to memory of 3164	3448	msedge.exe	80
PID 3448 wrote to memory of 3164	3448	msedge.exe	80
PID 3448 wrote to memory of 3164	3448	msedge.exe	80
PID 3448 wrote to memory of 3164	3448	msedge.exe	80
PID 3448 wrote to memory of 3164	3448	msedge.exe	80
PID 3448 wrote to memory of 3164	3448	msedge.exe	80
PID 3448 wrote to memory of 3164	3448	msedge.exe	80
PID 3448 wrote to memory of 3164	3448	msedge.exe	80
PID 3448 wrote to memory of 3164	3448	msedge.exe	80
PID 3448 wrote to memory of 3164	3448	msedge.exe	80
PID 3448 wrote to memory of 3164	3448	msedge.exe	80
PID 3448 wrote to memory of 3164	3448	msedge.exe	80
PID 3448 wrote to memory of 3164	3448	msedge.exe	80
PID 3448 wrote to memory of 3164	3448	msedge.exe	80
PID 3448 wrote to memory of 3164	3448	msedge.exe	80
PID 3448 wrote to memory of 3164	3448	msedge.exe	80
PID 3448 wrote to memory of 3164	3448	msedge.exe	80
PID 3448 wrote to memory of 3164	3448	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.youtube.com/redirect?event=comments&redir_token=QUFFLUhqbGdCLTFYdnZsZW80OGd0VlhLcE95c3ZpRTdMd3xBQ3Jtc0ttWGg1cjYxVS0zRHFZTVBlaUhGcmhRUlNKV0p1RVJoYXdwNEtfVGVEMENTdDVEcHN3VzhEUUNsa0tSOFcwUElqbFRfNElyclBxZWRpT2d6WEx2TkxVV2E4Unh2dkJZdWpjQ3g4WjFZNGhWX2lRanNtYw&q=https%3A%2F%2Froxplolts.net%2F
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffeda43cb8,0x7fffeda43cc8,0x7fffeda43cd8
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,6583138390572693381,5893721770911594771,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1856 /prefetch:2
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,6583138390572693381,5893721770911594771,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,6583138390572693381,5893721770911594771,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,6583138390572693381,5893721770911594771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,6583138390572693381,5893721770911594771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,6583138390572693381,5893721770911594771,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5012 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,6583138390572693381,5893721770911594771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,6583138390572693381,5893721770911594771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,6583138390572693381,5893721770911594771,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,6583138390572693381,5893721770911594771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,6583138390572693381,5893721770911594771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,6583138390572693381,5893721770911594771,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,6583138390572693381,5893721770911594771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1984 /prefetch:1
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,6583138390572693381,5893721770911594771,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,6583138390572693381,5893721770911594771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1912,6583138390572693381,5893721770911594771,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5604 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1756

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4368

C:\Users\Admin\Downloads\Вootstrapper-x64\Вootstrapper.exe
"C:\Users\Admin\Downloads\Вootstrapper-x64\Вootstrapper.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 1348
  2⤵
  - Program crash
  PID:4080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1676 -ip 1676
1⤵
PID:4308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c0a1774f8079fe496e694f35dfdcf8bc

SHA1
da3b4b9fca9a3f81b6be5b0cd6dd700603d448d3

SHA256
c041da0b90a5343ede7364ccf0428852103832c4efa8065a0cd1e8ce1ff181cb

SHA512
60d9e87f8383fe3afa2c8935f0e5a842624bb24b03b2d8057e0da342b08df18cf70bf55e41fa3ae54f73bc40a274cf6393d79ae01f6a1784273a25fa2761728b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e11c77d0fa99af6b1b282a22dcb1cf4a

SHA1
2593a41a6a63143d837700d01aa27b1817d17a4d

SHA256
d96f9bfcc81ba66db49a3385266a631899a919ed802835e6fb6b9f7759476ea0

SHA512
c8f69f503ab070a758e8e3ae57945c0172ead1894fdbfa2d853e5bb976ed3817ecc8f188eefd5092481effd4ef650788c8ff9a8d9a5ee4526f090952d7c859f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
744B

MD5
da55eddf89a97413d796e06398fa1eac

SHA1
dc8abd23fb9b4c89e5d487a6c368bf5e5bcc15ac

SHA256
3ebf671a9c77bc968d8faea9c15e397965945b2b19b33df736fa8dbc7d7daef5

SHA512
e270448e3f81a454d293ebf0a613f50e807f2f86e50a9aa51101603d384546bd798b91a43faccaf3b2788832959fdd73d7241d3dabf9cd3e02cd2b6ccf5ef202

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
be6e118ec399cbcf8c9681a4eacc2e44

SHA1
9863c1c80b146b30a3acc4383a12c0cc3b06e61b

SHA256
1382c11d56af834bac96d11f429be6bfcd8a8940671d1750824a2d9088fad366

SHA512
77d8e13a7ecc75350fb27a2c15e49ee446663655f5538197aafc77f0fae6c59dd09c33d79b963b95127d0f8a652ddb6926f49f906e862c6a1a24ddbfb1291e22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5ebe1f799b064f7c46448bb45d53ab9b

SHA1
af1dca885705cd55b36e42957bf2e9f40d333fb2

SHA256
71cfc90513bb61e2e53a1c0e68a42a2f4d311f330941cda3151711a3e15cd72c

SHA512
bc8f629e2f82742c996f5442876c46e17180b6ac36f390c6709f0001947842f255a0f04e3cc679c6c504b9c73588b0fbbf8bcb49d5753a12474265b8ea8d3e93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
282a1d0b9dc1f71e4331434cb357acba

SHA1
ad26bb8d9dda323646b10cdd7d9544d2050ad2c7

SHA256
4503d3ed5963f89c4847e1a294aa773d40ec1483c79022d4033a2f7edfed6f49

SHA512
6f66b7d80b458a59e0f5573385edd10f50d992c392277011c5fce18eb5cf71554d2807ed3932b051fd7af2d450f00834bf14cf7935c4db3f2afb5fdb2cacbc01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
18a83e9448b12d251c0f057c911f6129

SHA1
5b164230ce4303376ad8783bc0e9188dc6d23efd

SHA256
5ac1d515e2287c7b0585c6c4c3a627161814028ecdc070f90e98a5fa0477f212

SHA512
412e0ce21a6993af019c3241b546f4169d1adcf97e3b0fa69534fc87ec145f00224714e1994d3306f5447783572ef14d30b2d0609e6cddf8bcd7d07e772dd446

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7ab122fa73acd40b6d6feae38c04b392

SHA1
10fd0323ae09d174b843bdfd0ca0b287b4ae6196

SHA256
9905fd899a5f03279b2774081e04568a05c78e751ddf7582846074dbe66b9000

SHA512
91f5421681153fdfc33cfa2d7cbe187e8b93505eb98b77d8e7fb9897263d8d22e5b09c99969320c8e8f330db0cc4481bd30f20d03b8b1238a0900dedd8692c16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e753.TMP

Filesize
1KB

MD5
a2d001a8a855eb1ecdc2de86912c8b70

SHA1
6aed5556f8f950c636e60a55cad28e48816bdaf8

SHA256
ead5207b44614cb1ae4080d3eec7ec5d4b18e889210fec88af4368b2a7013160

SHA512
1e44ea5bf67b3f5cfe7df7ab337a42368998a23ee93278b7f39ca2bb00234664926b498bbc550963ec353af84f9b8a0187c34e96299be74e2fd760b042592a72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a14dac63c75ac256ac73e20429d4d76c

SHA1
9afcf013a587bb44f04ca06c2574073b793d5329

SHA256
15fa05678bda90ce714586089c24417d8c5fd3cf39fad1e84aeba76001fc821b

SHA512
e633b6c36c89f371e702594834743b04368e83d4db4a83010a803b40d18a2aafdb38a11df3c5b2dfd63d719227b0ed0116c2a1f4fccc0f2488442c3407ea61a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e18aceb7a9fbf3359a3f1ef641856490

SHA1
3ae5b4a4566449db9e6c4f9ff6636958951e45a2

SHA256
3d4d4a62cc98dc8c9ebd5242c0ee3b10c2232236c758cdcf4edb2a1e3282f7fe

SHA512
d1bb8ef22ca102478d3946c9cf5cabc8b25ffa2e5f6e6355f3a53473a86b1a574428702f89f4caf0c620d66b0b53283b762f902261db3783a8b75d6ca3aa02b4

Download Submit
C:\Users\Admin\Downloads\Вootstrapper-x64.zip

Filesize
327KB

MD5
09f3d3a5eab611746e3fdd9a006f6612

SHA1
58491045a53a77a734e9310b47947c054180b1b7

SHA256
a745c00c586b9f4eb5c8a658378024a533b21e907436c2e6046bb9cf744f2e13

SHA512
6ed5204e31f2a5f432d7b18a5bdac53517af9e121ab8a8c2ff0ba5eb386c132411bbb82eb94edbeac5f7d2a80bc12cedcc6c9d95ba49b7a2a36153b2e588af05

Download Submit
C:\Users\Admin\Downloads\Вootstrapper-x64.zip:Zone.Identifier

Filesize
824B

MD5
03f9c46942b75ff030eed4af60d2eb50

SHA1
6c6587f7261d0e0963b54f00c9062e6909e56336

SHA256
2dcdf29e1eed38a953db66779e5fdba51272d7a7fe86979b7d5d2d9cdd190c43

SHA512
b109dbbac7470ca8301cd6e362a724327cb878c8d16e258b6f898212d448e2f49281f1b78243df9e71dc0a7ce5c0ae38a4fa44333e8f3b93ed261d279b5e765b

Download Submit
memory/1676-226-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download