lumma | hxxps://ryos[.]transfernow[.]net/en/bld?utm_source=20241231mbPXRY6g

Analysis

max time kernel
112s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-01-2025 02:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://ryos.transfernow.net/en/bld?utm_source=20241231mbPXRY6g

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://jubbenjusk.biz/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3856	752	WerFault.exe	115
2252	1720	WerFault.exe	117
3644	3936	WerFault.exe	118

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3976	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1048	msedge.exe
1048	msedge.exe
4212	msedge.exe
4212	msedge.exe
212	identity_helper.exe
212	identity_helper.exe
3092	msedge.exe
3092	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4212 wrote to memory of 2772	4212	msedge.exe	83
PID 4212 wrote to memory of 2772	4212	msedge.exe	83
PID 4212 wrote to memory of 3476	4212	msedge.exe	85
PID 4212 wrote to memory of 3476	4212	msedge.exe	85
PID 4212 wrote to memory of 3476	4212	msedge.exe	85
PID 4212 wrote to memory of 3476	4212	msedge.exe	85
PID 4212 wrote to memory of 3476	4212	msedge.exe	85
PID 4212 wrote to memory of 3476	4212	msedge.exe	85
PID 4212 wrote to memory of 3476	4212	msedge.exe	85
PID 4212 wrote to memory of 3476	4212	msedge.exe	85
PID 4212 wrote to memory of 3476	4212	msedge.exe	85
PID 4212 wrote to memory of 3476	4212	msedge.exe	85
PID 4212 wrote to memory of 3476	4212	msedge.exe	85
PID 4212 wrote to memory of 3476	4212	msedge.exe	85
PID 4212 wrote to memory of 3476	4212	msedge.exe	85
PID 4212 wrote to memory of 3476	4212	msedge.exe	85
PID 4212 wrote to memory of 3476	4212	msedge.exe	85
PID 4212 wrote to memory of 3476	4212	msedge.exe	85
PID 4212 wrote to memory of 3476	4212	msedge.exe	85
PID 4212 wrote to memory of 3476	4212	msedge.exe	85
PID 4212 wrote to memory of 3476	4212	msedge.exe	85
PID 4212 wrote to memory of 3476	4212	msedge.exe	85
PID 4212 wrote to memory of 3476	4212	msedge.exe	85
PID 4212 wrote to memory of 3476	4212	msedge.exe	85
PID 4212 wrote to memory of 3476	4212	msedge.exe	85
PID 4212 wrote to memory of 3476	4212	msedge.exe	85
PID 4212 wrote to memory of 3476	4212	msedge.exe	85
PID 4212 wrote to memory of 3476	4212	msedge.exe	85
PID 4212 wrote to memory of 3476	4212	msedge.exe	85
PID 4212 wrote to memory of 3476	4212	msedge.exe	85
PID 4212 wrote to memory of 3476	4212	msedge.exe	85
PID 4212 wrote to memory of 3476	4212	msedge.exe	85
PID 4212 wrote to memory of 3476	4212	msedge.exe	85
PID 4212 wrote to memory of 3476	4212	msedge.exe	85
PID 4212 wrote to memory of 3476	4212	msedge.exe	85
PID 4212 wrote to memory of 3476	4212	msedge.exe	85
PID 4212 wrote to memory of 3476	4212	msedge.exe	85
PID 4212 wrote to memory of 3476	4212	msedge.exe	85
PID 4212 wrote to memory of 3476	4212	msedge.exe	85
PID 4212 wrote to memory of 3476	4212	msedge.exe	85
PID 4212 wrote to memory of 3476	4212	msedge.exe	85
PID 4212 wrote to memory of 3476	4212	msedge.exe	85
PID 4212 wrote to memory of 1048	4212	msedge.exe	86
PID 4212 wrote to memory of 1048	4212	msedge.exe	86
PID 4212 wrote to memory of 4240	4212	msedge.exe	87
PID 4212 wrote to memory of 4240	4212	msedge.exe	87
PID 4212 wrote to memory of 4240	4212	msedge.exe	87
PID 4212 wrote to memory of 4240	4212	msedge.exe	87
PID 4212 wrote to memory of 4240	4212	msedge.exe	87
PID 4212 wrote to memory of 4240	4212	msedge.exe	87
PID 4212 wrote to memory of 4240	4212	msedge.exe	87
PID 4212 wrote to memory of 4240	4212	msedge.exe	87
PID 4212 wrote to memory of 4240	4212	msedge.exe	87
PID 4212 wrote to memory of 4240	4212	msedge.exe	87
PID 4212 wrote to memory of 4240	4212	msedge.exe	87
PID 4212 wrote to memory of 4240	4212	msedge.exe	87
PID 4212 wrote to memory of 4240	4212	msedge.exe	87
PID 4212 wrote to memory of 4240	4212	msedge.exe	87
PID 4212 wrote to memory of 4240	4212	msedge.exe	87
PID 4212 wrote to memory of 4240	4212	msedge.exe	87
PID 4212 wrote to memory of 4240	4212	msedge.exe	87
PID 4212 wrote to memory of 4240	4212	msedge.exe	87
PID 4212 wrote to memory of 4240	4212	msedge.exe	87
PID 4212 wrote to memory of 4240	4212	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://ryos.transfernow.net/en/bld?utm_source=20241231mbPXRY6g
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ff9970546f8,0x7ff997054708,0x7ff997054718
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,5362260616391533246,8074859010021216610,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,5362260616391533246,8074859010021216610,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2532 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,5362260616391533246,8074859010021216610,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5362260616391533246,8074859010021216610,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5362260616391533246,8074859010021216610,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,5362260616391533246,8074859010021216610,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,5362260616391533246,8074859010021216610,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2112,5362260616391533246,8074859010021216610,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5362260616391533246,8074859010021216610,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2112,5362260616391533246,8074859010021216610,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5362260616391533246,8074859010021216610,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2648 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5362260616391533246,8074859010021216610,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1948 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5362260616391533246,8074859010021216610,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5362260616391533246,8074859010021216610,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:3952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5084

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3304

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp2_0P3NME.zip\README.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3976

C:\Users\Admin\Downloads\Bootstrapper.exe
"C:\Users\Admin\Downloads\Bootstrapper.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 752 -s 1300
  2⤵
  - Program crash
  PID:3856

C:\Users\Admin\Downloads\Bootstrapper.exe
"C:\Users\Admin\Downloads\Bootstrapper.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 1360
  2⤵
  - Program crash
  PID:2252

C:\Users\Admin\Downloads\Bootstrapper.exe
"C:\Users\Admin\Downloads\Bootstrapper.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 1324
  2⤵
  - Program crash
  PID:3644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 752 -ip 752
1⤵
PID:1536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1720 -ip 1720
1⤵
PID:5084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3936 -ip 3936
1⤵
PID:1644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
648B

MD5
2b1f5f0de85755b865a83dbc7eb53523

SHA1
5f51f6b7ae47b1244659e6d173b6a678209c425b

SHA256
65902a5fdecbc18119d14524ef1dc52a62e961f60124bee17ca098ce8f01475f

SHA512
a0efaa7ac91593cbe228ff169f197a30cf4e740b73bac827edcc0dd620dd343fddc651e4f0a6e92bbd5cbc9b83131b81d029230d7a48adc10002e81652894c52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1289f23645dc34ec05f32d03a50fbb68

SHA1
bb0f522f746e9dac2db3758d4ae52d01afbd7432

SHA256
771ed130bb9accbb50b8d846675b48319eb6e69ac1cf2baa69beb3cc7976aa26

SHA512
f0ec3a626fb8efd8568c8cb771a3c8459bb8a4df314750a2386e78978d564a8f60401058d07ef6798f41f00aed19c4b4bb030069966997f571ac774b30918d90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4e8e178a9f3ad44b398d6988b5c65ffe

SHA1
612142c674fa07a11f6c2c4d156c33f20563ac0e

SHA256
d516acb7c29492dcfd61def241b35ca3d4ba6c56e9318354a9012f8e8b474f22

SHA512
dec13d94b565cdd66ba0ac6e022d9c8f2fbe51e4199be03fd1f3d17d16b5d0fa1b8580451c4872dc6adaf65f47d5b36085c0835e34358397658ce81cd2a5e055

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bee7da7cc4edcf673ee01cee112cef7d

SHA1
04a828ce79b7f3fd585e80a872e4d8d32b12b8be

SHA256
db327004d97d6e15c83f8033093c620896420a03dc3a1ad4ef86dddd57584726

SHA512
859bc37a47664646fd93dc27344d6aa0f2b1162f2c43f0bec1328df1ce321a9e306d8198ce27a510ea7a468f53f136e45260055ae8c31799d08057a0f3a32826

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f745411566b4c36a53090ddeffd115c6

SHA1
88c688dbca0a747798ee84c3f990dfe450232360

SHA256
3be2bd9d6db6e2d87f2482cdedcb8d8e7882a7b3f85f30abc1f2830b9314b668

SHA512
e155c07df845d73153e1906f9cbd68028cf87792a4157d9c6627420c42219771c6046bc3445ad5d231af082b11bb57708be66a241ba3ad6ad136e48bebca83ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4eefe7e4a7b5a487613cb0ce48d20885

SHA1
9020ca8f93b90f2b08c9c10f67bd3b3c50901633

SHA256
38b3393e32f2d23797b5c72fd68971a9086784983e1139f595a0fe60379a44aa

SHA512
a8883f87ef17d7e08b5b603437ba4df3984304e5e9eb12b3668966dd2ea5d83753e9cdabe7bfddb58c3aa2f3c1f11b20fd0fff3c9003c9db315d11559ede3b37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58023d.TMP

Filesize
871B

MD5
cb54f535cfe02330ef1b36445add2013

SHA1
dcd3fc605d2ea6c0f869576de3137fd55197970b

SHA256
eaee4f680b4bf029795993a9990e47d07b200dea5f0aeb6514576a4da6e97de4

SHA512
c307f322a532e1f644bf9a2929abdf93549ec7705d2ffaa83e99071dbd5329b3f2634da02042f9b3350ed30e47c3b56b775e92e1545fc2cc30c8ad8997a8ac6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4a98987bd2ae245e102049aa5b769720

SHA1
951760ce065d24334d255979846b5cf5465907e6

SHA256
72996a7059cb12ddbadc547e2ebeddb8b602273c33c20a7eb43c2e94eaa4bb66

SHA512
eb44baeec04b243a6a972769ad2a20fdba61096a8086272e8e9ecb8cbd752ca897bb4501d8cfa05205ad2f55ac3e3bc73af921b9ecab7c0ef295d7355b9bc503

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5d3b5e1f0fe23b2318575f4d8695a89e

SHA1
bc91abe3035c39986194a0c1c88a29acc0716d39

SHA256
e7649284e41e30527aac277f0585ef01b48d0bc1bd4b922b5041b3d7974aeda7

SHA512
f33f36c9dc0ae2ebfdcd6da8445da514e02fef44f759d5b6263c801a305b4844465d137b9009e0b92cce308255c936726d695b58acb3f44b120fa240cdc80a61

Download Submit
C:\Users\Admin\Downloads\0P3NME.zip

Filesize
396KB

MD5
d9ca817a47df0f55ddbfa380fdfc1f5d

SHA1
7dc25bd49aa266786e0f8ca2b6a1af12b4f09e6d

SHA256
c68d6bcc8b0d0591b82e1a2ef8321382a57c56ff58831aadf58f57f3fe9d1096

SHA512
8547873a8c6004406a1743a68deadfc39d87a4860b65fba4af4a1f8ad3adbacad5989c4ff1b0d44d13b4a8386ae848012e2459d61e121fd9a56e159d0b0c5a37

Download Submit
memory/752-213-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/752-219-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/1720-217-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/3936-218-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download