lumma | hxxps://app[.]mediafire[.]com/4mnoy8tqbct4q

Resubmissions

15-01-2025 05:06

250115-frrhsatnfj 10

15-01-2025 05:03

250115-fp586atnbj 3

15-01-2025 05:01

250115-fnk7latmem 10

Analysis

max time kernel
86s
max time network
87s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
15-01-2025 05:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://app.mediafire.com/4mnoy8tqbct4q

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2680 set thread context of 2468	2680	Loader.exe	104

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\GalaxyPr00j33ct2.53v.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3568	msedge.exe
3568	msedge.exe
3704	msedge.exe
3704	msedge.exe
1164	identity_helper.exe
1164	identity_helper.exe
4512	msedge.exe
4512	msedge.exe
3160	msedge.exe
3160	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3704 wrote to memory of 2880	3704	msedge.exe	77
PID 3704 wrote to memory of 2880	3704	msedge.exe	77
PID 3704 wrote to memory of 4916	3704	msedge.exe	78
PID 3704 wrote to memory of 4916	3704	msedge.exe	78
PID 3704 wrote to memory of 4916	3704	msedge.exe	78
PID 3704 wrote to memory of 4916	3704	msedge.exe	78
PID 3704 wrote to memory of 4916	3704	msedge.exe	78
PID 3704 wrote to memory of 4916	3704	msedge.exe	78
PID 3704 wrote to memory of 4916	3704	msedge.exe	78
PID 3704 wrote to memory of 4916	3704	msedge.exe	78
PID 3704 wrote to memory of 4916	3704	msedge.exe	78
PID 3704 wrote to memory of 4916	3704	msedge.exe	78
PID 3704 wrote to memory of 4916	3704	msedge.exe	78
PID 3704 wrote to memory of 4916	3704	msedge.exe	78
PID 3704 wrote to memory of 4916	3704	msedge.exe	78
PID 3704 wrote to memory of 4916	3704	msedge.exe	78
PID 3704 wrote to memory of 4916	3704	msedge.exe	78
PID 3704 wrote to memory of 4916	3704	msedge.exe	78
PID 3704 wrote to memory of 4916	3704	msedge.exe	78
PID 3704 wrote to memory of 4916	3704	msedge.exe	78
PID 3704 wrote to memory of 4916	3704	msedge.exe	78
PID 3704 wrote to memory of 4916	3704	msedge.exe	78
PID 3704 wrote to memory of 4916	3704	msedge.exe	78
PID 3704 wrote to memory of 4916	3704	msedge.exe	78
PID 3704 wrote to memory of 4916	3704	msedge.exe	78
PID 3704 wrote to memory of 4916	3704	msedge.exe	78
PID 3704 wrote to memory of 4916	3704	msedge.exe	78
PID 3704 wrote to memory of 4916	3704	msedge.exe	78
PID 3704 wrote to memory of 4916	3704	msedge.exe	78
PID 3704 wrote to memory of 4916	3704	msedge.exe	78
PID 3704 wrote to memory of 4916	3704	msedge.exe	78
PID 3704 wrote to memory of 4916	3704	msedge.exe	78
PID 3704 wrote to memory of 4916	3704	msedge.exe	78
PID 3704 wrote to memory of 4916	3704	msedge.exe	78
PID 3704 wrote to memory of 4916	3704	msedge.exe	78
PID 3704 wrote to memory of 4916	3704	msedge.exe	78
PID 3704 wrote to memory of 4916	3704	msedge.exe	78
PID 3704 wrote to memory of 4916	3704	msedge.exe	78
PID 3704 wrote to memory of 4916	3704	msedge.exe	78
PID 3704 wrote to memory of 4916	3704	msedge.exe	78
PID 3704 wrote to memory of 4916	3704	msedge.exe	78
PID 3704 wrote to memory of 4916	3704	msedge.exe	78
PID 3704 wrote to memory of 3568	3704	msedge.exe	79
PID 3704 wrote to memory of 3568	3704	msedge.exe	79
PID 3704 wrote to memory of 4904	3704	msedge.exe	80
PID 3704 wrote to memory of 4904	3704	msedge.exe	80
PID 3704 wrote to memory of 4904	3704	msedge.exe	80
PID 3704 wrote to memory of 4904	3704	msedge.exe	80
PID 3704 wrote to memory of 4904	3704	msedge.exe	80
PID 3704 wrote to memory of 4904	3704	msedge.exe	80
PID 3704 wrote to memory of 4904	3704	msedge.exe	80
PID 3704 wrote to memory of 4904	3704	msedge.exe	80
PID 3704 wrote to memory of 4904	3704	msedge.exe	80
PID 3704 wrote to memory of 4904	3704	msedge.exe	80
PID 3704 wrote to memory of 4904	3704	msedge.exe	80
PID 3704 wrote to memory of 4904	3704	msedge.exe	80
PID 3704 wrote to memory of 4904	3704	msedge.exe	80
PID 3704 wrote to memory of 4904	3704	msedge.exe	80
PID 3704 wrote to memory of 4904	3704	msedge.exe	80
PID 3704 wrote to memory of 4904	3704	msedge.exe	80
PID 3704 wrote to memory of 4904	3704	msedge.exe	80
PID 3704 wrote to memory of 4904	3704	msedge.exe	80
PID 3704 wrote to memory of 4904	3704	msedge.exe	80
PID 3704 wrote to memory of 4904	3704	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://app.mediafire.com/4mnoy8tqbct4q
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff84baa3cb8,0x7ff84baa3cc8,0x7ff84baa3cd8
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,14952110907735573077,8324219312568955198,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1928,14952110907735573077,8324219312568955198,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1928,14952110907735573077,8324219312568955198,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14952110907735573077,8324219312568955198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14952110907735573077,8324219312568955198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1928,14952110907735573077,8324219312568955198,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1928,14952110907735573077,8324219312568955198,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14952110907735573077,8324219312568955198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14952110907735573077,8324219312568955198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14952110907735573077,8324219312568955198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14952110907735573077,8324219312568955198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14952110907735573077,8324219312568955198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6372 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14952110907735573077,8324219312568955198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14952110907735573077,8324219312568955198,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3812 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14952110907735573077,8324219312568955198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14952110907735573077,8324219312568955198,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,14952110907735573077,8324219312568955198,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3160

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2008

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1508

C:\Users\Admin\Downloads\GalaxyPr00j33ct2.53v\GalaxyPr00j33ct2.53v\GalaxyPr00j33ct2.53v\Loader.exe
"C:\Users\Admin\Downloads\GalaxyPr00j33ct2.53v\GalaxyPr00j33ct2.53v\GalaxyPr00j33ct2.53v\Loader.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2680
- C:\Users\Admin\Downloads\GalaxyPr00j33ct2.53v\GalaxyPr00j33ct2.53v\GalaxyPr00j33ct2.53v\Loader.exe
  "C:\Users\Admin\Downloads\GalaxyPr00j33ct2.53v\GalaxyPr00j33ct2.53v\GalaxyPr00j33ct2.53v\Loader.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1544690d41d950f9c1358068301cfb5

SHA1
ae3ff81363fcbe33c419e49cabef61fb6837bffa

SHA256
53d69c9cc3c8aaf2c8b58ea6a2aa47c49c9ec11167dd9414cd9f4192f9978724

SHA512
1e4f1fe2877f4f947d33490e65898752488e48de34d61e197e4448127d6b1926888de80b62349d5a88b96140eed0a5b952ef4dd7ca318689f76e12630c9029da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9314124f4f0ad9f845a0d7906fd8dfd8

SHA1
0d4f67fb1a11453551514f230941bdd7ef95693c

SHA256
cbd58fa358e4b1851c3da2d279023c29eba66fb4d438c6e87e7ce5169ffb910e

SHA512
87b9060ca4942974bd8f95b8998df7b2702a3f4aba88c53b2e3423a532a75407070368f813a5bbc0251864b4eae47e015274a839999514386d23c8a526d05d85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
f9b0835a614c8bbf10ac82f94b57c36d

SHA1
a449a58728279f660ccba35111d50dc27e5326fc

SHA256
cdb79967e72049f0db746cec98cbb347720da4f13dc34718764d37bbe815f01f

SHA512
d130f50a0a21b88d4c4edc00d5cfb7641aa1ae61c73f847810808f6a31cd1f552c5691eb6de76a4af894200e9d43c1ea9544efa37186969dce0c57934521d51e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
18e0b94774f190b1806ab114459c2d5b

SHA1
4d63a291b7202ae34ed313f1c600013770bed118

SHA256
406d6608c804e2df6c47d885b987bd441eb2275c70875c9a94e37dbc92c1f274

SHA512
2ae93f8b1976ede2cf89e89e578313c4ab43ad489ec115955932655b35e54628f2e361fec07e0f146fed668487ecbbd35fe915d87edf181163bf8442117adca8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
2dca283ea63040e79e50ae4a50538c64

SHA1
274ee8c2134d05941389d29659073189f44b9a08

SHA256
ccb074a67f4af43921688ae3922618988a9cf13c4b4b270d4a0998fe90af1ccf

SHA512
8da99f5b6c36d1cc0c84e5941b450efa2ff49500f69b00d0582a28258ac54bbcc6d04d1baad30312b4a0cc206209204864616956609a1a0982a5c9fb1de7d95f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
f971d89e8e99d9a79b3138e1a1e91ee5

SHA1
f808df8755c348879c10e17173f7bdeee5cc9073

SHA256
e1df6aa5fd74b9589696ca8bd917ddbcb56dfa8c0558fcca232eeb4dd6422281

SHA512
3774697ebb19b9b3719af3b2c55aaa541e172bf3eb5802394ec91c7bcc831c25d657ed95bd18476a42e1fce0aed518021e8dc06fae58ba3ae085ea198c0f8497

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cb265e5e60de2b8f075d63d8f3ed2602

SHA1
00d7c00e15afba49cbebe420f9e607fa9358cad8

SHA256
e31f07a3986d699b951311ce9b40dafc2a625e2ceb254a974f504b87c2a08879

SHA512
a21ffa132995ffe870fe2e0824b75403b66be939023a6fbb29ce895d6647c71064b5a70488d379d52dab2e2b0b1470b06b784768088741393e495f72d0748aea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5b6b4d2d4aeaf7c6ea099ea4806aafc4

SHA1
d0775f945b39173342a434a352cb9c37d29d747c

SHA256
4b093ea7145c62f38abc0de61784af40faac275b21788abfb86f413369c33123

SHA512
5d2d61cd8d00d7aa9fe730285c447444da3856a5bda3bc1a13ebf3e43db17e6ef8500b51e1fdadeaa63fcea0d5e357fbf5a2b5167364f42119b3079519910192

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
95aa09165fa13ffdca0fd8d02899a98f

SHA1
c62007b00e1bcd85ee11aa5eeb1c4808c81cb294

SHA256
7571e7ecd4839f9bb97da9e389d234e20cad5a087bbe4d560d492a45feaffc62

SHA512
a54f0148d6171e53f6cf57fd353fc9f9e6a50122821b8fa7682f2751e61a32e1f702e87dbe6538c298696d7225618d58e4d735535c3e3fcf8d1e48fe5c3e8190

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f8420a01778e4a95441a67ab60fbd135

SHA1
822482e1440e72326a16bdb0f322266cf678eaa9

SHA256
2f66ab873418d6159a9dbc344126330b340d1d76386f5875b35c743de642d399

SHA512
095e26ef1d037d882c1a3462fe362e1f51506abf88757a0486920035ed04ac9abd0a13c2b36c38b6d8d686785e56661c909d18e062128b9d7b54cf33eb00138f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
b44360020ee183600bd32e04257c37e8

SHA1
a99abb8effa3e972df90caadccad5c58ac690fec

SHA256
caa4b371ddbdee256f79e1b4a724bb5141073a256ba86634d424262e4414edb7

SHA512
d2b263013d3a3845f290ec223447c3c7f0dc1c92d2a9d7f5d2a8f8167721527088254752c14748f6752d92d179f747582e9ad279dee4631f8f9e308efba13dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ce0e.TMP

Filesize
706B

MD5
4aa11e481bf2f9c6ac8645035a962dc2

SHA1
dee8bd5c30fa4443ad71bdb5d296f2b601b13c66

SHA256
ab0f43becf0957ccce64889b38abb32d885d1e832a6d6b6889998878d7c764a0

SHA512
8df641233e3ce2d5a92548037f7bedeb8f4e842af1ecda0fb2901a7a4ee4792858f78bf488fa28123a9644c8920ca227cd1b8883c927e0c9c16a98bfe3bd4b74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bb59e8baaf46226f333e5de79cf86796

SHA1
73dca9aea3a3a6ec022933993ce527fb860e6489

SHA256
c3bd54c27c227343377a8c57769529733debaea069b357a8975e56e631da3132

SHA512
38cbeb0401fd3ffcc97dce215d52a42cb0aa76aa216c20a17012e494f50ca97fcc84388cd1e31be23cd15766db0ab147f401d811936c9c11e5057b498654ee5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f2e80c497be5d16b87d316e514ff8467

SHA1
256344fd8da14ef5daad11de9d580b4caea47390

SHA256
22ef5584c1ca95a7d148e17a79cfb40f1582c2dfee5f3717aeba567068c6773b

SHA512
599c13532e65a7afaa0a3655c8dc693cebdfca1f3b814a4248ad8560ef4b5ceede91230ea67dffff621d3137fb7e3e855afbb99f85f73ac6bac6ea2dff009a07

Download Submit
C:\Users\Admin\Downloads\GalaxyPr00j33ct2.53v.zip

Filesize
14.5MB

MD5
8faa3a936e2b8b9d2eefbf7fa1f46dd9

SHA1
f60190c689ae348b18bf42668dc36c8f96b8f7d9

SHA256
8d43ce0fe2d4a2b633d0dbe41c9b4d3ba74b24a81b98200cca203c705babcd95

SHA512
4de15739e50345aa18e202394dcb354d05150280b86e929f497cddbcaf037ee5b17fe56a8b960a48d67f6bd9c699cac5d809799e8d1806d66de66cd4b310aa12

Download Submit
C:\Users\Admin\Downloads\GalaxyPr00j33ct2.53v.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
memory/2468-353-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2468-354-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download