lumma | hxxp://ethelium[.]space

Analysis

max time kernel
72s
max time network
73s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
17-01-2025 21:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://ethelium.space

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ethelium.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Ethelium.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3888	msedge.exe
3888	msedge.exe
4068	msedge.exe
4068	msedge.exe
2052	msedge.exe
2052	msedge.exe
4916	identity_helper.exe
4916	identity_helper.exe
1088	msedge.exe
1088	msedge.exe
3712	Ethelium.exe
3712	Ethelium.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 3464	4068	msedge.exe	78
PID 4068 wrote to memory of 3464	4068	msedge.exe	78
PID 4068 wrote to memory of 3312	4068	msedge.exe	79
PID 4068 wrote to memory of 3312	4068	msedge.exe	79
PID 4068 wrote to memory of 3312	4068	msedge.exe	79
PID 4068 wrote to memory of 3312	4068	msedge.exe	79
PID 4068 wrote to memory of 3312	4068	msedge.exe	79
PID 4068 wrote to memory of 3312	4068	msedge.exe	79
PID 4068 wrote to memory of 3312	4068	msedge.exe	79
PID 4068 wrote to memory of 3312	4068	msedge.exe	79
PID 4068 wrote to memory of 3312	4068	msedge.exe	79
PID 4068 wrote to memory of 3312	4068	msedge.exe	79
PID 4068 wrote to memory of 3312	4068	msedge.exe	79
PID 4068 wrote to memory of 3312	4068	msedge.exe	79
PID 4068 wrote to memory of 3312	4068	msedge.exe	79
PID 4068 wrote to memory of 3312	4068	msedge.exe	79
PID 4068 wrote to memory of 3312	4068	msedge.exe	79
PID 4068 wrote to memory of 3312	4068	msedge.exe	79
PID 4068 wrote to memory of 3312	4068	msedge.exe	79
PID 4068 wrote to memory of 3312	4068	msedge.exe	79
PID 4068 wrote to memory of 3312	4068	msedge.exe	79
PID 4068 wrote to memory of 3312	4068	msedge.exe	79
PID 4068 wrote to memory of 3312	4068	msedge.exe	79
PID 4068 wrote to memory of 3312	4068	msedge.exe	79
PID 4068 wrote to memory of 3312	4068	msedge.exe	79
PID 4068 wrote to memory of 3312	4068	msedge.exe	79
PID 4068 wrote to memory of 3312	4068	msedge.exe	79
PID 4068 wrote to memory of 3312	4068	msedge.exe	79
PID 4068 wrote to memory of 3312	4068	msedge.exe	79
PID 4068 wrote to memory of 3312	4068	msedge.exe	79
PID 4068 wrote to memory of 3312	4068	msedge.exe	79
PID 4068 wrote to memory of 3312	4068	msedge.exe	79
PID 4068 wrote to memory of 3312	4068	msedge.exe	79
PID 4068 wrote to memory of 3312	4068	msedge.exe	79
PID 4068 wrote to memory of 3312	4068	msedge.exe	79
PID 4068 wrote to memory of 3312	4068	msedge.exe	79
PID 4068 wrote to memory of 3312	4068	msedge.exe	79
PID 4068 wrote to memory of 3312	4068	msedge.exe	79
PID 4068 wrote to memory of 3312	4068	msedge.exe	79
PID 4068 wrote to memory of 3312	4068	msedge.exe	79
PID 4068 wrote to memory of 3312	4068	msedge.exe	79
PID 4068 wrote to memory of 3312	4068	msedge.exe	79
PID 4068 wrote to memory of 3888	4068	msedge.exe	80
PID 4068 wrote to memory of 3888	4068	msedge.exe	80
PID 4068 wrote to memory of 684	4068	msedge.exe	81
PID 4068 wrote to memory of 684	4068	msedge.exe	81
PID 4068 wrote to memory of 684	4068	msedge.exe	81
PID 4068 wrote to memory of 684	4068	msedge.exe	81
PID 4068 wrote to memory of 684	4068	msedge.exe	81
PID 4068 wrote to memory of 684	4068	msedge.exe	81
PID 4068 wrote to memory of 684	4068	msedge.exe	81
PID 4068 wrote to memory of 684	4068	msedge.exe	81
PID 4068 wrote to memory of 684	4068	msedge.exe	81
PID 4068 wrote to memory of 684	4068	msedge.exe	81
PID 4068 wrote to memory of 684	4068	msedge.exe	81
PID 4068 wrote to memory of 684	4068	msedge.exe	81
PID 4068 wrote to memory of 684	4068	msedge.exe	81
PID 4068 wrote to memory of 684	4068	msedge.exe	81
PID 4068 wrote to memory of 684	4068	msedge.exe	81
PID 4068 wrote to memory of 684	4068	msedge.exe	81
PID 4068 wrote to memory of 684	4068	msedge.exe	81
PID 4068 wrote to memory of 684	4068	msedge.exe	81
PID 4068 wrote to memory of 684	4068	msedge.exe	81
PID 4068 wrote to memory of 684	4068	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://ethelium.space
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe0e083cb8,0x7ffe0e083cc8,0x7ffe0e083cd8
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1724,3353452921710300653,2338836219153427357,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1724,3353452921710300653,2338836219153427357,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1724,3353452921710300653,2338836219153427357,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,3353452921710300653,2338836219153427357,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3148 /prefetch:1
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,3353452921710300653,2338836219153427357,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,3353452921710300653,2338836219153427357,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4536 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,3353452921710300653,2338836219153427357,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,3353452921710300653,2338836219153427357,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,3353452921710300653,2338836219153427357,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1724,3353452921710300653,2338836219153427357,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1724,3353452921710300653,2338836219153427357,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,3353452921710300653,2338836219153427357,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,3353452921710300653,2338836219153427357,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,3353452921710300653,2338836219153427357,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1724,3353452921710300653,2338836219153427357,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,3353452921710300653,2338836219153427357,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1716 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,3353452921710300653,2338836219153427357,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3060 /prefetch:1
  2⤵
  PID:128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,3353452921710300653,2338836219153427357,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,3353452921710300653,2338836219153427357,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:4492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4288

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5060

C:\Users\Admin\Downloads\Ethelium\Ethelium\Ethelium.exe
"C:\Users\Admin\Downloads\Ethelium\Ethelium\Ethelium.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
554d6d27186fa7d6762d95dde7a17584

SHA1
93ea7b20b8fae384cf0be0d65e4295097112fdca

SHA256
2fa6145571e1f1ece9850a1ac94661213d3e0d82f1cef7ac1286ff6b2c2017cb

SHA512
57d9008ccabc315bd0e829b19fe91e24bab6ef20bcfab651b937b0f38eec840b58d0aed092a3bbedd2d6a95d5c150372a1e51087572de55672172adc1fc468a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a28bb0d36049e72d00393056dce10a26

SHA1
c753387b64cc15c0efc80084da393acdb4fc01d0

SHA256
684d797e28b7fd86af84bfb217d190e4f5e03d92092d988a6091b2c7bbbd67c1

SHA512
20940fee33aa2194c36a3db92d4fd314ce7eacc2aa745abec62aa031c2a53ba4ff89f2568626e7bd2536090175f8d045c3bb52c5faa5ecc8da8410ab5fc519f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
08db480232b4a8fa8e0ded8f69c238c3

SHA1
98bc9209e56cf0c2ff86b15e4f530883c10ef9bb

SHA256
aeac6b7e07ec99a56a41665af1ce9791ba3f6eec5eeb86ce429e4ee06855a456

SHA512
91a821eee4b3a9757de0659de214aee6a8552418db29c439866ba094bc3d47cd37f422e1e6bccab16d03c9c13908f4bdc140eabecf9385108590a8c6618d2e4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
cdadef567a947ff54b0f58ca65a02129

SHA1
2465fc05753f2488ef2f3f6cf8e7038f8388d6ab

SHA256
c15db3fcc9df168201e775c0039c897d9118de94aa05f05e6feb330a2d050c93

SHA512
e701628abff18f62fcbd9e5d62fee8a32cdc055f765129ede7db5fb458b51ed13b8d5c4d29776cf05997f84a3a6c801f77fbcb15cf871e46ff6a6b94504a7975

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d2a93fe24fb47398b24964b9e2934c7e

SHA1
357f34ffd324119e9c76f7f9f244169305ad0e55

SHA256
06374229f3a8ce67977ebab919ad1811690779b9b2255a712303f89f054cbb73

SHA512
f08518de8c6e522fd94f0217b45f53acf79485e8438eda59d77a0e2be8f58cad4c2737b082f8683fcef336ac3b90007f761c6146c2e74bf3f473b462b1e84843

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
84f8429c454f119d327bbae856c2ab78

SHA1
b30e4efb5508e56d2745588b033ff6202606c708

SHA256
681d3a39796a338194db9cc33b48f226dee89f5c673315be19a6162161a73503

SHA512
c59c10f866613675afaa71a998b978f39f0d43796ae85e1026c59d47ba786bed351a0121a5371301e058bb60aafa2c1869999b28c0209904d0b27dd314f84d28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7be4143650a35e0c115fa738b90446eb

SHA1
e8b293f2516de63c1acbca80a5dae8db066f63b1

SHA256
ca2195f43a9e4cd171e9da55829ba71360f75742685006c6d24595f045b5777b

SHA512
e5b2b9f52ced72a84f4b6cdf3e21d7dca705837193c68ec7a745b5973f8d4b24db141f45c7f1c82169ee676e6c6485ecaaaddc8cd2cb948f3af8060d7a07ddb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b38f0e1e5eb134a737649e21963d1c5f

SHA1
c3f4b5e69484274cc548a13b9ec3cddf68a40df5

SHA256
480ae1a9252603acd239a3a783f762b0455a1f843d64ac78cbb4503475b628a9

SHA512
d4e19b741d03933161f583f73d78678adc3bfb4c8979241cfe2e2706cf67f9c2c82b0b03e1dcc85cfd3688dbb932348703355acbf09a9a4becfb81822da0c671

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
523f4017eeb74fb96225dbe5a8208227

SHA1
c3b53327f7e21e3f23dbe7354b5b8b9c4b20931e

SHA256
afe689afd6647a5e0b865972cdeec5b3ed9eb20e68c9e123fa48ddaa87010b26

SHA512
dcebf3b7ecb64239ffa2765af09095302e3f2641ac5a3a8e876040229141707115c9756ba96b9755a63f9ff62ecc40127e2645338521c81287fcd5b197a8bd64

Download Submit
C:\Users\Admin\Downloads\Ethelium.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
memory/3712-196-0x0000000000400000-0x00000000006D1000-memory.dmp

Filesize
2.8MB

Download
memory/3712-220-0x0000000000400000-0x00000000006D1000-memory.dmp

Filesize
2.8MB

Download
memory/3712-221-0x0000000002590000-0x00000000025E9000-memory.dmp

Filesize
356KB

Download