lumma | hxxps://github[.]com/FlqmzeCraft/cheat-escape-from-tarkov/blob/main/Loader[.]zip

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-01-2025 15:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/FlqmzeCraft/cheat-escape-from-tarkov/blob/main/Loader.zip

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://servicedny.site/api

https://authorisev.site/api

https://faulteyotk.site/api

https://dilemmadu.site/api

https://contemteny.site/api

https://goalyfeastz.site/api

https://opposezmny.site/api

https://seallysl.site/api

https://mafnufacut.cyou/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Loads dropped DLL 2 IoCs

pid	Process
1620	Loader.exe
2644	Loader.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
65	raw.githubusercontent.com
66	raw.githubusercontent.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1620 set thread context of 2088	1620	Loader.exe	116
PID 2644 set thread context of 756	2644	Loader.exe	119

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_regiis.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_regiis.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3708	msedge.exe
3708	msedge.exe
2124	msedge.exe
2124	msedge.exe
4992	identity_helper.exe
4992	identity_helper.exe
4240	msedge.exe
4240	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 3580	2124	msedge.exe	82
PID 2124 wrote to memory of 3580	2124	msedge.exe	82
PID 2124 wrote to memory of 2732	2124	msedge.exe	83
PID 2124 wrote to memory of 2732	2124	msedge.exe	83
PID 2124 wrote to memory of 2732	2124	msedge.exe	83
PID 2124 wrote to memory of 2732	2124	msedge.exe	83
PID 2124 wrote to memory of 2732	2124	msedge.exe	83
PID 2124 wrote to memory of 2732	2124	msedge.exe	83
PID 2124 wrote to memory of 2732	2124	msedge.exe	83
PID 2124 wrote to memory of 2732	2124	msedge.exe	83
PID 2124 wrote to memory of 2732	2124	msedge.exe	83
PID 2124 wrote to memory of 2732	2124	msedge.exe	83
PID 2124 wrote to memory of 2732	2124	msedge.exe	83
PID 2124 wrote to memory of 2732	2124	msedge.exe	83
PID 2124 wrote to memory of 2732	2124	msedge.exe	83
PID 2124 wrote to memory of 2732	2124	msedge.exe	83
PID 2124 wrote to memory of 2732	2124	msedge.exe	83
PID 2124 wrote to memory of 2732	2124	msedge.exe	83
PID 2124 wrote to memory of 2732	2124	msedge.exe	83
PID 2124 wrote to memory of 2732	2124	msedge.exe	83
PID 2124 wrote to memory of 2732	2124	msedge.exe	83
PID 2124 wrote to memory of 2732	2124	msedge.exe	83
PID 2124 wrote to memory of 2732	2124	msedge.exe	83
PID 2124 wrote to memory of 2732	2124	msedge.exe	83
PID 2124 wrote to memory of 2732	2124	msedge.exe	83
PID 2124 wrote to memory of 2732	2124	msedge.exe	83
PID 2124 wrote to memory of 2732	2124	msedge.exe	83
PID 2124 wrote to memory of 2732	2124	msedge.exe	83
PID 2124 wrote to memory of 2732	2124	msedge.exe	83
PID 2124 wrote to memory of 2732	2124	msedge.exe	83
PID 2124 wrote to memory of 2732	2124	msedge.exe	83
PID 2124 wrote to memory of 2732	2124	msedge.exe	83
PID 2124 wrote to memory of 2732	2124	msedge.exe	83
PID 2124 wrote to memory of 2732	2124	msedge.exe	83
PID 2124 wrote to memory of 2732	2124	msedge.exe	83
PID 2124 wrote to memory of 2732	2124	msedge.exe	83
PID 2124 wrote to memory of 2732	2124	msedge.exe	83
PID 2124 wrote to memory of 2732	2124	msedge.exe	83
PID 2124 wrote to memory of 2732	2124	msedge.exe	83
PID 2124 wrote to memory of 2732	2124	msedge.exe	83
PID 2124 wrote to memory of 2732	2124	msedge.exe	83
PID 2124 wrote to memory of 2732	2124	msedge.exe	83
PID 2124 wrote to memory of 3708	2124	msedge.exe	84
PID 2124 wrote to memory of 3708	2124	msedge.exe	84
PID 2124 wrote to memory of 2716	2124	msedge.exe	85
PID 2124 wrote to memory of 2716	2124	msedge.exe	85
PID 2124 wrote to memory of 2716	2124	msedge.exe	85
PID 2124 wrote to memory of 2716	2124	msedge.exe	85
PID 2124 wrote to memory of 2716	2124	msedge.exe	85
PID 2124 wrote to memory of 2716	2124	msedge.exe	85
PID 2124 wrote to memory of 2716	2124	msedge.exe	85
PID 2124 wrote to memory of 2716	2124	msedge.exe	85
PID 2124 wrote to memory of 2716	2124	msedge.exe	85
PID 2124 wrote to memory of 2716	2124	msedge.exe	85
PID 2124 wrote to memory of 2716	2124	msedge.exe	85
PID 2124 wrote to memory of 2716	2124	msedge.exe	85
PID 2124 wrote to memory of 2716	2124	msedge.exe	85
PID 2124 wrote to memory of 2716	2124	msedge.exe	85
PID 2124 wrote to memory of 2716	2124	msedge.exe	85
PID 2124 wrote to memory of 2716	2124	msedge.exe	85
PID 2124 wrote to memory of 2716	2124	msedge.exe	85
PID 2124 wrote to memory of 2716	2124	msedge.exe	85
PID 2124 wrote to memory of 2716	2124	msedge.exe	85
PID 2124 wrote to memory of 2716	2124	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/FlqmzeCraft/cheat-escape-from-tarkov/blob/main/Loader.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffda90946f8,0x7ffda9094708,0x7ffda9094718
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,4695002441859393931,13425746021158212225,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,4695002441859393931,13425746021158212225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,4695002441859393931,13425746021158212225,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4695002441859393931,13425746021158212225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4695002441859393931,13425746021158212225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,4695002441859393931,13425746021158212225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,4695002441859393931,13425746021158212225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4695002441859393931,13425746021158212225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4695002441859393931,13425746021158212225,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4695002441859393931,13425746021158212225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4695002441859393931,13425746021158212225,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2072,4695002441859393931,13425746021158212225,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1756 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4695002441859393931,13425746021158212225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2232 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,4695002441859393931,13425746021158212225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,4695002441859393931,13425746021158212225,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4720 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2488

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2404

C:\Users\Admin\AppData\Local\Temp\Temp1_Loader.zip\Loader\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Loader.zip\Loader\Loader.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1620
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2088

C:\Users\Admin\AppData\Local\Temp\Temp1_Loader.zip\Loader\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Loader.zip\Loader\Loader.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2644
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Loader.exe.log

Filesize
42B

MD5
84cfdb4b995b1dbf543b26b86c863adc

SHA1
d2f47764908bf30036cf8248b9ff5541e2711fa2

SHA256
d8988d672d6915b46946b28c06ad8066c50041f6152a91d37ffa5cf129cc146b

SHA512
485f0ed45e13f00a93762cbf15b4b8f996553baa021152fae5aba051e3736bcd3ca8f4328f0e6d9e3e1f910c96c4a9ae055331123ee08e3c2ce3a99ac2e177ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\05e0b415-5ac9-47e6-849d-37f3c9feb5a2.tmp

Filesize
5KB

MD5
e146b553fda116f2a8e19fc497912190

SHA1
7bcba8a8ea78def3702a57bce1f4a9d269ebd91b

SHA256
3f53b41f7261bb68f03b73898fb1bf65915678eacd5daccf54fd0b66455ac8d5

SHA512
f83b67cbc865a1576f82b505f7d112c07fca8f8d639964dd7ad5761045124b3d5451a4bcf52a3aaa67f79ce98b73546de4349020ffd06807a9820768ea776fac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
22bcacf96a4c2746af53a25c4bb103e4

SHA1
61f98e7e2baefcb3866136ed9e381770d2ab9e39

SHA256
9ebcdd5db6ee4486a351fbaa0f9222477a6baba844e3173e3482a5a903a3e0aa

SHA512
c61b4a0b80a2c63d2d1b0dac21c815b908f39fd4435dd2b4db0f9c1e2364a70fe75c80fbb2dfd0085b6d68924eacadda96e093aadd7a0a4dd4a9394922316707

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
492B

MD5
eae1eb65fd621e6749438259afe7af72

SHA1
502bf228af80f312d20001bea083ca5fb8ef4e29

SHA256
1bca0bd622d855af12258a117a3a80dc22b5fa62abf5c5aef3342d75c8f0a525

SHA512
159a58c74d3ee631fe4f804e30078eadd90669b86099078bc70681a4d7350e20dccf14c2e8995103e74be211a7f190cc17a9d3d7fd7b217b16760ec878a00401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
889c919a4e9e3b8fd9007385ba54eacd

SHA1
1a67b470fb4e7b8113f023833a148aaee8895526

SHA256
fd64456c4dfc45528223eb6a2d0baa0c02ae5bde751114635f23e177422b226b

SHA512
9027504d053e7cdf88e1ed3b83782bd47ad2ff64c89dda5dca053d6155357c3bc4280d7163088b80cdde608c450a907801bd660a8c9be8450179b3fe6fef16bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a0b5fa502a6c2ce0afce868735473814

SHA1
809cc374598a78bf113433ee9380797cb0962101

SHA256
94a2b5f74f7172acb5bfaefe344a571a38e82209576b1b61f178bfa8c0fc069f

SHA512
4d544d58cc06943395a1a7cb47103a3063976068c22bb398cc447b5df7e2b89e458615ba39d54ae65b0f30b241d37a696f23a669a710ba3a78d3c611f7a279fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
893cce0a86bfeeb6367edc2603c710a0

SHA1
e70618394260eac92830e0fa58424e370fed755f

SHA256
1b2785ff4db976e548e91f041c4021536749acaf6258bc37459c08f36fc0deec

SHA512
feff98b36eb90f2d7eae5e982168f4df583730780b5e7ce27ab16595c1c791af47abbe1ba36f85dd6930646a1b4d9b4ff4b0f54ba17b90d2ca3debf9ff741831

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5ee28e.TMP

Filesize
706B

MD5
fbb91c8bb10e7258e2f31436f5eca388

SHA1
a9fd467175d28f934081730cb20f8544d99c1fbf

SHA256
e176c1ca79a4e9be7cda884633e20984dbfe7227e38af0802c8dce69ecbe21ab

SHA512
b5ce641fd77ff59f6da8ff53f1a6878ef845e5a66d13a5b10e5442048b098d2febe4afcd2d92671a624d0740c8847c7b6ea708297a631bd124bf45e4965f0987

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8a52c2864af8f617bf57a7068d62e2d7

SHA1
21f616ccb8c2b8f9e812ef0ecc4ac8aabba4c53b

SHA256
70abaf30f09f5751dc139087c1484f7e069f36fdd6c153d44258aca9cc336ec2

SHA512
0122ff75699f9b3f099c01bb91691d7de00522375bc5476d4526c22f885f6c9c945aed73c654b0b6669793af409e012a379ee62c7cfccd234cc03ba9411ae166

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8ffaf24a0a20b502d1a961719eff94ee

SHA1
d095089c1dd9d86300c2feccd068281ff7a83ccf

SHA256
932dd01228c2ca5d1514ec6163669d9c4d120538a798edb3c4cad3a33c84a104

SHA512
880ff6cb476d8869977d211eb89954459f2dc591693d66e6926e747d76d97ab5aebb96a954bd01b9c4becf39bd7a9d75778e5ae1d4b87fcee2a6f7592ff8451b

Download Submit
C:\Users\Admin\AppData\Roaming\gdi32.dll

Filesize
435KB

MD5
330f34f58ccf18d73fd3762d200a21f9

SHA1
3c5b99bcbd2d8e1a02040a8b25aebdbd274f422c

SHA256
9110eaaf2945deb7a1af94855f90ff10a342ae5ef8d70758d5924fa2371d92fd

SHA512
6df28801cdf4a6f59481e3ac93d50637308be7206958b2cb395cc74fa851bcd2e25fe5f9e926db2b537f0eef9cc32eb2a96c3e821a0c51ee57e1b8ee4aaa90cb

Download Submit
C:\Users\Admin\Downloads\Loader.zip

Filesize
323KB

MD5
b89c6879b44612a1ab61ce40c41a1cb7

SHA1
424485c8014fad974a727c7d2b6ae12af8944dbc

SHA256
55c42cbf3fb93d47f5629851f2f3031a49679cdb4352adbc5782c1921e48d42a

SHA512
a1e3dccf0f83eb3eb3b9dc12133113cf260c8e7b068798ba8d93ff28bdaec5b5c30c326ed9d4df29e6c8216f6a1580566e9528272e980334f276bd8b43b18b35

Download Submit
memory/756-265-0x0000000002C50000-0x0000000002CBA000-memory.dmp

Filesize
424KB

Download
memory/756-266-0x0000000002C50000-0x0000000002CBA000-memory.dmp

Filesize
424KB

Download
memory/756-269-0x0000000002C50000-0x0000000002CBA000-memory.dmp

Filesize
424KB

Download
memory/1620-185-0x0000000005130000-0x0000000005136000-memory.dmp

Filesize
24KB

Download
memory/1620-184-0x0000000000900000-0x0000000000950000-memory.dmp

Filesize
320KB

Download
memory/2088-197-0x0000000002C50000-0x0000000002CB1000-memory.dmp

Filesize
388KB

Download
memory/2088-194-0x0000000002C50000-0x0000000002CB1000-memory.dmp

Filesize
388KB

Download
memory/2088-192-0x0000000002C50000-0x0000000002CB1000-memory.dmp

Filesize
388KB

Download