lumma | hxxp://77[.]91[.]77[.]81/lend/lummac2[.]exe

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25-06-2024 07:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://77.91.77.81/lend/lummac2.exe

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://parallelmercywksoffw.shop/api

https://liabiliytshareodlkv.shop/api

https://notoriousdcellkw.shop/api

https://conferencefreckewl.shop/api

https://flourhishdiscovrw.shop/api

https://landdumpycolorwskfw.shop/api

https://barebrilliancedkoso.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

lummac2.exe

pid process

5544 lummac2.exe

pid	process
5544	lummac2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings msedge.exe
NTFS ADS 1 IoCs

Processes:

msedge.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\Unconfirmed 568697.crdownload:SmartScreen msedge.exe
Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exe

pid process

4624 msedge.exe
4624 msedge.exe
4456 msedge.exe
4456 msedge.exe
4480 identity_helper.exe
4480 identity_helper.exe
5216 msedge.exe
5216 msedge.exe
5672 msedge.exe
5672 msedge.exe
5672 msedge.exe
5672 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

4456 msedge.exe
4456 msedge.exe
4456 msedge.exe
4456 msedge.exe
4456 msedge.exe
4456 msedge.exe
4456 msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings	msedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 568697.crdownload:SmartScreen	msedge.exe

pid	process
4624	msedge.exe
4624	msedge.exe
4456	msedge.exe
4456	msedge.exe
4480	identity_helper.exe
4480	identity_helper.exe
5216	msedge.exe
5216	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

Processes:

msedge.exe

pid	process
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4456 wrote to memory of 2752	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 2752	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 1044	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 1044	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 1044	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 1044	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 1044	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 1044	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 1044	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 1044	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 1044	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 1044	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 1044	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 1044	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 1044	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 1044	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 1044	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 1044	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 1044	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 1044	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 1044	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 1044	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 1044	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 1044	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 1044	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 1044	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 1044	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 1044	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 1044	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 1044	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 1044	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 1044	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 1044	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 1044	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 1044	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 1044	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 1044	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 1044	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 1044	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 1044	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 1044	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 1044	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 4624	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 4624	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 2848	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 2848	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 2848	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 2848	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 2848	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 2848	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 2848	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 2848	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 2848	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 2848	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 2848	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 2848	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 2848	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 2848	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 2848	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 2848	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 2848	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 2848	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 2848	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 2848	4456	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://77.91.77.81/lend/lummac2.exe
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd1c0c46f8,0x7ffd1c0c4708,0x7ffd1c0c4718
2⤵
PID:2752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,15164843066556588683,13623771795633453583,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1852 /prefetch:2
2⤵
PID:1044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,15164843066556588683,13623771795633453583,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,15164843066556588683,13623771795633453583,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
2⤵
PID:2848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15164843066556588683,13623771795633453583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
2⤵
PID:4796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15164843066556588683,13623771795633453583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
2⤵
PID:4880

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,15164843066556588683,13623771795633453583,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5024 /prefetch:8
2⤵
PID:452

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,15164843066556588683,13623771795633453583,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5024 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15164843066556588683,13623771795633453583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
2⤵
PID:3180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15164843066556588683,13623771795633453583,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
2⤵
PID:4300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2112,15164843066556588683,13623771795633453583,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5580 /prefetch:8
2⤵
PID:4824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15164843066556588683,13623771795633453583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
2⤵
PID:1684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15164843066556588683,13623771795633453583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
2⤵
PID:4944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15164843066556588683,13623771795633453583,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
2⤵
PID:3400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2112,15164843066556588683,13623771795633453583,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5800 /prefetch:8
2⤵
PID:4728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2112,15164843066556588683,13623771795633453583,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5972 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,15164843066556588683,13623771795633453583,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:836

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5460

C:\Users\Admin\Downloads\lummac2.exe
"C:\Users\Admin\Downloads\lummac2.exe"
1⤵
- Executes dropped EXE
PID:5544

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
81e892ca5c5683efdf9135fe0f2adb15

SHA1
39159b30226d98a465ece1da28dc87088b20ecad

SHA256
830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

SHA512
c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
56067634f68231081c4bd5bdbfcc202f

SHA1
5582776da6ffc75bb0973840fc3d15598bc09eb1

SHA256
8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

SHA512
c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
13c0d7417b842c8368e91d3e1ea1b9ae

SHA1
8f71218f517c2890b5b06a8711a1adcd96b2cc15

SHA256
4476403a1d10537a0891daa45280be072674e11ad275fb07c5d3d54296b06c10

SHA512
be42d2fb0d6b33211a236f8265c06cabfd4732c3eec5585abf7154c51142fd749bfb2637641095bb7a40af6e7aafa405399257c9599501072569a40c4952eaf9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
56d03a3732d05358ae5f7fb8608ddfed

SHA1
e1e13184d35cc63ed9e132959d413024a0d91e9d

SHA256
498c0c0fa2123e00fd7c614a5f2f019469d6c18eaba8170d05c7208ddb9e541f

SHA512
db6f235b409e88f3c4cd8fe0c38d6fdf939dd6994902ca8491aec4c649aab01c7d61bed08c9769f18cf1928a5261ca009108be1e3755fb0285eb6e03a8db2a79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
e36fd4fc0ddb7e0901e9fb713a8d2a27

SHA1
7a1cd151c9228bc4a6e16c2e83e04f7f91a0f131

SHA256
f57960c9d2a6a291f4670e7f6a79a3e73878e99612d4a9c8efa546924e09a947

SHA512
020d2528556f7b0894215e50291e636947c7a3400443499d69f6d531c49f69f7a449a5b3a57040dfa8329ff6303abc58aca7417b758db2819f97b7814540bea2

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 568697.crdownload
Filesize
310KB

MD5
6e3d83935c7a0810f75dfa9badc3f199

SHA1
9f7d7c0ea662bcdca9b0cda928dc339f06ef0730

SHA256
dc4f0a8e3d12c98eac09a42bd976579ccc1851056d9de447495e8be7519760ed

SHA512
9f6b22bc9d0306a69d3c5bab83c7603fa23925c12089f9608772602ab2c4c0908cda2a3d9592fc0fab4aaff209ef41d3e2a931511ce9dfd027691e8dce9ad9b9

Download Submit
\??\pipe\LOCAL\crashpad_4456_PAOEDQDWMIRZJVUM
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit