lumma | hxxps://www[.]mediafire[.]com/folder/hmr841wxuh2vn/ModiFYX

Analysis

max time kernel
157s
max time network
160s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
31-12-2024 19:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/folder/hmr841wxuh2vn/ModiFYX

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://abruptyopsn.shop/api

https://wholersorie.shop/api

https://framekgirus.shop/api

https://tirepublicerj.shop/api

https://noisycuttej.shop/api

https://rabidcowse.shop/api

https://cloudewahsj.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Executes dropped EXE 2 IoCs

pid	Process
1692	ModiFyx.exe
832	ModiFyx.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241231190126.pma	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\3c82d7d3-e223-465b-8ef2-81ac54ea22c3.tmp	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ModiFyx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ModiFyx.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3316	msedge.exe
3316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4992	identity_helper.exe
4992	identity_helper.exe
2736	msedge.exe
2736	msedge.exe
1692	ModiFyx.exe
1692	ModiFyx.exe
832	ModiFyx.exe
832	ModiFyx.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	3976	7zG.exe
Token: 35	3976	7zG.exe
Token: SeSecurityPrivilege	3976	7zG.exe
Token: SeSecurityPrivilege	3976	7zG.exe

Suspicious use of FindShellTrayWindow 60 IoCs

pid	Process
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
3976	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 1344	4316	msedge.exe	80
PID 4316 wrote to memory of 1344	4316	msedge.exe	80
PID 4316 wrote to memory of 4400	4316	msedge.exe	81
PID 4316 wrote to memory of 4400	4316	msedge.exe	81
PID 4316 wrote to memory of 4400	4316	msedge.exe	81
PID 4316 wrote to memory of 4400	4316	msedge.exe	81
PID 4316 wrote to memory of 4400	4316	msedge.exe	81
PID 4316 wrote to memory of 4400	4316	msedge.exe	81
PID 4316 wrote to memory of 4400	4316	msedge.exe	81
PID 4316 wrote to memory of 4400	4316	msedge.exe	81
PID 4316 wrote to memory of 4400	4316	msedge.exe	81
PID 4316 wrote to memory of 4400	4316	msedge.exe	81
PID 4316 wrote to memory of 4400	4316	msedge.exe	81
PID 4316 wrote to memory of 4400	4316	msedge.exe	81
PID 4316 wrote to memory of 4400	4316	msedge.exe	81
PID 4316 wrote to memory of 4400	4316	msedge.exe	81
PID 4316 wrote to memory of 4400	4316	msedge.exe	81
PID 4316 wrote to memory of 4400	4316	msedge.exe	81
PID 4316 wrote to memory of 4400	4316	msedge.exe	81
PID 4316 wrote to memory of 4400	4316	msedge.exe	81
PID 4316 wrote to memory of 4400	4316	msedge.exe	81
PID 4316 wrote to memory of 4400	4316	msedge.exe	81
PID 4316 wrote to memory of 4400	4316	msedge.exe	81
PID 4316 wrote to memory of 4400	4316	msedge.exe	81
PID 4316 wrote to memory of 4400	4316	msedge.exe	81
PID 4316 wrote to memory of 4400	4316	msedge.exe	81
PID 4316 wrote to memory of 4400	4316	msedge.exe	81
PID 4316 wrote to memory of 4400	4316	msedge.exe	81
PID 4316 wrote to memory of 4400	4316	msedge.exe	81
PID 4316 wrote to memory of 4400	4316	msedge.exe	81
PID 4316 wrote to memory of 4400	4316	msedge.exe	81
PID 4316 wrote to memory of 4400	4316	msedge.exe	81
PID 4316 wrote to memory of 4400	4316	msedge.exe	81
PID 4316 wrote to memory of 4400	4316	msedge.exe	81
PID 4316 wrote to memory of 4400	4316	msedge.exe	81
PID 4316 wrote to memory of 4400	4316	msedge.exe	81
PID 4316 wrote to memory of 4400	4316	msedge.exe	81
PID 4316 wrote to memory of 4400	4316	msedge.exe	81
PID 4316 wrote to memory of 4400	4316	msedge.exe	81
PID 4316 wrote to memory of 4400	4316	msedge.exe	81
PID 4316 wrote to memory of 4400	4316	msedge.exe	81
PID 4316 wrote to memory of 4400	4316	msedge.exe	81
PID 4316 wrote to memory of 3316	4316	msedge.exe	82
PID 4316 wrote to memory of 3316	4316	msedge.exe	82
PID 4316 wrote to memory of 1432	4316	msedge.exe	83
PID 4316 wrote to memory of 1432	4316	msedge.exe	83
PID 4316 wrote to memory of 1432	4316	msedge.exe	83
PID 4316 wrote to memory of 1432	4316	msedge.exe	83
PID 4316 wrote to memory of 1432	4316	msedge.exe	83
PID 4316 wrote to memory of 1432	4316	msedge.exe	83
PID 4316 wrote to memory of 1432	4316	msedge.exe	83
PID 4316 wrote to memory of 1432	4316	msedge.exe	83
PID 4316 wrote to memory of 1432	4316	msedge.exe	83
PID 4316 wrote to memory of 1432	4316	msedge.exe	83
PID 4316 wrote to memory of 1432	4316	msedge.exe	83
PID 4316 wrote to memory of 1432	4316	msedge.exe	83
PID 4316 wrote to memory of 1432	4316	msedge.exe	83
PID 4316 wrote to memory of 1432	4316	msedge.exe	83
PID 4316 wrote to memory of 1432	4316	msedge.exe	83
PID 4316 wrote to memory of 1432	4316	msedge.exe	83
PID 4316 wrote to memory of 1432	4316	msedge.exe	83
PID 4316 wrote to memory of 1432	4316	msedge.exe	83
PID 4316 wrote to memory of 1432	4316	msedge.exe	83
PID 4316 wrote to memory of 1432	4316	msedge.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.mediafire.com/folder/hmr841wxuh2vn/ModiFYX
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff9cf9246f8,0x7ff9cf924708,0x7ff9cf924718
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,8045583318430511415,11863758129339995977,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,8045583318430511415,11863758129339995977,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,8045583318430511415,11863758129339995977,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8045583318430511415,11863758129339995977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8045583318430511415,11863758129339995977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,8045583318430511415,11863758129339995977,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:3568
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff679a25460,0x7ff679a25470,0x7ff679a25480
    3⤵
    PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,8045583318430511415,11863758129339995977,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8045583318430511415,11863758129339995977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8045583318430511415,11863758129339995977,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6460 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8045583318430511415,11863758129339995977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8045583318430511415,11863758129339995977,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2092,8045583318430511415,11863758129339995977,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6680 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8045583318430511415,11863758129339995977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,8045583318430511415,11863758129339995977,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1312

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1528

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\a4f0062e-754a-4a8d-9c50-04d2f698b7d4_zalupa ivanovna-eap0-ModiFYX-20241231-109.zip.7d4\ModiFYX\How to Download & Setup.txt
1⤵
PID:1104

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\ModiFexe\" -ad -an -ai#7zMap8438:78:7zEvent7093
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3976

C:\Users\Admin\Downloads\ModiFexe\ModiFyx.exe
"C:\Users\Admin\Downloads\ModiFexe\ModiFyx.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1692

C:\Users\Admin\Downloads\ModiFexe\ModiFyx.exe
"C:\Users\Admin\Downloads\ModiFexe\ModiFyx.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9fc751d5fa08ca574eba851a781b900

SHA1
963c71087bd9360fa4aa1f12e84128cd26597af4

SHA256
360b095e7721603c82e03afa392eb3c3df58e91a831195fc9683e528c2363bbb

SHA512
ecb8d509380f5e7fe96f14966a4d83305cd9a2292bf42dec349269f51176a293bda3273dfe5fba5a32a6209f411e28a7c2ab0d36454b75e155fc053974980757

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d9a93ee5221bd6f61ae818935430ccac

SHA1
f35db7fca9a0204cefc2aef07558802de13f9424

SHA256
a756ec37aec7cd908ea1338159800fd302481acfddad3b1701c399a765b7c968

SHA512
b47250fdd1dd86ad16843c3df5bed88146c29279143e20f51af51f5a8d9481ae655db675ca31801e98ab1b82b01cb87ae3c83b6e68af3f7835d3cfa83100ad44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
b02212b31dc7bdc8d426bee81015cfc0

SHA1
21ee5115125eee147cf603c5e9083f6d6e68dbb1

SHA256
b77fa59de33ecdc0464a927d9e6e8db6cffec8b24dc53a8567cb4c635cdc69c4

SHA512
2454be8821adcb4322a93feb63c140437205c24d760ec46c58c7fd254372967515b950971adc6668f93d545361e45fbb6ffd01f0b6c0ba1dea2d9d8ea178a757

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
1bfba153b7f2fe3e10e7097c6201646e

SHA1
c666dff4cc07539d5188a7cd1cda5433023ef2bb

SHA256
549c8ecf5531f7fac817ff0975bf645a76284a0fe372294a70c6b52f63592831

SHA512
acaca72b3004aaf7069b5ec84f354924bfbf9244beae4d231646aebf6213c64ad961e15850dd3f082bcecb51e60760254b9f21668474e8c8fd5ad88ccc584b2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
aa94ceeee5109c7544c57cd8fd31142e

SHA1
f34c884f37c1e92ab80a639a3e14a437decd34de

SHA256
80dd9b89fcfdeb47d14d2b6bcad9530174681e72fcd8e803c5ec972bdbcc8f4c

SHA512
a30e26ac998f05460f0c05efa1a05d1ca0fad610e05744df7cd4f299d0884938ed97acef6985bff475d305993cf44eb34c18442e5d93eb51660446afc4405a46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
018a57fc230aa0065f61f7e976f10e7b

SHA1
7ea25f4133a90a9380064321822336dbb64438d9

SHA256
9da4be4a6178a559f8fbed07305a1ad8c66799fe8c8b3fe9c9a116c4c4a384b1

SHA512
4a5ceb6ce69df62af4dc8c07f4419bc34eecc07481f24b8a4b76574ec964995c2a47e9a42b2c043418a7837bd45215e013553c1dd5a51e64d61a232b0e463a2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe58a004.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
fdf548e678d5f0c1c23591a84d167544

SHA1
4b21d10b91cb0c18aad927908a91538c45af3138

SHA256
98a08e34248c5ce27076acce58bbb686be5e5e5689e3117fbd7bcf16f3186f4a

SHA512
6fbdcbaf0e7b94a0141dcde6e600c687ef0b7eb235dbc89408a99bf8b7e6247f6b46344b7d48df178ac8ba0f632fcbdfd3125ed5d9a4b968235f70bb6da74a88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b05c7da98826860cb79d26263a7b461d

SHA1
0a485ba651816af4be9e8c7c31cf1364e8366ae2

SHA256
8d04eb066a7bb504fdf749ae4290fd233c61ddf4ecfc31417dd27f8253049ab8

SHA512
debeac2b6cf28ad5ea2c8c3181a55e65ea07a40bd26100ca3792334fec77de8d2513586f9e5be7eb45d90801a76e79d4fb6ceb815fc6af5ca43e4eb37360e0e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4f29d10f8d070fb15b6bfcb58bfc80df

SHA1
321450f99c0e98c48d2564f4c8682a52379aec33

SHA256
38940a4769df54b16c755e898670cad4eb57f7c7b5edcfd8198bb29c87f6123e

SHA512
c5a647186304394a4f77bbe9ca70e7197eec5c9acdeb6e4e3827083ad9efbcea420aaf8e89aafa9de921802e8eef9737054a073698a34a20fe7721bd4731e8b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ea2958caebb413396ca4647589eb98b8

SHA1
0b6298f74c7b338c647ef737dbc4bff43375dddd

SHA256
ad7bbffecfa98284877c13491f9f9b3e76ffbb36d31ccd7907023e9a439915a4

SHA512
2c5ebb6b9b8c373509861e209101cacfba93abf545cbffc67c70e72da3e4b72e0087377706e025048c2c6794b954c45e598ea36c265717f633e6bf1fed2f7f33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
f9055ea0f42cb1609ff65d5be99750dc

SHA1
6f3a884d348e9f58271ddb0cdf4ee0e29becadd4

SHA256
1cacba6574ba8cc5278c387d6465ff72ef63df4c29cfbec5c76fbaf285d92348

SHA512
b1937bc9598d584a02c5c7ac42b96ed6121f16fe2de2623b74bb9b2ca3559fc7aff11464f83a9e9e3002a1c74d4bb0ee8136b0746a5773f8f12f857a7b2b3cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d3412a01d4c3df1df43f94ecd14a889a

SHA1
2900a987c87791c4b64d80e9ce8c8bd26b679c2f

SHA256
dd1511db0f7bf3dc835c2588c1fdd1976b6977ad7babe06380c21c63540919be

SHA512
7d216a9db336322310d7a6191ebac7d80fd4fa084413d0474f42b6eff3feb1baf3e1fb24172ea8abcb67d577f4e3aea2bc68fdb112205fc7592a311a18952f7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
db0d16e37936b7dea6a0deddbd49d543

SHA1
928595983daa5e5375d8a526d9a3bdc8d09cb624

SHA256
95593885f2a98bbed0505dac32e475e2a3e25c1c16fc7c271068a32956fad961

SHA512
a725f0396bd8c652b65435d24826a0a66797dd9cf9874c1ed0a16ec9bf5efa25246de291a89909efe03fd5b4c5fdd124c597bc8ab5640d5c5649be234b50f541

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
86460ec4dd12cd50da287d9400ae9a3a

SHA1
d91f0c1424114eedc383879fa51ded1bfb7b03a2

SHA256
62846b5ea133f4e77664808263568c79045da7dbff733ba4c2ae3836d3855d29

SHA512
d58569a43d38d84227fa0336e750dc24c9c79d6773592170e9404401d296cda58335e3871a4f8cd6cdf0dd829fe8e3fd82ef30bbbb4c5ae8b8d7e15ac268d42d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
ac0583ebd4f9394795d60947b334fca3

SHA1
858e9039c50066fda80e6ddc15fe6b5879905fb4

SHA256
791e187db32462d48d9d892d3ec1002b2959a0871bea241c5539f4c417e18c0a

SHA512
10a0f1f8ddfb0bea100acb867153ea8f38d1c75696b2243cf02f1410b201a9ab39eeaadd52a5683505ee998b0c8bb5d64773124638fd7b42ad184a11c58a7082

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
200258589bb6097637484bc0b2503d0d

SHA1
19e8a43b49e38b9b27d0c56d84d3e296cc033082

SHA256
b8d91304ae269572f6c89055de1284dd885b68ba21cff558325f8e637c5e0874

SHA512
9a81d548bf594129728abb8d1a58230d600ed7878f716048407f61ed0d18be5f72768863f4204e5b04e25871384490ed3eba6d8da93593f25d429c1e3d129ac7

Download Submit
C:\Users\Admin\Downloads\ModiFexe\apt\postgresql\13\main\PG_VERSION

Filesize
3B

MD5
aa6ed9e0f26a6eba784aae8267df1951

SHA1
feee44ad365b6b1ec75c5621a0ad067371102854

SHA256
1a252402972f6057fa53cc172b52b9ffca698e18311facd0f3b06ecaaef79e17

SHA512
01765ddfd925d70d41d53cabdba5f2588e678e534ef5d8840a813bc58d33198039006ce6395c6b95747a2e05d21ff3a47389638ba9405fd11ab1b0857f56426f

Download Submit
C:\Users\Admin\Downloads\ModiFexe\apt\postgresql\13\main\base\14088\1259_fsm

Filesize
24KB

MD5
9a360591abd6ca7d3aca9b36ce19841d

SHA1
1f3d3f59be3657821aa1f4f66ea9d16c5d545c2d

SHA256
8acdc937fca22a496215056ed3960bff6d3319b9c45f3050e8edfc09d7085c27

SHA512
3ce5e0cb8db3beb16d254a01dfd7019931c1f30b9e5ba7341a95ba8b5db956a95e057a949c4934788c34bc1443f52b02fad93da5bd0ca7f06135927fc7d221a3

Download Submit
C:\Users\Admin\Downloads\ModiFexe\apt\postgresql\13\main\base\14088\13938_fsm

Filesize
24KB

MD5
c7cdb534af6bd29fb2c6e3ef3ed24526

SHA1
490b58cb3588090289f7b18e33cb2691dc8fcacf

SHA256
1026c5125dd766e9b5b35a9dc36622cb8b9e441fb4e6c9b62e65cb46566652cf

SHA512
85f587aedfea35bad2857e9f7772bb72aef0ebd96c88f5c29f2bd32cf20dd07befd08ff4ac4eb11ad4d244a20d40be29ebb69815850b75d9bf0702f4e65ffc9a

Download Submit
C:\Users\Admin\Downloads\ModiFexe\apt\postgresql\13\main\base\14088\13948_fsm

Filesize
24KB

MD5
99d1debbe47a2018c43693c11dd06300

SHA1
c341d19b9b9011c1dfda387a42b2764dfc44e2a3

SHA256
962a13e899d74c006af6764efbbc6901d740f1a9165dd8f79d1e9338bb3f18c7

SHA512
f5ed0df7f76cf571d4e8d8a9efc53dd5588cfb78187c2fc914451a8d5eae3580d1e4004e59aaa52d7006aef2b746a4fc5f501185765a241824ac48e2cf438883

Download Submit
C:\Users\Admin\Downloads\ModiFexe\apt\postgresql\13\main\base\14088\3079_fsm

Filesize
24KB

MD5
2a3216a10d8aeed6ac8058c1f5f6cabb

SHA1
6a01bfc3f8c7c15a5624300cbd6047c5dcfa9a4a

SHA256
a0551e864782ad52e08fb6d723a01d381d7c16a18009bb83025faba4e8179e53

SHA512
ece4efb1d1bc5910c8c967290760a8ee27a1d8dec39a137566c374f946bff14d6a190ba4aa90af6983dceec4f5684d53714ec53242bc8f586c07fe82cede8264

Download Submit
C:\Users\Admin\Downloads\ModiFexe\apt\postgresql\13\main\global\1214_fsm

Filesize
24KB

MD5
461ce67a44bad8aa641f0f8ac7f750a3

SHA1
8839d3ce467b401c60f851183bfd7841ce7c0770

SHA256
51e01e110ad6394a405d1cd7d0f18be9e1566302d54d545ff703c30cee71f5b0

SHA512
f8ed6ec80bb7a0b2b396d7fd99a12718a78aacc0215418434549c2e95c2fb9f0daf0340855ff2923c7cd143cc92f3112841c5dc65bfc4f955fb698ef765c66ac

Download Submit
C:\Users\Admin\Downloads\ModiFexe\apt\postgresql\13\main\pg_subtrans\0000

Filesize
8KB

MD5
0829f71740aab1ab98b33eae21dee122

SHA1
0631457264ff7f8d5fb1edc2c0211992a67c73e6

SHA256
9f1dcbc35c350d6027f98be0f5c8b43b42ca52b7604459c0c42be3aa88913d47

SHA512
18790c279e0ca614c2b57a215fecc23a6c3d2d308ce77f314378cb2d1b0f413acd3a9cd353aa6da86ec9f51916925c7210f7dfabc0ef726779f8d44f227f03b1

Download Submit
C:\Users\Admin\Downloads\ModiFexe\pam\dpkg\triggers\update-default-ispell

Filesize
28B

MD5
652b20cd6ff7c0aff5a74fa3f6fabeff

SHA1
f0d739861692b2a303e4b654bb9de05e251d9e5a

SHA256
b2eb5757b46fc925e6f149607f3aa9ae31755735a438fd9ae3effabab0ebf2ed

SHA512
220368aa428174cd5d01b9c3a6fc0b2bb36a8c81d8b58c6d7a6722da304894dee82eb961fd5e24995f0c624750a2eb2b7ad04a165190331e5d0d0d1fe7c70f0c

Download Submit
memory/832-3209-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Filesize
4KB

Download
memory/832-3210-0x0000000000EE0000-0x000000000173A000-memory.dmp

Filesize
8.4MB

Download
memory/1692-3205-0x00000000007F0000-0x00000000007F1000-memory.dmp

Filesize
4KB

Download
memory/1692-3206-0x0000000000EE0000-0x000000000173A000-memory.dmp

Filesize
8.4MB

Download