hxxps://github[.]com/binaryupdates/xLoader/blob/master/XLoader[.]exe

Analysis

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
29-08-2023 19:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/binaryupdates/xLoader/blob/master/XLoader.exe

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 5 IoCs

pid	Process
3304	XLoader.exe
5016	XLoader.exe
1720	XLoader.exe
3596	XLoader.exe
64	XLoader.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Program crash 5 IoCs

pid	pid_target	Process	procid_target
3312	3304	WerFault.exe	107
3852	5016	WerFault.exe	112
516	1720	WerFault.exe	118
4456	3596	WerFault.exe	122
400	64	WerFault.exe	125

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Local Settings	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 809746.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 860757.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1936	msedge.exe
1936	msedge.exe
5040	msedge.exe
5040	msedge.exe
836	identity_helper.exe
836	identity_helper.exe
60	msedge.exe
60	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 4700	5040	msedge.exe	63
PID 5040 wrote to memory of 4700	5040	msedge.exe	63
PID 5040 wrote to memory of 3972	5040	msedge.exe	82
PID 5040 wrote to memory of 3972	5040	msedge.exe	82
PID 5040 wrote to memory of 3972	5040	msedge.exe	82
PID 5040 wrote to memory of 3972	5040	msedge.exe	82
PID 5040 wrote to memory of 3972	5040	msedge.exe	82
PID 5040 wrote to memory of 3972	5040	msedge.exe	82
PID 5040 wrote to memory of 3972	5040	msedge.exe	82
PID 5040 wrote to memory of 3972	5040	msedge.exe	82
PID 5040 wrote to memory of 3972	5040	msedge.exe	82
PID 5040 wrote to memory of 3972	5040	msedge.exe	82
PID 5040 wrote to memory of 3972	5040	msedge.exe	82
PID 5040 wrote to memory of 3972	5040	msedge.exe	82
PID 5040 wrote to memory of 3972	5040	msedge.exe	82
PID 5040 wrote to memory of 3972	5040	msedge.exe	82
PID 5040 wrote to memory of 3972	5040	msedge.exe	82
PID 5040 wrote to memory of 3972	5040	msedge.exe	82
PID 5040 wrote to memory of 3972	5040	msedge.exe	82
PID 5040 wrote to memory of 3972	5040	msedge.exe	82
PID 5040 wrote to memory of 3972	5040	msedge.exe	82
PID 5040 wrote to memory of 3972	5040	msedge.exe	82
PID 5040 wrote to memory of 3972	5040	msedge.exe	82
PID 5040 wrote to memory of 3972	5040	msedge.exe	82
PID 5040 wrote to memory of 3972	5040	msedge.exe	82
PID 5040 wrote to memory of 3972	5040	msedge.exe	82
PID 5040 wrote to memory of 3972	5040	msedge.exe	82
PID 5040 wrote to memory of 3972	5040	msedge.exe	82
PID 5040 wrote to memory of 3972	5040	msedge.exe	82
PID 5040 wrote to memory of 3972	5040	msedge.exe	82
PID 5040 wrote to memory of 3972	5040	msedge.exe	82
PID 5040 wrote to memory of 3972	5040	msedge.exe	82
PID 5040 wrote to memory of 3972	5040	msedge.exe	82
PID 5040 wrote to memory of 3972	5040	msedge.exe	82
PID 5040 wrote to memory of 3972	5040	msedge.exe	82
PID 5040 wrote to memory of 3972	5040	msedge.exe	82
PID 5040 wrote to memory of 3972	5040	msedge.exe	82
PID 5040 wrote to memory of 3972	5040	msedge.exe	82
PID 5040 wrote to memory of 3972	5040	msedge.exe	82
PID 5040 wrote to memory of 3972	5040	msedge.exe	82
PID 5040 wrote to memory of 3972	5040	msedge.exe	82
PID 5040 wrote to memory of 3972	5040	msedge.exe	82
PID 5040 wrote to memory of 1936	5040	msedge.exe	81
PID 5040 wrote to memory of 1936	5040	msedge.exe	81
PID 5040 wrote to memory of 1172	5040	msedge.exe	83
PID 5040 wrote to memory of 1172	5040	msedge.exe	83
PID 5040 wrote to memory of 1172	5040	msedge.exe	83
PID 5040 wrote to memory of 1172	5040	msedge.exe	83
PID 5040 wrote to memory of 1172	5040	msedge.exe	83
PID 5040 wrote to memory of 1172	5040	msedge.exe	83
PID 5040 wrote to memory of 1172	5040	msedge.exe	83
PID 5040 wrote to memory of 1172	5040	msedge.exe	83
PID 5040 wrote to memory of 1172	5040	msedge.exe	83
PID 5040 wrote to memory of 1172	5040	msedge.exe	83
PID 5040 wrote to memory of 1172	5040	msedge.exe	83
PID 5040 wrote to memory of 1172	5040	msedge.exe	83
PID 5040 wrote to memory of 1172	5040	msedge.exe	83
PID 5040 wrote to memory of 1172	5040	msedge.exe	83
PID 5040 wrote to memory of 1172	5040	msedge.exe	83
PID 5040 wrote to memory of 1172	5040	msedge.exe	83
PID 5040 wrote to memory of 1172	5040	msedge.exe	83
PID 5040 wrote to memory of 1172	5040	msedge.exe	83
PID 5040 wrote to memory of 1172	5040	msedge.exe	83
PID 5040 wrote to memory of 1172	5040	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/binaryupdates/xLoader/blob/master/XLoader.exe
1⤵
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd61e146f8,0x7ffd61e14708,0x7ffd61e14718
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1780,5527099382829839,8766398430349130725,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1780,5527099382829839,8766398430349130725,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1780,5527099382829839,8766398430349130725,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,5527099382829839,8766398430349130725,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,5527099382829839,8766398430349130725,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1780,5527099382829839,8766398430349130725,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1780,5527099382829839,8766398430349130725,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,5527099382829839,8766398430349130725,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,5527099382829839,8766398430349130725,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,5527099382829839,8766398430349130725,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,5527099382829839,8766398430349130725,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,5527099382829839,8766398430349130725,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1780,5527099382829839,8766398430349130725,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1780,5527099382829839,8766398430349130725,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1780,5527099382829839,8766398430349130725,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:60
- C:\Users\Admin\Downloads\XLoader.exe
  "C:\Users\Admin\Downloads\XLoader.exe"
  2⤵
  - Executes dropped EXE
  PID:3304
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 3304 -s 1072
    3⤵
    - Program crash
    PID:3312
- C:\Users\Admin\Downloads\XLoader.exe
  "C:\Users\Admin\Downloads\XLoader.exe"
  2⤵
  - Executes dropped EXE
  PID:5016
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 5016 -s 1044
    3⤵
    - Program crash
    PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,5527099382829839,8766398430349130725,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1780,5527099382829839,8766398430349130725,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  PID:4524
- C:\Users\Admin\Downloads\XLoader.exe
  "C:\Users\Admin\Downloads\XLoader.exe"
  2⤵
  - Executes dropped EXE
  PID:1720
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 1720 -s 1044
    3⤵
    - Program crash
    PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1780,5527099382829839,8766398430349130725,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4880 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4516

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 416 -p 3304 -ip 3304
1⤵
PID:64

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 484 -p 5016 -ip 5016
1⤵
PID:4624

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 524 -p 1720 -ip 1720
1⤵
PID:4172

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3840

C:\Users\Admin\Downloads\XLoader.exe
"C:\Users\Admin\Downloads\XLoader.exe"
1⤵
- Executes dropped EXE
PID:3596
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3596 -s 1044
  2⤵
  - Program crash
  PID:4456

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 532 -p 3596 -ip 3596
1⤵
PID:3964

C:\Users\Admin\Downloads\XLoader.exe
"C:\Users\Admin\Downloads\XLoader.exe"
1⤵
- Executes dropped EXE
PID:64
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 64 -s 1044
  2⤵
  - Program crash
  PID:400

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 428 -p 64 -ip 64
1⤵
PID:1112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a7ad9bb1054aa03e39b3554833d0c3ec

SHA1
cbd5b99ca100bc2f1292df23bf8e2a5a6f9640d9

SHA256
0c3eae39386b4117ad26187afc4933e254468cd12d813271f4b7420cee73c189

SHA512
d1d0b77e0bc412b4ee687e849531a7c9b70200d45d0bdbf38357b6fc59af835522e749b2fd8c2d4cde73518970568c38d73416c97381a11cc6029c14b1678276

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
d5dfdb95184d7c8fc90ea244b02c9fe0

SHA1
df489ad17b9d63bc14d18f2add4d95f22178d279

SHA256
30bf88bddce62baabfc7875574b1e5270154110d892e5a41d9a5f0468e576d0c

SHA512
7c9e66a2039670473ecea0356e366ba1aeb74f7382af4537eaa0c85fc974e669a8224a21b37dc248e23c5a3fbf635370c11d29cc51d2c8b2f813a2da16f5ab7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
be85a012866f82533b134a3e7c03581c

SHA1
8f361377763dc0f643a3c2746149ca5850c5d8c0

SHA256
7c0534066657219aeecf9763515dbb8eeb5b0cc4509d25ed75d5347476f443a0

SHA512
38aa3dc3c36a5319162d52fb0bdb7588dfa9fada5247c49ee53d870b7d928ea5be1387e176e8caf3dd6cad9b6975d432eae587c0103f8dffc56f17ef887ae621

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
62a88132dcc93ec153adeb5eb706286b

SHA1
0a9480abbf14d6b6abe25219659b21b6b5463adb

SHA256
4531d4ce827801d725511373f4e06269c2006848864e823ffcb5ef0bcd82d420

SHA512
253a6a875550dfec78f391b0c2fb2c113ee9a46c73a4ce3e78320c05d77c5700e616a3dbd9f574aa9716b7a9c0f759808a2d2f2065a66eb6d5a5d45945f80134

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
67fe510a0020e82bd36bc0a50e43a167

SHA1
4d485b5147eef500ba6abc5c5c997edd494cb54b

SHA256
ff75033b93d8e3d02903482d85bb9215a98d9b307d7ef2a805c336dac20fe615

SHA512
ea6e7442f49d14740d5af58dac2b3e55e3c8f792d852e1187a92c2bf7e913560695ebfc071a4acb8a952d0a7feebbe6591f2a8ced7d650d74b8aaf11f90b7a2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
916c326a2cd6dd625431f77807703d8c

SHA1
133320c52324877835ef5ca3eec07e9163d89f88

SHA256
661ecce1a6c1e412751012f05033b6a7001333047917848dd8c44153d150133d

SHA512
24cfeeeb0d84238dc0b84fb68354cfc9a8f955fe45950225aed8581d4375c23663eda8a7817c21319d2e7922e495a40248cc2360baa0d2e58635428437cb9121

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5cfdb56c2383a6187cc2bc37caedfbb2

SHA1
fd1e58db4752b4799be1f3c0926eb8cf3cc3e253

SHA256
332be4e486ec9697e706678c1c42bdee48a46a3efdabff22d9f321e55139e8cd

SHA512
e9abc3b93a8b1032696d24c35f56f62abe56529728549db52f00df23c128cdcba10315ec76fbea1787efbe12ceac81272c5dd48eb28994ea7f9891a76b3c8b9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e62cc4051e1f8eaa0abda5d730a2496b

SHA1
d15346e40b196bc313cbfe5ac96b3c90b83345be

SHA256
ffb5b740b8777d010f0d32a120092084c3cd32eaceb937188d698ddc22df2fcb

SHA512
3e8f6d89c7c153177b2149d86cd8602ceafedf66f5335a86b19dfa46fc38c47f6ff9a272c3b71b4464a5921ebdf2461fba25692ca916b9715bac520bf1e81a22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
54cf73048eb042276cd0a703fe4f6f0e

SHA1
9c81f359ff5c530fa18970f6094ee197f598c6ba

SHA256
dc796a769a0d94e9af583da6ecc125ce6e2691d27b9217da2a545034e63d5c56

SHA512
9ade7c3f4567dbabb0c7aba67a184520a908c300251d3aa1f3c68201b59253f2e63fdb8921a68e6d94265854951d09185f559c3a26c154929ea96df4e8dad4e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0d41849a04759858b18eec4e673f6c15

SHA1
1e2e25a15c6559adcb41fe03afaccb19638a64ea

SHA256
f4af08cf14d818b749b66155319bc262a2e2a91111f2048d21ad20ecd95c8201

SHA512
79d380800dea0f36a038287e308390f8154c1ec1d40cceb138e3bc8930cd627ec3f2ef3d60432b43141436548fa5127679a613ee1a97e7f8502ebc3865ce9a47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d37c.TMP

Filesize
874B

MD5
7d3a94e982d6eefded0aefa85d8b8b8a

SHA1
abf93062ad2ec0b16eec3d9e1c23d9342e88a81b

SHA256
e43aebbb270368354d4df8af913ff8c481ec7368bf481a2b18eeac21e9612243

SHA512
2ab339fe8dc3d5342261e73355e572d163fa19913755badcbf432aa1d02c2016faf92a19b900e9f7a99f1fa868a9d93578de706cc185219c90c70f2d07a9189f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4dac90e0e4d64db2d77945347ec5720f

SHA1
b7c8ef65f1704881a7c70dc69c3383aeb615f4db

SHA256
e09a35fbbedcc824af4d0544693bc8d6a471abd047b42755200509c42eb895cf

SHA512
42cd38ae63e8e28ba6c3c4fd0184c1a34811004646bd642af668e401c775245f7d4797beb69e5fe39f652a96e04b2b5e385989355410b1e4bd88a10eb1197628

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2081d91d12f042b74389b8d03769e569

SHA1
25c1886d5b92c8ac1b2fee24bedeb52b21ec2b9c

SHA256
7ba0674e34a3beaa26db80f29639f5ba7a3c6cc79483b3bf74665a9d4da5cc02

SHA512
6dba73662ec95e8a0a38c64661ff76b7f759b6803b4107d0910f00fb4425f6dbde436f3864a2cdd7aa1b1154107ce99199c07d8986b90c6f0d720b9c21879974

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b41c6039b4c49c171e33b0a2d7325bea

SHA1
bdff7a36684c4ba4b5ca83af0688b60de6f2f790

SHA256
b2abb27c300047b0cb49952dd9672b6925ca7e9efb0de592fdb17eb83e1ab965

SHA512
cf13ca9b240787f4e41ec41072cd01b560ef041a6ad53aab85a6ec80f9b501aec3d8904a20085433fde36122e021c80ba9f2062c0a24313809bce79254652ffd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f69b9e66420a41b1bcc5b6696518b001

SHA1
4bdaf11f6d4e3034d55324d1583576ce40d6b5b7

SHA256
d0a8d50df419be0c374ac5f301ced658a6b564cc1ba4b6c57d4b297d42b912fb

SHA512
fa4a2bebce0c6554aa8777eb825cb22acfdaa89586cb5b80784b41131377f8c3deb5556cd8e083d0a59ce8b58eb18a65ff2665cf8554540470dee198948ee418

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 809746.crdownload

Filesize
271KB

MD5
f9ab266d4bc4669871a942733ca68db5

SHA1
7f2674772b0591b7eb54a267ba8bcf3cd195d000

SHA256
07008a86ef0da3fb533d3c5ee4f6771c1facd5b2216579bc7eddd13901b554e5

SHA512
581adfba87d6359138f0dce4b1fdeec8219b188d613460ad9d5f0b163fe6f8f1e82adc9cc8f57beecf0d0f85ad23702dd44d24b4f6684fdd5e22428737dafea4

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 860757.crdownload

Filesize
1.8MB

MD5
7fd14b8065014180489f9a884407dd07

SHA1
330d0fe51ebd9aba8fbf40624a5833bc25e44d18

SHA256
0c471c43d0d97df605219be1836245a99266e568f32f3bfdc902902b5d52f07b

SHA512
e3ac0fc0bbe2c533aba26e92e5cc591cea2b00dc385a5c57f4a3d9bf89b56447ced13a0c17351456f0bdb68ce7a6b2169cdc26a638194a23a690103fb63ee565

Download Submit
C:\Users\Admin\Downloads\XLoader.exe

Filesize
271KB

MD5
f9ab266d4bc4669871a942733ca68db5

SHA1
7f2674772b0591b7eb54a267ba8bcf3cd195d000

SHA256
07008a86ef0da3fb533d3c5ee4f6771c1facd5b2216579bc7eddd13901b554e5

SHA512
581adfba87d6359138f0dce4b1fdeec8219b188d613460ad9d5f0b163fe6f8f1e82adc9cc8f57beecf0d0f85ad23702dd44d24b4f6684fdd5e22428737dafea4

Download Submit
C:\Users\Admin\Downloads\XLoader.exe

Filesize
271KB

MD5
f9ab266d4bc4669871a942733ca68db5

SHA1
7f2674772b0591b7eb54a267ba8bcf3cd195d000

SHA256
07008a86ef0da3fb533d3c5ee4f6771c1facd5b2216579bc7eddd13901b554e5

SHA512
581adfba87d6359138f0dce4b1fdeec8219b188d613460ad9d5f0b163fe6f8f1e82adc9cc8f57beecf0d0f85ad23702dd44d24b4f6684fdd5e22428737dafea4

Download Submit
C:\Users\Admin\Downloads\XLoader.exe

Filesize
271KB

MD5
f9ab266d4bc4669871a942733ca68db5

SHA1
7f2674772b0591b7eb54a267ba8bcf3cd195d000

SHA256
07008a86ef0da3fb533d3c5ee4f6771c1facd5b2216579bc7eddd13901b554e5

SHA512
581adfba87d6359138f0dce4b1fdeec8219b188d613460ad9d5f0b163fe6f8f1e82adc9cc8f57beecf0d0f85ad23702dd44d24b4f6684fdd5e22428737dafea4

Download Submit
C:\Users\Admin\Downloads\XLoader.exe

Filesize
271KB

MD5
f9ab266d4bc4669871a942733ca68db5

SHA1
7f2674772b0591b7eb54a267ba8bcf3cd195d000

SHA256
07008a86ef0da3fb533d3c5ee4f6771c1facd5b2216579bc7eddd13901b554e5

SHA512
581adfba87d6359138f0dce4b1fdeec8219b188d613460ad9d5f0b163fe6f8f1e82adc9cc8f57beecf0d0f85ad23702dd44d24b4f6684fdd5e22428737dafea4

Download Submit
C:\Users\Admin\Downloads\XLoader.exe

Filesize
271KB

MD5
f9ab266d4bc4669871a942733ca68db5

SHA1
7f2674772b0591b7eb54a267ba8bcf3cd195d000

SHA256
07008a86ef0da3fb533d3c5ee4f6771c1facd5b2216579bc7eddd13901b554e5

SHA512
581adfba87d6359138f0dce4b1fdeec8219b188d613460ad9d5f0b163fe6f8f1e82adc9cc8f57beecf0d0f85ad23702dd44d24b4f6684fdd5e22428737dafea4

Download Submit
C:\Users\Admin\Downloads\XLoader.exe

Filesize
271KB

MD5
f9ab266d4bc4669871a942733ca68db5

SHA1
7f2674772b0591b7eb54a267ba8bcf3cd195d000

SHA256
07008a86ef0da3fb533d3c5ee4f6771c1facd5b2216579bc7eddd13901b554e5

SHA512
581adfba87d6359138f0dce4b1fdeec8219b188d613460ad9d5f0b163fe6f8f1e82adc9cc8f57beecf0d0f85ad23702dd44d24b4f6684fdd5e22428737dafea4

Download Submit
memory/64-300-0x00007FFD4EB40000-0x00007FFD4F601000-memory.dmp

Filesize
10.8MB

Download
memory/64-316-0x00007FFD4EB40000-0x00007FFD4F601000-memory.dmp

Filesize
10.8MB

Download
memory/1720-241-0x00007FFD4F9B0000-0x00007FFD50471000-memory.dmp

Filesize
10.8MB

Download
memory/1720-242-0x000000001B9B0000-0x000000001B9C0000-memory.dmp

Filesize
64KB

Download
memory/1720-243-0x00007FFD4F9B0000-0x00007FFD50471000-memory.dmp

Filesize
10.8MB

Download
memory/3304-224-0x00007FFD4F9B0000-0x00007FFD50471000-memory.dmp

Filesize
10.8MB

Download
memory/3304-200-0x000000001B4E0000-0x000000001B4F0000-memory.dmp

Filesize
64KB

Download
memory/3304-199-0x00007FFD4F9B0000-0x00007FFD50471000-memory.dmp

Filesize
10.8MB

Download
memory/3304-198-0x0000000000810000-0x000000000085A000-memory.dmp

Filesize
296KB

Download
memory/3596-272-0x00007FFD4F070000-0x00007FFD4FB31000-memory.dmp

Filesize
10.8MB

Download
memory/3596-273-0x0000000002C00000-0x0000000002C10000-memory.dmp

Filesize
64KB

Download
memory/3596-274-0x00007FFD4F070000-0x00007FFD4FB31000-memory.dmp

Filesize
10.8MB

Download
memory/5016-228-0x00007FFD4F9B0000-0x00007FFD50471000-memory.dmp

Filesize
10.8MB

Download
memory/5016-227-0x000000001AFB0000-0x000000001AFC0000-memory.dmp

Filesize
64KB

Download
memory/5016-226-0x00007FFD4F9B0000-0x00007FFD50471000-memory.dmp

Filesize
10.8MB

Download