hxxps://www[.]google[.]com/search?client=opera-gx&q=xworm&sourceid=opera&ie=UTF-8&oe=UTF-8

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 20:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.google.com/search?client=opera-gx&q=xworm&sourceid=opera&ie=UTF-8&oe=UTF-8
Sample240709-y3e81atdkn

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
66	camo.githubusercontent.com
67	camo.githubusercontent.com
68	camo.githubusercontent.com
69	camo.githubusercontent.com
70	camo.githubusercontent.com
71	camo.githubusercontent.com
72	camo.githubusercontent.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-384068567-2943195810-3631207890-1000\{B3C447C3-0D36-445F-B674-35CF8569ADC9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
3316	msedge.exe
3316	msedge.exe
3708	identity_helper.exe
3708	identity_helper.exe
4008	msedge.exe
4008	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3316 wrote to memory of 2328	3316	msedge.exe	82
PID 3316 wrote to memory of 2328	3316	msedge.exe	82
PID 3316 wrote to memory of 468	3316	msedge.exe	84
PID 3316 wrote to memory of 468	3316	msedge.exe	84
PID 3316 wrote to memory of 468	3316	msedge.exe	84
PID 3316 wrote to memory of 468	3316	msedge.exe	84
PID 3316 wrote to memory of 468	3316	msedge.exe	84
PID 3316 wrote to memory of 468	3316	msedge.exe	84
PID 3316 wrote to memory of 468	3316	msedge.exe	84
PID 3316 wrote to memory of 468	3316	msedge.exe	84
PID 3316 wrote to memory of 468	3316	msedge.exe	84
PID 3316 wrote to memory of 468	3316	msedge.exe	84
PID 3316 wrote to memory of 468	3316	msedge.exe	84
PID 3316 wrote to memory of 468	3316	msedge.exe	84
PID 3316 wrote to memory of 468	3316	msedge.exe	84
PID 3316 wrote to memory of 468	3316	msedge.exe	84
PID 3316 wrote to memory of 468	3316	msedge.exe	84
PID 3316 wrote to memory of 468	3316	msedge.exe	84
PID 3316 wrote to memory of 468	3316	msedge.exe	84
PID 3316 wrote to memory of 468	3316	msedge.exe	84
PID 3316 wrote to memory of 468	3316	msedge.exe	84
PID 3316 wrote to memory of 468	3316	msedge.exe	84
PID 3316 wrote to memory of 468	3316	msedge.exe	84
PID 3316 wrote to memory of 468	3316	msedge.exe	84
PID 3316 wrote to memory of 468	3316	msedge.exe	84
PID 3316 wrote to memory of 468	3316	msedge.exe	84
PID 3316 wrote to memory of 468	3316	msedge.exe	84
PID 3316 wrote to memory of 468	3316	msedge.exe	84
PID 3316 wrote to memory of 468	3316	msedge.exe	84
PID 3316 wrote to memory of 468	3316	msedge.exe	84
PID 3316 wrote to memory of 468	3316	msedge.exe	84
PID 3316 wrote to memory of 468	3316	msedge.exe	84
PID 3316 wrote to memory of 468	3316	msedge.exe	84
PID 3316 wrote to memory of 468	3316	msedge.exe	84
PID 3316 wrote to memory of 468	3316	msedge.exe	84
PID 3316 wrote to memory of 468	3316	msedge.exe	84
PID 3316 wrote to memory of 468	3316	msedge.exe	84
PID 3316 wrote to memory of 468	3316	msedge.exe	84
PID 3316 wrote to memory of 468	3316	msedge.exe	84
PID 3316 wrote to memory of 468	3316	msedge.exe	84
PID 3316 wrote to memory of 468	3316	msedge.exe	84
PID 3316 wrote to memory of 468	3316	msedge.exe	84
PID 3316 wrote to memory of 4852	3316	msedge.exe	85
PID 3316 wrote to memory of 4852	3316	msedge.exe	85
PID 3316 wrote to memory of 3588	3316	msedge.exe	86
PID 3316 wrote to memory of 3588	3316	msedge.exe	86
PID 3316 wrote to memory of 3588	3316	msedge.exe	86
PID 3316 wrote to memory of 3588	3316	msedge.exe	86
PID 3316 wrote to memory of 3588	3316	msedge.exe	86
PID 3316 wrote to memory of 3588	3316	msedge.exe	86
PID 3316 wrote to memory of 3588	3316	msedge.exe	86
PID 3316 wrote to memory of 3588	3316	msedge.exe	86
PID 3316 wrote to memory of 3588	3316	msedge.exe	86
PID 3316 wrote to memory of 3588	3316	msedge.exe	86
PID 3316 wrote to memory of 3588	3316	msedge.exe	86
PID 3316 wrote to memory of 3588	3316	msedge.exe	86
PID 3316 wrote to memory of 3588	3316	msedge.exe	86
PID 3316 wrote to memory of 3588	3316	msedge.exe	86
PID 3316 wrote to memory of 3588	3316	msedge.exe	86
PID 3316 wrote to memory of 3588	3316	msedge.exe	86
PID 3316 wrote to memory of 3588	3316	msedge.exe	86
PID 3316 wrote to memory of 3588	3316	msedge.exe	86
PID 3316 wrote to memory of 3588	3316	msedge.exe	86
PID 3316 wrote to memory of 3588	3316	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?client=opera-gx&q=xworm&sourceid=opera&ie=UTF-8&oe=UTF-8
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc9fe46f8,0x7ffcc9fe4708,0x7ffcc9fe4718
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,9549300926320409236,11847499384594702066,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,9549300926320409236,11847499384594702066,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,9549300926320409236,11847499384594702066,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9549300926320409236,11847499384594702066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9549300926320409236,11847499384594702066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9549300926320409236,11847499384594702066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2900 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,9549300926320409236,11847499384594702066,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:792
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,9549300926320409236,11847499384594702066,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9549300926320409236,11847499384594702066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9549300926320409236,11847499384594702066,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3912 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9549300926320409236,11847499384594702066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9549300926320409236,11847499384594702066,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9549300926320409236,11847499384594702066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9549300926320409236,11847499384594702066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2096,9549300926320409236,11847499384594702066,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2096,9549300926320409236,11847499384594702066,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9549300926320409236,11847499384594702066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9549300926320409236,11847499384594702066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9549300926320409236,11847499384594702066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9549300926320409236,11847499384594702066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3780 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,9549300926320409236,11847499384594702066,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3460 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9549300926320409236,11847499384594702066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1080 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9549300926320409236,11847499384594702066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:1396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 5e3237f26b6047f64459cd5d3a6bc3563e2642b98d75b97011c93e0a9bd26f3b
MD5 eaaad45aced1889a90a8aa4c39f92659
SHA1 5c0130d9e8d1a64c97924090d9a5258b8a31b83c
SHA512 0db1c6bdb51f4e6ba5ef4dc12fc73886e599ab28f1eec5d943110bc3d856401ca31c05baa9026dd441b69f3de92307eb77d93f089ba6e2b84eea6e93982620e4
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d80ec29cb17280af0c7522b30a80ffa19d1e786c0b09accfe3234b967d23eb6f
MD5 3ee50fb26a9d3f096c47ff8696c24321
SHA1 a8c83e798d2a8b31fec0820560525e80dfa4fe66
SHA512 479c0d2b76850aa79b58f9e0a8ba5773bd8909d915b98c2e9dc3a95c0ac18d7741b2ee571df695c0305598d89651c7aef2ff7c2fedb8b6a6aa30057ecfc872c5
MD5 SHA1 SHA512

Submit Download

3f9cea62-077e-436d-93be-472903e045af.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3f9cea62-077e-436d-93be-472903e045af.tmp
Size 6KB
SHA256 91eefa947c2bcce84fcf95c3fd905f127e0ce4805fed925ba0b4a94133d3bcf4
MD5 eb7ebe8cf87950c7f617fc81426cde78
SHA1 01f3d302a09f93f953634e79d935ce66e62bd818
SHA512 b1f857794e1a0f094e4ff6ef63820814a7fd3336468f948db55b9d0733f71114f96e37fce21fd5eb5b6877139b0a6f1b26b8d5075211c1412becd35f8fc752f0
SSDEEP 96:nKks9Y1cV1J2wpvWMoiVmdeHqmmS+UWQyV+VDCziEwb:nKkjaV10GWMXH+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001
Size 211KB
SHA256 043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed
MD5 151fb811968eaf8efb840908b89dc9d4
SHA1 7ec811009fd9b0e6d92d12d78b002275f2f1bee1
SHA512 83aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674
SSDEEP 6144:U1jkj9l1xrxCD7bj/M3QiwUwTLo2xZ/gKep:U1uxxNQ7PMATU8o2xZ/jep
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004
Size 64KB
SHA256 34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92
MD5 d6b36c7d4b06f140f860ddc91a4c659c
SHA1 ccf16571637b8d3e4c9423688c5bd06167bfb9e9
SHA512 2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487
SSDEEP 1536:Lm4AGqOak9IP5qOYV7SofryJiRB3xVcVXsIBGCrmQR:LITk4qOq2oDwuhpDCaQR
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005
Size 69KB
SHA256 adbd44258f3952a53d9c99303e034d87c5c4f66c5c431910b1823bb3dd0326af
MD5 7d5e1b1b9e9321b9e89504f2c2153b10
SHA1 37847cc4c1d46d16265e0e4659e6b5611d62b935
SHA512 6f3dc2c523127a58def4364a56c3daa0b2d532891d06f6432ad89b740ee87eacacfcea6fa62a6785e6b9844d404baee4ea4a73606841769ab2dfc5f0efe40989
SSDEEP 1536:qWAno765Gx781oZHTSGGwp/VpGxBnnMYxuH92aXISJ+vWNQY+DaUsjmj:qWO1hodhHNouH9HISJnwDaUsj6
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006
Size 41KB
SHA256 2c2ba720b00b5ea91083f203eba58347373081ef53201695e5b2de96405945a3
MD5 970d0e20692b74e97203d5cf9358350f
SHA1 3e45b858a775b05d117b26a317ceef16d3320ad1
SHA512 75cd3e41d4094aad759b315eb56eefa1f2b3a4111899ad0da733b12ceef8157ad44d507a01705f9b1ac77c53866355a08edef8663608ec2d7753425c203ba507
SSDEEP 768:8HBDApnEO6HSzbX7+qoE2QaXh0+SEJF9J9rZUoPYtLw0nBWzUWWY6nW++rcwTnV5:8hcpnEO6HS/XgE2QgeuJ9NUoPbIBWeWD
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
Size 19KB
SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
MD5 2e86a72f4e82614cd4842950d2e0a716
SHA1 d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA512 7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
SSDEEP 384:eV4Eqc1qgk/XDVGi8m7JEM9TUKPqivdjfommfP974oNF38:eV9qlxhVEM9UKPpMV74kFM
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
Size 65KB
SHA256 f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4
MD5 56d57bc655526551f217536f19195495
SHA1 28b430886d1220855a805d78dc5d6414aeee6995
SHA512 7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb
SSDEEP 1536:654NcGosP0w+UcGoanS2RR/QwNdIvEsgXn:6iRsw+UkC5QdEfXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a
Size 88KB
SHA256 b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd
MD5 b38fbbd0b5c8e8b4452b33d6f85df7dc
SHA1 386ba241790252df01a6a028b3238de2f995a559
SHA512 546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16
SSDEEP 1536:WwVbiMNFmJrBrbhiWu0FKK9fLRXT+FjhwTn1sH5J3iotwUB4xzjIRB9h:zVOiFWwg3Rjm1wRW5JSywbo9h
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b
Size 1.2MB
SHA256 eea7813cba41e7062794087d5d4c820d7b30b699af3ec37cb545665940725586
MD5 620dd00003f691e6bda9ff44e1fc313f
SHA1 aaf106bb2767308c1056dee17ab2e92b9374fb00
SHA512 3e245851bfa901632ea796ddd5c64b86eda217ec5cd0587406f5c28328b5cb98c5d8089d868e409e40560c279332ba85dd8ce1159ae98e8588e35ed61da2f006
SSDEEP 24576:7lxlxw83X6Or+fBzEztxFEhPWcPGubwpF9YzPnWdp9dV8ozgNvCrRRN/7WNy:7ZxNaOifhERxVUGY2KzPn2PV8ozgNvCX
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000023

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023
Size 18KB
SHA256 97c4d108edd2e41b185dae956c5bbbe13f4b7da2beb3bf5c4381ea9a3010df10
MD5 7fb857cf4fa9b0dcf3e7c056e534d410
SHA1 96852369fba231e75eb284dfa01d13d1cc606f43
SHA512 379766a8cd87f9862c05b7ce8d480751358c5bfc930a6664052de18e14a2878df41de8f0183e4480ebde11afcb8f1bd45cd34b155694aec5d2eba3b7a5777c4c
SSDEEP 384:Zl0SvElf+fhaXncyz1H9y8hpPYlBLtM8W/MvwpBzjoP:sSMk6cyRHu+z/4ujS
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7e260aff8feaae8127ac63cac97f9a18f42dce48a97aabf1ee8a9643f15efd44
MD5 875c92a6373eae88a82f1318880a191d
SHA1 b83c5d5c7e216a835e4c9a15e16178932a918008
SHA512 0c685119889d6e061e8d0d4c7f28e02b407c0275d97164433fb32d171513b25affcf5fefd2c5ae5e0a2d2e66613eee3af1b3fe73a4e465e8e1534733a8b68a8f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 b2ca8b6e261c10b672f040f3ae97bb2bd10e6539a9f8bcacc14b62824aa905dc
MD5 47ad374176f533fbd04443359f9320dc
SHA1 9c6c1df3499253d126147a5bbb9308656247d7c5
SHA512 ed6dba3abe111bd757b7c74ba50586d41e9a0c50d5676a4cdc3f7445e9f960483fe0b5b20ed45070ab2f208c758d5260498d302be8788e92d92a733d37d7e3ba
SSDEEP 96:Rv2KiIbGDijiH7gopN5G64fh57m2KbsCT4dUGWt:niIbXY8mL857m2KYCT7T
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 564ec03a820d213e989da0da20a6a860e83f9663250bba1a1045498e409360d6
MD5 7a11ec65e8f3d3b3c7e794763e022fa0
SHA1 ef26b3bcd61b08feae0e90612df7516d8533f315
SHA512 391ae44b998d1e6a14cf26cb2f2772eab8c5b804e503926dd71410b3eec7c1ddfa7d8f2e1cd2c6a906b7deddc586abd2cc4a5c6398cc87d1639a9c53e45a5ef5
SSDEEP 96:KOvYKiIbGDijiH7gZYLics5gcp/oO2Kbs/JB1YvQC5:KqiIbXY8gI/oO2KY/FG
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 bc53ef617ab19c390726f36a53d0c03567010f1cc71a0f30fb9457c9d9405221
MD5 c115f4b69e520d0181f32d4b4def5ca7
SHA1 8e239fdd511f3e2ba9f2929118f9d93c19fbda19
SHA512 02e1d668ac5e5b91fb473e7bee2246db5c4d4b62e5823b89503bdefbc9a9480b876b1b02d850db65e7dbe50684a1075e6e97f62a2276428790818db1a39e2bd4
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 2ecc5a65e297a11b1b371c13b7f99d41d56ba9bc78c2e0595db24d875aa764d7
MD5 bd2cbf1a2a3d133cabbcf6b77ba6e8dd
SHA1 dc5897a09b9d314a873cad72fbf71f88b3621c29
SHA512 a345a9653c9209b2d149a3eed21ed82fb8d24e59b0c270adfbd13747f304176ef3d1e13ac05112f92c55be78e1d0099d46733b2657effac35d6a71b671bd7eb6
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 89ad631f60dd337101e3c546aac8db82cfda2cdcee86bb25e0098bb215c8d6f6
MD5 61d0fc948dbb2837170e4ddae135149e
SHA1 8ea7726e0b9bbddc8f5e1ab0438472456c61e093
SHA512 a29e7d52d6732a17d869d4a4b3fbdad90bb910b1f6ae2f97bb7caf0c85853cf935417c9026ef67868376323aea667e760056a61bb718c22088adc189b9beb42f
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 a23149c5d7584823c851d8df9aabfe3d3017bccbfa29460eb22184d047ce0c4e
MD5 7a70895f25a320d42591b8ae53db5989
SHA1 74328b9895d2898e42f6353f3c1257406ea357c1
SHA512 0c91974da9c65689ac44812892e4c86a98fcfa537b5e5073d58a0f01b153b24aaf1f78b48d7ca69e3c869eb3734dfb18da13071448e83c104398b91c12dc8932
SSDEEP 96:nKkS9Y1cVdH2wpC6WMoifR5mdeCuN1Auw17qqm2S+UWQyV+VD7AiEwb:nKk5aVdWt6WMfsuNauwRqv+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 a917f46ec275109460e9f4c47da5e3ce7a749495fc9e393e76bd242b31f535c2
MD5 56961da647fd8a211343c4aebabfa84f
SHA1 388cc4ced6511334ea9fbeed26822561464c5c9b
SHA512 3f508fc173a46882c01970ce225174878959bfdd6aa5bda3ab5eaa6748c1bfd6fcb7cb498ef0077912ab404ec3f1a7d53b2ba6e9109b6fb680f92d8170fc51ae
SSDEEP 96:nKku9Y1cVdA2wpB9WMoiVRzR5mde2sidQYfMkOuw17qfIomWS+UWQyV+VD7AiEwb:nKk1aVdvy9WMVpcsieYf6uwRqgZ+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ac4145a008f4c28abe01bcc1aa06d696fea601ab39e29115d32189bf4fa70af0
MD5 21391600bd26af29838e8868f91319c9
SHA1 a6868abed6dbda7414c2a80d5730052d845d341f
SHA512 1340ea6fc12f14dcd8136007dfc6c71f7693bdf077c16819bbbebef21f48b6450b10f91b190595bce6588574df28485694c02f9677269dad7967975c2f81b52c
SSDEEP 96:nKkU9Y1cV152wpvWMoiVmdeEuw17qqmyS+UWQyV+VD7AiEwb:nKkbaV1kGWM0uwRqr+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 b79c85e9421c76782eb40e27e06e6ec6a8477e78ec31ae2f13ae749aee4d4ede
MD5 401138ec74b437f75df00a57d1619228
SHA1 ec03051293877ac225481632aa07a8ca3cc0f29f
SHA512 3bb6a5b00ba0848ff163d2f7b3c8a4e4a9f4f8ad1f0d73e7ec9e5e352b2666f3b90528fdd5e67d251010065dbc43b54bab50fa3406b3157f04182687ccd75c3e
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 b9a2ef9698b755f1698084dd46149e4749d6cd01c8bcb22b273b903383bb4651
MD5 a464bb41ccaafff71079849955d394d5
SHA1 160b2a2812170afc724df937755a79d85de6eb94
SHA512 d6250dcee9531037cbaba8f8b5dd5fb2055b8ce9744dcf77c769b523e948f3f3c8e2cec89621fbdd7071d39ca998bf341c29b9ffd9ce970e28d536ceabfeaa3c
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 0a5d9e6c185bda6d7f122a6d9fac32f6640a607886e2378d7f43226eeec7827a
MD5 4981c610aee6fbcca6fe84c6623257e5
SHA1 b905d032031845c39b9cda6367846617d13a78f1
SHA512 dfb166d090af42493013d41e4de09657d636426396acecde5819c8157a82720812bf7c09baecd332ac9da22283c3389c5ae3977e7e5f2af1b64d3882043c0e43
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 b9c13ac943619933dbf5f72765ceb86bb57949184066e54bd516a7a127e9abdd
MD5 855a40c7d17a32dea134cee0d3b4088f
SHA1 418c22949d1a51068efc701a847a6f6b017de2da
SHA512 bf64f2e1706842f2e89c70208e1410b01e9498c9b13ae8b86c94a724e3a54cdd1da83824404a6bba7193693e11fe0eaffcbab2d02fa7f7fa07e848f1c545c937
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 f3c9543c42ae2bccf9af766b20ea9fe64f7a2fa9484e5d496ddf22d169f78f49
MD5 7ff865b9faa2b05f465551a1d9016fe2
SHA1 d80712a9cfec7a3694a13e9dae81c3ec1e094ac6
SHA512 e41bf9e68d9295cb7a5d4ab73f4d4bf50c87cd93f145851ea1dd9fa9de46d159a8d411654aaf9f81ec9cc636465b0ccf7d9de91e3f9a14e5cf7f03613f7b4509
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe587143.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587143.TMP
Size 204B
SHA256 d1baedc2dbe290e8944a3f19735ff1558fe7d3cfcd7cfb25ad584c1981302d3d
MD5 7d21572d65f49b6e2787c35f3be17f45
SHA1 46446a5ec258f7fbe76b4c1d4f4ff23f319b2395
SHA512 88358dcce62a2d1917a4304f955b527ce792fcbd781e486e013cd6676356037355b12bb1944eca4c21f721876adc808434f4ab5f0508d341dcf59ed51f1b763a
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 7f50c6373cee6b848c4af9ae0e19294f92e404ea94f15a93db19ca34ed6e98ad
MD5 3f8a98c9b43fb1c764b356176c48f1cd
SHA1 45e03930a024ff0691d3711023869a748638e891
SHA512 f29aee5561053f3bc5abcc78d7b0f9f94a4a1d86264248888c91d3da6be00da8a132a54f0d830c0113f351eb561c21a94222f3f1ccb43a574bfa4fdeff4fc2af
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupae2RUCJOsLgcTzwxAULBZ1:A9iIxuERzA83h09RZxY0MsEhBZ1
MD5 SHA1 SHA512 SSDEEP

Submit Download