xworm | e8fd34b40b83391a855905620e4beeb153d256df196b063bc7845d747f1e7d67

Analysis

max time kernel
137s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08-08-2024 10:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Steam.exe
Size

51KB
MD5

eb794f3819b32c9fbc747309bb04cd68
SHA1

a6c24bfb6c2ea4cdf10f0f54c0a4e8ac0380beb3
SHA256

e8fd34b40b83391a855905620e4beeb153d256df196b063bc7845d747f1e7d67
SHA512

0b6cf31c799513b4e0f5ac21180cc7a26451fc54504f03ace353a5a8c598885c594b3375e990ac442e08ffaa1f3e9692cbf6dfb8c035b4380497cefd57288aaf
SSDEEP

768:juMMmVn76G3rspEacCIQgttZX+2V2ltnq7oTmggkbm1t+tuXSWCalOIhu//t/:SMDnv7sKEIHLXyBqCmjkbmn/weOImF/

Score

10^/10

xworm discovery rat trojan

Malware Config

Extracted

Family

xworm

tree-cleaning.gl.at.ply.gg:33027

Attributes

install_file
USB.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral3/memory/1528-1-0x0000000000EF0000-0x0000000000F04000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1892	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2908	msedge.exe
2908	msedge.exe
1964	msedge.exe
1964	msedge.exe
4952	identity_helper.exe
4952	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1528	Steam.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 1964	1528	Steam.exe	90
PID 1528 wrote to memory of 1964	1528	Steam.exe	90
PID 1964 wrote to memory of 5004	1964	msedge.exe	91
PID 1964 wrote to memory of 5004	1964	msedge.exe	91
PID 1964 wrote to memory of 824	1964	msedge.exe	92
PID 1964 wrote to memory of 824	1964	msedge.exe	92
PID 1964 wrote to memory of 824	1964	msedge.exe	92
PID 1964 wrote to memory of 824	1964	msedge.exe	92
PID 1964 wrote to memory of 824	1964	msedge.exe	92
PID 1964 wrote to memory of 824	1964	msedge.exe	92
PID 1964 wrote to memory of 824	1964	msedge.exe	92
PID 1964 wrote to memory of 824	1964	msedge.exe	92
PID 1964 wrote to memory of 824	1964	msedge.exe	92
PID 1964 wrote to memory of 824	1964	msedge.exe	92
PID 1964 wrote to memory of 824	1964	msedge.exe	92
PID 1964 wrote to memory of 824	1964	msedge.exe	92
PID 1964 wrote to memory of 824	1964	msedge.exe	92
PID 1964 wrote to memory of 824	1964	msedge.exe	92
PID 1964 wrote to memory of 824	1964	msedge.exe	92
PID 1964 wrote to memory of 824	1964	msedge.exe	92
PID 1964 wrote to memory of 824	1964	msedge.exe	92
PID 1964 wrote to memory of 824	1964	msedge.exe	92
PID 1964 wrote to memory of 824	1964	msedge.exe	92
PID 1964 wrote to memory of 824	1964	msedge.exe	92
PID 1964 wrote to memory of 824	1964	msedge.exe	92
PID 1964 wrote to memory of 824	1964	msedge.exe	92
PID 1964 wrote to memory of 824	1964	msedge.exe	92
PID 1964 wrote to memory of 824	1964	msedge.exe	92
PID 1964 wrote to memory of 824	1964	msedge.exe	92
PID 1964 wrote to memory of 824	1964	msedge.exe	92
PID 1964 wrote to memory of 824	1964	msedge.exe	92
PID 1964 wrote to memory of 824	1964	msedge.exe	92
PID 1964 wrote to memory of 824	1964	msedge.exe	92
PID 1964 wrote to memory of 824	1964	msedge.exe	92
PID 1964 wrote to memory of 824	1964	msedge.exe	92
PID 1964 wrote to memory of 824	1964	msedge.exe	92
PID 1964 wrote to memory of 824	1964	msedge.exe	92
PID 1964 wrote to memory of 824	1964	msedge.exe	92
PID 1964 wrote to memory of 824	1964	msedge.exe	92
PID 1964 wrote to memory of 824	1964	msedge.exe	92
PID 1964 wrote to memory of 824	1964	msedge.exe	92
PID 1964 wrote to memory of 824	1964	msedge.exe	92
PID 1964 wrote to memory of 824	1964	msedge.exe	92
PID 1964 wrote to memory of 824	1964	msedge.exe	92
PID 1964 wrote to memory of 2908	1964	msedge.exe	93
PID 1964 wrote to memory of 2908	1964	msedge.exe	93
PID 1964 wrote to memory of 2584	1964	msedge.exe	94
PID 1964 wrote to memory of 2584	1964	msedge.exe	94
PID 1964 wrote to memory of 2584	1964	msedge.exe	94
PID 1964 wrote to memory of 2584	1964	msedge.exe	94
PID 1964 wrote to memory of 2584	1964	msedge.exe	94
PID 1964 wrote to memory of 2584	1964	msedge.exe	94
PID 1964 wrote to memory of 2584	1964	msedge.exe	94
PID 1964 wrote to memory of 2584	1964	msedge.exe	94
PID 1964 wrote to memory of 2584	1964	msedge.exe	94
PID 1964 wrote to memory of 2584	1964	msedge.exe	94
PID 1964 wrote to memory of 2584	1964	msedge.exe	94
PID 1964 wrote to memory of 2584	1964	msedge.exe	94
PID 1964 wrote to memory of 2584	1964	msedge.exe	94
PID 1964 wrote to memory of 2584	1964	msedge.exe	94
PID 1964 wrote to memory of 2584	1964	msedge.exe	94
PID 1964 wrote to memory of 2584	1964	msedge.exe	94
PID 1964 wrote to memory of 2584	1964	msedge.exe	94
PID 1964 wrote to memory of 2584	1964	msedge.exe	94

C:\Users\Admin\AppData\Local\Temp\Steam.exe
"C:\Users\Admin\AppData\Local\Temp\Steam.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://guns.lol/tuesday.cs
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdb91446f8,0x7ffdb9144708,0x7ffdb9144718
    3⤵
    PID:5004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,15802288130757069915,1073702064273597504,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
    3⤵
    PID:824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,15802288130757069915,1073702064273597504,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,15802288130757069915,1073702064273597504,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
    3⤵
    PID:2584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15802288130757069915,1073702064273597504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:1452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15802288130757069915,1073702064273597504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
    3⤵
    PID:1140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15802288130757069915,1073702064273597504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
    3⤵
    PID:436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15802288130757069915,1073702064273597504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2556 /prefetch:1
    3⤵
    PID:4816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15802288130757069915,1073702064273597504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
    3⤵
    PID:1308
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,15802288130757069915,1073702064273597504,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:8
    3⤵
    PID:4908
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,15802288130757069915,1073702064273597504,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15802288130757069915,1073702064273597504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
    3⤵
    PID:1016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15802288130757069915,1073702064273597504,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
    3⤵
    PID:2468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15802288130757069915,1073702064273597504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
    3⤵
    PID:2092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15802288130757069915,1073702064273597504,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
    3⤵
    PID:828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15802288130757069915,1073702064273597504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1788 /prefetch:1
    3⤵
    PID:1380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15802288130757069915,1073702064273597504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
    3⤵
    PID:3784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15802288130757069915,1073702064273597504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
    3⤵
    PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://guns.lol/tuesday.cs
  2⤵
  PID:2064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdb91446f8,0x7ffdb9144708,0x7ffdb9144718
    3⤵
    PID:1372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp772A.tmp.bat""
  2⤵
  PID:1016
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:1892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\89d221dc-1e2c-40b2-983d-427917a6a09e.tmp

Filesize
204B

MD5
848916b309f16e7edf97b1422bad8c28

SHA1
005d9f2a255c21f1cb6ddc39d0ded549847658d2

SHA256
a4ef289ed1998d710b1a9a1f0d8fdbad7bdd726278a317964bf5f1e78711706c

SHA512
5311a7f4fbd6a278469a972f86591ceffe22ae3000acdab3826b0b45e06dc4ff2b054274df04ccce59818e70000bf9eb5fc35d44c4b1116ea22db40925d8af3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
f5867341aacdc750eaf5fafd3691b5d8

SHA1
dd377c92e8e866286895a7066c3f0a1c9d71b15a

SHA256
3fae76f4b1075e0812721b9d28c174468b5ca4912610166d9b79ea12adc2673c

SHA512
e4ec504c50d6ff68352f786c5191123ec4fcc7c929806b75f89f4062787ed30ea47e5c656a6d2386ea6786b6cf582a8e7ec48fd96f85b05b4002c40e3494b269

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
a3a2f116a88a1061f37cd13f60ebcf8c

SHA1
e3b37e5f0deab2cec839eba16b6456ea59092a41

SHA256
3320f77abc59f1f7771ec15c575adb159d36bf4a82ae28776676e00441897c43

SHA512
73d9ce3892e8b6277d3f4642c31f034d72bfd408e4aa9e6522ba36f089ad19f4f851b81b625f54713716d5c2d4f22cc20e50d8339821a9df8f2c285d12472384

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a7aca9b081c1cc5454ac283829be0f33

SHA1
29fc36c8126dc0782f184a7f3ffbaea9c1bae6f5

SHA256
28e34d760b8d2c6a2533e6561b4e857dee9893eb2015310988d7b22decb3118c

SHA512
94eeb4a6d3896b25895b802d50417f475754b4f2315d4cb36e9820913c4c0de1f7be2754f2259ef3dcce08c565ea4e58dc549c4b10a2ab8be52db9c57c5b7360

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9b5408aee79cd34ae9789b440e542afe

SHA1
54f7dd8c20527c6d4a023a9889e0392a95e2ffa1

SHA256
32ce3df8d0070c85dbf91656bf3144bc65df0f599923d260e03741ab5e4e58e7

SHA512
c176df0427049b3973b49afcefa8f788f0ae4a77b8092ed1b6d0c36b6682ba6f5bfcedc8c0d41947dc648fb87334dd181a2f9133fdad3ac98269b35b68870da4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c895fdf5d513468097e10bc7aadb4ef0

SHA1
d677b9506e967bde68264d304f9de153fe297133

SHA256
08ee44bdbb4e3cd7665dce07ead2453a146e99de65bcb5ebab07aba813dea0c9

SHA512
1e75f064f443ab06aab67bea2c5da1eef1a926f3f4927af41219aed263a7cbc0cd65ca90ef2cb5a2a3fb49003095005e35de15a29d7f5c09494014258f6cc351

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
dc278cfc4d3d69a2b5d46c7e63a26f57

SHA1
bc3502ef50fc3690f22f6545d3f94657ad3595cd

SHA256
54b8e54c087a46a5c7dfb8bd381d360a9b9f32c318ed348b80c5a9ab4c7931ea

SHA512
f46579dc467429757728085ebbff0c0d27f1a3b1c726c62e9333c71745f430556ebbb522c3571273dcde32c54f847c2b7bf340dcbe14002642b4898dd208b2fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp772A.tmp.bat

Filesize
157B

MD5
fac653f2d344d7eac47a61e0f37fd9af

SHA1
01c8aa9a91e4c7f5dd7d2e119abd132936530f95

SHA256
8647205a3378fcd41aa3ebf136f3d41ada825635fcb003d2724b24bf5d72b5f2

SHA512
965d9ea0ef3e6ff0fa7d1e501455529a6fab776808c607195b970b845ef9092dc238fe8873cc7eda08a394a79a339ae90d76a96c61d2e12e50cd463a1000c123

Download Submit
memory/1528-3-0x00007FFDBC990000-0x00007FFDBD451000-memory.dmp

Filesize
10.8MB

Download
memory/1528-0-0x00007FFDBC993000-0x00007FFDBC995000-memory.dmp

Filesize
8KB

Download
memory/1528-160-0x00007FFDBC990000-0x00007FFDBD451000-memory.dmp

Filesize
10.8MB

Download
memory/1528-2-0x00007FFDBC990000-0x00007FFDBD451000-memory.dmp

Filesize
10.8MB

Download
memory/1528-1-0x0000000000EF0000-0x0000000000F04000-memory.dmp

Filesize
80KB

Download