hxxps://github[.]com/JpnTr/XWorm-V5[.]2?tab=readme-ov-file

Analysis

max time kernel
123s
max time network
125s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
30-09-2024 23:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/JpnTr/XWorm-V5.2?tab=readme-ov-file

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
16	camo.githubusercontent.com
26	camo.githubusercontent.com
27	camo.githubusercontent.com
28	camo.githubusercontent.com
29	camo.githubusercontent.com
30	camo.githubusercontent.com
31	camo.githubusercontent.com

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
15	ipinfo.io
45	ipinfo.io
52	ipinfo.io
4	ipinfo.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1016	3876	WerFault.exe	92
3132	424	WerFault.exe	102

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWorm V5.2 Resou‮nls..scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWorm V5.2 Resou‮nls..scr

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\XWorm-V5.2-main.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1176	msedge.exe
1176	msedge.exe
1216	msedge.exe
1216	msedge.exe
1016	msedge.exe
1016	msedge.exe
4964	msedge.exe
4964	msedge.exe
1852	identity_helper.exe
1852	identity_helper.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3876	XWorm V5.2 Resou‮nls..scr
Token: SeDebugPrivilege	424	XWorm V5.2 Resou‮nls..scr

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1556	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 4680	1216	msedge.exe	78
PID 1216 wrote to memory of 4680	1216	msedge.exe	78
PID 1216 wrote to memory of 4372	1216	msedge.exe	79
PID 1216 wrote to memory of 4372	1216	msedge.exe	79
PID 1216 wrote to memory of 4372	1216	msedge.exe	79
PID 1216 wrote to memory of 4372	1216	msedge.exe	79
PID 1216 wrote to memory of 4372	1216	msedge.exe	79
PID 1216 wrote to memory of 4372	1216	msedge.exe	79
PID 1216 wrote to memory of 4372	1216	msedge.exe	79
PID 1216 wrote to memory of 4372	1216	msedge.exe	79
PID 1216 wrote to memory of 4372	1216	msedge.exe	79
PID 1216 wrote to memory of 4372	1216	msedge.exe	79
PID 1216 wrote to memory of 4372	1216	msedge.exe	79
PID 1216 wrote to memory of 4372	1216	msedge.exe	79
PID 1216 wrote to memory of 4372	1216	msedge.exe	79
PID 1216 wrote to memory of 4372	1216	msedge.exe	79
PID 1216 wrote to memory of 4372	1216	msedge.exe	79
PID 1216 wrote to memory of 4372	1216	msedge.exe	79
PID 1216 wrote to memory of 4372	1216	msedge.exe	79
PID 1216 wrote to memory of 4372	1216	msedge.exe	79
PID 1216 wrote to memory of 4372	1216	msedge.exe	79
PID 1216 wrote to memory of 4372	1216	msedge.exe	79
PID 1216 wrote to memory of 4372	1216	msedge.exe	79
PID 1216 wrote to memory of 4372	1216	msedge.exe	79
PID 1216 wrote to memory of 4372	1216	msedge.exe	79
PID 1216 wrote to memory of 4372	1216	msedge.exe	79
PID 1216 wrote to memory of 4372	1216	msedge.exe	79
PID 1216 wrote to memory of 4372	1216	msedge.exe	79
PID 1216 wrote to memory of 4372	1216	msedge.exe	79
PID 1216 wrote to memory of 4372	1216	msedge.exe	79
PID 1216 wrote to memory of 4372	1216	msedge.exe	79
PID 1216 wrote to memory of 4372	1216	msedge.exe	79
PID 1216 wrote to memory of 4372	1216	msedge.exe	79
PID 1216 wrote to memory of 4372	1216	msedge.exe	79
PID 1216 wrote to memory of 4372	1216	msedge.exe	79
PID 1216 wrote to memory of 4372	1216	msedge.exe	79
PID 1216 wrote to memory of 4372	1216	msedge.exe	79
PID 1216 wrote to memory of 4372	1216	msedge.exe	79
PID 1216 wrote to memory of 4372	1216	msedge.exe	79
PID 1216 wrote to memory of 4372	1216	msedge.exe	79
PID 1216 wrote to memory of 4372	1216	msedge.exe	79
PID 1216 wrote to memory of 4372	1216	msedge.exe	79
PID 1216 wrote to memory of 1176	1216	msedge.exe	80
PID 1216 wrote to memory of 1176	1216	msedge.exe	80
PID 1216 wrote to memory of 1976	1216	msedge.exe	81
PID 1216 wrote to memory of 1976	1216	msedge.exe	81
PID 1216 wrote to memory of 1976	1216	msedge.exe	81
PID 1216 wrote to memory of 1976	1216	msedge.exe	81
PID 1216 wrote to memory of 1976	1216	msedge.exe	81
PID 1216 wrote to memory of 1976	1216	msedge.exe	81
PID 1216 wrote to memory of 1976	1216	msedge.exe	81
PID 1216 wrote to memory of 1976	1216	msedge.exe	81
PID 1216 wrote to memory of 1976	1216	msedge.exe	81
PID 1216 wrote to memory of 1976	1216	msedge.exe	81
PID 1216 wrote to memory of 1976	1216	msedge.exe	81
PID 1216 wrote to memory of 1976	1216	msedge.exe	81
PID 1216 wrote to memory of 1976	1216	msedge.exe	81
PID 1216 wrote to memory of 1976	1216	msedge.exe	81
PID 1216 wrote to memory of 1976	1216	msedge.exe	81
PID 1216 wrote to memory of 1976	1216	msedge.exe	81
PID 1216 wrote to memory of 1976	1216	msedge.exe	81
PID 1216 wrote to memory of 1976	1216	msedge.exe	81
PID 1216 wrote to memory of 1976	1216	msedge.exe	81
PID 1216 wrote to memory of 1976	1216	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/JpnTr/XWorm-V5.2?tab=readme-ov-file
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffadf433cb8,0x7ffadf433cc8,0x7ffadf433cd8
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,7694331851816403006,17757321722647762942,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,7694331851816403006,17757321722647762942,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,7694331851816403006,17757321722647762942,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,7694331851816403006,17757321722647762942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,7694331851816403006,17757321722647762942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,7694331851816403006,17757321722647762942,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,7694331851816403006,17757321722647762942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2372 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,7694331851816403006,17757321722647762942,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,7694331851816403006,17757321722647762942,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,7694331851816403006,17757321722647762942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,7694331851816403006,17757321722647762942,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,7694331851816403006,17757321722647762942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,7694331851816403006,17757321722647762942,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3952 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,7694331851816403006,17757321722647762942,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1264 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:436

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4768

C:\Users\Admin\AppData\Local\Temp\Temp1_XWorm-V5.2-main.zip\XWorm-V5.2-main\XWorm V5.2 SRC\XWorm V5.2 Resou‮nls..scr
"C:\Users\Admin\AppData\Local\Temp\Temp1_XWorm-V5.2-main.zip\XWorm-V5.2-main\XWorm V5.2 SRC\XWorm V5.2 Resou‮nls..scr" /S
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3876
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3876 -s 2096
  2⤵
  - Program crash
  PID:1016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3876 -ip 3876
1⤵
PID:912

C:\Users\Admin\AppData\Local\Temp\Temp1_XWorm-V5.2-main.zip\XWorm-V5.2-main\XWorm V5.2 SRC\XWorm V5.2 Resou‮nls..scr
"C:\Users\Admin\AppData\Local\Temp\Temp1_XWorm-V5.2-main.zip\XWorm-V5.2-main\XWorm V5.2 SRC\XWorm V5.2 Resou‮nls..scr" /S
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:424
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 424 -s 2052
  2⤵
  - Program crash
  PID:3132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 424 -ip 424
1⤵
PID:3600

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
302c3de891ef3a75b81a269db4e1cf22

SHA1
5401eb5166da78256771e8e0281ca2d1f471c76f

SHA256
1d1640e5755779c90676290853d2e3ca948f57cf5fb1df4b786e277a97757f58

SHA512
da18e7d40376fd13255f3f67a004c3a7f408466bd7ce92e36a4d0c20441279fe4b1b6e0874ab74c494663fb97bd7992b5e7c264b3fc434c1e981326595263d33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9efc5ba989271670c86d3d3dd581b39

SHA1
3ad714bcf6bac85e368b8ba379540698d038084f

SHA256
c2e16990b0f6f23efdcecd99044993a4c2b8ba87bd542dd8f6256d69e24b93b3

SHA512
c1bc0dc70ab827b54feb64ad069d21e1c3c28d57d126b08314a9670437881d77dba02b5cca57ef0f2aa7f8e7d4d163fbd2c6f246ea2d51ce201d61a89015e8b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\806920ee-6c60-4894-9e27-eff465f62e60.tmp

Filesize
5KB

MD5
9e7561762ac3fce0021acb09e673bf2c

SHA1
6a7926d2c4d8fdb5f866c25ab417ceeffef48225

SHA256
ddf1588dedcce9af0b5e6b47eeee7891b492fba5963a02600fcc2f4adba1906d

SHA512
b0c527f813a24fc67411edaccd2e1eeacf065491bb813ebacf8fc3d7f1dd80272f4bae024dad146e86b1c502d41e63ca1f18b9441d1eebebb95191b40b3ce980

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
e519e9c866abaa42bd6a29be4d83ce7c

SHA1
d2ea0ba86a941fb8bd30d8d9fed71910d518e125

SHA256
0974dd1b9160f80506257f1a46f661318a65a9329b90e81ec4c434096df17d83

SHA512
cd1df5397a5e2070994e14652630482b0f30c809f9e60d32f56bc16cb3e3dfb978606087aa66026b7ea8e18ea1188b02a0d3b0b37a7ac4944d169833ccaa72d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
748B

MD5
609c08297e744cb6999eee11f3e4818b

SHA1
c1b0cccdf55696490ed5433eb705af545e2cf6f5

SHA256
b2c95269d48f9b60131b7fff74972f5b9f7a2e3a5552e2ef58730b3be2f999d5

SHA512
096bf3c9ca6232e9a57f15b1970698558ca2fa7c6facad6fe9f5a5f0d67c55cf81f833f82e90f758fa2f7a8b7c267495b0c61529e57d410805dafc56f9049ab2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aac3461796edaaf4bc3eedf91024b255

SHA1
c78e09e8f2c129e34e2406ab73c8259443bf9679

SHA256
5a910892d4a5d5a45b5e8a7754546d0b0e87d1e5f00d2fdc9ed1eacea1308e77

SHA512
2466c8443d9050b718343d34f14620bade8be2c5bc90010623d7710419134d6569186d26f95c86e560dcda4b87384ef333e2a00cd2a134a815275a59035dc31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3250d9ad1dd7494e8ad6b9cbe5b7a796

SHA1
b611c230130e33744ddf31334eefd49645c86a1f

SHA256
d0b306bbd8dc80510f27c05a42ca4b21f3bc845429583efa17f6d8279e54afd7

SHA512
ab2df8ff4400c0fbd62815268677db8189900a183f05f6333034588bdf301291f20ebfd1c3674ec8b6a792d91544cc56623b210a8b46e04f4143334d9c289b27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a76aa7b506f989aadbdf904d9ac800e1

SHA1
81112b2393f8f092d7e8d0dc4da87d6442baa059

SHA256
4cb1458201d31ee00d7298b5732081b32e68172a7852944cf0d6c07857f6ad9f

SHA512
19964894576a07f8f9b12832366274b0f5aeaf5f83600a830041b15ec3e56303844700ecc9ad08e486a463f14dc227ee7e66b8f615a578d28d4987e6062ff65d

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
eed1599235b9dd933e13cbd5751d7eec

SHA1
d461f7edc8bdb31b672f97b18d34e38bb7c96c4b

SHA256
13ee96f0fd8b45de1603cea7aa86ddaa749ea580989d6cb806d944f3547fbf43

SHA512
9679690676ef1ede8030e26359381a092eaec7cb671d51e91d8cd446006301bcb98518b977fd5d475e777baa11dd28e69135c517e3b3d74475134bfed4e8da9e

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
88c83953edf8df304c61067c2ef6ea08

SHA1
b82b925968af806f4f8d4f6d84e60bdba5d6a6d6

SHA256
e3162b49b8537965feb00b240a8ab0b4dea0208c05d118bc135ec9dc47a5e677

SHA512
c2e263942fa3fa857bce67c7e907d09c05703ef21ec0cad0251707ea8b46bf76b3a9b3cbdb390642ea9ff1ed62b7be3b81fc4d2f106ef063242abb2420ed9f1f

Download Submit
C:\Users\Admin\Downloads\XWorm-V5.2-main.zip

Filesize
752KB

MD5
06290bca26649b34c201fa1a6fabd232

SHA1
5ee6f669a49d57fb3669e4c404187f97afdb0d35

SHA256
338091b8fa272908857fee2d1ea3622a3147df78c1fd72f36328ccf16b51c87d

SHA512
b90c2f0e922b891400e30605362ff2cf588c0d072ce9263cc3d55ccf141d678803b39688ca18c2b36e85cb9c8dbb16745a471aa94610c98ef37d0dd8e1a4911d

Download Submit
C:\Users\Admin\Downloads\XWorm-V5.2-main.zip:Zone.Identifier

Filesize
168B

MD5
1e4e8419bc1d3b9031b561e051ad179e

SHA1
b52a9b591ac2b1d77dc2562b19d67539fdc21a62

SHA256
2e5687b13f2922fdd20047cfb80b415020750e9170e28033de2c4bcbab232075

SHA512
be014e7a7e7ea36266cae916acba227629cbb542531297f79109fa1121e81cc1d9f7f5c798b22e84d4742e511bcb34dd342a82da1c3b45a6949bc62a1ac2b950

Download Submit
memory/3876-220-0x0000000004C30000-0x0000000004CA6000-memory.dmp

Filesize
472KB

Download
memory/3876-221-0x0000000005E70000-0x0000000005E92000-memory.dmp

Filesize
136KB

Download
memory/3876-222-0x0000000005FC0000-0x0000000005FDE000-memory.dmp

Filesize
120KB

Download
memory/3876-219-0x0000000004AB0000-0x0000000004B62000-memory.dmp

Filesize
712KB

Download
memory/3876-218-0x0000000000180000-0x00000000001DA000-memory.dmp

Filesize
360KB

Download