xworm | hxxps://gofile[.]io/d/IEnlBM

Analysis

max time kernel
150s
max time network
141s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
03/11/2024, 20:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/IEnlBM

Score

10^/10

xworm defense_evasion discovery rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

4.tcp.eu.ngrok.io:15632

Mutex

4Wh0Wnq7T5DJJNh3

Attributes

Install_directory
%AppData%
install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x001900000002aaee-62.dat	family_xworm
behavioral1/memory/4464-96-0x00000000008C0000-0x00000000008D2000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm
Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
4464	TZ.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	ip-api.com

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\TZ.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 858272.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\TZ.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1308	msedge.exe
1308	msedge.exe
5108	msedge.exe
5108	msedge.exe
1736	msedge.exe
1736	msedge.exe
4632	identity_helper.exe
4632	identity_helper.exe
4248	msedge.exe
4248	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4464	TZ.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 4552	5108	msedge.exe	79
PID 5108 wrote to memory of 4552	5108	msedge.exe	79
PID 5108 wrote to memory of 2372	5108	msedge.exe	80
PID 5108 wrote to memory of 2372	5108	msedge.exe	80
PID 5108 wrote to memory of 2372	5108	msedge.exe	80
PID 5108 wrote to memory of 2372	5108	msedge.exe	80
PID 5108 wrote to memory of 2372	5108	msedge.exe	80
PID 5108 wrote to memory of 2372	5108	msedge.exe	80
PID 5108 wrote to memory of 2372	5108	msedge.exe	80
PID 5108 wrote to memory of 2372	5108	msedge.exe	80
PID 5108 wrote to memory of 2372	5108	msedge.exe	80
PID 5108 wrote to memory of 2372	5108	msedge.exe	80
PID 5108 wrote to memory of 2372	5108	msedge.exe	80
PID 5108 wrote to memory of 2372	5108	msedge.exe	80
PID 5108 wrote to memory of 2372	5108	msedge.exe	80
PID 5108 wrote to memory of 2372	5108	msedge.exe	80
PID 5108 wrote to memory of 2372	5108	msedge.exe	80
PID 5108 wrote to memory of 2372	5108	msedge.exe	80
PID 5108 wrote to memory of 2372	5108	msedge.exe	80
PID 5108 wrote to memory of 2372	5108	msedge.exe	80
PID 5108 wrote to memory of 2372	5108	msedge.exe	80
PID 5108 wrote to memory of 2372	5108	msedge.exe	80
PID 5108 wrote to memory of 2372	5108	msedge.exe	80
PID 5108 wrote to memory of 2372	5108	msedge.exe	80
PID 5108 wrote to memory of 2372	5108	msedge.exe	80
PID 5108 wrote to memory of 2372	5108	msedge.exe	80
PID 5108 wrote to memory of 2372	5108	msedge.exe	80
PID 5108 wrote to memory of 2372	5108	msedge.exe	80
PID 5108 wrote to memory of 2372	5108	msedge.exe	80
PID 5108 wrote to memory of 2372	5108	msedge.exe	80
PID 5108 wrote to memory of 2372	5108	msedge.exe	80
PID 5108 wrote to memory of 2372	5108	msedge.exe	80
PID 5108 wrote to memory of 2372	5108	msedge.exe	80
PID 5108 wrote to memory of 2372	5108	msedge.exe	80
PID 5108 wrote to memory of 2372	5108	msedge.exe	80
PID 5108 wrote to memory of 2372	5108	msedge.exe	80
PID 5108 wrote to memory of 2372	5108	msedge.exe	80
PID 5108 wrote to memory of 2372	5108	msedge.exe	80
PID 5108 wrote to memory of 2372	5108	msedge.exe	80
PID 5108 wrote to memory of 2372	5108	msedge.exe	80
PID 5108 wrote to memory of 2372	5108	msedge.exe	80
PID 5108 wrote to memory of 2372	5108	msedge.exe	80
PID 5108 wrote to memory of 1308	5108	msedge.exe	81
PID 5108 wrote to memory of 1308	5108	msedge.exe	81
PID 5108 wrote to memory of 4968	5108	msedge.exe	82
PID 5108 wrote to memory of 4968	5108	msedge.exe	82
PID 5108 wrote to memory of 4968	5108	msedge.exe	82
PID 5108 wrote to memory of 4968	5108	msedge.exe	82
PID 5108 wrote to memory of 4968	5108	msedge.exe	82
PID 5108 wrote to memory of 4968	5108	msedge.exe	82
PID 5108 wrote to memory of 4968	5108	msedge.exe	82
PID 5108 wrote to memory of 4968	5108	msedge.exe	82
PID 5108 wrote to memory of 4968	5108	msedge.exe	82
PID 5108 wrote to memory of 4968	5108	msedge.exe	82
PID 5108 wrote to memory of 4968	5108	msedge.exe	82
PID 5108 wrote to memory of 4968	5108	msedge.exe	82
PID 5108 wrote to memory of 4968	5108	msedge.exe	82
PID 5108 wrote to memory of 4968	5108	msedge.exe	82
PID 5108 wrote to memory of 4968	5108	msedge.exe	82
PID 5108 wrote to memory of 4968	5108	msedge.exe	82
PID 5108 wrote to memory of 4968	5108	msedge.exe	82
PID 5108 wrote to memory of 4968	5108	msedge.exe	82
PID 5108 wrote to memory of 4968	5108	msedge.exe	82
PID 5108 wrote to memory of 4968	5108	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://gofile.io/d/IEnlBM
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd73293cb8,0x7ffd73293cc8,0x7ffd73293cd8
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,7436599915510945112,4890287291006758042,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,7436599915510945112,4890287291006758042,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,7436599915510945112,4890287291006758042,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,7436599915510945112,4890287291006758042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,7436599915510945112,4890287291006758042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,7436599915510945112,4890287291006758042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2996 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,7436599915510945112,4890287291006758042,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4028 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,7436599915510945112,4890287291006758042,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,7436599915510945112,4890287291006758042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,7436599915510945112,4890287291006758042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1916,7436599915510945112,4890287291006758042,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,7436599915510945112,4890287291006758042,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,7436599915510945112,4890287291006758042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4572 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,7436599915510945112,4890287291006758042,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,7436599915510945112,4890287291006758042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,7436599915510945112,4890287291006758042,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,7436599915510945112,4890287291006758042,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1188 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1220

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1976

C:\Users\Admin\Downloads\TZ.exe
"C:\Users\Admin\Downloads\TZ.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1544690d41d950f9c1358068301cfb5

SHA1
ae3ff81363fcbe33c419e49cabef61fb6837bffa

SHA256
53d69c9cc3c8aaf2c8b58ea6a2aa47c49c9ec11167dd9414cd9f4192f9978724

SHA512
1e4f1fe2877f4f947d33490e65898752488e48de34d61e197e4448127d6b1926888de80b62349d5a88b96140eed0a5b952ef4dd7ca318689f76e12630c9029da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9314124f4f0ad9f845a0d7906fd8dfd8

SHA1
0d4f67fb1a11453551514f230941bdd7ef95693c

SHA256
cbd58fa358e4b1851c3da2d279023c29eba66fb4d438c6e87e7ce5169ffb910e

SHA512
87b9060ca4942974bd8f95b8998df7b2702a3f4aba88c53b2e3423a532a75407070368f813a5bbc0251864b4eae47e015274a839999514386d23c8a526d05d85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
aedcb2aec1ea52d88c31457b35263e64

SHA1
b42712428c1eab1432b1406111d02199a93d9be0

SHA256
b6aa8b0de8e85e5122732030d38b3a6fc6340fdbd76b7b575ba0cf28d70ba2bf

SHA512
c7824b17fbc89512cda71fce127d8502f55e6115b5d00754b1ce61d9fd1e5642dee7c8e0b88489618e35ff9aac17b8ee42bd8bbf34c83a225f4ba9a97e3ccbf9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
391B

MD5
ab275d2f26e9f1f7bddfd70d4a6c83b0

SHA1
fc2f34a41fde8c1efefa22a4752ed10e05d535f8

SHA256
4f4d38c0d6fe7b3375b7ef066d3a80a7b04271803725757754253ec5dcd372bf

SHA512
f8d9fee45a9174ef588730aa31c01159fa0aeca2b1dd1d8c016a5697271e83339f6d503e321d28ee4797ab8ff282c7d3aa081370914b749c4b41c034b7b9c921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
abba5f1c85ab0d60dffaf7bf745ef6b9

SHA1
149747e04e50bab2b6fad50e01f6ba1d46c6480a

SHA256
fa8a5c29591fb15b1bd882f6195d28c55af64727ee53040d14a6f539ca54b1c5

SHA512
0fb5cdc18e52a0dd4975a666094b13065f4dcf65c8195d84ec120c918c5fce8c93c2ee36aa26f641ac7ad04fbc3b6945e664f0d4cbe8b0245e1a8f74f2d04a0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a2015f36f193c38cb9cdd3102ea3fa55

SHA1
39cdf39079ea2657561d5d9dcc0f18c8850f46e6

SHA256
6c92c5c19936051d01239948303e899fbed73a0706db5becb27be67caabf3c41

SHA512
3a149becc63a82ca01ca1fd11c23c3367245c609b9c918c1f41207528084132f2e301e9fe9413b2060485bd0a7011485037b3ed0b729ab6cc16f5d2e802210c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9203cf03b47475e0be41a590f370a06b

SHA1
d6f00b4d385dcf5cf270873f566bd8e6224e8161

SHA256
d7ff6b19b0bdef6b805663958e78c7ea1b36c2b0e2f11644f7dbc53719a335fd

SHA512
4a10c6ad8a5ea3b5364763d413f032db80351e54b1e96102d5705c23a0e10d57b28ea1652260a5ea480855b90fbfde0f500e02c21abcf8a1ffa8be89c1aa827d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e361f6b903d410e571d7a379e372b4df

SHA1
4381afe2b5620a91dcec9156d44d63315702fba7

SHA256
0b8ef7b79de485bec3a17e20f742c24770eac2a629cb9efc684b1c50c1f97179

SHA512
f2b7c7d5348e21d7b9d8178cd466bab87cb097f894e334505a3e7a13c9cb659ff32a2c55824579393312ec044d4b1e8aecbc8ba8432d6048a0c552629a6c2542

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fe8051f603f7d63bb992e0dec7bc74ff

SHA1
010151020566129dbb5e7be6aba412805f2e82f3

SHA256
734dbe94018b0b14636b0809ac885e5a19312ea01557d91ca56df92380b85bec

SHA512
b0219ebc5d2df94a3f6f43d79a5d21ffcad6227fbc855a3b65f108907ab762dc62256fbfa206715282a10c081fde34d23f45be8025eb1881d5810284c269541e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1e86705cd15c883eb13d658ed74c78e3

SHA1
3c6974addff37bc000c2c1a0b5562bea83bc2b38

SHA256
f38b6f46f84d67c6e9fe292e72af80ba988f4e32da9017605ba692805c2003f6

SHA512
3dce70569d5d674ba68ceec85796cf9684e62ecd3fdee9ebccc208e86165bea7fd630999055a875d7b6f72f2287fb754a2fd32ea2b32373ec04ba8ca61374fa8

Download Submit
C:\Users\Admin\Downloads\TZ.exe:Zone.Identifier

Filesize
149B

MD5
634be1cfbd35f12e6b98b317932eebc8

SHA1
6015255cbe34b4f5c9dc44fa6cc4116087f64dc2

SHA256
fd12109cbb405691b75eacef2bc344e8f25a398cb93ab483bafe4e0fdd1341f6

SHA512
1c130854ada950c02158d224b8c71ba54d6b00dfced201505aedb65533093c8575bff207e728b73664108952fb051ae6a5f7030d3a3b382979a58c75d0d348d7

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 858272.crdownload

Filesize
45KB

MD5
2173e07478a7869ec8e416d452d62f8b

SHA1
afd8364af7eea67941c41f4e76915824b048dd67

SHA256
e5efef5f1c7bc1deb5a15b959d99633d38f3503642ec6a1c8e1b2ae95b8d0f81

SHA512
85981bbc722a2635002ef83e456e044618f1374cea69c90e3a3ad482cf32665799ae65ade7a8ba548ad4596eb5a82417bd2e96c18c6fb50e697642fb7e373a74

Download Submit
memory/4464-96-0x00000000008C0000-0x00000000008D2000-memory.dmp

Filesize
72KB

Download