Overview

overview

10

Static

static

10

XClient.exe

windows10-2004-x64

10

XClient.exe

windows10-ltsc 2021-x64

10

Resubmissions

01-12-2024 20:51

241201-znngha1pew 10

15-11-2024 18:52

241115-xh927synds 10

15-11-2024 18:49

241115-xgp1mstkaj 10

15-11-2024 18:48

241115-xfqwjstjgp 10

15-11-2024 18:45

241115-xd4pmazdkq 10

15-11-2024 16:38

241115-t5f6vsxfjd 10

Analysis

  • max time kernel
    99s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-11-2024 18:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    XClient.exe

  • Size

    63KB

  • MD5

    babb94ecb1c83f5daa6fbe659eaaa4f9

  • SHA1

    07289ec74f35061c515c6a835160ded06f823305

  • SHA256

    c82bb2bdf2a6a156eaa280eb6cd7f006e5c2421a24490ea017e0048c5e4ab140

  • SHA512

    93fb30710c1194bad4ce6cea55df8cca3b68dcb08a53dfb68f69cf6ca0695a3f89bae0e66d3f142c5d84cb9a03cc32ac65a815c9e859a1e4c39b50dd8609e6ab

  • SSDEEP

    1536:GjFmCqZLnPN/2hFtT/PXl6/3d8/kbS5duRcdjT5WkOLuKZEY:GeZrNMF9/EFAkbS5AKZT5WkOLuI

Score
10/10
xwormdiscoverypersistencerattrojan

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:56069

front-applications.gl.at.ply.gg:56069
Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 3 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 6 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 16 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 53 IoCs
  • Suspicious use of SetWindowsHookEx 43 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\XClient.exe
    "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3168
    • C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM explorer.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2452
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2880
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pornhub.com/
      2⤵
        PID:1660
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb26bd46f8,0x7ffb26bd4708,0x7ffb26bd4718
          3⤵
            PID:388
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,8614962750179623348,3041631502360589005,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
            3⤵
              PID:372
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,8614962750179623348,3041631502360589005,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
              3⤵
                PID:2236
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,8614962750179623348,3041631502360589005,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
                3⤵
                  PID:3544
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,8614962750179623348,3041631502360589005,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
                  3⤵
                    PID:1792
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,8614962750179623348,3041631502360589005,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
                    3⤵
                      PID:4276
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,8614962750179623348,3041631502360589005,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
                      3⤵
                        PID:2452
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,8614962750179623348,3041631502360589005,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
                        3⤵
                          PID:5756
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,8614962750179623348,3041631502360589005,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
                          3⤵
                            PID:5976
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,8614962750179623348,3041631502360589005,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
                            3⤵
                              PID:6120
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2192,8614962750179623348,3041631502360589005,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5984 /prefetch:8
                              3⤵
                                PID:6128
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2192,8614962750179623348,3041631502360589005,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6124 /prefetch:8
                                3⤵
                                  PID:2244
                            • C:\Windows\system32\OpenWith.exe
                              C:\Windows\system32\OpenWith.exe -Embedding
                              1⤵
                              • Modifies registry class
                              • Suspicious behavior: GetForegroundWindowSpam
                              • Suspicious use of SetWindowsHookEx
                              • Suspicious use of WriteProcessMemory
                              PID:4612
                              • C:\Windows\system32\NOTEPAD.EXE
                                "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\i sex kai
                                2⤵
                                  PID:3612
                              • C:\Windows\system32\OpenWith.exe
                                C:\Windows\system32\OpenWith.exe -Embedding
                                1⤵
                                • Modifies registry class
                                • Suspicious use of SetWindowsHookEx
                                • Suspicious use of WriteProcessMemory
                                PID:64
                                • C:\Program Files\Internet Explorer\iexplore.exe
                                  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\i sex kai
                                  2⤵
                                  • Modifies Internet Explorer Phishing Filter
                                  • Modifies Internet Explorer settings
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of SetWindowsHookEx
                                  • Suspicious use of WriteProcessMemory
                                  PID:3604
                                  • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3604 CREDAT:17410 /prefetch:2
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    • Modifies Internet Explorer settings
                                    • Suspicious use of SetWindowsHookEx
                                    PID:4000
                              • C:\Windows\system32\OpenWith.exe
                                C:\Windows\system32\OpenWith.exe -Embedding
                                1⤵
                                • Modifies registry class
                                • Suspicious behavior: GetForegroundWindowSpam
                                • Suspicious use of SetWindowsHookEx
                                • Suspicious use of WriteProcessMemory
                                PID:3320
                                • C:\Windows\system32\NOTEPAD.EXE
                                  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\i sex kai
                                  2⤵
                                    PID:1032
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                  • Modifies registry class
                                  • Suspicious use of SetWindowsHookEx
                                  PID:1880
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Boot or Logon Autostart Execution: Active Setup
                                  • Enumerates connected drives
                                  • Checks SCSI registry key(s)
                                  • Modifies registry class
                                  • Suspicious behavior: GetForegroundWindowSpam
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of SendNotifyMessage
                                  PID:2228
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                  • Suspicious use of SetWindowsHookEx
                                  PID:428
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Boot or Logon Autostart Execution: Active Setup
                                  • Enumerates connected drives
                                  • Checks SCSI registry key(s)
                                  • Modifies registry class
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of SendNotifyMessage
                                  PID:3996
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                  • Suspicious use of SetWindowsHookEx
                                  PID:3220
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                  • Modifies registry class
                                  • Suspicious use of SetWindowsHookEx
                                  PID:556
                                • C:\Windows\system32\AUDIODG.EXE
                                  C:\Windows\system32\AUDIODG.EXE 0x494 0x3f0
                                  1⤵
                                    PID:4060
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:1928
                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                      1⤵
                                        PID:3784
                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                        1⤵
                                          PID:2228
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                            PID:4156
                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                            1⤵
                                              PID:3220
                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                              1⤵
                                                PID:3960
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:4276
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                    PID:220
                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                    1⤵
                                                      PID:1368
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:812
                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                        1⤵
                                                          PID:3000
                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                          1⤵
                                                            PID:4400
                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                            1⤵
                                                              PID:1472
                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                              1⤵
                                                                PID:2276
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                  PID:556
                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                  1⤵
                                                                    PID:1076
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                    1⤵
                                                                      PID:1552

                                                                    Network

                                                                    MITRE ATT&CK Enterprise v15

                                                                    Replay Monitor

                                                                    Loading Replay Monitor...

                                                                    Downloads

                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                      Filesize

                                                                      471B

                                                                      MD5

                                                                      6742cb489d9fbdd586c32dc1a12be9b3

                                                                      SHA1

                                                                      c31250579ac42962e6d5168e1e08f966db6ffbb2

                                                                      SHA256

                                                                      e6f49ec632a9f7ca1506eda0f0789fea1a5d3a0593cdd6f9c4e2bb30f7a1c298

                                                                      SHA512

                                                                      a6260790bfc8f08672321d510fd0abccf02cb52d6b5b400be20a6797e1903758e066dd0a9eb7acbf079b5247dc5d7e33d9ff53c0f32171b48edd04a42f588650

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                      Filesize

                                                                      412B

                                                                      MD5

                                                                      e45bb98e6c52766f2f496e04c7c991ba

                                                                      SHA1

                                                                      87973286c1bf285cf4a7d4d816885d8ba2df0df8

                                                                      SHA256

                                                                      50889428be9b79ce2eb63aa8fbebab12760ea80d7821847421bf3afd71507bce

                                                                      SHA512

                                                                      a91a7b61a36b5ec267418f10b76c0f3f6a5038c72ecc2c38b01467fdc5ad8c49fc5f903dc3f32236446fdd1b92d65c721c8f91468f0edc9cf64d33e6fa7e6c40

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                      Filesize

                                                                      152B

                                                                      MD5

                                                                      e443ee4336fcf13c698b8ab5f3c173d0

                                                                      SHA1

                                                                      9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

                                                                      SHA256

                                                                      79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

                                                                      SHA512

                                                                      cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                      Filesize

                                                                      152B

                                                                      MD5

                                                                      56a4f78e21616a6e19da57228569489b

                                                                      SHA1

                                                                      21bfabbfc294d5f2aa1da825c5590d760483bc76

                                                                      SHA256

                                                                      d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

                                                                      SHA512

                                                                      c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\64c4e2ac-9122-4054-bde6-f1c27ff42d2d.tmp
                                                                      Filesize

                                                                      7KB

                                                                      MD5

                                                                      9bf3958b0b915d3b580cfb1e36eef5f1

                                                                      SHA1

                                                                      87fe0b5d9774d78fafefa0a9ea502f7a78000cf2

                                                                      SHA256

                                                                      e3d900b355067bbc1484279bfdf184807b4f23097b34939b989d598dae617072

                                                                      SHA512

                                                                      6b17ff10599d75b44411e419d5340211bb935889b1108fba9577cb6b4472dfc3417e3fe376b746eb1482fb0ba0bf3f0892e89d3cf66720f6f549dc467c73fe2e

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                      Filesize

                                                                      792B

                                                                      MD5

                                                                      77efc5689a56828af7eb5614cdb763bb

                                                                      SHA1

                                                                      251e45b1fc806bb2eda728545032045bc55294b1

                                                                      SHA256

                                                                      80d2266c8eb8a7a6504fea66e1b69fbb1b9ef094797ea9eb6ec6f75c955d232a

                                                                      SHA512

                                                                      26f562d1bceae2046945457b6074384eeeff7adb0801fb11068469802d555d07795b66d8969cba57001c87b4f5c7f0d97f9d93e2f12529231a523a5e6a42baf9

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                      Filesize

                                                                      2KB

                                                                      MD5

                                                                      553b8aee8d22d7cc588abaa6a607bab7

                                                                      SHA1

                                                                      08686ecfb4eede5a1703b034ff780f1495cb3cc5

                                                                      SHA256

                                                                      8f87edfd1c5970629be6151d82b29e86accb5cc533678fc64b6dc2bf8a0105b9

                                                                      SHA512

                                                                      81b6603332e219b5a58efcd150ffea01224fa651f0cdabe6764b23fed71b302d23b73ef938917460de07cd1e67ef6c103f7d405a7aec820b77239e7fb56b8d08

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                      Filesize

                                                                      5KB

                                                                      MD5

                                                                      a869cc9b1aa6ac4d73261a7735eb0a9b

                                                                      SHA1

                                                                      10502f6f270f83d5f3e42f7c52a012bcb42cd84f

                                                                      SHA256

                                                                      c33493560ecc03a53c5d72efcd27f4e426bacf0883571550f10406ff7b70af41

                                                                      SHA512

                                                                      3557055d7308f533c6f2680134eb70b3fb635456ee35528ac7b84e3515cbcbb1183336f1b7f9b1ae020912d2053769c329c1f5db9fd8547a100b175f11e0c044

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                      Filesize

                                                                      7KB

                                                                      MD5

                                                                      1e09bda3fc4b2f7323b2ba936ed2f663

                                                                      SHA1

                                                                      0784b8f8a17d342e52c4e714587bd0a9832e197f

                                                                      SHA256

                                                                      db515722808f9a0da9f4691d825a96a57b24c8ccc1cc7b74f97a4d5d9dd6d6be

                                                                      SHA512

                                                                      9928ae7c76e655d5d45d161f97bfce020e9b51b50874e3fa5b16c04fefd50127d1d59e7aefa35af99f4e9f19c97bb84c6d321fe5c91f70a971d6a670b5d2e2cd

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                      Filesize

                                                                      96B

                                                                      MD5

                                                                      69c66623ed58b29e95524ecbdfe6f2b3

                                                                      SHA1

                                                                      d9ba2af91cf79279515d60e366b9e7cbb30bfe28

                                                                      SHA256

                                                                      a17affeda230adf07463ce8f80a86f984a6ed1d87a8eb0aa2137825fa3cec483

                                                                      SHA512

                                                                      d6b42c0ef03101a0263c8f2613227dd3e382e05e6009468d7b4770002ceff6665bf307442bc28145eedb9e12250d57fe456d91365349e3b374e0db0124c7ed91

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59ac73.TMP
                                                                      Filesize

                                                                      48B

                                                                      MD5

                                                                      a0b5d8d2c5707788cace24ef2b37a537

                                                                      SHA1

                                                                      728cb182ec4eaa61482fcbe9751ed14e4fe68263

                                                                      SHA256

                                                                      fef0c17ac300bfca7ffc2a24240bd008e04c921a29922b5cd178fbd98e997b43

                                                                      SHA512

                                                                      8e3f78a05b8467da07dd811e802901277bf936042a545808c385db426641504ea9884f600524d0bb402dc8affb724ad41ad8c503f040533e9ff51387c9fe7431

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                      Filesize

                                                                      16B

                                                                      MD5

                                                                      6752a1d65b201c13b62ea44016eb221f

                                                                      SHA1

                                                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                      SHA256

                                                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                      SHA512

                                                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                      Filesize

                                                                      10KB

                                                                      MD5

                                                                      41bc6b3fee8df2ffe1ff19476469447d

                                                                      SHA1

                                                                      13e84aa381fe4644f7569d6f52e40fdf5b536c64

                                                                      SHA256

                                                                      2d05c39a5a3c9955e266f80f0c461fc00189d55b2360b2cf8e73a0b0c60a43eb

                                                                      SHA512

                                                                      5ecc7f7b6e8cd0927d8baf2159f32fac07ce3937e420aa70ed02f9dfe4037e774e3b29417e20e1ae76de647240a6dee05ea6d1a2a80d03430448d94b7f7a0cfd

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                      Filesize

                                                                      10KB

                                                                      MD5

                                                                      377284f47b5d4fd8a3aadfc7c06ea60c

                                                                      SHA1

                                                                      4e1f853cabc7aa2c59dd58e2e22a98d9d1ce42d9

                                                                      SHA256

                                                                      a3e81a7a48ae26f648376459abb79c2563728caec5919298efc30774bbb005ca

                                                                      SHA512

                                                                      16a0ecf3ac18c9672e76a6d292c9a7c2a0cc9b97f93e2fbc529722746ba68123a919906f561309e4f6b147c12b8b1feeebb79bf7fbfe49f0f14f4b92c227c88d

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                      Filesize

                                                                      2KB

                                                                      MD5

                                                                      75dd73c5be0a8c0886aaec0fc4d8e354

                                                                      SHA1

                                                                      dfdaa89a369fd50a724132aba2e48dbcd3cf70ad

                                                                      SHA256

                                                                      eb6422b3e887110eff0654905988918ca40f6d97db12c7232edb868edfa678f4

                                                                      SHA512

                                                                      2558784dcc47bc298e5b08f344b5939f22fbaa49023415cff24b5293b0865c077388f4fc2dbbf4b28452e0428312d7a643be9c5fbba3a80f90370cdea751af7f

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133761700458423342.txt
                                                                      Filesize

                                                                      74KB

                                                                      MD5

                                                                      ca39605762a3ff6abcc77a7f49c88aaf

                                                                      SHA1

                                                                      72959970130423b596de4e96573b538d57a87e18

                                                                      SHA256

                                                                      17c6959a0af9c52830a05b04670bd0c5b4e07f422c232adeb7b8d92e06d47c30

                                                                      SHA512

                                                                      7522c9f2cfac4d870e185bc4d8fd23b14eea5515325e520cbcd9ee2d09e36d4be74480b7d3535fbccad3384864169a2c1dfb88cb0aad2510b08f9c8af878c74b

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\LLDJA3WI\microsoft.windows[1].xml
                                                                      Filesize

                                                                      97B

                                                                      MD5

                                                                      372706547a804b876522fe741dbfc040

                                                                      SHA1

                                                                      9bca733d6804f24c6841ef02b52e8ade1b45d7e4

                                                                      SHA256

                                                                      09fe1eb66c953d75dc66ff6df9237cde5f419fb25fab6327de9cde6676219651

                                                                      SHA512

                                                                      cc8057de048bf5646e41bed6f01111328bceae9abb4282a4ee1be635d086b6b3647cb5cc17cc3564980e5e31342a767dc639e536edbd3720df6b35ac7ebce34a

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_B5109EE723944443ABE43B8CA9A6FBE2.dat
                                                                      Filesize

                                                                      940B

                                                                      MD5

                                                                      c26a51dadd64364fee2e7bebfa5c7cef

                                                                      SHA1

                                                                      d3e9c04448207f2c8971cee2c4d58e7a8c50a28e

                                                                      SHA256

                                                                      cbb3fa50fb65f967d01711c207eaa645066832b47984c1dd951e9a596bb48451

                                                                      SHA512

                                                                      d4c981888b20595a305bad2c2565a1603b2b43f8c1557e5d53dc39af4eff99f303aedb46c4dd30854af052e5bfc44b579f817ecec43350d9c25870d8f042571a

                                                                      Download Submit

                                                                    • memory/556-899-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/556-30-0x000001EA187A0000-0x000001EA188A0000-memory.dmp

                                                                      Filesize

                                                                      1024KB

                                                                      Download

                                                                    • memory/556-31-0x000001EA187A0000-0x000001EA188A0000-memory.dmp

                                                                      Filesize

                                                                      1024KB

                                                                      Download

                                                                    • memory/556-35-0x000001EA197D0000-0x000001EA197F0000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/556-66-0x000001EA19BA0000-0x000001EA19BC0000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/556-56-0x000001EA19790000-0x000001EA197B0000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/812-627-0x0000000004070000-0x0000000004071000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/1368-488-0x000001ACC5E60000-0x000001ACC5E80000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/1368-497-0x000001ACC5E20000-0x000001ACC5E40000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/1368-508-0x000001ACC6230000-0x000001ACC6250000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/1368-484-0x000001ACC4D00000-0x000001ACC4E00000-memory.dmp

                                                                      Filesize

                                                                      1024KB

                                                                      Download

                                                                    • memory/1552-905-0x000001B295660000-0x000001B295680000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/1552-900-0x000001B294500000-0x000001B294600000-memory.dmp

                                                                      Filesize

                                                                      1024KB

                                                                      Download

                                                                    • memory/1552-920-0x000001B295620000-0x000001B295640000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/1552-936-0x000001B295A30000-0x000001B295A50000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/1552-901-0x000001B294500000-0x000001B294600000-memory.dmp

                                                                      Filesize

                                                                      1024KB

                                                                      Download

                                                                    • memory/1928-183-0x00000000046B0000-0x00000000046B1000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/2228-212-0x000001561FDB0000-0x000001561FDD0000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/2228-185-0x000001561E900000-0x000001561EA00000-memory.dmp

                                                                      Filesize

                                                                      1024KB

                                                                      Download

                                                                    • memory/2228-202-0x000001561F9A0000-0x000001561F9C0000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/2228-190-0x000001561F9E0000-0x000001561FA00000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/3168-0-0x00007FFB29E63000-0x00007FFB29E65000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                      Download

                                                                    • memory/3168-1095-0x000000001CB00000-0x000000001CB0A000-memory.dmp

                                                                      Filesize

                                                                      40KB

                                                                      Download

                                                                    • memory/3168-1-0x0000000000A60000-0x0000000000A76000-memory.dmp

                                                                      Filesize

                                                                      88KB

                                                                      Download

                                                                    • memory/3168-6-0x00007FFB29E60000-0x00007FFB2A921000-memory.dmp

                                                                      Filesize

                                                                      10.8MB

                                                                      Download

                                                                    • memory/3168-7-0x00007FFB29E60000-0x00007FFB2A921000-memory.dmp

                                                                      Filesize

                                                                      10.8MB

                                                                      Download

                                                                    • memory/3168-14-0x0000000001250000-0x000000000125C000-memory.dmp

                                                                      Filesize

                                                                      48KB

                                                                      Download

                                                                    • memory/3168-15-0x000000001CAB0000-0x000000001CABA000-memory.dmp

                                                                      Filesize

                                                                      40KB

                                                                      Download

                                                                    • memory/3960-338-0x0000025E16A00000-0x0000025E16B00000-memory.dmp

                                                                      Filesize

                                                                      1024KB

                                                                      Download

                                                                    • memory/3960-343-0x0000025E17B40000-0x0000025E17B60000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/3960-339-0x0000025E16A00000-0x0000025E16B00000-memory.dmp

                                                                      Filesize

                                                                      1024KB

                                                                      Download

                                                                    • memory/3960-352-0x0000025E17B00000-0x0000025E17B20000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/3960-365-0x0000025E17F10000-0x0000025E17F30000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/3996-29-0x0000000003480000-0x0000000003481000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/4156-336-0x0000000004B70000-0x0000000004B71000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/4276-481-0x0000000004980000-0x0000000004981000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/4400-657-0x00000162D1060000-0x00000162D1080000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/4400-629-0x00000162CFB40000-0x00000162CFC40000-memory.dmp

                                                                      Filesize

                                                                      1024KB

                                                                      Download

                                                                    • memory/4400-634-0x00000162D0A90000-0x00000162D0AB0000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/4400-644-0x00000162D0A50000-0x00000162D0A70000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download