61bad8d96f17bc5e303a42e6fb63aa90dacec97a90aa2bf7bfebdee5d7f969eb

Analysis

max time kernel
720s
max time network
660s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
03-12-2024 12:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

X-Worm-V5-main/XWorm V5.0/XWorm V5.0.exe
Size

10.4MB
MD5

227494b22a4ee99f48a269c362fd5f19
SHA1

d32d08cf93d7f9450aee7e1e6c39d9d83b9a35c9
SHA256

7471ff7818da2e044caf5bd89725b6283ed0304453c18a0490d6341f3a010ca2
SHA512

71070e6b8042fa262ce12721e6c09104aec0a61ac0d6022f59f838077109b9476a5c1f8409242d93888eff6d36f0ee76337481fefe6f05e0f1243efbf350bee0
SSDEEP

196608:z59nhcOWSxxgQHl2np1eY5J5itQaZWtU8i/MJ:zRRWQBQnpji1W+8i/

Score

7^/10

agilenet discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

XWorm V5.0.exe

pid	Process
4752	XWorm V5.0.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral2/memory/4752-1-0x0000028BD5830000-0x0000028BD62A2000-memory.dmp	agile_net

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241203120926.pma	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\43f3137d-23dd-4f0a-8982-d98068fe39a5.tmp	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exeXWorm V5.0.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	XWorm V5.0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	XWorm V5.0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	XWorm V5.0.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	Process
2676	msedge.exe
2676	msedge.exe
4736	msedge.exe
4736	msedge.exe
1272	identity_helper.exe
1272	identity_helper.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

Processes:

msedge.exe

pid	Process
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

XWorm V5.0.exe

description	pid	Process
Token: SeDebugPrivilege	4752	XWorm V5.0.exe

Suspicious use of FindShellTrayWindow 51 IoCs

Processes:

msedge.exeXWorm V5.0.exe

pid	Process
4736	msedge.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4752	XWorm V5.0.exe
4736	msedge.exe
4736	msedge.exe

Suspicious use of SendNotifyMessage 2 IoCs

Processes:

msedge.exe

pid	Process
4736	msedge.exe
4736	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

XWorm V5.0.exemsedge.exe

description	pid	Process	procid_target
PID 4752 wrote to memory of 4736	4752	XWorm V5.0.exe	87
PID 4752 wrote to memory of 4736	4752	XWorm V5.0.exe	87
PID 4736 wrote to memory of 2608	4736	msedge.exe	88
PID 4736 wrote to memory of 2608	4736	msedge.exe	88
PID 4736 wrote to memory of 3864	4736	msedge.exe	89
PID 4736 wrote to memory of 3864	4736	msedge.exe	89
PID 4736 wrote to memory of 3864	4736	msedge.exe	89
PID 4736 wrote to memory of 3864	4736	msedge.exe	89
PID 4736 wrote to memory of 3864	4736	msedge.exe	89
PID 4736 wrote to memory of 3864	4736	msedge.exe	89
PID 4736 wrote to memory of 3864	4736	msedge.exe	89
PID 4736 wrote to memory of 3864	4736	msedge.exe	89
PID 4736 wrote to memory of 3864	4736	msedge.exe	89
PID 4736 wrote to memory of 3864	4736	msedge.exe	89
PID 4736 wrote to memory of 3864	4736	msedge.exe	89
PID 4736 wrote to memory of 3864	4736	msedge.exe	89
PID 4736 wrote to memory of 3864	4736	msedge.exe	89
PID 4736 wrote to memory of 3864	4736	msedge.exe	89
PID 4736 wrote to memory of 3864	4736	msedge.exe	89
PID 4736 wrote to memory of 3864	4736	msedge.exe	89
PID 4736 wrote to memory of 3864	4736	msedge.exe	89
PID 4736 wrote to memory of 3864	4736	msedge.exe	89
PID 4736 wrote to memory of 3864	4736	msedge.exe	89
PID 4736 wrote to memory of 3864	4736	msedge.exe	89
PID 4736 wrote to memory of 3864	4736	msedge.exe	89
PID 4736 wrote to memory of 3864	4736	msedge.exe	89
PID 4736 wrote to memory of 3864	4736	msedge.exe	89
PID 4736 wrote to memory of 3864	4736	msedge.exe	89
PID 4736 wrote to memory of 3864	4736	msedge.exe	89
PID 4736 wrote to memory of 3864	4736	msedge.exe	89
PID 4736 wrote to memory of 3864	4736	msedge.exe	89
PID 4736 wrote to memory of 3864	4736	msedge.exe	89
PID 4736 wrote to memory of 3864	4736	msedge.exe	89
PID 4736 wrote to memory of 3864	4736	msedge.exe	89
PID 4736 wrote to memory of 3864	4736	msedge.exe	89
PID 4736 wrote to memory of 3864	4736	msedge.exe	89
PID 4736 wrote to memory of 3864	4736	msedge.exe	89
PID 4736 wrote to memory of 3864	4736	msedge.exe	89
PID 4736 wrote to memory of 3864	4736	msedge.exe	89
PID 4736 wrote to memory of 3864	4736	msedge.exe	89
PID 4736 wrote to memory of 3864	4736	msedge.exe	89
PID 4736 wrote to memory of 3864	4736	msedge.exe	89
PID 4736 wrote to memory of 3864	4736	msedge.exe	89
PID 4736 wrote to memory of 3864	4736	msedge.exe	89
PID 4736 wrote to memory of 2676	4736	msedge.exe	90
PID 4736 wrote to memory of 2676	4736	msedge.exe	90
PID 4736 wrote to memory of 2456	4736	msedge.exe	91
PID 4736 wrote to memory of 2456	4736	msedge.exe	91
PID 4736 wrote to memory of 2456	4736	msedge.exe	91
PID 4736 wrote to memory of 2456	4736	msedge.exe	91
PID 4736 wrote to memory of 2456	4736	msedge.exe	91
PID 4736 wrote to memory of 2456	4736	msedge.exe	91
PID 4736 wrote to memory of 2456	4736	msedge.exe	91
PID 4736 wrote to memory of 2456	4736	msedge.exe	91
PID 4736 wrote to memory of 2456	4736	msedge.exe	91
PID 4736 wrote to memory of 2456	4736	msedge.exe	91
PID 4736 wrote to memory of 2456	4736	msedge.exe	91
PID 4736 wrote to memory of 2456	4736	msedge.exe	91
PID 4736 wrote to memory of 2456	4736	msedge.exe	91
PID 4736 wrote to memory of 2456	4736	msedge.exe	91
PID 4736 wrote to memory of 2456	4736	msedge.exe	91
PID 4736 wrote to memory of 2456	4736	msedge.exe	91
PID 4736 wrote to memory of 2456	4736	msedge.exe	91
PID 4736 wrote to memory of 2456	4736	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\X-Worm-V5-main\XWorm V5.0\XWorm V5.0.exe
"C:\Users\Admin\AppData\Local\Temp\X-Worm-V5-main\XWorm V5.0\XWorm V5.0.exe"
1⤵
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/XCoderTools
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffc73e246f8,0x7ffc73e24708,0x7ffc73e24718
    3⤵
    PID:2608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,7355383043228735150,10982555518488419532,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
    3⤵
    PID:3864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2236,7355383043228735150,10982555518488419532,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2236,7355383043228735150,10982555518488419532,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
    3⤵
    PID:2456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7355383043228735150,10982555518488419532,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
    3⤵
    PID:2928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7355383043228735150,10982555518488419532,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
    3⤵
    PID:4020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7355383043228735150,10982555518488419532,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
    3⤵
    PID:3508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7355383043228735150,10982555518488419532,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:1
    3⤵
    PID:4376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7355383043228735150,10982555518488419532,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
    3⤵
    PID:1196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7355383043228735150,10982555518488419532,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
    3⤵
    PID:1152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7355383043228735150,10982555518488419532,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
    3⤵
    PID:676
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,7355383043228735150,10982555518488419532,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6184 /prefetch:8
    3⤵
    PID:4796
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:2328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x254,0x258,0x25c,0x230,0x260,0x7ff7909a5460,0x7ff7909a5470,0x7ff7909a5480
      4⤵
      PID:4600
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,7355383043228735150,10982555518488419532,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6184 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7355383043228735150,10982555518488419532,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
    3⤵
    PID:3904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7355383043228735150,10982555518488419532,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:1
    3⤵
    PID:2464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7355383043228735150,10982555518488419532,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2020 /prefetch:1
    3⤵
    PID:1300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7355383043228735150,10982555518488419532,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3852 /prefetch:1
    3⤵
    PID:2688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7355383043228735150,10982555518488419532,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
    3⤵
    PID:548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7355383043228735150,10982555518488419532,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1724 /prefetch:1
    3⤵
    PID:3152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7355383043228735150,10982555518488419532,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
    3⤵
    PID:2480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,7355383043228735150,10982555518488419532,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3436 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7355383043228735150,10982555518488419532,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2132 /prefetch:1
    3⤵
    PID:1472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7355383043228735150,10982555518488419532,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2428 /prefetch:1
    3⤵
    PID:2240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7355383043228735150,10982555518488419532,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
    3⤵
    PID:3220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7355383043228735150,10982555518488419532,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1400 /prefetch:1
    3⤵
    PID:2576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7355383043228735150,10982555518488419532,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
    3⤵
    PID:736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7355383043228735150,10982555518488419532,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
    3⤵
    PID:556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7355383043228735150,10982555518488419532,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1508 /prefetch:1
    3⤵
    PID:4840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7355383043228735150,10982555518488419532,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3816 /prefetch:1
    3⤵
    PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/XCoderTools
  2⤵
  PID:2756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc73e246f8,0x7ffc73e24708,0x7ffc73e24718
    3⤵
    PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/XCoderTools
  2⤵
  PID:2664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc73e246f8,0x7ffc73e24708,0x7ffc73e24718
    3⤵
    PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/XCoderTools
  2⤵
  PID:1916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc73e246f8,0x7ffc73e24708,0x7ffc73e24718
    3⤵
    PID:3828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1cf1f752ee1e01f3c9b92cc8aeca0e61

SHA1
00b69315d5f95e83ccca6b4d2c1d4594affc89f3

SHA256
73be05d66aa81fb5b3a51774066427dcc0e468515c61a47530b419b9494baad5

SHA512
92382970d871c1ead282b1630630d104003d438207c89642ef43e829b78c1bbb16128390ee9a75a76afb6516a03a5330d0302242766604f380ffaea33acf9ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
78bc0ec5146f28b496567487b9233baf

SHA1
4b1794d6cbe18501a7745d9559aa91d0cb2a19c1

SHA256
f5e3afb09ca12cd22dd69c753ea12e85e9bf369df29e2b23e0149e16f946f109

SHA512
0561cbabde95e6b949f46deda7389fbe52c87bedeb520b88764f1020d42aa2c06adee63a7d416aad2b85dc332e6b6d2d045185c65ec8c2c60beac1f072ca184a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a134f1844e0964bb17172c44ded4030f

SHA1
853de9d2c79d58138933a0b8cf76738e4b951d7e

SHA256
50f5a3aaba6fcbddddec498e157e3341f432998c698b96a4181f1c0239176589

SHA512
c124952f29503922dce11cf04c863966ac31f4445304c1412d584761f90f7964f3a150e32d95c1927442d4fa73549c67757a26d50a9995e14b96787df28f18b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
28KB

MD5
38614225a098def99a788a2a1a3f1fd9

SHA1
8567fc94d204cfd2066654a0df7167d56f9952c8

SHA256
cda88367d92e5a05490b66cb01fdea12da6817067d1cbc21f42435052552ea1b

SHA512
926143d804a571fb4a0bf14e3c54204f2000039bd783a37e98339441c1451ac851a187cad5265540478e70e0f001513540fe8216a070b7c79a833754e8717e77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
80KB

MD5
14e39be019da848a73da7658165674cb

SHA1
e016473c4189a8cc3dbff754a48b3e42d68af25a

SHA256
39595a1806156cfcadf3cc4e20c5c3f3eec721386a0551790a15f025ba9402bd

SHA512
828a383de549871aa80ec960a7e371ef47da96d01ebb9628d1484ceed9eb698aec5109b3de0b24ff8000610a2c2d633616c9fd28d380656fecbaa930cffed029

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
2fa58455104d5e773d28ef05073675da

SHA1
51ade008a2d5eb5b76283c8693b7a145c411fbae

SHA256
019f212bbf8d82791581723ad84d49d56be0e9fa0d32bde0fd928d65797739c3

SHA512
3896d34c8809144d888730148028cb377a0ae9a973d435cfadd8ba2355c8523acd4a5029b19fef2d109bf78b2b34024dd556156c7183b56eba4d4f0e58abd599

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
3dd03702e455e9d16ef0fb4bce62342f

SHA1
507d1921b95b8136e892566eea8cc9b8ecba1b44

SHA256
f9be05441f0da72d9995993cd0a992824e8d41adbf2e0f8bc97e37fc54f519b4

SHA512
2717875ff41133282e5c6ddf6ba999ff801f2db3541273930a370aea6fb3285826fe95e8ebe06bbe3d2fead553e888d67013a26cdd62dea6c89ba44c48a306ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
442B

MD5
6f0feb453263c58cb346fcce0e46ee50

SHA1
be920972085da8cd0d67f51f19d405e7e9993d6e

SHA256
dba8855a59146b9604f5b84408d9e57a645807c3539df4382d4ff701e9c4620a

SHA512
3c015a8897c0f3adadab81331c06f34c44a71f1ce21fef78f76f607ba044edce6dbc490529a0900861c8ac0a73939497081236c1aba03f76d8ff16c791154447

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6c59361b6b27a080861cd52eb5e69572

SHA1
90fcffe5cdbe9b1d476af5837e0f29fb54181bfd

SHA256
26bbb0d204cb9de549b5e8a406bf4988062a83ac8aafb2bf066d7870b0f0645e

SHA512
124aaf39b140a90c2c7cc6cce73314f18a09e4610f9375e2152aad144f0d286046629f13b01b5526ed69983e219b288a56443ac02484dbc6b7d2a64eb789a9fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f540d4d17ce0d16532023772ba3c3d82

SHA1
b073f03c908644768b34c14111e6ef1a487fa350

SHA256
a60bdb2d3f3ec265ba4d0c1bfdba0cbbd5ed0c7a287ee5b7a89a02947a8f499d

SHA512
b7069d5dd54f01913759c5ef8d242cafa3436cdff4baf3517ab3a2eb612e9a4135205acc9cedc350948210efbd6645d421ebb2b01f765aab42d74c7e4d035f1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
557f7fbe1b5d6f9714f3b56ade580b40

SHA1
22c033e87e88ef687d099b4f5612c77302ad8076

SHA256
632417585aa84db6bc677b6c34d6d63fd46fd85f43cd4d04c5f712e5fdac4036

SHA512
561e7e33f99ded9ce6804dadfb8ff165d325e7b785bd1b5c8724bc7d6100fe12a893876b40ad83ef7de35e318e748d4563617e560b62e16d8c9ebbf9c61ab504

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
653ba21e0784063210cced5711c8b435

SHA1
eb3e70cd62dfa3340680dd6d379f75d3acb6c61b

SHA256
f619289ce5f37536d4feaf9177ac5789b12f5a1801890a89ad7b5f2633f1e511

SHA512
2266530d0bbc38fed1fc67107d8d948e9054e32358b15f1f1dc2592a83785842dfe84b14d0ec2722ae1128bf774737e3aed84aa0733a96f1d92a2948f863db0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d7019598288c37a8345e1a84a75168b5

SHA1
9aae06006c4d69aa833ecfb510906b38e39dc7a5

SHA256
f6a9806e5644c0c2c14f42544c1d45db805f2c24bbbbec1ce3065b5c51512a21

SHA512
249973a848105af97b4c23496dc481b763c95d7449f615dd60035ff067a6ec5a07259c9da905031d74b3e8aa88c13520ff738c3f0e84ced80d8d4a71bf4e5a25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
430da35def428cc3214601bd046e54af

SHA1
6b318b7cd657b62606fc0aee47e388a25a8c9fed

SHA256
572aada805c5bf7ac20275db3fbe2ab146d1b044b0ed57a49edb094755508b91

SHA512
dbf8eda726bf2d3b2841e4b21a86e9661be9a0a1c833ac731daa2a776b9412199cf346c7e66fa890eb1d9123d8236318461f29db440fdb752c7738dacfb3e670

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
082ab74ea6638c16f5594a866c726003

SHA1
4cff6e9ddbe64fc50e6170cdb64b293edc043afc

SHA256
c13d2c5aaf57645338c127c8bfe4bbb1c089719b0c8bb337f1a7f682d7bbcbca

SHA512
a22c65bdf7015f5d5e02f9d1e5a945e070fd106325c3e1290f69f40ffdb33d733d1ae692926979c75b705b36bd8e6849cc64163d4fdf97b54fa9df6cac897eca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
009f89547aca21aee6e190e8c27ff970

SHA1
c190340a59e73b842cc4a8caa0786a8032d2ec57

SHA256
f72cbfa63bf97f3768fce9938a776073fbeb94bc222ece4ec0eef5c705bbab71

SHA512
6cf51022e4807f7cfa41495f7e57f5fd4f80ddfc501d63866d192383470683c9b485442f2167c6db7318b94a108f4be1e6c9eaf8de40617eca35e16a7950ed49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
9010fe212d7da97a4e9cf63a903ee7a4

SHA1
8f124a736d045eea3c50a9597d18c9af8b128e28

SHA256
c2956b77f9af9f4d79e0198d8a7e0a5b6f880b4d597dfeee25a3f56c05d11834

SHA512
f763ab3261592107fb19b7d6134c7f4d02e921258b1c72f1e0c69a95ee8ed9cc20498259a279cca9648bbd213a5234b965a9196865d465e1f975ee9242e36326

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
21320325bdfc20c6f4e4d136228fc9c5

SHA1
7e96950811d7ddbc1daeb7341ddb9768980bf2b5

SHA256
5e7ac2b978206a07d8b1841a2bd89eae4b466bcd8a0df3a62ae2ca0439b8bd5e

SHA512
ee78316d5b8edffdc83e3431bdbd28ae05a481d2a445ddf3b7c58bf0f01c6c42aead46a4d91e7fc75519a5ca8a7e2bab78749d88476c7a2fa0a25e8b3592bd43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
08b55bb6720c36856e92d869f5ec9a82

SHA1
63b74003cfb0f18e4ba5f97992bbda36c5d47ad6

SHA256
80a1c1694a91cfda0dd9445457d4b4235d601db5f3a6abc624eb9cc377a1dc45

SHA512
dbebc121ee42eae8be14cc5b5dd7815b574ba077ce0d37992fd2d90ae50e8c394a02b859267777d528b9527c2a91e15b023168c7f1e7d6fb5439c9c3e2b5b2ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5a5100.TMP

Filesize
538B

MD5
7a2846333f5b958ee8df6ddbe7bf522c

SHA1
ff13e589f55d62759eecf105a120d373b3dfe0d5

SHA256
045bd6703c5991d6654ce97d926fed44ad0196e89b2a169f968e8f549de8c647

SHA512
1d3d9457d284b4f06cf848d0d27a8eb6b5114edc7b22fadd9f1c6f0b4b76ac2af25a1b983a48113aa5edbcd3025ad8f3d0941fc3933315324ab036b9f8dbce59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dfbca24f-4437-46b7-ba18-28ebbf84ecbd.tmp

Filesize
5KB

MD5
aaac663a084bea64d5ba15a5d1594df4

SHA1
83c6b8482b83fa7fb637384f76b81c3f5fe3dcbe

SHA256
fb29924c8706b16748d083c285d10deb1c2c0d0c29fa55888dd9ab5b8ea05299

SHA512
5c47c1707b2b7efbacbc915dbaaf8d812e85397c2737d9ef38288998ca8f8bd503176223332a6e59b1427c682a74cc9fefd9e5a9e6827a1398d30b5c6f95606f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b168d874ec147022489b1bb0c589648a

SHA1
f1e2cc4392483297e8ef6dace50552e0676f3986

SHA256
64f2fce8e8b65c9e4ec05bbfebd650a828f6749a872f31a79a0502e76c7b91b4

SHA512
362c87f8e997022c84383f3989a3796277c0b6f4e551fad4172c385b637496e1341d41b04810a9a87961966967bb5794f9525e6d9f037421482b35fa2f369d7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cdbd2648cefe225bfc2754b67ddd8c2b

SHA1
99a336bcdd068fb9c2430ee8feb567cb01f469b3

SHA256
decc2ade78af50fed172449f7ec81ed1edb83c7ab386a6095f7c1e2a42ab7366

SHA512
262ee945c85beaa7af89d6ed67228fdc19e6ed56778aea8a517566c17a889c34dd8e006968873658d038cb7114b77081a75f3787ec62747b08dde69fd702c8b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
f68c028ba23fc232d79e78edfa451405

SHA1
25a93f07f75fce36b22997d0205c1037ae90c0fc

SHA256
95c12cd24cbc8e3c21da164a04385b3dbb72079f86ab57a0bab6367dc523ae0b

SHA512
517c37d496851e0f421c53b0c48cf1f571acc0370ab8a97390b79fd3259a41b3284081d9fd4bd13165de7cef128f80bf1fa05f35d55a07368a6e7e9feaac378e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e80778c9bc3afdc820ec592dce8a325a

SHA1
ec2d3548ec849b90c4aa127687ed26984c121eaa

SHA256
f490388700caa2668243c346db052f58b3fd0f37b7f40cf1773a30f15fd41c99

SHA512
6b13968264f4ee4ebcdaf234063d147ff7494576c9be316e5aa132594d44579dc45f3e2956466c8b19dec483c065382d599a4283049b7ba6b48dbac0ed2019c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
99c707dbffead6f41649eeabaf68898a

SHA1
b587c595933623a1afba8813379a6d7d06bc4074

SHA256
39447b7a77832a0eaf8e4f984fd4ae0730d614cb89d1ba4c76a573b7c67a80be

SHA512
3883b504cff0bf9092be536f60bcc6feaac8f06dd538c11438e2ee2ace0e6e52dfccced5245818ae11a0c12129e1da0ee961cf395acf0b30e3be89f16c536202

Download Submit
C:\Users\Admin\AppData\Local\Temp\CE8806DA1EF0F1BB553DFF4FC5E9FCCD\CE8806DA1EF0F1BB553DFF4FC5E9FCCD.dll

Filesize
112KB

MD5
a239b7cac8be034a23e7e231d3bcc6df

SHA1
ae3c239a17c2b4b4d2fba1ec862cf9644bf1346d

SHA256
063099408fd5fb10a7ea408a50b7fb5da1c36accc03b9b31c933df54385d32b8

SHA512
c79a2b08f7e95d49a588b1f41368f0dd8d4cd431ad3403301e4d30826d3df0907d01b28ef83116ad6f035218f06dbdf63a0f4f2f9130bba1b0b7e58f9fc67524

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
f6dedb440c1fe43f07a42fe6b4c921ac

SHA1
8cbf2c79f79bcc89bcbc35123523ec48eba6da83

SHA256
be03d46612d322384f25e5b0169250462d3a8670d4089c74e3d5a4f4a2eacc0a

SHA512
25e8b6644d54995c2482189512cbee0801388c02607c8748cce86f020f133d95a937bd4bcc96ae8195fa33d982d8ef52c6c7c15fee0f6480243d86f1d944f033

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
cf7609a0a4430496edddd2ef59899f94

SHA1
22dc9712a7818b6c0de53c327265c154b370472b

SHA256
495f4d0ef23e3e5ef04bce1d2254a6695c0cdf90e83793a95ee4284baf31b7c9

SHA512
f3cea1d2bdeb36d426a41b4a8658a53cfe58c7a18d45d588434953d8344423d975785fa36b1121acd5fb52c099a052190ed8e06460acd4eac83cd9fb0dfcac45

Download Submit
\??\pipe\LOCAL\crashpad_4736_PNZEQQOOVGNZMOUJ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/4752-0-0x00007FFC79F13000-0x00007FFC79F15000-memory.dmp

Filesize
8KB

Download
memory/4752-12-0x00007FFC79F10000-0x00007FFC7A9D2000-memory.dmp

Filesize
10.8MB

Download
memory/4752-11-0x00007FFC79F10000-0x00007FFC7A9D2000-memory.dmp

Filesize
10.8MB

Download
memory/4752-10-0x0000028BF2860000-0x0000028BF2A54000-memory.dmp

Filesize
2.0MB

Download
memory/4752-13-0x00007FFC79F13000-0x00007FFC79F15000-memory.dmp

Filesize
8KB

Download
memory/4752-9-0x0000028BF10A0000-0x0000028BF1C56000-memory.dmp

Filesize
11.7MB

Download
memory/4752-14-0x00007FFC79F10000-0x00007FFC7A9D2000-memory.dmp

Filesize
10.8MB

Download
memory/4752-15-0x00007FFC79F10000-0x00007FFC7A9D2000-memory.dmp

Filesize
10.8MB

Download
memory/4752-400-0x00007FFC79F10000-0x00007FFC7A9D2000-memory.dmp

Filesize
10.8MB

Download
memory/4752-8-0x00007FFC79F10000-0x00007FFC7A9D2000-memory.dmp

Filesize
10.8MB

Download
memory/4752-144-0x00007FFC79F10000-0x00007FFC7A9D2000-memory.dmp

Filesize
10.8MB

Download
memory/4752-1-0x0000028BD5830000-0x0000028BD62A2000-memory.dmp

Filesize
10.4MB

Download