xworm | hxxps://cdn[.]discordapp[.]com/attachments/1345776574292561992/1345776601526177954/matrixnew_mapper[.]exe?ex=67c5c7a1&is=67c47621&hm=500a57a7bca2c90dcf4f340e9b6d8a57d3a0b1ad8cabd7af66795e1aa0440f98&

Resubmissions

02/03/2025, 17:23

250302-vylcnsy1gt 10

02/03/2025, 17:21

250302-vwyvzszmt9 10

Analysis

max time kernel
34s
max time network
34s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2025, 17:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1345776574292561992/1345776601526177954/matrixnew_mapper.exe?ex=67c5c7a1&is=67c47621&hm=500a57a7bca2c90dcf4f340e9b6d8a57d3a0b1ad8cabd7af66795e1aa0440f98&

Score

10^/10

xworm discovery rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

paul-nw.gl.at.ply.gg:51413

Mutex

AVvzTAnLyW8qQCcO

Attributes

Install_directory
%AppData%
install_file
kev.exe

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023d9c-106.dat	family_xworm
behavioral1/memory/5584-113-0x0000000000340000-0x0000000000350000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Downloads MZ/PE file 1 IoCs

flow	pid	Process
14	3776	msedge.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	newuimatrix.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Control Panel\International\Geo\Nation	matrixnew mapper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Control Panel\International\Geo\Nation	-.exe

Executes dropped EXE 4 IoCs

pid	Process
2296	matrixnew mapper.exe
5208	newuimatrix.exe
5296	-.exe
5584	.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
59	raw.githubusercontent.com
60	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
65	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5208	newuimatrix.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 35928.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3776	msedge.exe
3776	msedge.exe
4876	msedge.exe
4876	msedge.exe
1576	identity_helper.exe
1576	identity_helper.exe
3504	msedge.exe
3504	msedge.exe
5208	newuimatrix.exe
5208	newuimatrix.exe
5208	newuimatrix.exe
5208	newuimatrix.exe
5208	newuimatrix.exe
5208	newuimatrix.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	5296	-.exe
Token: SeDebugPrivilege	5584	.exe
Token: SeDebugPrivilege	5208	newuimatrix.exe
Token: SeDebugPrivilege	5208	newuimatrix.exe
Token: SeLoadDriverPrivilege	5208	newuimatrix.exe
Token: SeShutdownPrivilege	3556	Process not Found
Token: SeCreatePagefilePrivilege	3556	Process not Found
Token: SeShutdownPrivilege	3556	Process not Found
Token: SeCreatePagefilePrivilege	3556	Process not Found
Token: SeShutdownPrivilege	3556	Process not Found
Token: SeCreatePagefilePrivilege	3556	Process not Found
Token: SeShutdownPrivilege	3556	Process not Found
Token: SeCreatePagefilePrivilege	3556	Process not Found
Token: SeShutdownPrivilege	3556	Process not Found
Token: SeCreatePagefilePrivilege	3556	Process not Found
Token: SeShutdownPrivilege	3556	Process not Found
Token: SeCreatePagefilePrivilege	3556	Process not Found
Token: SeShutdownPrivilege	3556	Process not Found
Token: SeCreatePagefilePrivilege	3556	Process not Found
Token: SeShutdownPrivilege	3556	Process not Found
Token: SeCreatePagefilePrivilege	3556	Process not Found
Token: SeShutdownPrivilege	3556	Process not Found
Token: SeCreatePagefilePrivilege	3556	Process not Found
Token: SeShutdownPrivilege	3556	Process not Found
Token: SeCreatePagefilePrivilege	3556	Process not Found

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 4208	4876	msedge.exe	85
PID 4876 wrote to memory of 4208	4876	msedge.exe	85
PID 4876 wrote to memory of 3996	4876	msedge.exe	86
PID 4876 wrote to memory of 3996	4876	msedge.exe	86
PID 4876 wrote to memory of 3996	4876	msedge.exe	86
PID 4876 wrote to memory of 3996	4876	msedge.exe	86
PID 4876 wrote to memory of 3996	4876	msedge.exe	86
PID 4876 wrote to memory of 3996	4876	msedge.exe	86
PID 4876 wrote to memory of 3996	4876	msedge.exe	86
PID 4876 wrote to memory of 3996	4876	msedge.exe	86
PID 4876 wrote to memory of 3996	4876	msedge.exe	86
PID 4876 wrote to memory of 3996	4876	msedge.exe	86
PID 4876 wrote to memory of 3996	4876	msedge.exe	86
PID 4876 wrote to memory of 3996	4876	msedge.exe	86
PID 4876 wrote to memory of 3996	4876	msedge.exe	86
PID 4876 wrote to memory of 3996	4876	msedge.exe	86
PID 4876 wrote to memory of 3996	4876	msedge.exe	86
PID 4876 wrote to memory of 3996	4876	msedge.exe	86
PID 4876 wrote to memory of 3996	4876	msedge.exe	86
PID 4876 wrote to memory of 3996	4876	msedge.exe	86
PID 4876 wrote to memory of 3996	4876	msedge.exe	86
PID 4876 wrote to memory of 3996	4876	msedge.exe	86
PID 4876 wrote to memory of 3996	4876	msedge.exe	86
PID 4876 wrote to memory of 3996	4876	msedge.exe	86
PID 4876 wrote to memory of 3996	4876	msedge.exe	86
PID 4876 wrote to memory of 3996	4876	msedge.exe	86
PID 4876 wrote to memory of 3996	4876	msedge.exe	86
PID 4876 wrote to memory of 3996	4876	msedge.exe	86
PID 4876 wrote to memory of 3996	4876	msedge.exe	86
PID 4876 wrote to memory of 3996	4876	msedge.exe	86
PID 4876 wrote to memory of 3996	4876	msedge.exe	86
PID 4876 wrote to memory of 3996	4876	msedge.exe	86
PID 4876 wrote to memory of 3996	4876	msedge.exe	86
PID 4876 wrote to memory of 3996	4876	msedge.exe	86
PID 4876 wrote to memory of 3996	4876	msedge.exe	86
PID 4876 wrote to memory of 3996	4876	msedge.exe	86
PID 4876 wrote to memory of 3996	4876	msedge.exe	86
PID 4876 wrote to memory of 3996	4876	msedge.exe	86
PID 4876 wrote to memory of 3996	4876	msedge.exe	86
PID 4876 wrote to memory of 3996	4876	msedge.exe	86
PID 4876 wrote to memory of 3996	4876	msedge.exe	86
PID 4876 wrote to memory of 3996	4876	msedge.exe	86
PID 4876 wrote to memory of 3776	4876	msedge.exe	87
PID 4876 wrote to memory of 3776	4876	msedge.exe	87
PID 4876 wrote to memory of 1900	4876	msedge.exe	88
PID 4876 wrote to memory of 1900	4876	msedge.exe	88
PID 4876 wrote to memory of 1900	4876	msedge.exe	88
PID 4876 wrote to memory of 1900	4876	msedge.exe	88
PID 4876 wrote to memory of 1900	4876	msedge.exe	88
PID 4876 wrote to memory of 1900	4876	msedge.exe	88
PID 4876 wrote to memory of 1900	4876	msedge.exe	88
PID 4876 wrote to memory of 1900	4876	msedge.exe	88
PID 4876 wrote to memory of 1900	4876	msedge.exe	88
PID 4876 wrote to memory of 1900	4876	msedge.exe	88
PID 4876 wrote to memory of 1900	4876	msedge.exe	88
PID 4876 wrote to memory of 1900	4876	msedge.exe	88
PID 4876 wrote to memory of 1900	4876	msedge.exe	88
PID 4876 wrote to memory of 1900	4876	msedge.exe	88
PID 4876 wrote to memory of 1900	4876	msedge.exe	88
PID 4876 wrote to memory of 1900	4876	msedge.exe	88
PID 4876 wrote to memory of 1900	4876	msedge.exe	88
PID 4876 wrote to memory of 1900	4876	msedge.exe	88
PID 4876 wrote to memory of 1900	4876	msedge.exe	88
PID 4876 wrote to memory of 1900	4876	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://cdn.discordapp.com/attachments/1345776574292561992/1345776601526177954/matrixnew_mapper.exe?ex=67c5c7a1&is=67c47621&hm=500a57a7bca2c90dcf4f340e9b6d8a57d3a0b1ad8cabd7af66795e1aa0440f98&
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec1ff46f8,0x7ffec1ff4708,0x7ffec1ff4718
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,353051647606502124,10859448272432349415,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,353051647606502124,10859448272432349415,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,353051647606502124,10859448272432349415,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2960 /prefetch:8
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,353051647606502124,10859448272432349415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,353051647606502124,10859448272432349415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,353051647606502124,10859448272432349415,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,353051647606502124,10859448272432349415,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,353051647606502124,10859448272432349415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,353051647606502124,10859448272432349415,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2124,353051647606502124,10859448272432349415,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,353051647606502124,10859448272432349415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,353051647606502124,10859448272432349415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,353051647606502124,10859448272432349415,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2124,353051647606502124,10859448272432349415,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6396 /prefetch:8
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2124,353051647606502124,10859448272432349415,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3504
- C:\Users\Admin\Downloads\matrixnew mapper.exe
  "C:\Users\Admin\Downloads\matrixnew mapper.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:2296
- - C:\Users\Admin\Downloads\newuimatrix.exe
    "C:\Users\Admin\Downloads\newuimatrix.exe"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5208
- - C:\Users\Admin\Downloads\-.exe
    "C:\Users\Admin\Downloads\-.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5296
  - - C:\Users\Admin\Downloads\.exe
      "C:\Users\Admin\Downloads\.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:5584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
39c51e5592e99966d676c729e840107b

SHA1
e2dd9be0ffe54508a904d314b3cf0782a9a508b7

SHA256
29f29a3495976b65de3df2d537628d260bc005da5956b262ff35e9f61d3d9ed3

SHA512
b20532d0131b12603410c3cb425cb5df0ddc740f34e688455eff757802ffc854be771b30c3ff196e56b396c6fe53928a1577c8330b00f3f7b849fcf625e51bf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
39e376ee2f541e6b1ed0bca701e8fb59

SHA1
bfe3cc2eed8721339d433533aef6e18e0a13a9a3

SHA256
80eda1e4d8c05e257ff17ef734d606e67d8ab70b3e351430b2b231631eed5e04

SHA512
a3f082c32857db0e3dec24394a259fff85e21b6a7b057ef55933504c23ec38cbb3237eb519d38385fc53cbc584c52aaf66291f44231245d9afee509a108a3350

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2c8969f8d0a6f104d82edd0ded97688b

SHA1
3c99e4fb8bd061b3358008fa321df0b7964c1abd

SHA256
0b38317df6daa0e7ef319a16c90d8781d122056216b33bffcfc43b3784de349b

SHA512
ae37fe8c4ca5245419ba2985c77633442e45ea14793febf0824132190eb41a05c6b85781b9403a64ea8cb42b65ebc63c07112333ccee97d396f5caebae237335

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dbd4fb0cfe89add140c9773ddd510fe6

SHA1
eb33d6ec03a98c7c69b66360958f2326795fbf35

SHA256
1761dfcdde5aca360a1fd8c8b79c0c76a945d7fc177951649b924f669d8c8828

SHA512
b3a1913560828c42a58eefcac0602bcc9c5f3c6402aa4d1dd513b190971e6dc095f74d287e8e70ad7d8e8c5f3341d72ffd2ac260549f2488f8a1517f02ad6fd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a4d9e058f211914555fcce650820e335

SHA1
ff5e969fb84c33aec32c5b1d5bf276971cf0f6f0

SHA256
74dd4ecc60aab94bb9935bd431edd9a2ec4d710c29f50a5f62fca4ddeb297148

SHA512
184faead0343bba8a265351292ae33112cd4d2f6cc535527ba8135e2514857bb3a1bb47a4e348ed5b3c33012fa8bbc5461df8859dfeb17df96094866df3d8ae3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9a5bfca52b7f5616573857a7f33d936c

SHA1
b7967bc426ea1f8a0bc82c9f5054c848eb4aa737

SHA256
cd86c05e4d69ddcdd8b5643731b1e9208cb5e532c059d39bac12b1bff8830286

SHA512
bc8f6b8f7f6d84fcde13d0fcba6e5ef6f0e8ad7c89359d12d2607fb5920780fc1f7f3d55b588b1c6e55719131eac22cb778702e2e07f304543b3ce21c36f2e84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2910b752a311353de6b7cca1bf977103

SHA1
2bad19567b24c473871bfb9301afb35eff61941e

SHA256
10c19dddb9621d89eec8b6ab88351d8e39ede4f63aec2db7a17850d91609ba3d

SHA512
906459741c7f5da9f39dc8c0fc4d4935efd4200d9add957c9e712b366e212b64dd8907afac65474068672745d47cf643a15b0be23373a8f8954a5127622ace9f

Download Submit
C:\Users\Admin\Downloads\-.exe

Filesize
428KB

MD5
4e4ef72e167c726a5918dd38c9ec901d

SHA1
0d6502c6c0e0e60be7883ea09514b0bd1a1dd1bc

SHA256
17bfc5e52bc85dfafe14e428825ae1b36bd9f016c0a26dc2049057e4a4d71e69

SHA512
c86161039a7c09bb28614a62f40b34b27f0894fc84ed60ef24919048e0aeebaa0ebe00cd4d5cf2a4537f0f09df2ee3eae666c1ce4ae93711e362ca6591e74f24

Download Submit
C:\Users\Admin\Downloads\.exe

Filesize
37KB

MD5
01f86862e5a3fab03f886eb19089da95

SHA1
8749ecbbac9f911deaee8d5530ef644ca0270258

SHA256
ecfb4e772dd3be3c70e2833558b53c9352466ef193694a32a2a6e4926d810d81

SHA512
c03771ab0e115c95c2af29f1ec3e331e90bac38074bd1eeda741a6e9f4f93d7cf55dd2a6354219886e50055730c10a363f264eeadcb2c06a1fd06a3670e41a86

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 35928.crdownload

Filesize
4.5MB

MD5
2661e9a9b063a4d7a96686aa8e4ffa04

SHA1
cf6af9701e80fb8000f0820e649e9683f7e0e659

SHA256
a3b2fdc9903049997ece0fd5ae96922642477a8ad822c9d8a53d574b8459aca5

SHA512
6bda80210f421d64d8a954564689bdb3fc8f8e229e748c0aca846e9ae2f2b7bf24533a85ba22d0d2771f36a88e38d5918b9b387a6224f83301f5eda70bd3bf83

Download Submit
C:\Users\Admin\Downloads\newuimatrix.exe

Filesize
4.1MB

MD5
f749fcc1351aadd81b6775332859fff7

SHA1
d774f21509b2e96ae96c08824387c353d8b5bca2

SHA256
fa1c0114aca150636c782bf0a161aa46059827ba4690090cf5fe076ffc50d82e

SHA512
434a5fa21e0e138945382398726540393308b4eccb7e3b42f557c6683fd39b519e7d8dc507c73e4fac14c961776d6d938406b07bbf7b14f2f4f15a6f41b090fe

Download Submit
memory/2296-74-0x0000000000600000-0x0000000000A84000-memory.dmp

Filesize
4.5MB

Download
memory/5208-129-0x0000025C3DFA0000-0x0000025C3EBBC000-memory.dmp

Filesize
12.1MB

Download
memory/5208-130-0x0000025C3EBD0000-0x0000025C3EBD1000-memory.dmp

Filesize
4KB

Download
memory/5208-131-0x0000025C3DFA0000-0x0000025C3EBBC000-memory.dmp

Filesize
12.1MB

Download
memory/5208-133-0x0000025C3DFA0000-0x0000025C3EBBC000-memory.dmp

Filesize
12.1MB

Download
memory/5208-90-0x00007FF78D490000-0x00007FF78D8A4000-memory.dmp

Filesize
4.1MB

Download
memory/5208-159-0x00007FF78D490000-0x00007FF78D8A4000-memory.dmp

Filesize
4.1MB

Download
memory/5208-160-0x0000025C3DFA0000-0x0000025C3EBBC000-memory.dmp

Filesize
12.1MB

Download
memory/5296-101-0x000000001C080000-0x000000001C11C000-memory.dmp

Filesize
624KB

Download
memory/5296-100-0x000000001D910000-0x000000001DDDE000-memory.dmp

Filesize
4.8MB

Download
memory/5296-99-0x000000001BED0000-0x000000001BF76000-memory.dmp

Filesize
664KB

Download
memory/5584-113-0x0000000000340000-0x0000000000350000-memory.dmp

Filesize
64KB

Download