xworm | hxxps://gofile[.]io/d/ikTdqf

Analysis

max time kernel
24s
max time network
24s
platform
windows11-21h2_x64
resource
win11-20250217-en
resource tags

arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
submitted
06/03/2025, 07:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/ikTdqf

Score

10^/10

xworm defense_evasion discovery rat trojan

Malware Config

Extracted

Family

xworm

band-hypothesis.gl.at.ply.gg:6089

Attributes

Install_directory
%AppData%
install_file
XClient.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x001c00000002ad9b-51.dat	family_xworm
behavioral1/memory/404-108-0x0000000000180000-0x0000000000196000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Downloads MZ/PE file 1 IoCs

flow	pid	Process
20	3480	msedge.exe

Executes dropped EXE 1 IoCs

pid	Process
404	RedWare V3.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\RedWare V3.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 853118.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\RedWare V3.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3480	msedge.exe
3480	msedge.exe
2548	msedge.exe
2548	msedge.exe
1668	identity_helper.exe
1668	identity_helper.exe
3716	msedge.exe
3716	msedge.exe
2128	msedge.exe
2128	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	404	RedWare V3.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 4276	2548	msedge.exe	81
PID 2548 wrote to memory of 4276	2548	msedge.exe	81
PID 2548 wrote to memory of 5076	2548	msedge.exe	82
PID 2548 wrote to memory of 5076	2548	msedge.exe	82
PID 2548 wrote to memory of 5076	2548	msedge.exe	82
PID 2548 wrote to memory of 5076	2548	msedge.exe	82
PID 2548 wrote to memory of 5076	2548	msedge.exe	82
PID 2548 wrote to memory of 5076	2548	msedge.exe	82
PID 2548 wrote to memory of 5076	2548	msedge.exe	82
PID 2548 wrote to memory of 5076	2548	msedge.exe	82
PID 2548 wrote to memory of 5076	2548	msedge.exe	82
PID 2548 wrote to memory of 5076	2548	msedge.exe	82
PID 2548 wrote to memory of 5076	2548	msedge.exe	82
PID 2548 wrote to memory of 5076	2548	msedge.exe	82
PID 2548 wrote to memory of 5076	2548	msedge.exe	82
PID 2548 wrote to memory of 5076	2548	msedge.exe	82
PID 2548 wrote to memory of 5076	2548	msedge.exe	82
PID 2548 wrote to memory of 5076	2548	msedge.exe	82
PID 2548 wrote to memory of 5076	2548	msedge.exe	82
PID 2548 wrote to memory of 5076	2548	msedge.exe	82
PID 2548 wrote to memory of 5076	2548	msedge.exe	82
PID 2548 wrote to memory of 5076	2548	msedge.exe	82
PID 2548 wrote to memory of 5076	2548	msedge.exe	82
PID 2548 wrote to memory of 5076	2548	msedge.exe	82
PID 2548 wrote to memory of 5076	2548	msedge.exe	82
PID 2548 wrote to memory of 5076	2548	msedge.exe	82
PID 2548 wrote to memory of 5076	2548	msedge.exe	82
PID 2548 wrote to memory of 5076	2548	msedge.exe	82
PID 2548 wrote to memory of 5076	2548	msedge.exe	82
PID 2548 wrote to memory of 5076	2548	msedge.exe	82
PID 2548 wrote to memory of 5076	2548	msedge.exe	82
PID 2548 wrote to memory of 5076	2548	msedge.exe	82
PID 2548 wrote to memory of 5076	2548	msedge.exe	82
PID 2548 wrote to memory of 5076	2548	msedge.exe	82
PID 2548 wrote to memory of 5076	2548	msedge.exe	82
PID 2548 wrote to memory of 5076	2548	msedge.exe	82
PID 2548 wrote to memory of 5076	2548	msedge.exe	82
PID 2548 wrote to memory of 5076	2548	msedge.exe	82
PID 2548 wrote to memory of 5076	2548	msedge.exe	82
PID 2548 wrote to memory of 5076	2548	msedge.exe	82
PID 2548 wrote to memory of 5076	2548	msedge.exe	82
PID 2548 wrote to memory of 5076	2548	msedge.exe	82
PID 2548 wrote to memory of 3480	2548	msedge.exe	83
PID 2548 wrote to memory of 3480	2548	msedge.exe	83
PID 2548 wrote to memory of 3876	2548	msedge.exe	84
PID 2548 wrote to memory of 3876	2548	msedge.exe	84
PID 2548 wrote to memory of 3876	2548	msedge.exe	84
PID 2548 wrote to memory of 3876	2548	msedge.exe	84
PID 2548 wrote to memory of 3876	2548	msedge.exe	84
PID 2548 wrote to memory of 3876	2548	msedge.exe	84
PID 2548 wrote to memory of 3876	2548	msedge.exe	84
PID 2548 wrote to memory of 3876	2548	msedge.exe	84
PID 2548 wrote to memory of 3876	2548	msedge.exe	84
PID 2548 wrote to memory of 3876	2548	msedge.exe	84
PID 2548 wrote to memory of 3876	2548	msedge.exe	84
PID 2548 wrote to memory of 3876	2548	msedge.exe	84
PID 2548 wrote to memory of 3876	2548	msedge.exe	84
PID 2548 wrote to memory of 3876	2548	msedge.exe	84
PID 2548 wrote to memory of 3876	2548	msedge.exe	84
PID 2548 wrote to memory of 3876	2548	msedge.exe	84
PID 2548 wrote to memory of 3876	2548	msedge.exe	84
PID 2548 wrote to memory of 3876	2548	msedge.exe	84
PID 2548 wrote to memory of 3876	2548	msedge.exe	84
PID 2548 wrote to memory of 3876	2548	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://gofile.io/d/ikTdqf
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa15e23cb8,0x7ffa15e23cc8,0x7ffa15e23cd8
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,5926719894234630574,10082628139993777254,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,5926719894234630574,10082628139993777254,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,5926719894234630574,10082628139993777254,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,5926719894234630574,10082628139993777254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,5926719894234630574,10082628139993777254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,5926719894234630574,10082628139993777254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4548 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,5926719894234630574,10082628139993777254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,5926719894234630574,10082628139993777254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,5926719894234630574,10082628139993777254,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,5926719894234630574,10082628139993777254,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,5926719894234630574,10082628139993777254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4572 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,5926719894234630574,10082628139993777254,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,5926719894234630574,10082628139993777254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,5926719894234630574,10082628139993777254,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1896,5926719894234630574,10082628139993777254,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1896,5926719894234630574,10082628139993777254,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1896,5926719894234630574,10082628139993777254,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:1712
- C:\Users\Admin\Downloads\RedWare V3.exe
  "C:\Users\Admin\Downloads\RedWare V3.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8ae85e5cf3f16b6f88fea75afff52ab0

SHA1
b5e295ed2ddf08be4d80d37a9ecd65c25df6e517

SHA256
d45c4ed2ae15c6079c37164fa5f36c8413ad19234f11bf698f0db413788e78d8

SHA512
3ab8a201e3d426262d40d00a4d9f37c323df95f2edcb3a1a831c081a64825f5cf5cd37e7f9b9ed38eda7e09989f7ba9f5f9146ee49929acd1d61f17058b0c4eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
57d5636cf19706fbbd7b4f22dd021e66

SHA1
4f8eade2a567064c8e2f711333f59d0c2f32ace9

SHA256
7ad1541c32bd8190e8e949d9c97a39fc65cb327f7f9f5eb23e5e888a2b94c023

SHA512
b755cc197864b65207dbcf79007ebb652bfee509f7118b03894900d9cb5223e81e82ea5ac943427b34c6272d568e9a3d5f9ee2c69862e09d123e89e3961d4b42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
39600e2de60cba90a5b17787f189daba

SHA1
8b4940cf757290f8aa45f3d6450debb0a84e2157

SHA256
53c27598605fab4abc6d245b58ceeec897937de29574f4ef914814bda5b02139

SHA512
9f689d4823e7550da0bd91045ef436fb91406e6da35aca39ec0103398c9f81d110f0907d06ceaa516b2632fdd988da0e410a9e9e6833752dc3cd90ad17d891f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bd5f96dbe9ef69ea2fe7c271e13c5e49

SHA1
5e1bab928c055e38008ca3088debc95412a150de

SHA256
a816ace1e67cc2de116b75d90acb42247e7c63105f080c6cc946d418b8eda086

SHA512
0963e3ae5dde648f57ad452df56ae66dabd9ce52668053a71e3fbbcea81ef94c581ee7481fcd72b776f8dc9731186b419979e7049eedf26b64a298080730d44c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d76ce0abb6d30a576add5baff29555d2

SHA1
c78fff835a55cf1f4661eec9f0c0378b945aa218

SHA256
4b17168ce8744f76a1c92168cda9a1f28b3440855eac3e7c5702783d4a74c687

SHA512
8291b97b34d4689e776a976a84849d2eaa9443f914cfdcc75315eac316e0183ec69e85b9d172c7eb4431a665cee88f15fa1ac8910990e432de2b2902431de766

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
52eddca5d296ab737f0b3a69c9b21846

SHA1
dcee2cb5f0276354a75bbbc1448ce474bc3a55ee

SHA256
bea7574bf1c758f376374e725006ecba5b759390d72c0ff3d0bc31108bf2bea7

SHA512
9da688f171e56db6158ceeb294ff2b929e5e75749e918145a790257b78482f853c306a30471e6a57b7f35d1bc7644f314432e2eb83058a027163f08c878ba319

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ddbc25627f2fc1e56cef7ad0f7ade52a

SHA1
3e260e65b5db4130f95336fb4462eeb352ebe66c

SHA256
00c5017d32869e45a400c32a8a089dac4c19c1ce724c33dc4c17ce5ecaa4ba2c

SHA512
831dd3009ac10eeb2461017004c403695983d998a836ebb878ae48093d650b5d8e375415bd93c1dc613e8a292d4294733c887bc3684cbaac78daae150c386667

Download Submit
C:\Users\Admin\Downloads\RedWare V3.exe:Zone.Identifier

Filesize
159B

MD5
bfbf20b3efb0768561f4ba7b183b6e6e

SHA1
b2ad4db48432005d3a8573ea711a24dd29ea4ba0

SHA256
b6f4ab407bf973ea7a115e94f45a85d68160eedd6aad11ee2662a7e455cab271

SHA512
c34154ffe46c0cc369098595dd981ceacd5bd59ab23740f225291acdbc702332c156f2ab793ef1da08fada20a30cfb44bab43d3292b9814d1cac2aa0815d9c76

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 853118.crdownload

Filesize
65KB

MD5
8e0620072a142972c350d7fecbc511eb

SHA1
27fd6d5dcbcefac646c0cff0d3dd11ecebcbfb45

SHA256
a4c8b9583001d6f38417c5a59d96c7020c788c81995df8b9a3cd15ad61c43640

SHA512
fa17eace548070bfe8a0faa5f131714c63f25ea9df817bf37adb0006b392b9be62ae61177896a08a9bd4e6c74f1e80adf02c730d2aac34ac627d6c452aef4b92

Download Submit
memory/404-108-0x0000000000180000-0x0000000000196000-memory.dmp

Filesize
88KB

Download