xworm | fc49309c85d3e0d4251f388411e3619dbbe8b3207f4c51b28ed258e63c38ac30

Resubmissions

06/03/2025, 17:35

250306-v5y74stwhs 10

06/03/2025, 17:27

250306-v1vdcstwbs 10

Analysis

max time kernel
75s
max time network
79s
platform
windows11-21h2_x64
resource
win11-20250217-en
resource tags

arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
submitted
06/03/2025, 17:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XClient.exe
Size

82KB
MD5

d1204a713d2783ed15f21d05d36382b3
SHA1

3894a3e7357f1b1fca20f17834dc9ac3a448915b
SHA256

fc49309c85d3e0d4251f388411e3619dbbe8b3207f4c51b28ed258e63c38ac30
SHA512

d5fd18f6f2915e908555891dddf5e373244181ba45ee146f172c638df538551126a026d618779eeeb5785b8f6c40f2cc88446267a8145128b4d3de75c75709b6
SSDEEP

1536:/sGUFLw3NUPi9BbuRi2Hkjq/x6S1Opv7+bkw:/iJw3LBbuRxHk2F1Oh7+Yw

Score

10^/10

xworm discovery rat trojan

Malware Config

Extracted

Family

xworm

editor-monitoring.gl.at.ply.gg:35972

Attributes

Install_directory
%ProgramData%
install_file
USB.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/4392-1-0x0000000000F10000-0x0000000000F2A000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2344	msedge.exe
2344	msedge.exe
4780	msedge.exe
4780	msedge.exe
4552	identity_helper.exe
4552	identity_helper.exe
3152	msedge.exe
3152	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4392	XClient.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5008	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2484	2344	msedge.exe	91
PID 2344 wrote to memory of 2484	2344	msedge.exe	91
PID 2344 wrote to memory of 3240	2344	msedge.exe	92
PID 2344 wrote to memory of 3240	2344	msedge.exe	92
PID 2344 wrote to memory of 3240	2344	msedge.exe	92
PID 2344 wrote to memory of 3240	2344	msedge.exe	92
PID 2344 wrote to memory of 3240	2344	msedge.exe	92
PID 2344 wrote to memory of 3240	2344	msedge.exe	92
PID 2344 wrote to memory of 3240	2344	msedge.exe	92
PID 2344 wrote to memory of 3240	2344	msedge.exe	92
PID 2344 wrote to memory of 3240	2344	msedge.exe	92
PID 2344 wrote to memory of 3240	2344	msedge.exe	92
PID 2344 wrote to memory of 3240	2344	msedge.exe	92
PID 2344 wrote to memory of 3240	2344	msedge.exe	92
PID 2344 wrote to memory of 3240	2344	msedge.exe	92
PID 2344 wrote to memory of 3240	2344	msedge.exe	92
PID 2344 wrote to memory of 3240	2344	msedge.exe	92
PID 2344 wrote to memory of 3240	2344	msedge.exe	92
PID 2344 wrote to memory of 3240	2344	msedge.exe	92
PID 2344 wrote to memory of 3240	2344	msedge.exe	92
PID 2344 wrote to memory of 3240	2344	msedge.exe	92
PID 2344 wrote to memory of 3240	2344	msedge.exe	92
PID 2344 wrote to memory of 3240	2344	msedge.exe	92
PID 2344 wrote to memory of 3240	2344	msedge.exe	92
PID 2344 wrote to memory of 3240	2344	msedge.exe	92
PID 2344 wrote to memory of 3240	2344	msedge.exe	92
PID 2344 wrote to memory of 3240	2344	msedge.exe	92
PID 2344 wrote to memory of 3240	2344	msedge.exe	92
PID 2344 wrote to memory of 3240	2344	msedge.exe	92
PID 2344 wrote to memory of 3240	2344	msedge.exe	92
PID 2344 wrote to memory of 3240	2344	msedge.exe	92
PID 2344 wrote to memory of 3240	2344	msedge.exe	92
PID 2344 wrote to memory of 3240	2344	msedge.exe	92
PID 2344 wrote to memory of 3240	2344	msedge.exe	92
PID 2344 wrote to memory of 3240	2344	msedge.exe	92
PID 2344 wrote to memory of 3240	2344	msedge.exe	92
PID 2344 wrote to memory of 3240	2344	msedge.exe	92
PID 2344 wrote to memory of 3240	2344	msedge.exe	92
PID 2344 wrote to memory of 3240	2344	msedge.exe	92
PID 2344 wrote to memory of 3240	2344	msedge.exe	92
PID 2344 wrote to memory of 3240	2344	msedge.exe	92
PID 2344 wrote to memory of 3240	2344	msedge.exe	92
PID 2344 wrote to memory of 4780	2344	msedge.exe	93
PID 2344 wrote to memory of 4780	2344	msedge.exe	93
PID 2344 wrote to memory of 964	2344	msedge.exe	94
PID 2344 wrote to memory of 964	2344	msedge.exe	94
PID 2344 wrote to memory of 964	2344	msedge.exe	94
PID 2344 wrote to memory of 964	2344	msedge.exe	94
PID 2344 wrote to memory of 964	2344	msedge.exe	94
PID 2344 wrote to memory of 964	2344	msedge.exe	94
PID 2344 wrote to memory of 964	2344	msedge.exe	94
PID 2344 wrote to memory of 964	2344	msedge.exe	94
PID 2344 wrote to memory of 964	2344	msedge.exe	94
PID 2344 wrote to memory of 964	2344	msedge.exe	94
PID 2344 wrote to memory of 964	2344	msedge.exe	94
PID 2344 wrote to memory of 964	2344	msedge.exe	94
PID 2344 wrote to memory of 964	2344	msedge.exe	94
PID 2344 wrote to memory of 964	2344	msedge.exe	94
PID 2344 wrote to memory of 964	2344	msedge.exe	94
PID 2344 wrote to memory of 964	2344	msedge.exe	94
PID 2344 wrote to memory of 964	2344	msedge.exe	94
PID 2344 wrote to memory of 964	2344	msedge.exe	94
PID 2344 wrote to memory of 964	2344	msedge.exe	94
PID 2344 wrote to memory of 964	2344	msedge.exe	94

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4392

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:5008

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:3224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffdab503cb8,0x7ffdab503cc8,0x7ffdab503cd8
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1860,13566905972639751740,6550040567238850570,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1864 /prefetch:2
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1860,13566905972639751740,6550040567238850570,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1860,13566905972639751740,6550040567238850570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2524 /prefetch:8
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,13566905972639751740,6550040567238850570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,13566905972639751740,6550040567238850570,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,13566905972639751740,6550040567238850570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,13566905972639751740,6550040567238850570,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1860,13566905972639751740,6550040567238850570,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3536 /prefetch:8
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1860,13566905972639751740,6550040567238850570,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3536 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,13566905972639751740,6550040567238850570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,13566905972639751740,6550040567238850570,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1860,13566905972639751740,6550040567238850570,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,13566905972639751740,6550040567238850570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,13566905972639751740,6550040567238850570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4544 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,13566905972639751740,6550040567238850570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,13566905972639751740,6550040567238850570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:2616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e826770e88318fe8f2db3f380cc22916

SHA1
d4ebc1b80456022971bcbe046fbc95b821592eca

SHA256
39b58b21a085a32ab8c05a900f7865051b785bc0cf2b499a1cc8e26adc34165a

SHA512
c8f2f24e216db852c957bea9d5d3961b15d7274b02e72534ae496bbae0149c682155a6a24a0b74bdbda62374050e71e897d8010aeefd4c13d1290327b30708b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
aceef780c08301cd5b23ae05d0987aca

SHA1
d7dacb2528c70e3340a836da7666fcffd6f2a17b

SHA256
257d92d753dd7de9a01fb0c77c63f8c3ed01ea6d7c14d8c5e1fb2db50e0077aa

SHA512
95943d8b8db3450627559344429cb82c09fa2a61b35721f400a26378bafdb1d3243d52c7eecd3c2c355373de7f48d0bf290987e7064d80b9fa689f17475ae729

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
924c101bf4b718017581aa0f19709644

SHA1
bef2299f4c8c37087f4fcbc05af111904b8284c2

SHA256
5aea472e87645e28ed3037d20bb5713de8dae8341ff1874ed81555594d7f9a9c

SHA512
356cc2e2295b11437ee0eb7b3732dfd67eb36fc898d4dc39656674af0ef120096f176ba64f54521d55b17243e7491dcaf4e376fc3612e8413a56984683b69744

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
06f6a5c77af24db02c41774c44446a9a

SHA1
5cfbfee5607a3c6a2453b3845d7637adcffb4507

SHA256
0e2aaf6e23fba00754327227fc7182d1ec1e57cd47c5414b6e02678928f77bb1

SHA512
ee636b72255de7196e5a383f863e8928c49c420997d6ee48a2d03ff44762fc1bc97ddc504d86558ceaf1957f4d1d5ce67c3846fcb8b040e506c8c150af28a3bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
42ebdb90f34f393dd4f8421a6867f082

SHA1
a1483b051ebee6b11e2af084085deb5242fc1b98

SHA256
416299615f15cb7a15499cff5acbd03260920bc7b9f12c97048f7a76a7ded235

SHA512
e629dd2b318fabff69934381e511616d64a7fee44a15795511a4917028e2a4f61d24909ea3b6a7c70abc9957b8c23d26f56b6d49dd001195e5631cc65e6776dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dc6a92217b2fdc288b191b2ab742b019

SHA1
45f75152d8981126248b695962e0fc7e3684d50b

SHA256
3a530b4e3bb06acd42a918ab898dbde9bf7f34887400832ad8737d9d56ac0382

SHA512
4bd950f2ffd1ba587aa20ed0cc8149bac198a3df75c7f6fc0b90bec6eea6827a913b156310a3f9e729ef7ab365235995d0d0e6363527f5bb12bcfabddd31b8f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4ed94ddbc9416787009beee875250797

SHA1
c5d79d642a00e92ba4182d2cf84b1530490d8976

SHA256
33733868072ae1664fde04540f32e44a6ecccea77678c55f6a6c4720bf82787f

SHA512
9aba077f75d611626dfc6ba23a1b5e7b26126a5d573779957299ae1c2cebcc9617031caaec44387dbb81840d69282a0b04f1796c99702ea1ff1e1b8e42990aa2

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\8515d180-dd0d-44b1-92f4-d98c229c2c27.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
memory/4392-0-0x00007FFDAB213000-0x00007FFDAB215000-memory.dmp

Filesize
8KB

Download
memory/4392-3-0x00007FFDAB210000-0x00007FFDABCD2000-memory.dmp

Filesize
10.8MB

Download
memory/4392-2-0x00007FFDAB210000-0x00007FFDABCD2000-memory.dmp

Filesize
10.8MB

Download
memory/4392-1-0x0000000000F10000-0x0000000000F2A000-memory.dmp

Filesize
104KB

Download