Overview

overview

10

Static

static

1

URLScan

urlscan

1

https://gofile.io/d/...

windows10-ltsc_2021-x64

Analysis

  • max time kernel
    422s
  • max time network
    435s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20250314-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
  • submitted
    28/03/2025, 00:56

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    https://gofile.io/d/pzy4gN

Score
10/10
xwormdefense_evasiondiscoveryevasionexecutionpersistencerattrojan

Malware Config

Extracted

Family

xworm

C2

dvd-washington.gl.at.ply.gg:5399

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload 2 IoCs
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 1 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender notification settings 3 TTPs 1 IoCs
    defense_evasiontrojan
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 3 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Drops file in Windows directory 37 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 7 IoCs
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 48 IoCs
  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://gofile.io/d/pzy4gN
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3788
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x264,0x268,0x26c,0x260,0x2ac,0x7ffec792f208,0x7ffec792f214,0x7ffec792f220
      2⤵
        PID:4220
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1860,i,15387327855251862055,2298744275943094763,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
        2⤵
        • Downloads MZ/PE file
        PID:5672
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2264,i,15387327855251862055,2298744275943094763,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
        2⤵
          PID:3508
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2344,i,15387327855251862055,2298744275943094763,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:8
          2⤵
            PID:5608
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3452,i,15387327855251862055,2298744275943094763,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
            2⤵
              PID:5740
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3460,i,15387327855251862055,2298744275943094763,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
              2⤵
                PID:4644
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4872,i,15387327855251862055,2298744275943094763,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
                2⤵
                  PID:2744
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3720,i,15387327855251862055,2298744275943094763,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
                  2⤵
                    PID:788
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3712,i,15387327855251862055,2298744275943094763,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:8
                    2⤵
                      PID:5196
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5688,i,15387327855251862055,2298744275943094763,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:8
                      2⤵
                        PID:3136
                      • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5880,i,15387327855251862055,2298744275943094763,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
                        2⤵
                          PID:524
                        • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5880,i,15387327855251862055,2298744275943094763,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
                          2⤵
                            PID:3140
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=5900,i,15387327855251862055,2298744275943094763,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:1
                            2⤵
                              PID:4260
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6212,i,15387327855251862055,2298744275943094763,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:8
                              2⤵
                                PID:5412
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=4852,i,15387327855251862055,2298744275943094763,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:1
                                2⤵
                                  PID:5872
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4784,i,15387327855251862055,2298744275943094763,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:8
                                  2⤵
                                    PID:4480
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6764,i,15387327855251862055,2298744275943094763,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:8
                                    2⤵
                                      PID:2368
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=604,i,15387327855251862055,2298744275943094763,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:8
                                      2⤵
                                        PID:5164
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6948,i,15387327855251862055,2298744275943094763,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:8
                                        2⤵
                                          PID:5520
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5904,i,15387327855251862055,2298744275943094763,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:8
                                          2⤵
                                            PID:1192
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6444,i,15387327855251862055,2298744275943094763,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:8
                                            2⤵
                                              PID:1068
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5720,i,15387327855251862055,2298744275943094763,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:8
                                              2⤵
                                                PID:2796
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5740,i,15387327855251862055,2298744275943094763,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:8
                                                2⤵
                                                  PID:2348
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6192,i,15387327855251862055,2298744275943094763,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:8
                                                  2⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:5252
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6308,i,15387327855251862055,2298744275943094763,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:8
                                                  2⤵
                                                    PID:5020
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3756,i,15387327855251862055,2298744275943094763,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
                                                    2⤵
                                                      PID:5604
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5008,i,15387327855251862055,2298744275943094763,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
                                                      2⤵
                                                        PID:232
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5848,i,15387327855251862055,2298744275943094763,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
                                                        2⤵
                                                          PID:4004
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6804,i,15387327855251862055,2298744275943094763,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
                                                          2⤵
                                                            PID:2820
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6160,i,15387327855251862055,2298744275943094763,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:8
                                                            2⤵
                                                              PID:4968
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4336,i,15387327855251862055,2298744275943094763,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
                                                              2⤵
                                                                PID:404
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4288,i,15387327855251862055,2298744275943094763,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
                                                                2⤵
                                                                  PID:3844
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4976,i,15387327855251862055,2298744275943094763,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:8
                                                                  2⤵
                                                                    PID:4268
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
                                                                  1⤵
                                                                    PID:4712
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                    1⤵
                                                                      PID:1288
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                        2⤵
                                                                          PID:5256
                                                                      • C:\Windows\System32\rundll32.exe
                                                                        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                        1⤵
                                                                          PID:1084
                                                                        • C:\Users\Admin\Downloads\XClient.exe
                                                                          "C:\Users\Admin\Downloads\XClient.exe"
                                                                          1⤵
                                                                          • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                          • Checks computer location settings
                                                                          • Drops startup file
                                                                          • Executes dropped EXE
                                                                          • Enumerates connected drives
                                                                          • Checks processor information in registry
                                                                          • Enumerates system info in registry
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious behavior: GetForegroundWindowSpam
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          • Suspicious use of FindShellTrayWindow
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:1884
                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\XClient.exe'
                                                                            2⤵
                                                                            • Command and Scripting Interpreter: PowerShell
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:1760
                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
                                                                            2⤵
                                                                            • Command and Scripting Interpreter: PowerShell
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:1264
                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\BootstrapperNew'
                                                                            2⤵
                                                                            • Command and Scripting Interpreter: PowerShell
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:4604
                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'BootstrapperNew'
                                                                            2⤵
                                                                            • Command and Scripting Interpreter: PowerShell
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            PID:5264
                                                                          • C:\Windows\system32\sc.exe
                                                                            "C:\Windows\system32\sc.exe" qc windefend
                                                                            2⤵
                                                                            • Launches sc.exe
                                                                            PID:5460
                                                                          • C:\Windows\system32\cmd.exe
                                                                            "C:\Windows\system32\cmd.exe" /d/r SecurityHealthSystray & "%ProgramFiles%\Windows Defender\MSASCuiL.exe"
                                                                            2⤵
                                                                              PID:1268
                                                                              • C:\Windows\system32\SecurityHealthSystray.exe
                                                                                SecurityHealthSystray
                                                                                3⤵
                                                                                • Suspicious use of FindShellTrayWindow
                                                                                • Suspicious use of SendNotifyMessage
                                                                                PID:1604
                                                                            • C:\Windows\system32\whoami.exe
                                                                              "C:\Windows\system32\whoami.exe" /groups
                                                                              2⤵
                                                                                PID:5452
                                                                              • C:\Windows\system32\net1.exe
                                                                                "C:\Windows\system32\net1.exe" start TrustedInstaller
                                                                                2⤵
                                                                                  PID:1140
                                                                                • C:\Windows\SYSTEM32\taskkill.exe
                                                                                  taskkill /F /IM explorer.exe
                                                                                  2⤵
                                                                                  • Kills process with taskkill
                                                                                  PID:4556
                                                                                • C:\Windows\explorer.exe
                                                                                  "C:\Windows\explorer.exe"
                                                                                  2⤵
                                                                                  • Boot or Logon Autostart Execution: Active Setup
                                                                                  • Enumerates connected drives
                                                                                  • Checks SCSI registry key(s)
                                                                                  • Modifies registry class
                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                  • Suspicious use of SendNotifyMessage
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:4436
                                                                              • C:\Windows\servicing\TrustedInstaller.exe
                                                                                C:\Windows\servicing\TrustedInstaller.exe
                                                                                1⤵
                                                                                  PID:5548
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    powershell -nop -win 1 -c & {rp hkcu:\environment windir -ea 0;$AveYo=' (\ /) ( * . * ) A limited account protects you from UAC exploits ``` ';$env:1=6;iex((gp Registry::HKEY_Users\S-1-5-21*\Volatile* ToggleDefender -ea 0)[0].ToggleDefender)}
                                                                                    2⤵
                                                                                    • Modifies Windows Defender DisableAntiSpyware settings
                                                                                    • Modifies Windows Defender Real-time Protection settings
                                                                                    • Modifies Windows Defender notification settings
                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                    • Modifies data under HKEY_USERS
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    PID:5008
                                                                                    • C:\Windows\system32\sc.exe
                                                                                      "C:\Windows\system32\sc.exe" qc windefend
                                                                                      3⤵
                                                                                      • Launches sc.exe
                                                                                      PID:5016
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      "C:\Windows\system32\cmd.exe" /d/r SecurityHealthSystray & "%ProgramFiles%\Windows Defender\MSASCuiL.exe"
                                                                                      3⤵
                                                                                        PID:5204
                                                                                        • C:\Windows\system32\SecurityHealthSystray.exe
                                                                                          SecurityHealthSystray
                                                                                          4⤵
                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                          • Suspicious use of SendNotifyMessage
                                                                                          PID:4888
                                                                                      • C:\Windows\system32\whoami.exe
                                                                                        "C:\Windows\system32\whoami.exe" /groups
                                                                                        3⤵
                                                                                          PID:3396
                                                                                        • C:\Windows\system32\net1.exe
                                                                                          "C:\Windows\system32\net1.exe" stop windefend
                                                                                          3⤵
                                                                                            PID:4440
                                                                                          • C:\Windows\system32\sc.exe
                                                                                            "C:\Windows\system32\sc.exe" config windefend depend= RpcSs-TOGGLE
                                                                                            3⤵
                                                                                            • Launches sc.exe
                                                                                            PID:976
                                                                                          • C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                            "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
                                                                                            3⤵
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:5412
                                                                                      • C:\Windows\system32\control.exe
                                                                                        "C:\Windows\system32\control.exe" panel
                                                                                        1⤵
                                                                                          PID:5684
                                                                                        • C:\Windows\explorer.exe
                                                                                          C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
                                                                                          1⤵
                                                                                          • Modifies Internet Explorer settings
                                                                                          • Modifies registry class
                                                                                          • Suspicious behavior: AddClipboardFormatListener
                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                          PID:2956
                                                                                        • C:\Windows\SysWOW64\DllHost.exe
                                                                                          C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
                                                                                          1⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:5364
                                                                                        • C:\Windows\SysWOW64\DllHost.exe
                                                                                          C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
                                                                                          1⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:5524
                                                                                        • C:\Windows\System32\oobe\UserOOBEBroker.exe
                                                                                          C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
                                                                                          1⤵
                                                                                          • Drops file in Windows directory
                                                                                          PID:4928
                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
                                                                                          C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
                                                                                          1⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:2728
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe" -ServerName:SecHealthUI.AppXep4x2tbtjws1v9qqs0rmb3hxykvkpqtn.mca
                                                                                          1⤵
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:1636
                                                                                        • C:\Windows\System32\SecurityHealthHost.exe
                                                                                          C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
                                                                                          1⤵
                                                                                            PID:3892
                                                                                          • C:\Windows\System32\SecurityHealthHost.exe
                                                                                            C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
                                                                                            1⤵
                                                                                              PID:5444
                                                                                            • C:\Windows\System32\SecurityHealthHost.exe
                                                                                              C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
                                                                                              1⤵
                                                                                                PID:3360
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                1⤵
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                PID:4792
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                1⤵
                                                                                                • Modifies Internet Explorer settings
                                                                                                • Modifies registry class
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                PID:1776
                                                                                              • C:\Windows\system32\AUDIODG.EXE
                                                                                                C:\Windows\system32\AUDIODG.EXE 0x51c 0x510
                                                                                                1⤵
                                                                                                  PID:5088

                                                                                                Network

                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                Reconnaissance

                                                                                                Resource Development

                                                                                                Initial Access

                                                                                                Execution

                                                                                                Command and Scripting Interpreter

                                                                                                1
                                                                                                T1059

                                                                                                PowerShell

                                                                                                1
                                                                                                T1059.001

                                                                                                Persistence

                                                                                                Boot or Logon Autostart Execution

                                                                                                1
                                                                                                T1547

                                                                                                Active Setup

                                                                                                1
                                                                                                T1547.014

                                                                                                Create or Modify System Process

                                                                                                3
                                                                                                T1543

                                                                                                Windows Service

                                                                                                3
                                                                                                T1543.003

                                                                                                Privilege Escalation

                                                                                                Boot or Logon Autostart Execution

                                                                                                1
                                                                                                T1547

                                                                                                Active Setup

                                                                                                1
                                                                                                T1547.014

                                                                                                Create or Modify System Process

                                                                                                3
                                                                                                T1543

                                                                                                Windows Service

                                                                                                3
                                                                                                T1543.003

                                                                                                Defense Evasion

                                                                                                Impair Defenses

                                                                                                3
                                                                                                T1562

                                                                                                Disable or Modify Tools

                                                                                                3
                                                                                                T1562.001

                                                                                                Modify Registry

                                                                                                5
                                                                                                T1112

                                                                                                Credential Access

                                                                                                Discovery

                                                                                                Browser Information Discovery

                                                                                                1
                                                                                                T1217

                                                                                                Peripheral Device Discovery

                                                                                                2
                                                                                                T1120

                                                                                                Query Registry

                                                                                                6
                                                                                                T1012

                                                                                                System Information Discovery

                                                                                                6
                                                                                                T1082

                                                                                                System Location Discovery

                                                                                                1
                                                                                                T1614

                                                                                                System Language Discovery

                                                                                                1
                                                                                                T1614.001

                                                                                                Lateral Movement

                                                                                                Collection

                                                                                                Command and Control

                                                                                                Web Service

                                                                                                1
                                                                                                T1102

                                                                                                Exfiltration

                                                                                                Impact

                                                                                                Replay Monitor

                                                                                                Loading Replay Monitor...

                                                                                                Downloads

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                  Filesize

                                                                                                  3KB

                                                                                                  MD5

                                                                                                  3eb3833f769dd890afc295b977eab4b4

                                                                                                  SHA1

                                                                                                  e857649b037939602c72ad003e5d3698695f436f

                                                                                                  SHA256

                                                                                                  c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485

                                                                                                  SHA512

                                                                                                  c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                  Filesize

                                                                                                  280B

                                                                                                  MD5

                                                                                                  77532bfc14c90e92c2c117f6625e41d1

                                                                                                  SHA1

                                                                                                  7ba952d5e18485d66976547fb8f47b2aaffeab80

                                                                                                  SHA256

                                                                                                  587fe94912145359072577e01c7fe95e0fd4e6972e35f0a6a4d464382d8237f7

                                                                                                  SHA512

                                                                                                  1b1b9ed2c3012cb6371b05681acf995a15feab32f0bc860bd4c441c1a1dcd8bd1a9fc7985fd10c16674ee7423a86c479a241dd5d1c843fb70962504db0eb82a2

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                  Filesize

                                                                                                  7KB

                                                                                                  MD5

                                                                                                  a00c4106b493d8b659473987ebbd95cb

                                                                                                  SHA1

                                                                                                  a9c48f2483bf75cb13fdf497bada3f958b76dced

                                                                                                  SHA256

                                                                                                  49f4bc422c41a08a5b7d9cc2072b7511e2ceeec29274ac383b70b2d62e5c2e60

                                                                                                  SHA512

                                                                                                  bb134402403a461164bcb028ae5d7a857a9a7c8667a751dea46718e6cd432e032433e76927fa981424ee62a5d2140a537b7642c104a6d8c866d59fed7d7fd8f7

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
                                                                                                  Filesize

                                                                                                  151B

                                                                                                  MD5

                                                                                                  1359cb974c4242e6781cbda508ff6539

                                                                                                  SHA1

                                                                                                  b1d48bc3456287eb3b75db548c41fd84d662581e

                                                                                                  SHA256

                                                                                                  6812ba684ca6777303ae1aa2af87dac42c134cbc42c7a0bac57485ceb8672b54

                                                                                                  SHA512

                                                                                                  92b743c80f74bde65b440e00884c8e13991e4105b4b9d5f007f6bb612404bc2690b035b57dc07590cf6a292bae69c3d7dd823a0efd0ed485c7ff91cfc837a7d6

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                  Filesize

                                                                                                  3KB

                                                                                                  MD5

                                                                                                  49721eae64616c8f13455de39cc746a7

                                                                                                  SHA1

                                                                                                  83c1c98b2a6b048082cf7aa9e947d7831d6a78a7

                                                                                                  SHA256

                                                                                                  a59fce8619c611b62a6964747c7ee86d566181d31a7a11963cd835b9f6c435af

                                                                                                  SHA512

                                                                                                  6cd5b6c5d195ecb784620c20da880e7f96eab4a0b8377b51857bf9d63acaaced13a6623b656f3a804f81514ca95f77297b44d8fbd65c15f6ff348e3f1adae150

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57caa3.TMP
                                                                                                  Filesize

                                                                                                  3KB

                                                                                                  MD5

                                                                                                  8cf92f00a3307e28fbcc021bc11ce7f9

                                                                                                  SHA1

                                                                                                  97f4c6b0dd5f328d372d4875ed275ea241703d5d

                                                                                                  SHA256

                                                                                                  983467db9f4e44b81b4a963954e35c041cbdd0ff160814d9df9bcf2158e4a6f7

                                                                                                  SHA512

                                                                                                  ab8641d48b04a766b597fac4d0e019e9c0d9eb92742b27be583d8a76f707efdc8651463aea478affc393589bb8cde5e9dfe8b4130a1ec466677fecce1075ab38

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                  Filesize

                                                                                                  2B

                                                                                                  MD5

                                                                                                  99914b932bd37a50b983c5e7c90ae93b

                                                                                                  SHA1

                                                                                                  bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                                                                                  SHA256

                                                                                                  44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                                                                                  SHA512

                                                                                                  27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                                                                  Filesize

                                                                                                  107KB

                                                                                                  MD5

                                                                                                  40e2018187b61af5be8caf035fb72882

                                                                                                  SHA1

                                                                                                  72a0b7bcb454b6b727bf90da35879b3e9a70621e

                                                                                                  SHA256

                                                                                                  b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

                                                                                                  SHA512

                                                                                                  a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  e5e31388f5baa8494785663066eb5cfd

                                                                                                  SHA1

                                                                                                  ca8ed88bfa513e368461985607669a66e1cae4f4

                                                                                                  SHA256

                                                                                                  9c9357494b8e386cb1958d00c8e3ea41f10d45b935731594fc2b18b73d7326df

                                                                                                  SHA512

                                                                                                  466eb50826755fdc1a5d15f06e9fd2e9be9aedb6e57a82399c3e058e108ccdf2bcc73076c4563a90d127efe52610c73bcc44a56822ad8a5b9319b93e1dd4ad58

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  e6263a33bce418d638695a0323198cdc

                                                                                                  SHA1

                                                                                                  ccdf8929da969c5e61cbdabc51bffeef614f3641

                                                                                                  SHA256

                                                                                                  4f49c24e62783b733e1b32e04d8971b5672b94c3127bd1b326566228cfda7265

                                                                                                  SHA512

                                                                                                  543efb844ebd92c1e4f4716e830a57f7a1c2766146a29b1a16f4bfbddb500a6cb1f34379a23e3a20976c250943261de93d9fe2e685fe645a9b93b7a6d4009ed9

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  96eb55785f892a5875fad3e13000a97a

                                                                                                  SHA1

                                                                                                  1d554bf06d62f7f2314c32a9ad34248c889014ce

                                                                                                  SHA256

                                                                                                  f2df8a4288b693fbf35944a70154804c9adf81f25bd552221238155861e53311

                                                                                                  SHA512

                                                                                                  60b2d1f481cf1f80adb6e86526f3ce2a451555887756d94e70e0e448502d8aa8720eff8448c4f95441ceba75cedb9e6951823df577e75b6996c83bae1c41c078

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  aee63853ff606c3134bb7960628742d5

                                                                                                  SHA1

                                                                                                  c6535fa4454df93ad29181b79a90338cdaa8cbd4

                                                                                                  SHA256

                                                                                                  2915cc88a1f48b466a58f841b0130a353fa3dbb730bdbf664ec0e81bfe6c4c92

                                                                                                  SHA512

                                                                                                  06a60d09cf8b7464ec8a5b2b19fdcd0e89aa66f1898c50a7d3d4e70ca5a83fc1f182b0b39edc3591f3ab30b770c2534c6e4c6231246221a0b12684f88ec96336

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                  Filesize

                                                                                                  2B

                                                                                                  MD5

                                                                                                  d751713988987e9331980363e24189ce

                                                                                                  SHA1

                                                                                                  97d170e1550eee4afc0af065b78cda302a97674c

                                                                                                  SHA256

                                                                                                  4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                                                  SHA512

                                                                                                  b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                  Filesize

                                                                                                  40B

                                                                                                  MD5

                                                                                                  20d4b8fa017a12a108c87f540836e250

                                                                                                  SHA1

                                                                                                  1ac617fac131262b6d3ce1f52f5907e31d5f6f00

                                                                                                  SHA256

                                                                                                  6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

                                                                                                  SHA512

                                                                                                  507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                  Filesize

                                                                                                  16KB

                                                                                                  MD5

                                                                                                  143a1f9b5b9522503e7bf746ed4940cd

                                                                                                  SHA1

                                                                                                  e7421aeca55f5c956703a95a48df08994acbe603

                                                                                                  SHA256

                                                                                                  c42666621ade8d6c1dc33814e0d2ecd5476554d33c8410a786284f2589c5eea2

                                                                                                  SHA512

                                                                                                  1af54508e5dca1cf319cff455f3f66019c981030605c6b944acb753532eccc4a32261d22a8764c08ff9e8325dc3d71e3ef00d1f1b941cbfd5e421cf7f553c080

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                  Filesize

                                                                                                  16KB

                                                                                                  MD5

                                                                                                  9acb9d94205e666ba12343b92e2c04a1

                                                                                                  SHA1

                                                                                                  fdf483a4795318b42bff1a4061406c2d329f81d2

                                                                                                  SHA256

                                                                                                  4739d484ecfd039b78727923d8aaa6b0b215a2f8f2b2ac3369131bbc4516eb2c

                                                                                                  SHA512

                                                                                                  f3f7ed90ac4b7d5b3495264d0f13fcbef1761257f12c0e7c8099ef3599081de1d4a198968c729adb504d7e1cce4aaa5abc03c54a3928103b6cb5288e3ef65af5

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                  Filesize

                                                                                                  36KB

                                                                                                  MD5

                                                                                                  ac16ba3354ced510719f270be4230193

                                                                                                  SHA1

                                                                                                  3d561c17c8983a8866068296acf46ee8648d344e

                                                                                                  SHA256

                                                                                                  445bba0e4949f942fae60c2d1302eda5621b4fa9b490075625db3a63f3716989

                                                                                                  SHA512

                                                                                                  0b8a694d5cc02cfd9400c16a6785fa0d79a9c37f2a69e7f1d0a59536b13bcd589c59c5c94c45602d4ce65359a07ecddca9c307954ab4cdbf038a19f424e3b63c

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5bea1764-b070-4aad-8261-2a922c58cde7\index-dir\the-real-index
                                                                                                  Filesize

                                                                                                  1KB

                                                                                                  MD5

                                                                                                  a4f8b643121e730a08476f15177b28d5

                                                                                                  SHA1

                                                                                                  1a285ede216b6be65de021d0233c92f107537c1b

                                                                                                  SHA256

                                                                                                  8811845c337d41ae7bae9db244f7a68476e6bab39cf05c2208f3d18e75307a7d

                                                                                                  SHA512

                                                                                                  a6c46a9722a4d1a5c7d1c87ae0a62b537da616bbbdd8b9f23ed1a6775f431c7d08e398add1954e926ec8e8d832849739f916b5a5485387be6064b3cab28a28e6

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5bea1764-b070-4aad-8261-2a922c58cde7\index-dir\the-real-index~RFe5c0f59.TMP
                                                                                                  Filesize

                                                                                                  1KB

                                                                                                  MD5

                                                                                                  60cf69fc11b99aa1837f3f3233d50539

                                                                                                  SHA1

                                                                                                  92f783f664cf895e5686f1e243ff5344438a02ed

                                                                                                  SHA256

                                                                                                  840cb48f7e5b32d1e0c9fc31e0ef596878840a0d4268a8cbb601d7b74aa2273d

                                                                                                  SHA512

                                                                                                  c3a9e9091f62a3f951c8fe1ec6405f2e33eebd67763a98f2427f9e28de1f8fdeaf8ecb62becd2a88d0f1aac144dc9a25afbe5ac600683aaa6366246c3b0788a9

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                                  Filesize

                                                                                                  253B

                                                                                                  MD5

                                                                                                  cad8822348ebeb88164d66f35d0d7d62

                                                                                                  SHA1

                                                                                                  1bf13fe08c2ec490380df6f81434325865bc8bba

                                                                                                  SHA256

                                                                                                  3b0ef3209de7c978f3ca56007b0627092b63e0375e6079020ad4fa47a44572da

                                                                                                  SHA512

                                                                                                  353793793b3f0c0f5e8d8b7daf518cb8d4f2e89600ec6eb417c2f91eae3651c8e2cab73f8cae053760e98e5f5756c7e21c38c02063f2df76f24d7d67a9701ae7

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                  Filesize

                                                                                                  21KB

                                                                                                  MD5

                                                                                                  922d0477d76d626fd112ffac4ef2e11c

                                                                                                  SHA1

                                                                                                  897335cc807ae03422bf1a1306e6d4e6bd3ef5f1

                                                                                                  SHA256

                                                                                                  a407bac7b57b9000faa1e703777f2042ab3957507ead2a97ebfaa45ae5e8a735

                                                                                                  SHA512

                                                                                                  e314f72dc763b79babcc5430948a9b9d63dfff2d3107d28f00ddc457f48b82e8e8ea1b97ad5acfba5ccee22c34ccdf6f6cab03126b0f58ebf4e8fe5edab95a09

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
                                                                                                  Filesize

                                                                                                  467B

                                                                                                  MD5

                                                                                                  11519028045245b80e6a716c68d7af48

                                                                                                  SHA1

                                                                                                  a7358bab4d19e14b28d681547a8bdc70c436ab50

                                                                                                  SHA256

                                                                                                  56fb4d2b1d0298043898b5b256abb384fa9578cd8450d4f31e2fbdacb16294a3

                                                                                                  SHA512

                                                                                                  1a6d7fae0a346ad673fa4b30c015c21ab4eabc93c051a80032bb38d6f89dce76da360bba261f2f68cf5c786b4249ff42bf786e7e93cf61233c69ee7d7e60681a

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
                                                                                                  Filesize

                                                                                                  23KB

                                                                                                  MD5

                                                                                                  1675976df4066ea9427839270e70411b

                                                                                                  SHA1

                                                                                                  2817c73ded836648e1ce64e96caf7eeb354b199b

                                                                                                  SHA256

                                                                                                  a68778a149490d4e00cb5e129d279e61eee181ff79d87c67f9cf135a5cd5731f

                                                                                                  SHA512

                                                                                                  24bd5cecf5ace1ad9ca0455f3bf3271bffcaa7fe289a1013eef02188df230f1d8a712f778274230d18a8388eebd1f3626065e9dd47b99e9b87461f684f59f36a

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
                                                                                                  Filesize

                                                                                                  900B

                                                                                                  MD5

                                                                                                  d1d94dd8224c3295f533dd1862e86179

                                                                                                  SHA1

                                                                                                  a8b606dccb4fd7ce455d507f3c74c7ccdcdd26b6

                                                                                                  SHA256

                                                                                                  4ed22696303c1ca0ceff370968f955c8f489e774772fa159708de597a86e4036

                                                                                                  SHA512

                                                                                                  7a620912c603ad2bc4451c48077a818aa33a773bc71b52969bf7276b4f987da0e3698b4a77467bc6c90bccf98648f3444c2463566584a7a61744ae35b736024c

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                                                  Filesize

                                                                                                  19KB

                                                                                                  MD5

                                                                                                  41c1930548d8b99ff1dbb64ba7fecb3d

                                                                                                  SHA1

                                                                                                  d8acfeaf7c74e2b289be37687f886f50c01d4f2f

                                                                                                  SHA256

                                                                                                  16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

                                                                                                  SHA512

                                                                                                  a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                  Filesize

                                                                                                  40KB

                                                                                                  MD5

                                                                                                  14268d6402e2557b16956d92be3e70a1

                                                                                                  SHA1

                                                                                                  8deaf427b80bd3dd02883f22f1f103ab4585acad

                                                                                                  SHA256

                                                                                                  d82b69cc9b78936e1b95f8c3af701e3ac3219518ed457a3c46ba70c0141907b0

                                                                                                  SHA512

                                                                                                  b843e6d84aab779c2f8d4a05cb6e5767f828c08bc288d30585493d10e57fd1c6a6ce7e83ba1eaa39acdaaf21eddba9f76e293b68cfbb2d692a626777294723d7

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                  Filesize

                                                                                                  40KB

                                                                                                  MD5

                                                                                                  3012f83d1fddb4cad4cee1b113d7cf77

                                                                                                  SHA1

                                                                                                  363cf02be4c064bb5a661124d374eeebdc5f9963

                                                                                                  SHA256

                                                                                                  f529deecdb4cbdf88e8e93c2b05734b375bbd2cb50402aeeb015a5c6b2b7e39c

                                                                                                  SHA512

                                                                                                  5ffe3ba9555b5b2004be3b91ea3c98681fc28d81646fe79fda685a041746e77eccac7754e4147c48353374c5395fba3884035b967c957cd26806a12e780c5227

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                  Filesize

                                                                                                  49KB

                                                                                                  MD5

                                                                                                  714070da185aead96d9706b8f1f2de9c

                                                                                                  SHA1

                                                                                                  a90e7fd3c2b6cb4e0fdaed008569f5671dab950a

                                                                                                  SHA256

                                                                                                  709488e3431e1ed6f8c015ed58364aabef00595c7ff347435b4334a55f0cbe03

                                                                                                  SHA512

                                                                                                  f3bd3c5c9ef5494de3853315f7dd96843e11797c0462673c4b784d1c8cf9220789f5249d83d85d7e7691c8836f9177f1192a867d7adc15feabd7c3dcd3df5d8e

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                  Filesize

                                                                                                  54KB

                                                                                                  MD5

                                                                                                  11a8c378bd57d608aee86a734052c5b2

                                                                                                  SHA1

                                                                                                  e5fed713c084ea396eb878dd69cf887c159e7f77

                                                                                                  SHA256

                                                                                                  6c06cecf7cc97feb03caeac2960cc6ea0154abcbd14b0a2e4f83d0b17f6f7af1

                                                                                                  SHA512

                                                                                                  4bc636b51b2d3e093579530ddcbb7fc72aa764c9328649bdb4abc81b92ceda508ee8874376d244e4340274ecba682ffdb003e8a91c6b331c6564c3c38a8c8aa4

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                  Filesize

                                                                                                  54KB

                                                                                                  MD5

                                                                                                  4c775ac9871b4964f5e4618a1563dba8

                                                                                                  SHA1

                                                                                                  ef9650e540e66f2f36b575249f2993c80f586400

                                                                                                  SHA256

                                                                                                  d08ea84d1459365d242c3972ec717fac1c87bd397c2cb8d5a49782d1542104bd

                                                                                                  SHA512

                                                                                                  9bb32a1ce38c79599bb26d820e9cb58cbce9960d3d06a8e8442fa91a36babea72db62f37b32c9d0ffbfcfa250187ddde2d55e57c517f11b30583ba1f85412312

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                  Filesize

                                                                                                  54KB

                                                                                                  MD5

                                                                                                  d0074d2bfa2d5d065faee1305047ed00

                                                                                                  SHA1

                                                                                                  b69c5cf53adca51a059933315ba1ab078cd7ba17

                                                                                                  SHA256

                                                                                                  3aa0c2a719bf210df5d7c23f9bd833644cf3b261e2b18e31e3f1600c52760f90

                                                                                                  SHA512

                                                                                                  3149a79ad9792d85252f17aa1c5921deface196d344aaafc260358aff73c0d984392785d02e02c30ce5687cb65ce7b48f8ba58492baa192b3172eb81792e6543

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll
                                                                                                  Filesize

                                                                                                  572KB

                                                                                                  MD5

                                                                                                  f5f5b37fd514776f455864502c852773

                                                                                                  SHA1

                                                                                                  8d5ed434173fd77feb33cb6cb0fad5e2388d97c6

                                                                                                  SHA256

                                                                                                  2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e

                                                                                                  SHA512

                                                                                                  b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  24dacfaef3a4487ed384ed00dd6e6854

                                                                                                  SHA1

                                                                                                  6051568c5d329ad77b23540dbdaddde5d4ea643e

                                                                                                  SHA256

                                                                                                  e981124466302bca7dd932b7b675e245caf4c37801f3532ddbaa950ce85dacad

                                                                                                  SHA512

                                                                                                  3b698e914618fecc120967d8a87041c6aa981f5b21148a0dc4151a98b8ceca8bca1409e6434c364fcabe3a55a02c9717bef719938f58d67e49b6daccdb8d5cd9

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
                                                                                                  Filesize

                                                                                                  414KB

                                                                                                  MD5

                                                                                                  ab79489e9704fc9cc9d8bee4f8e17ec5

                                                                                                  SHA1

                                                                                                  b2e19a89b43d537bb5b02ee9ca2418f027259c1e

                                                                                                  SHA256

                                                                                                  4d71760d6f3159849068b635ab4c39b9b747d899f03670533971a62d262c264e

                                                                                                  SHA512

                                                                                                  60d11ee023b9a045c4b59b88311f001fcf4856e27837a1ffd6ecab0203e5199ee077d85c5217e0f0b94e0bff93b14c3680816b6fbf9d42ee2eff5c23d9a13edd

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                  Filesize

                                                                                                  1KB

                                                                                                  MD5

                                                                                                  033fa167a281907d81edc9d8eb54528c

                                                                                                  SHA1

                                                                                                  08adb6e56ec9c16c9e7e5e3cf487ed5987dcbfbf

                                                                                                  SHA256

                                                                                                  75bcc679c844cd2b02d5a37370781f6d4833e95a18f2bed6fe5b37fa45274daf

                                                                                                  SHA512

                                                                                                  20fb36f1ba5a696b5002406152ed76e5125117150a1f96c11acb2f871e4b9d307fd5ad06f7b1536ab6dcda59dde26c1158db49a134afb47863c8f70b40381a91

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                  Filesize

                                                                                                  1KB

                                                                                                  MD5

                                                                                                  04125e02fa61aa2028aeb0bf925d52ed

                                                                                                  SHA1

                                                                                                  057d20ab46e8ede994146c0c4a417b5b7cb23e78

                                                                                                  SHA256

                                                                                                  a24b1b5c5c58eecc96f483374b9ae82dc4502432a737a4e7296479f4e9c78c77

                                                                                                  SHA512

                                                                                                  6e414dceb441fe28525beeece7c07e5c9bea93a2a48fd35b2470fb68f60b3c41f6782a1b23eac213569c8f1b85a4f06973efbc9e9afd24a7f6f01f7c45894c4f

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                  Filesize

                                                                                                  1KB

                                                                                                  MD5

                                                                                                  13f55b2447ddbc8ec955afbd86e015bd

                                                                                                  SHA1

                                                                                                  82aaf622833f05da358c67a4f85b3a0b49c10231

                                                                                                  SHA256

                                                                                                  b46d32fc157c5c17af8d321be0bb0f3c18ff0b77b472e5303d973910ea461885

                                                                                                  SHA512

                                                                                                  dbbe3c9b6ba8d0641b4010bad3c4798f5d3031914aa1512a944eeeec4a40f1bfb3c9e1db62bef549fced18047831d3c1bfabf4fe89de715110dea0e80b7cb4f7

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                  Filesize

                                                                                                  1KB

                                                                                                  MD5

                                                                                                  5f024510235e152723eaee195f6cb2e0

                                                                                                  SHA1

                                                                                                  eb5b5990eefaa5eadc3fabe8a710a4f5b32b5dba

                                                                                                  SHA256

                                                                                                  1ab8a9c0775934fbfaeeafda1218f23b815b8486fdbf16a710c5f57986b74e23

                                                                                                  SHA512

                                                                                                  b4ccfbf17639ac1e903564d801a87af495914a2a7193f7d63a518783c8cd9388312b41e75674031474fc5533608a00701b98dfd370e2b9fa1c9df2ffc3dfa3d1

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133875973565954903.txt
                                                                                                  Filesize

                                                                                                  83KB

                                                                                                  MD5

                                                                                                  5ce98e1ec95a144ada7b1db220f852ff

                                                                                                  SHA1

                                                                                                  f269d43fbf95c1b75b4fc2ad1d828ef468bcef54

                                                                                                  SHA256

                                                                                                  b5ed3d4af30b9a8cd75c68aaa384bcef662cfd90d2981ed6065e1dcf3a8dba9b

                                                                                                  SHA512

                                                                                                  cd787d2653c4fc17a55c97454296230720c89bbaffa28d8de1368092d2cf712bd4730e064cf0f9957844e97a6d77ff43ffb34d5d6a5e8662f419ce537efe4a83

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3aiq4qq2.tkn.ps1
                                                                                                  Filesize

                                                                                                  60B

                                                                                                  MD5

                                                                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                                                                  SHA1

                                                                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                  SHA256

                                                                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                  SHA512

                                                                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\Downloads\XClient.exe.crdownload
                                                                                                  Filesize

                                                                                                  74KB

                                                                                                  MD5

                                                                                                  3fdc48e85492283d2d3722c2367af5c1

                                                                                                  SHA1

                                                                                                  a624133264fb10b9098a6f265bf50e6c2dfd616d

                                                                                                  SHA256

                                                                                                  80940961e6f0debe4c47818cbb05327c8d4ed8c68392901b1829f3440c612b98

                                                                                                  SHA512

                                                                                                  a4f9b95c202f7de41142d3a2bb19d187a310c6c819c7181459c5c5db6056f50c4c9c7366b16e8d307b2d64b86979333a79ad7b423f797cf4c18f0e01205a213f

                                                                                                  Download Submit

                                                                                                • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3788_1370865886\LICENSE
                                                                                                  Filesize

                                                                                                  1KB

                                                                                                  MD5

                                                                                                  ee002cb9e51bb8dfa89640a406a1090a

                                                                                                  SHA1

                                                                                                  49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

                                                                                                  SHA256

                                                                                                  3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

                                                                                                  SHA512

                                                                                                  d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

                                                                                                  Download Submit

                                                                                                • memory/1760-260-0x000001E1AF840000-0x000001E1AF862000-memory.dmp

                                                                                                  Filesize

                                                                                                  136KB

                                                                                                  Download

                                                                                                • memory/1776-764-0x0000026598990000-0x00000265989B0000-memory.dmp

                                                                                                  Filesize

                                                                                                  128KB

                                                                                                  Download

                                                                                                • memory/1776-765-0x0000026599310000-0x0000026599330000-memory.dmp

                                                                                                  Filesize

                                                                                                  128KB

                                                                                                  Download

                                                                                                • memory/1776-838-0x00000265AC370000-0x00000265AC470000-memory.dmp

                                                                                                  Filesize

                                                                                                  1024KB

                                                                                                  Download

                                                                                                • memory/1776-780-0x00000265AC7A0000-0x00000265AC8A0000-memory.dmp

                                                                                                  Filesize

                                                                                                  1024KB

                                                                                                  Download

                                                                                                • memory/1776-766-0x00000265989B0000-0x00000265989D0000-memory.dmp

                                                                                                  Filesize

                                                                                                  128KB

                                                                                                  Download

                                                                                                • memory/1776-733-0x0000025D96D00000-0x0000025D96E00000-memory.dmp

                                                                                                  Filesize

                                                                                                  1024KB

                                                                                                  Download

                                                                                                • memory/1776-734-0x0000025D96D00000-0x0000025D96E00000-memory.dmp

                                                                                                  Filesize

                                                                                                  1024KB

                                                                                                  Download

                                                                                                • memory/1884-509-0x000000001DB10000-0x000000001E038000-memory.dmp

                                                                                                  Filesize

                                                                                                  5.2MB

                                                                                                  Download

                                                                                                • memory/1884-501-0x000000001BB40000-0x000000001BB4C000-memory.dmp

                                                                                                  Filesize

                                                                                                  48KB

                                                                                                  Download

                                                                                                • memory/1884-229-0x0000000000980000-0x0000000000998000-memory.dmp

                                                                                                  Filesize

                                                                                                  96KB

                                                                                                  Download

                                                                                                • memory/1884-715-0x000000001BC50000-0x000000001BC5A000-memory.dmp

                                                                                                  Filesize

                                                                                                  40KB

                                                                                                  Download

                                                                                                • memory/1884-519-0x000000001BC60000-0x000000001BC6E000-memory.dmp

                                                                                                  Filesize

                                                                                                  56KB

                                                                                                  Download

                                                                                                • memory/1884-306-0x0000000001300000-0x000000000130C000-memory.dmp

                                                                                                  Filesize

                                                                                                  48KB

                                                                                                  Download

                                                                                                • memory/1884-882-0x000000001D1E0000-0x000000001D1EC000-memory.dmp

                                                                                                  Filesize

                                                                                                  48KB

                                                                                                  Download

                                                                                                • memory/4436-732-0x0000000002F30000-0x0000000002F31000-memory.dmp

                                                                                                  Filesize

                                                                                                  4KB

                                                                                                  Download