nanocore | hxxps:// gofile[.]io/d/rEFk2r

Analysis

max time kernel
94s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2025, 02:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https:// gofile.io/d/rEFk2r

Score

10^/10

nanocore defense_evasion discovery keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

malo2100.ddns.net:1212

127.0.0.1:1212

Mutex

1fd26080-49b2-4f4b-9e38-e91b26b71ffc

Attributes

activate_away_mode
true
backup_connection_host
127.0.0.1
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2025-01-14T14:20:02.758793036Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
1212
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
1fd26080-49b2-4f4b-9e38-e91b26b71ffc
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
malo2100.ddns.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Nanocore family
nanocore

Executes dropped EXE 1 IoCs

pid	Process
6072	xworm v5.3.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IMAP Service = "C:\\Program Files (x86)\\IMAP Service\\imapsvc.exe"	xworm v5.3.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	xworm v5.3.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
96	api.gofile.io
97	api.gofile.io
100	api.gofile.io

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\IMAP Service\imapsvc.exe	xworm v5.3.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping692_1233391206\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping692_1233391206\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping692_1233391206\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping692_329255792\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping692_329255792\manifest.fingerprint	msedge.exe
File created	C:\Program Files (x86)\IMAP Service\imapsvc.exe	xworm v5.3.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xworm v5.3.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133882926941551282"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3218366390-1258052702-4267193707-1000\{2E4D319D-4AC5-45B6-A6CC-6AD81E6D41A9}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
6072	xworm v5.3.exe
6072	xworm v5.3.exe
6072	xworm v5.3.exe
6072	xworm v5.3.exe
6072	xworm v5.3.exe
6072	xworm v5.3.exe
6072	xworm v5.3.exe
6072	xworm v5.3.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6072	xworm v5.3.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeRestorePrivilege	2632	7zG.exe
Token: 35	2632	7zG.exe
Token: SeSecurityPrivilege	2632	7zG.exe
Token: SeSecurityPrivilege	2632	7zG.exe
Token: SeDebugPrivilege	6072	xworm v5.3.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
2632	7zG.exe
692	msedge.exe
692	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 692 wrote to memory of 5108	692	msedge.exe	86
PID 692 wrote to memory of 5108	692	msedge.exe	86
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 3148	692	msedge.exe	87
PID 692 wrote to memory of 3148	692	msedge.exe	87
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 2768	692	msedge.exe	88
PID 692 wrote to memory of 3604	692	msedge.exe	89
PID 692 wrote to memory of 3604	692	msedge.exe	89
PID 692 wrote to memory of 3604	692	msedge.exe	89
PID 692 wrote to memory of 3604	692	msedge.exe	89
PID 692 wrote to memory of 3604	692	msedge.exe	89
PID 692 wrote to memory of 3604	692	msedge.exe	89
PID 692 wrote to memory of 3604	692	msedge.exe	89
PID 692 wrote to memory of 3604	692	msedge.exe	89
PID 692 wrote to memory of 3604	692	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https:// gofile.io/d/rEFk2r
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x258,0x7fffb0c5f208,0x7fffb0c5f214,0x7fffb0c5f220
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1876,i,15419876586675596917,6946226472806852559,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:3
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2168,i,15419876586675596917,6946226472806852559,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2352,i,15419876586675596917,6946226472806852559,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:8
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3512,i,15419876586675596917,6946226472806852559,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3528,i,15419876586675596917,6946226472806852559,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4176,i,15419876586675596917,6946226472806852559,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4224,i,15419876586675596917,6946226472806852559,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=3552,i,15419876586675596917,6946226472806852559,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5368,i,15419876586675596917,6946226472806852559,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:8
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5520,i,15419876586675596917,6946226472806852559,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=5572,i,15419876586675596917,6946226472806852559,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3684,i,15419876586675596917,6946226472806852559,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5136,i,15419876586675596917,6946226472806852559,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6464,i,15419876586675596917,6946226472806852559,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:8
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6464,i,15419876586675596917,6946226472806852559,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5172,i,15419876586675596917,6946226472806852559,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6624,i,15419876586675596917,6946226472806852559,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4976,i,15419876586675596917,6946226472806852559,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:8
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3556,i,15419876586675596917,6946226472806852559,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:8
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5312,i,15419876586675596917,6946226472806852559,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5472,i,15419876586675596917,6946226472806852559,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:8
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4744,i,15419876586675596917,6946226472806852559,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5540,i,15419876586675596917,6946226472806852559,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=5588,i,15419876586675596917,6946226472806852559,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=5752,i,15419876586675596917,6946226472806852559,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=5808,i,15419876586675596917,6946226472806852559,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --field-trial-handle=6744,i,15419876586675596917,6946226472806852559,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --field-trial-handle=3500,i,15419876586675596917,6946226472806852559,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6720,i,15419876586675596917,6946226472806852559,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --field-trial-handle=5664,i,15419876586675596917,6946226472806852559,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2428,i,15419876586675596917,6946226472806852559,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:8
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5464,i,15419876586675596917,6946226472806852559,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6828,i,15419876586675596917,6946226472806852559,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5108,i,15419876586675596917,6946226472806852559,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --field-trial-handle=5688,i,15419876586675596917,6946226472806852559,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5960,i,15419876586675596917,6946226472806852559,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --field-trial-handle=6784,i,15419876586675596917,6946226472806852559,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --field-trial-handle=6092,i,15419876586675596917,6946226472806852559,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --field-trial-handle=7012,i,15419876586675596917,6946226472806852559,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:1
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --field-trial-handle=7116,i,15419876586675596917,6946226472806852559,262144 --variations-seed-version --mojo-platform-channel-handle=7384 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7652,i,15419876586675596917,6946226472806852559,262144 --variations-seed-version --mojo-platform-channel-handle=7476 /prefetch:8
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7396,i,15419876586675596917,6946226472806852559,262144 --variations-seed-version --mojo-platform-channel-handle=7704 /prefetch:8
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=756,i,15419876586675596917,6946226472806852559,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --field-trial-handle=4004,i,15419876586675596917,6946226472806852559,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:3064

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:224

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:448

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\xworm v5.3 cracked\" -spe -an -ai#7zMap20664:98:7zEvent28676
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2632

C:\Users\Admin\Downloads\xworm v5.3 cracked\xworm v5.3.exe
"C:\Users\Admin\Downloads\xworm v5.3 cracked\xworm v5.3.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:6072

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Program Files (x86)\IMAP Service\imapsvc.exe
1⤵
PID:5140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping692_329255792\manifest.json

Filesize
43B

MD5
af3a9104ca46f35bb5f6123d89c25966

SHA1
1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8

SHA256
81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea

SHA512
6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\508cc8e5-3a1f-46fe-9330-7d1ccb2dc0d4.tmp

Filesize
6KB

MD5
e69945e406f500f1f4cdbf20b0b7c740

SHA1
75e7338c201986083c4ca5d55bda98e9e596758b

SHA256
7269705e13ca683964f4a1fb4a883bbb0adea9557ddb18c721b7faf36b843d88

SHA512
6b127b9f551b150db8a1d53bc9b536e0a08ddec4f19df947410b14ba2831057db0b8c627d8d985b18c6148661112b6443d778653cad2adee57b3bfbe6699ac9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\982149b2-2cff-4c24-a4ec-ef3f9fa51b0b.tmp

Filesize
39KB

MD5
33b2f3d6ceca9c1efe99dfa46c33e01b

SHA1
a131c94edefa39c74607a2d15701d3ade4a57f49

SHA256
0c50d8e2fae9340a405896054889a901b59f09c44590c830a10937a8e21b5367

SHA512
5d62acc289b70daaafe198f2bcea07f40785baf7d01813f7cb528710c86d1c353c6844e00318d7f972bb3564e2b739f82ad620bc01456cd2a3741d2342e43b50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
4013ebc7b496bf70ecf9f6824832d4ae

SHA1
cfdcdac5d8c939976c11525cf5e79c6a491c272a

SHA256
fb1a67bdc2761f1f9e72bbc41b6fc0bf89c068205ffd0689e4f7e2c34264b22a

SHA512
96822252f121fb358aa43d490bb5f5ce3a81c65c8de773c170f1d0e91da1e6beb83cb1fb9d4d656230344cd31c3dca51a6c421fda8e55598c364092232e0ad22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
fed4ab68611c6ce720965bcb5dfbf546

SHA1
af33fc71721625645993be6fcba5c5852e210864

SHA256
c41acdf5d0a01d5e9720ef9f6d503099950791b6f975ba698ccd013c4defa8c4

SHA512
f9ab23b3b4052f7fda6c9a3e8cd68056f21da5d0fcf28061331900cac6f31ef081705804d9a9d4103ee7d9c9bdb6aa4237987b7e821d2d96cd52da24219e55ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\25686d94-0e4b-4ef9-b6c0-683ba284b955.tmp

Filesize
69KB

MD5
164a788f50529fc93a6077e50675c617

SHA1
c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

SHA256
b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

SHA512
ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000072

Filesize
153KB

MD5
65ccbd69a1861e389c90bc8b2a796cb9

SHA1
49d653d24ed895122a60f7e1d06d143cdee8b1f2

SHA256
4f58bf398a86f5c91666acc4cd42e44ef520196e99a158db545b425fd27934a5

SHA512
db6ba940c673edf3c0adde8d36f47dc0bb09f4100a98c2c2823de6cc969872a973e624916d330d0469cdf82c0aaf8dfc645e927fdce5380656038574415f7eaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
5c9da104e636b347ce866d18b89950b2

SHA1
04056fe8f0741c357e423dbcc9a1420b5808c03d

SHA256
40945d2b4c6ceb004e8006a56d89a91d7280e4d96a11d3ec9dc51d4f1324fab3

SHA512
2a08e6d9528acf27ecad9d0335098489ffbc49769921ca72c6ff507b4a1e01b553e4bbcfa939c09ebc936357fd22320a9d08aeb9b0992509691b23b3e75ae8c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
1f541f31050407d137fd51e99b50b229

SHA1
1e12d9b7746a2349b009e7cab82f3d24a6930ac5

SHA256
7a40873bf922a2dfdeb9c551c17ede78e9c1da6bfe4c0a12477f5b9d9a67c847

SHA512
e9478eb8d2b7e758c3171d24e81fa22bc250e69af79ededcc399b639e9e1cfd2429c1dc9c4348f948675acb25be985b405100940f48b2b3bcc36a1405fcc7662

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe580a4c.TMP

Filesize
3KB

MD5
31b0e278d13d1d1917d8db1b723e9a9a

SHA1
80b53c2272de340aaa8d48d860668c7664ddae56

SHA256
23560c288485df9fa8f1cf296cd47f2cbf21d785fb7aeec7417612732ec3effb

SHA512
06bbb4f106ca674e7aeffe349b346bd9b7e8d9bd166a44ce48eac8104610dfa0d2706d7fde4c04fff553fa668ef695b42c55539daed63461fb433e6bf8929fae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js

Filesize
9KB

MD5
3d20584f7f6c8eac79e17cca4207fb79

SHA1
3c16dcc27ae52431c8cdd92fbaab0341524d3092

SHA256
0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643

SHA512
315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
6KB

MD5
5ae0c0748d2a77631cbdd8de4c25cbb3

SHA1
2b7613464085edf7ec280c618edfb343e66c32de

SHA256
1d1b72ebff3a9e695795825eb1518351ab1f0363662488b23e07555b8910fe14

SHA512
9d9cb3953b268cd22bd0a311a931c84cdb1f5d48a5704d7f44e63628d5673772cc3e7ea7d120a4ef94a67fa150818ec02c68defedc1272281f12fc915c8a51af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
211B

MD5
d6a605288017a58fe9068559d9e4140e

SHA1
00ab0e7cfad21a9a48aecea641e68e6d92db9b42

SHA256
47722dc5fe55826544866177d9cadef6201fd82b422f1af90c106c0caf7a8300

SHA512
4dd61f9c9eb08ca0aa53431507d7d28ca09f31a887d8a2855e5faa4d209c97e0f95b99b6654c02ab57985bfba32e13da50c49b2fc2d0d0491d52d88c42a0fd66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe5891ea.TMP

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
715a471f26fb45d9e1d7572c9e6b90d1

SHA1
e8a48ad1703aa12c725fc432fb05a153780d3927

SHA256
e3b8953e173aa3e5aa59079238b9e0fa06a0b1843d4b93fd521253ea46dc9736

SHA512
5ffb9200e5d3c36a6fbe520f0c4bd0d2741267cdaca94a8f8f6e13dbbcb8bb04e80270a3423194e25c73c9282726f69e0c6df03f167ac9a47c41b6052acc3e3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
e6ebd84d39f1a159888f4a3a21a927c0

SHA1
2b730d1751203f36732754773a4e19da70d534f7

SHA256
3d97e0563822c278d71e865067b88001b403bddaa13bbeb97932c24f6b432646

SHA512
4169676f3b8ea55943371ef4665b45aa53d0c4144b5491de547ed9c39ba4dfcdb1c4a582eb42b10299f723e8380ebfd3d50a46455fd5e34922437e419a258034

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
edff661545ce2336f564976551b362bd

SHA1
56402b8e561a5ce5e6164c08b883a90791c43777

SHA256
f6c8c6fbe35a664a44e1f50bc77a9af9ff49349abee71ca5a0bc53ea6ed0c0ab

SHA512
c541d0a3c9c2ea0fe4b2044ee83fb84b100f1729c4d386e21b42beaf580b3d02766c547e85b004b16632f632f08ca393038a47c87374d44d3f1ea7486515ac35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
ae6ce48a22ac66c9a61c0c902343b7a1

SHA1
91854b9a5e456bcddcb9d1896c9bbadd9526966a

SHA256
b3267319eb30aa6fff62dec4f7191b7db81899d4387ccdeb5dd47580342d921f

SHA512
bb413d447f5a24b7285938c69d836b77b04615caff3470ff1fac4b1e8e306171b096632e24b723a8b1b790ea09e1f010f4f0b065f88aa2945ed7de2a873e6872

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bb9a4039-5fee-44f8-a618-d20a135c468d\index-dir\the-real-index

Filesize
2KB

MD5
403cbdc66f5eed129e1268561ed2b4d8

SHA1
127b835c6a8a673a09e30995a48e179833c8b1fc

SHA256
4e791f279f91ba28218ad7cc45cfff5948eddb759059c9f9a2eb624cf6992e38

SHA512
45d75871fb4c184c831565cfbb68fe1b9b01b21c1d11bf6908229139b262463a584b425d311bad5cbab0bcb9874290685b2a7c66368afe3b9815313b96cb08c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bb9a4039-5fee-44f8-a618-d20a135c468d\index-dir\the-real-index

Filesize
864B

MD5
52f8ed1feb966e88b4d82d050f32c0eb

SHA1
50e5fa656e79d6c2bedf1f5c2681f2f430068103

SHA256
9074c0a5a2b86db7a9baa0caaff04031556144dc24df6b59d66967c6d444d6a1

SHA512
71aa55b0eda12514dd189b7e596a8106ccdf1204a69ba91b899c002345d329b8d7c93a6d91ba92fde797dd38cf7b4f5b5bea2f49a98a21b08625d397625cc75d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bb9a4039-5fee-44f8-a618-d20a135c468d\index-dir\the-real-index~RFe584011.TMP

Filesize
864B

MD5
7208e5d07e71699e237ae4834194eacc

SHA1
77b73e5a7b3fc4e060994ea5ec25bfdedf9e2b4e

SHA256
c6582ec9830a1314a249ed3a500ed3c9a92ba690fbb10dfaf80747c71813f056

SHA512
f76dda5dc53d995bb977ccac6da9ccff1c86a0b10d38d54cf55b479931dbac148569219fe0a2e9265393d0925e074a012503caa81c0d003909edb11eabe05692

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d5806065-9d71-425f-b355-a8f00337e4d3\index-dir\the-real-index

Filesize
72B

MD5
47f2ee5aef79d38c9ad99f0d95803681

SHA1
93f1ab63cf27ed87ee3f3ac2d3c7e8a86ba88956

SHA256
a845dd6c86466ebbee8757d5f3ac8cabc460fd131e73eb2a9fb2fac59f107c65

SHA512
efd5b26c699dca5eb747e9277f1f700e88f7f050fb200370217ea959f9fea650bfee47bc31ffe163e65be45fe77d2df909f5dd3738217493cff5aded7b0de4f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d5806065-9d71-425f-b355-a8f00337e4d3\index-dir\the-real-index

Filesize
72B

MD5
e29a24b20f1601b1e2177a33461ca2e3

SHA1
ab97b1e4be0845940415a8cc7c73399f3d6d8978

SHA256
72f2d8b8cd4613893f3000561d925135b188b72e82d4dcf02ef62ae9964735d7

SHA512
69ae6a3b8276e04627391ec6a4c4d831cab6c2aeb83b6b0742a09f46264f11875766c732c4dc503b9ec983a4ca8d9cbc1c2897517842e36566b5e46b88dd0bfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
327B

MD5
9688fbadc3978a327407db47e935ed5d

SHA1
ba5c34febd34a79c03f34c75435fd681bd5e4107

SHA256
3c1917dac708b1cd2691f27f2f1d0b23477c54b823b6399ef05f3b194414606f

SHA512
24e6c81dd994e8854c91efebde0bc8f2a91cba7a7a548841b0eb57b9a0ecc8dd45319d7780a707a8f3a78b5802d9d372cc06cc5bdb3c8416158b3560ea7b7a44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
253B

MD5
f960402b1605f4aa34ab3d481caa7edd

SHA1
4f009c60f6e85b60bf06006fe0859814a34805b9

SHA256
b38c75e1dccfa70072e1244e0a753490e54a04de2612928ab222e0bb4763b43d

SHA512
b431c8f3a488e80cb616df831bc545b9d2c14e2f651cf2f92ae6136a865a62c94411d2fc833bc60a630fd1f9f2adb0d15d43fd6df3f1c885c829c62f3451094d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
6243b81e7a3e468b730d6f462cf7b14f

SHA1
38c3c9a2cb19bf1728c4096ae3b93473375ae30a

SHA256
d6db4aa978b3d6e1991d7348094ffddae9709b75f57c93cdd79ef3dd21eea024

SHA512
e7e130cfbdc225fa3768b1192d522156efdf14ea54e40ca3db74ea1bbd470e98886b9e35e953531ecaf93817edcf6c598ad46002aae22e78b613de4569bd7b27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5896ec.TMP

Filesize
48B

MD5
8858cb2322efb044bf88d56ed94f5353

SHA1
18e20889a7fc3dcd158cdfee0bdada430a7f032d

SHA256
0accf324e08745829c507f61d736a4bec209a72fd29b9787423c1d63e3d55008

SHA512
0ff5b5bfb6476ebdcc3b8ee851cc3a42b97c1ffbc8b639ad36e4b62170d3acbd6d14eeb4bc9dcc799af445bc1b1f583be01e0e851b0037715f0912ec50acb287

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
4KB

MD5
475605e14593557995d79e801103d4da

SHA1
ff7aa9651bfa9e754d48eda3a90872c8a4375c07

SHA256
1d70b17773972b148fa9d3b1e76465587b7f670d94c2780288c181562fa2a2d8

SHA512
710756ed4add76a76e2f7f6dbddb144ecfba83762df216bdae903336b5a2c11c7cdf387a674c365f6300887b3e182577a44424daa294a3e74280864ff9b817d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
872B

MD5
0fd8e65fc331546f24002db8987ebd59

SHA1
ee67116051ff6c0f9202881a116c84f4f7e0d500

SHA256
3ecbbe856a4bc9e831063a753485fce61654182cfcf69e181b82382a50f4ece9

SHA512
2a309ba2da7ab3b0287e1403fc3aa69239c5bff8b13eea9d33bb2f54fc0e60b8a9a09e8c5d478d456ab00f422a64967832479635334e4cd456be3d6fd1801d6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
84b5a2a379dcdcdf1022762c23c571a3

SHA1
05ca0ae5419be275b37bc8447ab7b247a77c45d4

SHA256
bd21a6d7eacf81ffff68ab2133d70a178753d67b2c49828794a3b6f7e68dedd1

SHA512
fb3fef8162e361788f8783a4fdf099476f590988362e25339d1a6f8770c2d72a4f00911fad55c3fad7765d4f8985a4a2add9e206896c28c7e4c851a231f3945e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog~RFe58753b.TMP

Filesize
465B

MD5
83f18872d5a903835f2b255c13e9970f

SHA1
f2f8bf171e709e0031739aff53c4d26beddc29b7

SHA256
fa693bc58e40d2b39f7b57576d9803d5d2dc54b91b86543717674cfdc2a9fbc9

SHA512
32e44a70170fd0e8d119c8450fa73f75e2b781e896473364b9200d7474df4812091d82b40185abe3ad57989efbef74d236caceb3ea2fc7f7d59d5871f2df2764

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
7d43c0cae52f794b7680299d73249c68

SHA1
efc7137f27780d8d1eb9d675ff31a27f41b6fe7d

SHA256
b6277f61d1d80c19505d9ffb7ca7016159aab2037d265e89552320f553a5c7f4

SHA512
5191515b31d2490103a072747cde3acbfb81b75596d069f393865108531f1d21b9773c1b816aa46fdb5353802932cea39ecbdb653aeae81d6a288ce03b3c461d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
30KB

MD5
491a852cef6772bc3383ae2e0cafb764

SHA1
2df077e9c97cae1212a7abd97b8416741dfb31c8

SHA256
ab695dbaa223175d4ae6aa100efe9800aaf74ba6df73aca6c0dfa9966e76beb3

SHA512
0788565648b5f8979a585f84ef4095189e24a369da097ff58652cd58656697d77547072871ad03dd6470db49f352c120a63cf1fbe156946c69700279c6f46bb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
30KB

MD5
d8ecc29392f006fb77ba588f278ec913

SHA1
c263aa3028bd95351ecc91a210a6848db4c85e5a

SHA256
7f6bf1ad5fbad0ea7d013efb76dbec5cc93756a0ae7dd16c5298ba4e5a4f401e

SHA512
dd594bf3db16a0f2deb83315756652509a5ce5952be18021fa7c53675c4a75affa3d9c07b067a2df9827d8c8de0e99dbe5ff3f7d97be672fac4767adbda419dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
30KB

MD5
ee8c44c24c59c9b260bc7a1737db5bec

SHA1
ac435bf21e8271f110161827bee7d85733830e6c

SHA256
0be5a6ace4e767b11497ff8bf291cc261a1df6d985071008df7f4adca3c31458

SHA512
b3fecbb1604b9ac32d9910c4246496b09e9135ab9449eadac9a4b1ee0cc45e1438a59b27ffbabaea475d35b8f05c67cbc2671551215d80c906b9c4f56d9c9179

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
7KB

MD5
55424ccd468d2b8c2bee4e641428bc2b

SHA1
4b6942581f593492e3a06e1a1056afe3b21daa9a

SHA256
97256360052031977e7323946aada06a0e870f1121c7556592a075b55445f661

SHA512
67a5016e712773ca80f8559135fd326d2d6ced0d2e27d90033909f734d6af1c75320702992216d0c87c11a0db07b99f44a71ca4d6bf4b1975c9201aad0390848

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
dfc4a8b14d0a248261db3c2559849575

SHA1
943c0f963a808618a6d90d3b04f53ded3d0b52cd

SHA256
1a5a507787f7795374dba37f1018b20f7f21bf14c492e717d333da6d00e005bd

SHA512
6486476a452d5af83e96b4fcbeee1a3bf8974364b3a799f6133f3422bb7313475a3caffebe80201aa84ee1ab46fcfea0a34ef1870f146dd45843e2cb3a5b95be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe586387.TMP

Filesize
392B

MD5
5b4d1b48a82e24ee033b8b715bac8479

SHA1
5f0678d8d46da75571f176433feed8e5ce63a5f9

SHA256
c1705a86c3c98df18a0b8f6623d6821bb3ca8b9eb4ca608ec267c3ea6adc7f8e

SHA512
cb7c2029d00f6297339b54d55eae060ad700e7ce42ad4bb8ef5942cbeed6a226bf7d2484a0bcf2f73cc26a63db30e0e4965c09c4ec4db8c6f303a40440984994

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
6e8f687bdc1a2f37808d798c19027ace

SHA1
384d6aba786cf18fab020172bea23c78d51fdef3

SHA256
6ab679f7ce6558d0a836d581101e794f5585cab4a33cd4396b75bfbd7450290c

SHA512
0fd91e48047d8cb9bcf8e73f8a5bbaa3c9db6cc2dd192810cbd06074128e4795ba0d6fdd4ca032a02617db974ae0e0c522be57eb179eb3e1419bb6b8a255ebdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\a92bff1d-7610-4e34-890f-e71c4ec94518.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\db68bdc7-0e62-4b45-ac35-af0ee4c7b781.tmp

Filesize
10KB

MD5
78e47dda17341bed7be45dccfd89ac87

SHA1
1afde30e46997452d11e4a2adbbf35cce7a1404f

SHA256
67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550

SHA512
9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir692_2037431108\425496a7-4da6-4070-983e-42cf52580373.tmp

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\Downloads\xworm v5.3 cracked\xworm v5.3.exe

Filesize
202KB

MD5
ebac35386bf43a862c935827b9962d35

SHA1
6d4e8d1cd1ea44d5b350be64c5ed284fcb0cc3a0

SHA256
ed8c59afbc7331177e1f19b51f221a30fbe4d278f32f679b321f85975ad01e17

SHA512
eca5201182c446c712b8ae0249ebe0c1675a1be06e9fbff47b571b6c19f64515c09da57a6af70d09f629a45af3c3b100a4cf1e055b6b24ba3176445819796a0b

Download Submit