xworm | hxxps://limewire[.]com/d/WPofR#hvPWYyjsPN

Analysis

max time kernel
45s
max time network
45s
platform
windows11-21h2_x64
resource
win11-20250313-en
resource tags

arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
submitted
06/04/2025, 13:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://limewire.com/d/WPofR#hvPWYyjsPN

Score

10^/10

xworm defense_evasion discovery execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Attributes

Install_directory
%AppData%
install_file
XClient.exe
pastebin_url
https://pastebin.com/raw/NLm2yJYu

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x001a00000002b263-719.dat	family_xworm
behavioral1/memory/3304-721-0x0000000000590000-0x00000000005A8000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4692	powershell.exe
1588	powershell.exe
4828	powershell.exe
3964	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	Valthrunv0.39.2.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	Valthrunv0.39.2.exe

Executes dropped EXE 4 IoCs

pid	Process
3304	Valthrunv0.39.2.exe
1544	Valthrunv0.39.2.exe
4152	XClient.exe
3840	XClient.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe"	Valthrunv0.39.2.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
112	pastebin.com
128	pastebin.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\fi\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_1936_829353706\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_90_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1936_2072119784\_locales\lt\messages.json	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Valthrunv0.39.2.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133884185139625583"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3712238951-2226310826-298817577-1000\{B424067B-571A-460D-818F-8AB31C27E293}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3712238951-2226310826-298817577-1000\{0B1B0A9B-6F24-4CBC-AE96-EE501AAFFEBC}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Valthrunv0.39.2.exe:Zone.Identifier	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3744	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
4692	powershell.exe
4692	powershell.exe
4692	powershell.exe
1588	powershell.exe
1588	powershell.exe
1588	powershell.exe
4828	powershell.exe
4828	powershell.exe
4828	powershell.exe
3964	powershell.exe
3964	powershell.exe
3964	powershell.exe
3304	Valthrunv0.39.2.exe
3304	Valthrunv0.39.2.exe
3304	Valthrunv0.39.2.exe
3304	Valthrunv0.39.2.exe
3304	Valthrunv0.39.2.exe
3304	Valthrunv0.39.2.exe
3304	Valthrunv0.39.2.exe
3304	Valthrunv0.39.2.exe
3304	Valthrunv0.39.2.exe
3304	Valthrunv0.39.2.exe
3304	Valthrunv0.39.2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	3304	Valthrunv0.39.2.exe
Token: SeDebugPrivilege	1544	Valthrunv0.39.2.exe
Token: SeDebugPrivilege	4692	powershell.exe
Token: SeDebugPrivilege	1588	powershell.exe
Token: SeDebugPrivilege	4828	powershell.exe
Token: SeDebugPrivilege	3964	powershell.exe
Token: SeDebugPrivilege	4152	XClient.exe
Token: SeDebugPrivilege	3304	Valthrunv0.39.2.exe
Token: SeDebugPrivilege	3840	XClient.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3304	Valthrunv0.39.2.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 3044	1936	msedge.exe	82
PID 1936 wrote to memory of 3044	1936	msedge.exe	82
PID 1936 wrote to memory of 5080	1936	msedge.exe	83
PID 1936 wrote to memory of 5080	1936	msedge.exe	83
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 5064	1936	msedge.exe	84
PID 1936 wrote to memory of 3828	1936	msedge.exe	85
PID 1936 wrote to memory of 3828	1936	msedge.exe	85
PID 1936 wrote to memory of 3828	1936	msedge.exe	85
PID 1936 wrote to memory of 3828	1936	msedge.exe	85
PID 1936 wrote to memory of 3828	1936	msedge.exe	85
PID 1936 wrote to memory of 3828	1936	msedge.exe	85
PID 1936 wrote to memory of 3828	1936	msedge.exe	85
PID 1936 wrote to memory of 3828	1936	msedge.exe	85
PID 1936 wrote to memory of 3828	1936	msedge.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://limewire.com/d/WPofR#hvPWYyjsPN
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x25c,0x7ffcd0e1f208,0x7ffcd0e1f214,0x7ffcd0e1f220
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1804,i,1793577533987411003,11021188578072590123,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:11
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2216,i,1793577533987411003,11021188578072590123,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2392,i,1793577533987411003,11021188578072590123,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:13
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3424,i,1793577533987411003,11021188578072590123,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3436,i,1793577533987411003,11021188578072590123,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4680,i,1793577533987411003,11021188578072590123,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4652,i,1793577533987411003,11021188578072590123,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5416,i,1793577533987411003,11021188578072590123,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5280,i,1793577533987411003,11021188578072590123,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6292,i,1793577533987411003,11021188578072590123,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
  2⤵
  PID:5648
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6360,i,1793577533987411003,11021188578072590123,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6360,i,1793577533987411003,11021188578072590123,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5192,i,1793577533987411003,11021188578072590123,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6536,i,1793577533987411003,11021188578072590123,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6524,i,1793577533987411003,11021188578072590123,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:14
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5320,i,1793577533987411003,11021188578072590123,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:14
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=5340,i,1793577533987411003,11021188578072590123,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:1
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7216,i,1793577533987411003,11021188578072590123,262144 --variations-seed-version --mojo-platform-channel-handle=7252 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=7276,i,1793577533987411003,11021188578072590123,262144 --variations-seed-version --mojo-platform-channel-handle=7328 /prefetch:1
  2⤵
  PID:4484
- C:\Users\Admin\Downloads\Valthrunv0.39.2.exe
  "C:\Users\Admin\Downloads\Valthrunv0.39.2.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3304
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\Valthrunv0.39.2.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4692
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Valthrunv0.39.2.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1588
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4828
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3964
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3744
- C:\Users\Admin\Downloads\Valthrunv0.39.2.exe
  "C:\Users\Admin\Downloads\Valthrunv0.39.2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5028,i,1793577533987411003,11021188578072590123,262144 --variations-seed-version --mojo-platform-channel-handle=7504 /prefetch:14
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5408,i,1793577533987411003,11021188578072590123,262144 --variations-seed-version --mojo-platform-channel-handle=7516 /prefetch:14
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5308,i,1793577533987411003,11021188578072590123,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  PID:560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x2e0,0x7ffcd0e1f208,0x7ffcd0e1f214,0x7ffcd0e1f220
    3⤵
    PID:960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1752,i,1311836862459532253,11542561208225684333,262144 --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:11
    3⤵
    PID:5888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2696,i,1311836862459532253,11542561208225684333,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:2
    3⤵
    PID:5480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2108,i,1311836862459532253,11542561208225684333,262144 --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:13
    3⤵
    PID:4952
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4364,i,1311836862459532253,11542561208225684333,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:14
    3⤵
    PID:2560
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4364,i,1311836862459532253,11542561208225684333,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:14
    3⤵
    PID:5276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4468,i,1311836862459532253,11542561208225684333,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:14
    3⤵
    PID:5240

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:6080

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:2992

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\XClient.exe
1⤵
PID:948
- C:\Users\Admin\AppData\Roaming\XClient.exe
  C:\Users\Admin\AppData\Roaming\XClient.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4152

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4236

C:\Users\Admin\AppData\Roaming\XClient.exe
C:\Users\Admin\AppData\Roaming\XClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\74219aa5-d823-414a-87cb-bb5465ebf53e.tmp

Filesize
56KB

MD5
59652ebd02b5e3143cd9428f3003c26c

SHA1
16c1e44cb8188cfe2bbccbc1c58212c590170644

SHA256
2d0cab384ae1669260618c58aa31ae1537ce98c3e8befe4b6a695a45a7c7859a

SHA512
82a265a53b69de674bdbe3b5e649158f1774a34dba175579ce039706253b0b318e0903de67e46fd118e38e3bff1914e0c9acad0296d2bdcc4a4193714f6ddb52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
fe2e63caccaa2c520f7a7cf7b3add70c

SHA1
9022a1ce5e46bf0d33ef7f9ac25f46427aaea17c

SHA256
ae28f4d3b661306273a1e9d60560b4f8629c01d3858df9428a16be55e08f8c5e

SHA512
8881cb0b7178cbb7ddfdedf70c6faf368342215b4fb987ebf5c1aafd6791cac8c5a64684c0791d3ba3c198a0af7a644346123f105b6c42f3deff44f21740de64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
682ff716e69471147f7a0e231efe86ac

SHA1
937de827ecedfb18ed3f399ac647f88f2579c6bb

SHA256
11e566a5d7934e7f13ddb561000aafff386430a3df22a36424f2101e9ba76662

SHA512
4fffcccf9a78aed772e46ff48f817d586934c8d46434535d25b080c4fa264e018e6c2fe389d8d42b1f3b911e402abbf00affd9b890b77ae68d7074a31ee3e93e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
f91ff652e9a218bffd6e04294c031e6d

SHA1
b01206538a9852675e43730d55125192494fde16

SHA256
42da4039b4787f97907b32f972fd4e9e84475721469a74944f7323fd5e96e27f

SHA512
2032fae8c3b07a1b183256faa8dc7ea5c3c6cbe39bb0dfa33ed159258461d926fa5905d43666f4d80e5acbdf0d8a8d98206f13812ffb75f0d831e2726a6eaf65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0

Filesize
44KB

MD5
67276635b3da5590ab056992d67c8fc0

SHA1
ec53e823749b2dd73f9a35d75aa266a08c6f89c1

SHA256
8f8a80c24fd50ffee2c43eeb3346f2908669bfc37aada79ec301f4c1a7f53ad6

SHA512
f208f2358ba3aed767e9ae182e80dec80c520965b652ef0c39fc2ff90ebef1ef8e90558617605fb7fca1ff1d4695512c8f1bc02488dc3dfec544d80df5f1565a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1

Filesize
520KB

MD5
d1571d352acc94ef834879f6b6c7a5a2

SHA1
06ee726e4ad269961b95b76a822a2accd65b3d6a

SHA256
b1ec07a5172200d8a1e3068f0ccb5e9f7a4aad180eba7d0b05d2953f2b65d2b6

SHA512
5334da837e6ffe1b0d420345d2be902067c64f97a66a53508bcf4065afaa33f333d89246478b879d9c360369e923511ca354749f73df78607fd2ab1a0e17af9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2

Filesize
2.0MB

MD5
1944187c9538cc0e2fde2318f8d0bc46

SHA1
2a7578998300f15654e2e76166896003eab2f5e5

SHA256
f54679ce629d69f7094503aa6f42ecd04ce68e3ab07b2d40b8e9822ccdcf97a8

SHA512
662eaf271d2cc31a3f103236200932e11770357343d178480bc1c6dabdca2d31d6618748bbd34b2dcf8403127273748c3843efe95ae7bd878ac9fb2dad39f1bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3

Filesize
8.0MB

MD5
3ab0ad0ba5ca572350199cf831b54e37

SHA1
74724fc9a08ce7fefe1987adcd39f12ff85c6e0c

SHA256
92ee2de20892f41ecc22ecb7245cad40e627b906670194f2a15593d1884cc4e6

SHA512
efec9ee386fa0292d42ab6f6e58229d1872024f0b1ebc0e046209a39882f344b9997e3e953b9b58a412780ceeec276409adfbb4c69226dcf9a726a72b39c262f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006c

Filesize
21KB

MD5
c6e536e2465fc9eeb9bab94c6d449c8a

SHA1
77651f46404fa635d116955e234f6f6b0de59441

SHA256
f3cc8df2635b73f9a6e122d0deb6912a7fb3f2796db8d3329fa767fada327b15

SHA512
b8a175bbd13ef08af5db74bbc7460614939525c9449a383c9de4ce2956c7b30cdd3a1b11fdd4302dad45e3eb8248ab44ebda954952458fd37f9b2b124a14d415

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006d

Filesize
44KB

MD5
b1ed66ecdcff556a8bd91c33ba8ddf97

SHA1
67777cdafb8f4d16b1db6f3c6b2899c09f77b2f4

SHA256
3218fa6d8d902c6e18f855047c3979ac4ddcf03c22cf67752adca0536e406359

SHA512
437d74e9e18312819bcbb0f602787b55b8f3b9faaa6d9dc51a352a4280350d25f83bc9d6b6d1fa9e446714694d8e248e23562273391f0c091c6b72ab75f0f7b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006e

Filesize
47KB

MD5
0462a8bb7331ed75bd6544de9390c74c

SHA1
4a46f7cc1aa3862a26644c1d102e9a3c942c0361

SHA256
29fe6dec26bb6f8dc6be917bae1c36faf5f089a3c72cfcb5c7102d7377760ad0

SHA512
bb0fde2eae6409f766fe089416771772666cbe0673de517820af20ef76970048e5ad509a52a066dc87262ae35d6a9499922ef67f76cbcab67ab8cd1f32f5c293

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006f

Filesize
17KB

MD5
b2b26f2643ac2a77e8f112d02f043f0d

SHA1
46b49a858814650b5f809093d841e0a93b007868

SHA256
4d7f53a4310e55de95310a530cb465e5b79b47c708394f08c81b44d844b40f31

SHA512
216cfd93b9f9c7219087072063150b7d2245fd60433640951dd95f5c15250fc2f8caa8df72be529fc997debb811b3acca6c60961ee3b60f9a3e141d2844ff30a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000070

Filesize
51KB

MD5
0e0f8e53a58fa1361894d1e0930cc964

SHA1
d4fc59d76f03cd40dfb5e5db1494af96ad945fc3

SHA256
59acee07b9edebf273cab3f3f8a2ad88e5271ac86ae2814a3700b6562e8f5760

SHA512
b925141e54585b24f065ef3a34c17ea9650ecd8f697d109bfeff649ee76675590e9d7fd8a109b5f6c35b103859db78b1c8b534be56eda4cdd538aa3b9ad4c5a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000071

Filesize
20KB

MD5
656c0daeb203f97a65ccfd83141e0b69

SHA1
96641f8cf5ce6b44c85b128bb6f1c38cd00767ef

SHA256
813a6dfae97465a44b2fdb09671af30df06897b47bd2de93c82b6a694cfd66a1

SHA512
d53f633a516793e1578db89f70123c2f63466e245733948efc16aa51ba32240e55f9ae9a711294018131049bfdad8fc57b735a8bdcf48d776bca19bfc77eff25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000072

Filesize
24KB

MD5
e7ba8b0e575647b270d9c632140f6db0

SHA1
45a9304e2c7caf3fb2ef402103ec53759e767ac7

SHA256
5e90bad8e3fbda06ea1ce17b29b96d6e51ff611c59229494769526516f4bb4d9

SHA512
84b2fcf6a27228550e86cc16fb3a2c1d1c10f036ab4e647da8b14d456fb16b252a4d10772c3665c551d0cf218967358aa622a098cd4636aa759f1d93ef2deb92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073

Filesize
46KB

MD5
14e8b188bf5bd3d9696034944d2462c9

SHA1
3c3eba382cc7a0fecce86eb4ee0b2962414923b9

SHA256
81cb411552df8e2c449d25c46c22b4c2a943964b6c8f14202b2c5f310b8f9f4f

SHA512
5dd7cfece07dce8e7792139a2be7c9e3f5f2971a77354447b80c35541319b448afc56574e0fa2950f4e14ec8842fdd076abf2af2dd3fd5e829dae9998ae1cd8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074

Filesize
77KB

MD5
ec22e42ea86b27fe0b3074bb19aa94b7

SHA1
0d5dedca7393b0ecf150d7f6d52b2c039a0ed285

SHA256
6ba7f908d82e86f14cc8662e3f13bfa6fa0c7745d34d7e44a3e27454e659927f

SHA512
36b607d9ae6b165b05b3d92b2a4fd29f286373fb8ccff6b78b6e724b36820ea38e0e44cbe34f646b488c067cb61bc00324a2fa9a97476da8e259729280347798

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000075

Filesize
17KB

MD5
ca72fb4e277e59be50b8850190822581

SHA1
159b97b22006fe2a483da0a13d33cfb3cc5aa031

SHA256
f3c0fa2cd71bb91d0e3acf5d77b93c49a184e9ad941532ca8c07c82eb0bd6a6c

SHA512
6b7cbd0a333fb6626ec25a087517f732f92eb263a1d145142303501e4ba0ff2016c5746eb5bd2a1444ee388e637b40ba7d15591e1698f9a32c26011786f90bb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076

Filesize
17KB

MD5
f29503a1895affee5ed85d0246238af8

SHA1
f474c6e8a3e4e28fb68cf7fb29bd448cdfeb0278

SHA256
7164a212fb4df27bf1e006342d1686badcba58f5a5d301772c14cc7adf1d4821

SHA512
26ecb480a38eea82b25ca80383b5ad56b775b84e95d39695c028680e2695c8060fe94d3bf027c5ff664ad406d4f518c4b2f229f42bbd5a71ff57fa268547757d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077

Filesize
17KB

MD5
715796ddd1637e1334588181b0e9cdb5

SHA1
1246cb17f39f9d54b03540c8cfe6ba11e4084080

SHA256
e6997f451bbf8012dea5fb3b9f2e974a2f86861364126915097d81096392c800

SHA512
fc289bfdc8acd5fabddcec964f5d474933929c19907e63ad72262894ef97530bd78047319708feea8b53e8a1d96cb092d177b868d189cb4e61a5aa375ef08257

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078

Filesize
97KB

MD5
b9b9773659a41ac59740f2ec9e56e188

SHA1
7ec4817ac63bcbfff955b8518bc77e3399367c4e

SHA256
f58be6305a263551f8e0edf786d42b78923ccbdf27f021fa7c330484a7221336

SHA512
9fb00d21154e03c8396fb8abaf71f3b0f0d6d6f8642328a31adf10643b3deec0ad8d52bf1165067fe565c7974e77d1b75a6c1f0e713b0c43eea5275b49d58f00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079

Filesize
91KB

MD5
3704b9f7b10174f5608cdfb421f11281

SHA1
c08094b2594fcb61c0817f7abe12ce3a49cd9d45

SHA256
5ea7124c806b389d6fc03a18102d889c36efc0714803d52fa61ccbaef722215b

SHA512
1d7b3905b3c855dc56980b3f62886e97b577b5c73bb53a283705f4ed002bbc593570e27377904a5f492f6b69eb6e7715984ce0c09bcd3c76fdb44c5596fa56c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a

Filesize
173KB

MD5
a979ad7c86e550d54308c4b24e1f27a2

SHA1
850451b1ceedb7e0f69d3fdbf030c7e842b6e4ca

SHA256
3b721ad46e81d4e1d5f73bdab5447a88584bf2a5331106a4a4790015a01b691c

SHA512
7b9ee5f5f833af7377742ef8ffd176bec717fb6011ac55848dc30761da19aef22b1f8f237ee053b36d8c86242ef448c67563f7fba0452781324392257f344d43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b

Filesize
143KB

MD5
9c1bb68be172b7debadd1e676f686125

SHA1
ca4ff759962a73f6a1f8a3cf1482a48f03d91a11

SHA256
9826e3ee5a1de15040c0e068e3cd04a8ef7d36fe36511f399b628da31663a892

SHA512
f9c371bca6c45eb76bde552b719788e645f9f9bd943c6128f4e283128d027631d144e8c8a0543f96eb4d6a56354209a8efb9baa79f93225a78ffa16106689c8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c

Filesize
44KB

MD5
8885f5e09234ec0f6ec8b6b27e1406db

SHA1
fc747dd7d3835378dcba0d033c50dc17a18dfe84

SHA256
3915b0bc5d271b96bf253306c1fe66bd9a5852ef61f43f1ed39ea2e10d7d6851

SHA512
db22df8220c5ea00f2ae980cef12430e57ecad59c3d276225c09bd84e6a52265723584d70f6764ed5aadf1140a727c0fd767adffd209e4a137d105da8f6088a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007d

Filesize
64KB

MD5
d55c6bf4b58c99738a25c5343a1451c4

SHA1
976071aefa0999f74f05df9390b87ce67807b487

SHA256
e29002e7e75e641c73efe665139c478b1c0392c91ff878183b24738f8bc673ca

SHA512
f879b0ff14396b98b9a5b83d8ed640d1ef6eb599325ee29468e99f5174400d9d433b15af341070c6c45c44934bf71171eaea033e20c08d3c43f0e88111884ce0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007e

Filesize
19KB

MD5
5e5ae2374ea57ea153558afd1c2c1372

SHA1
c1bef73c5b67c8866a607e3b8912ffa532d85ccc

SHA256
1ef458d087e95119808d5e5fecbc9604d7805ea4da98170e2c995e967da308f3

SHA512
46059e4a334e0a5295ebcef8401eb94b8fa0971b200f0f9e788ed61edae5018c917efd30b01631cbd6bdadc5240c9fcad2966ea0aa9c94b538bcc369e10bbbaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007f

Filesize
191KB

MD5
eaebb390ddb3b1c0e07904f935d29bd9

SHA1
dca8da5b24b1b18b3c8dbc2523f5d145fd4dae13

SHA256
9478515162e79256323883a5092b39e0045dc8213d7dcf7be5dcc1ec5b70e9e4

SHA512
e2dae28c4661b3bb65b3811803a9396e1c9b16eb187b60f2d4d1a8cc65e2ad6ce0931a48e942b5d920bdc263ea939b9164b649edc3752e83daabef9366a186e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000080

Filesize
70KB

MD5
f56d22e707d854fbc138eb8b21c7306d

SHA1
391ace080ef662e5960b784a2d364b94877f87d0

SHA256
f70d4d47623f918b674d97bffddd84e4734d69f96ab6724afa9707fb044a386a

SHA512
b4856431bace0e12e24867a2b93bea72a040dacec182708525a9fab54157e817591647d21f19250698c20afebf6e855a7a4062a202c91f44b17a7087b518134f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
d1b65a75fac1622cd12ff4135aad768a

SHA1
3e6572ecea7cf6549b8375c2193a1776ce56425b

SHA256
e9c79e51d8e4a738c3d9b749261071fc8cbc776afbd1dfc5235ab361f2134df4

SHA512
b87a1570f14fd2927d28cd15789901658448e29593dfe4668a757435d364bf17beb739896700e50c64677c9a81e561aca064878764ff3ab011c36090ad4f4573

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57d64b.TMP

Filesize
3KB

MD5
1fba793d247906644cf7279954d25507

SHA1
a9c29af9476471ac7b60582e29cc12a219605770

SHA256
c73b279fca3ef14d5fb3c11d3a3021ae25fa4979d7c5af9deb59e2f3fc5851d1

SHA512
14ae668ef8739eb1add6f1679dc73d7c4dea9b2183714cd43b220c71e61d23ac0a2f22a1d7353b2d9098d24592c274dcfe296bd84d78f98d4f49f25b8af0e754

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache\data_1

Filesize
264KB

MD5
086276633393ff1946487bf15a3e9981

SHA1
efd252e88b538309182db73b18607f1a1b52ce71

SHA256
d58715f8fdc156255dc9a8b4d415316ecc8abb7b2f8c1560aa831a253a8a791f

SHA512
286ccedc0687eaf23a877977f110a17f722308255df6e32b72b03febefb4f0cce32916e19d70851d3678357292a87ff074025ce2ce4a8834ddc66b0a81590ef6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Filesize
20KB

MD5
721176008b42be41dabedd3b0d9070c3

SHA1
236faf742d41c8a554ba8213797d815f532bdb35

SHA256
7afb8c161dc2869cf321af16ba23062e37ee52f1348978c91932ec5654ee7572

SHA512
91c9155cfb69f5e7964ed9e3f8ca56ce66cf2388af2e5eabd67c607e89254d8f84b9422f48261a1e90d195432bdfcdf25398bb57b7c71ed12c72f47f40c7d3b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
ed72cf2adc54880de7742803375dac80

SHA1
1d5a1579d3fe4ad377a7f5d8fd0461951c47d0fa

SHA256
c4c3bb44447ae354bd7aea75ed5f1216ffbef8db96d3490701a0cef46f6a98fc

SHA512
030e27fc692d9e42d11391bf0e3bb55d83f44f9d37fe1067514d1106e74f0490899376ada50ad0569407afc219b5c021259af555b87572805ec95358f5df13c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
77fe38d776a6bb9bad09978f399f8626

SHA1
6e90b9c77e8f559c0c705d90df71ac1866134e3b

SHA256
30b8a186e879ec24d29ae7a4329f7e431f8810edeb211fd3432b816fecd72fee

SHA512
3aae7ee371002c9f9e9646172c8abcf1f04fce92098886520812c5018283907b49e93f686cf8abc330dd87ef89252143b5aa0c55075af0a18a6dbe62b2b1d3f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
c4a5c1938058f7b478a0ec9ca9e159d4

SHA1
54203fe11fed9fff471bdcf1b1c47ffad927ba23

SHA256
484ef2545a54cb5137762366abafd08df4cf555cdc1b10e11b49659f919f18eb

SHA512
b2a974aaec28b104e31f05891be64e851e3f29eea5fdc5bd6ef29b02fbe5354d5291f00de45e4e6936b4382a76010c8d085636d1c36b610025e1bef724dbb3eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
90dfc1675c033b0c23acdcd9dd6c8b73

SHA1
e39ee818afe59561934e29c7b2898e266de89d83

SHA256
83843f1b3ae324ad44834defc6b77629348943d55bd3776f26e28481d7334d81

SHA512
69ac39069202ee4822697a95af6a203deadd7b2e4afb4e0274508ebb9ab50ea4b671b5ad5356ad41cc1f1a9564feafae34fffa996eb132e78fd433010bb49ca1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
85d6c3d141a90621056a011b2dfecf85

SHA1
0190e8dbd514cf0de1b69f0c7ea2581302425622

SHA256
547e8867c786a58e9c7e3e401f6558fbd0763a6e5c3343e99bc2a4ab42e44753

SHA512
70958a46bafb18b39e5520ca9f368f2f9cc64d4a28128d2195486950b05ecde5479ca20cce9bdb44d27a813cd01a7cc3d66790d85a805e20a28fddc519f9447b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
70d4ef5f8cad323f4cfe1109017f99b1

SHA1
f6c29c52b4ca0a94ff7ac3dbd8ee99806b072f23

SHA256
b7d1dff55ee1aefb0ff2072faaa8b4249b8c0c5f01741388793430f1e71685db

SHA512
86f71b9ad1437ff77e6edb01e54ca8d2032de570f5e3da4373a48ab53833069533d736a4b8bfc14226e565e24d66df3913b060b20873cab9ac3b35e0fa094921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
b72d0d3e7767780476c44eef8aee1741

SHA1
302a8880ca086727ea342c4da61e2ca1793b9329

SHA256
d43042d987f9df26e91a9b088c773bdc1fe40fbab2c7982cc5923d3d0ba2020d

SHA512
b5d38c2f4956a3e1b5a01174ae18229d2dd345beb3d3fab89fe8887f0f7eefda904dab8af547eba48d9910e9adaefa6ff601e204b4ae27426d62548c3bd93616

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\db4125b5f40e60705005afe796cc0071c6f09794\27b0d4f2-a2e3-4a77-817b-8d35d8201d7a\index-dir\the-real-index

Filesize
48B

MD5
5069e71e6b318064ffd4ae680472d3c8

SHA1
45e82e05f765b6da81b78b580befcf4375974584

SHA256
ccbda648f1e0a4a97cd6ece0ae2f95735facdf90809819b092a5d380a0739ebe

SHA512
8c762d901e89fd2ef7ece714c4142677161c3d0339686dd931927784d78b49bb7049e7e8518c295501367fe6030c235805b5936a0a07fbb50285ad6c829c424d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\db4125b5f40e60705005afe796cc0071c6f09794\27b0d4f2-a2e3-4a77-817b-8d35d8201d7a\index-dir\the-real-index~RFe57c40b.TMP

Filesize
48B

MD5
e825e9e8665537b4ec673ee94d9b4872

SHA1
421e9110f318ddde27a36ec22aa84256d463ceca

SHA256
9541733c34c5785835bccc4d69baad4607f90caa757ff565a86d8d048e993217

SHA512
5981145c2e227c053f23fdea641118d80b586d1612d64b5570bcf0c0da687e09937a55fe845e0efc8500a96dd051221b1b85a1a2ed83b13d4f3f2c4d84ddbdb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\db4125b5f40e60705005afe796cc0071c6f09794\index.txt

Filesize
111B

MD5
dbc300fc6e7192788283af71589a6be8

SHA1
c15345e633a45f43f266d58887d706a93eea87dd

SHA256
a40aa5970fe2a7948d352a5eb5accc2a30ca331248102313f5cda2f56b32529d

SHA512
8bf629a6f38f1d273f0dab19f32f28d7483cf20165be5b12e73da4fb1fa96e1e4c0d02cb51d5eeb17c329a195b8d5623b342884839980c068f8cc4ce970ce2cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\db4125b5f40e60705005afe796cc0071c6f09794\index.txt~RFe57c44a.TMP

Filesize
118B

MD5
cacf7aaa37d5764564c97011b1510518

SHA1
645dc2a925e0a829e627b8afee48a64bb83544c7

SHA256
90485a5cbfc58a7271d002576b67a591130a329871cd498154bab75ed7ec791f

SHA512
d100fadbc9abb448fd33b1f21b8b9747bfc674e8ecad1885268d56e24c01540262ff732510a25c3c92d12e4ad106bc222abe16f183e3226b64b79686efc9ae29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
03a89ffe7cf07c537213209485ace9ce

SHA1
551ca95c648c32f8dbe78d52371eb54e0228015c

SHA256
28e77e4c3528b86212f4759263a40eed4f717ddc485b186f0782b833ca2d1d88

SHA512
0604ea345e10c6a79f2f86ca1d75d2bc775eb33774e256bcd24853c3287b58129bcfc7eeb5371ee0bca6b09b4238548749ca3421a47237cdd0a1b00626ff4124

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57c1f8.TMP

Filesize
72B

MD5
4892062c9dc1952756e9388af4b5dfa9

SHA1
d741852fd202b5c4a6cd4048f57ffdfc6f0a67cf

SHA256
52d1410a0b0b6ea82755f22cdb0b9ccb241d964199331dc934fe405038a6a0e6

SHA512
3d5839ab33d5fe5909043328ef7839cae4796b11339cf3f65dc08003dd93c3cd1d8209068f6393c166987cb9976d9faf37190c11bc827be05ce93d612d574c52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
23KB

MD5
f70544a0cfa5898b01044b9d201f7280

SHA1
f5c08631a39e605723d0b286929fd62956f65c68

SHA256
ffbb6ca5624dc9ad486484248585d089115111f5c5ed9b7485fa09dbba98523b

SHA512
9b0f1c0b84ef88f0b448a20b129f141c25c52f035ebccab3f5770d69750e3b3fef1a6412ee4d6b1d93a499426c2f9670ae06e33b003851e177b72abf44ffb289

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bc67d229-de96-4314-b89a-1280a70f4566.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
13B

MD5
3e45022839c8def44fd96e24f29a9f4b

SHA1
c798352b5a0860f8edfd5c1589cf6e5842c5c226

SHA256
01a3e5d854762d8fdd01b235ce536fde31bf9a6be0596c295e3cea9aaf40f3dd

SHA512
2888982860091421f89f3d7444cacccb1938ef70fc084d3028d8a29021e6e1d83eaef62108eace2f0d590ed41ece0e443d8b564e9c9a860fc48d766edb1dc3d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
56KB

MD5
3440096d12f2c973244601920113b19e

SHA1
5202570bc0c864c59b1e689adad77369fa1fa73b

SHA256
c5328dd1a62d967acdf74343750d36db82f4bdf8ccd4535f40ab94507127a77b

SHA512
d78ec7855958f1ceaa4d2c63358eec90823886145f84990801c411249c43aa5b17b598d42c6f28080932cbb82238892dfa331ad5f8e5fc69993a8947b2383005

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
52341d844bacb98554f56ad9783bdb6b

SHA1
738fb30ae3089626f3392e61c6289ff005e07f59

SHA256
8ef44411f84753229241be9da41dce900d39ee56ba59a88072b7d30f844287c7

SHA512
c1b80118affce098d5dcdde676262f5254f8ce1d745523a7cb808b33d60c5bfdb0d908927454510c445624d40baf8d4e62744f450a77d45547958fd09969203c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
a1a39465b57aa62b4bc83d03c5a6de5e

SHA1
a2bc2486906ddc61257571af8f87dddad6e2a1eb

SHA256
3103fbf04c7f55c9eaee9d07592bc002954b7f74d19f45c542b3b5c86583cc32

SHA512
496cd40852fee5b3e569ea2f3b0d92446f147183c4fbfb302c2bd46e7cde9b2b299d6d5506891c059466dc7c814e5b1a90594ff44ad7eabf66c32608998c684e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
3a275013348090bc7bf30fd46f168700

SHA1
3a3ca1543a016495fbacf1bf565a3cbdb09d9b22

SHA256
76fe51fbd786677358a7a7a62e6ab2f15887eb9146431bf6ef37b9a1da9f26c1

SHA512
dec8713051ac86554d96e57db64defa37daac63f5a370f9a0805d9426683ef931a58fa52527f14b5eb9675303440bc0f3dcb8c885da9bef262baeee4746c0e88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations

Filesize
86B

MD5
961e3604f228b0d10541ebf921500c86

SHA1
6e00570d9f78d9cfebe67d4da5efe546543949a7

SHA256
f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

SHA512
535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e8eb51096d6f6781456fef7df731d97

SHA1
ec2aaf851a618fb43c3d040a13a71997c25bda43

SHA256
96bfd9dd5883329927fe8c08b8956355a1a6ceb30ceeb5d4252b346df32bc864

SHA512
0a73dc9a49f92d9dd556c2ca2e36761890b3538f355ee1f013e7cf648d8c4d065f28046cd4a167db3dea304d1fbcbcea68d11ce6e12a3f20f8b6c018a60422d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
8cb7f4b4ab204cacd1af6b29c2a2042c

SHA1
244540c38e33eac05826d54282a0bfa60340d6a1

SHA256
4994013dabe4f131d401879278eee147add6349124ea6452358dca7e2344c7a6

SHA512
7651cb6863a425840db610253151e271d3e8da26a8c633ce484247266fa226792ecb84b9578df3ab17fef84a5dfcad417b63a7df59c9650a907e08d59b91dd6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e986b73634e22802f2402cb14f45b25e

SHA1
03ec90c16740a1b7f1f4d6e564e8f3aa3be21098

SHA256
ec63cb606b1264f770e2d7c9649b00e5e8d261bc7e0be183741d8d5f1c1e1742

SHA512
b6358abf18ec0e1b86869d49dc3c81e53fca7b20b16b69506526d6cd0f18f305395155e9247f4b974640ed799dfd22ce4e770e5c877ddc27747063c9693f60bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x3jg0fel.bcu.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\Valthrunv0.39.2.exe

Filesize
70KB

MD5
9325049797a2d989b9ef1f3a62b3d362

SHA1
429a928ef879611b66d6f9bbe2a329611b337c16

SHA256
77c5cea5e6c019a67f63177c0054daf9892979d4b72266cbeed1d11c5537bfb2

SHA512
e9b34c9f11880adf0c8cb1bd5f30e384113f25fee44bb4c5661748bed0d11e67ce8aef1a89db4c0487b989e64a8e27f44c5b617f969f8a3be5373c0c380cdf19

Download Submit
C:\Users\Admin\Downloads\Valthrunv0.39.2.exe:Zone.Identifier

Filesize
184B

MD5
19777fafd9ead020abeb515f3aaa65b5

SHA1
76d9356e0dbe4ed55c862b2d15ae9ed925e73b0d

SHA256
0e2fc2c4edafbe49bacebff8e99650c115190fab7757aa9ebb6efa26091b7fd5

SHA512
96a20f3f79f8f381f2b0b062c428cfe398c987a95de253079f03ee238867cf813b851f994a129b5dd58267ca53fc7e12643450ae2953eb028ce20ee3a5fc7741

Download Submit
memory/3304-721-0x0000000000590000-0x00000000005A8000-memory.dmp

Filesize
96KB

Download
memory/3304-1113-0x000000001C150000-0x000000001C15C000-memory.dmp

Filesize
48KB

Download
memory/4692-741-0x000002157F570000-0x000002157F592000-memory.dmp

Filesize
136KB

Download