Overview

overview

10

Static

static

10

xarxina.exe

windows11-21h2-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    650s
  • max time network
    541s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260911-en
  • resource tags

    arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    27/10/2026, 21:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    xarxina.exe
  • Size 32KB
  • Sample261027-1eb8jsgs2t
  • SHA256 540f97ab8f9e072c940db1079ad38909030fcd95150787687432e64d9e6de82d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoveryxwormpersistenceransomwarerattrojan

Malware Config

Extracted

Family

  • xworm

Version

  • 5.0

C2

  • vivo-croix.tun.ply.gg :25565

Mutex

  • HHcvdsJcUyBHS0je

Attributes
  • install_file

    USB.exe

aes.plain

Signatures

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Detect Xworm Payload 1 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies registry class 42 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 41 IoCs
  • Suspicious use of FindShellTrayWindow 61 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\xarxina.exe
    "C:\Users\Admin\AppData\Local\Temp\xarxina.exe"
    1⤵
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious use of AdjustPrivilegeToken
    PID:3492
  • C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\StickyNotesStub.exe
    "C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\StickyNotesStub.exe" -ServerName:App.AppXkqfs6y78jh7hq28mk2c4s2qpre76a7s4.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:396
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
    1⤵
      PID:3416
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:?url=https%3A%2F%2Fwww.bing.com%2Fsearch%3Fq%3DNotepad%252b%252b%26filters%3Dufn%253a%2522Notepad%252b%252b%2522%2Bsid%253a%25220ad0f2fd-e465-95ec-15f9-a5c5a03fb776%2522%26asbe%3DHS%26form%3DWSQFSH%26qs%3DHS%26cvid%3D9e00994b93a740fabe119fe0808adde9%26pq%3Dnot%26cc%3DUS%26setlang%3Den-US%26nclid%3DBF4A449364FC2A9D4D1DC00AA00C205B%26ts%3D1793136931176%26nclidts%3D1793136931%26tsms%3D176%26wsso%3DModerate%26PC%3DWSBREC&timestamp=1793136931177&source=WindowsSearchBox&campaign=addedgeprot&medium=AutoSuggest
      1⤵
      • Enumerates system info in registry
      • Modifies registry class
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4480
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x320,0x7fff0acec188,0x7fff0acec194,0x7fff0acec1a0
        2⤵
          PID:432
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,15006617436469481756,7598504628907961884,524288 --field-trial-handle=2216,i,147269445072891279,6522317794346375218,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:11
          2⤵
          • System Time Discovery
          PID:4632
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,6819661572355433013,5980977305011942308,262144 --field-trial-handle=2216,i,147269445072891279,6522317794346375218,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:2
          2⤵
            PID:6016
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2512,i,10960235984473320930,614189284883431299,524288 --field-trial-handle=2216,i,147269445072891279,6522317794346375218,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:13
            2⤵
              PID:5948
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,4422738297670179587,6295253463706238255,2097152 --field-trial-handle=2216,i,147269445072891279,6522317794346375218,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
              2⤵
                PID:5900
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,975182455014761487,12108030035836498820,2097152 --field-trial-handle=2216,i,147269445072891279,6522317794346375218,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
                2⤵
                  PID:2080
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4104,i,9982690723884267057,15121679364876362260,2097152 --field-trial-handle=2216,i,147269445072891279,6522317794346375218,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:1
                  2⤵
                    PID:2476
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4124,i,18329500465210236562,17837197922089658892,2097152 --field-trial-handle=2216,i,147269445072891279,6522317794346375218,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:9
                    2⤵
                      PID:3048
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4144,i,6375499281888042516,7769606469158380109,2097152 --field-trial-handle=2216,i,147269445072891279,6522317794346375218,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:1
                      2⤵
                        PID:3156
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4156,i,16570172317282969069,28834795947425486,2097152 --field-trial-handle=2216,i,147269445072891279,6522317794346375218,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:9
                        2⤵
                          PID:4436
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,232158026073162366,18429795672648877009,524288 --field-trial-handle=2216,i,147269445072891279,6522317794346375218,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:14
                          2⤵
                            PID:1044
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,16654068670655769311,1045734391787786704,524288 --field-trial-handle=2216,i,147269445072891279,6522317794346375218,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
                            2⤵
                              PID:3304
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,6764008970235228468,5812503346929464423,524288 --field-trial-handle=2216,i,147269445072891279,6522317794346375218,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:14
                              2⤵
                                PID:4920
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,1253945635999110814,12472858913414574789,524288 --field-trial-handle=2216,i,147269445072891279,6522317794346375218,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
                                2⤵
                                  PID:4676
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,17780397211407715230,1043261097176970986,524288 --field-trial-handle=2216,i,147269445072891279,6522317794346375218,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
                                  2⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:2840
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                    cookie_exporter.exe --cookie-json=1140
                                    3⤵
                                      PID:4376
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,16054625487116557256,1509965083244840703,524288 --field-trial-handle=2216,i,147269445072891279,6522317794346375218,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
                                    2⤵
                                      PID:2336
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,16054625487116557256,1509965083244840703,524288 --field-trial-handle=2216,i,147269445072891279,6522317794346375218,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
                                      2⤵
                                        PID:5328
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,12089569331535870019,9765644701883814264,524288 --field-trial-handle=2216,i,147269445072891279,6522317794346375218,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
                                        2⤵
                                          PID:1780
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,15529081437364079292,181431270217322913,524288 --field-trial-handle=2216,i,147269445072891279,6522317794346375218,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:14
                                          2⤵
                                            PID:5256
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,9915145367984453164,8147838351029401977,524288 --field-trial-handle=2216,i,147269445072891279,6522317794346375218,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:14
                                            2⤵
                                              PID:896
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,12975082564417811593,6284784484652557048,524288 --field-trial-handle=2216,i,147269445072891279,6522317794346375218,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
                                              2⤵
                                                PID:3676
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,1397666577305523536,17716909821683953054,524288 --field-trial-handle=2216,i,147269445072891279,6522317794346375218,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:14
                                                2⤵
                                                  PID:5504
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6480,i,17631356613698286555,11051577015235308491,2097152 --field-trial-handle=2216,i,147269445072891279,6522317794346375218,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:1
                                                  2⤵
                                                    PID:5428
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                  1⤵
                                                    PID:2040
                                                  • C:\Windows\system32\sihost.exe
                                                    sihost.exe
                                                    1⤵
                                                    • Suspicious use of FindShellTrayWindow
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:196
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe /LOADSAVEDWINDOWS
                                                      2⤵
                                                      • Boot or Logon Autostart Execution: Active Setup
                                                      • Enumerates connected drives
                                                      • Checks SCSI registry key(s)
                                                      • Modifies registry class
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      • Suspicious use of FindShellTrayWindow
                                                      • Suspicious use of SendNotifyMessage
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:1448
                                                  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                    1⤵
                                                    • Enumerates system info in registry
                                                    • Modifies registry class
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:5228
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                    • Modifies registry class
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:1396

                                                  Network

                                                        MITRE ATT&CK Enterprise v16

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        020985e9-c523-4e02-83a5-8e3e74037624.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\020985e9-c523-4e02-83a5-8e3e74037624.tmp
                                                        • Size 8KB
                                                        • SHA256 069e4634a9bf269c4e135914a22248dc1669fd26fc0f8dc32a8869284353aa3a
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        8dba189f-6063-41df-8eef-c80331c3f978.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8dba189f-6063-41df-8eef-c80331c3f978.tmp
                                                        • Size 18KB
                                                        • SHA256 c628b8f26f11a7f22cf4429516216a0c9228b2eff62145f406f298f4e452ecf1
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        d41d3686-9cdb-42eb-a598-40e9ea6b0287.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\d41d3686-9cdb-42eb-a598-40e9ea6b0287.tmp
                                                        • Size 105KB
                                                        • SHA256 70186446beefb5f52a8af72dc666f019127ca772ab346b24c242d8d83b3dbd41
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        settings.dat
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                        • Size 280B
                                                        • SHA256 c3d6e1c303999af0d8df13a878ff81ae1d0a4b0dbd87e6e8d2a4b14b845481ea
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        settings.dat
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                        • Size 280B
                                                        • SHA256 3ac6d06c818694d314fd7e1c8585b8fed5f3f436c22dad65d4d99f6c08dbd429
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        settings.dat
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                        • Size 280B
                                                        • SHA256 d5203709d191cefd619c9b1777d39aff6cab97309c7e64a26cca768a0982a1c1
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        3adaddac-8c5a-4dca-a58e-1fcc52d2f810.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3adaddac-8c5a-4dca-a58e-1fcc52d2f810.tmp
                                                        • Size 6B
                                                        • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        6288d862-9970-4be6-b87c-ec83e02f94dc.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6288d862-9970-4be6-b87c-ec83e02f94dc.tmp
                                                        • Size 70KB
                                                        • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        681334d7-4d0c-423f-9762-992185b7ed46.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\681334d7-4d0c-423f-9762-992185b7ed46.tmp
                                                        • Size 15KB
                                                        • SHA256 2485d290aa4a4cc239e05a53a6b84b7bde48cfb05b53beb4a6297ee5dd6fb4ab
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        f_000080
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000080
                                                        • Size 45KB
                                                        • SHA256 cbab9b5750b82482da3832f65c9e24f37de8f98a48a0adf935333a4502ca6c1c
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        f_000085
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
                                                        • Size 68KB
                                                        • SHA256 9a184f33ae7f406bc55bb497748336469980585b53ccc41f863c96306dbf238a
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        f_000086
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
                                                        • Size 19KB
                                                        • SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        f_000089
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
                                                        • Size 60KB
                                                        • SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        f_00008a
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
                                                        • Size 63KB
                                                        • SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        temp-index
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                        • Size 5KB
                                                        • SHA256 1409904ed5e46b00c3cd8091f96ca42d573de91fceb8b83cdcb20856f8a944e3
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        the-real-index
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                        • Size 3KB
                                                        • SHA256 00cbd779dc1ef728ab9371822daa88656323f6539637834844b408eba810c161
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        data_1
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
                                                        • Size 264KB
                                                        • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                        • MD5 SHA1 SHA512 SSDEEP
                                                        Submit Download

                                                        cce9992d-1a4e-449e-bd9c-c4ca6b5270f8.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\cce9992d-1a4e-449e-bd9c-c4ca6b5270f8.tmp
                                                        • Size 2B
                                                        • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        dasherSettingSchema.json
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
                                                        • Size 854B
                                                        • SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        015cde61-f4f6-4955-b012-85ae697043ea.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\015cde61-f4f6-4955-b012-85ae697043ea.tmp
                                                        • Size 111B
                                                        • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        918f81a0-efdd-45c4-99ec-687e57382c1a.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\918f81a0-efdd-45c4-99ec-687e57382c1a.tmp
                                                        • Size 2B
                                                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        abba170e-314d-41f3-aac3-7ba3b90dfa05.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\abba170e-314d-41f3-aac3-7ba3b90dfa05.tmp
                                                        • Size 3KB
                                                        • SHA256 95bf36b57909c2279adb9cfc2ab7578d3ac58a0ff0a3fc2a45837378d9219ff4
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        sync_diagnostic.log
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                        • Size 4KB
                                                        • SHA256 04b39432c2c420880a3ed4f8fe25595179002b268b3605ac4d3ff37ee253b4d2
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        b486a7b3-bb1a-4c01-b7e4-edbe9b56522d.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b486a7b3-bb1a-4c01-b7e4-edbe9b56522d.tmp
                                                        • Size 13KB
                                                        • SHA256 021f7c9c1bd42b66c29917124bd9c8bf7de66e91a37771cdff53dbf36c93d03b
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        eb9b8ca3-44e2-4661-817e-9b8c7614eefc.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\eb9b8ca3-44e2-4661-817e-9b8c7614eefc.tmp
                                                        • Size 33KB
                                                        • SHA256 97e82fcb6f3e5c595cc01a80d8553d2c3ff9442e852f581285b03daa55c71c2d
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        f0008972-6d01-4717-9716-f4bf74c41d67.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f0008972-6d01-4717-9716-f4bf74c41d67.tmp
                                                        • Size 13KB
                                                        • SHA256 d9486c52df6dbecc83e72d59beac20c3c9d2952444c19477ce21cc0b05bed4b3
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        af401001-c4db-45a4-91fe-bf619b63c156.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\af401001-c4db-45a4-91fe-bf619b63c156.tmp
                                                        • Size 8KB
                                                        • SHA256 324248103cb20d51f404db2447d21b433e5c726a1cffbce8e46520ea7e4f7b9a
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        e426dfef-ddd4-48d9-8720-f794cbddbf8f.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e426dfef-ddd4-48d9-8720-f794cbddbf8f.tmp
                                                        • Size 23KB
                                                        • SHA256 5a5365c43c4f179e4cb3e428c6db55bb6059ed27961a5e81d5864ae46a5bb6ca
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        d226db50-0ccf-4a51-97b6-eeca52482080.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d226db50-0ccf-4a51-97b6-eeca52482080.tmp
                                                        • Size 13B
                                                        • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        0eb96abe-56a4-480f-a18b-c8fd76ccc0f5.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Temp\0eb96abe-56a4-480f-a18b-c8fd76ccc0f5.tmp
                                                        • Size 1B
                                                        • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        f3bafa8d-0e12-4ff3-a944-3c270680b625.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Temp\f3bafa8d-0e12-4ff3-a944-3c270680b625.tmp
                                                        • Size 158KB
                                                        • SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        08f4b6b2-70db-4987-a237-42a44cb9d9fc.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4480_1246474637\08f4b6b2-70db-4987-a237-42a44cb9d9fc.tmp
                                                        • Size 10KB
                                                        • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        content.js
                                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4480_1246474637\CRX_INSTALL\content.js
                                                        • Size 9KB
                                                        • SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        messages.json
                                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4480_1719538705\CRX_INSTALL\_locales\en_CA\messages.json
                                                        • Size 711B
                                                        • SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        memory/3492-2-0x000000001D1D0000-0x000000001D1E0000-memory.dmp
                                                        Download

                                                        memory/3492-1-0x000000001D1D0000-0x000000001D1E0000-memory.dmp
                                                        Download

                                                        memory/3492-0-0x0000000000C00000-0x0000000000C0E000-memory.dmp
                                                        Download

                                                        memory/5228-879-0x0000018EC8FB0000-0x0000018EC90B0000-memory.dmp
                                                        Download

                                                        memory/5228-887-0x00000186C8AE0000-0x00000186C8BE0000-memory.dmp
                                                        Download

                                                        memory/5228-889-0x0000018EDB200000-0x0000018EDB300000-memory.dmp
                                                        Download

                                                        memory/5228-918-0x0000018FDBF80000-0x0000018FDBFA0000-memory.dmp
                                                        Download

                                                        memory/5228-919-0x0000018EDBA60000-0x0000018EDBA80000-memory.dmp
                                                        Download

                                                        memory/5228-985-0x0000018FDD500000-0x0000018FDD600000-memory.dmp
                                                        Download