Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1800s
  • max time network
    1469s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    10/08/2024, 09:40

General

  • Target

    https://evonexecutor.dev/

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs
  • Suspicious use of FindShellTrayWindow 42 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evonexecutor.dev/
    1⤵
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1744
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffddae93cb8,0x7ffddae93cc8,0x7ffddae93cd8
      2⤵
        PID:2504
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,9077923173245246007,4350775849913095278,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
        2⤵
          PID:2392
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1928,9077923173245246007,4350775849913095278,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2396
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1928,9077923173245246007,4350775849913095278,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2372 /prefetch:8
          2⤵
            PID:4144
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,9077923173245246007,4350775849913095278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
            2⤵
              PID:4688
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,9077923173245246007,4350775849913095278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
              2⤵
                PID:968
              • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1928,9077923173245246007,4350775849913095278,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:2268
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,9077923173245246007,4350775849913095278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
                2⤵
                  PID:3176
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1928,9077923173245246007,4350775849913095278,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2536
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,9077923173245246007,4350775849913095278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
                  2⤵
                    PID:2572
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,9077923173245246007,4350775849913095278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
                    2⤵
                      PID:4364
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,9077923173245246007,4350775849913095278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:1
                      2⤵
                        PID:4552
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,9077923173245246007,4350775849913095278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
                        2⤵
                          PID:3364
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,9077923173245246007,4350775849913095278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
                          2⤵
                            PID:740
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,9077923173245246007,4350775849913095278,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
                            2⤵
                              PID:4612
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,9077923173245246007,4350775849913095278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
                              2⤵
                                PID:868
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,9077923173245246007,4350775849913095278,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
                                2⤵
                                  PID:964
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,9077923173245246007,4350775849913095278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
                                  2⤵
                                    PID:5036
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1928,9077923173245246007,4350775849913095278,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6284 /prefetch:8
                                    2⤵
                                      PID:2812
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,9077923173245246007,4350775849913095278,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6556 /prefetch:8
                                      2⤵
                                      • Subvert Trust Controls: Mark-of-the-Web Bypass
                                      • NTFS ADS
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:2920
                                    • C:\Users\Admin\Downloads\winrar-x64-701.exe
                                      "C:\Users\Admin\Downloads\winrar-x64-701.exe"
                                      2⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:3028
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,9077923173245246007,4350775849913095278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
                                      2⤵
                                        PID:740
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,9077923173245246007,4350775849913095278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6660 /prefetch:1
                                        2⤵
                                          PID:2964
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,9077923173245246007,4350775849913095278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6580 /prefetch:1
                                          2⤵
                                            PID:3684
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,9077923173245246007,4350775849913095278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6484 /prefetch:1
                                            2⤵
                                              PID:4360
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,9077923173245246007,4350775849913095278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:1
                                              2⤵
                                                PID:2280
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,9077923173245246007,4350775849913095278,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
                                                2⤵
                                                  PID:572
                                              • C:\Windows\System32\CompPkgSrv.exe
                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                1⤵
                                                  PID:1176
                                                • C:\Windows\System32\CompPkgSrv.exe
                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                  1⤵
                                                    PID:1788

                                                  Network

                                                  MITRE ATT&CK Enterprise v15

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                    Filesize

                                                    152B

                                                    MD5

                                                    9af507866fb23dace6259791c377531f

                                                    SHA1

                                                    5a5914fc48341ac112bfcd71b946fc0b2619f933

                                                    SHA256

                                                    5fb3ec65ce1e6f47694e56a07c63e3b8af9876d80387a71f1917deae690d069f

                                                    SHA512

                                                    c58c963ecd2c53f0c427f91dc41d9b2a9b766f2e04d7dae5236cb3c769d1f048e4a342ea75e4a690f3a207baa1d3add672160c1f317abfe703fd1d2216b1baf7

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                    Filesize

                                                    152B

                                                    MD5

                                                    b0177afa818e013394b36a04cb111278

                                                    SHA1

                                                    dbc5c47e7a7df24259d67edf5fbbfa1b1fae3fe5

                                                    SHA256

                                                    ffc2c53bfd37576b435309c750a5b81580a076c83019d34172f6635ff20c2a9d

                                                    SHA512

                                                    d3b9e3a0a99f191edcf33f3658abd3c88afbb12d7b14d3b421b72b74d551b64d2a13d07db94c90b85606198ee6c9e52072e1017f8c8c6144c03acf509793a9db

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

                                                    Filesize

                                                    210KB

                                                    MD5

                                                    48d2860dd3168b6f06a4f27c6791bcaa

                                                    SHA1

                                                    f5f803efed91cd45a36c3d6acdffaaf0e863bf8c

                                                    SHA256

                                                    04d7bf7a6586ef00516bdb3f7b96c65e0b9c6b940f4b145121ed00f6116bbb77

                                                    SHA512

                                                    172da615b5b97a0c17f80ddd8d7406e278cd26afd1eb45a052cde0cb55b92febe49773b1e02cf9e9adca2f34abbaa6d7b83eaad4e08c828ef4bf26f23b95584e

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

                                                    Filesize

                                                    24KB

                                                    MD5

                                                    c594a826934b9505d591d0f7a7df80b7

                                                    SHA1

                                                    c04b8637e686f71f3fc46a29a86346ba9b04ae18

                                                    SHA256

                                                    e664eef3d68ac6336a28be033165d4780e8a5ab28f0d90df1b148ef86babb610

                                                    SHA512

                                                    04a1dfdb8ee2f5fefa101d5e3ff36e87659fd774e96aa8c5941d3353ccc268a125822cf01533c74839e5f1c54725da9cc437d3d69b88e5bf3f99caccd4d75961

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\292411b27c58504a_0

                                                    Filesize

                                                    343KB

                                                    MD5

                                                    97f584c1b23c51b82d722e6448995391

                                                    SHA1

                                                    95dbaca46f28e08fb82f0f1a34cbc74322b5b88b

                                                    SHA256

                                                    034f200254a380f6d6de6d86066f1a9d1c93e8a1482f77160c667b4b4481c4f9

                                                    SHA512

                                                    841e1fc12557732105c584cd7e7bad2611af1a97b0aa803c93556423d41f415486fe5efe6a2085e4c575e6235a6c714a59db89fd331448ba81a26ae31c318266

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2d1a60d94cb115fb_0

                                                    Filesize

                                                    289B

                                                    MD5

                                                    dfd0cddf93e4a4b9eefbfddf0d5614af

                                                    SHA1

                                                    b1936d5a25acb261b24985056a6b30285510ca1c

                                                    SHA256

                                                    d3639f4210d8a7cd969b72d95d0c14f6f2cfbed4e0d6027afaf45a3752110976

                                                    SHA512

                                                    6335331013886555845e31eef882fe40198b31f03874919a3b24689acf028f02802509795b1c292f4966494e4343f8c082f3eea0d04ad06042320055d4096c77

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                    Filesize

                                                    264B

                                                    MD5

                                                    870584295056b7684b8d46b36f20bbed

                                                    SHA1

                                                    c9ce1c65d375698f34ec7c733828199b0b1fbe90

                                                    SHA256

                                                    02cdfe90db71a255d023a17bacfd0c44adc44ae86e159a26acc48d7bfdc408be

                                                    SHA512

                                                    04644c5316645cdd57377ffa099f1f4c7c876b109df43444dd1a1a5678e7bdf6065da018e01f140d7d8b84ab9ff8b202ca31ed406d43a78282c5f5014ca53657

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                    Filesize

                                                    216B

                                                    MD5

                                                    effc24042b05895329880f98153e7d52

                                                    SHA1

                                                    a6d01977f14c7852da18dd46719738c551e27440

                                                    SHA256

                                                    39ba3880b31508bf2008bc3c79a8ac4193d87c95eecc12e7cf2b1e536393f4dc

                                                    SHA512

                                                    a141c12239a9a584f7c121d954069a0ae7e5169c26626f9ea1ac8506be63fadcc9b6f308b8326669faf91379145ad7cd5958bdce973f916d81838a1fd388b469

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                    Filesize

                                                    240B

                                                    MD5

                                                    61d70f35cd4ec146a0703824d55d0bec

                                                    SHA1

                                                    2f55b7788a21fe10887fd71854d9d014727ec7b1

                                                    SHA256

                                                    9ce5405233c3bb0d77a2eae655bf5778888164b10869fb69484301454bf1d903

                                                    SHA512

                                                    1bc20cc6b13d93364cc617a87f047cbbe3cf5feb6bc96e0099156990a15fa178681a230c930cdd833dc5265a0ca7f55ba06d04eeb2be849e5a07d70f36cea3e0

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                    Filesize

                                                    1KB

                                                    MD5

                                                    22cae9e589ba02fbd15cca74d4dbbc9d

                                                    SHA1

                                                    1414801104f96e9b504a5aeaa6ec48472c1bc036

                                                    SHA256

                                                    d7395102c3941d65f95eb0c0f22a95da14c7ccbcc24996b90ebfc1ef65fafd35

                                                    SHA512

                                                    912bdbb51681022738460d34fde4d085feb0d06ac260c2d24f011907e66161f6c995160b9108d3788b82c29fae2f48241366f49a151793938323ca9f1465a4f5

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                    Filesize

                                                    1KB

                                                    MD5

                                                    5eb5769ed00db61ff6d9434ef264f5cb

                                                    SHA1

                                                    e36089c63f3db265e24bf22d0e8348f6a71ca16c

                                                    SHA256

                                                    eb7648496967fef2ff836e771fe4296b42ac6a2c9d631d93ee872dfaa855f904

                                                    SHA512

                                                    deeb6fa6ff1d3482a3362590af681737df6965a9284362716f1187c067a4a1b36fc4f6cf9a854930fffb66dec90434d500b1fb6d8dfca8e00071a12dcc037c83

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                    Filesize

                                                    6KB

                                                    MD5

                                                    978c2ab83f5a314f58528fa6f3d1b4e4

                                                    SHA1

                                                    a3108ad618924488f85b0dc0918051d1a27f137b

                                                    SHA256

                                                    3b97d629fd3905b08c7b94cfdfe139a5c7d9784ca6162a6dba10733a36723bae

                                                    SHA512

                                                    9154eea3966299c89e7d94b085ec558c71fc64bc3113211c1d2989092f3775392359b449585b3274416749bd05beae458d0edd4163e0e43af5de283b4a5ae570

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                    Filesize

                                                    7KB

                                                    MD5

                                                    d31924bf91ac229d3b32d0f407bd4f26

                                                    SHA1

                                                    4cb0ebe75ae49c1f6a66b288b5a6e135c65818fd

                                                    SHA256

                                                    ce014bc0d433164021f63dfd62671618b9b88d647ec1beb0941af146e4e8d711

                                                    SHA512

                                                    713ce3e5e9186eb13bb72bc84b4be9e39e91c29e2eff75957d23816148806e9c50889fae955ab425c5872bf326789546b7b10c9a01217b8eda91842f51917588

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                    Filesize

                                                    6KB

                                                    MD5

                                                    1ccfd5ba6a3bf3b5c1318076472ee3a7

                                                    SHA1

                                                    ade43e5902cb6dbb844fea2c5c088658b3c2fbf5

                                                    SHA256

                                                    762c581210307261d9380ea36a70eec13359ce88bcf38698c53a6b4f3d6ee9f9

                                                    SHA512

                                                    119e7948c06cf66d84fcaa1307e72b03103a134df7a23652d45e76cf8bd648cbd1ee3e09f69d97afa1aaa6d7d2059003d4e7e2222a48a7f9035f23258bafa25c

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                    Filesize

                                                    6KB

                                                    MD5

                                                    13a3c281ce1fbf332a86a8a8e3c90798

                                                    SHA1

                                                    a88d2e5f41ade84bb80d3a9a07f90ec0be4d3d53

                                                    SHA256

                                                    c597f5da7bbb11a78a7ca510c53f173ac0c8e39ed618a5a2d5ebffbda9ac0af6

                                                    SHA512

                                                    81a989907339a97418ada8a14c995f66be6deec9c84fadc22110c6ce3adfdeadbcd1499d9d0bba7bbbe0ba58f157b046aed84aa2d37cc9b27b3b730f639cc1cd

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                    Filesize

                                                    7KB

                                                    MD5

                                                    3bd5a40e5682eb8904681ac963f91c2a

                                                    SHA1

                                                    92082ef1a4edee1fc880fd5fb19bbc70ba769112

                                                    SHA256

                                                    57f8c98f6285dfa399341079437fd1ce87d403b57eb78a86e9241b767852358d

                                                    SHA512

                                                    bbe5403a145ca1cefa867e98e3b22bf0f250491a9d1e64903aee97cc5fb72cb92d2cd552aa501555a922b375793d98c1d739a23e503fa2113228b8dcf7aba52f

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                    Filesize

                                                    366B

                                                    MD5

                                                    807a08bc5d6b4aa7396751f205d0870f

                                                    SHA1

                                                    815a58d072411deba9c015f9e24ed05ed98bce60

                                                    SHA256

                                                    577e34bfa04ca631828811725a52cef00bf5ca7feb1903c6ac5578b96c502c05

                                                    SHA512

                                                    c6cdc42dcb1105c64a36df846825d37e9c1ca1c9fbf0c5fa9e68b83f717eb307d651ff3ef07f6e86a8e69da18757732a5e77770a6084dd1f3f26547d77cd33fe

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                    Filesize

                                                    366B

                                                    MD5

                                                    9b2bc88aa941f89aa21b61e1aa33642b

                                                    SHA1

                                                    62b554083d1ed299ace29598ec1c95b3772b60e9

                                                    SHA256

                                                    348a0a13bc670611bc235e54e6abf38b90c49257d1de38d5bc2ce6a9c5b80ac3

                                                    SHA512

                                                    0edddac928f6a04d8fb699998711818164be72c3d7d380aa3df3ac67b413f7e6833d2ae29ac95bcea3edf655ad07390366f73936272129db98d70eaf58b9aa87

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580c40.TMP

                                                    Filesize

                                                    366B

                                                    MD5

                                                    aac8d474c57823d1b2fd42f1d6fbb14b

                                                    SHA1

                                                    c903ad3bdd6b77a9e1a75b4d98cd86bbed331aa0

                                                    SHA256

                                                    f8a3bc3c08edcf76f0b19db6c487ebd9affc0ef692024be843af1deed81b5eb1

                                                    SHA512

                                                    63f12655772a9aa6ec2950f75e240479e6124b01632b6459b67e0d74317333b9f4d0693a68480bce5cb76329732ddc651995aa17494427ed065366eddeb28268

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                    Filesize

                                                    16B

                                                    MD5

                                                    6752a1d65b201c13b62ea44016eb221f

                                                    SHA1

                                                    58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                    SHA256

                                                    0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                    SHA512

                                                    9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                    Filesize

                                                    11KB

                                                    MD5

                                                    cda2dbbbb4504be96b2a66e9bad4f23c

                                                    SHA1

                                                    876f6d5cb9b0671d01c5bd7b59a54f071b3ce06e

                                                    SHA256

                                                    c1682eb732369593d07fdbe7293b469934230f84a72980733d671dd1180f5ea9

                                                    SHA512

                                                    3f7adcd3a55410f8d14742634f9585f4e449051c1d8e7611101773bbb83cd7fc94f7b5949f15dd98d86e300f0e8fec251639d4d49bdaaf45f68ae366279a8d4b

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                    Filesize

                                                    11KB

                                                    MD5

                                                    fc2d114b077374efb9f1d9b4bbd2bae8

                                                    SHA1

                                                    afca9844c117a3d7a9473ff899462011acfd0ca8

                                                    SHA256

                                                    9d3e3f457ab9c860b5e4af15ae51fc3af4047ff71baf90c476386fb701a946c2

                                                    SHA512

                                                    00a708d76340243547734de0d7ff0da1ce53802effa5e5c3f80f4143c5bf3baf26597b2aeb45b4af7cee53636f64d99b8f45385844c68d0b2c83981b7529feb5

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                    Filesize

                                                    11KB

                                                    MD5

                                                    16c7df35326848b53538d0a65149a399

                                                    SHA1

                                                    98af21bd3219ee42df6681887a0775479af4845b

                                                    SHA256

                                                    9d8295b93914e85e2f6cde507908914b829f929157eb9f5459fd93c3c39032fc

                                                    SHA512

                                                    844fb55963bf7471d41ea3b427cf0a2082f4c0b8719cef17068457b82b5ecd5882d510996c8d08570f5504029a5aebc6bfc2f53555812c8f03fde1bc0fbfa45e

                                                  • C:\Users\Admin\Downloads\Unconfirmed 696966.crdownload

                                                    Filesize

                                                    3.8MB

                                                    MD5

                                                    46c17c999744470b689331f41eab7df1

                                                    SHA1

                                                    b8a63127df6a87d333061c622220d6d70ed80f7c

                                                    SHA256

                                                    c5b5def1c8882b702b6b25cbd94461c737bc151366d2d9eba5006c04886bfc9a

                                                    SHA512

                                                    4b02a3e85b699f62df1b4fe752c4dee08cfabc9b8bb316bc39b854bd5187fc602943a95788ec680c7d3dc2c26ad882e69c0740294bd6cb3b32cdcd165a9441b6

                                                  • C:\Users\Admin\Downloads\winrar-x64-701.exe:Zone.Identifier

                                                    Filesize

                                                    26B

                                                    MD5

                                                    fbccf14d504b7b2dbcb5a5bda75bd93b

                                                    SHA1

                                                    d59fc84cdd5217c6cf74785703655f78da6b582b

                                                    SHA256

                                                    eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

                                                    SHA512

                                                    aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98