Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    56s
  • max time network
    57s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20250113-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    25/01/2025, 18:46

General

  • Target

    https://gofile.io/d/2y9gR8

Malware Config

Extracted

Family

xenorat

C2

127.0.0.1

Mutex

Xeno_rat_nd8912d

Attributes
  • delay

    5000

  • install_path

    appdata

  • port

    4444

  • startup_name

    Security HELP

Signatures

  • Detect XenoRat Payload 2 IoCs
  • XenorRat

    XenorRat is a remote access trojan written in C#.

  • Xenorat family
  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 2 IoCs
  • NTFS ADS 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 37 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://gofile.io/d/2y9gR8
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3592
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7fff11c546f8,0x7fff11c54708,0x7fff11c54718
      2⤵
        PID:4704
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,16557039312995280060,95670865701996236,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
        2⤵
          PID:4652
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,16557039312995280060,95670865701996236,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 /prefetch:3
          2⤵
          • Downloads MZ/PE file
          • Suspicious behavior: EnumeratesProcesses
          PID:2876
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,16557039312995280060,95670865701996236,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
          2⤵
            PID:5040
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16557039312995280060,95670865701996236,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
            2⤵
              PID:3844
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16557039312995280060,95670865701996236,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
              2⤵
                PID:2304
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16557039312995280060,95670865701996236,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
                2⤵
                  PID:2456
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,16557039312995280060,95670865701996236,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
                  2⤵
                    PID:4428
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
                    2⤵
                    • Drops file in Program Files directory
                    PID:684
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff6b2965460,0x7ff6b2965470,0x7ff6b2965480
                      3⤵
                        PID:1220
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,16557039312995280060,95670865701996236,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2552
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16557039312995280060,95670865701996236,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
                      2⤵
                        PID:4116
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16557039312995280060,95670865701996236,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
                        2⤵
                          PID:1852
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2100,16557039312995280060,95670865701996236,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5376 /prefetch:8
                          2⤵
                            PID:1996
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,16557039312995280060,95670865701996236,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4780 /prefetch:8
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:3000
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2100,16557039312995280060,95670865701996236,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4840 /prefetch:8
                            2⤵
                              PID:3792
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16557039312995280060,95670865701996236,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6524 /prefetch:1
                              2⤵
                                PID:5948
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16557039312995280060,95670865701996236,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
                                2⤵
                                  PID:5956
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:5076
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:4412
                                  • C:\Windows\System32\rundll32.exe
                                    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                    1⤵
                                      PID:1080
                                    • C:\Users\Admin\Downloads\client.exe
                                      "C:\Users\Admin\Downloads\client.exe"
                                      1⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • NTFS ADS
                                      PID:3804
                                      • C:\Users\Admin\AppData\Roaming\XenoManager\client.exe
                                        "C:\Users\Admin\AppData\Roaming\XenoManager\client.exe"
                                        2⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        PID:5300
                                        • C:\Windows\SysWOW64\schtasks.exe
                                          "schtasks.exe" /Create /TN "Security HELP" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEF03.tmp" /F
                                          3⤵
                                          • System Location Discovery: System Language Discovery
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:5380
                                    • C:\Windows\system32\taskmgr.exe
                                      "C:\Windows\system32\taskmgr.exe" /4
                                      1⤵
                                      • Checks SCSI registry key(s)
                                      • Checks processor information in registry
                                      • Modifies registry class
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of FindShellTrayWindow
                                      • Suspicious use of SendNotifyMessage
                                      PID:5440

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\client.exe.log

                                      Filesize

                                      226B

                                      MD5

                                      66aea5e724c4a224d092067c3381783b

                                      SHA1

                                      ee3cc64c4370a255391bdfeef2883d5b7a6e6230

                                      SHA256

                                      04b17cab961f973464bba8924f764edef6451d1774f2405d27ef33d164296923

                                      SHA512

                                      5d719e303f491d1443cb7c7e8946481e90532522a422c98f82466e1eddcd1ef24a4505dcbf75f2191fbb66825d3550566d7f408a3854edeb4c1a192c8c9a6d06

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2622ccb9-613f-47c2-aac0-45fca374b9b0.tmp

                                      Filesize

                                      8KB

                                      MD5

                                      75c84f4d8853e0ed2dec0f1f33a51600

                                      SHA1

                                      82b48ac11a9a895b2df1034d82cea3933a84f802

                                      SHA256

                                      154e0ba34ecab40daea62eca506ad0217ba209d34486359469c3630bb3a9de20

                                      SHA512

                                      108459f454085f13b82be6a345bf8eedb0f13d5aaf09664099dd2fa53b99221106e31588ba9815d3673de9f1516160577b15a6a0e8047c4ba04ecd19b3c55ed2

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      ce3b1f686fe1099f127abf8bb0a6ebd1

                                      SHA1

                                      0d73154910ba712114a54da4a70e1f2fd6af7911

                                      SHA256

                                      ba6fb4f1587708c5b12d41d181d5c0bd794a0a0acdca7b70c7538398ed3f07df

                                      SHA512

                                      aa39919330e2261df585ab526c1dee495a7404f361f0f8f6856c18d38cb5468d463d5135b339d379bfbe39e789a8d994064f845f690cd9ed2c29c780e4aab622

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      2dbb5524aa1aa51fb09065a1fffbc8eb

                                      SHA1

                                      931698f70968b05802e3f1caf59ef833cb49717c

                                      SHA256

                                      98be2d6ca5623fbc27ef9701448face11d39e85297489d63569b40f38ad07404

                                      SHA512

                                      2e80c69ebdb363d3deb8ce8a36f4f582450e932b039f71fb1a2b0a94458add2c978e122b98633430db51125be2e60d746aa88e1fbd0be38434de0784cd685316

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      48B

                                      MD5

                                      04d8954fbd139d5eccff41fdd5c223e2

                                      SHA1

                                      9a9236533cf8e53f28bc2fde2cf4c286bd2adc1d

                                      SHA256

                                      cecfbd9c9141f2449f8497343709e4b69ce21632085d4685dac7e2ea697badd9

                                      SHA512

                                      865bb3ea6bae435f957127cd6ba61bf7c7d0f16a7a443bbe27c856234ab232eabccde48e83f39ec2b832069bd3435923486665e9485ff3dd223b121dd9d5219b

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      144B

                                      MD5

                                      0627edb39a4567730400bfd0cbfc98cc

                                      SHA1

                                      d3634f2faba37eaa97d159cbf99219752e75f22a

                                      SHA256

                                      58b05e6f2ded94ea91bdd0c5f8c9f7ac55d66e86e24aa4d147557675cd2aabe8

                                      SHA512

                                      bdb5527050171173c4436b449800e9c58d1e50bd0076307521c6d7d70be6c0f2a8c2d4c398f4519261be6f663b60542b9d174e0cafd3d9d764cc30ace327619c

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

                                      Filesize

                                      70KB

                                      MD5

                                      e5e3377341056643b0494b6842c0b544

                                      SHA1

                                      d53fd8e256ec9d5cef8ef5387872e544a2df9108

                                      SHA256

                                      e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

                                      SHA512

                                      83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      5KB

                                      MD5

                                      82837e230d1fbd319ba85960ef4c0ffb

                                      SHA1

                                      d3691139b21f2404410e77738857ae5f3b15e21f

                                      SHA256

                                      a04a4c11f1f0a8cfc51d5ad197996308d06362447e39e691e9256e7ef05f2073

                                      SHA512

                                      11c05515ba984f02307093832452e02e3bcb013bebb70d2939d91d51e5d9b0442930b7b56cdd3584bf06c039828015c6c8c297252c9272cbec63a030d4fa0801

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      5KB

                                      MD5

                                      e6dfa77234b6c74988a8542de0c2a884

                                      SHA1

                                      9c2c1ff78d70289053d90c268bd13b277b37996b

                                      SHA256

                                      6dedd10663f0eb536ed824f30f1dbc1331b4f18ff407b2ca2f0e9e70e1bb791d

                                      SHA512

                                      22facb9e3d71bc65cca12374301f15197252b48f7294a436da08cf8aa1cf317503549ac753625b0edda662f71fd333b1b91e1ea972157387783fe3fe02b60c09

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      5KB

                                      MD5

                                      d7f72b93997ad332967f02305dc19872

                                      SHA1

                                      ae4275f8a52690481783e3d3764cc47b74f312d4

                                      SHA256

                                      8e35fb13d6ee82ddbc56990df8347ca3a693a173a5986ba71018b4750fe72408

                                      SHA512

                                      b1dc85abbc19e19ca2e0f38f1115652402adf37ade17b3e3aebbba218e7e55661cffef6f39fb4969c2afe0488c7fe054bdc1eea91e27141b090cc2a81c0a37d4

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      5KB

                                      MD5

                                      7c392d6afee9ba733f24ed68229d6a39

                                      SHA1

                                      29ee95f679d3fa97999a1c80e341d6ae8f63c2f7

                                      SHA256

                                      9451d4f4f31b02ddb205e9ef50404630904cbaaeca748bdc62ba12cc97478d48

                                      SHA512

                                      7ed2b4e846718049f0d43c2f9bcca0b46aa37dfb44111b450caf0ecb5949b676099ada360711f8c20d4571cfc768a204ad9e1331f1682ef60c46747ec4283fd5

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                      Filesize

                                      24KB

                                      MD5

                                      b34b4baff340a3f6eefe8505fc27e7e7

                                      SHA1

                                      4d1b936588dd1eb659511606f7ae37b4b788bd8d

                                      SHA256

                                      333804cf5fe67abc2dcbfc59e065200af4843e64bf4e6b2cd3fe0ec93fff182d

                                      SHA512

                                      4821914745f500999afc00a979cb251ee9bb08b96501ab8eade9f75565565d568b24422661c81a1b136017151ded5192fc5575990215d1c8f7783e1a9be45257

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                      Filesize

                                      24KB

                                      MD5

                                      5614b3ff8da92c0262de324b43eb81b9

                                      SHA1

                                      d313dd6760e336a522ba05f3918e9aa4d8bb0a11

                                      SHA256

                                      4f9380552bf22ef4ed93687f44b76aee52c56dcb373c6c3fe5613f6370100275

                                      SHA512

                                      61957fa440c545bc3c83e2579f14fbc4945377c2df935bfb1ff2a71361ca8effd821418b3d6a64005038741837ed4fbf0a55101d9d1f69ed0881d9ed28a57954

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                      Filesize

                                      16B

                                      MD5

                                      206702161f94c5cd39fadd03f4014d98

                                      SHA1

                                      bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                      SHA256

                                      1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                      SHA512

                                      0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

                                      Filesize

                                      16B

                                      MD5

                                      46295cac801e5d4857d09837238a6394

                                      SHA1

                                      44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                      SHA256

                                      0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                      SHA512

                                      8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

                                      Filesize

                                      41B

                                      MD5

                                      5af87dfd673ba2115e2fcf5cfdb727ab

                                      SHA1

                                      d5b5bbf396dc291274584ef71f444f420b6056f1

                                      SHA256

                                      f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                      SHA512

                                      de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      10KB

                                      MD5

                                      3c95598c9d435814dc424f0158c6261f

                                      SHA1

                                      35016f34d5b6181be61a64c12a1a565ed58e7276

                                      SHA256

                                      290c12ddc68a123e2334645e9e786fe1364529b1d99d893576e6643135d4a3ed

                                      SHA512

                                      7057d038966c208ee8793bc498e521f161d19d55357c268745555f6c1cffbb47151c643ba96168b7f03e57e860b3639e7a86653f3bf6883ad2183a88c0285ce6

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      10KB

                                      MD5

                                      e14ac05e33f049871621f9c895bd7b8e

                                      SHA1

                                      7ca793780d0cc7d1cbcf9cd9ff1564fe09430276

                                      SHA256

                                      64a19e625a0376b0716a9171240f1c8e83fc7327fabd9697c753053be7f2a016

                                      SHA512

                                      81c9e2f1b84b075e1577727b163bc9e87e11facc863753204fa71b7eeb9cacbfddf7b89ebe5b32f673a2af9ecadae838fdf6359926efa8b0dc64c59edaacc8dc

                                    • C:\Users\Admin\AppData\Local\Temp\tmpEF03.tmp

                                      Filesize

                                      1KB

                                      MD5

                                      fdd36139980f5cbfef3360123665b96c

                                      SHA1

                                      faf5353ca339065426642578c3913906e892becf

                                      SHA256

                                      ff95b1308fc4294f5d6dcb0c171633387d81b4f2efda617292eb784615b17bed

                                      SHA512

                                      2ab91e7733c16300feda4efa61cc11baf21245f85c4cccd08e92c5fd61cfa03d206ba04939362733ce26385dfd66ab4524cd1a0da2c779a7e0ce9d00b4e5e31b

                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

                                      Filesize

                                      3KB

                                      MD5

                                      fce41c71f8e8dc4116b07f720c18bcf5

                                      SHA1

                                      cd25ced95922c12b7175729b7cb01cbfcbf7a2a9

                                      SHA256

                                      795a3d2eac4d8b5833e8f983664bb67e414dbac782da1ee2315791ac367f7067

                                      SHA512

                                      4246f447866851e0e60c49eed07aab16c313d3d7b6d29e5100a33a223db5817ddd1a73235388db92acdf9e95635ab99e0ead25b4ad7a39436553c8e5b6d32f5f

                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

                                      Filesize

                                      3KB

                                      MD5

                                      ae82aef4d2c5ce64d96d5dc6b047175c

                                      SHA1

                                      d8f3ca5f930a5d9284798e7f50794a5ca618630a

                                      SHA256

                                      c1ec3775ebcc5629cdcffaf5c21b169ea201f4f5301d825e10c478516f781467

                                      SHA512

                                      e771050e1b39477bc8bacecc76e15653b637a43fa598d67e22f64bd8bd6a6bb189f5b39d8196dc4f276ed4e696499f52b40adadd8ecf414d0618e673e57fe9b2

                                    • C:\Users\Admin\Downloads\Unconfirmed 908283.crdownload

                                      Filesize

                                      45KB

                                      MD5

                                      d4731e30c74730a52c53317e723d1f8f

                                      SHA1

                                      78abe02baab00478135fbb980cbb6c19d7d7120f

                                      SHA256

                                      4e8445b92a76947f6dc52dfbe6dd77c2fe4cb32761de7c9b8e292a8c83930312

                                      SHA512

                                      474bb63e8ccf353c68ca703630ab721899c6363b57cef296e1b3447f5761d85efc66886dbf79a050b40a8d0c57f4b880dc909fee73bcd3b2762c7066fb83eb60

                                    • memory/3804-227-0x0000000000510000-0x0000000000522000-memory.dmp

                                      Filesize

                                      72KB

                                    • memory/5440-257-0x00000167FF580000-0x00000167FF581000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/5440-254-0x00000167FF580000-0x00000167FF581000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/5440-246-0x00000167FF580000-0x00000167FF581000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/5440-256-0x00000167FF580000-0x00000167FF581000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/5440-255-0x00000167FF580000-0x00000167FF581000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/5440-253-0x00000167FF580000-0x00000167FF581000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/5440-252-0x00000167FF580000-0x00000167FF581000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/5440-251-0x00000167FF580000-0x00000167FF581000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/5440-247-0x00000167FF580000-0x00000167FF581000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/5440-245-0x00000167FF580000-0x00000167FF581000-memory.dmp

                                      Filesize

                                      4KB