Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    130s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/02/2025, 04:39

General

  • Target

    https://github.com/RatterOf/NitroGenV2/blob/main/NitroGen(Made%20By%20Merk)-%20thanks%20for%205k%20subs.exe

Malware Config

Extracted

Family

xenorat

C2

127.0.0.1

Mutex

Xeno_rat_nd8912d

Attributes
  • delay

    5000

  • install_path

    nothingset

  • port

    4444

  • startup_name

    nothingset

Signatures

  • Detect XenoRat Payload 2 IoCs
  • XenorRat

    XenorRat is a remote access trojan written in C#.

  • Xenorat family
  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs
  • Suspicious use of FindShellTrayWindow 37 IoCs
  • Suspicious use of SendNotifyMessage 26 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/RatterOf/NitroGenV2/blob/main/NitroGen(Made%20By%20Merk)-%20thanks%20for%205k%20subs.exe
    1⤵
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3864
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdf3f646f8,0x7ffdf3f64708,0x7ffdf3f64718
      2⤵
        PID:2416
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,13966153858046072134,7277527967789948402,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
        2⤵
          PID:4376
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,13966153858046072134,7277527967789948402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
          2⤵
          • Downloads MZ/PE file
          • Suspicious behavior: EnumeratesProcesses
          PID:4732
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,13966153858046072134,7277527967789948402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
          2⤵
            PID:116
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13966153858046072134,7277527967789948402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
            2⤵
              PID:4812
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13966153858046072134,7277527967789948402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
              2⤵
                PID:1836
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,13966153858046072134,7277527967789948402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 /prefetch:8
                2⤵
                  PID:4660
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,13966153858046072134,7277527967789948402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:812
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2148,13966153858046072134,7277527967789948402,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4872 /prefetch:8
                  2⤵
                    PID:4200
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13966153858046072134,7277527967789948402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
                    2⤵
                      PID:3716
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2148,13966153858046072134,7277527967789948402,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6044 /prefetch:8
                      2⤵
                        PID:2572
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13966153858046072134,7277527967789948402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
                        2⤵
                          PID:4404
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13966153858046072134,7277527967789948402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
                          2⤵
                            PID:4220
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13966153858046072134,7277527967789948402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
                            2⤵
                              PID:2360
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13966153858046072134,7277527967789948402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
                              2⤵
                                PID:1912
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13966153858046072134,7277527967789948402,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
                                2⤵
                                  PID:5076
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13966153858046072134,7277527967789948402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:1
                                  2⤵
                                    PID:1228
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13966153858046072134,7277527967789948402,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
                                    2⤵
                                      PID:5060
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13966153858046072134,7277527967789948402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
                                      2⤵
                                        PID:544
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13966153858046072134,7277527967789948402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
                                        2⤵
                                          PID:2300
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13966153858046072134,7277527967789948402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
                                          2⤵
                                            PID:1652
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13966153858046072134,7277527967789948402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6272 /prefetch:1
                                            2⤵
                                              PID:1556
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13966153858046072134,7277527967789948402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2232 /prefetch:1
                                              2⤵
                                                PID:3240
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13966153858046072134,7277527967789948402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
                                                2⤵
                                                  PID:1668
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2148,13966153858046072134,7277527967789948402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6020 /prefetch:8
                                                  2⤵
                                                  • Modifies registry class
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:808
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13966153858046072134,7277527967789948402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4224 /prefetch:1
                                                  2⤵
                                                    PID:5016
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2148,13966153858046072134,7277527967789948402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
                                                    2⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:4504
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2148,13966153858046072134,7277527967789948402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6040 /prefetch:8
                                                    2⤵
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:2316
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,13966153858046072134,7277527967789948402,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4932 /prefetch:2
                                                    2⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:3212
                                                • C:\Windows\System32\CompPkgSrv.exe
                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                  1⤵
                                                    PID:4924
                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                    1⤵
                                                      PID:4928
                                                    • C:\Windows\System32\rundll32.exe
                                                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                      1⤵
                                                        PID:4068
                                                      • C:\Users\Admin\Downloads\NitroGen(Made By Merk)- thanks for 5k subs.exe
                                                        "C:\Users\Admin\Downloads\NitroGen(Made By Merk)- thanks for 5k subs.exe"
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        PID:3536

                                                      Network

                                                      MITRE ATT&CK Enterprise v15

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                        Filesize

                                                        152B

                                                        MD5

                                                        a7b5a5433fe76697fec05973806a648c

                                                        SHA1

                                                        786027abe836d4d8ff674c463e5bb02c4a957b70

                                                        SHA256

                                                        c8d623536ebdf5ffbefb84013d1c8ff5f853b59f1b09c80364c32b8ed5e4a735

                                                        SHA512

                                                        27be4c82e26468bbb9ce698ef305320f6cac46c953f88c714a0372fa524d098b9af2a87a88b14a134ff0f5f4b3d671902908622d2c7ec48e2c7bc458d7f5cc16

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                        Filesize

                                                        152B

                                                        MD5

                                                        8ea156392347ae1e43bf6f4c7b7bc6ec

                                                        SHA1

                                                        7e1230dd6103043d1c5d9984384f93dab02500a6

                                                        SHA256

                                                        40b28bf59b3e2026ad3ebe2fecf464a03d7094fd9b26292477ad264d4efc1c75

                                                        SHA512

                                                        2479b86a9a31aa2f260ff6a1c963691994242ced728a27ffa2ee4e224945446a191bdb49ce399ec5a7d5d362499716133072e97d4253b5b4f09582d58b25144f

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                        Filesize

                                                        2KB

                                                        MD5

                                                        6a222ee07ec174c1a23e6f6a2c43ede8

                                                        SHA1

                                                        e72a25cadd1a891c357659ce951d44446865e3b9

                                                        SHA256

                                                        800123a929263166967d946f1fca5e94d7bcec002be60031f1aa57b81a786b4c

                                                        SHA512

                                                        95494f27521968bbd2c7525fb8b7a78b44e941fc52d58dba6d664fbee16ee2b2605e9e3661f5fa4689381a62962eb77f46ad1afe0f1a14087a2d7fb92d072b12

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                        Filesize

                                                        3KB

                                                        MD5

                                                        02e23482447977aa78f8a14d79e020fb

                                                        SHA1

                                                        b97f9f077cc9416ea91aaa0b035ac550ec3feba9

                                                        SHA256

                                                        bcb18ae360f3ce46fbb4e48b45da9a01f9d68a83ca516e0f5fa4d8e2c8095b1c

                                                        SHA512

                                                        aca7742545db7576c40b1936e81df145894309733727884bdcf1bba0405af5f5229e5b7dc3c67694407a3d9441dc6285d76ec294f2a27e42078f113675e76434

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                        Filesize

                                                        2KB

                                                        MD5

                                                        d4b5da9d3ce04940cc14396e7ddb6468

                                                        SHA1

                                                        71ad350406114be78850fbf1eec1b4810d730ac2

                                                        SHA256

                                                        67511951994f652a6497a7c1ba490f4d724d98e46b5292010d9c096291ca1e04

                                                        SHA512

                                                        e234c858881eaed17c81f144596e2df5212fa0033afa0051c38d602755dea7c888f6214708d527077a0fd7b1fabe5ecc0cb76dffebdefe4e409a379a968fa700

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                        Filesize

                                                        6KB

                                                        MD5

                                                        5e82261cd99a541a6b4018649ade07f7

                                                        SHA1

                                                        904d9fa20449d3c4f8ae84603a1f3d55932b77e4

                                                        SHA256

                                                        11a0e8ec373b444014e5e13ff06669010db8cff6d53d8f11fc9e058f1b85c59c

                                                        SHA512

                                                        591937714fe04457dbf9e3014d7bb274a28976c6e45b3cd5d6314b7f7dba7893e7df390ab7ef293156429b631397cbcf0ae152e8f5257d8757001b81af2a906e

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                        Filesize

                                                        6KB

                                                        MD5

                                                        c8e980ecd5f71c2f69bcb5de2af2f09e

                                                        SHA1

                                                        f8c99640cafbb26205e1265bd80f746a12c56a30

                                                        SHA256

                                                        e7c486811b2412438509423a9296c616e4f286c4597e1f38ce1272a159013c37

                                                        SHA512

                                                        fdc27a2bc30f10388ec964483e29db8000cf3d2e298a36a7350f8f746f1a8889ded0b2fa69902a80ab41c961345457e4f8e0ef784a345a0a22d7f39f4ab39e2a

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                        Filesize

                                                        7KB

                                                        MD5

                                                        d847a513176f8e2654eda011441dde90

                                                        SHA1

                                                        66821da1d568b216eb681c9f111a6b9e5a27d27c

                                                        SHA256

                                                        086f14489ad0a083749c348adb252d5b83d7e4421e4ddd6d1ac44950fd7e124b

                                                        SHA512

                                                        3dfd2db1bd1fbdbf8139458cfe1321e17275a21291e339d88d155bc37df0e2e8a401114c78110dbc5962604c8f610d2caca4b985a3699d8628afdcd8f29bcf7a

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                        Filesize

                                                        8KB

                                                        MD5

                                                        1ac7df27656e3384a78d5006e7ec7183

                                                        SHA1

                                                        45afa67b4191ee5513aeecf730eadc12171a4559

                                                        SHA256

                                                        c8a4abaaf09000ab8f7afbce15ec114617eb424466f1ca3a6e960bfa23e196b0

                                                        SHA512

                                                        bba9183027d20e88e8737afd489d922598d338456b6f87df86990909b51d29521a7a3183c5fd7c29d8fff2aaec0d2fd6f7b4b7ba15dd6c8a4fe91df240b04af6

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                        Filesize

                                                        1KB

                                                        MD5

                                                        a315e60500a30df8e6bd830a23f29012

                                                        SHA1

                                                        8f1cc628857d9ec3c286508a89860fa59d9c7452

                                                        SHA256

                                                        1824aa2bedd658d59ec40c199f6cd56f2e2a14e1745e8ea390fb7321f28e0f9e

                                                        SHA512

                                                        9187ba172351a08c72148cb086a7e6a22a996d15978d7b3aedc3c696a176d975cece0cfb2330b92181cc06300464ea9442d6e26d64382bf6504f22473a656e14

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                        Filesize

                                                        1KB

                                                        MD5

                                                        2346dc8ad3b00e12c8188a75d76bdfb1

                                                        SHA1

                                                        b599712e698be1063f607a7d26b304f440a49cca

                                                        SHA256

                                                        8b23dfbf0e8b3ccea7fb0e268891179326ca05594db01a4815b73d6451711eb2

                                                        SHA512

                                                        83efeaffdfef5850156979a98cfc4c30dea6fe36b090820744e17514aa6415be26f95654c3cfa212d1b730099a0085b4988174d67723fbac6fc6f91c8cb269f3

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581921.TMP

                                                        Filesize

                                                        1KB

                                                        MD5

                                                        15a4997032ab583e4133f68586a79f6c

                                                        SHA1

                                                        8d02707feae9068db2b71d37a7eaca30a90bdc05

                                                        SHA256

                                                        08d1ede1842e0e913f855f5e7a15baf2476cb09ebbc7f352b18566ece82a3cf3

                                                        SHA512

                                                        ef5f917434beba1e2ff2ed9423723d077f455779dcd1c67ab06b85087a5223087a0b76bd9a346a1206b5e0dd465e25bef86757430e31fac947692290f7a1f932

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                        Filesize

                                                        16B

                                                        MD5

                                                        6752a1d65b201c13b62ea44016eb221f

                                                        SHA1

                                                        58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                        SHA256

                                                        0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                        SHA512

                                                        9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                        Filesize

                                                        11KB

                                                        MD5

                                                        a254f038641d45b40fd2e34a8246ec66

                                                        SHA1

                                                        39d11aacc6ec03efcf04345872da38c98adbf2ce

                                                        SHA256

                                                        f0f6ec892dc29d7b66bcf5ccc84251e15c950c8b928f108633e64ddbef9de4e4

                                                        SHA512

                                                        0f965bc3b350875aa303ed4e151e8b9b5fdd588d3e1496d08ce0e3b5b34ce9bef8afd394fa5eb0ae67bacfd8b097b6659881cb02e91a358a192bcd10c944d9b8

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                        Filesize

                                                        11KB

                                                        MD5

                                                        1f91f4ff501df29f4afa9bb7b46d2496

                                                        SHA1

                                                        c9a66168ca75cfba3e16d9da7a021464ed96cc6c

                                                        SHA256

                                                        6a422f0b86a12b41bb3b6a6ed9130415586086c4dc5f3b260d99a293fa24f5ec

                                                        SHA512

                                                        b64a85e99c469bb6d70e5a3d7d33305c2d5ea989699b3829619d377d3194fcdf422359b8b1acfd22ec58c27ebb32d80689e2fd31607d9521a02ff968914f30af

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                        Filesize

                                                        11KB

                                                        MD5

                                                        bd84e24f86ee83485ef4405cae48ae31

                                                        SHA1

                                                        e6fa3dcf25a8e62c6bfa34b2608cbd20a832ad5c

                                                        SHA256

                                                        c4758d72b071b473cc3c9fe4b770ae0337b590d8a5739bf896b5f5b8d6a3afd8

                                                        SHA512

                                                        81ef84e308023940a95cd46de88328fb52e506690f5c951c56e13eae9274edcddab955d7b9d4fccbb4efaf27c65ea99697f3b9ffd5c133749345af541c2e066f

                                                      • C:\Users\Admin\Downloads\Unconfirmed 942186.crdownload

                                                        Filesize

                                                        45KB

                                                        MD5

                                                        716e951d8dc72d80f48431a3e039b4dd

                                                        SHA1

                                                        f6030cefeb22031de5f2bc17c2a65252b88ab0db

                                                        SHA256

                                                        4720b9e1aae0cbf9ddd1a4c1ebb486aee2c73bca6eba0efd0d3b462353c2ea52

                                                        SHA512

                                                        d81f1a55a99c92750637d226525664004ecd6956e0eeaae280dbb0007a12feac14b0a64f0fea7e0cf771837cec7dc80d8920cb5c136ed1258185bb8826c9286f

                                                      • memory/3536-445-0x0000000000F30000-0x0000000000F42000-memory.dmp

                                                        Filesize

                                                        72KB