Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

23/03/2025, 00:07

250323-aejphstxdx 8

23/03/2025, 00:06

250323-adrzhaxqz8 8

23/03/2025, 00:05

250323-adkkestxbw 3

23/03/2025, 00:02

250323-abxrzaxqw9 10

20/03/2025, 23:27

250320-3fd5mstrw6 10

01/03/2025, 19:51

250301-ykw4sszqy9 8

01/03/2025, 19:50

250301-yj8ffazqx8 8

01/03/2025, 19:47

250301-yh1dfazxev 8

01/03/2025, 19:45

250301-yghr1azp15 10

26/02/2025, 02:07

250226-ckdrka1m15 10

Analysis

  • max time kernel
    46s
  • max time network
    53s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/03/2025, 00:07

General

  • Target

    https://github.com/Da2dalus/The-MALWARE-Repo

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2476
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x2bc,0x7ff97db3f208,0x7ff97db3f214,0x7ff97db3f220
      2⤵
        PID:4392
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1792,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
        2⤵
        • Downloads MZ/PE file
        PID:4464
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2244,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
        2⤵
          PID:936
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2624,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:8
          2⤵
            PID:1904
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3496,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
            2⤵
              PID:1608
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3504,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
              2⤵
                PID:1084
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4284,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
                2⤵
                  PID:4376
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4228,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
                  2⤵
                    PID:3300
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5288,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
                    2⤵
                      PID:3244
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5256,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
                      2⤵
                        PID:3340
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5588,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:8
                        2⤵
                          PID:4568
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3484,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:8
                          2⤵
                            PID:5072
                          • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5328,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:8
                            2⤵
                              PID:2684
                            • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5328,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:8
                              2⤵
                                PID:5080
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6232,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
                                2⤵
                                  PID:1868
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6380,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
                                  2⤵
                                    PID:1148
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3660,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
                                    2⤵
                                      PID:5088
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4380,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
                                      2⤵
                                        PID:1912
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5064,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:8
                                        2⤵
                                          PID:5144
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6604,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:8
                                          2⤵
                                            PID:5152
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6588,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:8
                                            2⤵
                                              PID:5304
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7148,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:8
                                              2⤵
                                                PID:5608
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7192,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=7248 /prefetch:8
                                                2⤵
                                                  PID:5284
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=7288,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:1
                                                  2⤵
                                                    PID:5280
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6960,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:8
                                                    2⤵
                                                      PID:5300
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6564,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:8
                                                      2⤵
                                                        PID:5344
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7200,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:8
                                                        2⤵
                                                          PID:1912
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7404,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:8
                                                          2⤵
                                                            PID:5660
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4296,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=7396 /prefetch:8
                                                            2⤵
                                                              PID:5144
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
                                                            1⤵
                                                              PID:3248
                                                            • C:\Windows\System32\rundll32.exe
                                                              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                              1⤵
                                                                PID:5836
                                                              • C:\Users\Admin\Downloads\MistInstaller.exe
                                                                "C:\Users\Admin\Downloads\MistInstaller.exe"
                                                                1⤵
                                                                • Drops file in Drivers directory
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:4516

                                                              Network

                                                              MITRE ATT&CK Enterprise v15

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                Filesize

                                                                280B

                                                                MD5

                                                                0db1d88802048ff847bfcf47035335bd

                                                                SHA1

                                                                bb54059e5b145da464f6521ae67353889ce00771

                                                                SHA256

                                                                416525d2bfeaeab0950175c0eab55ad35e84518ef5299f10565023800788cf9a

                                                                SHA512

                                                                32c5b42febdb38c3a30eb5179b8aa20a5e731b0e83aab16ec73d27b4108bfc89eb6316f71a988388cb5df19267ba823f6d0220fab5584667ba0adb0da1152a30

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                Filesize

                                                                280B

                                                                MD5

                                                                8734b4a181214bb62f91cfa36c7e2c98

                                                                SHA1

                                                                9cff323f10778a23d73ac3dcffc038d3bf661b78

                                                                SHA256

                                                                e06afe980fa56c8dad3e7c6b8d0d8f1e7eb9a4860ac715e966026fb7631c3ba5

                                                                SHA512

                                                                e8648a54da9aa24b6cba1f0377a0ce33979ea097554bb6347f252cad894ad4134e1fe839abc80eb48e2510061d5c6937e80374d32f95afd4cc8567b57694ac36

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                Filesize

                                                                5KB

                                                                MD5

                                                                9a3a8e02f39ad081ba31915e8d77c816

                                                                SHA1

                                                                2961dd96cf370e346b047bf75b425906fa7101e1

                                                                SHA256

                                                                eaef9ae37c6b564663c16c99edf4dacd1761c4fe8a0f6989eae0a1351624c140

                                                                SHA512

                                                                aa9632fd8048069b8aa0ef2358a7f3063d141ed3794fd96b67ea58f9d5c71894682434a4d78143d4b6e4aa0a4344a80f7b5ac7bf0e6387499d76c28d75fe431b

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5864c0.TMP

                                                                Filesize

                                                                3KB

                                                                MD5

                                                                218ef660fdfb636c64dcf28140cdace3

                                                                SHA1

                                                                3f92a13e266b623fc1eacdc0ffdc426df7671165

                                                                SHA256

                                                                9ad9e89917e50325a9339743bf75589988800b0020593b0bb3217a6e32b6657c

                                                                SHA512

                                                                140f11a94b8aae282da1923a485e0de28f203a74e678e0107e351640ab677f15025d9fab26568c3ccfbace703b97dec005c5d7146467facabfccb6d1ef852a83

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

                                                                Filesize

                                                                69KB

                                                                MD5

                                                                164a788f50529fc93a6077e50675c617

                                                                SHA1

                                                                c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

                                                                SHA256

                                                                b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

                                                                SHA512

                                                                ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js

                                                                Filesize

                                                                9KB

                                                                MD5

                                                                3d20584f7f6c8eac79e17cca4207fb79

                                                                SHA1

                                                                3c16dcc27ae52431c8cdd92fbaab0341524d3092

                                                                SHA256

                                                                0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643

                                                                SHA512

                                                                315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

                                                                Filesize

                                                                111B

                                                                MD5

                                                                285252a2f6327d41eab203dc2f402c67

                                                                SHA1

                                                                acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                SHA256

                                                                5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                SHA512

                                                                11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

                                                                Filesize

                                                                2B

                                                                MD5

                                                                d751713988987e9331980363e24189ce

                                                                SHA1

                                                                97d170e1550eee4afc0af065b78cda302a97674c

                                                                SHA256

                                                                4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                SHA512

                                                                b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                Filesize

                                                                14KB

                                                                MD5

                                                                80504d6ea3cf71b09c61b90172d9cabd

                                                                SHA1

                                                                a36927af65d25f14e1a40dd027b644f30a011347

                                                                SHA256

                                                                dced60d93ccaa969c54efa11d2a498e20d68866176236088dee40cb7d7f5e44d

                                                                SHA512

                                                                4dd0195408ebf0f93faf762bedfa017bc7723699109073d1ffa17016145889cb85263484362aa94cc0e377dc18531e1c7968d67f284b14f147ddf6f625f95ed3

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                Filesize

                                                                15KB

                                                                MD5

                                                                f82918233c1b7b76940b37325d57b940

                                                                SHA1

                                                                67e0f13577514a451954c7ce9501e6df6d3f08fa

                                                                SHA256

                                                                79f748d8289a9c31387cbf228daabd40f595b649367803b5920e1b524d416394

                                                                SHA512

                                                                54d4d2626d300216ac33b3f443bb89011d3ffb4a61a33cbef2ed7d4d00dc26ffbdf176564fc4704ae250151a98fac712f3ed345a5ba1aa928d563cd92ff04e82

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                Filesize

                                                                36KB

                                                                MD5

                                                                50f217811d5c69d71db20d5c32a7f98c

                                                                SHA1

                                                                af5211ba4cff1c9fd45ab6a6c016063f5dfb5648

                                                                SHA256

                                                                e641b72813bb5cae769648baec1c76ac3f4526c4942c55793107eefc4d9dd7f5

                                                                SHA512

                                                                e5c4cf8e51098bf0ce0cc15371d1e8188a30c4e4e4e1055d1486a497f8d222dfe0da222fc4286aaa768925d20cd24f26d12e9aed1e444b2fce1e9b9da3e7f0dd

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

                                                                Filesize

                                                                4KB

                                                                MD5

                                                                90cf05866477d2f21aeabbd7ed21495b

                                                                SHA1

                                                                99beb02308a133030e2b022035b913f87a26164a

                                                                SHA256

                                                                a55c874ebb8bb4966226ef767293fbefd646a582f04ac853f662ba8a4b7b4133

                                                                SHA512

                                                                374bc83fc817b79dbc41939683a200cc27c9f87abba3654ca76baea58977fe9161d6289fa8212f7fd60ff0cacb96efb72b008101f1dc626d30a8a9a60a1e5304

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                Filesize

                                                                7KB

                                                                MD5

                                                                f7d2605fa5274b3d3e8b6c0dc6e27a1e

                                                                SHA1

                                                                9df6212a9298915ba6fa947441bc484e6f9e07b5

                                                                SHA256

                                                                e6b9a6550607fb9fc137371a55e9ddf29ec3f113f2d1667ae068829f4038b1fb

                                                                SHA512

                                                                5eff31ecffb1ea786a88b2798954f6a3cb09c76612906b1a55b995eb878241fb5ef48bc25e98737ccd3740a1fb3fafa9ba11f4835eb8a8e31671e67c209bea56

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                Filesize

                                                                6KB

                                                                MD5

                                                                80ee2acaa2015220bec0063f26495c8d

                                                                SHA1

                                                                0042ba1a61a5d369439c95ab3b4eaea5092b0721

                                                                SHA256

                                                                f99972acab3300721894450a8cb11a6ed32f3d174cafc2926ff52838a4d5db7d

                                                                SHA512

                                                                396845e78fa72d9fb00d74f37092992c2ca646b210410ad532049301a98c189f593e14588278739e38a84cbdf885e75c98ce0d65cf2bcb59c0013503de0d5323

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                Filesize

                                                                30KB

                                                                MD5

                                                                a539e9b71339db8979b9bdae05c2b311

                                                                SHA1

                                                                50a831dd2d0487fe31ed516cbf6768e595644dbc

                                                                SHA256

                                                                61cfd95b073d6e430e5221967859e797159b9fdc0301d5240f4b1f880f8514ac

                                                                SHA512

                                                                05b932672e453043c867cf8116e68cc2137eefb0169053731af2472d77bda26523f99ea4aaf237e0f58e3af44f95139979463923ae71531e63cbefdd00b2ab24

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                Filesize

                                                                30KB

                                                                MD5

                                                                ebb785d0b91b2afef504bae462618240

                                                                SHA1

                                                                7dffde7e87b6ea8e516d10a5384dad71c9cc13ed

                                                                SHA256

                                                                87b85937f3072e8f24245dc9e0f59e11dba0e550f9708756e2c74f65c07c0f93

                                                                SHA512

                                                                d8b85c6021216dd6000110c3ca08aa9cfa00ee9ee8a5a42169b5144a7b7f93257ae36da708529d2bce2be4fcdbe944b6ce8730908dbfbf696a3d2669fdb0739a

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

                                                                Filesize

                                                                392B

                                                                MD5

                                                                a5e7530b951fc78b6f532730f3372f13

                                                                SHA1

                                                                fc647ae0574195bffc8d9d783ce91c5d60e46cdb

                                                                SHA256

                                                                efc6edd73acaae3c50356df4c9856888b7aeae92401d94303a3c6a7c28f17724

                                                                SHA512

                                                                f48fa9932d7453078f2bd17e022edd117066ba6e40c2bb76dbd023162650f5a73bf4e8100c8e654c9761843ed5bf840070846e8e0d6454d52fd0852ab0586d07

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

                                                                Filesize

                                                                392B

                                                                MD5

                                                                3b84a29bcfd9e8db1094a0665d7d1972

                                                                SHA1

                                                                25e1bb6aac60a686475f3b0b570398a80a740472

                                                                SHA256

                                                                7212759b8c760c6ee81d69dae035afe9a584e995aa145948190e0591af8cae2b

                                                                SHA512

                                                                6ae83324aa4e2b3b6b9f1bedc1c496991a8cda3c97505a0d77dbe44d901341147141807234f800fd3a7578e64ec978abd8970d68e297aed6934aef6a9e690213

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5833bd.TMP

                                                                Filesize

                                                                392B

                                                                MD5

                                                                201bc2448e9766a0611460da1647c8b6

                                                                SHA1

                                                                5654f1ce7fbb743885db1babe41587ce72f814c7

                                                                SHA256

                                                                ad89a29d11ec134e4fb5a690abfd1ed3dafb8cb3af07beedf1f78c3fe8542b0b

                                                                SHA512

                                                                2760140fd4662aee46d50e0285d2a5813f81cfdf100143fe814e7ba04551c7c3f289668357dadbed267e18deb31f891d6dad141cbcff2b750f3f1bee76438bde

                                                              • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

                                                                Filesize

                                                                2KB

                                                                MD5

                                                                f2d5df2895dc16fe5ef8e381c0d3eb50

                                                                SHA1

                                                                cc0ed68dd665963d4fbf65fa64822464540e69a8

                                                                SHA256

                                                                dd2f8013951e83c25b059e7ac507bb5649cf554e62dfb3823a13bd2a0a397230

                                                                SHA512

                                                                deb30d94a9a4f84e4017588e63182dd9c3fd54dddfe709bdca58252e4fd5efc680868afd9addd288e376495bfc744c8338fad7cfb56eb699828fdcd676b06a62

                                                              • C:\Users\Admin\AppData\Local\Temp\3f3ea148-fff4-4e77-9a10-86501349d472.tmp

                                                                Filesize

                                                                1B

                                                                MD5

                                                                5058f1af8388633f609cadb75a75dc9d

                                                                SHA1

                                                                3a52ce780950d4d969792a2559cd519d7ee8c727

                                                                SHA256

                                                                cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

                                                                SHA512

                                                                0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

                                                              • C:\Users\Admin\AppData\Local\Temp\4f7ddcd3-476f-4b52-a231-57e9584c659b.tmp

                                                                Filesize

                                                                10KB

                                                                MD5

                                                                78e47dda17341bed7be45dccfd89ac87

                                                                SHA1

                                                                1afde30e46997452d11e4a2adbbf35cce7a1404f

                                                                SHA256

                                                                67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550

                                                                SHA512

                                                                9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5

                                                              • C:\Users\Admin\AppData\Local\Temp\scoped_dir2476_1982024382\9b629488-b379-423b-9ffc-0ddd4fc184a5.tmp

                                                                Filesize

                                                                152KB

                                                                MD5

                                                                dd9bf8448d3ddcfd067967f01e8bf6d7

                                                                SHA1

                                                                d7829475b2bd6a3baa8fabfaf39af57c6439b35e

                                                                SHA256

                                                                fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

                                                                SHA512

                                                                65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

                                                              • C:\Users\Admin\Downloads\MistInstaller.exe

                                                                Filesize

                                                                83KB

                                                                MD5

                                                                8813125a606768fdf8df506029daa16f

                                                                SHA1

                                                                48e825f14522bd4d149ef8b426af81eec0287947

                                                                SHA256

                                                                323060680fed9a3205e3e36d2b62b7b5b6c6e6245e4555dcc733cf6ef390f41c

                                                                SHA512

                                                                9486a027029a27cbf0424760625c08d73aa62e28e45081751c5bada7c07ca05b4e44239da7774cf4f76298fb6b71769ae62595ae439b470c8308d39e1b2289d8