hxxps://github[.]com/UnamSanctam/SilentCryptoMiner/releases/tag/scm-v3[.]4[.]0

Analysis

max time kernel
1049s
max time network
1050s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
27-05-2024 13:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/UnamSanctam/SilentCryptoMiner/releases/tag/scm-v3.4.0

Score

7^/10

pyinstaller upx

Malware Config

Signatures

Executes dropped EXE 31 IoCs

Processes:

windres.exex86_64-w64-mingw32-clang.execlang-17.exeSysWhispersU.exeSysWhispersU.exeg++.execlang-17.execlang-17.execlang-17.execlang-17.execlang-17.execlang-17.exeld.lld.exestrip.exellvm-strip.exeupx.exewindres.exex86_64-w64-mingw32-clang.execlang-17.exeSysWhispersU.exeSysWhispersU.exeg++.execlang-17.execlang-17.execlang-17.execlang-17.execlang-17.execlang-17.exeld.lld.exestrip.exellvm-strip.exe

pid	process
2812	windres.exe
6008	x86_64-w64-mingw32-clang.exe
5880	clang-17.exe
2272	SysWhispersU.exe
6032	SysWhispersU.exe
5256	g++.exe
4040	clang-17.exe
5680	clang-17.exe
5960	clang-17.exe
3088	clang-17.exe
3208	clang-17.exe
1760	clang-17.exe
1720	ld.lld.exe
5988	strip.exe
3956	llvm-strip.exe
3128	upx.exe
960	windres.exe
6140	x86_64-w64-mingw32-clang.exe
5940	clang-17.exe
3076	SysWhispersU.exe
2356	SysWhispersU.exe
5180	g++.exe
5132	clang-17.exe
5448	clang-17.exe
4808	clang-17.exe
884	clang-17.exe
5476	clang-17.exe
1240	clang-17.exe
1552	ld.lld.exe
6092	strip.exe
5872	llvm-strip.exe

Loads dropped DLL 64 IoCs

Processes:

windres.execlang-17.exeSysWhispersU.execlang-17.execlang-17.execlang-17.execlang-17.execlang-17.execlang-17.exeld.lld.exellvm-strip.exewindres.execlang-17.exeSysWhispersU.execlang-17.execlang-17.execlang-17.exe

pid	process
2812	windres.exe
2812	windres.exe
2812	windres.exe
5880	clang-17.exe
5880	clang-17.exe
5880	clang-17.exe
5880	clang-17.exe
6032	SysWhispersU.exe
6032	SysWhispersU.exe
6032	SysWhispersU.exe
6032	SysWhispersU.exe
6032	SysWhispersU.exe
4040	clang-17.exe
4040	clang-17.exe
4040	clang-17.exe
4040	clang-17.exe
5680	clang-17.exe
5680	clang-17.exe
5680	clang-17.exe
5680	clang-17.exe
5960	clang-17.exe
5960	clang-17.exe
5960	clang-17.exe
5960	clang-17.exe
3088	clang-17.exe
3088	clang-17.exe
3088	clang-17.exe
3088	clang-17.exe
3208	clang-17.exe
3208	clang-17.exe
3208	clang-17.exe
3208	clang-17.exe
1760	clang-17.exe
1760	clang-17.exe
1760	clang-17.exe
1760	clang-17.exe
1720	ld.lld.exe
1720	ld.lld.exe
1720	ld.lld.exe
3956	llvm-strip.exe
3956	llvm-strip.exe
3956	llvm-strip.exe
960	windres.exe
960	windres.exe
960	windres.exe
5940	clang-17.exe
5940	clang-17.exe
5940	clang-17.exe
5940	clang-17.exe
2356	SysWhispersU.exe
2356	SysWhispersU.exe
2356	SysWhispersU.exe
2356	SysWhispersU.exe
2356	SysWhispersU.exe
5132	clang-17.exe
5132	clang-17.exe
5132	clang-17.exe
5132	clang-17.exe
5448	clang-17.exe
5448	clang-17.exe
5448	clang-17.exe
5448	clang-17.exe
4808	clang-17.exe
4808	clang-17.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/3128-9265-0x0000000000400000-0x0000000000617000-memory.dmp	upx
behavioral1/memory/3128-9270-0x0000000000400000-0x0000000000617000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service
T1102

Processes:

flow ioc

21 raw.githubusercontent.com

flow	ioc
21	raw.githubusercontent.com

Detects Pyinstaller 1 IoCs

pyinstaller

Processes:

resource	yara_rule
C:\Users\Admin\Desktop\UCompilers\SysWhispersU\SysWhispersU.exe	pyinstaller

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exefirefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 64 IoCs

Processes:

Silent Crypto Miner Builder.exemsedge.exefirefox.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Silent Crypto Miner Builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Silent Crypto Miner Builder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Silent Crypto Miner Builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Silent Crypto Miner Builder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Silent Crypto Miner Builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Silent Crypto Miner Builder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000100000000000000ffffffff	Silent Crypto Miner Builder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Silent Crypto Miner Builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0	Silent Crypto Miner Builder.exe
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0	Silent Crypto Miner Builder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\MRUListEx = ffffffff	Silent Crypto Miner Builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Silent Crypto Miner Builder.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Silent Crypto Miner Builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Silent Crypto Miner Builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Silent Crypto Miner Builder.exe
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	Silent Crypto Miner Builder.exe
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	Silent Crypto Miner Builder.exe
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Silent Crypto Miner Builder.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = 00000000ffffffff	Silent Crypto Miner Builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Silent Crypto Miner Builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Silent Crypto Miner Builder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 010000000200000000000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000000000001000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0 = 7e00310000000000bb58106e11004465736b746f7000680009000400efbea8585677bb58106e2e0000005c5702000000010000000000000000003e000000000098740f004400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000	Silent Crypto Miner Builder.exe
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	Silent Crypto Miner Builder.exe
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Silent Crypto Miner Builder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000e7760a3858a1da01d0d9a78b5ba1da0163dd37dd3eb0da0114000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\MRUListEx = ffffffff	Silent Crypto Miner Builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Silent Crypto Miner Builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Silent Crypto Miner Builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "4"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	Silent Crypto Miner Builder.exe
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	Silent Crypto Miner Builder.exe
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0 = 5000310000000000a858d07a100041646d696e003c0009000400efbea8585677bb58fc6d2e0000005257020000000100000000000000000000000000000030d21e00410064006d0069006e00000014000000	Silent Crypto Miner Builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Silent Crypto Miner Builder.exe
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe

NTFS ADS 1 IoCs

Processes:

msedge.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\Silent.Crypto.Miner.Builder.zip:Zone.Identifier msedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Silent.Crypto.Miner.Builder.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exemsedge.exe

pid	process
2040	msedge.exe
2040	msedge.exe
240	msedge.exe
240	msedge.exe
3084	msedge.exe
3084	msedge.exe
1288	identity_helper.exe
1288	identity_helper.exe
1640	msedge.exe
1640	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
5448	msedge.exe
5448	msedge.exe
5548	msedge.exe
5548	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

msedge.exe

pid process

5548 msedge.exe

pid	process
5548	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 37 IoCs

Processes:

msedge.exe

pid	process
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

Silent Crypto Miner Builder.exefirefox.exe

description	pid	process
Token: SeDebugPrivilege	4820	Silent Crypto Miner Builder.exe
Token: SeDebugPrivilege	3412	firefox.exe
Token: SeDebugPrivilege	3412	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe

pid	process
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe

Suspicious use of SendNotifyMessage 27 IoCs

Processes:

msedge.exefirefox.exe

pid	process
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
3412	firefox.exe
3412	firefox.exe
3412	firefox.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

Silent Crypto Miner Builder.exefirefox.exemsedge.exe

pid process

4820 Silent Crypto Miner Builder.exe
4820 Silent Crypto Miner Builder.exe
4820 Silent Crypto Miner Builder.exe
3412 firefox.exe
5548 msedge.exe

pid	process
4820	Silent Crypto Miner Builder.exe
4820	Silent Crypto Miner Builder.exe
4820	Silent Crypto Miner Builder.exe
3412	firefox.exe
5548	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 240 wrote to memory of 1744	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 1744	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 1088	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 1088	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 1088	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 1088	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 1088	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 1088	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 1088	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 1088	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 1088	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 1088	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 1088	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 1088	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 1088	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 1088	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 1088	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 1088	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 1088	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 1088	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 1088	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 1088	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 1088	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 1088	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 1088	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 1088	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 1088	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 1088	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 1088	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 1088	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 1088	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 1088	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 1088	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 1088	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 1088	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 1088	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 1088	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 1088	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 1088	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 1088	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 1088	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 1088	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 2040	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 2040	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 4528	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 4528	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 4528	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 4528	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 4528	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 4528	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 4528	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 4528	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 4528	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 4528	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 4528	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 4528	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 4528	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 4528	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 4528	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 4528	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 4528	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 4528	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 4528	240	msedge.exe	msedge.exe
PID 240 wrote to memory of 4528	240	msedge.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/UnamSanctam/SilentCryptoMiner/releases/tag/scm-v3.4.0
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd41233cb8,0x7ffd41233cc8,0x7ffd41233cd8
2⤵
PID:1744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1900 /prefetch:2
2⤵
PID:1088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
2⤵
PID:4528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
2⤵
PID:4900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
2⤵
PID:384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3084

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
2⤵
PID:4428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
2⤵
PID:1708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
2⤵
PID:1444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
2⤵
PID:4760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
2⤵
PID:2360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
2⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:1640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3360 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
2⤵
PID:1612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6720 /prefetch:1
2⤵
PID:1520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
2⤵
PID:4952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7012 /prefetch:1
2⤵
PID:2576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7020 /prefetch:1
2⤵
PID:3740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=1232 /prefetch:8
2⤵
PID:4808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6324 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
2⤵
PID:2100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6980 /prefetch:1
2⤵
PID:1544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:1
2⤵
PID:1596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1972 /prefetch:1
2⤵
PID:5704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
2⤵
PID:3668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
2⤵
PID:5312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2768 /prefetch:1
2⤵
PID:4416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7304 /prefetch:1
2⤵
PID:2284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7544 /prefetch:1
2⤵
PID:1836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7392 /prefetch:1
2⤵
PID:2384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7380 /prefetch:1
2⤵
PID:5204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6848 /prefetch:1
2⤵
PID:1132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8000 /prefetch:1
2⤵
PID:5984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7984 /prefetch:1
2⤵
PID:6004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
2⤵
PID:3380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6672 /prefetch:1
2⤵
PID:5564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7856 /prefetch:1
2⤵
PID:416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6656 /prefetch:1
2⤵
PID:6028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
2⤵
PID:5852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7768 /prefetch:1
2⤵
PID:3960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3036 /prefetch:1
2⤵
PID:1212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
2⤵
PID:5596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
2⤵
PID:2968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7636 /prefetch:1
2⤵
PID:4344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7256 /prefetch:1
2⤵
PID:5796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,16351286423289797493,2278615325177614954,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7264 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3532

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:244

C:\Users\Admin\Desktop\Silent Crypto Miner Builder.exe
"C:\Users\Admin\Desktop\Silent Crypto Miner Builder.exe"
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/UnamSanctam/SilentCryptoMiner/wiki
2⤵
PID:1528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffd41233cb8,0x7ffd41233cc8,0x7ffd41233cd8
3⤵
PID:1180

C:\Users\Admin\Desktop\UCompilers\gcc\bin\windres.exe
"C:\Users\Admin\Desktop\UCompilers\gcc\bin\windres.exe" --input UFiles\resource.rc --output UFiles\resource.o -O coff --codepage=65001
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2812

C:\Users\Admin\Desktop\UCompilers\gcc\bin\x86_64-w64-mingw32-clang.exe
C:/Users/Admin/Desktop/UCompilers/gcc/bin/x86_64-w64-mingw32-clang.exe --driver-mode=gcc -target x86_64-w64-mingw32 -E -xc -DRC_INVOKED "UFiles\resource.rc" -o C:/Users/Admin/AppData/Local/Temp/preproc-7d2b63.rc
3⤵
- Executes dropped EXE
PID:6008

C:\Users\Admin\Desktop\UCompilers\gcc\bin\clang-17.exe
"C:\Users\Admin\Desktop\UCompilers\gcc\bin\clang-17" "--start-no-unused-arguments" "-target" "x86_64-w64-mingw32" "-rtlib=compiler-rt" "-unwindlib=libunwind" "-stdlib=libc++" "-fuse-ld=lld" "--end-no-unused-arguments" "--driver-mode=gcc" "-target" "x86_64-w64-mingw32" "-E" "-xc" "-DRC_INVOKED" "UFiles\resource.rc" "-o" "C:/Users/Admin/AppData/Local/Temp/preproc-7d2b63.rc"
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5880

C:\Users\Admin\Desktop\UCompilers\SysWhispersU\SysWhispersU.exe
"C:\Users\Admin\Desktop\UCompilers\SysWhispersU\SysWhispersU.exe" -a x64 -l gas --function-prefix "Ut" -f NtSetInformationFile,NtSetInformationProcess,NtCreateFile,NtWriteFile,NtReadFile,NtDeleteFile,NtClose,NtOpenFile,NtResumeThread,NtGetContextThread,NtSetContextThread,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtFreeVirtualMemory,NtDelayExecution,NtOpenProcess,NtCreateUserProcess,NtOpenProcessToken,NtWaitForSingleObject,NtQueryAttributesFile,NtQueryInformationFile,NtCreateMutant,NtAdjustPrivilegesToken,NtQuerySystemInformation,NtQueryInformationToken,NtOpenKey,NtCreateKey,NtEnumerateKey,NtQueryValueKey,NtRenameKey,NtTerminateProcess,NtProtectVirtualMemory,NtSetValueKey -o "UFiles\Syscalls\syscalls"
2⤵
- Executes dropped EXE
PID:2272

C:\Users\Admin\Desktop\UCompilers\SysWhispersU\SysWhispersU.exe
"C:\Users\Admin\Desktop\UCompilers\SysWhispersU\SysWhispersU.exe" -a x64 -l gas --function-prefix "Ut" -f NtSetInformationFile,NtSetInformationProcess,NtCreateFile,NtWriteFile,NtReadFile,NtDeleteFile,NtClose,NtOpenFile,NtResumeThread,NtGetContextThread,NtSetContextThread,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtFreeVirtualMemory,NtDelayExecution,NtOpenProcess,NtCreateUserProcess,NtOpenProcessToken,NtWaitForSingleObject,NtQueryAttributesFile,NtQueryInformationFile,NtCreateMutant,NtAdjustPrivilegesToken,NtQuerySystemInformation,NtQueryInformationToken,NtOpenKey,NtCreateKey,NtEnumerateKey,NtQueryValueKey,NtRenameKey,NtTerminateProcess,NtProtectVirtualMemory,NtSetValueKey -o "UFiles\Syscalls\syscalls"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6032

C:\Users\Admin\Desktop\UCompilers\gcc\bin\g++.exe
"C:\Users\Admin\Desktop\UCompilers\gcc\bin\g++.exe" -m64 -Wl,-subsystem,windows -DRANDSYSCALL -x c++ "..\..\..\UFiles\*.cpp" "..\..\..\UFiles\Syscalls\*.c" -x assembler "..\..\..\UFiles\Syscalls\syscallsstubs.rnd.x64.s" -O2 -g0 -static-libgcc -static-libstdc++ -fno-stack-protector -fno-threadsafe-statics -fvisibility=hidden -fdata-sections -ffunction-sections -fno-exceptions -Wl,--gc-sections -flto -pipe -Wl,--strip-all -s -o "..\..\..\File-watchdog.exe"
2⤵
- Executes dropped EXE
PID:5256

C:\Users\Admin\Desktop\UCompilers\gcc\bin\clang-17.exe
"C:\Users\Admin\Desktop\UCompilers\gcc\bin\clang-17" "--start-no-unused-arguments" "--driver-mode=g++" "-target" "x86_64-w64-mingw32" "-rtlib=compiler-rt" "-unwindlib=libunwind" "-stdlib=libc++" "-fuse-ld=lld" "--end-no-unused-arguments" "-m64" "-Wl,-subsystem,windows" "-DRANDSYSCALL" "-x" "c++" "..\..\..\UFiles\*.cpp" "..\..\..\UFiles\Syscalls\*.c" "-x" "assembler" "..\..\..\UFiles\Syscalls\syscallsstubs.rnd.x64.s" "-O2" "-g0" "-static-libgcc" "-static-libstdc++" "-fno-stack-protector" "-fno-threadsafe-statics" "-fvisibility=hidden" "-fdata-sections" "-ffunction-sections" "-fno-exceptions" "-Wl,--gc-sections" "-flto" "-pipe" "-Wl,--strip-all" "-s" "-o" "..\..\..\File-watchdog.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4040

C:\Users\Admin\Desktop\UCompilers\gcc\bin\clang-17.exe
C:/Users/Admin/Desktop/UCompilers/gcc/bin/clang-17.exe -cc1 -triple x86_64-w64-windows-gnu -emit-llvm-bc -flto=full -flto-unit -dumpdir "..\..\..\File-watchdog.exe-" -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name common.cpp -mrelocation-model pic -pic-level 2 -mframe-pointer=none -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -mms-bitfields -funwind-tables=2 -fno-use-init-array -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -ffunction-sections -fdata-sections -fcoverage-compilation-dir=C:/Users/Admin/Desktop/UCompilers/gcc/bin -resource-dir C:/Users/Admin/Desktop/UCompilers/gcc/lib/clang/17 -D RANDSYSCALL -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/x86_64-w64-mingw32/include/c++/v1 -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/include/c++/v1 -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/lib/clang/17/include -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/x86_64-w64-mingw32/include -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/x86_64-w64-mingw32/usr/include -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/include -O2 -fdeprecated-macro -fdebug-compilation-dir=C:/Users/Admin/Desktop/UCompilers/gcc/bin -ferror-limit 19 -fvisibility=hidden -fno-use-cxa-atexit -fgnuc-version=4.2.1 -fno-threadsafe-statics -exception-model=seh -vectorize-loops -vectorize-slp -faddrsig -o C:/Users/Admin/AppData/Local/Temp/common-0e1d4f.o -x c++ "..\..\..\UFiles/common.cpp"
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5680

C:\Users\Admin\Desktop\UCompilers\gcc\bin\clang-17.exe
C:/Users/Admin/Desktop/UCompilers/gcc/bin/clang-17.exe -cc1 -triple x86_64-w64-windows-gnu -emit-llvm-bc -flto=full -flto-unit -dumpdir "..\..\..\File-watchdog.exe-" -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name inject.cpp -mrelocation-model pic -pic-level 2 -mframe-pointer=none -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -mms-bitfields -funwind-tables=2 -fno-use-init-array -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -ffunction-sections -fdata-sections -fcoverage-compilation-dir=C:/Users/Admin/Desktop/UCompilers/gcc/bin -resource-dir C:/Users/Admin/Desktop/UCompilers/gcc/lib/clang/17 -D RANDSYSCALL -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/x86_64-w64-mingw32/include/c++/v1 -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/include/c++/v1 -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/lib/clang/17/include -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/x86_64-w64-mingw32/include -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/x86_64-w64-mingw32/usr/include -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/include -O2 -fdeprecated-macro -fdebug-compilation-dir=C:/Users/Admin/Desktop/UCompilers/gcc/bin -ferror-limit 19 -fvisibility=hidden -fno-use-cxa-atexit -fgnuc-version=4.2.1 -fno-threadsafe-statics -exception-model=seh -vectorize-loops -vectorize-slp -faddrsig -o C:/Users/Admin/AppData/Local/Temp/inject-286538.o -x c++ "..\..\..\UFiles/inject.cpp"
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5960

C:\Users\Admin\Desktop\UCompilers\gcc\bin\clang-17.exe
C:/Users/Admin/Desktop/UCompilers/gcc/bin/clang-17.exe -cc1 -triple x86_64-w64-windows-gnu -emit-llvm-bc -flto=full -flto-unit -dumpdir "..\..\..\File-watchdog.exe-" -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name main.cpp -mrelocation-model pic -pic-level 2 -mframe-pointer=none -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -mms-bitfields -funwind-tables=2 -fno-use-init-array -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -ffunction-sections -fdata-sections -fcoverage-compilation-dir=C:/Users/Admin/Desktop/UCompilers/gcc/bin -resource-dir C:/Users/Admin/Desktop/UCompilers/gcc/lib/clang/17 -D RANDSYSCALL -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/x86_64-w64-mingw32/include/c++/v1 -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/include/c++/v1 -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/lib/clang/17/include -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/x86_64-w64-mingw32/include -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/x86_64-w64-mingw32/usr/include -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/include -O2 -fdeprecated-macro -fdebug-compilation-dir=C:/Users/Admin/Desktop/UCompilers/gcc/bin -ferror-limit 19 -fvisibility=hidden -fno-use-cxa-atexit -fgnuc-version=4.2.1 -fno-threadsafe-statics -exception-model=seh -vectorize-loops -vectorize-slp -faddrsig -o C:/Users/Admin/AppData/Local/Temp/main-c95dd2.o -x c++ "..\..\..\UFiles/main.cpp"
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3088

C:\Users\Admin\Desktop\UCompilers\gcc\bin\clang-17.exe
C:/Users/Admin/Desktop/UCompilers/gcc/bin/clang-17.exe -cc1 -triple x86_64-w64-windows-gnu -emit-llvm-bc -flto=full -flto-unit -dumpdir "..\..\..\File-watchdog.exe-" -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name syscalls.c -mrelocation-model pic -pic-level 2 -mframe-pointer=none -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -mms-bitfields -funwind-tables=2 -fno-use-init-array -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -ffunction-sections -fdata-sections -fcoverage-compilation-dir=C:/Users/Admin/Desktop/UCompilers/gcc/bin -resource-dir C:/Users/Admin/Desktop/UCompilers/gcc/lib/clang/17 -D RANDSYSCALL -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/x86_64-w64-mingw32/include/c++/v1 -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/include/c++/v1 -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/lib/clang/17/include -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/x86_64-w64-mingw32/include -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/x86_64-w64-mingw32/usr/include -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/include -O2 -fdeprecated-macro -fdebug-compilation-dir=C:/Users/Admin/Desktop/UCompilers/gcc/bin -ferror-limit 19 -fvisibility=hidden -fno-use-cxa-atexit -fgnuc-version=4.2.1 -fno-threadsafe-statics -exception-model=seh -vectorize-loops -vectorize-slp -faddrsig -o C:/Users/Admin/AppData/Local/Temp/syscalls-37acfd.o -x c++ "..\..\..\UFiles\Syscalls/syscalls.c"
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3208

C:\Users\Admin\Desktop\UCompilers\gcc\bin\clang-17.exe
C:/Users/Admin/Desktop/UCompilers/gcc/bin/clang-17.exe -cc1as -triple x86_64-w64-windows-gnu -filetype obj -main-file-name syscallsstubs.rnd.x64.s -target-cpu x86-64 -fdebug-compilation-dir=C:/Users/Admin/Desktop/UCompilers/gcc/bin -dwarf-debug-producer "clang version 17.0.4 (https://github.com/llvm/llvm-project.git 309d55140c46384b6de7a7573206cbeba3f7077f)" -dwarf-version=4 -mrelocation-model pic -o C:/Users/Admin/AppData/Local/Temp/syscallsstubs-8e48ab.o "..\..\..\UFiles\Syscalls\syscallsstubs.rnd.x64.s"
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1760

C:\Users\Admin\Desktop\UCompilers\gcc\bin\ld.lld.exe
C:/Users/Admin/Desktop/UCompilers/gcc/bin/ld.lld -s -m i386pep -Bdynamic -o "..\..\..\File-watchdog.exe" -s C:/Users/Admin/Desktop/UCompilers/gcc/x86_64-w64-mingw32/lib/crt2.o C:/Users/Admin/Desktop/UCompilers/gcc/x86_64-w64-mingw32/lib/crtbegin.o -LC:/Users/Admin/Desktop/UCompilers/gcc/x86_64-w64-mingw32/lib -LC:/Users/Admin/Desktop/UCompilers/gcc/x86_64-w64-mingw32/mingw/lib -LC:/Users/Admin/Desktop/UCompilers/gcc/lib -LC:/Users/Admin/Desktop/UCompilers/gcc/lib/clang/17/lib/windows -subsystem windows C:/Users/Admin/AppData/Local/Temp/common-0e1d4f.o C:/Users/Admin/AppData/Local/Temp/inject-286538.o C:/Users/Admin/AppData/Local/Temp/main-c95dd2.o C:/Users/Admin/AppData/Local/Temp/syscalls-37acfd.o C:/Users/Admin/AppData/Local/Temp/syscallsstubs-8e48ab.o --gc-sections --strip-all -Bstatic -lc++ -Bdynamic -lmingw32 C:/Users/Admin/Desktop/UCompilers/gcc/lib/clang/17/lib/windows/libclang_rt.builtins-x86_64.a -l:libunwind.a -lmoldname -lmingwex -lmsvcrt -ladvapi32 -lshell32 -luser32 -lkernel32 -lmingw32 C:/Users/Admin/Desktop/UCompilers/gcc/lib/clang/17/lib/windows/libclang_rt.builtins-x86_64.a -l:libunwind.a -lmoldname -lmingwex -lmsvcrt -lkernel32 C:/Users/Admin/Desktop/UCompilers/gcc/x86_64-w64-mingw32/lib/crtend.o
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720

C:\Users\Admin\Desktop\UCompilers\gcc\bin\strip.exe
"C:\Users\Admin\Desktop\UCompilers\gcc\bin\strip.exe" "C:\Users\Admin\Desktop\File-watchdog.exe"
2⤵
- Executes dropped EXE
PID:5988

C:\Users\Admin\Desktop\UCompilers\gcc\bin\llvm-strip.exe
"C:\Users\Admin\Desktop\UCompilers\gcc\bin\strip.exe" "C:\Users\Admin\Desktop\File-watchdog.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3956

C:\Users\Admin\Desktop\UCompilers\UPX\upx.exe
"C:\Users\Admin\Desktop\UCompilers\UPX\upx.exe" "xmrig.exe"
2⤵
- Executes dropped EXE
PID:3128

C:\Users\Admin\Desktop\UCompilers\gcc\bin\windres.exe
"C:\Users\Admin\Desktop\UCompilers\gcc\bin\windres.exe" --input UFiles\resource.rc --output UFiles\resource.o -O coff --codepage=65001
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:960

C:\Users\Admin\Desktop\UCompilers\gcc\bin\x86_64-w64-mingw32-clang.exe
C:/Users/Admin/Desktop/UCompilers/gcc/bin/x86_64-w64-mingw32-clang.exe --driver-mode=gcc -target x86_64-w64-mingw32 -E -xc -DRC_INVOKED "UFiles\resource.rc" -o C:/Users/Admin/AppData/Local/Temp/preproc-793d2f.rc
3⤵
- Executes dropped EXE
PID:6140

C:\Users\Admin\Desktop\UCompilers\gcc\bin\clang-17.exe
"C:\Users\Admin\Desktop\UCompilers\gcc\bin\clang-17" "--start-no-unused-arguments" "-target" "x86_64-w64-mingw32" "-rtlib=compiler-rt" "-unwindlib=libunwind" "-stdlib=libc++" "-fuse-ld=lld" "--end-no-unused-arguments" "--driver-mode=gcc" "-target" "x86_64-w64-mingw32" "-E" "-xc" "-DRC_INVOKED" "UFiles\resource.rc" "-o" "C:/Users/Admin/AppData/Local/Temp/preproc-793d2f.rc"
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5940

C:\Users\Admin\Desktop\UCompilers\SysWhispersU\SysWhispersU.exe
"C:\Users\Admin\Desktop\UCompilers\SysWhispersU\SysWhispersU.exe" -a x64 -l gas --function-prefix "Ut" -f NtSetInformationFile,NtSetInformationProcess,NtCreateFile,NtWriteFile,NtReadFile,NtDeleteFile,NtClose,NtOpenFile,NtResumeThread,NtGetContextThread,NtSetContextThread,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtFreeVirtualMemory,NtDelayExecution,NtOpenProcess,NtCreateUserProcess,NtOpenProcessToken,NtWaitForSingleObject,NtQueryAttributesFile,NtQueryInformationFile,NtCreateMutant,NtAdjustPrivilegesToken,NtQuerySystemInformation,NtQueryInformationToken,NtOpenKey,NtCreateKey,NtEnumerateKey,NtQueryValueKey,NtRenameKey,NtTerminateProcess,NtProtectVirtualMemory,NtSetValueKey -o "UFiles\Syscalls\syscalls"
2⤵
- Executes dropped EXE
PID:3076

C:\Users\Admin\Desktop\UCompilers\SysWhispersU\SysWhispersU.exe
"C:\Users\Admin\Desktop\UCompilers\SysWhispersU\SysWhispersU.exe" -a x64 -l gas --function-prefix "Ut" -f NtSetInformationFile,NtSetInformationProcess,NtCreateFile,NtWriteFile,NtReadFile,NtDeleteFile,NtClose,NtOpenFile,NtResumeThread,NtGetContextThread,NtSetContextThread,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtFreeVirtualMemory,NtDelayExecution,NtOpenProcess,NtCreateUserProcess,NtOpenProcessToken,NtWaitForSingleObject,NtQueryAttributesFile,NtQueryInformationFile,NtCreateMutant,NtAdjustPrivilegesToken,NtQuerySystemInformation,NtQueryInformationToken,NtOpenKey,NtCreateKey,NtEnumerateKey,NtQueryValueKey,NtRenameKey,NtTerminateProcess,NtProtectVirtualMemory,NtSetValueKey -o "UFiles\Syscalls\syscalls"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356

C:\Users\Admin\Desktop\UCompilers\gcc\bin\g++.exe
"C:\Users\Admin\Desktop\UCompilers\gcc\bin\g++.exe" -m64 -Wl,-subsystem,windows -DRANDSYSCALL -x c++ "..\..\..\UFiles\*.cpp" "..\..\..\UFiles\Syscalls\*.c" -x assembler "..\..\..\UFiles\Syscalls\syscallsstubs.rnd.x64.s" -O2 -g0 -static-libgcc -static-libstdc++ -fno-stack-protector -fno-threadsafe-statics -fvisibility=hidden -fdata-sections -ffunction-sections -fno-exceptions -Wl,--gc-sections -flto -pipe -Wl,--strip-all -s -o "..\..\..\File.exe"
2⤵
- Executes dropped EXE
PID:5180

C:\Users\Admin\Desktop\UCompilers\gcc\bin\clang-17.exe
"C:\Users\Admin\Desktop\UCompilers\gcc\bin\clang-17" "--start-no-unused-arguments" "--driver-mode=g++" "-target" "x86_64-w64-mingw32" "-rtlib=compiler-rt" "-unwindlib=libunwind" "-stdlib=libc++" "-fuse-ld=lld" "--end-no-unused-arguments" "-m64" "-Wl,-subsystem,windows" "-DRANDSYSCALL" "-x" "c++" "..\..\..\UFiles\*.cpp" "..\..\..\UFiles\Syscalls\*.c" "-x" "assembler" "..\..\..\UFiles\Syscalls\syscallsstubs.rnd.x64.s" "-O2" "-g0" "-static-libgcc" "-static-libstdc++" "-fno-stack-protector" "-fno-threadsafe-statics" "-fvisibility=hidden" "-fdata-sections" "-ffunction-sections" "-fno-exceptions" "-Wl,--gc-sections" "-flto" "-pipe" "-Wl,--strip-all" "-s" "-o" "..\..\..\File.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5132

C:\Users\Admin\Desktop\UCompilers\gcc\bin\clang-17.exe
C:/Users/Admin/Desktop/UCompilers/gcc/bin/clang-17.exe -cc1 -triple x86_64-w64-windows-gnu -emit-llvm-bc -flto=full -flto-unit -dumpdir "..\..\..\File.exe-" -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name common.cpp -mrelocation-model pic -pic-level 2 -mframe-pointer=none -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -mms-bitfields -funwind-tables=2 -fno-use-init-array -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -ffunction-sections -fdata-sections -fcoverage-compilation-dir=C:/Users/Admin/Desktop/UCompilers/gcc/bin -resource-dir C:/Users/Admin/Desktop/UCompilers/gcc/lib/clang/17 -D RANDSYSCALL -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/x86_64-w64-mingw32/include/c++/v1 -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/include/c++/v1 -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/lib/clang/17/include -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/x86_64-w64-mingw32/include -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/x86_64-w64-mingw32/usr/include -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/include -O2 -fdeprecated-macro -fdebug-compilation-dir=C:/Users/Admin/Desktop/UCompilers/gcc/bin -ferror-limit 19 -fvisibility=hidden -fno-use-cxa-atexit -fgnuc-version=4.2.1 -fno-threadsafe-statics -exception-model=seh -vectorize-loops -vectorize-slp -faddrsig -o C:/Users/Admin/AppData/Local/Temp/common-5c91fb.o -x c++ "..\..\..\UFiles/common.cpp"
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5448

C:\Users\Admin\Desktop\UCompilers\gcc\bin\clang-17.exe
C:/Users/Admin/Desktop/UCompilers/gcc/bin/clang-17.exe -cc1 -triple x86_64-w64-windows-gnu -emit-llvm-bc -flto=full -flto-unit -dumpdir "..\..\..\File.exe-" -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name inject.cpp -mrelocation-model pic -pic-level 2 -mframe-pointer=none -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -mms-bitfields -funwind-tables=2 -fno-use-init-array -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -ffunction-sections -fdata-sections -fcoverage-compilation-dir=C:/Users/Admin/Desktop/UCompilers/gcc/bin -resource-dir C:/Users/Admin/Desktop/UCompilers/gcc/lib/clang/17 -D RANDSYSCALL -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/x86_64-w64-mingw32/include/c++/v1 -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/include/c++/v1 -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/lib/clang/17/include -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/x86_64-w64-mingw32/include -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/x86_64-w64-mingw32/usr/include -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/include -O2 -fdeprecated-macro -fdebug-compilation-dir=C:/Users/Admin/Desktop/UCompilers/gcc/bin -ferror-limit 19 -fvisibility=hidden -fno-use-cxa-atexit -fgnuc-version=4.2.1 -fno-threadsafe-statics -exception-model=seh -vectorize-loops -vectorize-slp -faddrsig -o C:/Users/Admin/AppData/Local/Temp/inject-6713ab.o -x c++ "..\..\..\UFiles/inject.cpp"
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4808

C:\Users\Admin\Desktop\UCompilers\gcc\bin\clang-17.exe
C:/Users/Admin/Desktop/UCompilers/gcc/bin/clang-17.exe -cc1 -triple x86_64-w64-windows-gnu -emit-llvm-bc -flto=full -flto-unit -dumpdir "..\..\..\File.exe-" -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name main.cpp -mrelocation-model pic -pic-level 2 -mframe-pointer=none -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -mms-bitfields -funwind-tables=2 -fno-use-init-array -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -ffunction-sections -fdata-sections -fcoverage-compilation-dir=C:/Users/Admin/Desktop/UCompilers/gcc/bin -resource-dir C:/Users/Admin/Desktop/UCompilers/gcc/lib/clang/17 -D RANDSYSCALL -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/x86_64-w64-mingw32/include/c++/v1 -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/include/c++/v1 -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/lib/clang/17/include -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/x86_64-w64-mingw32/include -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/x86_64-w64-mingw32/usr/include -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/include -O2 -fdeprecated-macro -fdebug-compilation-dir=C:/Users/Admin/Desktop/UCompilers/gcc/bin -ferror-limit 19 -fvisibility=hidden -fno-use-cxa-atexit -fgnuc-version=4.2.1 -fno-threadsafe-statics -exception-model=seh -vectorize-loops -vectorize-slp -faddrsig -o C:/Users/Admin/AppData/Local/Temp/main-5efbff.o -x c++ "..\..\..\UFiles/main.cpp"
4⤵
- Executes dropped EXE
PID:884

C:\Users\Admin\Desktop\UCompilers\gcc\bin\clang-17.exe
C:/Users/Admin/Desktop/UCompilers/gcc/bin/clang-17.exe -cc1 -triple x86_64-w64-windows-gnu -emit-llvm-bc -flto=full -flto-unit -dumpdir "..\..\..\File.exe-" -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name syscalls.c -mrelocation-model pic -pic-level 2 -mframe-pointer=none -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -mms-bitfields -funwind-tables=2 -fno-use-init-array -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -ffunction-sections -fdata-sections -fcoverage-compilation-dir=C:/Users/Admin/Desktop/UCompilers/gcc/bin -resource-dir C:/Users/Admin/Desktop/UCompilers/gcc/lib/clang/17 -D RANDSYSCALL -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/x86_64-w64-mingw32/include/c++/v1 -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/include/c++/v1 -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/lib/clang/17/include -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/x86_64-w64-mingw32/include -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/x86_64-w64-mingw32/usr/include -internal-isystem C:/Users/Admin/Desktop/UCompilers/gcc/include -O2 -fdeprecated-macro -fdebug-compilation-dir=C:/Users/Admin/Desktop/UCompilers/gcc/bin -ferror-limit 19 -fvisibility=hidden -fno-use-cxa-atexit -fgnuc-version=4.2.1 -fno-threadsafe-statics -exception-model=seh -vectorize-loops -vectorize-slp -faddrsig -o C:/Users/Admin/AppData/Local/Temp/syscalls-92806b.o -x c++ "..\..\..\UFiles\Syscalls/syscalls.c"
4⤵
- Executes dropped EXE
PID:5476

C:\Users\Admin\Desktop\UCompilers\gcc\bin\clang-17.exe
C:/Users/Admin/Desktop/UCompilers/gcc/bin/clang-17.exe -cc1as -triple x86_64-w64-windows-gnu -filetype obj -main-file-name syscallsstubs.rnd.x64.s -target-cpu x86-64 -fdebug-compilation-dir=C:/Users/Admin/Desktop/UCompilers/gcc/bin -dwarf-debug-producer "clang version 17.0.4 (https://github.com/llvm/llvm-project.git 309d55140c46384b6de7a7573206cbeba3f7077f)" -dwarf-version=4 -mrelocation-model pic -o C:/Users/Admin/AppData/Local/Temp/syscallsstubs-777bce.o "..\..\..\UFiles\Syscalls\syscallsstubs.rnd.x64.s"
4⤵
- Executes dropped EXE
PID:1240

C:\Users\Admin\Desktop\UCompilers\gcc\bin\ld.lld.exe
C:/Users/Admin/Desktop/UCompilers/gcc/bin/ld.lld -s -m i386pep -Bdynamic -o "..\..\..\File.exe" -s C:/Users/Admin/Desktop/UCompilers/gcc/x86_64-w64-mingw32/lib/crt2.o C:/Users/Admin/Desktop/UCompilers/gcc/x86_64-w64-mingw32/lib/crtbegin.o -LC:/Users/Admin/Desktop/UCompilers/gcc/x86_64-w64-mingw32/lib -LC:/Users/Admin/Desktop/UCompilers/gcc/x86_64-w64-mingw32/mingw/lib -LC:/Users/Admin/Desktop/UCompilers/gcc/lib -LC:/Users/Admin/Desktop/UCompilers/gcc/lib/clang/17/lib/windows -subsystem windows C:/Users/Admin/AppData/Local/Temp/common-5c91fb.o C:/Users/Admin/AppData/Local/Temp/inject-6713ab.o C:/Users/Admin/AppData/Local/Temp/main-5efbff.o C:/Users/Admin/AppData/Local/Temp/syscalls-92806b.o C:/Users/Admin/AppData/Local/Temp/syscallsstubs-777bce.o --gc-sections --strip-all -Bstatic -lc++ -Bdynamic -lmingw32 C:/Users/Admin/Desktop/UCompilers/gcc/lib/clang/17/lib/windows/libclang_rt.builtins-x86_64.a -l:libunwind.a -lmoldname -lmingwex -lmsvcrt -ladvapi32 -lshell32 -luser32 -lkernel32 -lmingw32 C:/Users/Admin/Desktop/UCompilers/gcc/lib/clang/17/lib/windows/libclang_rt.builtins-x86_64.a -l:libunwind.a -lmoldname -lmingwex -lmsvcrt -lkernel32 C:/Users/Admin/Desktop/UCompilers/gcc/x86_64-w64-mingw32/lib/crtend.o
4⤵
- Executes dropped EXE
PID:1552

C:\Users\Admin\Desktop\UCompilers\gcc\bin\strip.exe
"C:\Users\Admin\Desktop\UCompilers\gcc\bin\strip.exe" "C:\Users\Admin\Desktop\File.exe"
2⤵
- Executes dropped EXE
PID:6092

C:\Users\Admin\Desktop\UCompilers\gcc\bin\llvm-strip.exe
"C:\Users\Admin\Desktop\UCompilers\gcc\bin\strip.exe" "C:\Users\Admin\Desktop\File.exe"
3⤵
- Executes dropped EXE
PID:5872

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\aivtqav2\aivtqav2.cmdline"
2⤵
PID:3816

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:AMD64 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9DA.tmp" "c:\Users\Admin\Desktop\CSC21D6852AAB844E0FAB7E5C37356287D0.TMP"
3⤵
PID:5588

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uy2fbxl0\uy2fbxl0.cmdline"
2⤵
PID:5980

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:AMD64 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA67.tmp" "c:\Users\Admin\Desktop\CSC3384A4463AF148F9A414C06573EB2C.TMP"
3⤵
PID:2672

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:1948

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3412

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3412.0.1311512370\249291080" -parentBuildID 20230214051806 -prefsHandle 1712 -prefMapHandle 1704 -prefsLen 22074 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f4eb0427-9b49-4738-8197-5f4ebf916da2} 3412 "\\.\pipe\gecko-crash-server-pipe.3412" 1808 1e771e0d758 gpu
3⤵
PID:1332

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3412.1.851274436\121139618" -parentBuildID 20230214051806 -prefsHandle 2340 -prefMapHandle 2336 -prefsLen 22110 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {28ead517-6b1f-4024-92db-59df6d1fc3a7} 3412 "\\.\pipe\gecko-crash-server-pipe.3412" 2352 1e75db85358 socket
3⤵
- Checks processor information in registry
PID:5228

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3412.2.674961856\1686073454" -childID 1 -isForBrowser -prefsHandle 2952 -prefMapHandle 2948 -prefsLen 22213 -prefMapSize 235121 -jsInitHandle 1316 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d0f447fc-b1fc-4123-8bc8-f065f3b2640f} 3412 "\\.\pipe\gecko-crash-server-pipe.3412" 1388 1e774a04158 tab
3⤵
PID:3656

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3412.3.2024153850\1427995896" -childID 2 -isForBrowser -prefsHandle 3272 -prefMapHandle 3288 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1316 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ec26d6f1-61ed-467e-8426-e3ac8c1c5f21} 3412 "\\.\pipe\gecko-crash-server-pipe.3412" 3648 1e777865f58 tab
3⤵
PID:5756

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3412.4.1687937950\1494137491" -childID 3 -isForBrowser -prefsHandle 5132 -prefMapHandle 5128 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1316 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1699a9c0-58dd-430e-99b4-cab1b6353ddd} 3412 "\\.\pipe\gecko-crash-server-pipe.3412" 5144 1e772699958 tab
3⤵
PID:720

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3412.5.469556629\1446087929" -childID 4 -isForBrowser -prefsHandle 5300 -prefMapHandle 5304 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1316 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7aac9c72-7e1d-4153-8321-2bb8048f7e9a} 3412 "\\.\pipe\gecko-crash-server-pipe.3412" 5292 1e772699c58 tab
3⤵
PID:2408

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3412.6.290125122\25357906" -childID 5 -isForBrowser -prefsHandle 5496 -prefMapHandle 5500 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1316 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {feba6748-6d3c-4dba-8f82-8823444a6c1f} 3412 "\\.\pipe\gecko-crash-server-pipe.3412" 5484 1e77269ab58 tab
3⤵
PID:3128

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3412.7.1249427581\869802657" -childID 6 -isForBrowser -prefsHandle 5956 -prefMapHandle 5936 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1316 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce3dec96-da22-4b7b-93fe-1e1daf61b006} 3412 "\\.\pipe\gecko-crash-server-pipe.3412" 5968 1e77b6b4858 tab
3⤵
PID:1192

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5660

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
d56e8f308a28ac4183257a7950ab5c89

SHA1
044969c58cef041a073c2d132fa66ccc1ee553fe

SHA256
0bc24451c65457abc1e4e340be2f8faceae6b6ec7768a21d44bcd14636543bae

SHA512
fd5798559f4025ec3408f5550b8671d394b1ec83b85fdac8c005b0cc3e183272bdd07db15a156a572c9c5e5798badf235dc10aae62a052efa8dd9dfdbdca8189

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
8f2eb94e31cadfb6eb07e6bbe61ef7ae

SHA1
3f42b0d5a90408689e7f7941f8db72a67d5a2eab

SHA256
d222c8e3b19cda2657629a486faf32962e016fc66561ce0d17010afdb283c9de

SHA512
9f7f84149885b851e0bf7173c540e466a2b2eb9907d8b608f60360933328cc75d9d1b63640ea4ecc1e64ecc5dd7ee74d82903f96a8b4418ca56296641a8c0703

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013
Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014
Filesize
67KB

MD5
d2d55f8057f8b03c94a81f3839b348b9

SHA1
37c399584539734ff679e3c66309498c8b2dd4d9

SHA256
6e273f3491917d37f4dbb6c3f4d3f862cada25c20a36b245ea7c6bd860fb400c

SHA512
7bcdbb9e8d005a532ec12485a9c4b777ddec4aee66333757cdae3f84811099a574e719d45eb4487072d0162fa4654349dd73705a8d1913834535b1a3e2247dc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015
Filesize
40KB

MD5
3c2ac6ed09323fe172784cdec7f3d671

SHA1
79eb656ac99f1a2efa7fbf8e8923f84dd2b63355

SHA256
67d42a456baa3edbec1eb21c94f294c04a72bac350acfae80f4f2b65afe8bc5f

SHA512
ac95a571afa882744a42447e84c1ca5231303ba33700f63e99d58860e9635ddc861745678d5c74b137af3d50daf05ea710abe65b11ffba95e2b2f6aaafb65071

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016
Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017
Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018
Filesize
84KB

MD5
74e33b4b54f4d1f3da06ab47c5936a13

SHA1
6e5976d593b6ee3dca3c4dbbb90071b76e1cd85c

SHA256
535fc48679c38decd459ad656bdd6914e539754265244d0cc7b1da6bddf3e287

SHA512
79218e8ee50484af968480ff9b211815c97c3f3035414e685aa5d15d9b4152682d87b66202339f212bf3b463a074bf7a4431107b50303f28e2eb4b17843991c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019
Filesize
1.2MB

MD5
1f7c0a3a257e5f561b61cb6af85289a3

SHA1
7bfd5ea039ee0f291fa4e5ef23ad91d583e840d5

SHA256
d15d37dd6e8b273c4bc1e4d64b8d462f33af2fd58831ea3e28c1cb6fcdec8669

SHA512
64a0eaa739a6f7f6e5579975a1dacb1741fe8d2f106c08df6cc87fde0bdad59ee80dbc8f7ea38cc926b5a51e469e32cb11effc0cb1ef50475fbc7747d240a442

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a
Filesize
32KB

MD5
bbc7e5859c0d0757b3b1b15e1b11929d

SHA1
59df2c56b3c79ac1de9b400ddf3c5a693fa76c2d

SHA256
851c67fbabfda5b3151a6f73f283f7f0634cd1163719135a8de25c0518234fc2

SHA512
f1fecb77f4cdfe7165cc1f2da042048fd94033ca4e648e50ebc4171c806c3c174666bb321c6dda53f2f175dc310ad2459e8f01778acaee6e7c7606497c0a1dea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b
Filesize
74KB

MD5
bc9faa8bb6aae687766b2db2e055a494

SHA1
34b2395d1b6908afcd60f92cdd8e7153939191e4

SHA256
4a725d21a3c98f0b9c5763b0a0796818d341579817af762448e1be522bc574ed

SHA512
621386935230595c3a00b9c53ea25daa78c2823d32085e22363dc438150f1cb6b3d50be5c58665886fac2286ae63bf1f62c8803cb38a0cac201c82ee2db975c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c
Filesize
24KB

MD5
299ca9ea3943cf1b445a594d37eb544c

SHA1
3f47e5f651cfe4cfd6a121935ee3479e9bbe40ec

SHA256
a5530a56265611adb7e0161eaf8ec59914e19e853c14d55650f9cdc3f77ac9f5

SHA512
2bfc02a9a17a3cda23c6863aa722580cf2f8c5979a56fb28b74d90394fdc4705832e1c0e7f4af656f001f2ee0a2193f0f1a0387ed6bbfd8c33877beef31f0434

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d
Filesize
23KB

MD5
3abb16405f081d9bd0e4e9bd8982ccfe

SHA1
b89ffbdc9f1f5c1916444bc730a30aec0714bb5c

SHA256
896c96bffaa50fee414fa8d3a5e039538de1b888e6209d211f1f4bc09a7f2eb1

SHA512
4e9a039f3e7be7763b5a0dfb73a024b1472fabebc20f7b5b9437b360ea851ba85f657e8054577913cab9d15e13c455f3cedacd5739c4403d8d411f3f2686bde2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002c
Filesize
69KB

MD5
3ffeac044eab9d0ff13aacc548e1efbe

SHA1
43baf7b0341dff17c7dc45fa940f52c32775625a

SHA256
cfeb358ae428dbc685dc7b2dd44685d0f55d2cc31e03c8d988832dbc8a30d476

SHA512
6b2e7f12baec62224243e61a460adc4b55090aa0c4e7e3ecdee53d7803471b80a3ebb395bc2529958b0e074e6e77cb2a4114d886aebc3d71baeba130afb2824b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002f
Filesize
21KB

MD5
650bc1872ca99bb3af1d2a0c5b4d73cb

SHA1
2cdb23fee68ad799026a82148bf2bc04c0015926

SHA256
917d16cb26eb82abfa776f3fa00dcc23164bfcfe16ae04f32f61891cb4cdaa2b

SHA512
ffc8bd5fd2174380b36cee407960913351cbe20557f84669dad99a9df56ae670135a6a17216a4c8379b54d7e442d1e06e4bd8ff5e7bbd50255807a025aee9e55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000030
Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000031
Filesize
96KB

MD5
aa8a3d96ad2cb857ed510d39263cc835

SHA1
5f97e82c73af30da53999e10dbecf71a94ac6008

SHA256
9ee493e6b998f151ca9fdf318ea7a9d8f9cc801b46877c0e13a56d2e93944b8b

SHA512
1bfc4c34cb98ed9aa0c2d32de07894099190c029cbb50b367ab0886ae91c34081723724d9b0cb5daca2ba1e30ee345020fd7a8de38908ebe60dcc32393eb384e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000033
Filesize
29KB

MD5
6872f0ad2d332313378eac57f35887af

SHA1
13d2ad38185a538808c8ae9e46afebce215bce49

SHA256
abd377f77e45c1157605c63d3988149967317567da8b91ef531a62c02eb27a74

SHA512
1bb6e0ff6a90aacc454c65d3a07041770469705464c96d8745f248c33ae76a6678b7774c2031c6dc7c55022da65a762ad3e664b2223567b2f3f02c0f2ac462b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000035
Filesize
95KB

MD5
12f9ec8a81f5c69551f9e41c3a8a2c1b

SHA1
3ad7d25d592f928d2f620a71c1218d94d9300496

SHA256
85bc05d0031a9faf190228c9d0d7fa5cc2df7132d826c74daf5b9b3f7c55de65

SHA512
5aa9c8b61e714b29fdd1bd3450ed903e753d289b4c9791a1c1a41069a969526a788a2de06a13f41b4f0ca66e461f65c5248c19f31dec09ad1d3dfde4d7085b1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000036
Filesize
42KB

MD5
10efb91369daa4c04cf6fd78580d3d15

SHA1
dc3214cb574ccb55aa01bc154e998662a760d93d

SHA256
ef6b412bb64be39a05223be9622f34947b0bbb9709f4a59c91f60208b2c20195

SHA512
d26a9a063e3e01453739175e103da8118d1ce58e129d9c5cb24964ab5963cc132580a2dbfc7366f7277c41c736a3a4386b19d51075a157bc561cdeb37d4644b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000037
Filesize
74KB

MD5
a0333eea21b44385683f32acd7e6d1f5

SHA1
42d247bf89bee1a213654a2a298727ce3dd8ac7f

SHA256
777fc09164188fc026ce65b745720b3303144f054997b3d1054627a407101d65

SHA512
334dcad34296312c638786d6ea31b3be9fb8b82cc5bcbd4478396d19746aa40743940993d73d53a1ddc6516879d0ddca18c51653f365e454845fcb4b3529f12b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000038
Filesize
141KB

MD5
6e64a529396354c4c7315eaf773f3ee7

SHA1
4a6f76f684428b2c65a170518607b46dd479d148

SHA256
d681d16e0e71325ddfd93ad12025b3ea4d5d2a5e7b8c4bc0ba8dae7b95aca6b3

SHA512
4b1abc4bcfdafc70541e2fea60df08b13045a6270f4440979b3bee3706638a93829e49c3d5e7eb098429a0f7af6c31ca3890a71d776674a18fb4d7ada94a854e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003c
Filesize
35KB

MD5
977e52517b0df50973992e4ed37db883

SHA1
48efe7547574e0dbcfe8a9d998cfd19d86e4ebff

SHA256
8742d03c2589b19fcc588298aeb70aa26b46dc0efccd963f0c505d1f08d73cac

SHA512
48b4591855418f55e66d6ee22a5ec280773a2fd6a9c94501e84c2a7570cce633d0d38fb2ca29a785490fba22ed9cf14faa03c89ce66021b9770099ede58bfdd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003f
Filesize
62KB

MD5
d595aeedb6ab5955252895140cd33b2d

SHA1
54ec38264ca7194d6df71d5a5fe4b7dd5b4b5130

SHA256
94449a2e74b33178a00cbd79505d9251a0fcdff8ee1a0ac24352a6779ca34fb6

SHA512
439d8d57c0e938f28804e4500f6549569090b7e52c9d4048ac8ac266e7732669eeb017b7a32ba027abd590ebd39658a443baefe3a125f28fc5ad00176efa7bab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000040
Filesize
31KB

MD5
36c9caa1478083bd6ecf7c07649ff6c3

SHA1
a44d0b10ae53f6ea46bc450acb5798c159a1e412

SHA256
c5aae61399b871202548f1f2df7af726b6ca8b8026600c6ce1cf9893ad0d80ca

SHA512
2e15e8cb6776985ad7d30f9ed750052334027e4e38adf80ee6f46f3cf9f9b2b79a9df1913b8f854ce81f39c9228313c2b7faf597cf19fef5ef0b127ae3b2b1c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000042
Filesize
27KB

MD5
70dc4f19424ed6d1eb3edf2e3acffdfe

SHA1
f5e03c8717997457ab5875098caf342e959c52fb

SHA256
4f0529047afe2ad52d6b531440745c009727a374b0302784e5993ad85b3030c5

SHA512
92d0562b604a951bcfcea32569343eeee2c400149faa84375b8eab5f4432bf97bb833b5f9c7c287b1f8f1a330bda52cc9a5868cd35a56789beb7ffc1e9cf7580

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000060
Filesize
19KB

MD5
2b845c3bbfbcb4e28ffbd1838368decd

SHA1
4414c101a651bbc06ab2d1eced6932338278e7fb

SHA256
addd85cdf92ff6c8fe37ab271bbaf49b204ebb8f0e0782ff412959c1e9ac57e4

SHA512
c6a374402b6b038387d385b81040d0d6ae83b2a503be91335b4b641e9eaecace2696871b7ac79af7e78e526212de77f128738cd47142c8ff1494a11bc3a4548d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000064
Filesize
64KB

MD5
d84862513956cbe61aeb4ebbfdd3355a

SHA1
14ab269df17cb0333b1556ce120d587324479f6b

SHA256
a18b26912ab9e034923cc64fbfdb59d682500f2c556456930e480b6bd69e33b5

SHA512
d04ca96d72595f1e291a6ce96f092c1707064800103cde733512a186c1b22e089b63690a0c53965c97248dd782731b22fa2d27b8ee3ae112647382f1c06d1a9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00006d
Filesize
20KB

MD5
1435f3cfd01bf0f3c24b8983e6780db0

SHA1
439ab7ffa6f9d5b654710691d8736eedf2b6e892

SHA256
8cd3f9f312e86bade2e77eb25c28eba805707909441d49e29288944677ce6d47

SHA512
dded0517b2c8f6c6ea045ba87f3ae870df63843291c3e2219e7bdeb4e33baf360b5fdb6065f0566fd1c79253105574ee4ca8cb13a11f7e6a51bf20eacf03155b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8895ef8cbcf693fa_0
Filesize
53KB

MD5
7afbeb56dadd80e9dc30e96da5b5af3e

SHA1
15b8f8874010b7a520c616809b7c2b22c2f75394

SHA256
a215ef9a3c9b1950680b7136845d96120c28c43799bcc8c0ec9b3d12b90fcaf0

SHA512
bc86db5d3f073461509c4f730b6937ef7e098c2c3b1295b91ee174796dd310ad50cae0127db53f52603967c78218bb09df5f066a0f51b315d69b1db7b576a38b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Filesize
1KB

MD5
a41d95456380f8263a1d19ed8ccd740d

SHA1
70bc34640d8ec8a8b8f310d9bfe3d57225ab7eac

SHA256
82a405415b7ee5842de95da74fc4ffeb78ea3b014851e14a0dcc4e67850bddb8

SHA512
1f59d9b79a8c1e0efdb59afbd30d0f587292dd24febc9d4f517d9ecfd843daf8a26a9ef569678af94d5ec0bcf81f583d6aa7424cd79f0ecb77d05809b9cd5ba4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
5KB

MD5
d242d9a99974b3efa51bf11bbbf1f5f8

SHA1
8502ff7c3ab080bb4221e5e7eef8088fefbd0d63

SHA256
a80c643cce81b1e43584390df7d3c41f7025a5a6dd88aac3ad06d795308e2663

SHA512
33fa702e6135759a50a592233e72eda2c9a26a39dad645345714407036754d05ff93d5505225aa35001d46e99c3e6fe7a6b60cd94c63f9d200bf6111f943baf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
22ae7bdd833baf74a794f82c5aeac799

SHA1
a3ced5bdc0794ae249afde46067831b1ad4dcabc

SHA256
81276fed1d513d854f1476e352c73a454bbb338eeee53c682869f03eccefa731

SHA512
151cb534bc87421f5bc62a5e43d5abbbd6c48b67237e08a4ee5b535fd710183dca0ba6d2f77b802ecba6bf203e3dc2389be1ef5a56ff94b4e7106da4c1df0411

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
8KB

MD5
7d84a42b8a1033be37dafcd7e9cf0bef

SHA1
886a2e18f7ec0400088ee574d512deda119242fd

SHA256
79304e35caf05078833635fcbf6eb8b274b7b55647f74ffef17d837ab2119612

SHA512
a4ce20477a038150f0854f1fc3b7e5aa467df8b0eb418f27e961a25ba21172f8626c33a5f7f2b7a5d6bff72576718a1d270c15c9c11172e96fd53f5cd478f43c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
496B

MD5
30322550d9f9c54f345ea1c71f3b2e8f

SHA1
b5a3cff2995147279c2bbed7c03b2280ecb286e5

SHA256
4e7798d8476361378f8fbfb0442db63c7f6bf7e1830d50808bfdb8a58700d8f9

SHA512
261d1f5bc9c8a369f815eb846c252f54681f70862153bd49959411450870207b3ee240cc9016533c27401922527d561cc1ea7bb23708e4a257f071d010cf55ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
f61b81dd1bb451412cdfb04dde292451

SHA1
1e8da5d716d9c99971cd862e029b0320778d96ef

SHA256
734a0218ab0f20bd5c3b47e3dd2f2facf75445d34f38716c691b7b171d4c8d3c

SHA512
e8a3fa93507709f1c07bb41875db12ced24c4b901bb8d4fa4f4cd69c155dd99dc31ad580d0794c94d6c43828566083917169494a17568dbe8a5ded641f5d0488

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
7aa63bde841b6a1dfc201ce6d3c2e971

SHA1
7a1a5f976434d3ed787f915277d60ee04730b16f

SHA256
f6acd6f14358c08224bc63ef2ca562724d27e383b0cb16cb2b1eaf242d0a456c

SHA512
4d0fc051d6de29c1100b09e9bd2ff961f41b181a52892deb68f8b4c3b9991c55ccd32fce947703e53feda61b9989cc01928a55b5d2386c9be474c0cef881307d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
1fe9e7ead129e4ac651077ffa6c72442

SHA1
ec65c32154cec6d375ea12739c76bff85ef33ad6

SHA256
9a9bba63b3d507231dc593e72a5d3588d1711b18396747b91bb2718340ee3baa

SHA512
372f405fe2af1a9080507ce261edd07cbd4454e5e11775102c8a4b83e75671d7b3ddc9e01dd33276b1da25a97a0b78e24bf8545979ea668c848676e23675bdd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
12KB

MD5
84da87ff60dc6bb4c99cd8a10bb1025e

SHA1
e61f2664d8d9330b8f3d7e78cbf577407b668c3f

SHA256
e5e8c40625967b7934e68fcf5ff48643be797a969168b38cd5a7510fdb2b9cb5

SHA512
441ea1dfea231a83a98739718eab136572b6a46ec1b6b018a1b637622e2f54aafb2d1480d780668eb7072297fac61b0624dba0d4d5ca8103c9ca581073a02535

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
f803530709ffa903a5c1151940ee1bf6

SHA1
7d1f0bb90b0dec34782828804d8a1efa13ec4941

SHA256
c571586769f33072c68615f74cf591b8db002ca5412d62822d352573f733bdd9

SHA512
18a0b4ed6c057e77f9bd6a4c4d060d4ccfbe622784ac0d2aef2962c3b60ed1c044f3a93e98c1db5109bdfe5ef8b661e1007b496ef8a1a592e3c8ce89880b5a90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
12KB

MD5
7166f3beabb3b782913c6b3efde78d64

SHA1
62c985f30121d3115a5cc75cec94a8555d494ae4

SHA256
4fed8e6c4092eee76aeb3b0f36b455647190c820e9fde89a03feb22b7e4a6d7e

SHA512
1da573ddd970190c4237183fcbc0b2a020ca74202cf8109ce9d35fdc307a5628933791dbb2cf3f64d0909641d554379f18865d2171ebdf389b4cff6950800385

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
11KB

MD5
3cd0d6ce53d100eccc50ab1e01260108

SHA1
558c11053ba08733c67a6d2c40b6132500cc2d36

SHA256
ac42e6533faa23eab07e39be94078a53d6b20627f878c894305d99796f0fa6db

SHA512
d05d9dbf3ae3f85b2d0ef21f6d7812661a99a205797fb7a88a4dc1e31c2cfed10612240cf2d0d824fbd36e5d01a1cbda33bced706b9f5d6bc22811ef9072a666

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
94472793d54c2da7d32fd9926fc49025

SHA1
11c52b8d0749ead06c4bb8d1d500d76bc7d1c4ed

SHA256
b62fccef49892b44c53e448a6d29b33ee5d4884fe5e1bbcfd3d9b8904370804b

SHA512
f09245d355a9733763ad3f0182f2d6ad659dad9e60acdb63930c3988fc7b7c6d7c2c5c2fdd4a65da70a50e6d5be606fe5ded51400cadb55bd75bc31b1095036d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
4938d97455059574384d97157ffe5d21

SHA1
2ed28f17c487c9124833acedffc467c1246c480c

SHA256
11c2b2de76ccd379e7efc212f8b1c8c0f311bc30cf1428588464ea29b93381c2

SHA512
18041c979daf738c1696530f91399ef194df27588c511d1165b65e1f21f00c157fab0c93025b75bd6bdacf9e2dfd350132da6655755de94fab9c543e381873ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
c41a587fe3f1eafe4da427ae1790cde4

SHA1
fd0e6f9f0a93d0316d821bef2ba3006c7bb8aac8

SHA256
4a16ec51509a07ea4134e8752e4182f3c0e3ed3979743bd7bfbad06962be2cef

SHA512
14caabcb15046bc7076b74c3471d61d1fe0214562dbb0c999e18fe9e90d58496a1fbb8073fda7ecbfed503e17063c14a5269fa8f3bc429d4fcd124cb96b97401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
3KB

MD5
ad1497f5274f22c0e8f189822461f55d

SHA1
64f383ef79dcfe5ec526660fbe600e4a015ec36c

SHA256
f049a41a0e679e5cb2859e47f1b98c903e00f022620f6ccb7a53f816317acb54

SHA512
90260d22f719d5deee41b1d765b0c7f5c4e06b1ea7c845ecb26f73a9a11463bca698d931cba35733984fd1371f9417f5d89975d2d9cd3d8813811c10996de057

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
3KB

MD5
fdd7ae59211609dc097e6a1a181f329e

SHA1
b7982d353f89c8cb6e0ace78d06d4c59329d884b

SHA256
a16fdff17a7a59326701f8462330567dd8c6fa9259a172effd4f0d919d62ccdc

SHA512
8c53a5403f3d7fa61a6e135a8db8f58d147294341df38c5e60b9f1077efce6bbf8be3ffe58ec773514d258b295b48faf3a1d250c00195dce2524b57eb9d0841a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
4KB

MD5
73e4568ec0788edbe110999779abd229

SHA1
4fea52bc103801abbeb56fb97ce929f271dbd722

SHA256
020b220fdedd70ac26e9775eac0e7832c80d6466498f0871c3981118e2d0fcc8

SHA512
4b7c89d2a36e6ce9c16a0969b884949bbe4cd08f9c9b1bf97975ac67727b8437fcab1b24af53698c83747dc228b1092f089488b0649999db317f4d8c3727a245

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
196dd3ecbfb207ab970aada96e8d4c96

SHA1
cdf3c9cafdc1260875359bbf1d7c1f93cbdf441b

SHA256
7a4660bf19ff4e91f49c202b329fcae42db2545d5ce2360d7697a3ecdf20842c

SHA512
0762d4365c5c13a7f1c0cd1243398b34d07dc1221b145c6b0b713b043dbcb36f397354b8295a73162fe696f204b2ab47c25584e27c633b0603297825d819850a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
35d279a4bf8340cafa773c26e098a1ba

SHA1
beb8dcfc068103e3b483a9d5d8c71134467bdc10

SHA256
e20de20f2fa54b90c9ce9490962ee9437fe8c1e54c12d5bc8948a7bd0e368593

SHA512
151336eb4a76068a1a2ff0cdf408c1966aa18964a8587df6bc287063b9223294a0a5e201199f8ccd4bf2f453629148d933af5246ee143ffebb93f3f0d57cf5f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
24817ce85c9ebfbd5205b0eda1501498

SHA1
5dc1ae609fd587fccf435d085de5c6993a47fff6

SHA256
39973ca343fee3570b5f56033fb19fa93c5c0bb2ee3011732e836019df881b88

SHA512
069ce9145ccae5662d7b24a881873f944f9e1376bb59c57d12c50f785116faf9cad0de80d6a6467e2ac01c45d1067fadd1537c9a8966637633b4c1047220d8d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
856B

MD5
3a2b891987be1aed4b6b78be37ac50bb

SHA1
932711f63c2ecd4bb62363edfd962b01e65d26b3

SHA256
8dcfedd84c263f6f87917642fbc8fe0dd761a6779eb598330b80bb2dc10f204f

SHA512
ccc3bf8349305ecdeb42e10a59cd71b185a912e463cc1f09e563ae040d08882124a2aa9111ac90b0c2bc14c7c3d6221a87efee4fdab47857e878609ea5a8846f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
a8ae50d2315c1b13e9a1097921abbd7d

SHA1
663912f2d205cdc5eb9b78f3409d4b9fe0a5d6ec

SHA256
74a134db7ac589a070e9bc0f3816421138f245251d84f91b5a258fdc1069c98c

SHA512
92acab92591c591652e7f3f33949bd9d1481e98ea038ea09f4e45711439a9304b88ba426356a8aea72a046e8fe0faf05f3205d7efa86d89d9845e6580018a074

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5813b2.TMP
Filesize
856B

MD5
b4430d560f34efa42ea48acfd55359e6

SHA1
029a6dd4169394ab577c26b9ea8c6b188607c31b

SHA256
0d48c5d0b7f82ba2d60ad1dfaa51cfc889b3a17df4b999fae0ece537267b4470

SHA512
29260c691cebceba17733c63b542fd2f88bd37a194deaf48a420b10ccbc6ace558265dd2623182ea08d82f59de5d429d21313298dd17a69f6e9157802f53801b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
60ec75f0f339be46024cae194cc1843a

SHA1
d9304fadc26f6058ad08adb272025152635b52f0

SHA256
d7bf220ec673ff4b22e0e57f0b50b3ef88c9e5092b8825dd236e763643578865

SHA512
1fa04de5be6d916a2b89ae849f83ec5d99334ae44d71d645ed900b570e1a6a6b493f961b3622eaa0635f95d5e6d197cb8881d5f3edfb946474f4562b88d16758

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
7c071aab76e26db58e4fa1ad4db6be15

SHA1
ab09716fd55d5a451ecf214521f885ad56a9e955

SHA256
01f037f9c5ecc38f6d1f11d84f77acc1e568e9f00231b162e1cc564e2fc27760

SHA512
4bca8518b3acb4eadf3a9bbbd14a8c331f98f29da8b716fd142f6772f5f4067a67b0353cbc6f971fa66cfe6032c749c7be76787fabca344b93c5786897d89e1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
95a01d4db8d16d9ff72de7cd715c4b4b

SHA1
cc635cfcd09b5bd9ef02a8d7bf6028f25417290a

SHA256
be5b1612dd94efc221f0a6954f7b4546ad7ac7b28c921e82fed826b19ffc77e8

SHA512
01409106e699067b759cd06415d817d987b742bb6a980db1b4dc390e861f5666da846d78ae8c00c986b819321f2db0f3d42a6210e6d349d380676f245299847a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
3fe8ec1f03893afa5789928573eace88

SHA1
8e4d4f7d237f2ab6700fb20286ee0dc272098044

SHA256
9d64bb72b5fb4893484b96e0e661028c8b748b4df8e58b09fba8fcd70afa175a

SHA512
db6106fcc8ef79183ad341dac04ecab80634edc3adb68462a571409d4998c849d3b6ffc43e9e8b6a206fde9265457fc4cd7ba984a53e8b2337a8e4fe50a71550

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
ab6e93e2efc020e8938e3ff9d9902048

SHA1
289b4be0d4c374eeb0aa67f7715f3139e500358d

SHA256
0be96ce6852cacd49a305c2c96eb138e7c5013592c3e614c0415015243d5eae7

SHA512
fc0d8f2e3b197b840a732885feee6d6570dca38189469c0fa4b4f35d194526f97648b60ec3a1b2648c5f6b21aa5d337df5850e7ce0e37ead6387064452ce6675

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Filesize
14KB

MD5
5205ba9a7aac7841a33d4009ece6cb5b

SHA1
de1cd385f0df1a5515b2de2397d9d852da791c77

SHA256
173a0ab467a2f06db87cdbea2b09826e0889ee0ea8598437a80980a148aeab83

SHA512
8d645df5eecf455e3c8414cbbd88cb8a27695b245cc1f822f17a858ee2bde793c0e07751c1aab18e0eb9604e3a0a307ec1e215cf17d3053e07d2e0022c901869

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mg2c1myw.default-release\activity-stream.discovery_stream.json.tmp
Filesize
24KB

MD5
d1f4a9f15337f5b6582635e3c99a50f8

SHA1
870d779620e85c869484bf52068b7d8f4b6348c4

SHA256
847581361e7118025486c02495929aff61877d9b6b85ca85b868c643e8eb89ac

SHA512
82caf33f39cb8383483af59dcacd013aa63e7b6fcade69a9f030695c22a7acc1d4952615313748c0248902e6d3a55f014cb2fbd9eb630825e4735e695825ec9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI22722\VCRUNTIME140.dll
Filesize
74KB

MD5
5f9d90d666620944943b0d6d1cca1945

SHA1
08ead2b72a4701349430d18d4a06d9343f777fa6

SHA256
9ec4afad505e0a3dad760fa5b59c66606ae54dd043c16914cf56d7006e46d375

SHA512
be7a2c9dae85e425a280af552dbd7efd84373f780fa8472bab9a5ff29376c3a82d9dfa1fef32c6cf7f45ba6e389de90e090cb579eebff12dcfe12e6f3e7764d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI22722\api-ms-win-core-console-l1-1-0.dll
Filesize
3KB

MD5
0a79fe89d36672ee97c4c921e91fe6a4

SHA1
55d8dd3152f01f792bb46642fa9fc3db24a7d976

SHA256
149ca27230838573829ff0387a0df9b0a9a8cec76e3968072404234ade22da77

SHA512
6ef1d45f0d6dc8ea3573b1b30e8adc4298bfe51da58aed27f5d580d20c436546b37613aeb9c63d012b5b3de2ec56a1490716b704afcdd5f6e5556c107f7ec275

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI22722\api-ms-win-core-datetime-l1-1-0.dll
Filesize
3KB

MD5
040d23778f9ca943f6d1d7713beec10f

SHA1
238bc7e5cc7662e764f7920c3a39a96ea6aac9b3

SHA256
48f9df227b6503ad00ee4dd3074f54ea0f465254f7a5dec49c530c28dd7c35b1

SHA512
c10862dac1978277029a65406b7a3884aa12e8b2c44a7133a0efbf7fa22106429e55ad248df9f95801a72be2930ec5c9a57a447b9a2ac10c528af0d0046662cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI22722\api-ms-win-core-debug-l1-1-0.dll
Filesize
3KB

MD5
99cab050161fc923d0e822e6153e6c97

SHA1
1c372916122a0a2485bc62e943f85b97e7762519

SHA256
f9ef7c3f86992053d4c674c838e4b913e33fe96664508aa96b5180e7ce2a003b

SHA512
c2bab4bc9bc41563baff9893dd2561c276bf5bf077ac6bd22e44d87ecc1c75b66edd38619ea68684abeb98e8707284d51d4f1d5f98521384092b58ce44e2c621

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI22722\api-ms-win-core-errorhandling-l1-1-0.dll
Filesize
3KB

MD5
875a7ad01fe086b31cee517ab7912134

SHA1
470ea59219e7b1c725c9df074c7213addfda7292

SHA256
0d46452889a897250a5c4fc842a7c9546d38a27e9b3f856520bce4d79a0201af

SHA512
4753cbff86e67a9472ff85aca877365f1bab9c0cf48c38901bb8f5f1257c5e9aeb64cd04d6d5c5b3ae449759bf80b6bd8eee75e11adc86987c08a9150c0cfa43

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI22722\api-ms-win-core-file-l1-1-0.dll
Filesize
5KB

MD5
ed08040a4d19dc3261a0b8d23e9925b8

SHA1
1166aaa1f257749561b74fa10575564b3f65021e

SHA256
38c48f08b047935856ed3290c99646df06a551c30e2ff4e1d8412136abf03604

SHA512
bbbd1965733684b1a78074cd765e5494f15b1f8922ddc48bcb317448b5d536d25ed4b6ef033dff95b91be7151b9afa42e54e4ef9063035c7abf3195708ebe53e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI22722\api-ms-win-core-file-l1-2-0.dll
Filesize
11KB

MD5
04c39b760247c6eed86854f657833347

SHA1
9490b9dcd3f91b06fa7f3028dc5df5b4a22d4fbc

SHA256
f56b749c01cc82118ffe538674df22a1f4ef7a07e94e559d25f55ce104e7b095

SHA512
5a5c9e8a1e41c4fb9aa6c0a50b60d14e4e727d951eadc3c1d475a905ea5fa5fcee8f801163206ed2a8ff651506cebcce9611afafbb3c7952ce9790f6e292e2b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI22722\api-ms-win-core-file-l2-1-0.dll
Filesize
11KB

MD5
8403e7b9ec4b0c4f6c9bf0ec93687c77

SHA1
7581e7d872ec9c00f33bdac9690e55096db30172

SHA256
a8b79e230a81102735996500dd00d34bfa77955c11d87c0f9c967ec85003e116

SHA512
a1017a6115c9375ae0ee5ccc40dcf354dbe1ed3067c027c99f3d4b4045c9ad50ecb833e587579153f6b819abd27399bfe8f47bd0b898b1f1c901ab3d4a8bc146

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI22722\api-ms-win-core-handle-l1-1-0.dll
Filesize
3KB

MD5
1f18b14870a12562d6d46f63949ee8a1

SHA1
f51f843e9bdc4536c7b5b86ada3daef0c72287c8

SHA256
3b04f4cbd854e624c4b787d71231efe4985e90ad269665ef55f654245bf6a2ba

SHA512
050f56bf932c38f5f14f044ffdcd9409c9af41b01ac1fa8533f2db7214341a8009dbe5929cfda725ed8d321c723e4e1d69501352af8f726b94db354f6b00a244

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI22722\api-ms-win-core-heap-l1-1-0.dll
Filesize
3KB

MD5
655e692ce254d532653e1d6a9b046f89

SHA1
2ec7ad9b44391d497d913b01cb460cd9b88b7ac9

SHA256
bc7ee08196bb37384fce0c68d19d6682ddccfe718c2d94d4f1ff462f48a0dc56

SHA512
47109efcc0303e210cc6ce6db2d5df8f02d5375b99bef4c817f1831e0cdb8ac48dc6302ab465c712d4fe75f4076d2371de0964889891594be55641a233d1b6e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI22722\api-ms-win-core-interlocked-l1-1-0.dll
Filesize
3KB

MD5
7c022dbd0b67e8f325bcdb2dca783f54

SHA1
a3954fab8b5784db85656b2bb8bcd9d9d020f385

SHA256
5d87839618485a00abf5e5eb060f56e547aa04160fd1a814e0ce07b1343b8cd3

SHA512
e676193425953cb7f891440c369de95f8e27205fbb416dacc590890ca28074931cb5b2681faea591d10199e4e7c0dd542b55cee2cec44e2b363a1daad61184da

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI22722\api-ms-win-core-libraryloader-l1-1-0.dll
Filesize
3KB

MD5
4f6d327e407b7b25fc3412d78cfce340

SHA1
6db6584620aeedba8d4ac28fe61a9a77d0bc520d

SHA256
7b373b8522686696e037f9e6efec34c4cd1af973db494d4fbb684e479f3af126

SHA512
892f38d400bb52b5bcadbaa5e9df83bc74fc59441d52edde9c36c3e886404843c956a68d7e61e3813be5b210d1e38e6579d743e42c9b7bb99263a677bfd4b979

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI22722\api-ms-win-core-localization-l1-2-0.dll
Filesize
13KB

MD5
2e2c78125c66cde5859559f5e6167034

SHA1
f00e9cdd8da93106fb3bc060e64c643e2274a598

SHA256
9bf2bff3adcb1fb5707794b18320d7113f45446dd505eee43abbf8835cd73a44

SHA512
9bc9158284dedd0dff361b7f4ec3bf32b2915d4aeaff5a8d8ed51ccdc1e34ea5d3781343c489614eebd02323d6926a865ab94d3efd6ef6f34779364ac1752e1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI22722\api-ms-win-core-memory-l1-1-0.dll
Filesize
3KB

MD5
0b3c721613ed246970e1a94288c360ab

SHA1
6b364e8c21ce0a77fe61bc4a62ccdef0d6585562

SHA256
8f65d3f3f048536d57c73ac9cf75c11ae6c351426e864812de911cb006ae486f

SHA512
bb9e9e32b663a04a2d0dbc79195a093f240079daf39c129aa776e83c9ab9a561e5fb346720a2d45ef8206cdc264d449d7403ee2b09a83d2a5f7be3396a8cae0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI22722\api-ms-win-core-namedpipe-l1-1-0.dll
Filesize
3KB

MD5
ac152d5a04b92204ecbcbb02050b8768

SHA1
720769199fea7c6a30747457e9a364cc4f6f2397

SHA256
77b429db0e9ee476c60ed741553579d0da38e17acc19124a025d2a127ff79fdb

SHA512
bb08b98a786469d2b7d99578a67fdaa8867f8834fbb82d9d5d503848375bf6b88f78fbc54ea9904fa6a8a9b20f01ba0c34a5c6b05c979eba54e4c84c7a58a48e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI22722\api-ms-win-core-processenvironment-l1-1-0.dll
Filesize
3KB

MD5
87892d627fa98cebc255669373c99059

SHA1
89091ea26952b32310df510c28dfbb6a5ee2845c

SHA256
be9d1fe8da58a2032e2b9057c6269b33586f808dcd86f3a587773bdab850f764

SHA512
244b4e84722ea05837e7ee629ffe406ea6fde3faf5f96a3b391b18e997555847b5cbfd7f039d73f884cbdadec6f88db2a5cdfefe01c313f7b7d2a36ae7a1d39b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI22722\api-ms-win-core-processthreads-l1-1-0.dll
Filesize
4KB

MD5
327658416c901ff49a9e720a8bc68729

SHA1
047456b82861ffb42e4c36f61c49d8a9a3add09b

SHA256
7af0bfd652b88b6f1a4d5e09b2d1b37fe8404158b6d83b137864cde9207ae4eb

SHA512
92d11d7f177712cffb693c2ee8047a20d09ca1074a9ed347f208808ca6e5b4fcc0e57391f1183acd1f3b15550250362467b48fdd460708cec04bedcc209bd12e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI22722\api-ms-win-core-processthreads-l1-1-1.dll
Filesize
11KB

MD5
5efd5f4b617e95043898dbfd78af97fb

SHA1
70babd7098b05c59484a9dbea77f4b5dcd2bf9cc

SHA256
cfcefc5af3f7a37242dcdbfebedbb954a0d21d93175441bce680a1a4c1c9fef3

SHA512
d09444a042e18655f1b994d0552db0478206dc1901557fdd9f58df5fba58654007beeedfb185f6d5958a25f287ecde84f5173c4cd34ceb8a9d507fa7f9d027be

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI22722\base_library.zip
Filesize
824KB

MD5
71f009bde4035ae76bc579ff05cc96ae

SHA1
901c8fa78f681096149f4240f71f86f11612f22d

SHA256
6eecb9ecbc244eca6bc33e6eb6969a3fafc23fcd4c7eca55ebce50c0a34a3c8e

SHA512
7c5b7325a8d8656e6ca9573f886bc2b0386db742d4230344b3d66b076e6aecd356ed757f8ee67761be6d3d994d8919bfa02c5600aebb25e2621a1c795325b710

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI22722\python38.dll
Filesize
3.9MB

MD5
9f8e0de6e7d4b165b4a49600daacc3b1

SHA1
8cf37d69fdaf65c49f7f5e048c0085b207f7287b

SHA256
a9675a91d767095c9d4a2ae1df6e17bdb59102dbd2b4504c3493b0bcbed5ef55

SHA512
3201b7adf94d3f4510e0b39b4766d1314da66662819fd6de5f5f71956750bb4fdf4228b6e1ad9d4d3bc1fdeb99b7414ed2eff0374aaa3216b67eeedfb8673b48

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI22722\ucrtbase.dll
Filesize
880KB

MD5
5b55e9a1360a6c52cc988da6804d6ca2

SHA1
ab36f680029c672b885d52ae376b80b4752f5f80

SHA256
ab2bbec93fa2af707d9c55b3db442dde6561d1799e53e74c7f6345252989798c

SHA512
b7b3116bad981464155d1c8b0a0db0793661f73ffa20d1e37e52f3a3785635afe1b803e65d657213adfe2d6a972e84da10050f31522e8acce27b65f2a8bc4261

Download Submit
C:\Users\Admin\AppData\Local\Temp\preproc-7d2b63.rc
Filesize
156B

MD5
692d50f06e151acc3f1a27e20c5384dd

SHA1
35af76250880963104ee6a35ecd6c5cf7d394214

SHA256
b983b876f2a12ee6cb20e5492f5e971ce1c75821548e1258eca95d5ccf7b0852

SHA512
a95a0448063cc757163ecd7e06697c6721ab1b115ec16e95107f2811ac1316515503d5eae5cc4d2467292919dd8633219fd03c1c3de7968fa2394460a6488782

Download Submit
C:\Users\Admin\AppData\Local\Temp\rc-84b0bb.res
Filesize
32B

MD5
45d02203801ec5cae86ed0a68727b0fa

SHA1
1b22a6df3fc0ef23c6c5312c937db7c8c0df6703

SHA256
5e743f477333066c29c3742cc8f9f64a8cb9c54b71dbc8c69af5025d31f8c121

SHA512
8da0bf59066223aab96595c9fbf8532baa34f1f9c2c0dee674d310a82677b6c7d6a1cc0bbaa75262b986d2b805b049ec3a2bfb25a9ae30fe6d02e32660f15e83

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\prefs-1.js
Filesize
6KB

MD5
9c73f9f0d6ff7b49aa5a5ded004f53df

SHA1
8d4731cd89212865df272e677bc29a6fab7db31c

SHA256
190288f99faf8d3ac34b825fc54681a8d370e8fecf9efc321b04197dd913881a

SHA512
0db095900817969960824899957c2226ec0b93f2d28fc447a21c0b6e7245db62e6d510aaf3af521f8b9c8b3e2906ff8f282fd4df9b7652866e5d27d53d645dcf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
3KB

MD5
8645da3520539100f1b626680f2d68c8

SHA1
4f090538df1d9693a6e2d5dcb1b0750df5f25705

SHA256
9a8876a2ed492775ea6476be92ccf6f92466063f4921f57766ba811c2e87e4bc

SHA512
64462d07459d2a02bc51837a08f371aa0850d0a455caaeb064742ce31041aa852d32f05703be96c5c9287d88be0efaf06d6647ebf78104b409f4e9d68525c2c9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\sessionstore.jsonlz4
Filesize
4KB

MD5
1e595d528c5d4c2e9352f345dd966bea

SHA1
9de3e3aa98bcba5404385d6708a96c76bae1d368

SHA256
10e4d1ec910e8931cb340a31484160d7dfdc41f64a9105a94340cdb4529197c9

SHA512
f99ba08e49540e4f793f06b68688d48531bb5f6a67f7a249dcda220532c2a8f5506815fd422abdd9abed435019597c05743d9b53f8d9a8a34dc29bb3f2999297

Download Submit
C:\Users\Admin\Desktop\UCompilers\SysWhispersU\SysWhispersU.exe
Filesize
9.3MB

MD5
1a4e1811c0995f5a775a43ccaa9884f2

SHA1
6c7d1ee96a2e37225d6ff284d42efd451e58ed43

SHA256
457631e02ca9242f7a2193406b35d317b3f7138e22a9515bd296f0c88010e6d5

SHA512
41b33264bf7a2bd1a4e71d702af81ec4b05a189757eb07b5a57e9e6fe195bd6b4056239113892b7ec06d88f39ae02dba80288ccc7fd810b5f80a61ab0bede808

Download Submit
C:\Users\Admin\Desktop\UCompilers\gcc\bin\c99.exe
Filesize
15KB

MD5
f3a47df94cc5ce61fa8760b1bc641840

SHA1
7ca19189b6494a9d3be1337c2b073885bb83bff4

SHA256
17c17ffdbc0ea659790e46301e559f6c9cdc108b298a965d03c1d64996ef7951

SHA512
489b7e85bd85b79a523a6ff7c837718885b19eb8935454e1a35a68533cf031de4030e515c7dd9596afec0565279c9b561a8d26724d457208ee685f21ae469db6

Download Submit
C:\Users\Admin\Desktop\UCompilers\gcc\bin\clang-17.exe
Filesize
109KB

MD5
7a6b3c4ba692dc9e7e147b1bb78a3bab

SHA1
4e7d4db1b6a0a55feb790432deaddbebff2b3bec

SHA256
de798a6477e80d7036246de08d024d8ba59a4039a2872331153e7408c775cc4b

SHA512
7ff3e88397cc563ad488845a24812114557335b33dc996c4562c1fe2d3c498a5879c77f5284d4f760e04ab5c8d794ae6e492b312e2189681bec80ec89067c312

Download Submit
C:\Users\Admin\Desktop\UCompilers\gcc\bin\libc++.dll
Filesize
1.9MB

MD5
06976b9f6d38a041e86f4a6b225cb2d3

SHA1
efc894cac7577f6fad40f470719cdfa5719da6f0

SHA256
59e4242db4f9fa010aa0ef1e478dd0393ffdae6c9c25f6edaebe8b68b7986b2a

SHA512
2969b1694e88cb7f55a73179b8480ac175dd3eb45f129d5a731311e4bd990fa044e0c47a5da7aa8774cd741886e340b32fc1cad9312974e8f17e56cc336a8bb8

Download Submit
C:\Users\Admin\Desktop\UCompilers\gcc\bin\libunwind.dll
Filesize
211KB

MD5
7e05f6adbf182ddb315a9365c0794177

SHA1
f22caf4af16b3162933d2e2f107dded394d31f80

SHA256
1aaf304b3c51ceab1ddb647dbb5db1f84007744a081bed0fff27004b515f72c9

SHA512
c4519b191a686303fbb5af260f4b9a5ae3e8ce4e48f3172bdf1ad2e272fc108e1771a48d59fb1d4655542ee4c567c5569c46e56c2db9c19658b2856996409826

Download Submit
C:\Users\Admin\Desktop\UCompilers\gcc\bin\llvm-dlltool.exe
Filesize
92KB

MD5
a0b761689eb88cebd4ba50195678c118

SHA1
f4d1e750a7b3f1e6a017b64aa05262f8752891f3

SHA256
3fb64f754bd7b552d7f5f735cbbb097b7d9e9e268c386c4c7f519359d9c963e3

SHA512
ffeb39de6121cc72ade0b256a96745758b8620f2990e4a6a728f77ea352ebbbfce8ec3c106c0f8091c6772614b313d501c9eb7a472f9d95b8438f2c36cdc7cdb

Download Submit
C:\Users\Admin\Desktop\UCompilers\gcc\bin\llvm-strip.exe
Filesize
193KB

MD5
80393b9ac586d4715f019929c9a9ba2b

SHA1
8ddb748348850fb920bb17b24fbe4073ee22ffae

SHA256
3ee4826132ab26e111148a6164a4f38fc16149d9f87a7ae7fa016f1a5dc20a13

SHA512
9585183476a8b22ee54f5259ded92218d95442dacff05909eb7379eb166734f1a2cc85f5617b5993ee74c9807287efc104704132137a3fa1f5f4352cc023eb53

Download Submit
C:\Users\Admin\Desktop\UCompilers\gcc\bin\llvm-wrapper.exe
Filesize
14KB

MD5
fc664fdb9ad3b91fcfa5a188dc07dbfd

SHA1
1920f010996c76fdf9549687a9a055da27706707

SHA256
beee5bc8ae86237ba3154c6429837199da67179f34b0c419aaf9d7f4a3c1f7a5

SHA512
85d387ef67042bb0a44864459f2f8361990fed2560b0f982ccd5908a6616df32ec4e891287e458bb11578a7adb31f0870b08422f52cdc1369dc948b1237ac924

Download Submit
C:\Users\Admin\Desktop\UCompilers\gcc\bin\windres.exe
Filesize
162KB

MD5
65767fde1d11cd7b2f59ab8d8a8cc393

SHA1
7089cd03e0e03eadc9f0fc2a3d9064389c9801d6

SHA256
eea39fdf1bfb5de61002656e65563bf8e90c995f7285009dc1ad4c3b59441da7

SHA512
98c59c7a095bd319aae48386811b13195b97ba312006d0a64690b7ab27d02e1111aefc5cf78f605376768ee10295b5a1faa7fe3d9e90b26c7cbee36024836861

Download Submit
C:\Users\Admin\Desktop\UCompilers\gcc\bin\x86_64-w64-mingw32-ld
Filesize
1KB

MD5
54a013e73867cb604a5d85316ec40160

SHA1
b86df8e523472993bdd255ec34efe767b4ed72fc

SHA256
5300466c8181d26cf8426f322ab8efcb5995a6056090d21d3aee1cdb1c021aca

SHA512
1831c628f4b73ff3d31dbfa5bc1e117b0cae90176c36227f7446981c55a7dc46d7b41dcb898d4b5e29fc8405faa352ed11fabc3e0dd5a573c2bb81ca048178ee

Download Submit
C:\Users\Admin\Desktop\UCompilers\gcc\bin\x86_64-w64-mingw32-objdump
Filesize
1KB

MD5
e2fbf183aa372d0a9a0cbdf8671a938f

SHA1
7801eb58a97dad714bee99de01909dae0f0fd08d

SHA256
7f90e4d330d2629c72bc8575b50db9bfe9a0c3a1f119a9ae78419c8fb57a563e

SHA512
e8d0c0f628db900e088ae25812e6e5d0e18118f400ae388eeaac4c464cb5e9114a602e0d501213bc5a082bdf8afa21e9c95d8984a038a303e90d4c3bad84c116

Download Submit
C:\Users\Admin\Desktop\UCompilers\gcc\bin\x86_64-w64-mingw32uwp-widl.exe
Filesize
513KB

MD5
51959395f79ddabbe42814f0f31b6342

SHA1
bc8e520fb6c5f340efc3ab5b646ba6046ba02221

SHA256
5dda8adab6cef5f8fa72856f828a17f39903cfcebbed29448a0d3973f819fac0

SHA512
f8873c526fc1a900fafff8d5af065884c36d03ce62d0784b8e822f8ed27a404b4a93b9107b2070c158de7e76896e2193b345c36521fc5d0bcaf2cdde34e06504

Download Submit
C:\Users\Admin\Desktop\UCompilers\gcc\include\scardsrv.h
Filesize
238B

MD5
1f0d70d404140b0b980828d2d02345ce

SHA1
cc21371a235a392bd17807d6774c60e64ff5bb28

SHA256
a32207b286686ad5f42d72a5c96308b96c5cb5f42fb2a7deef01843e657c6035

SHA512
d1a5589be969b15e09379c630fd56849d2a57eb6d26068899753c7701c97ff695fefe63648749f2bc7526cd0fd8816970ecec00d5f476f84f9cb10c0e9a377a0

Download Submit
C:\Users\Admin\Desktop\UCompilers\gcc\include\txctx.h
Filesize
237B

MD5
78e0d5a995d78a006930de3633bbd3be

SHA1
f58a7650dece31af5c4f3931981dc9bb2584c101

SHA256
255a11df990657af623e682c7c3a81274fbb4a80c10f1dc2280cb3ce4eb98cf4

SHA512
18a5f5166a12b157e5727e7e4187c1b9521530419fefbb355be693da8fa959a852a6b00eadf4d759c74931f7943ca3f08ce01ac7497a80892b79489aa1bf8b38

Download Submit
C:\Users\Admin\Desktop\UCompilers\gcc\x86_64-w64-mingw32\lib\gcrt2.o
Filesize
2KB

MD5
b00a05297c3997a1a1e6632d9af03cad

SHA1
7e816d46f5235faa2e6709722dd2fa5b2e3694ec

SHA256
35f23433e5b9d07be419247fbada6bfe9309bfdf842934853b3448b89a853c3c

SHA512
7cb84eb6ad032980f46c9d2bc7a6c0137354e3f63805498fc996695cad747f5bac6d47e09988af9d399e376c2a5712c3548e3f9806a15594ec80ba34d79e53b0

Download Submit
C:\Users\Admin\Desktop\UCompilers\gcc\x86_64-w64-mingw32\lib\libd3dcompiler_35.a
Filesize
2KB

MD5
d2c085bda6edba7c0bc2611576a3eaa2

SHA1
0b82e1b3d5e9075d6411432b8838fd964b7a6b7f

SHA256
a836e2c842878a7df2351079edc9cbaa5a9dd14a2a1ca4ef042447d4a5446601

SHA512
dc9c5afb02d3a2cab3028f086b822738c39c366358bcf12a1780e5be14eb55c865ef6348e59e94f4896c3fe5db383c5bb83009dbe2bdbf7fd65701cceed87567

Download Submit
C:\Users\Admin\Desktop\UCompilers\gcc\x86_64-w64-mingw32\lib\libssp_nonshared.a
Filesize
8B

MD5
ab0a4c8c62da160eaae565341c07f202

SHA1
c98a17c08a612b399bcbcffed621456142bf10af

SHA256
f0a17a43c74d2fe5474fa2fd29c8f14799e777d7d75a2cc4d11c20a6e7b161c5

SHA512
220dbd2e437313c441bc34a9707ccc2e70a9c864399cfcb2aad34a012b75c45316758f8b6e85c668920beb510e0a4bc11a3129ee4d9df25a3fd090e944437dab

Download Submit
C:\Users\Admin\Desktop\UFiles\resource.rc
Filesize
693B

MD5
11600d490657524458fab5f7562eb1eb

SHA1
800f678bd6f5fb6469e89ecccbc50a9b85b825a1

SHA256
6878e8e101f9448e7ec918ec50d483680fd5f304d019544592e00593af8872a8

SHA512
dd88b24dcf07c05b86fda91fa4bbffa0476fa475f085fd2dfe0c23205c7d9df43abae9bb2df56172b48d943b6984b6fb83db44cfc5c845ea1d7eff2c554df231

Download Submit
C:\Users\Admin\Downloads\Silent.Crypto.Miner.Builder.zip:Zone.Identifier
Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
\??\pipe\LOCAL\crashpad_240_WNDWTZGZPOSAAIWS
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/3128-9265-0x0000000000400000-0x0000000000617000-memory.dmp

Filesize
2.1MB

Download
memory/3128-9270-0x0000000000400000-0x0000000000617000-memory.dmp

Filesize
2.1MB

Download
memory/4040-9246-0x00007FFD220F0000-0x00007FFD255BF000-memory.dmp

Filesize
52.8MB

Download
memory/4820-541-0x0000019E74AB0000-0x0000019E74ABA000-memory.dmp

Filesize
40KB

Download
memory/4820-540-0x0000019E71530000-0x0000019E71542000-memory.dmp

Filesize
72KB

Download
memory/4820-247-0x0000019E73490000-0x0000019E734AE000-memory.dmp

Filesize
120KB

Download
memory/4820-246-0x0000019E74770000-0x0000019E747E6000-memory.dmp

Filesize
472KB

Download
memory/4820-209-0x0000019E67A90000-0x0000019E68A90000-memory.dmp

Filesize
16.0MB

Download
memory/5880-9152-0x00007FFD10820000-0x00007FFD13CEF000-memory.dmp

Filesize
52.8MB

Download