hxxps://github[.]com/aliimran2000/cryptojacker-chess

Resubmissions

24/08/2024, 01:39

240824-b22paa1brk 3

24/08/2024, 01:35

240824-bz5cds1arj 3

Analysis

max time kernel
147s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 01:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/aliimran2000/cryptojacker-chess

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
2572	msedge.exe
2572	msedge.exe
2588	identity_helper.exe
2588	identity_helper.exe
5464	msedge.exe
5464	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 5104	2572	msedge.exe	84
PID 2572 wrote to memory of 5104	2572	msedge.exe	84
PID 2572 wrote to memory of 4136	2572	msedge.exe	85
PID 2572 wrote to memory of 4136	2572	msedge.exe	85
PID 2572 wrote to memory of 4136	2572	msedge.exe	85
PID 2572 wrote to memory of 4136	2572	msedge.exe	85
PID 2572 wrote to memory of 4136	2572	msedge.exe	85
PID 2572 wrote to memory of 4136	2572	msedge.exe	85
PID 2572 wrote to memory of 4136	2572	msedge.exe	85
PID 2572 wrote to memory of 4136	2572	msedge.exe	85
PID 2572 wrote to memory of 4136	2572	msedge.exe	85
PID 2572 wrote to memory of 4136	2572	msedge.exe	85
PID 2572 wrote to memory of 4136	2572	msedge.exe	85
PID 2572 wrote to memory of 4136	2572	msedge.exe	85
PID 2572 wrote to memory of 4136	2572	msedge.exe	85
PID 2572 wrote to memory of 4136	2572	msedge.exe	85
PID 2572 wrote to memory of 4136	2572	msedge.exe	85
PID 2572 wrote to memory of 4136	2572	msedge.exe	85
PID 2572 wrote to memory of 4136	2572	msedge.exe	85
PID 2572 wrote to memory of 4136	2572	msedge.exe	85
PID 2572 wrote to memory of 4136	2572	msedge.exe	85
PID 2572 wrote to memory of 4136	2572	msedge.exe	85
PID 2572 wrote to memory of 4136	2572	msedge.exe	85
PID 2572 wrote to memory of 4136	2572	msedge.exe	85
PID 2572 wrote to memory of 4136	2572	msedge.exe	85
PID 2572 wrote to memory of 4136	2572	msedge.exe	85
PID 2572 wrote to memory of 4136	2572	msedge.exe	85
PID 2572 wrote to memory of 4136	2572	msedge.exe	85
PID 2572 wrote to memory of 4136	2572	msedge.exe	85
PID 2572 wrote to memory of 4136	2572	msedge.exe	85
PID 2572 wrote to memory of 4136	2572	msedge.exe	85
PID 2572 wrote to memory of 4136	2572	msedge.exe	85
PID 2572 wrote to memory of 4136	2572	msedge.exe	85
PID 2572 wrote to memory of 4136	2572	msedge.exe	85
PID 2572 wrote to memory of 4136	2572	msedge.exe	85
PID 2572 wrote to memory of 4136	2572	msedge.exe	85
PID 2572 wrote to memory of 4136	2572	msedge.exe	85
PID 2572 wrote to memory of 4136	2572	msedge.exe	85
PID 2572 wrote to memory of 4136	2572	msedge.exe	85
PID 2572 wrote to memory of 4136	2572	msedge.exe	85
PID 2572 wrote to memory of 4136	2572	msedge.exe	85
PID 2572 wrote to memory of 4136	2572	msedge.exe	85
PID 2572 wrote to memory of 4852	2572	msedge.exe	86
PID 2572 wrote to memory of 4852	2572	msedge.exe	86
PID 2572 wrote to memory of 5012	2572	msedge.exe	87
PID 2572 wrote to memory of 5012	2572	msedge.exe	87
PID 2572 wrote to memory of 5012	2572	msedge.exe	87
PID 2572 wrote to memory of 5012	2572	msedge.exe	87
PID 2572 wrote to memory of 5012	2572	msedge.exe	87
PID 2572 wrote to memory of 5012	2572	msedge.exe	87
PID 2572 wrote to memory of 5012	2572	msedge.exe	87
PID 2572 wrote to memory of 5012	2572	msedge.exe	87
PID 2572 wrote to memory of 5012	2572	msedge.exe	87
PID 2572 wrote to memory of 5012	2572	msedge.exe	87
PID 2572 wrote to memory of 5012	2572	msedge.exe	87
PID 2572 wrote to memory of 5012	2572	msedge.exe	87
PID 2572 wrote to memory of 5012	2572	msedge.exe	87
PID 2572 wrote to memory of 5012	2572	msedge.exe	87
PID 2572 wrote to memory of 5012	2572	msedge.exe	87
PID 2572 wrote to memory of 5012	2572	msedge.exe	87
PID 2572 wrote to memory of 5012	2572	msedge.exe	87
PID 2572 wrote to memory of 5012	2572	msedge.exe	87
PID 2572 wrote to memory of 5012	2572	msedge.exe	87
PID 2572 wrote to memory of 5012	2572	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/aliimran2000/cryptojacker-chess
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc0da46f8,0x7ffcc0da4708,0x7ffcc0da4718
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,14390995740662446052,446858470359005693,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,14390995740662446052,446858470359005693,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,14390995740662446052,446858470359005693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14390995740662446052,446858470359005693,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14390995740662446052,446858470359005693,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,14390995740662446052,446858470359005693,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,14390995740662446052,446858470359005693,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14390995740662446052,446858470359005693,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14390995740662446052,446858470359005693,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14390995740662446052,446858470359005693,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14390995740662446052,446858470359005693,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2124,14390995740662446052,446858470359005693,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:5444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14390995740662446052,446858470359005693,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2124,14390995740662446052,446858470359005693,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,14390995740662446052,446858470359005693,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1852 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1596

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
3a24838e79e6d27c48b2377bef2e30dc

SHA1
c70bf44ee44509bc3e6c1ed97a9deb631a484489

SHA256
dab8ce860a3fea22fcd8a50f1c2053749ad8e5531a56d3a94a5653e059165d35

SHA512
403add50ab10b9c088e2c397ad0123cc8831b45daaab1925e25911a0c56ea93fc4b6789579be0c29bcb0ea17570564dd552e05df29034f6effd4bdf2ff3b001d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
573B

MD5
72d8b549c047805a5315df059bb1539a

SHA1
3df3770c14379441be3be79eac28f5a1344cdada

SHA256
beb758c4229b5c555242bde07bb5e88edd0d43be725dd68c8a4f33e6eddf10f6

SHA512
0bee533bd41e2226f9e971c9e4b75dee9d8d8ea545bc8a119d3a3c31bbea9f4c30b0ae3dcb58cfeca103ec4880171d2d63c676ac7a4a71b990e4a5ad376fe4fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
01d0ab33239d88a179ae406b2d59fedf

SHA1
f797bf1744e251556a7efe76dd982783f7984350

SHA256
2c90d029d2158b5bc15fef7cf271d9d7bdd480d21a60bea951b2e52bf1750182

SHA512
701b7476cc1cc46444631209adf1c96f6147748811d9b3fa11c0b87e51a5e7d787b53f872166dbe720556598b720cdd2787b4f9aeae8e9479ccea63178ec2793

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0da20df25262efe022c6eaae5a9ce49c

SHA1
6c9ec7ca54c2509dd6acab31d326a416f0570d20

SHA256
5b44acaa457175495c5ed9caa669f23cb087e231bf6d869599944ec5ad1991f6

SHA512
c3b776036e987a5b7c14cda3e7e0984d5d31fa4f43b567fa40ecffac14244c9e1a8e4a5d62e5400f86a47087e1b326c555d05b2783c2fe6866d3f746ecaa7f7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d8fc9a17351118e9a5b19bf1db6d1bd7

SHA1
c73f4e1c15aca22defd22363a284e181a2ffeda8

SHA256
a2527f4226807a2be5c1f9d78c2f4e699d58f399b2e1c1d4cb1bf84059b07260

SHA512
91add720875014f28436f02db2eb002797f1c1609474fe139ebde8e218ae9dc28a6f4c9ed2b8800bff4d5b2ba86d2ce49dbba7d8760a85763a1c70a32266a3d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7c5f355067ea324f4fe0f8eb510c5369

SHA1
28d2f26f3dcd9a1484fa2946cf0f90c21f3a17f8

SHA256
9845deef64e67c4ae83d67d7cd181d4b5cf2b1154780a9d89fb144cd22558277

SHA512
4a1311a224c15b38ff2089b51f927a277e7ac31e5626b6216986b3fc735350860d83654d09037f11e1b13f5974676b51d3a612cd6626ac36e1e5e54664bec388

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b7d6.TMP

Filesize
874B

MD5
b10cf1b884d27b54769992a128d9f529

SHA1
842863d857bfb0872124be05f0fba40d12ea8859

SHA256
ff5c3e473aaa228c3745a86a0e0329b6354c0aed120c7cf8a7500afaf21d2d0b

SHA512
2c98d09c59d21bf5edd2c15743c1564b643c24e660ab2024b7e512c3dace06a09b6ea0aaed1ec6b0ecf3c519f1def5c9778bc84880f1c768012655221f30e0f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e51a247c581f0d997dca88bce1712663

SHA1
6918f06e1e6a2496407bf5465091a5540de02f67

SHA256
abe746c23e744fb0a2010e865b894053b273f6b20009f355397da59828e991bb

SHA512
66c3d1c16219fc96893dad156d9cd38c2d737a57777eab60291d24b8bde8a47d5fae845e0e389b4b40914507f3abbc55f3524769a641085ab1780b30654dc594

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
35c9dad5762a9b780b240066e1cf412b

SHA1
54162a31e5d78782001bf8167b2df689a49f8f4f

SHA256
f872a37ef2300a2ae73f0e59353370fc4d2c7a1d838b0762c6a241798db02553

SHA512
790143f42bcbfe95065c49e775e69735e8c1614b73069ba9c6f18a620011210ef241d9a8650b3c3d0b03b86e23b2125ebe683914be4b106c599a7f04c5fed052

Download Submit
C:\Users\Admin\Downloads\cryptojacker-chess-master.zip

Filesize
297KB

MD5
f53db681d49d7ef536c507419304011b

SHA1
1ec38d04161615741a33f72b5fe032748a763c84

SHA256
3eef85f88a59ae11b89b88025fffb73d5e7c3d656e054ed556c3e789dc26cd4e

SHA512
e7849f8e11afc023ff310636ba0de14839eeda8099f872d5ce21830613518806543536b85db9e9334162dc386e8709ce80658fbb9b652c4468aa39ae6a60c999

Download Submit