Analysis

  • user interaction
    yes
  • max time kernel
    629s
  • max time network
    606s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260911-en
  • resource tags

    arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    26/10/2026, 14:24

General

  • Target
    https://cdn.minezone.hu/launcher/minezone-latest.exe
  • Sample261026-rq4x9sev21

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 22 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies registry class 52 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.minezone.hu/launcher/minezone-latest.exe
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2588
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2ac,0x7ff8737ac188,0x7ff8737ac194,0x7ff8737ac1a0
      2⤵
        PID:1620
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,8950426531867528325,12657579950304552836,262144 --field-trial-handle=2152,i,1359914824035524370,9246078812073087495,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:2
        2⤵
          PID:1984
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,13258321169722696223,17346263956113256356,524288 --field-trial-handle=2152,i,1359914824035524370,9246078812073087495,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:11
          2⤵
          • Downloads MZ/PE file
          • System Time Discovery
          PID:2584
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2512,i,13684610828631756908,1992520171975231585,524288 --field-trial-handle=2152,i,1359914824035524370,9246078812073087495,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:13
          2⤵
            PID:3196
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3392,i,11315357538968103334,13397272256974480440,2097152 --field-trial-handle=2152,i,1359914824035524370,9246078812073087495,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
            2⤵
              PID:396
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,11009841898675976070,11960077132908801567,2097152 --field-trial-handle=2152,i,1359914824035524370,9246078812073087495,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
              2⤵
                PID:2768
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4124,i,11899566019540698103,14246713079999116535,2097152 --field-trial-handle=2152,i,1359914824035524370,9246078812073087495,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:1
                2⤵
                  PID:3396
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4148,i,7740665380956446905,13709123921259334820,2097152 --field-trial-handle=2152,i,1359914824035524370,9246078812073087495,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:9
                  2⤵
                    PID:2100
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4180,i,1392336290491876022,1793159395379396939,2097152 --field-trial-handle=2152,i,1359914824035524370,9246078812073087495,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
                    2⤵
                      PID:1512
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4200,i,16328931156026972757,4969088686923882826,2097152 --field-trial-handle=2152,i,1359914824035524370,9246078812073087495,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:9
                      2⤵
                        PID:2948
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,8009403156955133612,8472135309302739716,524288 --field-trial-handle=2152,i,1359914824035524370,9246078812073087495,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:14
                        2⤵
                          PID:1972
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4144,i,11679542826047083922,17752805770415375831,524288 --field-trial-handle=2152,i,1359914824035524370,9246078812073087495,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
                          2⤵
                            PID:4088
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,4998447608029498401,13293611116666228702,524288 --field-trial-handle=2152,i,1359914824035524370,9246078812073087495,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:14
                            2⤵
                              PID:5212
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5776,i,16666070296103609001,13599497757257708917,2097152 --field-trial-handle=2152,i,1359914824035524370,9246078812073087495,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:1
                              2⤵
                                PID:4248
                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,867485411997043180,8474974009523773378,524288 --field-trial-handle=2152,i,1359914824035524370,9246078812073087495,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
                                2⤵
                                  PID:5280
                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,867485411997043180,8474974009523773378,524288 --field-trial-handle=2152,i,1359914824035524370,9246078812073087495,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
                                  2⤵
                                    PID:5260
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6712,i,17209988014178750740,5448505308752529073,524288 --field-trial-handle=2152,i,1359914824035524370,9246078812073087495,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:14
                                    2⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:5600
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                      cookie_exporter.exe --cookie-json=1128
                                      3⤵
                                        PID:5528
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,9358260322542840489,16360884423584337119,524288 --field-trial-handle=2152,i,1359914824035524370,9246078812073087495,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
                                      2⤵
                                      • Subvert Trust Controls: Mark-of-the-Web Bypass
                                      • NTFS ADS
                                      PID:3396
                                    • C:\Users\Admin\Downloads\minezone-latest.exe
                                      "C:\Users\Admin\Downloads\minezone-latest.exe"
                                      2⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • System Location Discovery: System Language Discovery
                                      • NTFS ADS
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:916
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,14310258172629226357,2510783783118253638,524288 --field-trial-handle=2152,i,1359914824035524370,9246078812073087495,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:14
                                      2⤵
                                        PID:5656
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,7892975521835305947,18429114819340456715,524288 --field-trial-handle=2152,i,1359914824035524370,9246078812073087495,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:14
                                        2⤵
                                          PID:5928
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4140,i,10266703750574499633,7225927199264605197,524288 --field-trial-handle=2152,i,1359914824035524370,9246078812073087495,262144 --variations-seed-version --mojo-platform-channel-handle=7296 /prefetch:14
                                          2⤵
                                            PID:5824
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,17767942668906303318,9892628719884354188,524288 --field-trial-handle=2152,i,1359914824035524370,9246078812073087495,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
                                            2⤵
                                              PID:2548
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6216,i,9631368585368801297,16929840238182553604,262144 --field-trial-handle=2152,i,1359914824035524370,9246078812073087495,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:10
                                              2⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:5820
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,292325048797387849,1050861852662043277,524288 --field-trial-handle=2152,i,1359914824035524370,9246078812073087495,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:14
                                              2⤵
                                                PID:4440
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3460,i,7065495410532457532,4862446586585080318,524288 --field-trial-handle=2152,i,1359914824035524370,9246078812073087495,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
                                                2⤵
                                                  PID:5832
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,15441980546853820024,2446453869382172678,524288 --field-trial-handle=2152,i,1359914824035524370,9246078812073087495,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:14
                                                  2⤵
                                                    PID:2328
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7292,i,4836007375621094350,4577233268873301694,524288 --field-trial-handle=2152,i,1359914824035524370,9246078812073087495,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:14
                                                    2⤵
                                                      PID:3896
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,701575535174171959,14070221061473798293,524288 --field-trial-handle=2152,i,1359914824035524370,9246078812073087495,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
                                                      2⤵
                                                        PID:2500
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                      1⤵
                                                        PID:916
                                                      • C:\Users\Admin\AppData\Local\Programs\MineZone\MineZone.exe
                                                        "C:\Users\Admin\AppData\Local\Programs\MineZone\MineZone.exe"
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Reads the TCP/IP host and domain name from the registry
                                                        • Checks processor information in registry
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        • Suspicious use of FindShellTrayWindow
                                                        • Suspicious use of SendNotifyMessage
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2816
                                                        • C:\Users\Admin\AppData\Local\Programs\MineZone\MineZone.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\MineZone\MineZone.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\MineZone" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1644 --field-trial-handle=1792,i,6508899581297349204,6535295888194316101,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          PID:5568
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand CgAkAFAAcgBvAGcAcgBlAHMAcwBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwAKACQAdQB1AGkAZAAgAD0AIAAoAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAAVwBpAG4AMwAyAF8AQwBvAG0AcAB1AHQAZQByAFMAeQBzAHQAZQBtAFAAcgBvAGQAdQBjAHQAKQAuAFUAVQBJAEQACgAkAGMAcAB1ACAAPQAgACgARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxACkALgBQAHIAbwBjAGUAcwBzAG8AcgBJAGQACgAkAGQAaQBzAGsATwBiAGoAIAA9ACAARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIABXAGkAbgAzADIAXwBEAGkAcwBrAEQAcgBpAHYAZQAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgBNAGUAZABpAGEAVAB5AHAAZQAgAC0AbQBhAHQAYwBoACAAJwBGAGkAeABlAGQAJwAgAH0AIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQAKAGkAZgAgACgALQBuAG8AdAAgACQAZABpAHMAawBPAGIAagApACAAewAgACQAZABpAHMAawBPAGIAagAgAD0AIABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADEAIAB9AAoAJABkAGkAcwBrACAAPQAgACQAZABpAHMAawBPAGIAagAuAFMAZQByAGkAYQBsAE4AdQBtAGIAZQByAAoAJABiAG8AYQByAGQAIAA9ACAAKABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAFcAaQBuADMAMgBfAEIAYQBzAGUAQgBvAGEAcgBkACkALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAIgAkAHUAdQBpAGQAfAAkAGMAcAB1AHwAJABkAGkAcwBrAHwAJABiAG8AYQByAGQAIgAKAA=="
                                                          2⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:5580
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand CgAkAFAAcgBvAGcAcgBlAHMAcwBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwAKACQAdQB1AGkAZAAgAD0AIAAoAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAAVwBpAG4AMwAyAF8AQwBvAG0AcAB1AHQAZQByAFMAeQBzAHQAZQBtAFAAcgBvAGQAdQBjAHQAKQAuAFUAVQBJAEQACgAkAGMAcAB1ACAAPQAgACgARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxACkALgBQAHIAbwBjAGUAcwBzAG8AcgBJAGQACgAkAGQAaQBzAGsATwBiAGoAIAA9ACAARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIABXAGkAbgAzADIAXwBEAGkAcwBrAEQAcgBpAHYAZQAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgBNAGUAZABpAGEAVAB5AHAAZQAgAC0AbQBhAHQAYwBoACAAJwBGAGkAeABlAGQAJwAgAH0AIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQAKAGkAZgAgACgALQBuAG8AdAAgACQAZABpAHMAawBPAGIAagApACAAewAgACQAZABpAHMAawBPAGIAagAgAD0AIABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADEAIAB9AAoAJABkAGkAcwBrACAAPQAgACQAZABpAHMAawBPAGIAagAuAFMAZQByAGkAYQBsAE4AdQBtAGIAZQByAAoAJABiAG8AYQByAGQAIAA9ACAAKABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAFcAaQBuADMAMgBfAEIAYQBzAGUAQgBvAGEAcgBkACkALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAIgAkAHUAdQBpAGQAfAAkAGMAcAB1AHwAJABkAGkAcwBrAHwAJABiAG8AYQByAGQAIgAKAA==
                                                            3⤵
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:420
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
                                                          2⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2636
                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                            wmic path win32_VideoController get name
                                                            3⤵
                                                            • Reads the TCP/IP host and domain name from the registry
                                                            • Detects videocard installed
                                                            PID:5928
                                                        • C:\Users\Admin\AppData\Local\Programs\MineZone\MineZone.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\MineZone\MineZone.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\MineZone" --mojo-platform-channel-handle=2144 --field-trial-handle=1792,i,6508899581297349204,6535295888194316101,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Reads the TCP/IP host and domain name from the registry
                                                          PID:5792
                                                        • C:\Users\Admin\AppData\Local\Programs\MineZone\MineZone.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\MineZone\MineZone.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\MineZone" --app-user-model-id=MineZone --app-path="C:\Users\Admin\AppData\Local\Programs\MineZone\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2444 --field-trial-handle=1792,i,6508899581297349204,6535295888194316101,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          PID:388
                                                        • C:\Users\Admin\AppData\Local\Programs\MineZone\MineZone.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\MineZone\MineZone.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\MineZone" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4288 --field-trial-handle=1792,i,6508899581297349204,6535295888194316101,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:6000
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /d /s /c "where.exe javaw 2>nul || where.exe java 2>nul"
                                                          2⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:1104
                                                          • C:\Windows\system32\where.exe
                                                            where.exe javaw
                                                            3⤵
                                                              PID:5836
                                                          • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
                                                            "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe" -version
                                                            2⤵
                                                              PID:1036
                                                            • C:\Program Files\Java\jdk-1.8\bin\java.exe
                                                              "C:\Program Files\Java\jdk-1.8\bin\java.exe" -version
                                                              2⤵
                                                                PID:5864
                                                              • C:\Program Files\Java\jre-1.8\bin\java.exe
                                                                "C:\Program Files\Java\jre-1.8\bin\java.exe" -version
                                                                2⤵
                                                                  PID:5840
                                                                • C:\Users\Admin\AppData\Local\Programs\MineZone\MineZone.exe
                                                                  "C:\Users\Admin\AppData\Local\Programs\MineZone\MineZone.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\MineZone" --app-user-model-id=MineZone --app-path="C:\Users\Admin\AppData\Local\Programs\MineZone\resources\app.asar" --enable-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=4364 --field-trial-handle=1792,i,6508899581297349204,6535295888194316101,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  PID:948
                                                              • C:\Windows\system32\sihost.exe
                                                                sihost.exe
                                                                1⤵
                                                                • Suspicious use of FindShellTrayWindow
                                                                PID:4976
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe /LOADSAVEDWINDOWS
                                                                  2⤵
                                                                  • Boot or Logon Autostart Execution: Active Setup
                                                                  • Enumerates connected drives
                                                                  • Checks SCSI registry key(s)
                                                                  • Modifies registry class
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of FindShellTrayWindow
                                                                  • Suspicious use of SendNotifyMessage
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:5500
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                • Modifies registry class
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:6068
                                                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                1⤵
                                                                • Enumerates system info in registry
                                                                • Modifies registry class
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:3416

                                                              Network

                                                                    MITRE ATT&CK Enterprise v16

                                                                    Replay Monitor

                                                                    Loading Replay Monitor...

                                                                    Downloads

                                                                    00c3c865-d4f9-4f92-8b71-8a24daff4823.tmp

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\00c3c865-d4f9-4f92-8b71-8a24daff4823.tmp
                                                                    • Size 18KB
                                                                    • SHA256 ce5756674752038590ced4d0d1064a50fb8dde84c6493a220485fb55fad98322
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    09ca048b-5212-4d92-a6f1-a4f8b9a02df6.tmp

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\09ca048b-5212-4d92-a6f1-a4f8b9a02df6.tmp
                                                                    • Size 18KB
                                                                    • SHA256 9dbc2873ab16f58d41548e29594a8b9309fced778fd7662780a5100e4d988395
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    734be566-e903-4ed1-8a3b-ad3861d4a555.tmp

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\734be566-e903-4ed1-8a3b-ad3861d4a555.tmp
                                                                    • Size 18KB
                                                                    • SHA256 f96c3f5f0ae4ce50a18609ae4a03ecb39c4e47ee24378489b02fd69d6472a453
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    80b8ab59-91db-49af-933e-e61abe1f8e34.tmp

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\80b8ab59-91db-49af-933e-e61abe1f8e34.tmp
                                                                    • Size 8KB
                                                                    • SHA256 ecd0fa26c3be52964f334a78d705ce0216e4721f7a15e20c70146ea36ec4303d
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    91e666df-94ee-4309-bb9a-c6291e5a5520.tmp

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\91e666df-94ee-4309-bb9a-c6291e5a5520.tmp
                                                                    • Size 21KB
                                                                    • SHA256 2d353f01d8bca2c75885017ca3ad37e5e134ab16f8afc790b9413cc5531c1522
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    ad917183-b6a8-4a99-8469-ab2d01e29ce6.tmp

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\ad917183-b6a8-4a99-8469-ab2d01e29ce6.tmp
                                                                    • Size 105KB
                                                                    • SHA256 aa204e7f585c1f2b64ec2dfe226fcda3dd40e2d6c7acaecb8bc39c51bf5021a2
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    settings.dat

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                    • Size 280B
                                                                    • SHA256 635a17b62bc802a1d6d2ac977e63b5a2027aa2bf3d1b5551e63352afa4362fd9
                                                                    • MD5 SHA1 SHA512 TLSH

                                                                    7bdcd5c3-c357-4570-9ccf-6024e58700c7.tmp

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7bdcd5c3-c357-4570-9ccf-6024e58700c7.tmp
                                                                    • Size 28KB
                                                                    • SHA256 60512dc9195924d296f312d3ce688c9e63fea923e551f3b76de50173b48d6d93
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    8079166c-03c6-488f-907a-7783d6107849.tmp

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8079166c-03c6-488f-907a-7783d6107849.tmp
                                                                    • Size 9KB
                                                                    • SHA256 adcb817d20fdebc4d8d7bce5c4528227b6c21c2fd803fe230719ccfea721a6a5
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    8a21117c-8ade-453c-b6bf-d1f975c8c879.tmp

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8a21117c-8ade-453c-b6bf-d1f975c8c879.tmp
                                                                    • Size 10KB
                                                                    • SHA256 ec6b5f9727ec740d82bd034007c40cbfcbbc5840a61092d7a2f10300f3604456
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    9d3c39fd-f0a8-4bf8-9e88-212fc3813d48.tmp

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9d3c39fd-f0a8-4bf8-9e88-212fc3813d48.tmp
                                                                    • Size 6B
                                                                    • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                    • MD5 SHA1 SHA512

                                                                    LOG

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
                                                                    • Size 334B
                                                                    • SHA256 e8ac2ce5e8f3e427de9049afe28d20d0801fcbdd02fecd0b990b81e2f4796bf7
                                                                    • MD5 SHA1 SHA512 TLSH

                                                                    LOG

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
                                                                    • Size 331B
                                                                    • SHA256 4e98105b3c5ac2b14cc2cbe0ceab8fe6d94bf1f46da6d34490d2b9fff6a574c5
                                                                    • MD5 SHA1 SHA512 TLSH

                                                                    LOG.old

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                    • Size 331B
                                                                    • SHA256 3f5f56cc959387174b1df0aa6fdf36d51d117097de729455d08d20cb877d3005
                                                                    • MD5 SHA1 SHA512 TLSH

                                                                    the-real-index

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                    • Size 3KB
                                                                    • SHA256 c8135e330eac3b2a857ba5a4dbda70ca6989a525b819069bc176fcfbf93535a3
                                                                    • MD5 SHA1 SHA512 TLSH

                                                                    89a6d473-e527-44e0-8601-95bc4b1be3ba.tmp

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\89a6d473-e527-44e0-8601-95bc4b1be3ba.tmp
                                                                    • Size 2B
                                                                    • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                    • MD5 SHA1 SHA512

                                                                    Edge Profile.ico

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                    • Size 70KB
                                                                    • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    0b0a958b-920e-4c63-a4ae-2b1c42dc3501.tmp

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0b0a958b-920e-4c63-a4ae-2b1c42dc3501.tmp
                                                                    • Size 2B
                                                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                    • MD5 SHA1 SHA512

                                                                    0cce3d29-9c08-4709-9b41-ee0125eef201.tmp

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0cce3d29-9c08-4709-9b41-ee0125eef201.tmp
                                                                    • Size 1KB
                                                                    • SHA256 625b4f3940a73c1b4d85e3d1459aa4f5dbb3edf2949da6e80212c48fadfa569a
                                                                    • MD5 SHA1 SHA512 TLSH

                                                                    9eff5441-8aa3-4c4e-9285-cbef2e631444.tmp

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9eff5441-8aa3-4c4e-9285-cbef2e631444.tmp
                                                                    • Size 1KB
                                                                    • SHA256 8df10c6ab65977f100841f9da38d59834f998fdf8507dbec5efaa1fce1d4010e
                                                                    • MD5 SHA1 SHA512 TLSH

                                                                    a9f8efd6-30b3-403a-8b07-2aa6baeb66ce.tmp

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a9f8efd6-30b3-403a-8b07-2aa6baeb66ce.tmp
                                                                    • Size 111B
                                                                    • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                    • MD5 SHA1 SHA512 TLSH

                                                                    sync_diagnostic.log

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                    • Size 5KB
                                                                    • SHA256 3f7cb80426b8b9a66fbb8b314a3621bde4192bb410c26d5bb3a41ee4b32c0737
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    d0a8157a-78fb-4f53-916e-361fbb0d20a4.tmp

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d0a8157a-78fb-4f53-916e-361fbb0d20a4.tmp
                                                                    • Size 9KB
                                                                    • SHA256 3273aa618dcdd108a4bf9fba20c642d235084b6d2c9c9a694add8b46cfe0a667
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    f07ee9d9-ea52-45b6-8187-64a0ef939e87.tmp

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f07ee9d9-ea52-45b6-8187-64a0ef939e87.tmp
                                                                    • Size 10KB
                                                                    • SHA256 deac34c1dbf2d3028321a6532aef8c0bd8b4cbaa5d5bda1aed3eaac52254fe47
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    d35957d6-e294-428d-98da-e0fb8f41ba95.tmp

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d35957d6-e294-428d-98da-e0fb8f41ba95.tmp
                                                                    • Size 22KB
                                                                    • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    af3f2572-b46a-41b0-a526-0d71ac26f058.tmp

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\af3f2572-b46a-41b0-a526-0d71ac26f058.tmp
                                                                    • Size 18KB
                                                                    • SHA256 ec17ed3cd5b904304b3c3a9cf3844df50ef50f462e6aa8384892a6dbd1947cdc
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    caa5cc9e-3222-4443-a5ab-7d8be6b2a64d.tmp

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\caa5cc9e-3222-4443-a5ab-7d8be6b2a64d.tmp
                                                                    • Size 21KB
                                                                    • SHA256 dc5a0607dbb0c1b0b60bed4de57ef0a4a4c96e9b4a361548cdefc900f9b34c7e
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    d6cfce74-1356-48fa-bc6e-9ef3720ec19b.tmp

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d6cfce74-1356-48fa-bc6e-9ef3720ec19b.tmp
                                                                    • Size 8KB
                                                                    • SHA256 96773ebee0805a0d44841283c8a6a7a49d599494b761adf538e815ce3d4cf056
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    a871788d-d93d-447c-8fc4-f21b8c699623.tmp

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a871788d-d93d-447c-8fc4-f21b8c699623.tmp
                                                                    • Size 13B
                                                                    • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                    • MD5 SHA1 SHA512

                                                                    AppCache134374986016156039.txt

                                                                    • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134374986016156039.txt
                                                                    • Size 80KB
                                                                    • SHA256 9188dd8150ed0e759d2b146b231115f2ed3299d14f5640b00624a86975e062b1
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    LICENSE.electron.txt

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\LICENSE.electron.txt
                                                                    • Size 1KB
                                                                    • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
                                                                    • MD5 SHA1 SHA512 TLSH

                                                                    LICENSES.chromium.html

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\LICENSES.chromium.html
                                                                    • Size 6.5MB
                                                                    • SHA256 9f3f2b4d9bbd3113486839eca85de119fab766450cdca08a4574b80748885708
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    chrome_200_percent.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\chrome_200_percent.pak
                                                                    • Size 175KB
                                                                    • SHA256 1408387e87cb5308530def6ce57bdc4e0abbbaa9e70f687fd6c3a02a56a0536c
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    d3dcompiler_47.dll

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\d3dcompiler_47.dll
                                                                    • Size 4.7MB
                                                                    • SHA256 5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    ffmpeg.dll

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\ffmpeg.dll
                                                                    • Size 2.6MB
                                                                    • SHA256 aad7e7ac9d74ac18892801950c9728e9c4eacd3b676cbb5d6f63382da2ce0559
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    icudtl.dat

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\icudtl.dat
                                                                    • Size 10.0MB
                                                                    • SHA256 97b978a19edd4746e9a44d9a44bb4bc519e127a203c247837ec0922f573449e3
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    libEGL.dll

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\libEGL.dll
                                                                    • Size 473KB
                                                                    • SHA256 85f238fb7ace3cbdf7c29c72b01307c440f13491b07a509cbc5b9f257a637164
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    libGLESv2.dll

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\libGLESv2.dll
                                                                    • Size 7.2MB
                                                                    • SHA256 25d49934fc220b169cadeb21fc99dc2a8fb1dd5a4f244265799392f0f5f2f8f8
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    af.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\af.pak
                                                                    • Size 340KB
                                                                    • SHA256 d63222c4a20fa9741f5262634cf9751f22fbb4fcd9d3138d7c8d49e0efb57fba
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    am.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\am.pak
                                                                    • Size 551KB
                                                                    • SHA256 55357baf28716a73f79ac9a6af1ae63972eb79f93c415715518027fc5c528504
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    ar.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\ar.pak
                                                                    • Size 602KB
                                                                    • SHA256 e34d5cabaed4634c672591074057c12947bc9e728004228a9e75f87829f4a48a
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    bg.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\bg.pak
                                                                    • Size 631KB
                                                                    • SHA256 fc4a59ea60d04b224765be4916090e97ed8ddda6b136a92a3827ed0fcc64bb0e
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    bn.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\bn.pak
                                                                    • Size 812KB
                                                                    • SHA256 e325d936cd97c3f9ddfca2d87caefb8b6e7465ffa31d0386ae2456b18f7a92da
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    ca.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\ca.pak
                                                                    • Size 384KB
                                                                    • SHA256 e1d6b5fd0bc411f2895eaaa1409916f5ffe39a5c6bd1bafe8af7ce33da5be17d
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    cs.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\cs.pak
                                                                    • Size 393KB
                                                                    • SHA256 936466784a55b965d23b016bc49377655bc5d281d012c8369c0809c961e05c74
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    da.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\da.pak
                                                                    • Size 356KB
                                                                    • SHA256 1b0793b1cbeb6a56ff1e64523c37ba753457320aa29f9718022caa07b4981d8f
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    de.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\de.pak
                                                                    • Size 381KB
                                                                    • SHA256 e0f632ce324951002c80e019dd0169be9f6b0640533fa434cd6ca80f28a1d3f7
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    el.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\el.pak
                                                                    • Size 691KB
                                                                    • SHA256 92403b6160e38746597d4dd7f64d64cf19e30b5e7862901263c39679187b2c91
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    en-GB.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\en-GB.pak
                                                                    • Size 310KB
                                                                    • SHA256 463af7da8418d7fb374ebf690e2aa79ee7cb2acc11c28a67f3ba837cf7a0937b
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    en-US.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\en-US.pak
                                                                    • Size 313KB
                                                                    • SHA256 bb165eaa51456b52fcbdf7639ee727280e335a1f6b4cfb91afc45222895b564f
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    es-419.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\es-419.pak
                                                                    • Size 380KB
                                                                    • SHA256 5aff3762747a6e8c6df9f2a3b470bf231b44163006b17ce87e2a03694be27b81
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    es.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\es.pak
                                                                    • Size 380KB
                                                                    • SHA256 267e7b6376e7e5ab806b16fde93bbbcd961bf0c3a7b3a2cabccab37faa9a1d16
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    et.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\et.pak
                                                                    • Size 342KB
                                                                    • SHA256 d984aee4d18ca24a88846b1b6e0294d373733430f30bb4f1b97bc7d50d512c2e
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    fa.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\fa.pak
                                                                    • Size 557KB
                                                                    • SHA256 221bbbde078d135f6daca4978a31cc6a82f8f46536467ebc9a0cd322c58a7785
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    fi.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\fi.pak
                                                                    • Size 351KB
                                                                    • SHA256 5339b8ca52500bd0082e0ba5a5f440c5f04733803da47963280479760c7fff2c
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    fil.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\fil.pak
                                                                    • Size 394KB
                                                                    • SHA256 4cd3fa70487e894400ad29e3bfbfba3e1c5edd799aab12c62c3aff3c2580ce5e
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    fr.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\fr.pak
                                                                    • Size 410KB
                                                                    • SHA256 1f6bc09499ee37456968a28b67b81bbf5b9df4f0c6035a388242d2037a3b65a1
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    gu.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\gu.pak
                                                                    • Size 787KB
                                                                    • SHA256 c36a20730d5f2b91cb61b5b2a5912db2ea5a328a9b8abe0fca0af300446d3c20
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    he.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\he.pak
                                                                    • Size 488KB
                                                                    • SHA256 875712bb852c698f677c0c74e088f62d31adb2bce65648fc390607aad8705c45
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    hi.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\hi.pak
                                                                    • Size 821KB
                                                                    • SHA256 1e9623c7407ae8b8a88df3f69a47ae8117f74c4dcb56897bb794a9c38ee5805b
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    hr.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\hr.pak
                                                                    • Size 381KB
                                                                    • SHA256 3d7685163c5eb6a11e745ff934312b8681c5f85dfa8d9ea701e9dcaee1e7a285
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    hu.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\hu.pak
                                                                    • Size 411KB
                                                                    • SHA256 3ec43893c6de5ec0f9433841afd5fa9feaaf59ddcef05f7e1cab14dba799887f
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    id.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\id.pak
                                                                    • Size 336KB
                                                                    • SHA256 9210c4c4c33e7ceb5f70005a92a4fd36ca4facdd41701fdc1d2ce638db8adf22
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    it.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\it.pak
                                                                    • Size 373KB
                                                                    • SHA256 c0dc0a4a87f7bb054a30eb1174c3228ea2014bd94668a7d22995b99c4937d817
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    ja.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\ja.pak
                                                                    • Size 456KB
                                                                    • SHA256 3accfd9a1833ddeedb2082fb94101beb59b555c60f42e3070e9e04a372eba84a
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    kn.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\kn.pak
                                                                    • Size 910KB
                                                                    • SHA256 90b2df3338468e84e2cf2f2f67597cba5c3ceb5dba9c59ebd072ec15a70ce741
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    ko.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\ko.pak
                                                                    • Size 383KB
                                                                    • SHA256 b04c1b91cab31054be70cb851dc6716065545445801045daceb96eeee4d2334a
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    lt.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\lt.pak
                                                                    • Size 412KB
                                                                    • SHA256 9200a9509bd77834d9912f4ba8f4219d2b9bd2cdad49a11873db30e99b9d1350
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    lv.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\lv.pak
                                                                    • Size 410KB
                                                                    • SHA256 b5a31cbfcb40ad8d911de1618c4eb7e8cc67b97eb8878220f15d40eb014d8ac8
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    ml.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\ml.pak
                                                                    • Size 948KB
                                                                    • SHA256 61a372f170de0a22712be980c3c78b22035ebf40ce79332fab75cdcc4208c9e6
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    mr.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\mr.pak
                                                                    • Size 772KB
                                                                    • SHA256 481faf7dd66cf10a476d8b156fb4ea452f920322d8007f7e25d41b2837bdbc09
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    ms.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\ms.pak
                                                                    • Size 351KB
                                                                    • SHA256 fe58cc4f62fc31e32c1fb9a0893a5483391ab6a91b1c92ed4a5e3103a962da7a
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    nb.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\nb.pak
                                                                    • Size 344KB
                                                                    • SHA256 d565c6c95dad89d3f2b7210de4ec3fc437633de4dcfc994fde0704b92bb53ff8
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    nl.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\nl.pak
                                                                    • Size 356KB
                                                                    • SHA256 55413d5eddb3300e0ae0fa5d79d26fdf1e5a12922d7018c8054b1faa9d660301
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    pl.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\pl.pak
                                                                    • Size 396KB
                                                                    • SHA256 53b59486361b11512fb90f15065104b15ee2322bb7804f859cde2f2ecf9581fb
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    pt-BR.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\pt-BR.pak
                                                                    • Size 374KB
                                                                    • SHA256 c9ec3822044365457b8736348cf95a8e39bdfe3ed36267449bf3ed739accef2e
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    pt-PT.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\pt-PT.pak
                                                                    • Size 376KB
                                                                    • SHA256 c89170385b3afb2ec89fbd61b8470ac718713c7296441c8430f173dac218e74b
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    ro.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\ro.pak
                                                                    • Size 387KB
                                                                    • SHA256 7247470057a936d03bfa2a8776508ab66aa1040c41a4eb8f79c1e93551c74bb8
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    ru.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\ru.pak
                                                                    • Size 634KB
                                                                    • SHA256 b4223b56ec88235819a427d60bb937eb3984076523f02a018f57819e0429bea9
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    sk.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\sk.pak
                                                                    • Size 399KB
                                                                    • SHA256 75f179897cad221ca6e36b47f53cead7f3fb4159ee196f1d10a5181b84e1b5b7
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    sl.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\sl.pak
                                                                    • Size 385KB
                                                                    • SHA256 6002c129a56558832e9bd260c427c0bd2e1566e0aea3ad999f89c8e479534f9b
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    sr.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\sr.pak
                                                                    • Size 595KB
                                                                    • SHA256 524acc64e70918a77cda43fd9b27a727645b28ad2d4cce16b327105101c8bbeb
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    sv.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\sv.pak
                                                                    • Size 347KB
                                                                    • SHA256 3420a1fbcca5bf8c2d65d6dcb0db78b03f95f7f2fc56479a0de6e3312333ce6f
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    sw.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\sw.pak
                                                                    • Size 365KB
                                                                    • SHA256 690027c4a31c4aea00b7d1b32ec6cd3fa50b1eac412ae273ab15e72eb485dd6e
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    ta.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\ta.pak
                                                                    • Size 936KB
                                                                    • SHA256 7e818deedd50a533851bbf08e056bf2ad8d45f442a1a61d9b48e66804ea848db
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    te.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\te.pak
                                                                    • Size 869KB
                                                                    • SHA256 d839531c4ff4a2885c993e0d358f78667215b0950c77a06ef01a6acff9221c5b
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    th.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\th.pak
                                                                    • Size 731KB
                                                                    • SHA256 cd80bf232f2f128a3d411f52c8039987559dbc1055f746eed6e0e8478b116dc1
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    tr.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\tr.pak
                                                                    • Size 371KB
                                                                    • SHA256 b22fc7b75c52cc142f201d5cf107d17c1b173a494a6add022127f559fb46bcb0
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    uk.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\uk.pak
                                                                    • Size 634KB
                                                                    • SHA256 28ea88f19b2c34699d535ca0c691449b7e4001c12e8aed8d04b2078916e88a37
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    ur.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\ur.pak
                                                                    • Size 552KB
                                                                    • SHA256 4c7affdcc324cd791d10e235da809ce7501e8005be64340b6e8bf5595647a707
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    vi.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\vi.pak
                                                                    • Size 439KB
                                                                    • SHA256 b75694e390bd2e20780b3bc72f6e1473ba45d7537c27642a7d888dfd3bb6c3bb
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    zh-CN.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\zh-CN.pak
                                                                    • Size 319KB
                                                                    • SHA256 a7ac9fda6f4cd189b75fdadc4b70cd0d369a09b66eaeb5d032678cb97ffc98f6
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    zh-TW.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\locales\zh-TW.pak
                                                                    • Size 316KB
                                                                    • SHA256 c5061ec00bd969f76f3c0c6ff15ddacafed7491260bd8ced78118691ba57bdff
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    resources.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\resources.pak
                                                                    • Size 5.1MB
                                                                    • SHA256 4f29587bcd952de1dbc0b98df0aa506bd9fcf447e6a7258c5eb7e9eb780e6d6c
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    app-update.yml

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\resources\app-update.yml
                                                                    • Size 102B
                                                                    • SHA256 34ea710d41cc10e1ac864fdf1d4f2c69d6f5faaa513d1ff6c60c36e68a4e1f25
                                                                    • MD5 SHA1 SHA512 TLSH

                                                                    app.asar

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\resources\app.asar
                                                                    • Size 22.2MB
                                                                    • SHA256 0885db1a30b98cfb1345231037d4fd44369953c2f62b87f19320cda3a06ed209
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    elevate.exe

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\resources\elevate.exe
                                                                    • Size 105KB
                                                                    • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    snapshot_blob.bin

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\snapshot_blob.bin
                                                                    • Size 168KB
                                                                    • SHA256 8613412ebcf462373d4d50f5729f5b9a61ef2b5c599b267f750276c8e29caf25
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    v8_context_snapshot.bin

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\v8_context_snapshot.bin
                                                                    • Size 471KB
                                                                    • SHA256 add78f3f85f0b173cbe917871821f74c5afe0a6562462762b181180d16df4470
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    vk_swiftshader.dll

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\vk_swiftshader.dll
                                                                    • Size 4.9MB
                                                                    • SHA256 a32c3fbbf74699a10e7642bf4901191f29c88c5aec93ae7ba28c79ab28462a69
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    vk_swiftshader_icd.json

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\vk_swiftshader_icd.json
                                                                    • Size 106B
                                                                    • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
                                                                    • MD5 SHA1 SHA512 TLSH

                                                                    vulkan-1.dll

                                                                    • Path C:\Users\Admin\AppData\Local\Programs\MineZone\vulkan-1.dll
                                                                    • Size 894KB
                                                                    • SHA256 1f8b647f161f20d45d554e349b3e5ef0b7b5da8c7bdbc1ff631d37dc9c819503
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    __PSScriptPolicyTest_nwy0h24o.iiy.ps1

                                                                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nwy0h24o.iiy.ps1
                                                                    • Size 60B
                                                                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                    • MD5 SHA1 SHA512 TLSH

                                                                    cc205588-e044-465d-a0b8-f6d6840ff156.tmp.ico

                                                                    • Path C:\Users\Admin\AppData\Local\Temp\cc205588-e044-465d-a0b8-f6d6840ff156.tmp.ico
                                                                    • Size 119KB
                                                                    • SHA256 6cbf290aea0ae059322aa0b5c141626c9724bd2398b1fad2c9589f85d723077b
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    chrome_100_percent.pak

                                                                    • Path C:\Users\Admin\AppData\Local\Temp\nsfE972.tmp\7z-out\chrome_100_percent.pak
                                                                    • Size 126KB
                                                                    • SHA256 9f79f46ca911543ead096a5ee28a34bf1fbe56ec9ba956032a6a2892b254857e
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    StdUtils.dll

                                                                    • Path C:\Users\Admin\AppData\Local\Temp\nsfE972.tmp\StdUtils.dll
                                                                    • Size 100KB
                                                                    • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    System.dll

                                                                    • Path C:\Users\Admin\AppData\Local\Temp\nsfE972.tmp\System.dll
                                                                    • Size 12KB
                                                                    • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    UAC.dll

                                                                    • Path C:\Users\Admin\AppData\Local\Temp\nsfE972.tmp\UAC.dll
                                                                    • Size 14KB
                                                                    • SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    WinShell.dll

                                                                    • Path C:\Users\Admin\AppData\Local\Temp\nsfE972.tmp\WinShell.dll
                                                                    • Size 3KB
                                                                    • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
                                                                    • MD5 SHA1 SHA512 TLSH

                                                                    nsDialogs.dll

                                                                    • Path C:\Users\Admin\AppData\Local\Temp\nsfE972.tmp\nsDialogs.dll
                                                                    • Size 9KB
                                                                    • SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    nsExec.dll

                                                                    • Path C:\Users\Admin\AppData\Local\Temp\nsfE972.tmp\nsExec.dll
                                                                    • Size 6KB
                                                                    • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    nsis7z.dll

                                                                    • Path C:\Users\Admin\AppData\Local\Temp\nsfE972.tmp\nsis7z.dll
                                                                    • Size 424KB
                                                                    • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    ADDITIONAL_LICENSE_INFO

                                                                    • Path C:\Users\Admin\AppData\Roaming\.minezone.hu\jre\legal\java.instrument\ADDITIONAL_LICENSE_INFO
                                                                    • Size 49B
                                                                    • SHA256 ebf9777bd307ed789ceabf282a9aca168c391c7f48e15a60939352efb3ea33f9
                                                                    • MD5 SHA1 SHA512

                                                                    ASSEMBLY_EXCEPTION

                                                                    • Path C:\Users\Admin\AppData\Roaming\.minezone.hu\jre\legal\java.instrument\ASSEMBLY_EXCEPTION
                                                                    • Size 44B
                                                                    • SHA256 b998cda101e5a1ebcfb5ff9cddd76ed43a2f2169676592d428b7c0d780665f2a
                                                                    • MD5 SHA1 SHA512

                                                                    LICENSE

                                                                    • Path C:\Users\Admin\AppData\Roaming\.minezone.hu\jre\legal\java.instrument\LICENSE
                                                                    • Size 33B
                                                                    • SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
                                                                    • MD5 SHA1 SHA512

                                                                    jre_temp.zip

                                                                    • Path C:\Users\Admin\AppData\Roaming\.minezone.hu\jre_temp.zip
                                                                    • Size 46.7MB
                                                                    • SHA256 d35f31e712f0fcf6ac5a093edc90204fbff22f720ba3950bd09d331d5e621636
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    default.dic

                                                                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                                                                    • Size 2B
                                                                    • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                                                    • MD5 SHA1 SHA512

                                                                    MineZone.lnk

                                                                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MineZone.lnk
                                                                    • Size 2KB
                                                                    • SHA256 40ec0225e67649fe68782fa6d2a847d32a69358e3101ace57be8286cb9c54ebb
                                                                    • MD5 SHA1 SHA512 TLSH

                                                                    temp-index

                                                                    • Path C:\Users\Admin\AppData\Roaming\MineZone\Code Cache\wasm\index-dir\temp-index
                                                                    • Size 48B
                                                                    • SHA256 f848e2e685a50ac947f11e02ca1914fd03b15296dfbe417a453f3d5002258781
                                                                    • MD5 SHA1 SHA512

                                                                    CURRENT

                                                                    • Path C:\Users\Admin\AppData\Roaming\MineZone\Local Storage\leveldb\CURRENT
                                                                    • Size 16B
                                                                    • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                    • MD5 SHA1 SHA512

                                                                    Network Persistent State

                                                                    • Path C:\Users\Admin\AppData\Roaming\MineZone\Network\Network Persistent State
                                                                    • Size 59B
                                                                    • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                                                    • MD5 SHA1 SHA512 TLSH

                                                                    d6fe38f8-6d4f-4f9a-a432-8143cae122dd.tmp

                                                                    • Path C:\Users\Admin\AppData\Roaming\MineZone\Network\d6fe38f8-6d4f-4f9a-a432-8143cae122dd.tmp
                                                                    • Size 300B
                                                                    • SHA256 d94d1e3531a20a130b10ed1d25b45d60f1ac8f28f2a6f3aeb764d97522b7f50e
                                                                    • MD5 SHA1 SHA512 TLSH

                                                                    Preferences

                                                                    • Path C:\Users\Admin\AppData\Roaming\MineZone\Preferences
                                                                    • Size 86B
                                                                    • SHA256 8029940de92ae596278912bbbd6387d65f4e849d3c136287a1233f525d189c67
                                                                    • MD5 SHA1 SHA512 TLSH

                                                                    MANIFEST-000001

                                                                    • Path C:\Users\Admin\AppData\Roaming\MineZone\Session Storage\MANIFEST-000001
                                                                    • Size 41B
                                                                    • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                    • MD5 SHA1 SHA512

                                                                    c57f6373-1f2f-40d1-85e5-13ed55a97cbd.tmp

                                                                    • Path C:\Users\Admin\AppData\Roaming\MineZone\c57f6373-1f2f-40d1-85e5-13ed55a97cbd.tmp
                                                                    • Size 57B
                                                                    • SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
                                                                    • MD5 SHA1 SHA512 TLSH

                                                                    2d9c7c10-0a38-4eb4-9251-7b02b244d82a.tmp

                                                                    • Path C:\Users\Admin\Downloads\2d9c7c10-0a38-4eb4-9251-7b02b244d82a.tmp
                                                                    • Size 5KB
                                                                    • SHA256 7148780e669a954414fefa42c9046bfe8f85e82a72fc2f85ad905d81f5943ec7
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    minezone-latest.exe:Zone.Identifier

                                                                    • Path C:\Users\Admin\Downloads\minezone-latest.exe:Zone.Identifier
                                                                    • Size 88B
                                                                    • SHA256 90cd06518d1ff1a1c2f72396a013c29e185cc9d8249b0784016f82a25ed2f4c9
                                                                    • MD5 SHA1 SHA512 TLSH

                                                                    minezone-latest.exe:Zone.Identifier

                                                                    • Path C:\Users\Admin\Downloads\minezone-latest.exe:Zone.Identifier
                                                                    • Size 88B
                                                                    • SHA256 90cd06518d1ff1a1c2f72396a013c29e185cc9d8249b0784016f82a25ed2f4c9
                                                                    • MD5 SHA1 SHA512 TLSH

                                                                    memory/388-980-0x00007FF892A90000-0x00007FF892A91000-memory.dmp

                                                                    memory/388-981-0x00007FF892740000-0x00007FF892741000-memory.dmp

                                                                    memory/420-941-0x00000118707B0000-0x00000118707DA000-memory.dmp

                                                                    memory/420-920-0x00000118704E0000-0x0000011870502000-memory.dmp

                                                                    memory/420-938-0x0000011870750000-0x000001187076C000-memory.dmp

                                                                    memory/420-942-0x00000118707B0000-0x00000118707D4000-memory.dmp

                                                                    memory/420-939-0x0000011870820000-0x00000118708D3000-memory.dmp

                                                                    memory/420-940-0x0000011870770000-0x000001187077A000-memory.dmp

                                                                    memory/1036-5406-0x000001FC145B0000-0x000001FC145B1000-memory.dmp

                                                                    memory/3416-5850-0x0000020D3BEE0000-0x0000020D3BFE0000-memory.dmp

                                                                    memory/3416-5819-0x0000020D3BEE0000-0x0000020D3BFE0000-memory.dmp

                                                                    memory/3416-5806-0x0000020D39FD0000-0x0000020D3A0D0000-memory.dmp

                                                                    memory/3416-5857-0x0000020E4E0C0000-0x0000020E4E0E0000-memory.dmp

                                                                    memory/3416-5925-0x0000020E5F9B0000-0x0000020E5FAB0000-memory.dmp

                                                                    memory/3416-5856-0x0000020E4E080000-0x0000020E4E0A0000-memory.dmp

                                                                    memory/5568-900-0x00007FF892730000-0x00007FF892731000-memory.dmp

                                                                    memory/5840-5430-0x000001A4013B0000-0x000001A4013B1000-memory.dmp

                                                                    memory/5864-5418-0x000001F728340000-0x000001F728341000-memory.dmp

                                                                    memory/6000-5366-0x0000020B1B210000-0x0000020B1B211000-memory.dmp

                                                                    memory/6000-5367-0x0000020B1B210000-0x0000020B1B211000-memory.dmp

                                                                    memory/6000-5368-0x0000020B1B210000-0x0000020B1B211000-memory.dmp

                                                                    memory/6000-5369-0x0000020B1B210000-0x0000020B1B211000-memory.dmp

                                                                    memory/6000-5370-0x0000020B1B210000-0x0000020B1B211000-memory.dmp

                                                                    memory/6000-5371-0x0000020B1B210000-0x0000020B1B211000-memory.dmp

                                                                    memory/6000-5372-0x0000020B1B210000-0x0000020B1B211000-memory.dmp

                                                                    memory/6000-5360-0x0000020B1B210000-0x0000020B1B211000-memory.dmp

                                                                    memory/6000-5361-0x0000020B1B210000-0x0000020B1B211000-memory.dmp

                                                                    memory/6000-5362-0x0000020B1B210000-0x0000020B1B211000-memory.dmp