neshta | hxxps://www[.]mediafire[.]com/file/i839le86o6e2hw6/XMRig[.]zip/file

Analysis

user interaction
yes
max time kernel
1798s
max time network
1798s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
27/10/2026, 00:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/i839le86o6e2hw6/XMRig.zip/file
Sample261027-adzz4sxt6p

Score

10^/10

discovery execution neshta xmrig miner persistence ransomware spyware stealer

Malware Config

Signatures

Family: Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detect Neshta payload 7 IoCs

resource	yara_rule
behavioral2/files/0x0006000000024449-926.dat	family_neshta
behavioral2/memory/1088-1060-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/1088-1067-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/1088-1079-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/1088-1081-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/1088-1083-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/1088-1086-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

XMRig Miner payload 57 IoCs

miner

resource	yara_rule
behavioral2/files/0x000400000000033f-913.dat	family_xmrig
behavioral2/files/0x000400000000033f-913.dat	xmrig
behavioral2/memory/5272-1061-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1076-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1080-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1082-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1084-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1088-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1089-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1090-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1091-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1106-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1120-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1121-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1122-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1123-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1124-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1125-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1126-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1127-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1128-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1137-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1154-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1155-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1156-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1161-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1162-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1163-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1164-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1165-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1166-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1167-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1182-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1199-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1200-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1201-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1202-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1203-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1204-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1205-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1206-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1207-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1208-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1217-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1234-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1235-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1236-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1237-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1238-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1239-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1240-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1241-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1242-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1243-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1244-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1260-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig
behavioral2/memory/5272-1277-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp	xmrig

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\Control Panel\International\Geo\Nation	xmrig.exe

Executes dropped EXE 2 IoCs

pid	Process
1088	xmrig.exe
5272	xmrig.exe

Loads dropped DLL 1 IoCs

pid	Process
5852	msedge.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	xmrig.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge.exe	xmrig.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\COOKIE~1.EXE	xmrig.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\INSTAL~1\setup.exe	xmrig.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\PWAHEL~1.EXE	xmrig.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MI9C33~1.EXE	xmrig.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	xmrig.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	xmrig.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	xmrig.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	xmrig.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe	xmrig.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevation_service.exe	xmrig.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MIA062~1.EXE	xmrig.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MICROS~1.EXE	xmrig.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	xmrig.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	xmrig.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{5625B~1\WINDOW~1.EXE	xmrig.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe	xmrig.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	xmrig.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	xmrig.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MICROS~3.EXE	xmrig.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	xmrig.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	xmrig.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE	xmrig.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	xmrig.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	xmrig.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	xmrig.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\MSEDGE~1.EXE	xmrig.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	xmrig.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	xmrig.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	xmrig.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	xmrig.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MID1AD~1.EXE	xmrig.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	xmrig.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	xmrig.exe
File opened for modification	C:\PROGRA~2\Google\GOOGLE~1\141073~1.0\DISABL~1.EXE	xmrig.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	xmrig.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\ELEVAT~1.EXE	xmrig.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\msedge.exe	xmrig.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	xmrig.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE	xmrig.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	xmrig.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	xmrig.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\NOTIFI~1.EXE	xmrig.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~2.EXE	xmrig.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\MICROS~1.EXE	xmrig.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	xmrig.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	xmrig.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	xmrig.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	xmrig.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedgewebview2.exe	xmrig.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\notification_click_helper.exe	xmrig.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\pwahelper.exe	xmrig.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MIA062~1.EXE	xmrig.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	xmrig.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\MSEDGE~2.EXE	xmrig.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MI9C33~1.EXE	xmrig.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	xmrig.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	xmrig.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	xmrig.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	xmrig.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	xmrig.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_proxy.exe	xmrig.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	xmrig.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	xmrig.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\Wallet-BuyNow\wallet-buynow.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_280184422\crs.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_280184422\ct_config.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\json\i18n-hub\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\webui-setup.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\json\i18n-hub\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\json\i18n-mobile-hub\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\json\i18n-tokenized-card\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\json\i18n-tokenized-card\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_1718166929\crl-set	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\json\i18n-mobile-hub\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\json\i18n-tokenized-card\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\json\i18n-ec\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\json\i18n-hub\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\json\i18n-notification-shared\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\json\i18n-shared-components\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\json\i18n-tokenized-card\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\json\wallet\wallet-checkout\merchant-site-info.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_31603560\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\json\i18n-hub\da\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\json\i18n-notification\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\json\i18n-shared-components\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\json\i18n-hub\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\json\i18n-notification-shared\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\json\i18n-tokenized-card\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\json\i18n-hub\hu\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\json\i18n-hub\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\json\i18n-notification\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\json\i18n-notification-shared\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\json\i18n-shared-components\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\json\i18n-shared-components\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\json\i18n-ec\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\Notification\notification.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_1229429729\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\json\i18n-notification\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\json\i18n-shared-components\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\wallet-webui-101.079f5d74a18127cd9d6a.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_424325636\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\json\i18n-notification\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_149776931\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_31603560\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\Wallet-Checkout\wallet-drawer.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\json\i18n-hub\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\json\wallet\wallet-eligibile-aad-users.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\json\wallet\wallet-notification-config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_31603560\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\json\i18n-ec\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\json\i18n-notification-shared\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\json\i18n-shared-components\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\json\i18n-shared-components\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\Wallet-BuyNow\wallet-buynow.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\Wallet-Checkout\app-setup.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\wallet-webui-227.bb2c3c84778e2589775f.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_116899462\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\json\i18n-shared-components\th\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_1229429729\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\bnpl\bnpl.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\json\i18n-ec\hu\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\json\i18n-hub\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\json\i18n-notification-shared\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_424325636\_platform_specific\win_x64\widevinecdm.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\json\i18n-hub\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\json\i18n-hub\it\strings.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3708	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	xmrig.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	xmrig.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xmrig.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1264	msedge.exe
1648	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3353145205-3618084634-580274525-1000\{2D9E63F8-ACD8-458A-9641-319220D1DE2F}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3353145205-3618084634-580274525-1000\{C58A69C8-7321-40A7-9D11-7B7EB711908E}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	xmrig.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5852	msedge.exe
5852	msedge.exe
4644	msedge.exe
4644	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	5132	7zG.exe
Token: 35	5132	7zG.exe
Token: SeSecurityPrivilege	5132	7zG.exe
Token: SeSecurityPrivilege	5132	7zG.exe
Token: SeLockMemoryPrivilege	5272	xmrig.exe
Token: SeLockMemoryPrivilege	5272	xmrig.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5132	7zG.exe
5272	xmrig.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5540 wrote to memory of 4684	5540	msedge.exe	82
PID 5540 wrote to memory of 1264	5540	msedge.exe	83
PID 5540 wrote to memory of 1928	5540	msedge.exe	84
PID 5540 wrote to memory of 1672	5540	msedge.exe	85
PID 5540 wrote to memory of 1928	5540	msedge.exe	84
PID 5540 wrote to memory of 1928	5540	msedge.exe	84
PID 5540 wrote to memory of 1672	5540	msedge.exe	85
PID 5540 wrote to memory of 3908	5540	msedge.exe	87
PID 5540 wrote to memory of 5352	5540	msedge.exe	88
PID 5540 wrote to memory of 3908	5540	msedge.exe	87
PID 5540 wrote to memory of 3908	5540	msedge.exe	87
PID 5540 wrote to memory of 5352	5540	msedge.exe	88
PID 5540 wrote to memory of 5352	5540	msedge.exe	88
PID 5540 wrote to memory of 1080	5540	msedge.exe	91
PID 5540 wrote to memory of 1080	5540	msedge.exe	91
PID 5540 wrote to memory of 1080	5540	msedge.exe	91
PID 5540 wrote to memory of 3060	5540	msedge.exe	96
PID 5540 wrote to memory of 5752	5540	msedge.exe	97
PID 5540 wrote to memory of 3060	5540	msedge.exe	96
PID 5540 wrote to memory of 5752	5540	msedge.exe	97
PID 5540 wrote to memory of 5396	5540	msedge.exe	99
PID 5540 wrote to memory of 5884	5540	msedge.exe	106
PID 5540 wrote to memory of 5928	5540	msedge.exe	105
PID 5540 wrote to memory of 5928	5540	msedge.exe	105
PID 5540 wrote to memory of 5928	5540	msedge.exe	105
PID 5540 wrote to memory of 5884	5540	msedge.exe	106
PID 5540 wrote to memory of 1128	5540	msedge.exe	107
PID 5540 wrote to memory of 3996	5540	msedge.exe	109
PID 5540 wrote to memory of 916	5540	msedge.exe	110
PID 5540 wrote to memory of 5620	5540	msedge.exe	111
PID 5540 wrote to memory of 5852	5540	msedge.exe	112
PID 5852 wrote to memory of 5548	5852	msedge.exe	113
PID 5852 wrote to memory of 1648	5852	msedge.exe	114
PID 5852 wrote to memory of 2540	5852	msedge.exe	115
PID 5852 wrote to memory of 2540	5852	msedge.exe	115
PID 5852 wrote to memory of 2540	5852	msedge.exe	115
PID 5852 wrote to memory of 1984	5852	msedge.exe	117
PID 5852 wrote to memory of 1984	5852	msedge.exe	117
PID 5852 wrote to memory of 4864	5852	msedge.exe	119
PID 5852 wrote to memory of 6020	5852	msedge.exe	120
PID 5852 wrote to memory of 6020	5852	msedge.exe	120
PID 5852 wrote to memory of 5272	5852	msedge.exe	121
PID 5852 wrote to memory of 5272	5852	msedge.exe	121
PID 5852 wrote to memory of 1152	5852	msedge.exe	122
PID 5852 wrote to memory of 1152	5852	msedge.exe	122
PID 5852 wrote to memory of 4328	5852	msedge.exe	123
PID 5852 wrote to memory of 4328	5852	msedge.exe	123
PID 5852 wrote to memory of 6048	5852	msedge.exe	124
PID 5852 wrote to memory of 6048	5852	msedge.exe	124
PID 5852 wrote to memory of 2708	5852	msedge.exe	125
PID 5852 wrote to memory of 2708	5852	msedge.exe	125
PID 5852 wrote to memory of 6084	5852	msedge.exe	126
PID 5852 wrote to memory of 6084	5852	msedge.exe	126
PID 5852 wrote to memory of 6044	5852	msedge.exe	133
PID 5852 wrote to memory of 5140	5852	msedge.exe	134
PID 5852 wrote to memory of 4732	5852	msedge.exe	135
PID 3708 wrote to memory of 1088	3708	cmd.exe	141
PID 1088 wrote to memory of 5272	1088	xmrig.exe	142
PID 5852 wrote to memory of 4644	5852	msedge.exe	144
PID 5852 wrote to memory of 5536	5852	msedge.exe	145
PID 5852 wrote to memory of 5536	5852	msedge.exe	145
PID 5852 wrote to memory of 2472	5852	msedge.exe	146
PID 5852 wrote to memory of 2472	5852	msedge.exe	146
PID 5852 wrote to memory of 232	5852	msedge.exe	147

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/i839le86o6e2hw6/XMRig.zip/file
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ffa6ccbc188,0x7ffa6ccbc194,0x7ffa6ccbc1a0
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,14271298808496850954,12929157416820132511,524288 --field-trial-handle=2636,i,15741505847610433094,16201931000381600179,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1780,i,3001498650581227454,2310112465022409772,262144 --field-trial-handle=2636,i,15741505847610433094,16201931000381600179,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:2
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2320,i,7643968078849115080,4623355931165169770,524288 --field-trial-handle=2636,i,15741505847610433094,16201931000381600179,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,3147305021754847665,8281561523661608858,2097152 --field-trial-handle=2636,i,15741505847610433094,16201931000381600179,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,2986953500099478097,5862161789395710229,2097152 --field-trial-handle=2636,i,15741505847610433094,16201931000381600179,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5328,i,17746470247939722228,1806231502790424099,2097152 --field-trial-handle=2636,i,15741505847610433094,16201931000381600179,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,16673644790737296005,9837017457284830428,524288 --field-trial-handle=2636,i,15741505847610433094,16201931000381600179,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:8
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,3332298888738048112,1138334029158621145,524288 --field-trial-handle=2636,i,15741505847610433094,16201931000381600179,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:8
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,15193458134282653253,15164806114353894390,524288 --field-trial-handle=2636,i,15741505847610433094,16201931000381600179,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:524
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,15193458134282653253,15164806114353894390,524288 --field-trial-handle=2636,i,15741505847610433094,16201931000381600179,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6316,i,15953804553586445871,2686084433664558323,2097152 --field-trial-handle=2636,i,15741505847610433094,16201931000381600179,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,3508213666082334326,6721394899922461625,524288 --field-trial-handle=2636,i,15741505847610433094,16201931000381600179,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,16023285452935447144,2354352109480529154,524288 --field-trial-handle=2636,i,15741505847610433094,16201931000381600179,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:8
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6876,i,6665228521065928305,17444917533641833268,524288 --field-trial-handle=2636,i,15741505847610433094,16201931000381600179,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:8
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,5965837863499275113,1338429579914678819,524288 --field-trial-handle=2636,i,15741505847610433094,16201931000381600179,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:8
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6872,i,10712590990127499674,16532283796206836075,524288 --field-trial-handle=2636,i,15741505847610433094,16201931000381600179,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:8
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c0,0x7ffa6ccbc188,0x7ffa6ccbc194,0x7ffa6ccbc1a0
    3⤵
    PID:5548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,10583930022934972046,3240155372161062200,524288 --field-trial-handle=2288,i,10975641851776115842,8105447465110954930,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,6184169243022607210,17062371529860215374,262144 --field-trial-handle=2288,i,10975641851776115842,8105447465110954930,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
    3⤵
    PID:2540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,11966424660918105496,4926299891631839450,524288 --field-trial-handle=2288,i,10975641851776115842,8105447465110954930,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:8
    3⤵
    PID:1984
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,5098052761037384172,4755636427106215466,524288 --field-trial-handle=2288,i,10975641851776115842,8105447465110954930,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:8
    3⤵
    PID:3988
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,5098052761037384172,4755636427106215466,524288 --field-trial-handle=2288,i,10975641851776115842,8105447465110954930,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:8
    3⤵
    PID:4864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,4165622905366624474,5256597225451309872,524288 --field-trial-handle=2288,i,10975641851776115842,8105447465110954930,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:8
    3⤵
    PID:6020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4640,i,16582264765396450371,8690426696909649980,524288 --field-trial-handle=2288,i,10975641851776115842,8105447465110954930,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:8
    3⤵
    PID:5272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4820,i,9138238641962139978,2103952427408629046,524288 --field-trial-handle=2288,i,10975641851776115842,8105447465110954930,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:8
    3⤵
    PID:1152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4656,i,9189211282334799382,14962349562267207898,524288 --field-trial-handle=2288,i,10975641851776115842,8105447465110954930,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:8
    3⤵
    PID:4328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,5684910735817677399,8411611600389881443,524288 --field-trial-handle=2288,i,10975641851776115842,8105447465110954930,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:8
    3⤵
    PID:6048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4792,i,16476603241976681417,12119706960689862621,524288 --field-trial-handle=2288,i,10975641851776115842,8105447465110954930,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:8
    3⤵
    PID:2708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,13498857322939945698,12411953046156306974,524288 --field-trial-handle=2288,i,10975641851776115842,8105447465110954930,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:8
    3⤵
    PID:6084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4776,i,6435974081653751980,13274033999778636170,524288 --field-trial-handle=2288,i,10975641851776115842,8105447465110954930,262144 --variations-seed-version --mojo-platform-channel-handle=3208 /prefetch:8
    3⤵
    PID:6044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4732,i,4233384556150785962,2887076589906208430,524288 --field-trial-handle=2288,i,10975641851776115842,8105447465110954930,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:8
    3⤵
    PID:5140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4640,i,13930179925052938329,12474505571183548108,524288 --field-trial-handle=2288,i,10975641851776115842,8105447465110954930,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:8
    3⤵
    PID:4732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4612,i,13905547185682503706,3063116424007147413,262144 --field-trial-handle=2288,i,10975641851776115842,8105447465110954930,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,8854717329764912981,604571565571482551,524288 --field-trial-handle=2288,i,10975641851776115842,8105447465110954930,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:8
    3⤵
    PID:5536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3912,i,16033513681479112194,10427062462205245624,524288 --field-trial-handle=2288,i,10975641851776115842,8105447465110954930,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:8
    3⤵
    PID:2472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4764,i,11159553043533285724,17247329661862200188,524288 --field-trial-handle=2288,i,10975641851776115842,8105447465110954930,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:8
    3⤵
    PID:232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,13616275338449792940,16265324042965534676,524288 --field-trial-handle=2288,i,10975641851776115842,8105447465110954930,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:8
    3⤵
    PID:1204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3856,i,927577448521849310,4606918217596313739,524288 --field-trial-handle=2288,i,10975641851776115842,8105447465110954930,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
    3⤵
    PID:3292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3852,i,15827153864698455875,5652026499876504170,524288 --field-trial-handle=2288,i,10975641851776115842,8105447465110954930,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:8
    3⤵
    PID:2860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,1793309317290739494,12300536621444373300,524288 --field-trial-handle=2288,i,10975641851776115842,8105447465110954930,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:8
    3⤵
    PID:3336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4628,i,13633588152311049632,8176071977634040875,524288 --field-trial-handle=2288,i,10975641851776115842,8105447465110954930,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:8
    3⤵
    PID:4144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4404,i,8890452980885852896,3252010127356632684,524288 --field-trial-handle=2288,i,10975641851776115842,8105447465110954930,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:8
    3⤵
    PID:5528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4756,i,11286917886699678139,6279646341309732199,524288 --field-trial-handle=2288,i,10975641851776115842,8105447465110954930,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:8
    3⤵
    PID:5100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,5510755550869020694,7263347959892537642,524288 --field-trial-handle=2288,i,10975641851776115842,8105447465110954930,262144 --variations-seed-version --mojo-platform-channel-handle=776 /prefetch:8
    3⤵
    PID:5664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4756,i,11555017967644423131,13973253754762635080,524288 --field-trial-handle=2288,i,10975641851776115842,8105447465110954930,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:8
    3⤵
    PID:4952

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3272

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1320

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6060

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\XMRig\" -spe -an -ai#7zMap8726:72:7zEvent705
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5132

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\XMRig\startnew.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Users\Admin\Downloads\XMRig\xmrig.exe
  xmrig.exe -a rx/0 -o xmr.kryptex.network:7029 -u krxXWQGVEQ.worker -p x
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1088
- - C:\Users\Admin\AppData\Local\Temp\3582-490\xmrig.exe
    "C:\Users\Admin\AppData\Local\Temp\3582-490\xmrig.exe" -a rx/0 -o xmr.kryptex.network:7029 -u krxXWQGVEQ.worker -p x
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:5272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AcroRd32.exe

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
Size 2.4MB
SHA256 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
MD5 8ffc3bdf4a1903d9e28b99d1643fc9c7
SHA1 919ba8594db0ae245a8abd80f9f3698826fc6fe5
SHA512 0b94ead97374d74eaee87e7614ddd3911d2cf66d4c49abbfd06b02c03e5dd56fd00993b4947e8a4bcd9d891fa39cab18cc6b61efc7d0812e91eb3aea9cd1a427
SSDEEP 49152:oTfiUEWo6zuEz439z99akTBc4O8b8ITDnlT4NvJX:oTfiG/nzU90T
TLSH
T179C59226A2C8C0EBE5642170CC59BBF900546D78DBA2CDD7BD447E16BA307D29533A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2e0f48d2-33b7-44b5-a545-8b2e62603bec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2e0f48d2-33b7-44b5-a545-8b2e62603bec.tmp
Size 31KB
SHA256 3fbcd784f0475a6a8ebbd4e2b5e512b2ae4a3e254e372f7a15136d31b298432f
MD5 1169378c3c6cf0ddc3c74bccbc9fbb7f
SHA1 62f37a70fd2c32564e044b892fd06f35ee885a9c
SHA512 d78216ecbca7e382029fb71ea5391c7bc0b22d4e8f1c5d47ce3224b898c89a74539cd0d4e817330a59addb044cca9dc60806e48acc4ebdce1f38a94d36da7adf
SSDEEP 768:SFjPPwgBviB4eCP6F9vY4r9odFvaTZc1LY:cPrNP6F9jWdFy20
TLSH
T1F3E2283DAC54D93FA8EE7B84A24E3652DDE40273C8B88998D7C54F1C80B619DF74A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3672d367-4179-4e42-9482-f31ee62edcb9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3672d367-4179-4e42-9482-f31ee62edcb9.tmp
Size 26KB
SHA256 063e585fb896f83c37f824ba70b450e0a50aab5c41891196e82c54fbfca7500b
MD5 dbf2c4e6519f67563996074aba890e9c
SHA1 8cf0766f8e1e2246b35ee2d6e86a32b3c0b76d9e
SHA512 553ac3f12d81e3614eacf0ea8ae1a3439944609a80f254475e0486d657c45217fec3f206076b0d587180bcc724bcf14c937c31e5549822c671290cbfd6b33232
SSDEEP 384:nBRiFzQkUSvPsNW8TUNTUlI4kQE3aJJ3jt4fdB4eCP6ntzmCvud4vaTZcXggL/7G:aFdPPwgBqiB4eCP6F9vY4vaTZc1LY
TLSH
T158C25A32E854DD6BEDEA4FD5A38E7643EEE04253D88C9AD4DAC95D2C00DB1AD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

83a7ab6b-ed35-4368-8da6-96e0f5f40dc8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\83a7ab6b-ed35-4368-8da6-96e0f5f40dc8.tmp
Size 26KB
SHA256 7ef6b0853ba4c888cad178396b81b4effd624f52334125665450d77e3b971819
MD5 fdb945d8d47997d1f9d7e6c29d0215a6
SHA1 dd8b45e9bae49b54bd0f8c55afbadcd3e91e66d1
SHA512 01fd3b37135258134ee691673fa7a36e4e6dc5cb086d5b15e0170ed9260b48811c4d24d55d8dd8fbd9094970fb1198d64de336137e2af79d3788631d342c0bbf
SSDEEP 384:nSiFiZcI63sNS8TUNTUlImkrE3a56nQt4fdB4eCP6ntzmCvu84sa+VYdd7UcgL/a:ZFQ63fwgO1xB4eCP6F9vP4hggRx
TLSH
T1EDC24A32EC94DDABECEA4FD9A78A7607DDF04263998C9AC4C5D85D1C10DB1AD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

87e61a10-f436-4b3f-b0fe-491520300db2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\87e61a10-f436-4b3f-b0fe-491520300db2.tmp
Size 28KB
SHA256 17fe20537ffe59f0a19480a2cbebf81e7189a8eb05cff01629a4faf0ed675508
MD5 f56a3d28bfd8e6d4d6fcd48313327376
SHA1 cdf17596dfb5b3e88da447ef888c293a9d6c921f
SHA512 48d14699f64690fd2f5eb951f9f75bfed16d61aa8cfab9936dab666c61a0c4bdf1b599f752f6ffea16efd004a6a10cfd5c02cd82102e7d0a41c7dc8fc15edd89
SSDEEP 384:npFiFxQkUSvPsNA8TUNTUlI4kQE3a9Nujt4fdB4eCP6ntzmeV7WSXz8UtDaTZcXg:CFjPNwgB1iB4eCP6FNxRz8UtDaTZc3Ls
TLSH
T179D24B3AEC55DD7FACEE6B94A34E3513DDE04223D99C5AD4D7C80E1C00AA19CA30BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 fde3b41a5711362d7f3df7d71563d5eb6cc679bae7f80f74afcdf81dbc09eafd
MD5 3406d3b708dcef0116bffd8eaa181ad4
SHA1 3df64b48bff2b9d4160d900e91a7670046a24340
SHA512 d22d05c221bd19bc3b07e9a5ed722fbf8fbf75d695302fe8ec441d6d1e653bd63b3751a9608b344cc859feb79c5869aaeedd08bf846dc01a522b3a0dbb1637d9
SSDEEP 12:sUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T18F727886B34494FFC8C35A7189BE27902374F6DE5F02836B6A3A7A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3a90bea09e212134dc17388b25f224d71e49ca39dcc69bc19702622e77398e31
MD5 1b78c171c4c68630e5b7ebb32c84e785
SHA1 91cf5dd71c41350998b7d2281087fdcfdebe69c1
SHA512 ea0518551e5ebe409c443be54112086677308fdab24beab120e4553deb487efb00bf47a7a850d5952ae98f894136b4b665897af533998d21b0bdebe2ab6f9313
TLSH
T130D0244CF5FCD054D413103FC3304F4033C5C5545103F001C04433550C477030754050
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98999e5f9bbbe62cf100a651f3803ea26406959130726aeb56f769fc1d96ac59
MD5 0a0b4a8419ad8c9bcfb1e22c15093266
SHA1 6111bc8420ac681cdd67fbf8176c72b5edfcb15e
SHA512 818ca7f71f4f9a0cad9c8933a72104baeeb330e888447904f38e6dd825f100cc27d2507be851a791b0841b0ef587d02139bf01408d67c7ac1eaac9c56060d15c
TLSH
T171D0C004757A38EDC12E503F81508EC006C08F6342000500070B1C080D502021C90ECC
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5edd90b1baeb2e089f20776064e97b90615f17d249e44b7a9c0602ff76486d0a
MD5 9d29809c2652c8f7dfc1714b2ac1a04f
SHA1 28fb378c24d9aac9ca93b7f2fca1fbc0a530d7cb
SHA512 c345ef3a531aa93d7824ddea36d18622a1570ee297cad7b5d96e1ae939f7d3707f43de0eb45199d3a54bf405be219fdbc9945a0fd027f574d395ff53007aeedb
TLSH
T124D02B48F9F88054D402103F82604B4033C581545103B001808422650C867020A54050
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c55fbe31e3c4ab949ada389f971e071b484ab721c70910cf591afd7fa64d77e4
MD5 6373ae5a7b45d358d7343a290a889c7f
SHA1 10a0a1d7f8bfb56003ca03c7ee36c002e27f87b8
SHA512 20b9c9868515b6d43b073feb0fea87e554880bbd69a78c11e202244e0112ad3292de964ce46b3245a7aa3e37a3c8b770351bf8d0f8126d7adb19b0d417c31982
TLSH
T197D0C02C72BF380CCF0F903746408FC046808F1641028910160B6D040C4030D1E400D8
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 15d6fc8d93296c12dcffa6502872a30f42703a3ef4743520879ebfc76542a710
MD5 8ceab9df52911cd78f7b3535d53b2777
SHA1 84ef878d90db69aad3b4ce119369ca5db5c786f2
SHA512 ffdbbbc85e58918eca3ce902bd5a08456576bd2049e04eb18e9c8e40d35af77d4d8840ef7a396e034248ce4b5d3d61a9e74b516dce6193c8a47bfaa9ccb85278
TLSH
T1A3D0C02872BB380CCF0F903746808FC046808B1741028910160B6D042C4032D1E400D8
MD5 SHA1 SHA512 TLSH

Submit Download

7af1307b-3f81-4296-b975-9a115682301b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7af1307b-3f81-4296-b975-9a115682301b.tmp
Size 13KB
SHA256 9cc1056683dc181b99eaaf1c8ad3de8e12e53f300fa3af58484477f161d18309
MD5 7e6ac47f252051de7761d38bacaa0475
SHA1 989f6ff2688b95ceb65e0437f2b694dca98bd738
SHA512 de0646b29020c0fca57f5ea5263a03ae3ad93ec1ba1231aff0258e9fdf8bd93523e3bc286148fea90b26a0ec4d23e875a311808745f8ea25575198d0cbc20f5a
SSDEEP 192:sxZYRe9u/fzsrWpVEe1sEzodpufHW6+WNZhPlXYUYV80mGIgbPttJ:sxZY6u/fzsrWvEeu0HbVXE/rt3
TLSH
T16E52E8056D28A93F9CCBD21DFA15BF93D2F9513290955E48AAFC8A1C14EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 5dbd6db81f71ac6772f07c342f03922979927f796ff4371936823f4c232b8e24
MD5 882a9ec06ec00c7ada3c2e22585c8ee8
SHA1 7e4d8125ed1ed4c1b52bb004a793ecd14c798eb3
SHA512 31646114a5413d04a9ea8383c11a91b21e03cbe4e0a64099f99283ce82d3c76aef6b2edcf995aa3c1af33bbb96ae588523ccf27e2d2ec9bdd42b26a8e496ed6f
TLSH
T1BDE020E808C4C21F550465870274974DF7812AAB92C46D0D2704C54C7046B40EF85D64
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 379c3aaf391df77082f55e027dd721c21060c990091851baa25c647b0f9a6ebb
MD5 eae1924c1c86a3947ffa3fb28f63245b
SHA1 ed44d7bf44c5ba020bf3cd4491ed51456dfb3a2f
SHA512 2382204d2ef18c7ecb1077a12087ed6057b02b78c2bd3d0f59e3a0049a60a662523e4df78ef0da77ac746663e2238b429912ab446736b22d47c5a2eb2742cd84
TLSH
T163E020D649C4C25F5604E4470278AB0C83812AAB9BC46D1D6F00C55D71C6140EB81B54
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 7660c383345c67650363a903103747a72e51b87045e8c50004d8f599893f0db9
MD5 3e5144a6c8bdf437d32365c783017f4a
SHA1 1a7b3b654166105d31fb0495d432d5db3f294f55
SHA512 68d06f237f8bbdb0ab7ca2690e2bba6b8e938f92c27e73e0fb06b864e5104e1f670b5f433e519b021923f74623d5cf34d06db6e37f36cdd8dfc60c1d4663569b
SSDEEP 768:PMcfQBEU6Q/S1LOIAHiRzYXhM1ugmdVbmK:PMcfHaiRzYu2EK
TLSH
T189134D7F72B05C16CAEE897C001B0BBC6F3ACE64C0E5C55767B4F9249B5E746680EA09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 47c3b8d753884a03d01b493f13a5078e286b6a8678fb260717580b34463b9d60
MD5 dd8a6d6f5831985c82265649ee745048
SHA1 e19b569f345aab9dff1d4c7437bd860955114820
SHA512 a13868e946eb0688d9962adbc78f45dc215c6775b498dbad056fd957d14ba54c1d8fb75a50067ff3241369619082c1b53fea88224af0668edf7932685ffd5359
SSDEEP 1536:07T5L/BfL/7/9Lx2rsdPKIv4C/AXL/5L/QL/8u1bl+zwAtEZ9ykNafIVhZUVtjOC:OT5L/9L/FUNZL/5L/QL/9fGYUR9Sa
TLSH
T125446FF71951A01BCBA842F5D2133E3ED17B055D2CE1F8E9E5788C922829B31B6BDE44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 f11543715a87c04acc989a775f6320dd661bf70b8fc681d8a18409d8c3b06312
MD5 d77f5a14a036baff239ba7069cd6f769
SHA1 5569e880bf9d95d6fec9f3a0edb4fc89c223952b
SHA512 6b80e26a4562acb04a712b2673ed3b340e93e268da8a38612b1515443c8a193e511e13015112d44598ebc003cf31ef548a3e63bb276090d35a3fe42dad4786d7
SSDEEP 6144:rVBxbHXQSsMbnjg9SbVtyJAeOZYQA+51CHt:5DXQSZbnjo+eOZZA+51CHt
TLSH
T14F253AEEC7281C82DB6B8770B4E0DD077E702182B69DD0D39940C5E897D6B8176E92BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 c1850f7a3659e5b328be06ba577a58310a187e739f28c6d54d0b2e5c5b027a30
MD5 6667626d294362daa95cf671033ffa95
SHA1 20836d70355e79841621d66e88fe0d31c0d005b8
SHA512 961b366c4a7af8fafc22136e58ea1a60c3698d8befb7fecd26375ba3ca62eda429d85fd12288149a1c929b504930bef0be90ccc3b72d1f17c0d825a9dbc2b226
SSDEEP 24576:szUbRvfSnYCQky13M7oQikigGGcKOpLKhVA7BYuC79YvKkIgS2:kUFfIYq7oQiE6DpLUK
TLSH
T104166CEDCA7858C3CD639A30B4F0ED477C7413C3F965C1D68898C58402AB7C5BBAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 d58ec42d5da1f258d3e660e119306385a030dacdd138829fabe149f02b9c1e75
MD5 e692a91bdeefa08f7212bc655abb412d
SHA1 bf548a0a83687ad4519c912068cfa05e6954fc70
SHA512 82256b70fbe6d7c76ca03586a27bf8b51f8a6aa0e8bce3936485f2f20b0e2d624fc58a343f7a2e38ad3dc1b615f2a108327033706817c53de492b3e6a8e4963a
TLSH
T1AA71A6C92EFD1C59CB5C85354FD7418B3AB58DA0D783FE0D9A5CC03847AEBA26478290
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 76afc29baab04388823cc12b6710a41ee3d4d1f7c11098287fd569e64c55d721
MD5 59fd755c4eb61e513552f107a89fceee
SHA1 d0b1c1aa81c9797dc8ec805944c0a3638aac422e
SHA512 2e5b937ffe6102028d9b01587eb65929417a5e4bd257f72151f0f8193e453f274a9142487d2c009d5f1711761e1c5f8b5583f4660fb3364b6410c8f520e4d49d
TLSH
T17B615FC90EFD1CA9CB9C45354FD7408B3AB54DA1A787FD0D8BACC13847ADBA64079290
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 82fff0009ad8e1607f2437edcd24d053e7583d781c6cfd56576c810a467a14ba
MD5 9fdaec10a7332baa82001a84fc789030
SHA1 6af7644ad3ea732568673080c50784a7a95d87aa
SHA512 d9816db0b35956ef4e66e38386066f5cde1c612557e4cc99384cddb850df2a3ec90d33d188a47f0b8ef36510a0eb18187cdf34bbbf80bc1a4c05f9c2f43992cf
SSDEEP 3:MsEllllkEthXllkl2zEklV4/:/M/xT02znVg
MD5 SHA1 SHA512 SSDEEP

Submit Download

2eb77cfe-2c4f-4db9-a37b-d0124742a25e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\2eb77cfe-2c4f-4db9-a37b-d0124742a25e.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 2f44997dde548a5cdc647c6fdfab14b4df13e104d4960f9f83946d1459453fd4
MD5 70cf64f1dce5af0c9415fe4647743703
SHA1 ef5da37001cf677561bdc9bf3235eea86f31b332
SHA512 0c86f85d7ddf5153ccd59935a4720185e7a89337f556c7282d312c30b5865364e2c12b857a2c7ade69b65e92e7ea9143f30eeccae3934304c41c029d192fa40e
TLSH
T108E0D8A46ACFC11E991434CB06245B88828535B3DB81AD072B04C8C4F64B006F742D46
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 570B
SHA256 99def1b557f19f04c1affc6f247d0451f33fc10ec42e73792223c3215ac98be6
MD5 d4ba0ae0bb0b9faff3da6f35fdbc3c8a
SHA1 fb3e9dec7f35a9b1d94e54a5659dd0de484055e7
SHA512 86fd07c34b9abd4c52ba19eae291936f92bc6d38a75c021edc1dedbc15617669876180cd99f959c62476d82ec6bb9f5fe4c6cb4d82cb037efb76d99a4d3d9c51
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 3dfac81e8419f44565131f57df850c55fd7447e39fe476d8539e7400de7e1c67
MD5 a48e98d29d0b0dc2ccf806fd360d7302
SHA1 9fe6ba764e2d9699ae3633905d2a165d82a477e6
SHA512 ab7bf583c8f0ced1f6a856974b3bb8494a07562a0d88761ec5b513b8bbf69245077b4ee5b8ec44efcf36e640c0a9fb7a8494455cb2dd33beb8153c3cc5c3bf19
TLSH
T177E0866816D9C12AF01C78D34678778987D27497B6843906670ECC44E647A5AEBDA6C0
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 d86b7b7f10bbecfa155b2aa53e2a61a8b726d075be1073b16322b4446e5f564a
MD5 959fd7a9dd064b5f7fead31a31b71b10
SHA1 fd0d829d81034864d3c8c3f212815cdadc8bed62
SHA512 84099eb90e068a3100530d376ebd68db1a68880d543e8c94c0cd92c292ec0655afe96d491ebb837604bb491b987bfbf18cdf13e6be24aac9ba0c205bd8744d00
SSDEEP 24:TL8JhK3iOvwxwwweePKmJIOAdQBVA/BNj2VTJZwJ9vpV3WOT/uReQQ:Tgm+BE9ZW9v/3WOT/
TLSH
T1A3E23A2A5E7C7521CD667136BC21A4665CB910DA977336F23EE0007D6F8228BC475CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 7f7f22ef009437f15a29b9a7f5f9dd4bcf7a3d2527a6b8731829ce5373b37eb7
MD5 737115f928997eba8ec3d3244b794381
SHA1 4417a1079ae69feaca9ff6168284c8d9670a7b2b
SHA512 9fe0e195ee7188c45234d870409ddd5d47e8aa87060da47e931d2bc6410eb7b2bae0b3247ff12a02ff12200360e3e659d5f82dba45952d1f25d87299862292e3
SSDEEP 48:uzBmw6QU1PzoLKPkvi6xVqKRmYht4VTz7T:6BCxoLKcKkVqKmAt4hzX
TLSH
T16692B5835E743003EB560D76223B147C993BE16C5FB6CDD5782894324DF8842A4B9AEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 6a19a2d3e32d94a2a1eda42f3dd0ce41d542ec7a778802b176f2ded3a0695290
MD5 5a18f709135d2d1678de98a9d5437573
SHA1 d4772da8fb8ef9cdce88e82bc0ecfc9710d9b3a2
SHA512 8ce28f823411b9a9509817aca75556b2579174656c59d32958862c7765520727be08d428b256d8d04e79db6512a739870d4ef0915d5139305cc621cbc3da5eb6
SSDEEP 96:nFNwV66cIU+bGz83uy3+u4tgp4DLjGQLBze9z3VjBHMsDEuspU0wbtqrOQpPfR4A:n3+Fcf+G83uy3Ct7XBBKTH7DXspU3iV
TLSH
T13714214F4F653712CDBD817669F744B35C6CF03F8B1266DA686104B4CEE2A52A06C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 496B
SHA256 0c6e7a7de47ac9c2d8716b7e49513b502831178e511aca27e06feb1143db1357
MD5 2cd177b03bd0099f5bbc88fca247cff3
SHA1 912315865f0e39fd3c7699468c6fdcf36a4f23d9
SHA512 f09455f756efefd564d686958f201e62fa6da2e166e59bd5efcb33e368d91c37430994c841cf4f3ac8ae3f7d8188bd531f8e618e0efe9c7fa8ea49c6b4407dfc
TLSH
T136F015738CD4A0BAD75B4CB5E57AFAADA347E99D1D84D381E402E2995E480B402E5D03
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 21369464f88fe088dbf746afe7b954affd2fd9234ebd4c2657da5294ad45dc2f
MD5 2b5b3af5266914a0956a13c20898f825
SHA1 223dd5e3dc24aaa5f0b139866e79463933252a76
SHA512 4606c012e2859422c6e7edd943e845eb22f2feefddf766f83be7c565d75212b024debcf60b04546e0555f7f96c21c8cbdc8fd5e438e0c1a132bdf5af71604e9a
TLSH
T15CE0267146EDC12FA21B204B02286F4CC7B13457E6853E06AB04DD48F00A208EB86EC2
MD5 SHA1 SHA512 TLSH

Submit Download

664d8182-076a-4750-896e-92d961d7223f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\664d8182-076a-4750-896e-92d961d7223f.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 a25316e44528b856fc3053c767c6aaf75feca485c5f4688c10370961a9d012ec
MD5 4d464cf71a0ed39b43830a812413448e
SHA1 5cbe39d7a22fc7a23de3a9fac20424a729cf8fc8
SHA512 afa1750b872a72598a54d5c3aaaed0b1f33f745c8f9c8a441cdffc210ffebd122f41ce48a9621bcbe635a507a89b1aa3193842758717bb6eb9be2aaaf5329af0
SSDEEP 96:NeMatUaAKfYDqOGNhMeSI18mKsK/hN/PYnbzbnJvA:NLaSaHfKq1hMvI18lhZY/Lm
TLSH
T16A92A79FDFD01103C5FF1972C9B78C7A293C18D99392ED9A6D90A1B3CD1121AB081F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 858B
SHA256 59b4f315cfbabdc3625ab9dbd837e3f761ad93c72312bd2fd615d1d6e0300b1c
MD5 ec352e755d424f3385855bd68c47cf1f
SHA1 e288a7ad42d3e9a7d4001af7af4f71ca1bed9e67
SHA512 bb01cf48c712e7d142fd43c7feb7107577c0d024768cb50e47d0751a8642410f75c26b3dd4e17362419699557cb435a803eeff764b385a885da573e7f48d1501
TLSH
T14B116FE7817EBE6B5028887B0E8879422D7AA432025170F1EF5B833C70C25F71B56835
MD5 SHA1 SHA512 TLSH

Submit Download

a964b4d5-daba-4508-9af6-5d732243c092.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a964b4d5-daba-4508-9af6-5d732243c092.tmp
Size 7KB
SHA256 dd007fc6c59b08e11bfcdbbf04eaeec652c4125f7c00f87206f3727a79bb1ef3
MD5 ff12b1c2956a6c984c863ab8da6f12a2
SHA1 264fe6aa3063de36c419677ab850991668ec84bd
SHA512 53a6b9b430c4c1e082f5668cda9145bc16a3efdc820d47090385651be11cd24b3756e2db955f01f92ecb42819d382d052e570998c69d3d61497b030444f39b3b
SSDEEP 192:D1ILAokvVNlWCCWgV4IYeWrGip4V3RbkD4q1el+aP/Wl:D1ILAokvVNlWCCWgV4IYe4Gip4V3Rbkf
TLSH
T1ACF19BF383E5C66E89015AF456146E1BCF2D1B19432C3C16C8D5EE4BE3E2432D26A64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aa309ea0-a2a9-404a-9dd2-b221224e3368.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\aa309ea0-a2a9-404a-9dd2-b221224e3368.tmp
Size 7KB
SHA256 a261e9f97989bd3d36adeca981443b0e9c22930990bf655ad7d27d20d2a6c011
MD5 cbc47d91645a04b555393c0217a3c9dd
SHA1 12ea44d1f33669dfc4d5fdaa0eeb92817b1aed4f
SHA512 eab22a99fd01eed0fbc23bbeff76a93b8035b2835d1d0dc9515221b2ca197fbf927626bc8fbef144be5d83fcec57a50eee8fffa4e99b2d527843db3e3580de05
SSDEEP 192:D1ILAokvVNleaaECWgV4IYeWrGip4V3RbkD4jGk1elK:D1ILAokvVNleaaECWgV4IYe4Gip4V3RL
TLSH
T1E6F19BF383E5C66E89015AF896186E1BCF2D1715432C3C2688D5EE47E3E3432D16A65F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c39d2959-5996-4109-ad9d-508bb21d4bae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c39d2959-5996-4109-ad9d-508bb21d4bae.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 46a5cb0365f2375dc4b41199510b4318b5e681eace5a4865ac6432b6a8b4f2a9
MD5 93a82da3690a933a68a417ed2c5712ac
SHA1 cfc2394cf47502f96c2ec10524f1ef6fc479a98f
SHA512 1f1b2918f08d3d433586c9cca0e7272b22e45b10884640bfd90a03fe8ac7b8770051f4da431632e164bdceb232929538b6e83788d10dd1df69734b169097ebcc
SSDEEP 768:HaaazDVWvZTqo8F1+UoAYDCx9Tuqh0VfUC9xbog/OVdLLlCQcmMroWtaZ:HaaazDVWvZTqou1jasLLwVmXWtaZ
TLSH
T11EC2E93B244CCB7E4FC01A9DDD5A6FDB2E9802C7A6588D4087FA984C02D77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 00023de4cae86a78694c8e6a78e849368addf5c95e4d3b333e93b70df976836a
MD5 ac1aac765c335768eee7e0e1040219bf
SHA1 cdb212a21496837f94f5b02747c2c3549a912769
SHA512 03e045b69e6b633176f3cbf355e35e60f80385181535536df7353f48be8c410b47411e986c8e01026afbf2ea3732ebd43ca805cb5f40412bec76a54a834d5310
TLSH
T1B5E026204AC8C13EB21B32870628838883E6B46BD2C47E067F94CE44A54760DF393582
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 34629413f2395f491beb67cb70ff1899352e92b0115f5f3dc9b3159e37b7c8da
MD5 303971c951e2dfcf88110666322eff35
SHA1 223deb13cad454aaed118132e3fa3875dbe21cf3
SHA512 9cd9b0a03fd623b5e90975fdcf46d0e35bf75fd5fc9b797fa8aaf01a37384d59123ca12ce3d74be379cdc0f7fb3e76cde23861ba207f05c90f59c4c5ae301686
TLSH
T1EEB012053B004303C4BD08B242D347C07231E44200044F139D5AEF700E19AA47F058C0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 7e28fa5f2f75a0dbf1fd2c409225e53210e07960480004c3a6a5ced07c7daaef
MD5 8afb20a206ece8d8b4e5758929dd94a7
SHA1 e74b55c6617aade9e90523875b8d4e8d4130237e
SHA512 4ac4641409d8e5b2af2298f34451c224337e15638a7d2e038e2cd57e5edff7f5c2fb2e9ee6758e9d95ef417ad72c20594561581800ed66e4712079cfbb3444e1
TLSH
T12FE0DF385ACAC23BA14921CB1A24E34CC3A3B453E6C569167B08E688A20B548F383A80
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 57ff08e3abaf89134a0525d6917d3fae097ca98082990721d60ea21e054349c6
MD5 17e50a64e903a44c9de440cc15edf4e1
SHA1 ecb3d07b0f1866f08b2d6378535d7e6763f8993b
SHA512 ac5d67ad3ee216a8d076e21d4ecabb01cd5ddcc5752cfdc23c84b8f08af231dc81cbbcaf820cd860848c4c3f7d6ca4765af77b6c012d2451575c195427e8fa48
TLSH
T10FE026708AC8C23AA04971C70AB4974EC3F2A85BD3C13E0AB70C8C44F502919F7A6980
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 6a3f68088ff5d21afdca9a8bbc75b1edd4da29fa33cffb7aa703993dda8c652c
MD5 c0d6a5a7dc5282ac453995a95ca27368
SHA1 ad8c06659163cce6d706aba5373cfa86f052a64f
SHA512 d686688e1153d07b7e0e8e4b4470b1831aeb37d513d6c852f474e3230e6c0abfc97f5f249fdbc7fe7d3879fa9b01337ef68f14bfa3c34feb101d924c0e40beee
SSDEEP 384:q5/FO5XfrQnWaAqOrm1KSoGlUB4Q9WeDdERN/rviDuRlJ1lnKVl+HYHUFDTsxG:q5/FO5XfrQnWaAqOrm1KSoGlUB4Q9We6
TLSH
T180B2081170BB0240787E2D1981B4972EDA4271A33178EABB7FBC14A6CE66E045DFDCD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 27KB
SHA256 ecb634dafbc8c65a046a4e1ca24c18d70b73e420de23e927a9441ab240aed0f6
MD5 4720aaa4a15dc1410a6d9dbf3affe911
SHA1 abef32f93effc22b4a5a08821912cddaac08d923
SHA512 07dbec697f4a1d298cb6ba3978f583c8727feeb1aecb4598701088354bc905e2a4d06b8f677bfd5028661631020efb8317107b7ec77b92c570c38586f745f481
SSDEEP 768:q5/FO5XfrQnWaAqOrm1KSoGlUB4Q9WeDdERN/rviDuRlJ1lnKVl+HYHUFDTsxkhg:q5/FO5XfrQnWaAqOrm1KSoGlUB4Q9WeF
TLSH
T167C2381171BB0200783E2D1C81B4976F964271A33168EABB7FBC15A6CE6AE044DFDDD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 1932477fd39b9a9896db3ac58b2add8054cf2b1a86a901af7388136d25b12f67
MD5 4285243f1cd3afc77bc981c82f234ded
SHA1 667e9ec6a124d5932b96860878677b30e3d4e9b6
SHA512 cb6d3f6e22dc46978e3e5b42809445c98beecd9341dd8350c470294eb39d57cce2444f4d26478772bed22ea481784224f23cf1f11ed67fa66c1941c3b2b82bfd
SSDEEP 192:P+xWSzE7fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxFzwfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1DC24840A7B747001EDE6D9725CB080771E3CB16ECF22A6915DB254698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 d74ec6ca66c95a2d4af1e27f6bf80e06f6999594d110cfba06d162a8066d89f3
MD5 1173b28127e4e7fa3426fa5d793c2130
SHA1 dc291f060ee7c657cd0bbddfd51fd07f7ad8141a
SHA512 789eadb349ac07aa00afcf5235ebaebc4496003d218c1aa9b010644333b6acf1fe17837af9cd3855bf2c62dfd856bb40bebafa0923c7a041135737a786efc67b
SSDEEP 48:DEK3tjkSI5IUltGhp22iSBggQ7rgGiRww5xVW:DEtSyGhp22iS4yRjO
TLSH
T12552129BEE603253DDD94732EAE111E17E3A413C4EC2D70228C520161FB855257D9DDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b09d8e6a-f99a-480e-8023-852fff89a7b4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b09d8e6a-f99a-480e-8023-852fff89a7b4.tmp
Size 13KB
SHA256 f998a2601a5fcadeca9dc16a691de05340790bd3b7f2e9465b64f1f76c21ee4b
MD5 142ac29428b213f1a96a90c3e0418dc0
SHA1 cdff9fcc2a257ffe14f245937ffbb9304f5d609f
SHA512 4088668eb91b1b718e813cb342c0c85e336728094991d528cf20ff3e35191e8bc94eb0ddfe017414a232a4ebc21726be7f3f8877d981a2541f559d77f2d1e1fe
SSDEEP 192:sxZYRe9u/fzs6+WpVESTZQsAKezodpufHW6+WNZhPlXYUYV809QIgbPttJ:sxZY6u/fzsDWvESdlAKF0HbVXEWrt3
TLSH
T19D52E7056D28A93B9CCBD219FA55BF93E2F9513390955E48AAFC8A1C14E76DD220380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c43a0a23-785b-4938-8cdb-d505683450ad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c43a0a23-785b-4938-8cdb-d505683450ad.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

c6ed5c86-8dc8-44d5-9558-d69e23910975.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c6ed5c86-8dc8-44d5-9558-d69e23910975.tmp
Size 414B
SHA256 576443818a7ff06a8cd416b4c55d8cd0ecc02c91f9610caa8dd1b39052a89707
MD5 51d37b6b48510842a771a963f76bc428
SHA1 febd29a63df6a000ce0a0c58d546781b85334583
SHA512 f3db62771f807337177b931a6bd6dfa1dc84591042b8e80d83bd828f0707398ae064bb8fd2e991d9cc8712ab867a53569a9d83279eb48a4a1410b98f7fa4efc7
TLSH
T1BBE02BF9CD21F82B18FC0B5D64544645E64453571690848F3F3D410D8FB5E3B4296C5C
MD5 SHA1 SHA512 TLSH

Submit Download

d67a21f6-d1bc-4645-bde9-0bd6a56af0fb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d67a21f6-d1bc-4645-bde9-0bd6a56af0fb.tmp
Size 12KB
SHA256 4b9114f92e0b2eeb69e43169d18660315e681d3878c2c408bb0f3f2c302b5f7a
MD5 a95aeaa922100b5036eb00bfe238b51f
SHA1 98546816e4bf9ea55635e3fea827dc366135ce89
SHA512 7306b60ccae807713de6e8d1bbf9f620cf55220d61f9ae926bd743415e04e2911d4a92713708cd92b7c0ed7859daf9e9921001fec2690c6883c60312ff4ec2a3
SSDEEP 192:sxZYRgku/fzsce1s5zodpufHW6+WNmXk/YMTqVY0SQIg5PttJ:sxZYFu/fzsceL0Hbx/+Rdt3
TLSH
T13542F9156D28A93B9CCBD209FB55BF93D3F9513390945E48A6FC8A1C14EB6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcdd738b-0e2b-439f-b8a7-5135bbd35240.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dcdd738b-0e2b-439f-b8a7-5135bbd35240.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f8c97c84-c06e-4007-aeff-c930d7476ea1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f8c97c84-c06e-4007-aeff-c930d7476ea1.tmp
Size 11KB
SHA256 2447f5493459ba0e1cb9f1717d054a80905c79ddfb5c85b4f837452d57e1db91
MD5 7479ce8e6bdebd56dd6619eb1d375c07
SHA1 eae72c615e89a127d44c4c6b42c2a176a5c79ab8
SHA512 7c8020c43ecbfdd9f43c5ccf382ba3728d7658fb3a91c1c11f8168da1cdcd360dbf93a0430f98d899956121860ef00dcb0910886f0f9b5d36b39d4a7f71106de
SSDEEP 192:sxZYRgku/fzs6be1s5zodpufHW6+WNmXk/YMTqVY0SQIgjttJ:sxZYFu/fzsCeL0Hbx/+Rjt3
TLSH
T11842E9156D28A93B9CCBD209FB19BF93D3F9513390945E48A6FC8A1C14EB6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 2KB
SHA256 5a43bd463669687297bd0052e7999e2e35cb059d82657857ac6d30aad65351b4
MD5 8ffa83222ddccdb980e194117c2e3823
SHA1 9ce88f9efe6d5fb174d660827a49d853b51f1112
SHA512 97c59a289481d3b9b84e68f22fdad3b1c3f16a25e33d01e4e4f00384357a742cb0ba74110ec62c432b148e6c7f7691ba3e472711ea0fcc341705ae9f5d54751a
TLSH
T1A9511AC0A3BA5494BF8AB941C12D5643A4E23EA7260E99B1372D45F4CF48C1D4F2FE71
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 16KB
SHA256 dc9c03f07c1aaa353344f06a0730ec3cc7ba174eaf71391ebbd9f8f187e539a6
MD5 1e2738da978577d96221f87d1eada70f
SHA1 c661c565630692d1b52ff4bb873126d08fc95e27
SHA512 8955da9837c74f137b4d2f95ebd98e467c3123f31fe97a61c4fa58c1eb80057618a158df3865a8bc2b485aad9fee2e882282483a67af76c743a0cc4c98d7f171
SSDEEP 192:x95QkIIIbbLMIMNsYcYgEOaNLAszlrhKrshxA5S99B9jV:x95QkIIIbbLMIM2Bla2sZYsY5S99B9jV
TLSH
T11172945B27451B73C19F5FB7027AA7A42BC9CD80493662BD3462284F5DF2B2389D42F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 a28095d91f0e1616c753bb1c7ed80541ec950405f8d069c9fb6073b06f8b3ad2
MD5 ad017114d41a0792b256acab213be615
SHA1 dcbeb618d70576aa0bd92a95d03d890f8c87e0a4
SHA512 11dc3606f6a116b2b0db0142fb245e7a060c8594be8b4c8e8e9b41f25aee353225a464748790e432e4af197a5db27964b3d870f240285c7844452f1ac458b03a
TLSH
T1C2E086A0BFDDD13FE01A308705648B88D7932967EA95394A2F04CC88E546649FB9A5C1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 61d1d9f9bb8c7aaefd8cca75ada3a78523645f3a50b7c1193db2fb37d907b9b5
MD5 4ef89083c49f22ec787a63f6a75f571a
SHA1 f345f82d7258a2f1d22d02b65305dc790e8a8773
SHA512 45dfd268f2816f9431ad89fbb7abc7e546a6b1a0f87990815e173835c608a0fe0eb5962ef517c8a0d4753b1be8ff24357990b130a78cf38eed7db835903022ae
TLSH
T16721BF65F320C158E18A863E902F97350738E8169FFCDC0F84BA24752DB1B100E8B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 f97fd5124210ed1fa9bac5776544061c78ad9c15a24885537cf08c1094e59890
MD5 ae044ee2bbb0fcca8d0e146dfdc61492
SHA1 f653b60cdfeedd51dd289efe925949ee8ad50c6d
SHA512 4b8f2ae363c8a22ef6cddb681083bf5b3a9cc10d2d74d672dba71c47145890614dfe9f6f339023a4e9a6f1e496aa901104793ed3e3147402124cdec4459aa127
TLSH
T184E080607EDDD17FD01630930564DB88D7933867EA953E052F04CD48D546646FB5E5C1
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 2482589b4af264b19efbf24eb3c52260f2ff3ecbb60c659364dba196dfc34a37
MD5 fc07f3168adc2e7a45047cd325b6850b
SHA1 ca46211595e2181069a22d4c4df827be8fc3aa5c
SHA512 a7ace34a55e9213f9035d35b6b7c885e7edac83f7e3805ee4fd6aa67156f24e2613a508d2dc79b9c68fa214141c2138412ab65e7bb5db8d795de7649730e8b35
SSDEEP 3:MsEllllkEthXllkl2zEelt14l:/M/xT02zNv
TLSH
T1B644040C7FD41405C514F5315111C3D00370DD1005117743345544335CC75500C01404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 302186fb7359efe5a407a5169ff4e2bc5e8e8fa8e35d688fdb17049864b780b9
MD5 dfe56695f67e925b947feee2909857b7
SHA1 2639fccdd127e3746f050db9e0815bcc0aa3628a
SHA512 0b7781950f8408781e3a1db2f4a47c97aec4ec74335511dae6da85b816fb2791791b75759484d4988cef75b82fbbdb1c247341b486c0d130b13023b210f08696
SSDEEP 3:MsEllllkEthXllkl2zEelkmV+:/M/xT02zNkd
TLSH
T1E344040C7FC45405D51410314013C3510370DC100511774375530F335CC75C00C00044
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 1356c524b6f42a63195b112b660be369718c21ad732499e8e81f1f52819c1551
MD5 6b5bd2b7b29769c4032e00d208a8635f
SHA1 a359f23b6fa51c4ed967416c98a6a84370e560ed
SHA512 bc7ab4de1465b9a46672f47be250aed3357e84fc91ca2453423431932eb2fce71dc891401b7c03925d2d31ef5c93c44515e2fa591ff128b346b443151e49ba87
SSDEEP 768:SFjPPwgBOiB4eCP6F9vY4r9odFvaTZc1LY:cPrGP6F9jWdFy20
TLSH
T146E2283DEC54D93F98EE7B84A24E3652DDE40273C8B88998D7C54F1C80B619DF74A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 799c112d04ef2327d8fda552add10e03a31a360f92d1752ff1fe9934662fce7b
MD5 8848881e88a042658aa0a8d296773d00
SHA1 7082977615770e43f7b6f5810f8c7d440ffb4ba3
SHA512 9920842b869777f094091cb2c1413c8bf205a30042973cfb5c5bf70e9c1bd16509e2b28580d99e3d9a4e393d4aff45cf9092e54cb66ce79c4cd34c0e4634eec7
SSDEEP 3:MsEllllkEthXllkl2zEel0Kl:/M/xT02zN0
TLSH
T1A744040C7FC41445C51510304013D3510770DC101511774334510C335CDF5401C0011C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

cc7eaf2e-343d-4c2f-be74-f91e98d7bb54.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cc7eaf2e-343d-4c2f-be74-f91e98d7bb54.tmp
Size 25KB
SHA256 3bfbb1d2779887acb85056f333db96ea51d636d548d67a755aac5397e73f32cb
MD5 e22eb21e52c257fd272e94a1e1837a58
SHA1 461406f6c98cd11c0a8dea202b632081ac0186a7
SHA512 a51b8b3d83e701f40400360c993817e011306fb6e707bd7a6a83f4a4a1f068d46f19789cc7ee081dc32d3163f6be364257d2fc379605cfce220cb3089d51fe4d
SSDEEP 384:nwiFiZcI63sNA8TUNTUlImkrE3a+c3t4fdB4eCP6ntzmnMsa+VYdd7UcgL/7IzZx:LFQ63ZwgOE2B4eCP6F+MhggRx
TLSH
T1F5C24A32EC94DDBBECEB4FDAA78ABA07DEE41163949C5AD4CAD84D1C109719D0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

054e83fe-635a-4544-83e2-64e2062fd7fd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\054e83fe-635a-4544-83e2-64e2062fd7fd.tmp
Size 2KB
SHA256 a307491450f49cf3951fcd7f10887e5bcb868b49d0b1c8ac6208570996d4d2cc
MD5 8dd29db46f940b723de636b2df6c6178
SHA1 9d834cb37290c580686194d3c65bffed900abd45
SHA512 e57aa29999ad1864c09a0d8ae917f12e0dab10a7f568c62897ede93d00bf70a235d74f6c355d25051b866214bbf3c4fb4df17cd3f6240a96a919f287281991d3
TLSH
T14A5153D08C395AD1D1BD0E7EB05B39FC85E8D621F4A4783A3868E988497E62D748483F
MD5 SHA1 SHA512 TLSH

Submit Download

1fab95a7-1623-4062-81b3-02406ae19223.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\1fab95a7-1623-4062-81b3-02406ae19223.tmp
Size 2KB
SHA256 d9caa0faf3e81af0e88f75aae8564f2e580069de57a766d321a4098b938b32c3
MD5 ec73c7ba26365078fe388e96c86808d2
SHA1 ed903372bdc3aa628f09afbd403ed36b94afb7d2
SHA512 7134fe8ef23fb06f685b74a6a335db36b9426d9e18269b66bd116535b7093cedcdabcd5f557e6fff97d04534c89abc410e31ddec9c72dd79a111e4762122a193
TLSH
T16F51FCD05C3C5AD1D1BD0E7EE49739EC90EC8725B4A438397868E99C5A7AA1E7084C3F
MD5 SHA1 SHA512 TLSH

Submit Download

2d412735-0845-4c26-b5a0-3545349807fb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\2d412735-0845-4c26-b5a0-3545349807fb.tmp
Size 2KB
SHA256 95c297930483c8e9dd9af7c3c56a795bdaf9f112265ba8da250c220506e9ac1b
MD5 fc6d593317aeaeecfd181d40dec20d5c
SHA1 89eae68d59990b86ebdfeb2ebd6e74e75b98fe24
SHA512 02102d9ff6201bcf4adf5df1a04fe09f72c78b367c20495bda39887ff01e8f3594c071c5e4346028b4cbb47db4462e5ee7a6b7fc74a15cd447c7d83b1233360c
TLSH
T1B55142D08C3D5AD1D1BD0E7EB09739FC85E8C621F4A4783A3868E998497E62D349483F
MD5 SHA1 SHA512 TLSH

Submit Download

46a45346-78fa-4364-848b-d5a9aae6b78c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\46a45346-78fa-4364-848b-d5a9aae6b78c.tmp
Size 2KB
SHA256 a557dbc54a61d187afa735ac9649c7c161fc31350b20fcef2201d51d030c7007
MD5 082ca1babdb3d5d058472b7f8ecb0d78
SHA1 ac887ad1af73e74d0f829648cc9e4a38d9eb66a1
SHA512 5d6e2cf82fef44c3345a49f47d61bff39ad4d2e8e265740e9ab540347f7cd23d13def7c85fa926bc84da294cdb32ee0abc7fe27ef58cbc550441f1ad3cce85c5
TLSH
T1D35143D04C3D5AD1D1BD0EBEB09B39FC85D8C661F5A0783A3868E998497E62D349483F
MD5 SHA1 SHA512 TLSH

Submit Download

4eb9b96e-9cba-4b84-af3c-cb8d5b96594d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\4eb9b96e-9cba-4b84-af3c-cb8d5b96594d.tmp
Size 2KB
SHA256 4fe0435a9b92bf0436e425c2eaf0e7f1a36f5b57d322117893471abb8c91431b
MD5 df2e3028a6238a9b3c2f738880a88458
SHA1 3d38c51c4e42e4181e309c99b9657e1d1d3459e3
SHA512 9c86ae9bfcdcab7daa408a0b7fcdb8a944a1ea67e13da7f7226e2d9520b444daf584e96f25a8840b37d39708d1c9365962a0c12d9e6bb2f55f6fe1841597c888
TLSH
T14C510DD04C3C5AD1D1BD0E7EA09739EC90ECC662B4A434397869E99C497A62D7184C3F
MD5 SHA1 SHA512 TLSH

Submit Download

5d76fa4d-a664-4003-9c82-f020540b5cc8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\5d76fa4d-a664-4003-9c82-f020540b5cc8.tmp
Size 2KB
SHA256 eefcfce27637f70cd5dcb3fec3ab87330634cc06875312ad64b8e39604053587
MD5 a184e18d9e3886686ddeb3311e7f320d
SHA1 e6f19453993c5aafe5368fe79ace69027cc100e9
SHA512 280e786c79c2d2aea6e59b93de024f5c61aa75c99800afa036ee3e35622cebb86043460e660fc89a6f908669186f1a397e14168ea7af359f8be0a8c6d3a86981
TLSH
T1795133D04C3D5AD1D1BC0E7EF49B39EC91E89622B590343A3868D998497EA2D7484C3F
MD5 SHA1 SHA512 TLSH

Submit Download

8ff2dff3-ca28-4411-9863-2b7016d725ef.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\8ff2dff3-ca28-4411-9863-2b7016d725ef.tmp
Size 2KB
SHA256 1fb56e6506c27a6a928af7f6d13a3ce653c2d7a65bfcd1e21565c072574212c3
MD5 efa13cff9ba556f8832ac1b41c0fff4b
SHA1 40b5c0ef05b465c79550ce5a89e54b0ff3fe9710
SHA512 176144e67afdd931935b8f989be4edb3989443b216ceeb2f5c3689fcd755cd744d0146489e7683d238c20e7ab42194b61efed08c894aa2bde111f4488bb6dd30
TLSH
T1D45142D04C3D5AD1D1BD0EBEB05739FC81E88621B5A4383A7869E988497A62D348483F
MD5 SHA1 SHA512 TLSH

Submit Download

a908aa7b-43df-471b-8cb8-5a671f3c3de1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\a908aa7b-43df-471b-8cb8-5a671f3c3de1.tmp
Size 2KB
SHA256 101ba3e7e57a9840fa7704cea203081292221491b9b48710e3a4a2c667842574
MD5 1f2a87368c118c78abe4014a4bc3302f
SHA1 505d41aefdc27c9a191b1da66604a522dc4cb9bb
SHA512 c0b44f44e7348031247b857e7e69a8d2c940a9ed46f1e3d13ca0c920e136b88b4ce4e4731188a70cc91a279f9bfb1f7cb26a6b5ed1063851d7886270f16bfa72
TLSH
T1745133D04C3D5AD1D1BD0E7EB09739FC81E8C622B590343A6868E998497E62D3484C3F
MD5 SHA1 SHA512 TLSH

Submit Download

e0efdcea-4106-463b-953b-0723623a0554.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\e0efdcea-4106-463b-953b-0723623a0554.tmp
Size 2KB
SHA256 84b38045492a66d189e5edac91ae0bb7af508209f19591c7922d8bdd912217b1
MD5 5f3ded864045fb94897a580e35a83f2f
SHA1 ea63acb2cd878009155dc1f0a3547a09f94be640
SHA512 e18daa5760e10bb09da93bef9effa85eef46034a9371a573de634fe099cfb72f2a94d484883a9f4cfe05d1b729a065c546b449a8a61b5273c08e0e00af04b3c2
TLSH
T132513FD04C3D5AD1D1BC0E7EB09B39EC90E8D622B490343A7868E998497E62D3080C3F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 392a28f7a8c8369086d5ad4e491a32d6c71b59852becf46486b0ec68ff15bc96
MD5 23cc1ae263f85d8bfcf968247b2cf048
SHA1 bada253e234b61077ad2d542b55f3be08374bcbe
SHA512 6c3b6e6c0e7e0e3f08d8420166587a2846c33245fb34bad490df57c9ff589b6ee9722bb92a8b18e4e5ca2ba5418027a601c1c990d03d398f59be5c1ca0d47814
TLSH
T15A41455CBAE90148B3B76E1A9BF3686E447BBC332E0AD59E10010E4F0963A40C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download

xmrig.exe

Path C:\Users\Admin\AppData\Local\Temp\3582-490\xmrig.exe
Size 7.9MB
SHA256 d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4
MD5 e2fe87cc2c7dab8ca6516620dccd1381
SHA1 f714ec0448325435103519452610cf7aadf8bbba
SHA512 8455c47e8470e0e322426bc9b9f3c7e858d803bfc8c5d576d580f88585f550b95043139d69b0750a3e211915e3f5ec7a67e7784dcf8cac6bd8fe51ab7e9cbed6
SSDEEP 98304:/Ss0YJodntQk3Hv7I4a1Shua+XOoca2q4RVHNaAXMbmx4WH5umbLtb/IRHOhrgjY:LqQk3DBNfrkhKj4DbrxLskS3qAP2
TLSH
T1B0866C17F19350ECC56BC170865BA673F671F8691230BE6F2764DB342E22E905A2EF24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

36b92e84-515c-4df6-a98f-4509f3c9b995.tmp

Path C:\Users\Admin\AppData\Local\Temp\36b92e84-515c-4df6-a98f-4509f3c9b995.tmp
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b7596228-a319-4564-a788-e7cdf70aed7b.tmp

Path C:\Users\Admin\AppData\Local\Temp\b7596228-a319-4564-a788-e7cdf70aed7b.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cv_debug.log
Size 2KB
SHA256 81849cad6993d5f95032256dfbf7143e87b8fbc097d9c1a4839086d5a73d06ab
MD5 422063fe4405a7e49b22b15046843292
SHA1 0ab4d6c89af8ad8c48ea8fbc50557b6eb87edf3d
SHA512 a18c022139f2a2cf9f8fb195323926dcc7c647b430798225f335e3252106ea00daad39138841c41dedc82d8c20b41f714c1753f2a536658a4a1772bd42a4aab5
TLSH
T1BB4166E03571A63F5BC34BC960664C8425A1F182133FAA1CEE4A5074BD5CEA2A72E3C6
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5852_466150679\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5852_895428272\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

XMRig.zip.crdownload

Path C:\Users\Admin\Downloads\XMRig.zip.crdownload
Size 3.2MB
SHA256 ecb4497e5cfbe10ff34a313c33dcf369f856492c6f6c3920ff1166d4b0a2e34f
MD5 64f463af8ed47f299afb2acbe2e7aeaa
SHA1 4fedf2a8441f6bc7d14eccb1d8e72aa29935bf5c
SHA512 dd94244bf1a3c0732241376df5f8753e0d345069903c5912a0409b3d93ab775fb9f2e643e6e79f9d740e0655c4fd0194ec7a527deddb6790e52c9f8bbdc1c010
SSDEEP 98304:I12Uc8wVlZRqCfjd9JGFFkSLBPMz3jIEJi:IOl5fnJokSLBPMPZi
TLSH
T117F5334A1A4C2A32D41DF832BFAD38556B20C16529061C9A8FB67A654FCDF534B3E393
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

benchmark_10M.cmd

Path C:\Users\Admin\Downloads\XMRig\benchmark_10M.cmd
Size 61B
SHA256 235a64e3520b1c2c27763122b303f78aee8d7c083dfd9f1eb936cd5174383609
MD5 5be1c4cacb5ae37c43527e99a097dc7a
SHA1 1b2f00fefde9d601764d5d26d5e0fb2b9f58074c
SHA512 20a9e18bc397fe86514875af4213a02a5831a27671370849f05c2f3ba048bc29fc41ca96f0cb1cc08aaff27bbebf637f30d2ee798cb80ed03080e8c7d8f2d9a1
TLSH
T1DEA02202882300C88283C020302F2222AC0C2083AE00380202A32032382E8000A00282
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_116899462\manifest.json
Size 177B
SHA256 976e13362933c4e9d37530c32a043728f47136ff030f249ade8210d4d1300df6
MD5 27f9a23b87cd0575e13bfd00ea13e3e1
SHA1 998b5c16a3c10772059819448dca88be1af7b84a
SHA512 3a1517e7d3f68d944fa540d52885c2e16d679358c8683997a407720cd6b4b194829017d07b451e58a78879e68cef66ac9e5a1cca3582034a70699709c6ad7f88
TLSH
T144C012DFDC509DB115EB4332156D43C4D733CF0B1546450935F766082E25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_1229429729\manifest.json
Size 119B
SHA256 16d797bd864617212a3e898afbbb83ea627b7232b1c1e9de40aea6ece6473894
MD5 c2fb3bccd5576ebdc993a412bd9947f2
SHA1 bd17e1efe6ce7eff4da219f3dead2d013205bec8
SHA512 f1d7e4a66b046dd36c8b744259d1024b41e1f412a684a54d66bdff967460ae2477a1510266346bea71484e0878ea19fdf8413d7613fccb6fa9ecbc4e87288869
TLSH
T15BB092B00C1AE02B22C49320ECA06A8383F80228F8125B1E088036881F88179C0362B2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_149776931\manifest.json
Size 53B
SHA256 e1cd8395b2a987ed86c356bfae0952ae09f0cb012030690d6e23615698478f77
MD5 231f4c6814bd04e1dff159c333e99a8f
SHA1 e7a5e431643eb7e17b88cd2bc6d76be5be95edf2
SHA512 10edf632be82534001690da65ece25b5c0882a44afd68b54ba078676f06cc19183c50e64b771f36b1d5a52ce2e885dc34ca4f4c049eb517770ee33c03ae06d21
TLSH
T1A29002600814921716C14E506570B882A391661955950D1D04455558029586CE0502A9
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_1567155104\manifest.json
Size 141B
SHA256 fe8c5046a79693a9b7f32bfc3ed7c8fdf84c5d186f5326a527ac508345a44009
MD5 3a5a48cc06d7f5cf2ec6e467e34915dd
SHA1 b6c3679e8961f0af7b5a56704992d5561ebaf6c1
SHA512 ae2de2b1827831eaeae6c9d00d081aa7be570fb050368eabc6b549469b14d7409b55e3726d4ac8ceb6cf75e48b3a88604345cb56a53f0686dd84cf8cb262125a
TLSH
T130C04C5585005D71509D87781D6C97054B12CF5618946509DDC68309EC1DCCB64B234F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_1718166929\manifest.json
Size 118B
SHA256 cc33e26f3b2efe862336389207db045cc7a916940213b9d33d845c82c12c8712
MD5 acb0c12cc7e5345764763e37bcebbec8
SHA1 4147b2615955c51a6054c807c2397e4d7d10ee03
SHA512 6777da8af66a77c28049eaf1b49ba7cdfaa08a8f381c27dad4af0e980e8d5a7ea0df0c3f1fd0cbc0cbe93a83a07d130ae24dc4057471de830fac60036b1c2f3a
TLSH
T10EB09222DC80D832697693A84E2246D0F238234B2568AA493630048C0B2E2F182A2721
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_280184422\manifest.json
Size 102B
SHA256 4a918873dddefc4e395c8a9f8580c8f03c9a37512eb7da6e6454730be756fdac
MD5 bbd743ed25bbba94c85d6d7310c4fd45
SHA1 d19550c1895576761ab76f3ba9bb813511002bd8
SHA512 070aad3473150ba7388e2305f3d5dff14c69a4b468609fa38e1411e575d271d63cc1bf4083d63372b4d244ee5031bd40933f5f68f041c9650999509666e219e1
TLSH
T1B0B01220EC10B4B30004436C0C6CC3C073272F032C4079180DE59F84E90E9DBE071529
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_31603560\manifest.json
Size 80B
SHA256 abe933f0db95b1a75786da21de82feb5270ffa7ae072270923da2437710d93ba
MD5 3790d9257ba14f8be2ba08acf259a57f
SHA1 c54ab2e79d0ac9dc27425c7450e01ad593f02d60
SHA512 9568fef732369f06aafd8270638a38531a26f6f40a1c7c65fb7254eed36807789756e1c6efabaec86017b3decead2773de9ef5814650dbb334e6000ebd44a467
TLSH
T1A8A012605811E13310C403700260438243E01C112015240405461140218823713A3129
MD5 SHA1 SHA512 TLSH

Submit Download

notification_fast.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\Notification\notification_fast.bundle.js.LICENSE.txt
Size 551B
SHA256 38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179
MD5 7bf61e84e614585030a26b0b148f4d79
SHA1 c4ffbc5c6aa599e578d3f5524a59a99228eea400
SHA512 ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3
TLSH
T108F08B5A31E12673416285A1270B52DE7F0C10BDB0AF39779444C3386C348EE82D0EE1
MD5 SHA1 SHA512 TLSH

Submit Download

tokenized-card.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt
Size 1KB
SHA256 363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831
MD5 8595bdd96ab7d24cc60eb749ce1b8b82
SHA1 3b612cc3d05e372c5ac91124f3756bbf099b378d
SHA512 555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5
TLSH
T1A2313A5B32F53673416245A1670B52DEBF0C24AEB56F38B79495C3387C388ED82D1DA1
MD5 SHA1 SHA512 TLSH

Submit Download

strings.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\json\i18n-tokenized-card\fr-CA\strings.json
Size 2KB
SHA256 c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5
MD5 cd247582beb274ca64f720aa588ffbc0
SHA1 4aaeef0905e67b490d4a9508ed5d4a406263ed9c
SHA512 bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895
TLSH
T17251EE3D88F4489B60C7921B6B1142D7C9704E36D704F3848A63828A035BDEFB0BF69D
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_596787430\manifest.json
Size 121B
SHA256 cd25cc1afcc03514d978f0a90692454e810c3cc81763074e0ea5ac504255335a
MD5 8083caaf7f5bc5f01ede464e68db1c7e
SHA1 ed6cf18f79c4ee2968adfffe7bf1bce163ef3873
SHA512 60924bd5617ac5f994805f9a871999764ba93c6adda79c501a0b692dce51b9db6f6531a5e25129bc424ae7c4de868ba6e5a976d6bcfbac2bb8bd192c5513c7ee
TLSH
T10CB0922289429D300469079809B486A6E230674BE406F0397B7041CC8B785B8A4A2A94
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1088-1060-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1088-1086-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1088-1083-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1088-1081-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1088-1079-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1088-1067-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4864-842-0x0000016180000000-0x0000016181000000-memory.dmp

Download

memory/5272-1200-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1235-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1125-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1126-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1127-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1128-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1121-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1137-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1120-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1154-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1155-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1156-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1106-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1161-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1162-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1163-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1164-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1165-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1166-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1167-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1091-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1182-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1090-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1199-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1123-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1201-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1202-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1203-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1124-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1206-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1204-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1207-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1208-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1089-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1217-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1088-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1234-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1205-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1236-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1237-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1238-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1239-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1240-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1241-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1242-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1243-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1244-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1084-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1260-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1277-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1082-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1080-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1076-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-1061-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5272-923-0x000001EDCCEF0000-0x000001EDCCF10000-memory.dmp

Download

memory/5272-1122-0x00007FF6427C0000-0x00007FF6432C3000-memory.dmp

Download

memory/5396-263-0x0000027AB7BC0000-0x0000027AB8BC0000-memory.dmp

Download