348fd64bb5a77cece920aadaf8adc583d662342d84b2e1b42773c95a12cd658b

Analysis

max time kernel
36s
max time network
39s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
21-08-2024 23:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RBX Alt Manager.exe
Size

3.8MB
MD5

131932e4f1709c336a48394d010b839d
SHA1

03a63f9e44f317606361017c49982fabbcc84ae3
SHA256

348fd64bb5a77cece920aadaf8adc583d662342d84b2e1b42773c95a12cd658b
SHA512

3dcef7db833b7a318d092712d34edb8ecee1e9727ca2abc9ed2114a2473048a4e95c3e37ed15f2749bf3e79582abe77b4c78d1b8a07a6df78a9b216fd43d965b
SSDEEP

98304:V2bT1QzcmapX3TJcKGFjyPkqXf0Fk7WpW7:+QzWNdcKbPkSIk7yW

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1812	3028	WerFault.exe	79

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RBX Alt Manager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RBX Alt Manager.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe
4856	msedge.exe
4856	msedge.exe
4888	msedge.exe
4888	msedge.exe
2088	identity_helper.exe
2088	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4972	RBX Alt Manager.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 3028	4972	RBX Alt Manager.exe	79
PID 4972 wrote to memory of 3028	4972	RBX Alt Manager.exe	79
PID 4972 wrote to memory of 3028	4972	RBX Alt Manager.exe	79
PID 4856 wrote to memory of 2268	4856	msedge.exe	86
PID 4856 wrote to memory of 2268	4856	msedge.exe	86
PID 4856 wrote to memory of 1196	4856	msedge.exe	87
PID 4856 wrote to memory of 1196	4856	msedge.exe	87
PID 4856 wrote to memory of 1196	4856	msedge.exe	87
PID 4856 wrote to memory of 1196	4856	msedge.exe	87
PID 4856 wrote to memory of 1196	4856	msedge.exe	87
PID 4856 wrote to memory of 1196	4856	msedge.exe	87
PID 4856 wrote to memory of 1196	4856	msedge.exe	87
PID 4856 wrote to memory of 1196	4856	msedge.exe	87
PID 4856 wrote to memory of 1196	4856	msedge.exe	87
PID 4856 wrote to memory of 1196	4856	msedge.exe	87
PID 4856 wrote to memory of 1196	4856	msedge.exe	87
PID 4856 wrote to memory of 1196	4856	msedge.exe	87
PID 4856 wrote to memory of 1196	4856	msedge.exe	87
PID 4856 wrote to memory of 1196	4856	msedge.exe	87
PID 4856 wrote to memory of 1196	4856	msedge.exe	87
PID 4856 wrote to memory of 1196	4856	msedge.exe	87
PID 4856 wrote to memory of 1196	4856	msedge.exe	87
PID 4856 wrote to memory of 1196	4856	msedge.exe	87
PID 4856 wrote to memory of 1196	4856	msedge.exe	87
PID 4856 wrote to memory of 1196	4856	msedge.exe	87
PID 4856 wrote to memory of 1196	4856	msedge.exe	87
PID 4856 wrote to memory of 1196	4856	msedge.exe	87
PID 4856 wrote to memory of 1196	4856	msedge.exe	87
PID 4856 wrote to memory of 1196	4856	msedge.exe	87
PID 4856 wrote to memory of 1196	4856	msedge.exe	87
PID 4856 wrote to memory of 1196	4856	msedge.exe	87
PID 4856 wrote to memory of 1196	4856	msedge.exe	87
PID 4856 wrote to memory of 1196	4856	msedge.exe	87
PID 4856 wrote to memory of 1196	4856	msedge.exe	87
PID 4856 wrote to memory of 1196	4856	msedge.exe	87
PID 4856 wrote to memory of 1196	4856	msedge.exe	87
PID 4856 wrote to memory of 1196	4856	msedge.exe	87
PID 4856 wrote to memory of 1196	4856	msedge.exe	87
PID 4856 wrote to memory of 1196	4856	msedge.exe	87
PID 4856 wrote to memory of 1196	4856	msedge.exe	87
PID 4856 wrote to memory of 1196	4856	msedge.exe	87
PID 4856 wrote to memory of 1196	4856	msedge.exe	87
PID 4856 wrote to memory of 1196	4856	msedge.exe	87
PID 4856 wrote to memory of 1196	4856	msedge.exe	87
PID 4856 wrote to memory of 1196	4856	msedge.exe	87
PID 4856 wrote to memory of 4352	4856	msedge.exe	88
PID 4856 wrote to memory of 4352	4856	msedge.exe	88
PID 4856 wrote to memory of 3336	4856	msedge.exe	89
PID 4856 wrote to memory of 3336	4856	msedge.exe	89
PID 4856 wrote to memory of 3336	4856	msedge.exe	89
PID 4856 wrote to memory of 3336	4856	msedge.exe	89
PID 4856 wrote to memory of 3336	4856	msedge.exe	89
PID 4856 wrote to memory of 3336	4856	msedge.exe	89
PID 4856 wrote to memory of 3336	4856	msedge.exe	89
PID 4856 wrote to memory of 3336	4856	msedge.exe	89
PID 4856 wrote to memory of 3336	4856	msedge.exe	89
PID 4856 wrote to memory of 3336	4856	msedge.exe	89
PID 4856 wrote to memory of 3336	4856	msedge.exe	89
PID 4856 wrote to memory of 3336	4856	msedge.exe	89
PID 4856 wrote to memory of 3336	4856	msedge.exe	89
PID 4856 wrote to memory of 3336	4856	msedge.exe	89
PID 4856 wrote to memory of 3336	4856	msedge.exe	89
PID 4856 wrote to memory of 3336	4856	msedge.exe	89
PID 4856 wrote to memory of 3336	4856	msedge.exe	89

C:\Users\Admin\AppData\Local\Temp\RBX Alt Manager.exe
"C:\Users\Admin\AppData\Local\Temp\RBX Alt Manager.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Users\Admin\AppData\Local\Temp\RBX Alt Manager.exe
  "C:\Users\Admin\AppData\Local\Temp\RBX Alt Manager.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 1352
    3⤵
    - Program crash
    PID:1812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3028 -ip 3028
1⤵
PID:1852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe42623cb8,0x7ffe42623cc8,0x7ffe42623cd8
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,17848115118535043108,13971716504245924482,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1928,17848115118535043108,13971716504245924482,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1928,17848115118535043108,13971716504245924482,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,17848115118535043108,13971716504245924482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,17848115118535043108,13971716504245924482,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,17848115118535043108,13971716504245924482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,17848115118535043108,13971716504245924482,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1928,17848115118535043108,13971716504245924482,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1928,17848115118535043108,13971716504245924482,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,17848115118535043108,13971716504245924482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,17848115118535043108,13971716504245924482,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,17848115118535043108,13971716504245924482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:1596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3540

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RBX Alt Manager.exe.log

Filesize
1KB

MD5
bf8ce65cfc62532eec96eab3d6608293

SHA1
e26750d57f1bfdbc6814b5628aa2b28b98342f55

SHA256
29e07eeee794292ee69851f9c37378fb047e81454d108d8214bb8f48e72d6e42

SHA512
79864889c3df670b09b057b2e3c420d2a265875c4a6a1ba03630dcac154cacae06ac2cd1759bbe7a21b2863aadf4da8588739aa88d17fd2b627898f6e0e9379b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4bf4b59c3deb1688a480f8e56aab059d

SHA1
612c83e7027b3bfb0e9d2c9efad43c5318e731bb

SHA256
867ab488aa793057395e9c10f237603cfb180689298871cdf0511132f9628c82

SHA512
2ec6c89f9653f810e9f80f532abaff2a3c0276f6d299dce1b1eadf6a59e8072ed601a4f9835db25d4d2610482a00dd5a0852d0ef828678f5c5ed33fe64dddca9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b4ae6009e2df12ce252d03722e8f4288

SHA1
44de96f65d69cbae416767040f887f68f8035928

SHA256
7778069a1493fdb62e6326ba673f03d9a8f46bc0eea949aabbbbc00dcdaddf9d

SHA512
bb810721e52c77793993470692bb2aab0466f13ed4576e4f4cfa6bc5fcfc59c13552299feb6dfd9642ea07b19a5513d90d0698d09ca1d15e0598133929c05fe1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1d7ea0441e6e4e182aa701daedc2f466

SHA1
50662190278cff3596d395b4c8dd5e92caff67a8

SHA256
a75b8521e3a7857f6ce101df15f07ec175170442b26d37fc9324f5ef93bd3648

SHA512
8454a7c1c9f048da9420e0c46ee049fecdf0951af55e6243ec62f638eed2165b15533c2c7ef412f9dbb929ff8617f41b8340b1300b27e510ac1ca25348442e76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6c7f0673a76b9b0b9abdf6a727485262

SHA1
ccb505894dec942bac99fbe9d47c9aa6d2b5ed1d

SHA256
0f5cc747cdae944824c937f3ec4e5f0511f53a256b981537aadce3fbea94e380

SHA512
ef265cb0860c0fb6b1b2d2f234863c361e40ee1ae933b3ee1bfbc0599ba32f505980b8f1b0a3537b788ca3bbd29d2a05462cdff6c1207e55b7bd072e5a606a1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
26d91b22d0d54df2b94e71756059c04b

SHA1
c6c3af2a67441d923d554c749eabf0a26cd372c3

SHA256
164bf6b2284eff47dfac606feece283709d33975f9fdb59b7f99cc60ff43ac8a

SHA512
40123692556c0074853288d1c916c18cf42d4a83ee1435496879beea99c879b207c47cae55f218b88af408d0bb971383f425c8e6c21743ac8ab12c7d2f5cfe23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0e745d5d0b6b25dd29fb6d09f5d92c85

SHA1
c27aa95c06a7dcdb38cd59711cc6e715fdd9d6b2

SHA256
87564dd723081bc26aac4bdd4b1cb3f976021a5ab7dd77f7f278647b0e813b3d

SHA512
d73f5bac56912a1c6a983f9747eabdb3fe59ffb93732735135991a3305cba30e06074603d554c1af1f430a1dfe83097ea41c43fa0b503f86dbca48550325a42c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6df317995fe8586021163a7b96530ba2

SHA1
6a0ef3c3ffb91312692f66de1122bf0c4d04ae45

SHA256
57825b7ae6034222bb0eff39c9cc4771094d5d702862a467d57e91f425531601

SHA512
9e8dd2e6fdb9a52afa62cdb75a6c44890cb76019a1c0f23a241ed8ca20c34170bb3e46e56fb6aeda583d1f2ce58aafb55fbe74ebb3598b43a176a8f512621737

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\RAMTheme.ini

Filesize
307B

MD5
2a40dbc9b944150983d9e1fc489660bf

SHA1
6ddc216f371c65d0c9a0aa740dec5a2dc52bd425

SHA256
ce43e6b7695d95fe16a61fed950a40e86b8b7179ae15af812375b8b2b15c7899

SHA512
12a1aa7fee2629d6d215c16199b7e267b28e0f405a1b014e97db584d371e629e1619804a3c09c7d45cb09fb9d76a0dbaf55bcb4374c807f5916db9d54bff3bb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\RBX Alt Manager.exe.config

Filesize
2KB

MD5
3af58cc4ea567ff23275857a7662903b

SHA1
14cc53e5aaf65da4315436c9b85768ae04e94569

SHA256
b19b7fdd8aa951e1ad15cf5f2c901f1c0a2c9b86a87added6268a72c97d1aa88

SHA512
6d277743a1ac3fd520aa3e9dc2d3b6c8346d7f0dc2742ed716ae55ebd660e1cbe9bb754639cbda0d31561982bb89efd44c2328f382c27eb092339d0709dad253

Download Submit
C:\Users\Admin\AppData\Local\Temp\log4.config

Filesize
933B

MD5
083c9613bea87bb1dcbf9bfee2c666fe

SHA1
7d310e72288eb118f3930664f835028084d999bf

SHA256
1480054437115d21b16e161d0b58bb8670831abf2aa5f21fc59b46afc01dbef9

SHA512
c9163d1802c5b53fe5fd57fa3ecc7e37d082fd6cb6d31fc98b8fe045ff422ee54cd0ebc43848cf823795f41aaaf0bd9cc775f652ed5bf7822bed49e66c69f360

Download Submit
memory/3028-20-0x0000000006690000-0x0000000006704000-memory.dmp

Filesize
464KB

Download
memory/3028-16-0x0000000074E70000-0x0000000075621000-memory.dmp

Filesize
7.7MB

Download
memory/3028-19-0x0000000005810000-0x0000000005824000-memory.dmp

Filesize
80KB

Download
memory/3028-21-0x0000000006730000-0x000000000673A000-memory.dmp

Filesize
40KB

Download
memory/3028-17-0x0000000074E70000-0x0000000075621000-memory.dmp

Filesize
7.7MB

Download
memory/3028-23-0x0000000074E70000-0x0000000075621000-memory.dmp

Filesize
7.7MB

Download
memory/3028-24-0x000000000AAA0000-0x000000000AAD4000-memory.dmp

Filesize
208KB

Download
memory/3028-26-0x0000000074E70000-0x0000000075621000-memory.dmp

Filesize
7.7MB

Download
memory/4972-25-0x0000000074E70000-0x0000000075621000-memory.dmp

Filesize
7.7MB

Download
memory/4972-0-0x0000000074E7E000-0x0000000074E7F000-memory.dmp

Filesize
4KB

Download
memory/4972-12-0x00000000067C0000-0x0000000006948000-memory.dmp

Filesize
1.5MB

Download
memory/4972-8-0x0000000005950000-0x00000000059E2000-memory.dmp

Filesize
584KB

Download
memory/4972-7-0x0000000006210000-0x0000000006326000-memory.dmp

Filesize
1.1MB

Download
memory/4972-5-0x0000000005590000-0x00000000055A4000-memory.dmp

Filesize
80KB

Download
memory/4972-6-0x00000000055B0000-0x00000000055C0000-memory.dmp

Filesize
64KB

Download
memory/4972-4-0x0000000005540000-0x0000000005586000-memory.dmp

Filesize
280KB

Download
memory/4972-3-0x0000000074E70000-0x0000000075621000-memory.dmp

Filesize
7.7MB

Download
memory/4972-2-0x0000000005C60000-0x0000000006206000-memory.dmp

Filesize
5.6MB

Download
memory/4972-1-0x00000000006F0000-0x0000000000ABA000-memory.dmp

Filesize
3.8MB

Download