Overview

overview

10

Static

static

1

URLScan

urlscan

https://github.com/S...

windows11-21h2-x64

10

Analysis

  • max time kernel
    877s
  • max time network
    727s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250313-en
  • resource tags

    arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    27/03/2025, 15:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://github.com/Sampdoria335/SKRIPTGG-FIVEM.git

Score
10/10
rhadamanthysdefense_evasiondiscoverypersistencestealer

Malware Config

Extracted

Family

rhadamanthys

C2

https://185.125.50.38:3034/739bd3e91cd40ca83/pancake.api

Signatures

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys
  • Rhadamanthys family
    rhadamanthys
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 1 IoCs
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Drops file in Windows directory 55 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 56 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:3060
      • C:\Windows\SysWOW64\dialer.exe
        "C:\Windows\system32\dialer.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:5896
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Sampdoria335/SKRIPTGG-FIVEM.git
      1⤵
      • Drops file in Windows directory
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4144
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x2b8,0x7ffce59ff208,0x7ffce59ff214,0x7ffce59ff220
        2⤵
          PID:4836
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1824,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:11
          2⤵
            PID:1128
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2224,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
            2⤵
              PID:3256
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2328,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:13
              2⤵
                PID:3508
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3480,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
                2⤵
                  PID:1792
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3512,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
                  2⤵
                    PID:3672
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4040,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:1
                    2⤵
                      PID:1484
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4172,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:9
                      2⤵
                        PID:2736
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=4284,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
                        2⤵
                          PID:3140
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=4388,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:9
                          2⤵
                            PID:4932
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4132,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:14
                            2⤵
                              PID:3568
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5444,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:14
                              2⤵
                                PID:2064
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5492,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14
                                2⤵
                                  PID:2500
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5324,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
                                  2⤵
                                    PID:3520
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6068,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:14
                                    2⤵
                                      PID:3132
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
                                        cookie_exporter.exe --cookie-json=1128
                                        3⤵
                                          PID:1004
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6136,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
                                        2⤵
                                          PID:1444
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6136,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
                                          2⤵
                                            PID:3080
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6316,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
                                            2⤵
                                              PID:4208
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6452,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
                                              2⤵
                                                PID:1936
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6580,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=4044 /prefetch:14
                                                2⤵
                                                  PID:1656
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6572,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
                                                  2⤵
                                                    PID:484
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6720,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:14
                                                    2⤵
                                                      PID:1724
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6880,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:14
                                                      2⤵
                                                        PID:1604
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7040,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:14
                                                        2⤵
                                                          PID:4168
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7200,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:14
                                                          2⤵
                                                            PID:2336
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6984,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:14
                                                            2⤵
                                                              PID:3456
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=7104,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:1
                                                              2⤵
                                                                PID:484
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6948,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:14
                                                                2⤵
                                                                • NTFS ADS
                                                                PID:4160
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --field-trial-handle=4664,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:1
                                                                2⤵
                                                                  PID:2980
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=568,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:14
                                                                  2⤵
                                                                    PID:2764
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6228,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:14
                                                                    2⤵
                                                                      PID:2736
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6252,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
                                                                      2⤵
                                                                        PID:1728
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7180,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
                                                                        2⤵
                                                                          PID:2500
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5652,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:14
                                                                          2⤵
                                                                            PID:5344
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5648,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
                                                                            2⤵
                                                                              PID:5484
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6548,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
                                                                              2⤵
                                                                                PID:5752
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5604,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:10
                                                                                2⤵
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                PID:5976
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3572,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
                                                                                2⤵
                                                                                  PID:5128
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3456,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
                                                                                  2⤵
                                                                                    PID:5380
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3648,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
                                                                                    2⤵
                                                                                      PID:4516
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5660,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:14
                                                                                      2⤵
                                                                                        PID:1860
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5448,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14
                                                                                        2⤵
                                                                                          PID:5800
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6052,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
                                                                                          2⤵
                                                                                            PID:2212
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6240,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
                                                                                            2⤵
                                                                                              PID:1468
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3320,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:14
                                                                                              2⤵
                                                                                                PID:1516
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4352,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:14
                                                                                                2⤵
                                                                                                  PID:3848
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4328,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
                                                                                                  2⤵
                                                                                                    PID:5108
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6056,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:14
                                                                                                    2⤵
                                                                                                      PID:3624
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3700,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
                                                                                                      2⤵
                                                                                                        PID:2424
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5488,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=1032 /prefetch:14
                                                                                                        2⤵
                                                                                                          PID:5136
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2952,i,9023220907667906128,17403069363048368013,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:14
                                                                                                          2⤵
                                                                                                            PID:3944
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
                                                                                                          1⤵
                                                                                                            PID:2280
                                                                                                          • C:\Windows\System32\rundll32.exe
                                                                                                            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                            1⤵
                                                                                                              PID:2172
                                                                                                            • C:\Program Files\7-Zip\7zFM.exe
                                                                                                              "C:\Program Files\7-Zip\7zFM.exe"
                                                                                                              1⤵
                                                                                                              • Enumerates connected drives
                                                                                                              • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                                                                              • NTFS ADS
                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                              • Suspicious behavior: GetForegroundWindowSpam
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                              PID:3788
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zOCCE35659\RubixLauncher.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7zOCCE35659\RubixLauncher.exe"
                                                                                                                2⤵
                                                                                                                • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                • Executes dropped EXE
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                PID:5836
                                                                                                            • C:\Windows\system32\BackgroundTransferHost.exe
                                                                                                              "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
                                                                                                              1⤵
                                                                                                              • Modifies registry class
                                                                                                              PID:4400
                                                                                                            • C:\Windows\system32\sihost.exe
                                                                                                              sihost.exe
                                                                                                              1⤵
                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                              PID:2080
                                                                                                              • C:\Windows\explorer.exe
                                                                                                                explorer.exe /LOADSAVEDWINDOWS
                                                                                                                2⤵
                                                                                                                • Boot or Logon Autostart Execution: Active Setup
                                                                                                                • Enumerates connected drives
                                                                                                                • Checks SCSI registry key(s)
                                                                                                                • Modifies registry class
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                PID:3116
                                                                                                            • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                              "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                              1⤵
                                                                                                              • Enumerates system info in registry
                                                                                                              • Modifies Internet Explorer settings
                                                                                                              • Modifies registry class
                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                              PID:2584
                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                              1⤵
                                                                                                              • Modifies registry class
                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                              PID:3044

                                                                                                            Network

                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                            Replay Monitor

                                                                                                            Loading Replay Monitor...

                                                                                                            Downloads

                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                                                                              Filesize

                                                                                                              105KB

                                                                                                              MD5

                                                                                                              e777bde1afc679b89c7102b8cfb9b35d

                                                                                                              SHA1

                                                                                                              3deec1b5f9eee777d12853bba30e4c16287cb94c

                                                                                                              SHA256

                                                                                                              2db3a91744672b47fc0a77d458c4a0dffc5311c873f5daf274f69a99248f1cc6

                                                                                                              SHA512

                                                                                                              9b7e60925172257a56781395369e3b813144d698b998ee8767aebe3ac765917a9e80f34864f5d196a927e93d5f34073897b6fb38e96b4864759c5a8927a3715e

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                              Filesize

                                                                                                              280B

                                                                                                              MD5

                                                                                                              ca53cefa89eda1561903f2cec58af742

                                                                                                              SHA1

                                                                                                              66cc43f787136e1070d79ae51e3fdd4c0ddf6159

                                                                                                              SHA256

                                                                                                              32e69371ea4fce52c45992bcb31113c9ffb90016e93d0f5f9ec119caa8a8cee9

                                                                                                              SHA512

                                                                                                              a71715ec9c429d3ffb4e59b4e995e6698187ff8cfb5b3096dac9f54f0a87d02cc97ed181cebe55043bee5a75834ad1f893b72d345210459e92efa95404ee70cf

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                              Filesize

                                                                                                              280B

                                                                                                              MD5

                                                                                                              16324d67eebfa38055529e9e5f1f9ef0

                                                                                                              SHA1

                                                                                                              d8e94ea2c3d5a7f4e73880055b9247e1014c5c1d

                                                                                                              SHA256

                                                                                                              aec06bcadf691e0d12402f0c8ac092df48f1c2b4b77dae27d10ec618d27f8e95

                                                                                                              SHA512

                                                                                                              ce528cf5233a9f3b40367f45612e7e11eeb89aba427a7b353109fc742681e99c8368e217a0d51f882c31cb6f88cf02dc9e352a01b86863749929d71f78864f66

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                              Filesize

                                                                                                              7KB

                                                                                                              MD5

                                                                                                              156aa71da1bf3b0cdf91cc8dbba987b8

                                                                                                              SHA1

                                                                                                              81c6bf1045ebb9a824aac79f38b825ad0aa6f250

                                                                                                              SHA256

                                                                                                              a9a7df6dbc41b54e5e050cba9bb1e9b082fb9cba43ea586963e61d32846a7077

                                                                                                              SHA512

                                                                                                              f5e93fb538524b85af2936de0691ad326e6b21bb1c85d253cb3cd2e2dd53a03cae0a5823ed33b1bb4c6004851eddd17118e352b3678a0a80bc56f0abbef6f37b

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                              Filesize

                                                                                                              334B

                                                                                                              MD5

                                                                                                              8368490f3e0bb390c14701f058458fbc

                                                                                                              SHA1

                                                                                                              58afedf03ba5fcb6ce1f247ac0f39663dcf8ed8e

                                                                                                              SHA256

                                                                                                              7e664c9f93c97f8e7221def9c7c3a50666b4429a2ece98fbab22654139b80106

                                                                                                              SHA512

                                                                                                              2dcc22e689bd61bf9b5487a0ab180b22683bd02ea44a0ed18e8f4e3ea9680e274f73412f5df58e5f45f2a16f04fd70da1a2669f5ed728916344f9c09f6495531

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                              Filesize

                                                                                                              352B

                                                                                                              MD5

                                                                                                              7c727eb51bf47a8d3fccdc88f4c5a19e

                                                                                                              SHA1

                                                                                                              69d50d9af102c63b6985f60c7ffceb44ae6faa1c

                                                                                                              SHA256

                                                                                                              d849b1c35174cdd56e16b641f53fe10699ad5daab171653f0bfb297c07426e74

                                                                                                              SHA512

                                                                                                              242536c9a54b12d2704f2109236748bac32d7c10a6b8d622206533be4774ee56817420529d6b777d5998adbd9a89b86099655b2d986ca402d9689016ec9da4d7

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
                                                                                                              Filesize

                                                                                                              158B

                                                                                                              MD5

                                                                                                              40bed80a2de92180d7a484d378d6fbb8

                                                                                                              SHA1

                                                                                                              f7d8294eb0247600d5fbf3f5881f8d31c7034853

                                                                                                              SHA256

                                                                                                              2dd0e03335d107d2af03bba679786964f4fb11062544dc29d21fc6bc717a13ac

                                                                                                              SHA512

                                                                                                              868093219720cd73f6c0ebbeb8c70d4b9daccafaae657280274fc99264add5a8ee33f79ffe4cfba8145bb5b38a493ad8ada33b62bec6a04657b8fb59bdfe08e4

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
                                                                                                              Filesize

                                                                                                              274B

                                                                                                              MD5

                                                                                                              1157922c87eba749ca1e0f131b57e9a8

                                                                                                              SHA1

                                                                                                              74fa474205e07246af9ec2f361bece6a5c6675af

                                                                                                              SHA256

                                                                                                              d46c34110bea121f074f860d83c8e5495f09e997f0d52fb4418e500154b82ac6

                                                                                                              SHA512

                                                                                                              8f42e51bca535b4de0d8d7eaa1fa0a0e6e03306cb6f6148df2dfd2ba024f18ae8b708e18b638cbf016efc2a697c945330a38a81ea7fe23542a2c5ae755e2842b

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                              Filesize

                                                                                                              5KB

                                                                                                              MD5

                                                                                                              c9e95e3a10732a367c138fec2728abb1

                                                                                                              SHA1

                                                                                                              777a7ec3eaed8f1e9e69d814d2bb41b3f5614680

                                                                                                              SHA256

                                                                                                              bb93d35cd0585cf7c0f24ea3de161e791ddd2fbc092eaeb9da3eb78719a60f83

                                                                                                              SHA512

                                                                                                              27e6cd4ddafa310574db27bf2b40445d23c3ee87eda5b9db535f02c618ff4d438f1b61a62246bd5366efbfd3a776c5fce33005dfd080bc3006c3028a9344d441

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe580ed0.TMP
                                                                                                              Filesize

                                                                                                              2KB

                                                                                                              MD5

                                                                                                              a5bdcc03911941c0d7a5f060ebdaf5fe

                                                                                                              SHA1

                                                                                                              7fb3936b132dc15357d309a9097bc58c70f62ce8

                                                                                                              SHA256

                                                                                                              d77cc2a1fe3e919bbdd8443a679501add7b2146c9a2f9c0d7cd7d4426ab1cf0c

                                                                                                              SHA512

                                                                                                              cb05fbe1451bcc5a8f16c22a818b449f72327cba8c71b9b8b1e5b91fc304aabf2ec689de0d6bb387fd99a4a9febfbd14f4d99e605324b8d3875f917ef360e845

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                              Filesize

                                                                                                              2B

                                                                                                              MD5

                                                                                                              99914b932bd37a50b983c5e7c90ae93b

                                                                                                              SHA1

                                                                                                              bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                                                                                              SHA256

                                                                                                              44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                                                                                              SHA512

                                                                                                              27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                              Filesize

                                                                                                              69KB

                                                                                                              MD5

                                                                                                              164a788f50529fc93a6077e50675c617

                                                                                                              SHA1

                                                                                                              c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

                                                                                                              SHA256

                                                                                                              b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

                                                                                                              SHA512

                                                                                                              ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\content.js
                                                                                                              Filesize

                                                                                                              9KB

                                                                                                              MD5

                                                                                                              3d20584f7f6c8eac79e17cca4207fb79

                                                                                                              SHA1

                                                                                                              3c16dcc27ae52431c8cdd92fbaab0341524d3092

                                                                                                              SHA256

                                                                                                              0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643

                                                                                                              SHA512

                                                                                                              315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                                                                              Filesize

                                                                                                              107KB

                                                                                                              MD5

                                                                                                              40e2018187b61af5be8caf035fb72882

                                                                                                              SHA1

                                                                                                              72a0b7bcb454b6b727bf90da35879b3e9a70621e

                                                                                                              SHA256

                                                                                                              b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

                                                                                                              SHA512

                                                                                                              a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                              Filesize

                                                                                                              3KB

                                                                                                              MD5

                                                                                                              e33499d1598b0a84c830f0e34da496a2

                                                                                                              SHA1

                                                                                                              317172f2fc4b74a19cd84d362d2af7cdad35719a

                                                                                                              SHA256

                                                                                                              f641b372b4b45fd8a59f9a09609a76b83dd077fe4e321b83a9ae7bdb1ed1ce97

                                                                                                              SHA512

                                                                                                              5981866489796b67dac7fd1170ad417a747c321fbfdea1c3d2f4635a20e4d84a18e0d0c0730227264eaf645aefb093568c8f9bbcb63e3e52bf6af011abfce637

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                              Filesize

                                                                                                              3KB

                                                                                                              MD5

                                                                                                              26dce426ff3b0ad86cbee000a64f97c7

                                                                                                              SHA1

                                                                                                              91856c201c2b18ea19addbddbd4a8371f8b9f8bd

                                                                                                              SHA256

                                                                                                              e6f1af0e3a2272a351e75914715c5b3205929279707a1565e7044b5a1f8cfb9a

                                                                                                              SHA512

                                                                                                              7703305bd4a8770ed1f08c0ac22dcb72381a3ff73152313800af94edfb85d71adaa88caf5f678a721af83e75f47e8a9bef5b303d7121454e38e7150deb9d5fdf

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                              Filesize

                                                                                                              3KB

                                                                                                              MD5

                                                                                                              34e28c3a72dc553b2153cf753c4feccd

                                                                                                              SHA1

                                                                                                              958377e2da2ae6dc6f54160bd6dbf0f0b7f876f9

                                                                                                              SHA256

                                                                                                              6b3ce6eb4efcd0de2f00a4c9b678c22ac5e5bf8260a0466aa0210fe992d5e880

                                                                                                              SHA512

                                                                                                              b514ff4a5e49d5d8c3abbbc86fa62d4918fb57c8f20498447cbe1e817dd50b3d4b9cacfe4cfbaa1dcacf941a79e7026dfdf4f3cf9528eb09e9e5336352d1e2c5

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                              Filesize

                                                                                                              111B

                                                                                                              MD5

                                                                                                              285252a2f6327d41eab203dc2f402c67

                                                                                                              SHA1

                                                                                                              acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                                                              SHA256

                                                                                                              5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                                                              SHA512

                                                                                                              11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                              Filesize

                                                                                                              2B

                                                                                                              MD5

                                                                                                              d751713988987e9331980363e24189ce

                                                                                                              SHA1

                                                                                                              97d170e1550eee4afc0af065b78cda302a97674c

                                                                                                              SHA256

                                                                                                              4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                                                              SHA512

                                                                                                              b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                              Filesize

                                                                                                              15KB

                                                                                                              MD5

                                                                                                              4c343e3dc942de470d007bfbf46e9a99

                                                                                                              SHA1

                                                                                                              167db05d7e3360f5f6a4c89a2f1719c5f7e3ea4a

                                                                                                              SHA256

                                                                                                              3afff33d4dea1529cc47065cd09db5cb9d1a1178adf8a6b09674f1a49a4f0fa9

                                                                                                              SHA512

                                                                                                              30c0372902170e61fb8cc209ffb533779ee693332032445882ebfa5f124a66f58e8eec5eee5650c73b8a31a3e3c3c4fe92e46f7a8f16e0957c3b5f492e32c497

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                              Filesize

                                                                                                              14KB

                                                                                                              MD5

                                                                                                              8b7713a05c532c1f8ee56142360e0871

                                                                                                              SHA1

                                                                                                              750a6fd8b55272a1e593f04392a5b1fa14f4febe

                                                                                                              SHA256

                                                                                                              200acf0bf6783e28e42b464102a29b970babe979b209b982eb1c5bba748148fe

                                                                                                              SHA512

                                                                                                              f43801dcc5a70a0a797134d26eeab9d6b5164f1100e4e98153c2ae99e7335c0ba46016c17c0013b223bc1b50b97672500bdba7b5d7665ef5928d918fd2b335d3

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                              Filesize

                                                                                                              15KB

                                                                                                              MD5

                                                                                                              00a9757e958e72ba3e6cfa14fd6aface

                                                                                                              SHA1

                                                                                                              5c33c879424528b649e12caf853684a84697e813

                                                                                                              SHA256

                                                                                                              faf77e0037fd0a3bd37c5c1efcda5f17d950ce9c8c211533062542856a4ad65e

                                                                                                              SHA512

                                                                                                              aa4ffde11d929c0702f9f9838c6b7da6355c1ea61f40fc74217651a3aafb57846e51b69a5dcb65f894f24b98f025a5d18f98e761b68db6a4f12b2d53177215ec

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                              Filesize

                                                                                                              37KB

                                                                                                              MD5

                                                                                                              e17e64aff269c280224e3a9524cc19fe

                                                                                                              SHA1

                                                                                                              fde908420c5b85f6804bd942a382cb0de70e590d

                                                                                                              SHA256

                                                                                                              7806eae65d759693bf01c9eb0056350ecef3b32a91503761d83f9b9155cb1a7d

                                                                                                              SHA512

                                                                                                              c8d75ec2f8723010908a9ea25e101f5d2d2cd10c2e557ac4c999132b90e5e884ee81ebfe31ccd4cbf0957b95614ae6011b19bd26a35896b7f6fa3388316b1428

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                                              Filesize

                                                                                                              253B

                                                                                                              MD5

                                                                                                              f0cddb122e53d00fda14c825bda3adb1

                                                                                                              SHA1

                                                                                                              b3bdcdade792626799f852c72a9cef921215bb5c

                                                                                                              SHA256

                                                                                                              f476b360155f9447a33da4e4d340588f45ba3aab5470e2f676768122054c8e70

                                                                                                              SHA512

                                                                                                              d438ff9e6007c45d0c4644998ee12804fd17b13c6221738e5457b07ef7ec508257693a4bf52ec48db855b01a565c88cbe146e0be3dd9f7da364125105630991d

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                              Filesize

                                                                                                              4KB

                                                                                                              MD5

                                                                                                              411bfa6f981cd219944c58ab4a90e079

                                                                                                              SHA1

                                                                                                              132fb3a5d3da67694c2806e70df8cefe1f253dce

                                                                                                              SHA256

                                                                                                              f66c3e45188a1361ab721703676e48e67196258a85a36d516f23db9a810b0e31

                                                                                                              SHA512

                                                                                                              c7d75c432be9df4804b11a12d3acad67907e2adb10844eed68fc3659157994bf19c20d092fa1f6c54bc7572663ad525ca5fd8ae2932e2a0f69c467708f504014

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.3.10\data.txt
                                                                                                              Filesize

                                                                                                              113KB

                                                                                                              MD5

                                                                                                              60beb7140ed66301648ef420cbaad02d

                                                                                                              SHA1

                                                                                                              7fac669b6758bb7b8e96e92a53569cf4360ab1aa

                                                                                                              SHA256

                                                                                                              95276c09f44b28100c0a21c161766eda784a983f019fc471290b1381e7ed9985

                                                                                                              SHA512

                                                                                                              6dfa4eca42aea86fba18bc4a3ab0eed87948ea1831e33d43426b3aca1816070ecb7fd024856ad571ca2734214a98cc55e413502b3deef2c4a101228a7377e9d5

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1abbc2e9-d5e9-4fbf-807c-56a56413e5e8.tmp
                                                                                                              Filesize

                                                                                                              22KB

                                                                                                              MD5

                                                                                                              06592b86d8ab6309c77426804f7b590e

                                                                                                              SHA1

                                                                                                              d63f876ab8d1dcbd92e052769cbf13f9a983534f

                                                                                                              SHA256

                                                                                                              43920eeafa84fd526a2e7c9bbe5de63b5306fdc17595bbc4e8ad1370f53d225d

                                                                                                              SHA512

                                                                                                              f2e4e7e937cdb486fa9d524b46d3a97a02624e4f612325da590fbc46ad337e063b771c8370cd389e581f1b16450c410850bf1979a46a118ded4a491fddb56ffa

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\39e16889-67c5-4f9f-8f92-1c8f9fd4c955.tmp
                                                                                                              Filesize

                                                                                                              23KB

                                                                                                              MD5

                                                                                                              055a3d5b30e8f9ebf5c701cde52760f0

                                                                                                              SHA1

                                                                                                              fb1b6400e04095dfbd4904b21a3cea1932dd7ccc

                                                                                                              SHA256

                                                                                                              1d36fe6e6a6447af3d0169d0ff4e727fbf76e5e0306a53c9200dc4f09c11d324

                                                                                                              SHA512

                                                                                                              796c4db7c92351eb083915324ab2dfb8327f9a9a3310f5bcfa4e9cccb8c295e23fb9d0b61cbda66f02c514cb44140c6828ba7d63d1ac389ff334e2f3125a4904

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
                                                                                                              Filesize

                                                                                                              878B

                                                                                                              MD5

                                                                                                              b1f5129d4562ccae8ddcac77ad6b8b1f

                                                                                                              SHA1

                                                                                                              cf7213819224e2dc7a77cce9c60049d5d25f3fa7

                                                                                                              SHA256

                                                                                                              8f5722199ad1fc5dcd52a89908538a87209e89522ec53d4a6e4a5910e8e9b81f

                                                                                                              SHA512

                                                                                                              cff64a1fa7ea3a481429d5840dc98c5f0265e9ef585f8f4b12e74ea58fb2c69fa849bf74ed06e3f018dac577d606c820b931adfe81e9afe677896b0db3283874

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog~RFe588ce9.TMP
                                                                                                              Filesize

                                                                                                              469B

                                                                                                              MD5

                                                                                                              14bc68d46a441adb83758e8e53306f18

                                                                                                              SHA1

                                                                                                              dd20bca4b420eaf20919c0f469e44fc11f875c27

                                                                                                              SHA256

                                                                                                              752233d1c47285b914683922a0e936e67d98a0b64505f4145c173345e3f521fd

                                                                                                              SHA512

                                                                                                              db90316960a3ac4a4e014d1217062da96edd2ddb404308d9e5e3be925afb39162665b59c7c439e571d4d67e7c3949ba65f763e03126e6d7ceb54761448bf34e0

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json
                                                                                                              Filesize

                                                                                                              3KB

                                                                                                              MD5

                                                                                                              94406cdd51b55c0f006cfea05745effb

                                                                                                              SHA1

                                                                                                              a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9

                                                                                                              SHA256

                                                                                                              8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e

                                                                                                              SHA512

                                                                                                              d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                              Filesize

                                                                                                              39KB

                                                                                                              MD5

                                                                                                              a5979e96d03762ab79405e2179f75b29

                                                                                                              SHA1

                                                                                                              a4b5a66f15d357d8bf5c40b72a84bc2e5f5e4eae

                                                                                                              SHA256

                                                                                                              497ca6a9698549dffebdef88a0d40703b1ac13fb17114b7faf9d44fdef90acdc

                                                                                                              SHA512

                                                                                                              c29c1fe68f274219f4afb35a8393693d7f0a786f879a91c94770f49653d74637affc39e65cb271b2a1494890f077ea829c67a34eb614f607fde4be9ba3a6515a

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                              Filesize

                                                                                                              30KB

                                                                                                              MD5

                                                                                                              c2a81dac65f3dadcc2983d177b314a7a

                                                                                                              SHA1

                                                                                                              c6faf75bd456e6ead4441065b0018aca05594f3d

                                                                                                              SHA256

                                                                                                              033342d3455bcd8611c379332e55d87b4765469caa3ff2811085781689423262

                                                                                                              SHA512

                                                                                                              1f272dce809c8b9fca7f38858bbbb8a9519aed808877da3f02da8efb14e883ba415562660e8770c6724e22306892f3bb85ff5b9829272c59fa79c29d2a4a61ee

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                              Filesize

                                                                                                              6KB

                                                                                                              MD5

                                                                                                              6770c5bfaaa6a23aead778b7c0dbc48c

                                                                                                              SHA1

                                                                                                              7f3eb03e54c1c79ad314131e47a8bfeea41abb84

                                                                                                              SHA256

                                                                                                              68dc946628d923f82d63d5d382a41f313ca4132b05ac6195c7fadf0417bce8d3

                                                                                                              SHA512

                                                                                                              4c3beacf6b42e8274c72951db1d8e58766abad5bced99e27b3aa8096e6ef0e72df1e8a72c0d66d9f06349a2e560b93020651e62bd2eefcda04291d1025cfcc21

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                              Filesize

                                                                                                              30KB

                                                                                                              MD5

                                                                                                              03dd2af2d7c8a54d1573178365f99ae0

                                                                                                              SHA1

                                                                                                              b9caf5ed578a0636df721d7f9e5e1f72ce6a830a

                                                                                                              SHA256

                                                                                                              007a6b8746bfcbcbe14892d591b6446d702ad9d661ad5450a2d6223898738fcc

                                                                                                              SHA512

                                                                                                              b148b594c9d3bf5a4378cc9fd9d1e00fdbaaae0dd83d5ae8bcdb4ecf0db39b83be5070ea9d4a26b89cdbb7fa690c92cfaba55a00d9540cf8ad32392fe9ab964a

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                              Filesize

                                                                                                              7KB

                                                                                                              MD5

                                                                                                              a2889673f38579b656a339481816f2d7

                                                                                                              SHA1

                                                                                                              7aa52d0bb0a1ae1d9138ddf976aa2179aa01df72

                                                                                                              SHA256

                                                                                                              478e4473a0f34a1d53d76afb933f62a98fb0c3ee5c0fcf717038dc87b3840fef

                                                                                                              SHA512

                                                                                                              4798e0fcb4946c6e68ec0ad39e3698fc49a7f42e31785c00a6a18456132f889874d4926a76cd9437be752b2f3ca249b2723538ed3141d49ccd6cd0cbfcdc0a28

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\safety_tips.pb
                                                                                                              Filesize

                                                                                                              163KB

                                                                                                              MD5

                                                                                                              bd6846ffa7f4cf897b5323e4a5dcd551

                                                                                                              SHA1

                                                                                                              a6596cdc8de199492791faa39ce6096cf39295cd

                                                                                                              SHA256

                                                                                                              854b7eb22303ec3c920966732bc29f58140a82e1101dffe2702252af0f185666

                                                                                                              SHA512

                                                                                                              aa19b278f7211ffaf16b14b59d509ce6b80708e2bb5af87d98848747de4cba13b6626135dd3ec7aabd51b4c2cfb46ed96800a520d2dae8af8105054b6cd40e0b

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\typosquatting_list.pb
                                                                                                              Filesize

                                                                                                              3KB

                                                                                                              MD5

                                                                                                              17c10dbe88d84b9309e6d151923ce116

                                                                                                              SHA1

                                                                                                              9ad2553c061ddcc07e6f66ce4f9e30290c056bdf

                                                                                                              SHA256

                                                                                                              3ad368c74c9bb5da4d4750866f16d361b0675a6b6dc4e06e2edd72488663450e

                                                                                                              SHA512

                                                                                                              ad8ed3797941c9cad21ae2af03b77ce06a23931d9c059fe880935e2b07c08f85fc628e39873fb352c07714b4e44328799b264f4adb3513975add4e6b67e4a63c

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\keys.json
                                                                                                              Filesize

                                                                                                              6KB

                                                                                                              MD5

                                                                                                              bef4f9f856321c6dccb47a61f605e823

                                                                                                              SHA1

                                                                                                              8e60af5b17ed70db0505d7e1647a8bc9f7612939

                                                                                                              SHA256

                                                                                                              fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

                                                                                                              SHA512

                                                                                                              bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\077270c1-8f4c-4913-b43e-355fff72d878.down_data
                                                                                                              Filesize

                                                                                                              555KB

                                                                                                              MD5

                                                                                                              5683c0028832cae4ef93ca39c8ac5029

                                                                                                              SHA1

                                                                                                              248755e4e1db552e0b6f8651b04ca6d1b31a86fb

                                                                                                              SHA256

                                                                                                              855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

                                                                                                              SHA512

                                                                                                              aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\4KB3B3WG\www.bing[1].xml
                                                                                                              Filesize

                                                                                                              17KB

                                                                                                              MD5

                                                                                                              0d7e08310c86c78c788f971383338266

                                                                                                              SHA1

                                                                                                              41408cdcee68768795f6d3104580e65775ceded2

                                                                                                              SHA256

                                                                                                              837ad4ead82328502bf1d4689a2bbb2ecc46135bc4589523021286489cda367e

                                                                                                              SHA512

                                                                                                              72ca19e8d0ba442b0645aa33dbea30396c98ad6fb58da7dbf2a5ccac313722fb051db05a700a03b916776d9a617f9c371ee776f946585715f043c20fb7a0f4d9

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zOCCE35659\RubixLauncher.exe
                                                                                                              Filesize

                                                                                                              355KB

                                                                                                              MD5

                                                                                                              8a6f1580a5b9b94d7cd47cc6b1af1b9a

                                                                                                              SHA1

                                                                                                              e68768afd59e18091d345cb300e859572e8d4c5c

                                                                                                              SHA256

                                                                                                              bb1464e75c750d90c0c49d148c9e64eefe0c29b2f670d708c8085ddd3104dbfe

                                                                                                              SHA512

                                                                                                              1663a9e0868b3f5d7e1edd30259024e419c2d190ec8c31e76e66aef0c8a0e02da0c829584214b9e2f76cbd349a53bf77d01d03e9b0e9c8a99eb18021b1d53309

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zOCCE35659\RubixLauncher.exe:Zone.Identifier
                                                                                                              Filesize

                                                                                                              88B

                                                                                                              MD5

                                                                                                              3c41410c4fd694c8ba99ecec4c6eff11

                                                                                                              SHA1

                                                                                                              2b676e157e187af40d7d127ef810283e290cf96c

                                                                                                              SHA256

                                                                                                              9a854108a2e693f3dd049bbe3c7bae7a4894eed071c285783cbe3962550395dc

                                                                                                              SHA512

                                                                                                              365a9840e3e514a5a5998590dd73b418d3609a88db56a25bb04fed632040cc3f73e6aa9f96b9e98a7d1508b1b6a9c72147b143f1d2cac2bcf1ce3371bec815f3

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a2d53300-8cf1-460a-a242-f108fb0b3203.tmp
                                                                                                              Filesize

                                                                                                              10KB

                                                                                                              MD5

                                                                                                              78e47dda17341bed7be45dccfd89ac87

                                                                                                              SHA1

                                                                                                              1afde30e46997452d11e4a2adbbf35cce7a1404f

                                                                                                              SHA256

                                                                                                              67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550

                                                                                                              SHA512

                                                                                                              9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Temp\eeb7c9ae-269c-418c-8c6d-1527f478e381.tmp
                                                                                                              Filesize

                                                                                                              1B

                                                                                                              MD5

                                                                                                              5058f1af8388633f609cadb75a75dc9d

                                                                                                              SHA1

                                                                                                              3a52ce780950d4d969792a2559cd519d7ee8c727

                                                                                                              SHA256

                                                                                                              cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

                                                                                                              SHA512

                                                                                                              0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Temp\scoped_dir4144_837745101\a69350ad-7b49-4d91-8328-64134166c437.tmp
                                                                                                              Filesize

                                                                                                              152KB

                                                                                                              MD5

                                                                                                              dd9bf8448d3ddcfd067967f01e8bf6d7

                                                                                                              SHA1

                                                                                                              d7829475b2bd6a3baa8fabfaf39af57c6439b35e

                                                                                                              SHA256

                                                                                                              fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

                                                                                                              SHA512

                                                                                                              65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\Downloads\SKRIPTGG-FIVEM-main.zip.crdownload
                                                                                                              Filesize

                                                                                                              884KB

                                                                                                              MD5

                                                                                                              e5eb6a37e9cd8d4cd3d3a1879cc71bc0

                                                                                                              SHA1

                                                                                                              44936b7f945d8d8813e64f9b5708059d9714fcdf

                                                                                                              SHA256

                                                                                                              90c7d3b939db02faf27a670beedb61ffaf33a940119484a1b62dbfe21656afdd

                                                                                                              SHA512

                                                                                                              02eb80e5dff1551268abd6d366e36f88f8a940ceb2a4242b677a8823b51217e8fa8548d4abbd3c80ef9a112a2741cf75b09000ceb0da2cfe24df5303865c7cfd

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\Downloads\SKRIPTGG-FIVEM-main.zip:Zone.Identifier
                                                                                                              Filesize

                                                                                                              26B

                                                                                                              MD5

                                                                                                              fbccf14d504b7b2dbcb5a5bda75bd93b

                                                                                                              SHA1

                                                                                                              d59fc84cdd5217c6cf74785703655f78da6b582b

                                                                                                              SHA256

                                                                                                              eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

                                                                                                              SHA512

                                                                                                              aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

                                                                                                              Download Submit

                                                                                                            • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4144_1192251507\manifest.json
                                                                                                              Filesize

                                                                                                              238B

                                                                                                              MD5

                                                                                                              15b69964f6f79654cbf54953aad0513f

                                                                                                              SHA1

                                                                                                              013fb9737790b034195cdeddaa620049484c53a7

                                                                                                              SHA256

                                                                                                              1bdda4a8fc3e2b965fbb52c9b23a9a34871bc345abfb332a87ea878f4472efbd

                                                                                                              SHA512

                                                                                                              7eeee58e06bba59b1ef874436035202416079617b7953593abf6d9af42a55088ab37f45fdee394166344f0186c0cb7092f55ed201c213737bb5d5318e9f47908

                                                                                                              Download Submit

                                                                                                            • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4144_1358598824\manifest.json
                                                                                                              Filesize

                                                                                                              160B

                                                                                                              MD5

                                                                                                              a24a1941bbb8d90784f5ef76712002f5

                                                                                                              SHA1

                                                                                                              5c2b6323c7ed8913b5d0d65a4d21062c96df24eb

                                                                                                              SHA256

                                                                                                              2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747

                                                                                                              SHA512

                                                                                                              fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2

                                                                                                              Download Submit

                                                                                                            • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4144_1749137969\manifest.json
                                                                                                              Filesize

                                                                                                              135B

                                                                                                              MD5

                                                                                                              4055ba4ebd5546fb6306d6a3151a236a

                                                                                                              SHA1

                                                                                                              609a989f14f8ee9ed9bffbd6ddba3214fd0d0109

                                                                                                              SHA256

                                                                                                              cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5

                                                                                                              SHA512

                                                                                                              58d39f7ae0dafd067c6dba34c686506c1718112ad5af8a255eb9a7d6ec0edca318b557565f5914c5140eb9d1b6e2ffbb08c9d596f43e7a79fdb4ef95457bf29a

                                                                                                              Download Submit

                                                                                                            • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4144_2005066734\manifest.json
                                                                                                              Filesize

                                                                                                              85B

                                                                                                              MD5

                                                                                                              c3419069a1c30140b77045aba38f12cf

                                                                                                              SHA1

                                                                                                              11920f0c1e55cadc7d2893d1eebb268b3459762a

                                                                                                              SHA256

                                                                                                              db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

                                                                                                              SHA512

                                                                                                              c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

                                                                                                              Download Submit

                                                                                                            • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4144_2011413087\manifest.json
                                                                                                              Filesize

                                                                                                              176B

                                                                                                              MD5

                                                                                                              6607494855f7b5c0348eecd49ef7ce46

                                                                                                              SHA1

                                                                                                              2c844dd9ea648efec08776757bc376b5a6f9eb71

                                                                                                              SHA256

                                                                                                              37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd

                                                                                                              SHA512

                                                                                                              8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a

                                                                                                              Download Submit

                                                                                                            • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4144_2028142696\manifest.json
                                                                                                              Filesize

                                                                                                              72B

                                                                                                              MD5

                                                                                                              a30b19bb414d78fff00fc7855d6ed5fd

                                                                                                              SHA1

                                                                                                              2a6408f2829e964c578751bf29ec4f702412c11e

                                                                                                              SHA256

                                                                                                              9811cd3e1fbf80feb6a52ad2141fc1096165a100c2d5846dd48f9ed612c6fc9f

                                                                                                              SHA512

                                                                                                              66b6db60e9e6f3059d1a47db14f05d35587aa2019bc06e6cf352dfbb237d9dfe6dce7cb21c9127320a7fdca5b9d3eb21e799abe6a926ae51b5f62cf646c30490

                                                                                                              Download Submit

                                                                                                            • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4144_587321837\LICENSE
                                                                                                              Filesize

                                                                                                              1KB

                                                                                                              MD5

                                                                                                              ee002cb9e51bb8dfa89640a406a1090a

                                                                                                              SHA1

                                                                                                              49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

                                                                                                              SHA256

                                                                                                              3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

                                                                                                              SHA512

                                                                                                              d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

                                                                                                              Download Submit

                                                                                                            • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4144_587321837\manifest.json
                                                                                                              Filesize

                                                                                                              79B

                                                                                                              MD5

                                                                                                              7f4b594a35d631af0e37fea02df71e72

                                                                                                              SHA1

                                                                                                              f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

                                                                                                              SHA256

                                                                                                              530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

                                                                                                              SHA512

                                                                                                              bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

                                                                                                              Download Submit

                                                                                                            • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4144_784280693\manifest.json
                                                                                                              Filesize

                                                                                                              53B

                                                                                                              MD5

                                                                                                              22b68a088a69906d96dc6d47246880d2

                                                                                                              SHA1

                                                                                                              06491f3fd9c4903ac64980f8d655b79082545f82

                                                                                                              SHA256

                                                                                                              94be212fe6bcf42d4b13fabd22da97d6a7ef8fdf28739989aba90a7cf181ac88

                                                                                                              SHA512

                                                                                                              8c755fdc617fa3a196e048e222a2562622f43362b8ef60c047e540e997153a446a448e55e062b14ed4d0adce7230df643a1bd0b06a702dc1e6f78e2553aadfff

                                                                                                              Download Submit

                                                                                                            • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4144_821381062\manifest.json
                                                                                                              Filesize

                                                                                                              43B

                                                                                                              MD5

                                                                                                              af3a9104ca46f35bb5f6123d89c25966

                                                                                                              SHA1

                                                                                                              1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8

                                                                                                              SHA256

                                                                                                              81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea

                                                                                                              SHA512

                                                                                                              6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1

                                                                                                              Download Submit

                                                                                                            • memory/2584-1379-0x000002B178600000-0x000002B178620000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/2584-1422-0x000002B178EF0000-0x000002B178F10000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/2584-1501-0x000002B178AD0000-0x000002B178BD0000-memory.dmp

                                                                                                              Filesize

                                                                                                              1024KB

                                                                                                              Download

                                                                                                            • memory/2584-1505-0x000002B17A070000-0x000002B17A090000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/2584-1519-0x000002B17CC30000-0x000002B17CD30000-memory.dmp

                                                                                                              Filesize

                                                                                                              1024KB

                                                                                                              Download

                                                                                                            • memory/2584-1523-0x000002B17CC30000-0x000002B17CD30000-memory.dmp

                                                                                                              Filesize

                                                                                                              1024KB

                                                                                                              Download

                                                                                                            • memory/2584-1423-0x000002B179230000-0x000002B179330000-memory.dmp

                                                                                                              Filesize

                                                                                                              1024KB

                                                                                                              Download

                                                                                                            • memory/2584-1424-0x000002B177DB0000-0x000002B177DD0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/2584-1361-0x000002B176000000-0x000002B176100000-memory.dmp

                                                                                                              Filesize

                                                                                                              1024KB

                                                                                                              Download

                                                                                                            • memory/5836-1091-0x00007FFCF4EE0000-0x00007FFCF50E9000-memory.dmp

                                                                                                              Filesize

                                                                                                              2.0MB

                                                                                                              Download

                                                                                                            • memory/5836-1087-0x0000000000480000-0x00000000004ED000-memory.dmp

                                                                                                              Filesize

                                                                                                              436KB

                                                                                                              Download

                                                                                                            • memory/5836-1089-0x0000000003FE0000-0x00000000043E0000-memory.dmp

                                                                                                              Filesize

                                                                                                              4.0MB

                                                                                                              Download

                                                                                                            • memory/5836-1095-0x0000000000480000-0x00000000004ED000-memory.dmp

                                                                                                              Filesize

                                                                                                              436KB

                                                                                                              Download

                                                                                                            • memory/5836-1090-0x0000000003FE0000-0x00000000043E0000-memory.dmp

                                                                                                              Filesize

                                                                                                              4.0MB

                                                                                                              Download

                                                                                                            • memory/5836-1093-0x0000000075FF0000-0x0000000076242000-memory.dmp

                                                                                                              Filesize

                                                                                                              2.3MB

                                                                                                              Download

                                                                                                            • memory/5896-1098-0x00007FFCF4EE0000-0x00007FFCF50E9000-memory.dmp

                                                                                                              Filesize

                                                                                                              2.0MB

                                                                                                              Download

                                                                                                            • memory/5896-1094-0x0000000000AE0000-0x0000000000AE9000-memory.dmp

                                                                                                              Filesize

                                                                                                              36KB

                                                                                                              Download

                                                                                                            • memory/5896-1097-0x0000000002700000-0x0000000002B00000-memory.dmp

                                                                                                              Filesize

                                                                                                              4.0MB

                                                                                                              Download

                                                                                                            • memory/5896-1100-0x0000000075FF0000-0x0000000076242000-memory.dmp

                                                                                                              Filesize

                                                                                                              2.3MB

                                                                                                              Download