hxxps://cdn[.]discordapp[.]com/attachments/1477074502696566794/1550536288468205620/fivemdumper[.]zip?ex=6ab7eb72&is=6ab699f2&hm=d5a67b787c63128146cc3e829bed9c50eb06f4f41e89f8bb772a9478ce717d79&

Analysis

user interaction
yes
max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1477074502696566794/1550536288468205620/fivemdumper.zip?ex=6ab7eb72&is=6ab699f2&hm=d5a67b787c63128146cc3e829bed9c50eb06f4f41e89f8bb772a9478ce717d79&
Sample260925-va4jca1ema

Score

5^/10

discovery execution

Malware Config

Signatures

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5628	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5864	cmd.exe
3328	cmd.exe
4136	cmd.exe
5312	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fivem_offset_dumper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fivem_offset_dumper.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3900	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{5FB31328-5BD0-480B-81A0-80FDCC098B8D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5992	msedge.exe
5992	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5628	tasklist.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 3220	2632	msedge.exe	86
PID 2632 wrote to memory of 3900	2632	msedge.exe	87
PID 2632 wrote to memory of 3820	2632	msedge.exe	88
PID 2632 wrote to memory of 3820	2632	msedge.exe	88
PID 2632 wrote to memory of 3820	2632	msedge.exe	88
PID 2632 wrote to memory of 2400	2632	msedge.exe	89
PID 2632 wrote to memory of 2400	2632	msedge.exe	89
PID 2632 wrote to memory of 2160	2632	msedge.exe	90
PID 2632 wrote to memory of 4420	2632	msedge.exe	91
PID 2632 wrote to memory of 2160	2632	msedge.exe	90
PID 2632 wrote to memory of 2160	2632	msedge.exe	90
PID 2632 wrote to memory of 4420	2632	msedge.exe	91
PID 2632 wrote to memory of 4420	2632	msedge.exe	91
PID 2632 wrote to memory of 4376	2632	msedge.exe	93
PID 2632 wrote to memory of 4376	2632	msedge.exe	93
PID 2632 wrote to memory of 4376	2632	msedge.exe	93
PID 2632 wrote to memory of 2248	2632	msedge.exe	94
PID 2632 wrote to memory of 2248	2632	msedge.exe	94
PID 2632 wrote to memory of 2248	2632	msedge.exe	94
PID 2632 wrote to memory of 4552	2632	msedge.exe	98
PID 2632 wrote to memory of 4824	2632	msedge.exe	99
PID 2632 wrote to memory of 4552	2632	msedge.exe	98
PID 2632 wrote to memory of 4824	2632	msedge.exe	99
PID 2632 wrote to memory of 4284	2632	msedge.exe	100
PID 2632 wrote to memory of 4284	2632	msedge.exe	100
PID 2632 wrote to memory of 1324	2632	msedge.exe	101
PID 2632 wrote to memory of 1324	2632	msedge.exe	101
PID 2632 wrote to memory of 1324	2632	msedge.exe	101
PID 2632 wrote to memory of 4448	2632	msedge.exe	102
PID 2632 wrote to memory of 3936	2632	msedge.exe	106
PID 2632 wrote to memory of 6076	2632	msedge.exe	124
PID 2632 wrote to memory of 6084	2632	msedge.exe	125
PID 2632 wrote to memory of 6092	2632	msedge.exe	126
PID 4136 wrote to memory of 5832	4136	cmd.exe	138
PID 2632 wrote to memory of 6076	2632	msedge.exe	139
PID 2632 wrote to memory of 6076	2632	msedge.exe	139
PID 2632 wrote to memory of 4360	2632	msedge.exe	140
PID 2632 wrote to memory of 4360	2632	msedge.exe	140
PID 5312 wrote to memory of 5628	5312	cmd.exe	145
PID 5312 wrote to memory of 5692	5312	cmd.exe	146
PID 2632 wrote to memory of 5992	2632	msedge.exe	150

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1477074502696566794/1550536288468205620/fivemdumper.zip?ex=6ab7eb72&is=6ab699f2&hm=d5a67b787c63128146cc3e829bed9c50eb06f4f41e89f8bb772a9478ce717d79&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ff9418dc188,0x7ff9418dc194,0x7ff9418dc1a0
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,15168538131624018438,4880839892142365568,524288 --field-trial-handle=2264,i,6783982469925281896,14248923943633204110,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,10350499773286489184,5375572658245106716,262144 --field-trial-handle=2264,i,6783982469925281896,14248923943633204110,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,6867385822351913056,7813211101961566511,524288 --field-trial-handle=2264,i,6783982469925281896,14248923943633204110,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,18133547233676382060,2612380899593523540,2097152 --field-trial-handle=2264,i,6783982469925281896,14248923943633204110,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,18397266241072275147,17944352354356655291,2097152 --field-trial-handle=2264,i,6783982469925281896,14248923943633204110,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,5899261966579767977,6011505950710598370,2097152 --field-trial-handle=2264,i,6783982469925281896,14248923943633204110,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,12343905240145942130,11588479057388920329,2097152 --field-trial-handle=2264,i,6783982469925281896,14248923943633204110,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,15528536943501914970,18364259231445736305,524288 --field-trial-handle=2264,i,6783982469925281896,14248923943633204110,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,11155546701543314369,4845430311599538041,524288 --field-trial-handle=2264,i,6783982469925281896,14248923943633204110,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,1663101891399935065,6674764061089945413,524288 --field-trial-handle=2264,i,6783982469925281896,14248923943633204110,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5708,i,7263142447125854684,9322646801501835531,2097152 --field-trial-handle=2264,i,6783982469925281896,14248923943633204110,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,12124539287864787371,10269662635092916963,524288 --field-trial-handle=2264,i,6783982469925281896,14248923943633204110,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,2570717744452182962,1175005276307601089,524288 --field-trial-handle=2264,i,6783982469925281896,14248923943633204110,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:8
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,2570717744452182962,1175005276307601089,524288 --field-trial-handle=2264,i,6783982469925281896,14248923943633204110,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:8
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,17069833740280904994,5615621474034455137,524288 --field-trial-handle=2264,i,6783982469925281896,14248923943633204110,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:8
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4104,i,6673869236081158265,14262384552501194999,524288 --field-trial-handle=2264,i,6783982469925281896,14248923943633204110,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:8
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1656,i,808224993339088603,1782374622167817590,524288 --field-trial-handle=2264,i,6783982469925281896,14248923943633204110,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:8
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,1058443332622758486,17393738485720283361,524288 --field-trial-handle=2264,i,6783982469925281896,14248923943633204110,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,5709844653989338736,11224609098149185626,524288 --field-trial-handle=2264,i,6783982469925281896,14248923943633204110,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:8
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=748,i,4340405706382513416,14585667452979383589,262144 --field-trial-handle=2264,i,6783982469925281896,14248923943633204110,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5992

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4644

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4592

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\fivem-offset-dumper-main\build.bat" "
1⤵
- Executes a command shell one-liner
PID:5864

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\fivem-offset-dumper-main\compile.bat" "
1⤵
- Executes a command shell one-liner
PID:3328

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\fivem-offset-dumper-main\run.bat" "
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Users\Admin\Desktop\fivem-offset-dumper-main\fivem_offset_dumper.exe
  fivem_offset_dumper.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5832

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\fivem-offset-dumper-main\test.bat" "
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5312
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq FiveM*"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5628
- C:\Windows\system32\find.exe
  find /I /N "FiveM"
  2⤵
  PID:5692

C:\Users\Admin\Desktop\fivem-offset-dumper-main\fivem_offset_dumper.exe
"C:\Users\Admin\Desktop\fivem-offset-dumper-main\fivem_offset_dumper.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1d24032e322bda4aa4f943eeee5c1be2eee903b8fa00c6e40c3ae3aab1d6e57
MD5 cf18b86051311e5d4cb3435637b32441
SHA1 81808c10d3ea99d837ac73ca978bbac4af2b14c3
SHA512 d8f6d4f7cc0a9a322acccdf645cd0eaf7d236c68d82f2fd25c2d01e1e6ce323c3d584edd204b1c68ced260f3cf67a5be22a62de64511401735df9213129ac8f0
TLSH
T1EFD02B02FE898A6CD4921C34012E811D36CDF40049027041C0B023974C04701102CC64
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7ba460c9f5a00478279781ba3317975fb747ea7519f30b24bac67a94df77c22d
MD5 be02dc26a22f37196d8a2ed1f90604b5
SHA1 0d4f49e0f6b152530b0ff133dac678914194c470
SHA512 74fcddf19d34dc2b1dc8ec59c0f57f326e68c7c9b62fb89494b07e2bd52522d6f7662a05f91a2d0787fba43ac2646fc3214bc591a45f14862aa715bcd9206f88
TLSH
T1EBD02B02FEC98E6CD8921C34012D811D36CDF4004902B142C0B023974C05741102CC64
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e4798ea2e0d25a45af7d10fb8c051dfaf72b4a75603340c4b17ebc487902c514
MD5 2315fffcabf7a60bf0e2c121aca5c29b
SHA1 0c7a19b238ed2730f6ddd3d6c415c869ecf6c94a
SHA512 c162d86e1a4686899f516e00e9160138e8c2269b9bf036eb8d89c81c4df7e4617ee67e2a4e5dc51f2d5fb95707968937989bfbb77f44f51b1bf3b670dbfe3e09
TLSH
T1125191B908AB6451D77EEF7093DD22ABF63097F177937D03A6AAC574A7373009145044
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f400.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f400.TMP
Size 3KB
SHA256 b9dbe9e42cf42a1cfb820bbe87b796312b077f3b44543978b305f2c81c2bedd5
MD5 48bcd6a5b850122b8c533e1891ad6c8e
SHA1 400f8a1aeaffc67ee887c1dccbff4954827380a8
SHA512 b30532a609c712f89db30801002e7dc93ab0ce52a1938d7ecad12fc09062df310b63d213465b70ee84bac3e5452c397d5eeafc2b675d67fd91627f5bfcb1fa2d
TLSH
T1D45192B908AB6451D77EEF7093DD22ABF63097F177937D03A6AAC574A7373009149044
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 bef29c58a893b9b4b139460f0fa44885acdf2bd4c662bde2efb778fcd0b7e896
MD5 3acbb08d5b2329f6ad72f4044468490a
SHA1 aa8c594c2be5ecf4c6e0e4570bd64dfa372c42d8
SHA512 6cbb6d778763905f290729efa7315cb5a9e27989622e09e0ba98716f74b6812b0cff1296f50955be27cf5f9220eadf5b75253c97adf44ee06b35c6eb9f233bd2
TLSH
T17A217BF7C3D5855EC90516F0AA24AE2BCE1D095542283C1BC9D4EF6BE7E3062E10195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 2eef9d807eba2fb1f4bd50872c0048a741349fdd084ca14727bbd3ef719a3210
MD5 01e371c7a0a01108d02b4705c35277f3
SHA1 ea69c72809ff0c2c34e689ea6a2dd46025fa4346
SHA512 45cd5999654cd7ad2579900d64cedb402c536a7b98143b8d5b59ee31920e8673ea9046b38a10cbb00d429f888d0bcd71bde2d52e3c7e19ca47483625d73ab63f
SSDEEP 192:sxZMBRtnH/fis05dIdpJHW6+WNGYYBRzULIgrJ:sxZMBPH/fis0YJHbGfG9
TLSH
T10812A5156E38A53B8CCBE20DBB65BF53E6F9503265D01E98EAFC861C05E66DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 45c55af1663bb5ef268e184dabba4bd0bab1bc77da8ef78510a5d480856cc7cc
MD5 837c2113805a78d5874e1a61f6f9931c
SHA1 02b0754dcd6bc66dd32ef15401a154c4448d8a23
SHA512 c1daf8720656c9e122b622d4003e8fa1a4a6ba8cac71eb221f411f9b11eb8565efdbd3fc02f1564c95c08a1c2e761374a78e28c5a746cadd0b9434fbf657a149
SSDEEP 192:sxZMBRt5H/fisU5dIdpLHW6+WNGYYB9zULIg5hJ:sxZMBBH/fisUYLHbGfqJ
TLSH
T17F22B616AE28657B8CCBE20DBB55BF53E6F9503265901E98EAFCC61C05E76CE120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 c5ed0a8e1e5e6e8a8f9efc05d6dd4d97c54a149726b48fdff322df750274bed7
MD5 6e2417b03987b1a82900972e63fdb228
SHA1 f12d5ec6d8527f6765761199a341963036e7d27f
SHA512 d6012c9dc5901169e2498e4a4ded78f48fa913675087f3ff6316a16ae155c3aa006798c283e54ef15e76e7b1a01275abaf0de6fb9d70a4a982154e19d17d2ec6
SSDEEP 192:sxZMBRt5H/fis95dIdpJHW6+WNGYYBRzULIg5TJ:sxZMBBH/fis9YJHbGfGX
TLSH
T12E22A615AE28A57B8CCBE20DBB55BF53E6F9503261D01E98EAFC861C05E76CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 7d5f7970968b4a85fe3d71aa522ff6f9de6a9f32708291e3da54f3fb01cd64f6
MD5 f45105e8e67dbc055ea0f081c147d92f
SHA1 0af713a0c4fa04dd2f41deec67cd07c31334521e
SHA512 626142fc7bf7ee0abb0a30f49ef9d0ba63295dfe04d0812dce2b1c4793ad55f16b916ba1dedcab234a7bc86958db157bfddbd321bf568391a3655c00db2c5e91
SSDEEP 192:sxZMBRt5H/fisU5dIdpJHW6+WNGYYB6zULIg5hJ:sxZMBBH/fisUYJHbGfBJ
TLSH
T1B522A515AE28657B8CCAE20DBB55BF53E6F9503265901E98AAFC871C05E76CE120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 8be5cfffcf0eafc5e11739cb1653ab3c14925554632953e514e5b952112c2918
MD5 daa9ff52665083cf8e03344aa97a3c91
SHA1 492fc4314e8f4751991e3255d952d290563a4c29
SHA512 c29b1fa0c4a7b1cc09366041c8196d3a551f9e26bf604d1d2ba07348553b0eb74d1fc993eb6ef74556adfcd951569b2d2364a391fabc377998ce5d6022099178
SSDEEP 768:DkyYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXYrop9SS:DkyYR7jWv3NpBu1ja/CL8OXjt
TLSH
T1D5C2E93F640DCB7E4FC01E9DDC5A6F9B2E9802C7A6548D4047FA954C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 5fb17ec9dbdcb62642985c23344008ca679810841a981fbc6c1540f04415dd6a
MD5 5654925b548010496e485b112e6b81ca
SHA1 d8c8e9b77cb66484c11121644caea24ff5c36c7d
SHA512 680eb54f859ac5809c63b8a31eda78cccb169c9ecfa86b315ff030ca5cb563273022c2a8484de64bca6331c498db251a99dc39d3ffbc69af1dd2b82ea55f39bd
SSDEEP 96:KAkgKdaOiKMK7KkCEKTqKOJqKiINAAK9+ig:mbf8nNJrg
TLSH
T106D1145132B7121138BD659886B58B1F128132773119FA3BBFBC11B59E7AE184CFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe598eb9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe598eb9.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 def23e34574ba76b0d654c4b8fc589f06b3c449dfa911bf68984e40b255e38d6
MD5 a52c31d58054243726fa5a496ff90d56
SHA1 4b35e798cc0f5282ec915f0a39e95cd04234927e
SHA512 de2ee74c37243f9336c30e91d7be89e8f855e92f3b8a115caa6179ae1c77bbd9e6eafbf34d3bdbec2952698ace1c4e9e36702f42c031d4b764d2a7eec5bdd290
SSDEEP 384:gZcIEsNg8TiBbmSQX5+DtH80gXmeDSMtgOIwZOyyAoy:eEo9RkD9QxDJXs2B
TLSH
T18B827D36A8BCAC771DFBA181B54632039FB89427E5C46BC0D5FD6B1D01E92A9130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 9b2ffc5f1d882acd87bfc890848dd0e1a54104ee81812b758ecf0a262220bb93
MD5 eacfebc31851553ab26b05308997a371
SHA1 e444837390ba4ab2b5db060b08580d93baa2bc87
SHA512 5c83f9a880e87f1fcb5c23501681fd524c9f7b72e91cbf2d4376c931299ef7c4f27fa453b8b4dd47623633a505e9bd1fa29116e78fbaef60914448880bfecb99
SSDEEP 384:BViFsZcIVssNg8TUNTUlIlNTiQmSQX5+DtH80gXmiDSMtgOIwZOyyAoy:qF6mxwgDORkD9QTDJXs2B
TLSH
T1DFA27C379CA8D97B6DFB9A81B54A32038EB84067D5C5BBD0E6ED5B1C01AA1DC030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 60d6e73dcaace8e5d7af71ccc16e59248634918daa434de8fcefc01ba2064a9f
MD5 410421b7a1e409e6a02eb54981d783e2
SHA1 5534d723684718bd143a5d63280e4f76a3ded011
SHA512 0bf4692665d198d63e1744c90f87be90cc582c239e596335f99cac49a4db9fa18ba93d42e6f1e0e0111ec0b4319d14ab696179589f2592b89f48a800761b54e4
SSDEEP 192:EONI6nnHGQmiUyLrQYcX5hQDP1fjzorLoaMc3RU6:EONI6nCsQNX5+DtH80ChU6
TLSH
T18102EB34ACB87CBB8EF7AD45748636139FA4216BE5952B80D7F85F1C00D769C2306927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 49b73df3aeb108c983188a80fa70fff8628b041e34aaea87bbd4eea2470bf426
MD5 a4ec62ddb5efa0308c955b33a93bf628
SHA1 4662438ad1d94ec417b1787420c6341c47ca38b7
SHA512 0842ab65e4cd331a7aeedbb661e3b521809035d71a8fcde5e3064ef176110fafd203c98a824d89cef3b4b44defcc78e8560c61839c4ba8e1027bbb71dc1d8451
SSDEEP 192:EONyU6nnH8QmiUyvrOYcX5hQDP1fjzorLogXXbKog3p/5SMU6:EONJ6nsWONX5+DtH80gXmTDSMU6
TLSH
T1A0121B35B8B8BC675EE36595B08631139EA55127EA887FC0D6FC1B2C01EE69C130A927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b7196d24e406dbce41f078b10d95be0cc6d4c7a256fdf07cbfe8b48fc292a3e4
MD5 b85dc18a6d592d965249db8241ba9a1c
SHA1 38e7bd09266e032814988955533ed46011d56ca8
SHA512 5e970663da2f3b20bd5ba63aeb33a1813bca4d629e08dbecc46cb906ada31b4317b2d0c91b7dc60b99e5355fb2bbf76cf5cd178cb3926358ba311ef15211c153
SSDEEP 384:OZcIKsNg8TiQmSQX5+DtH80gXmoDSMtgOIwZOyyAoy:sKoORkD9QnDJXs2B
TLSH
T1C2827D36A8BCAD771DFB9181B54722039FB89427E5C46BC0D5FD6B1C01E92A8130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a03f7b006d42d4a60bd696d7924031b67bbe05ddf669fa555a24be0277e6bd4e
MD5 57c00e004fcbd360f36152b9e7f6324b
SHA1 0a5ceae6f00343549ccb7720a948a81e383d26a2
SHA512 31f6d916fc92685e329042d9c2b72010a0fa51537fc8ce605b437eafe7d0b7e5d34cd448f4b12168d0069df0aab63835fbdf7cb2edfeddad5964c91a14700124
SSDEEP 384:JfZcIKsNgNTiQmSQX5+DtH80gXmoDSMtgOIwZOyyAoy:9KZORkD9QnDJXs2B
TLSH
T17B827D36A8BCAD371DFB9181B54632039FB89427E5C46BC0D5FD5B1D01E96A8130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9f007bf6-8fd1-48b9-bafd-29a0f7d9c4d3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9f007bf6-8fd1-48b9-bafd-29a0f7d9c4d3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 782d6768a9317d60f3d7c04decb56ea49a6f5d31ef43833abcc9fc49dd7a19b9
MD5 f171dcc5d6b220ea0ec805fa2fbba8e5
SHA1 9d4060e998725150dcb978b30c3c71056af950d1
SHA512 9b6548dc47ada25854e426336e82b47d9211b02fc40393e7f7528fc1305f4b963351ef806f85c505000ba85f27a5a8611807b339e743e226065dabbcd8062dde
TLSH
T13C412788A6EA1158B3B76F4A9BF7A86D487BB9332E4AD45D00110E4F0A22F40CD71737
MD5 SHA1 SHA512 TLSH

Submit Download

fivemdumper.zip.crdownload

Path C:\Users\Admin\Downloads\fivemdumper.zip.crdownload
Size 291KB
SHA256 9240fa9b8fdd8a84316e57b30d2db3dd539eb491ab94c38c9fc4152eb305d259
MD5 5facd9a4cc01d2bc1da084ab8f13861f
SHA1 fae206f29a35107eec08d22538da305c24d817f3
SHA512 90ee5539a267977aa870d0de0466bd04dd50297be1dbedfa35d8bceb945490416f2d16adb95dd6548d88673a38342fb2801925f0e399b86d340514c33cc9f287
SSDEEP 6144:g2KlHlCSTNL2prEP3lh+Oh3Jh5z6OLUl2tit65i4SpN07/+:grpQsirEPjXJhVCl2tA6kzpeK
TLSH
T14F54220B5EE2F200C122F5BCE614858FA5E831DBBFB5F5D680BC7A95482E7B5097606C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3936-183-0x00000288036F0000-0x0000028803839000-memory.dmp

Download

memory/3936-182-0x00000288036F0000-0x0000028803839000-memory.dmp

Download