Analysis
-
max time kernel
82s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
25-06-2024 22:06
Static task
static1
Behavioral task
behavioral1
Sample
RubixLauncher.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
RubixLauncher.exe
Resource
win10v2004-20240611-en
General
-
Target
RubixLauncher.exe
-
Size
355KB
-
MD5
8a6f1580a5b9b94d7cd47cc6b1af1b9a
-
SHA1
e68768afd59e18091d345cb300e859572e8d4c5c
-
SHA256
bb1464e75c750d90c0c49d148c9e64eefe0c29b2f670d708c8085ddd3104dbfe
-
SHA512
1663a9e0868b3f5d7e1edd30259024e419c2d190ec8c31e76e66aef0c8a0e02da0c829584214b9e2f76cbd349a53bf77d01d03e9b0e9c8a99eb18021b1d53309
-
SSDEEP
6144:g2qezd2ab1/RuHk+M3k8M3W7XomjOJCqshrOlumY6DMIewgxQfqhsb:gf2R/EEkCQFYDwRqW
Malware Config
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
RubixLauncher.exedescription pid process target process PID 2460 created 1212 2460 RubixLauncher.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
RubixLauncher.exedialer.exechrome.exepid process 2460 RubixLauncher.exe 2460 RubixLauncher.exe 2444 dialer.exe 2444 dialer.exe 2444 dialer.exe 2444 dialer.exe 3028 chrome.exe 3028 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe Token: SeShutdownPrivilege 3028 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
Processes:
chrome.exepid process 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
Processes:
chrome.exepid process 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe 3028 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
RubixLauncher.exechrome.exedescription pid process target process PID 2460 wrote to memory of 2444 2460 RubixLauncher.exe dialer.exe PID 2460 wrote to memory of 2444 2460 RubixLauncher.exe dialer.exe PID 2460 wrote to memory of 2444 2460 RubixLauncher.exe dialer.exe PID 2460 wrote to memory of 2444 2460 RubixLauncher.exe dialer.exe PID 2460 wrote to memory of 2444 2460 RubixLauncher.exe dialer.exe PID 2460 wrote to memory of 2444 2460 RubixLauncher.exe dialer.exe PID 2460 wrote to memory of 2444 2460 RubixLauncher.exe dialer.exe PID 2460 wrote to memory of 2444 2460 RubixLauncher.exe dialer.exe PID 2460 wrote to memory of 2444 2460 RubixLauncher.exe dialer.exe PID 3028 wrote to memory of 3040 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 3040 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 3040 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 1944 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 1944 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 1944 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 1944 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 1944 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 1944 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 1944 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 1944 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 1944 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 1944 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 1944 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 1944 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 1944 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 1944 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 1944 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 1944 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 1944 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 1944 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 1944 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 1944 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 1944 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 1944 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 1944 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 1944 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 1944 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 1944 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 1944 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 1944 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 1944 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 1944 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 1944 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 1944 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 1944 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 1944 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 1944 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 1944 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 1944 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 1944 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 1944 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 1596 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 1596 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 1596 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 2184 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 2184 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 2184 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 2184 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 2184 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 2184 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 2184 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 2184 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 2184 3028 chrome.exe chrome.exe PID 3028 wrote to memory of 2184 3028 chrome.exe chrome.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\RubixLauncher.exe"C:\Users\Admin\AppData\Local\Temp\RubixLauncher.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef5d89758,0x7fef5d89768,0x7fef5d897783⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1200 --field-trial-handle=1216,i,4616020826057528852,3115846667740429507,131072 /prefetch:23⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1528 --field-trial-handle=1216,i,4616020826057528852,3115846667740429507,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1628 --field-trial-handle=1216,i,4616020826057528852,3115846667740429507,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2344 --field-trial-handle=1216,i,4616020826057528852,3115846667740429507,131072 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2352 --field-trial-handle=1216,i,4616020826057528852,3115846667740429507,131072 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1200 --field-trial-handle=1216,i,4616020826057528852,3115846667740429507,131072 /prefetch:23⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1364 --field-trial-handle=1216,i,4616020826057528852,3115846667740429507,131072 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3484 --field-trial-handle=1216,i,4616020826057528852,3115846667740429507,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3612 --field-trial-handle=1216,i,4616020826057528852,3115846667740429507,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3584 --field-trial-handle=1216,i,4616020826057528852,3115846667740429507,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3684 --field-trial-handle=1216,i,4616020826057528852,3115846667740429507,131072 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3732 --field-trial-handle=1216,i,4616020826057528852,3115846667740429507,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3828 --field-trial-handle=1216,i,4616020826057528852,3115846667740429507,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=1544 --field-trial-handle=1216,i,4616020826057528852,3115846667740429507,131072 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1756 --field-trial-handle=1216,i,4616020826057528852,3115846667740429507,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=3800 --field-trial-handle=1216,i,4616020826057528852,3115846667740429507,131072 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=2684 --field-trial-handle=1216,i,4616020826057528852,3115846667740429507,131072 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1504 --field-trial-handle=1216,i,4616020826057528852,3115846667740429507,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1104 --field-trial-handle=1216,i,4616020826057528852,3115846667740429507,131072 /prefetch:83⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Downloads\RubixLauncher.rar3⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmpFilesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
363B
MD5a817f8ea6c69a23f98df54e732e386a9
SHA19af5eddbf116401bfc04e67026f305bccc62c15f
SHA256c8a95f11dcbd089c561dccd0a21f5abc3f3b28e9906f204c90420aa0c834106e
SHA51280a528caea4ef50a913473408d5df0c33cc0c52f5c90b3136fbcddd34e4250959937f98426da98da1251fcbab24c075f513d9c5895f12efe1dc951a3c0777e61
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
5KB
MD5e19cde8e2ae7d8738265382eba0fa8d6
SHA1c0f0efb472f1374fde5afe17f9eee3e1ed774061
SHA2568904075803dcb11b65184a9f084db9abb28823defbd0455d23c4aedae5cc750d
SHA5127d4fae1e6719d8701966b6c5fca33c917089ee65feaf3925eabebac30da1f7b3a78579d2a58ef059a4e241d12fac036b523927f9592972857af4106bf55addfa
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
5KB
MD5c6091f153906291fa9916724e72f539b
SHA1f63d2d3a1fd01aa69765599065e1ab644e44daaa
SHA256babe28b9b14d5e3b08c6ab50a809bb0363903577e43ec61ed850a95b01f57431
SHA512e7fa08f81151b0de10c8c0a326fbbd2977c001dd013a52da7e33610d4fcf64b707760be6fabc9bc71bf5d72942b7576cab57a4d2521a4e28c59962626dcfa4b3
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmpFilesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
312KB
MD530c47fedb515ca0bdd8307241fdbc731
SHA1bab46e4837acdfd0ab1379adcc38e65ff7dccaf8
SHA256282762960d1a2aeaf3e55d1c27593c3e1bff03ccb35216f5c0bc148483e62ef1
SHA512f99ef7ce1d3f8c82df1436a751d4a93ab23c71650957be2eadce045eb9060d72e8127d4137961ade440a8fdcdf463cac2df1898513e76659b242b324923305ab
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
294KB
MD50708e63e6a15701e154823cf2c5e9034
SHA1792da3c98ca3f2fbc372cd36b96c73f195afe031
SHA2564c38ecc1dc7838be30b32fae539b0122d77c9b2900bb8170bb7a96e1cdfa8284
SHA512d39bec0d4a4121f87d1ee3ae0d1ed9c3763328827914ab5d4a4fabe0e5e585dd052b0eeb6ea42c160a4fc6288f09d52ca0fef37a32da57e615fc2dff11317e3d
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
140KB
MD59ddaaac2db420e7758dd8d5d0f1458a2
SHA1fea9735cfd7d899cb98379df872c7e989e791c38
SHA2568f40104c62f5ea09f07a460205f294f6b6d2129b5923b2b9bcc5b68b7b67879c
SHA51261216263e6f3653f1f95b2582a9da1d02ba5b95f570d1d9eaa79fd2f7911826c0744a836744180e8ee2c620e27326a9b425731c78b2d0bd9cbac342fa96fc10f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
311KB
MD571aec3ac9ada1b2d06a7ecfeb2ace0e4
SHA19bef421d7eb17cdd8910723c9277f7c31de6579d
SHA256ec43ea2013dc9089947b0f360f667ed284c76a90e70fb8cc804b61a97ccb9ce4
SHA5122e4d7444edd15d486d139a3fd34842eddfba1c64e003a8289cc79ea24567c3e69b83c8f3002eb4627b6fa2082d13b88408926375b91347967a9c3ec497133bf5
-
C:\Users\Admin\AppData\Local\Temp\Tar3895.tmpFilesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
C:\Users\Admin\Downloads\RubixLauncher.rarFilesize
237KB
MD5a48d76e6d43a698cfdab6ef51b8ae57d
SHA1ae04f60ef5ca250ae39a86b74f436a67d1f29eab
SHA256837f6441b7784d5f83e3b1d883cfe0d1ee2b97b0a6ed23300206120b9ec42030
SHA51216aad32e95abf3ef745439d9ba79045a0c0c7e6f6a826cf81380a19c7cbe36c3ad97a8e6d277a481cc40f3fc33a5b160b5ff810bc294fb8cbda24c76b143d418
-
\??\pipe\crashpad_3028_GLTQFPQAKJYLRJWGMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/2444-17-0x0000000077020000-0x00000000771C9000-memory.dmpFilesize
1.7MB
-
memory/2444-16-0x0000000076960000-0x00000000769A7000-memory.dmpFilesize
284KB
-
memory/2444-12-0x0000000077020000-0x00000000771C9000-memory.dmpFilesize
1.7MB
-
memory/2444-13-0x0000000001F00000-0x0000000002300000-memory.dmpFilesize
4.0MB
-
memory/2444-9-0x0000000000090000-0x0000000000099000-memory.dmpFilesize
36KB
-
memory/2460-0-0x0000000000ED0000-0x0000000000F3D000-memory.dmpFilesize
436KB
-
memory/2460-10-0x0000000000ED0000-0x0000000000F3D000-memory.dmpFilesize
436KB
-
memory/2460-7-0x0000000003370000-0x0000000003770000-memory.dmpFilesize
4.0MB
-
memory/2460-6-0x0000000076960000-0x00000000769A7000-memory.dmpFilesize
284KB
-
memory/2460-8-0x0000000077021000-0x0000000077122000-memory.dmpFilesize
1.0MB
-
memory/2460-4-0x0000000077020000-0x00000000771C9000-memory.dmpFilesize
1.7MB
-
memory/2460-3-0x0000000003370000-0x0000000003770000-memory.dmpFilesize
4.0MB
-
memory/2460-1-0x0000000003370000-0x0000000003770000-memory.dmpFilesize
4.0MB