4a95d9034ae38f6198d39d6e2a8c4d3844c1a0edab402a144a6d678f35e17f1f

Analysis

max time kernel
150s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 08:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup - Bloxshade.exe
Size 9.0MB
Sample240613-kewdes1dnb
SHA256 e3b64f3a8630a310186580c84c2a9efa535ef61b06b615e09a54c7c3353f2d26
MD5 75b48391fb33a984ac667decca6b0ccd
SHA1 9cb4dea4a8d795369aa298a48910a9d002ad2acb
SHA512 e56708d35922558e95d12ca274a76eb40c1e23347cbe705c44ad82a1d645fb5abe6b718ea8b224008af9103cc79db03c3b656bc00434b52af291f40e8a5e6321
SSDEEP 98304:xbWKo/zVIQsun5MxKkCRrXZu+aV1ZIDHCYYgYM7yn5duKYO4rOiZZeMV61lIeaSS:S+1Z9df4jFVgbaDs8i
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

evasion trojan

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
1748	setup.exe
4544	installer.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup.exe

Drops file in Program Files directory 50 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_909617333\hyph-da.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_909617333\hyph-es.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_909617333\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_909617333\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_1468279214\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_909617333\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_909617333\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_909617333\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_909617333\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_803694679\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_909617333\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_909617333\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_909617333\hyph-as.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_909617333\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_909617333\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_909617333\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Program Files\Bloxshade\setup.exe	Setup - Bloxshade.exe
File opened for modification	C:\Program Files\Bloxshade\install.txt	setup.exe
File opened for modification	C:\Program Files\Bloxshade\install.txt	installer.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_803694679\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_909617333\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_909617333\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_909617333\hyph-be.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_909617333\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_909617333\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_909617333\hyph-or.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_909617333\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_1468279214\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_909617333\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_909617333\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_909617333\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_909617333\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_909617333\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_909617333\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_909617333\hyph-et.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_909617333\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_909617333\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_909617333\hyph-la.hyb	msedgewebview2.exe
File created	C:\Program Files\Bloxshade\installer.exe	Setup - Bloxshade.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_909617333\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_909617333\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_803694679\crl-set	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_909617333\hyph-te.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_909617333\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_909617333\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_909617333\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_909617333\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_909617333\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_909617333\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3048_1468279214\protocols.json	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
4444	taskkill.exe
1416	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133627411045758574"	msedgewebview2.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 989557.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4652	msedge.exe
4652	msedge.exe
2800	msedge.exe
2800	msedge.exe
2052	identity_helper.exe
2052	identity_helper.exe
5392	msedgewebview2.exe
5392	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3048	msedgewebview2.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1416	taskkill.exe
Token: SeDebugPrivilege	4444	taskkill.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1748	setup.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 556	5072	Setup - Bloxshade.exe	83
PID 5072 wrote to memory of 556	5072	Setup - Bloxshade.exe	83
PID 556 wrote to memory of 1416	556	cmd.exe	85
PID 556 wrote to memory of 1416	556	cmd.exe	85
PID 5072 wrote to memory of 2688	5072	Setup - Bloxshade.exe	88
PID 5072 wrote to memory of 2688	5072	Setup - Bloxshade.exe	88
PID 2688 wrote to memory of 4444	2688	cmd.exe	90
PID 2688 wrote to memory of 4444	2688	cmd.exe	90
PID 5072 wrote to memory of 1748	5072	Setup - Bloxshade.exe	91
PID 5072 wrote to memory of 1748	5072	Setup - Bloxshade.exe	91
PID 1748 wrote to memory of 3048	1748	setup.exe	93
PID 1748 wrote to memory of 3048	1748	setup.exe	93
PID 3048 wrote to memory of 4236	3048	msedgewebview2.exe	94
PID 3048 wrote to memory of 4236	3048	msedgewebview2.exe	94
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95
PID 3048 wrote to memory of 4068	3048	msedgewebview2.exe	95

C:\Users\Admin\AppData\Local\Temp\Setup - Bloxshade.exe
"C:\Users\Admin\AppData\Local\Temp\Setup - Bloxshade.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM installer.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:556
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM installer.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1416
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM setup.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM setup.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4444
- C:\Program Files\Bloxshade\setup.exe
  "C:\Program Files\Bloxshade\setup.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1748
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=setup.exe --webview-exe-version=2.8.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --mojo-named-platform-channel-pipe=1748.2396.7325941030166354549
    3⤵
    - Drops file in Program Files directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:3048
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=125.0.6422.142 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=125.0.2535.92 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffceeb24ef8,0x7ffceeb24f04,0x7ffceeb24f10
      4⤵
      PID:4236
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView" --webview-exe-name=setup.exe --webview-exe-version=2.8.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1724,i,5133876367062961435,16274555185681068126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1692 /prefetch:2
      4⤵
      PID:4068
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView" --webview-exe-name=setup.exe --webview-exe-version=2.8.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=1880,i,5133876367062961435,16274555185681068126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:3
      4⤵
      PID:4576
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView" --webview-exe-name=setup.exe --webview-exe-version=2.8.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=1688,i,5133876367062961435,16274555185681068126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:8
      4⤵
      PID:3968
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView" --webview-exe-name=setup.exe --webview-exe-version=2.8.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3592,i,5133876367062961435,16274555185681068126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
      4⤵
      PID:3356
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView" --webview-exe-name=setup.exe --webview-exe-version=2.8.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=4688,i,5133876367062961435,16274555185681068126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:8
      4⤵
      PID:5436
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView" --webview-exe-name=setup.exe --webview-exe-version=2.8.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=1028,i,5133876367062961435,16274555185681068126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:8
      4⤵
      PID:5884
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView" --webview-exe-name=setup.exe --webview-exe-version=2.8.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4776,i,5133876367062961435,16274555185681068126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5392
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView" --webview-exe-name=setup.exe --webview-exe-version=2.8.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=4792,i,5133876367062961435,16274555185681068126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:8
      4⤵
      PID:1132
- - C:\Program Files\Bloxshade\installer.exe
    "C:\Program Files\Bloxshade\installer.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:4544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.roblox.com/download/client
      4⤵
      Enumerates system info in registry
      NTFS ADS
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:2800
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcfd6e46f8,0x7ffcfd6e4708,0x7ffcfd6e4718
        5⤵
        
        PID:912
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,5252100701115508749,2020145952298108659,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
        5⤵
        
        PID:2732
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1960,5252100701115508749,2020145952298108659,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4652
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1960,5252100701115508749,2020145952298108659,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
        5⤵
        
        PID:4892
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,5252100701115508749,2020145952298108659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
        5⤵
        
        PID:4532
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,5252100701115508749,2020145952298108659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
        5⤵
        
        PID:3648
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,5252100701115508749,2020145952298108659,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 /prefetch:8
        5⤵
        
        PID:3416
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,5252100701115508749,2020145952298108659,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2052
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1960,5252100701115508749,2020145952298108659,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5492 /prefetch:8
        5⤵
        
        PID:5140
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,5252100701115508749,2020145952298108659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
        5⤵
        
        PID:5148
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1960,5252100701115508749,2020145952298108659,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6068 /prefetch:8
        5⤵
        
        PID:5296
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,5252100701115508749,2020145952298108659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
        5⤵
        
        PID:5360
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,5252100701115508749,2020145952298108659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
        5⤵
        
        PID:5460
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,5252100701115508749,2020145952298108659,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
        5⤵
        
        PID:5468
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,5252100701115508749,2020145952298108659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
        5⤵
        
        PID:5664
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,5252100701115508749,2020145952298108659,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
        5⤵
        
        PID:5672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1604

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install.txt

Path C:\Program Files\Bloxshade\install.txt
Size 223B
SHA256 4bca074571d09554ac00ff3e9f6383579dcbd80b049597c62eaad7dbbe524db7
MD5 17af09f2f77cb31e58529ea31557c098
SHA1 b48fde97d9df912b6e3978ed5b54d212828e0b5a
SHA512 ef616f0f6d9d5740008b7b5050c006f8955302d1591a3aac7cd6a453c9146b14527a0ad79b50f86d17d2ad454a80855b3019047419e4a554f4062ffc1471d1c3
MD5 SHA1 SHA512

Submit Download

installer.exe

Path C:\Program Files\Bloxshade\installer.exe
Size 1.6MB
SHA256 9fa736a1ef90623337208246328f440a8858b48de1106226a60f8f19025ce29f
MD5 717185ab370c3dd143db0ce06369bdc9
SHA1 4d3def9c099b4a2df128d354ed36a017568fc21d
SHA512 55a64ed1adf468d542f1125cc2cd9ebd0c9082b47c3872c00185037bab08279657b0eb23488fbd2168fe78403e9aa1e6ac452fc2877066476ca4d8b77f5cf3ef
SSDEEP 24576:y2+UiiOTs92UkQ7hCUYbeG0YuuSHwgU5WvJ4+bgJ6ftxRryEUM/:6UuGuQlCHaGHH7WvJ4+bgJ6ftxRrtUM
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Bloxshade\setup.exe
Size 6.7MB
SHA256 8eef87212ca808b830123256be45cc0a800a77507ac9d646d6d656d04243dea6
MD5 53c49eb46e609dc60c4d8c2a399f3b44
SHA1 c90e831199880f0c1c25ee034329a04ccebd60bf
SHA512 e6bde4b7158ec51b609b16b17e4b3acba83c0cf3890274e243392eac84efbfc492380e8f100330ba9b42135e6bc82cefe25f7a51bdfb8b7b9cd61d4532471844
SSDEEP 98304:LbWKo/zVIQsun5MxKkCRrXZu+aV1ZIDHCYYgYM7yn5duKYO4rOiZZeMV61lIeaS:8+1Z9df4jFVgba
MD5 SHA1 SHA512 SSDEEP

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3048_1468279214\manifest.fingerprint
Size 66B
SHA256 52493422ac4c18918dc91ef5c4d0e50c130ea3aa99915fa542b890a79ea94f2b
MD5 0c9218609241dbaa26eba66d5aaf08ab
SHA1 31f1437c07241e5f075268212c11a566ceb514ec
SHA512 5d25a1fb8d9e902647673975f13d7ca11e1f00f3c19449973d6b466d333198768e777b8cae5becef5c66c9a0c0ef320a65116b5070c66e3b9844461bb0ffa47f
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3048_1468279214\manifest.json
Size 134B
SHA256 a946db31a6a985bdb64ea9f403294b479571ca3c22215742bdc26ea1cf123437
MD5 58d3ca1189df439d0538a75912496bcf
SHA1 99af5b6a006a6929cc08744d1b54e3623fec2f36
SHA512 afd7f140e89472d4827156ec1c48da488b0d06daaa737351c7bec6bc12edfc4443460c4ac169287350934ca66fb2f883347ed8084c62caf9f883a736243194a2
MD5 SHA1 SHA512

Submit Download

hyph-as.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3048_909617333\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
MD5 SHA1 SHA512

Submit Download

hyph-hi.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3048_909617333\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
MD5 SHA1 SHA512

Submit Download

hyph-nb.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3048_909617333\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
MD5 SHA1 SHA512 SSDEEP

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3048_909617333\manifest.json
Size 179B
SHA256 0e22719a850c49b3fba3f23f69c8ff785ce3dee233030ed1ad6e6563c75a9902
MD5 273755bb7d5cc315c91f47cab6d88db9
SHA1 c933c95cc07b91294c65016d76b5fa0fa25b323b
SHA512 0e375846a5b10cc29b7846b20a5a9193ea55ff802f668336519ff275fb3d179d8d6654fe1d410764992b85a309a3e001cede2f4acdec697957eb71bdeb234bd8
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c
MD5 c39b3aa574c0c938c80eb263bb450311
SHA1 f4d11275b63f4f906be7a55ec6ca050c62c18c88
SHA512 eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201
MD5 dabfafd78687947a9de64dd5b776d25f
SHA1 16084c74980dbad713f9d332091985808b436dea
SHA512 dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b
MD5 SHA1 SHA512

Submit Download

599ae7f5-80cb-42f6-80ce-877417aa7a65.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\599ae7f5-80cb-42f6-80ce-877417aa7a65.tmp
Size 6KB
SHA256 2a8a798e122b1359b7d27e76ac55f4b9423caa18653e333d4561bac740420883
MD5 4fbc3a3b34d735e86c3c9fabea62fc7b
SHA1 845b9d45e047671d33b3e5814c0b1cc89bed25dd
SHA512 1fff9480cf82c21cf4f12800766287c6767214dee48359859ded213aa9765e94646257ae001179c3e539df4b3eb2a3fafdee75f1c1269b371b02c1ea27b8a8a5
SSDEEP 96:nyFk8sQ3oxm/DnmqiNL1h+mwpvWMoiVmdeH1DDpUWQyV+VD7AiEwb:nyFkW6RB3+mGWMX/rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 377B
SHA256 6a3064964b4feafcfc5fed65eb24bb34e71afe9e4b56400cbc181bc51461d276
MD5 4052f8402661af597fd6d253ad71d7ca
SHA1 dca0cbf9e48f105b797269565e1dc3005e2d988b
SHA512 8aeabd7dd73d5a0f6dea47baf6628473b62bc0d29e68e1ac49eb68d8b50feb4cae4bc0ad7b9fc712a87a636df5202984e78899407087021b1d9731b7f4b13931
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 8486d3e2d1a7d662b4187380ecc2c2b7440939b870f516a040eac2dcdb2c0440
MD5 a4f8918d8963f5d42dc61c26b34b0a0b
SHA1 11ce1914afd2e0e463b4ed24bc4842e8b6e66b50
SHA512 2df5da9041b55ed192e2374a44c20436647879c9852f020240b545040017a150af03c6c7be7790aa242390ef029e621dff6fbfd5dcc230387612cb293e5b591b
SSDEEP 96:nyFkVoxm/DQYmqiNL1h+mwpvWMoiVmdeH1DRpUWQyV+VDCziEwb:nyFkfIRB3+mGWMXZro
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 06eedb5cfd6395efb51217c8c1fb03d7c2df032f673147d0be7e60132ca1e014
MD5 903869977131ce47014c6294f6ead666
SHA1 13a6e690a7a20855e5fe18db663fa4ce28673d37
SHA512 c0d9b6991ffaca288e6280e798ebee12832af6478affb0a9c8f852c70560051a76dd96442b1655376ae2967233734b317d6ee0970d6690cc0a38efdce6f9b688
SSDEEP 192:/oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupAce2RUQdSRsZ3z2OMDCRHX:n9iIxuERzA83h09RZxYHVcGZaOMWRHq4
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 649a1a3514b6adf0ecb68a24686d2f6fdbedc165d452f998b8fa0373e80581e3
MD5 c3e92a5166ff603792289fc0f3870ce1
SHA1 4e59daeb3bb948b0187d0427d41f05ef57475155
SHA512 0152b6d6fb8244985d014ebecbabdd0caa4525d95e1ece94b09e675c930f2c7d4b33f427dbb41a36c42578b7f186d966f3884048521ce57f8d56f6dd40dc00d3
MD5 SHA1 SHA512

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\AutoLaunchProtocolsComponent\1.0.0.8\protocols.json
Size 3KB
SHA256 01594d510a1bbc016897ec89402553eca423dfdc8b82bafbc5653bf0c976f57c
MD5 6bbb18bb210b0af189f5d76a65f7ad80
SHA1 87b804075e78af64293611a637504273fadfe718
SHA512 4788edcfa3911c3bb2be8fc447166c330e8ac389f74e8c44e13238ead2fa45c8538aee325bd0d1cc40d91ad47dea1aa94a92148a62983144fdecff2130ee120d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5a171d4a3c8a3087603b610f59125c2c5c095aada6c18012d89cff0ce565c983
MD5 87c544b3e10670e787fca198d6a19cb8
SHA1 773de2a7d68722a11eaedd55ce246efb8cbb7d92
SHA512 ed4192c90b890278ac6a6faa5c24fb60bbd4fa11953d87296bf3e6378f76cc854e5e1540590af70f685e9283cc3e9eb19cb5b4b8589b383d3dbda9253e016c4b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b792d7edb6c901ff38148a5a18b1431d84c8e5616ca584890c0db7fe2de85ec4
MD5 37e43c620665bcbff962ec34d31536d8
SHA1 b5ffc996973080d96ab78f571589238b615e6d54
SHA512 5b7146d3cb2c17e6060379dda3883ed8dc69a419a837608d6b29d580a2c462802f9b106c9f9024dafa35362cc68fa01cd885ab0410c1e118e451bf71bd29b39a
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 2ddfd439f82acb5cb8832685a2515f4705b9ce31f7792d57d130d8ba6b92b071
MD5 521f0237c9b0abdf52cf2afb571931ab
SHA1 19760a59c3398d3d338824769449895899dd0447
SHA512 7798be13b692f69795b4508b44c5b97e9732826c7c330466d037bda9e6ba6d268f2f80f629e2b361a44d61782fd41a734acc1d33803a153c574f28e94586b008
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 5d910068e11f8e0b70f0b88d84016d376b044f0963eff17460a8c2cc4a2f26a1
MD5 bb985868e5a7ea3feb4d1e3fd4aa2a6c
SHA1 bf17a0b574624d98df1b8e0df0250747b6c366d1
SHA512 0d203098f7c50eb8ace8a5627256f66dff6f208ef9e93423d2930e51918a815a67d11ffce7b35b9e26910f7f4fb81c47701ab2379555995a3fb43629da6c4126
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Default\Network\Network Persistent State
Size 827B
SHA256 3fc7ec343b8624a0755648228510d175753914aaf65ea9c5627866d8244573cf
MD5 cc68955ba01646d14343d0c2149fe1b9
SHA1 e099e99088db0fd4e092f1ffea13c25e52e64640
SHA512 fa906f299f0d5f6e91e47d010060f1bc558847d0222985f1d69bb4bfba0406e524cf6352c507c5ee1d29b40eb44dda1d3f6ff235f7f1e64fac6e42523111ef49
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Default\Network\Network Persistent State
Size 796B
SHA256 15b0120b8522319268d9117855505e9d3321967b4f16b612b0ac96d6d9bbad0a
MD5 b6bb77ea6cbca762d6f3d490d8059e1e
SHA1 c74ccf37cbcf4a2ba7c9a6f05689640a54f35c61
SHA512 78051adb5865426a5c371f91341bc2b3d83174a0f7319ed77407f6c0068e2aaad3bb7c519b2c34e6fa33239f57b5f0f7f9b0a116d3dc3b944cbdf1cd96ab0b8e
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Default\Network\TransportSecurity
Size 356B
SHA256 1d47a0c8c13fb3fb3f8253b1a207ca20d658030d69a8a8f76e5e8d56f3643638
MD5 79d01011a6499cb6060573a26b22c963
SHA1 a563119b3c29379272900b0c16542f1a33beae57
SHA512 3a8dece63ae8f307000c6df46f3f1f740330ad181fb76be7d37ac2791b877a1895f0290f6c4f581063619d866427f51142ca7bc262c4834f4d81cd6414f566cf
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5818b3.TMP

Path C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Default\Network\TransportSecurity~RFe5818b3.TMP
Size 356B
SHA256 39964b3d235164db4d044546c09a69e44bb2816ff9d8820893d139314934fdfa
MD5 614ea4188356653ec11bcc2bb54572f2
SHA1 73a1c52fbb7b8db1aa9198e83f9b8332e23493f8
SHA512 12ba8ea2576341a4c340b3c18f46e1f46c9df1930bcddb03c9681bb8c2f515908d4dc8eee412896bfa9acc5eed7ba663e2b99928585a5653265873cb5ff135a0
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Default\Preferences
Size 6KB
SHA256 d98dfcebb665e8a6a35d7379ccc324013843bdb247673bc7fb3e994d4be42852
MD5 5ebcc18a009249cb4aaad742559eafef
SHA1 54bd8ef8b442de6ec6286aafbc6ab4db1b0676af
SHA512 273e2a444f8cef798a85c1a12b0ee5285241034f75fceffc01ad1ff15e03e10816902702ee868d5cab4b5f3f1481f241eaca18f795436baf9b73fa6609158e26
SSDEEP 96:stye7z2Gyb9YEqjZ5hET6ZQ/7/x+hHMSm+uec0xjaYxCK+g6fG28XM1C7K:stp7BtZgR/V++ex+YTfG6K
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

aee4cf9d-9f4b-4a54-a56a-1686c85c3491.tmp

Path C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Default\aee4cf9d-9f4b-4a54-a56a-1686c85c3491.tmp
Size 6KB
SHA256 1fe9c90be3ad531ffa014680da229dd14ec4e1f4b8ac6f803af24bd1d23458df
MD5 6fdc18baaf1c32ea890e4f6347a249e9
SHA1 ce860ece03d9b6a6649a5b62f8e5f5cf92d83b63
SHA512 ad3a4d5a5db0eeeb4f7b04f58ebec787d7b7a5a96f77e1341626198135dc7b258f5bb548d26074532cc43a4ba6fbdc298753e828d41354c7ac3a575dce9386ca
SSDEEP 96:stye7znyb9YEqjZ5hET6ZQ/7/x+hHMSm+uec0xjaYxCK+gQG28XM1C7K:stp7/tZgR/V++ex+YTRG6K
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Local State
Size 16KB
SHA256 9ea50dea4ff3c0d9e0af73163c3a01d403c33ce85577f48b2371e249ef99a251
MD5 c1185d39b28aae1f503e3531249d0977
SHA1 a3fa14483add1742e39750dec6b590487227cd69
SHA512 338a0544039f380e811cb957fc962146b4ce73a2a218be53c768dd05e8d957c9eb9e9c05e6294fc7c2b7776335e0770d5ad1f1f61b56d4ac7e4dac90729d6630
SSDEEP 384:z0WiUqwdzb8pl0ZK3oae12yTmpNbwFc50fT4QmPZ:4uhOl0koADKLSPZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Local State
Size 2KB
SHA256 e6e72304475a7767e9dd1756ea277ffca9fe010ce56fafd66e6c80df573b8ebe
MD5 8f62e1b29f7af8dd48e436945e22aa6d
SHA1 218ae2f5581fa85e63efd1d5b16a21994997f785
SHA512 be8fdb236b605683736b8db1bc480aaf5ed3b58701bf190aa0fa01482aa875ac959d8b69eed3c06714a1ad5c553a8195e16bea964411c4e3f4ced19e003490f0
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Local State
Size 3KB
SHA256 35a7f352aa9910f1dc6f42b4f905be18a45712169d92cc13be8abd9decba7ca6
MD5 2cfd29ceb5ec691857b61267685e2d4d
SHA1 de7398a764a61f287b5cffa9bc57fa5d7fbe8955
SHA512 3786b05a672441072a7bff9f750ea42243a3f13e03a947c288c25eb8cd102a9fead44a7c8ed0ab4084916dd3c4e7c0eec49a8065a1014aba3ea3eb3e17aed34c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Local State
Size 16KB
SHA256 99bde0af38662e045e843689eda65a02178f7a763d0cefe10bda1de45a0a8cb1
MD5 ade80e23796188c237fd346e1fc7feb3
SHA1 fc9a66cd552b3e5f93aaf43934f56a5670637ae8
SHA512 f0641583954efdbb722e5371571a24c8ab939b2e5f4bfeff2af475bdb7a9872d44990424ec03bbdd4e81074f7da64d4e430d0e8c6d1d79d0bc72e17dbe1fa33f
SSDEEP 384:zyWiUqwdzb8pl0ZK3oae12yTmRNbdWc50fT4QmPZ:muhOl0koARKLSPZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Local State
Size 1KB
SHA256 6d3069663b37c19129415d5434871fa896b6d5ba1f1c39dd453e9a48f85a243d
MD5 4764ea99b1624b26bde2ef8ced5748de
SHA1 ea633c9fa059657a824bca88895f698ac72a17b9
SHA512 0aafdcdffa82b79cbc2bec81bc1c073ad121317093ff6a307f82918a176af6f6aa9c1ef1a0c92a9999dcf0be48af892e99a5aff2cb6b09559e31786f29ad8e32
MD5 SHA1 SHA512

Submit Download

Local State~RFe575a26.TMP

Path C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Local State~RFe575a26.TMP
Size 1KB
SHA256 ec441d73d42800fd4098d0447edb1288c8afefb95e3e6680e632c650b7e42bd5
MD5 00f1eea847de34f335df866bc475d91c
SHA1 e8f14ff921cfe8b943cb9723618f2b942769aa52
SHA512 71c35fb54f17090281a536e9bcb4d486e4c37d672df4d8a6ef9292d2a430f11a3243be59e94fff9bc877f25e2112d84ea7e1b1b73b6d326b7ddb8e2fe61b1a82
MD5 SHA1 SHA512

Submit Download

Unconfirmed 989557.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 989557.crdownload
Size 5.4MB
SHA256 b5d35eaf2ca4befb5ac6de8680609c9a86fdc257b49d21ce4c8d17eddaa1b51a
MD5 a0396f9bb5e0144808cc7c7fda47e682
SHA1 76bef1c55c6f288ca5988d344c4e92ee8f3a6329
SHA512 dd49140d4661d813501d67c44d5fedd6bdc7ce731242fb33973b0b7a5b603344682fe1bc393fcf9fe3f5ad10ed9f1de7dbc42c66ec16b84063fe535f288ab7e0
SSDEEP 98304:JnvFdBAtAOZPKZvf2H2dDgl3UZqPKCRAvMcCLsbuar+v:15AdumYglHpRpc8o/rI
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3356-144-0x00007FFD0CA50000-0x00007FFD0CA51000-memory.dmp

Download

memory/3968-71-0x00007FFD0C0D0000-0x00007FFD0C0D1000-memory.dmp

Download

memory/3968-69-0x00007FFD0B300000-0x00007FFD0B301000-memory.dmp

Download

memory/4068-31-0x00007FFD0CA50000-0x00007FFD0CA51000-memory.dmp

Download

memory/5392-456-0x0000012AAD380000-0x0000012AAD381000-memory.dmp

Download

memory/5392-466-0x0000012AAD380000-0x0000012AAD381000-memory.dmp

Download

memory/5392-465-0x0000012AAD380000-0x0000012AAD381000-memory.dmp

Download

memory/5392-463-0x0000012AAD380000-0x0000012AAD381000-memory.dmp

Download

memory/5392-467-0x0000012AAD380000-0x0000012AAD381000-memory.dmp

Download

memory/5392-468-0x0000012AAD380000-0x0000012AAD381000-memory.dmp

Download

memory/5392-464-0x0000012AAD380000-0x0000012AAD381000-memory.dmp

Download

memory/5392-462-0x0000012AAD380000-0x0000012AAD381000-memory.dmp

Download

memory/5392-458-0x0000012AAD380000-0x0000012AAD381000-memory.dmp

Download

memory/5392-457-0x0000012AAD380000-0x0000012AAD381000-memory.dmp

Download