hxxps://bloxshade[.]com/

Analysis

max time kernel
448s
max time network
447s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/09/2024, 12:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://bloxshade.com/

Score

8^/10

discovery evasion persistence privilege_escalation trojan

Malware Config

Signatures

Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 27 IoCs

pid	Process
928	MicrosoftEdgeWebview2Setup.exe
1716	MicrosoftEdgeUpdate.exe
4732	MicrosoftEdgeUpdate.exe
4972	MicrosoftEdgeUpdate.exe
556	MicrosoftEdgeUpdateComRegisterShell64.exe
4172	MicrosoftEdgeUpdateComRegisterShell64.exe
6032	MicrosoftEdgeUpdateComRegisterShell64.exe
4280	MicrosoftEdgeUpdate.exe
5656	MicrosoftEdgeUpdate.exe
1888	MicrosoftEdgeUpdate.exe
3280	MicrosoftEdgeUpdate.exe
4804	MicrosoftEdge_X64_128.0.2739.63.exe
2384	setup.exe
3972	setup.exe
3940	MicrosoftEdgeUpdate.exe
5392	RobloxPlayerInstaller.exe
4268	RobloxPlayerBeta.exe
1188	setup.exe
3064	msedgewebview2.exe
4756	msedgewebview2.exe
4828	msedgewebview2.exe
5504	msedgewebview2.exe
4740	msedgewebview2.exe
5096	msedgewebview2.exe
1192	installer.exe
1892	RobloxPlayerBeta.exe
5980	msedgewebview2.exe

Loads dropped DLL 40 IoCs

pid	Process
1716	MicrosoftEdgeUpdate.exe
4732	MicrosoftEdgeUpdate.exe
4972	MicrosoftEdgeUpdate.exe
556	MicrosoftEdgeUpdateComRegisterShell64.exe
4972	MicrosoftEdgeUpdate.exe
4172	MicrosoftEdgeUpdateComRegisterShell64.exe
4972	MicrosoftEdgeUpdate.exe
6032	MicrosoftEdgeUpdateComRegisterShell64.exe
4972	MicrosoftEdgeUpdate.exe
4280	MicrosoftEdgeUpdate.exe
5656	MicrosoftEdgeUpdate.exe
1888	MicrosoftEdgeUpdate.exe
1888	MicrosoftEdgeUpdate.exe
5656	MicrosoftEdgeUpdate.exe
3280	MicrosoftEdgeUpdate.exe
3940	MicrosoftEdgeUpdate.exe
4268	RobloxPlayerBeta.exe
1188	setup.exe
3064	msedgewebview2.exe
4756	msedgewebview2.exe
3064	msedgewebview2.exe
3064	msedgewebview2.exe
3064	msedgewebview2.exe
4828	msedgewebview2.exe
5504	msedgewebview2.exe
4828	msedgewebview2.exe
5504	msedgewebview2.exe
4828	msedgewebview2.exe
4828	msedgewebview2.exe
4828	msedgewebview2.exe
4828	msedgewebview2.exe
4740	msedgewebview2.exe
4740	msedgewebview2.exe
5096	msedgewebview2.exe
5096	msedgewebview2.exe
5096	msedgewebview2.exe
3064	msedgewebview2.exe
1892	RobloxPlayerBeta.exe
5980	msedgewebview2.exe
5980	msedgewebview2.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Checks system information in the registry 2 TTPs 12 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	msedgewebview2.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
4268	RobloxPlayerBeta.exe
1892	RobloxPlayerBeta.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 36 IoCs

pid	Process
4268	RobloxPlayerBeta.exe
4268	RobloxPlayerBeta.exe
4268	RobloxPlayerBeta.exe
4268	RobloxPlayerBeta.exe
4268	RobloxPlayerBeta.exe
4268	RobloxPlayerBeta.exe
4268	RobloxPlayerBeta.exe
4268	RobloxPlayerBeta.exe
4268	RobloxPlayerBeta.exe
4268	RobloxPlayerBeta.exe
4268	RobloxPlayerBeta.exe
4268	RobloxPlayerBeta.exe
4268	RobloxPlayerBeta.exe
4268	RobloxPlayerBeta.exe
4268	RobloxPlayerBeta.exe
4268	RobloxPlayerBeta.exe
4268	RobloxPlayerBeta.exe
4268	RobloxPlayerBeta.exe
1892	RobloxPlayerBeta.exe
1892	RobloxPlayerBeta.exe
1892	RobloxPlayerBeta.exe
1892	RobloxPlayerBeta.exe
1892	RobloxPlayerBeta.exe
1892	RobloxPlayerBeta.exe
1892	RobloxPlayerBeta.exe
1892	RobloxPlayerBeta.exe
1892	RobloxPlayerBeta.exe
1892	RobloxPlayerBeta.exe
1892	RobloxPlayerBeta.exe
1892	RobloxPlayerBeta.exe
1892	RobloxPlayerBeta.exe
1892	RobloxPlayerBeta.exe
1892	RobloxPlayerBeta.exe
1892	RobloxPlayerBeta.exe
1892	RobloxPlayerBeta.exe
1892	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\AssetImport\btn_dark_resetcam_28x28.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\ExtraContent\textures\ui\LuaApp\ExternalSite\twitter.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\fonts\families\Montserrat.json	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\ui\VoiceChat\New\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\ExtraContent\textures\ui\LuaApp\ExternalSite\amazon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\ExtraContent\textures\ui\LuaChatV2\common_search.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.63\v8_context_snapshot.bin	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\RoduxDevtools\StateTabs\Diff.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\StudioToolbox\ScrollBarBottom.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\ExtraContent\textures\ui\LuaApp\graphic\gr-avatar mask-84x84.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\ui\PurchasePrompt\RightButtonDown.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\fonts\Kalam-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\ExtraContent\textures\ui\InGameMenu\drop_shadow_favorite.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\ExtraContent\textures\ui\LuaApp\icons\ic-more-events.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1C2F.tmp\EdgeUpdate.dat	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.63\Trust Protection Lists\Sigma\Other	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\ExtraContent\textures\ui\Gamepad\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\avatar\unification\AdapterReference.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\ui\Settings\LeaveGame\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\ui\VoiceChat\New\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\AvatarImporter\icon_AvatarImporter.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\CompositorDebugger\blend1d.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\StudioSharedUI\alert_error_withbg.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\ExtraContent\textures\ui\LuaChatV2\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.63\Locales\gd.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\ui\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\ui\VoiceChat\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1C2F.tmp\msedgeupdateres_fil.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\ui\Controls\graveaccent.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\ui\PlayerList\NotificationOff.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\ui\VoiceChat\SpeakerLight\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.63\Trust Protection Lists\Sigma\Content	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\models\MaterialManager\material_model.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\TerrainTools\progress_bar.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\ui\TopBar\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\ExtraContent\textures\ui\LuaApp\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\ui\ResetIcon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source2384_1165036280\MSEDGE.7z	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.63\Locales\or.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.63\Trust Protection Lists\manifest.json	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.63\Locales\et.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.63\Locales\mt.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\MaterialGenerator\Materials\Metal.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\advCursor-default.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\ui\dialog_purpose_quest.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\ui\InspectMenu\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1C2F.tmp\msedgeupdateres_ja.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.63\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\MotorCursor.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\ui\VoiceChat\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\ui\VoiceChat\Misc\Unmute.png	RobloxPlayerInstaller.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebview2Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4280	MicrosoftEdgeUpdate.exe
3280	MicrosoftEdgeUpdate.exe
3940	MicrosoftEdgeUpdate.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
1056	taskkill.exe
5092	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133700139922937333"	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-7201700b36284abb"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ = "IAppVersionWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32\ = "{31FB561A-CD57-4AF0-AE52-5652A86256B1}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32\ = "{31FB561A-CD57-4AF0-AE52-5652A86256B1}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachine\CLSID\ = "{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32\ = "{31FB561A-CD57-4AF0-AE52-5652A86256B1}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32\ = "{31FB561A-CD57-4AF0-AE52-5652A86256B1}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32\ = "{31FB561A-CD57-4AF0-AE52-5652A86256B1}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32\ = "{31FB561A-CD57-4AF0-AE52-5652A86256B1}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0B4C1840-3931-4AA5-A64F-95339D05E614}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\NumMethods\ = "41"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ = "IApp"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback.1.0\ = "Microsoft Edge Update Legacy On Demand"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ = "IAppBundleWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\ELEVATION	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebSvc.1.0\CLSID\ = "{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32\ = "{31FB561A-CD57-4AF0-AE52-5652A86256B1}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\LocalServer32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods\ = "4"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods\ = "10"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ProxyStubClsid32\ = "{31FB561A-CD57-4AF0-AE52-5652A86256B1}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachine\CurVer\ = "MicrosoftEdgeUpdate.OnDemandCOMClassMachine.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{31FB561A-CD57-4AF0-AE52-5652A86256B1}\ = "PSFactoryBuffer"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\ProgID\ = "MicrosoftEdgeUpdate.ProcessLauncher.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\NumMethods\ = "17"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\VERSIONINDEPENDENTPROGID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\ = "Microsoft Edge Update Core Class"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback\CLSID\ = "{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\PROGID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\ = "IPolicyStatus5"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32\ = "{31FB561A-CD57-4AF0-AE52-5652A86256B1}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachineFallback.1.0\CLSID\ = "{E421557C-0628-43FB-BF2B-7C9F8A4D067C}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-3f7e4622625145b8\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32\ = "{31FB561A-CD57-4AF0-AE52-5652A86256B1}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ = "IProgressWndEvents"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\ProgID\ = "MicrosoftEdgeUpdate.PolicyStatusMachine.1.0"	MicrosoftEdgeUpdate.exe

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 283271.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 849467.crdownload:SmartScreen	msedge.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1C2F.tmp\MicrosoftEdgeUpdateSetup.exe\:SmartScreen:$DATA	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 148567.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe
4124	msedge.exe
4124	msedge.exe
4044	identity_helper.exe
4044	identity_helper.exe
2484	msedge.exe
2484	msedge.exe
3304	msedge.exe
3304	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3996	msedge.exe
3996	msedge.exe
632	msedge.exe
1716	MicrosoftEdgeUpdate.exe
1716	MicrosoftEdgeUpdate.exe
4520	msedge.exe
4520	msedge.exe
1716	MicrosoftEdgeUpdate.exe
1716	MicrosoftEdgeUpdate.exe
1716	MicrosoftEdgeUpdate.exe
1716	MicrosoftEdgeUpdate.exe
5392	RobloxPlayerInstaller.exe
5392	RobloxPlayerInstaller.exe
4268	RobloxPlayerBeta.exe
1892	RobloxPlayerBeta.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 49 IoCs

pid	Process
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
3064	msedgewebview2.exe
4124	msedge.exe
4124	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: 33	1896	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1896	AUDIODG.EXE
Token: SeDebugPrivilege	1716	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	1716	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	1056	taskkill.exe
Token: SeDebugPrivilege	5092	taskkill.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
1188	setup.exe
4124	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5292	Setup - Bloxshade.exe
1048	Setup - Bloxshade.exe
1188	setup.exe
1192	installer.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4268	RobloxPlayerBeta.exe
1892	RobloxPlayerBeta.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4124 wrote to memory of 4032	4124	msedge.exe	83
PID 4124 wrote to memory of 4032	4124	msedge.exe	83
PID 4124 wrote to memory of 3884	4124	msedge.exe	84
PID 4124 wrote to memory of 3884	4124	msedge.exe	84
PID 4124 wrote to memory of 3884	4124	msedge.exe	84
PID 4124 wrote to memory of 3884	4124	msedge.exe	84
PID 4124 wrote to memory of 3884	4124	msedge.exe	84
PID 4124 wrote to memory of 3884	4124	msedge.exe	84
PID 4124 wrote to memory of 3884	4124	msedge.exe	84
PID 4124 wrote to memory of 3884	4124	msedge.exe	84
PID 4124 wrote to memory of 3884	4124	msedge.exe	84
PID 4124 wrote to memory of 3884	4124	msedge.exe	84
PID 4124 wrote to memory of 3884	4124	msedge.exe	84
PID 4124 wrote to memory of 3884	4124	msedge.exe	84
PID 4124 wrote to memory of 3884	4124	msedge.exe	84
PID 4124 wrote to memory of 3884	4124	msedge.exe	84
PID 4124 wrote to memory of 3884	4124	msedge.exe	84
PID 4124 wrote to memory of 3884	4124	msedge.exe	84
PID 4124 wrote to memory of 3884	4124	msedge.exe	84
PID 4124 wrote to memory of 3884	4124	msedge.exe	84
PID 4124 wrote to memory of 3884	4124	msedge.exe	84
PID 4124 wrote to memory of 3884	4124	msedge.exe	84
PID 4124 wrote to memory of 3884	4124	msedge.exe	84
PID 4124 wrote to memory of 3884	4124	msedge.exe	84
PID 4124 wrote to memory of 3884	4124	msedge.exe	84
PID 4124 wrote to memory of 3884	4124	msedge.exe	84
PID 4124 wrote to memory of 3884	4124	msedge.exe	84
PID 4124 wrote to memory of 3884	4124	msedge.exe	84
PID 4124 wrote to memory of 3884	4124	msedge.exe	84
PID 4124 wrote to memory of 3884	4124	msedge.exe	84
PID 4124 wrote to memory of 3884	4124	msedge.exe	84
PID 4124 wrote to memory of 3884	4124	msedge.exe	84
PID 4124 wrote to memory of 3884	4124	msedge.exe	84
PID 4124 wrote to memory of 3884	4124	msedge.exe	84
PID 4124 wrote to memory of 3884	4124	msedge.exe	84
PID 4124 wrote to memory of 3884	4124	msedge.exe	84
PID 4124 wrote to memory of 3884	4124	msedge.exe	84
PID 4124 wrote to memory of 3884	4124	msedge.exe	84
PID 4124 wrote to memory of 3884	4124	msedge.exe	84
PID 4124 wrote to memory of 3884	4124	msedge.exe	84
PID 4124 wrote to memory of 3884	4124	msedge.exe	84
PID 4124 wrote to memory of 3884	4124	msedge.exe	84
PID 4124 wrote to memory of 2076	4124	msedge.exe	85
PID 4124 wrote to memory of 2076	4124	msedge.exe	85
PID 4124 wrote to memory of 888	4124	msedge.exe	86
PID 4124 wrote to memory of 888	4124	msedge.exe	86
PID 4124 wrote to memory of 888	4124	msedge.exe	86
PID 4124 wrote to memory of 888	4124	msedge.exe	86
PID 4124 wrote to memory of 888	4124	msedge.exe	86
PID 4124 wrote to memory of 888	4124	msedge.exe	86
PID 4124 wrote to memory of 888	4124	msedge.exe	86
PID 4124 wrote to memory of 888	4124	msedge.exe	86
PID 4124 wrote to memory of 888	4124	msedge.exe	86
PID 4124 wrote to memory of 888	4124	msedge.exe	86
PID 4124 wrote to memory of 888	4124	msedge.exe	86
PID 4124 wrote to memory of 888	4124	msedge.exe	86
PID 4124 wrote to memory of 888	4124	msedge.exe	86
PID 4124 wrote to memory of 888	4124	msedge.exe	86
PID 4124 wrote to memory of 888	4124	msedge.exe	86
PID 4124 wrote to memory of 888	4124	msedge.exe	86
PID 4124 wrote to memory of 888	4124	msedge.exe	86
PID 4124 wrote to memory of 888	4124	msedge.exe	86
PID 4124 wrote to memory of 888	4124	msedge.exe	86
PID 4124 wrote to memory of 888	4124	msedge.exe	86

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	msedgewebview2.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://bloxshade.com/
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff204346f8,0x7fff20434708,0x7fff20434718
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3032 /prefetch:1
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6756 /prefetch:8
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6436 /prefetch:1
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6524 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6632 /prefetch:1
  2⤵
  PID:6004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6612 /prefetch:1
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7164 /prefetch:1
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7344 /prefetch:1
  2⤵
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7136 /prefetch:1
  2⤵
  PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6768 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7304 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6616 /prefetch:8
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1992 /prefetch:1
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7516 /prefetch:1
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2008 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7856 /prefetch:1
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7188 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1788 /prefetch:1
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4748 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7100 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7732 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7596 /prefetch:1
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7544 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7332 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7592 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7540 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7532 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1760 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3084 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=6676 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6836 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2448 /prefetch:1
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=8428 /prefetch:8
  2⤵
  PID:5928
- C:\Users\Admin\Downloads\MicrosoftEdgeWebview2Setup.exe
  "C:\Users\Admin\Downloads\MicrosoftEdgeWebview2Setup.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  PID:928
- - C:\Program Files (x86)\Microsoft\Temp\EU1C2F.tmp\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\Temp\EU1C2F.tmp\MicrosoftEdgeUpdate.exe" /installsource taggedmi /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks system information in the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1716
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:4732
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:4972
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.19\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.19\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:556
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.19\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.19\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:4172
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.19\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.19\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:6032
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTkiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OTkwMTY5MzMtM0I0NS00MUQ5LTk3QjMtRkM1NEI2MkM1NjY3fSIgdXNlcmlkPSJ7NkE2M0NFODItQ0ZDNy00QzNFLTlCNTktREMzODkwNUM4Q0RCfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezgwOTJGNzYzLTBCNjItNEUwMi04RjA2LTVDQjg1NTg2MDY0Q30iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTk1LjE1IiBuZXh0dmVyc2lvbj0iMS4zLjE5NS4xOSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzA3OTY5MDAyMiIgaW5zdGFsbF90aW1lX21zPSI1NDciLz48L2FwcD48L3JlcXVlc3Q-
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4280
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource taggedmi /sessionid "{99016933-3B45-41D9-97B3-FC54B62C5667}"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8464 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8500 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7760 /prefetch:1
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7836 /prefetch:1
  2⤵
  PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7500 /prefetch:1
  2⤵
  PID:1840
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5392
- - C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\RobloxPlayerBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\RobloxPlayerBeta.exe" -app -isInstallerLaunch -clientLaunchTimeEpochMs 0
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of UnmapMainImage
    PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7344 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5104 /prefetch:8
  2⤵
  PID:2116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:624

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5216

C:\Users\Admin\AppData\Local\Temp\Temp1_Bloxshade.zip\Setup - Bloxshade.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Bloxshade.zip\Setup - Bloxshade.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/p/?LinkId=2124703
  2⤵
  PID:5540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff204346f8,0x7fff20434708,0x7fff20434718
    3⤵
    PID:5556

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x33c 0x4a0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5988

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1888
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTkiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OTkwMTY5MzMtM0I0NS00MUQ5LTk3QjMtRkM1NEI2MkM1NjY3fSIgdXNlcmlkPSJ7NkE2M0NFODItQ0ZDNy00QzNFLTlCNTktREMzODkwNUM4Q0RCfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7MEQ2QzY3NzAtQzJGRS00RURELUI4NEQtQUVENUYzREE5RjFGfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0o3VmlaamJOeXgxR1ZySFcrUmQvUGdWaXpuRit0cXhpVXRXWG9GdEloZlU9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIzMyIgaW5zdGFsbGRhdGV0aW1lPSIxNzIyNjAyNzEzIiBvb2JlX2luc3RhbGxfdGltZT0iMTMzNjcwNzUyNzAwMTQ5Mzc0IiBmaXJzdF9mcmVfc2Vlbl90aW1lPSIxMzM3MDAxMzYyMjQ3Njk3MzIiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMzExMTg5IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3MDg1MzI5OTQ1Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3280
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9452A050-106B-42CB-9614-865D2ACA3585}\MicrosoftEdge_X64_128.0.2739.63.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9452A050-106B-42CB-9614-865D2ACA3585}\MicrosoftEdge_X64_128.0.2739.63.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  PID:4804
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9452A050-106B-42CB-9614-865D2ACA3585}\EDGEMITMP_37C00.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9452A050-106B-42CB-9614-865D2ACA3585}\EDGEMITMP_37C00.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9452A050-106B-42CB-9614-865D2ACA3585}\MicrosoftEdge_X64_128.0.2739.63.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:2384
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9452A050-106B-42CB-9614-865D2ACA3585}\EDGEMITMP_37C00.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9452A050-106B-42CB-9614-865D2ACA3585}\EDGEMITMP_37C00.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=128.0.6613.120 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9452A050-106B-42CB-9614-865D2ACA3585}\EDGEMITMP_37C00.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=128.0.2739.63 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ff6992206d8,0x7ff6992206e4,0x7ff6992206f0
      4⤵
      Executes dropped EXE
      PID:3972
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTkiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OTkwMTY5MzMtM0I0NS00MUQ5LTk3QjMtRkM1NEI2MkM1NjY3fSIgdXNlcmlkPSJ7NkE2M0NFODItQ0ZDNy00QzNFLTlCNTktREMzODkwNUM4Q0RCfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezY1NDZFQ0E3LTBDQTEtNDY1Qy04MkM1LTQ1NkM0MjRBREU1Nn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMjguMC4yNzM5LjYzIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3MTAxMjQwMTYxIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzEwMTQ0MDAxNiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc0NzI3Njc5MzQiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5mLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzg1YWYyOWQ5LTQzNjgtNDQyYi1hNmY5LTZmOTJmZTIxNDg1Mj9QMT0xNzI2MTQ1MDU0JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PVdjN29tT0pmSkVMb1JjbUNocXglMmJsaWtTUDE2T2p6ZElzbDV1WVJRZ1pqOXNuWWhhUUtlMDRzY3JwSUpROERoJTJmVkZiaWRoUE12MlpkSUslMmJ0WVZ2NjFBJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTczODU0Nzc2IiB0b3RhbD0iMTczODU0Nzc2IiBkb3dubG9hZF90aW1lX21zPSIzMDcwMSIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc0NzI5MDg0MzciIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3NDg5OTA3ODA1IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3OTMzMjYwODMwIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMTE1MiIgZG93bmxvYWRfdGltZV9tcz0iMzcxMzciIGRvd25sb2FkZWQ9IjE3Mzg1NDc3NiIgdG90YWw9IjE3Mzg1NDc3NiIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iNDQzMzQiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3940

C:\Users\Admin\AppData\Local\Temp\Temp1_Bloxshade.zip\Setup - Bloxshade.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Bloxshade.zip\Setup - Bloxshade.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1048
- C:\Windows\system32\cmd.exe
  cmd.exe /c taskkill /F /IM installer.exe
  2⤵
  PID:4104
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM installer.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1056
- C:\Windows\system32\cmd.exe
  cmd.exe /c taskkill /F /IM setup.exe
  2⤵
  PID:1208
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM setup.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5092
- C:\Program Files\Bloxshade\setup.exe
  "C:\Program Files\Bloxshade\setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:1188
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.63\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.63\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=setup.exe --webview-exe-version=2.8.11 --user-data-dir="C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --mojo-named-platform-channel-pipe=1188.4844.12199119455186170378
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks system information in the registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - System policy modification
    PID:3064
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.63\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.63\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=128.0.6613.120 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.63\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=128.0.2739.63 --initial-client-data=0x174,0x178,0x17c,0x150,0x184,0x7fff0c549fd8,0x7fff0c549fe4,0x7fff0c549ff0
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4756
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.63\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.63\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView" --webview-exe-name=setup.exe --webview-exe-version=2.8.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1812,i,13617649339729918172,11398297182688003483,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1808 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4828
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.63\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.63\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView" --webview-exe-name=setup.exe --webview-exe-version=2.8.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=2076,i,13617649339729918172,11398297182688003483,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5504
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.63\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.63\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView" --webview-exe-name=setup.exe --webview-exe-version=2.8.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=2216,i,13617649339729918172,11398297182688003483,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4740
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.63\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.63\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView" --webview-exe-name=setup.exe --webview-exe-version=2.8.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3560,i,13617649339729918172,11398297182688003483,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:5096
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.63\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.63\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView" --webview-exe-name=setup.exe --webview-exe-version=2.8.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=3752,i,13617649339729918172,11398297182688003483,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5980
- - C:\Program Files\Bloxshade\installer.exe
    "C:\Program Files\Bloxshade\installer.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.roblox.com/download/client
      4⤵
      PID:4820
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff204346f8,0x7fff20434708,0x7fff20434718
        5⤵
        
        PID:4092

C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:1892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.63\Installer\setup.exe

Filesize
6.6MB

MD5
0306115e5983a950a7c1df77dac6ebad

SHA1
7fa1850fe1c9683eead8cc201bfeb6e8c5f2898c

SHA256
3f20b4d5ccc612ace1a94fbdd43414feb1bf4c52f04b30891042d0611277b0de

SHA512
54d1d00fd6979076f30c209cb814efcd0f1d24ea22f9765767c4f39cbec8b9c75405f9c80a27e035e82adfbb2d54afd43dd15349c16b77442ca1efad454dc2ec

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU1C2F.tmp\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
b0d94ffd264b31a419e84a9b027d926b

SHA1
4c36217abe4aebe9844256bf6b0354bb2c1ba739

SHA256
f471d9ff608fe58da68a49af83a7fd9a3d6bf5a5757d340f7b8224b6cd8bddf6

SHA512
d68737f1d87b9aa410d13b494c1817d5391e8f098d1cdf7b672f57713b289268a2d1e532f2fc7fec44339444205affb996e32b23c3162e2a539984be05bb20c4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU1C2F.tmp\MicrosoftEdgeUpdateCore.exe

Filesize
262KB

MD5
e468fe744cbaebc00b08578f6c71fbc0

SHA1
2ae65aadb9ab82d190bdcb080e00ff9414e3c933

SHA256
7c75c35f4222e83088de98ba25595eb76013450fc959d7feefcab592d1c9839f

SHA512
184a6f2378463c3ccc0f491f4a12d6cac38b10a916c8525a27acd91f681eb8fb0be956fc4bdb99e5a6c7b76f871069f939c996e93a68ff0a6c305195a6049276

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU1C2F.tmp\msedgeupdate.dll

Filesize
2.1MB

MD5
b0da0a3975239134c6454035e5c3ed79

SHA1
fbea5c89ef828564f3d3640d38b8a9662c5260e6

SHA256
c590d1af571d75d85cfe6cb3d1aa0808c702bcefd1b74b93ea423676859fb8ba

SHA512
5fbfa431a855d634bcbef4c54e5cc62b6435629305efee11559f66473c427ad0775c09364d37aaa7a4a8a963800886f6547a52ae680a1ff2c4dcc52c87d994bb

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU1C2F.tmp\msedgeupdateres_en.dll

Filesize
27KB

MD5
be845ba29484bdc95909f5253192c774

SHA1
70e17729024ab1e13328ac9821d495de1ac7d752

SHA256
28414cd85efe921a07537f8c84c0a98a2a85fdbd5dfa3141e722ed7b433d0a96

SHA512
2800ec29ece429151c4cd463c5042492ac24e82b4999a323607d142a6e1a08cb69258190a6722afbbcfb3c9cdc6eebdedf89ee6549e0f420f6fbae3aa0501fd4

Download Submit
C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe

Filesize
5.5MB

MD5
929a709b2e6c4b26c0249a380ecc62ec

SHA1
20b9623b5c0f539b382767952c724cd2b347644a

SHA256
54feb2119e5b6f99a4172639d3671724bb998fc2d61454920d90db7dd6cfb2b4

SHA512
7c36e695fc87c40550be600a3f63b43f99230331c46a64aaa496c3233de4daec858f3e4a96100cf542fc5bc0a0a4514c052e7bad4c02c48ad425b22a5006b7ab

Download Submit
C:\Program Files\MsEdgeCrashpad\settings.dat

Filesize
280B

MD5
aa2bdcbff7d470104013a39183dd91ca

SHA1
444e3ea43dbb2a8775523db07a73bf434402b7c9

SHA256
4c58551ca99a529ff210e33064a3dfc66448546ef137ca88915727ef8a1bbedc

SHA512
cf980ab878b64a22fa56f2132feb7aa151bbf36224a4cd0864583c99f16a6b89d8c1d8c788776e6813e6dd8cb305537d3e448786dc52da72b2a06883cbd9cb18

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3064_1145404593\crs.pb

Filesize
278KB

MD5
981a9155cad975103b6a26acef33a866

SHA1
1965290a94d172c4def1ac7199736c26dccca33e

SHA256
971393390616fbe53c63865274a40a0b4a8e731c529664275bdc764f09a28e2d

SHA512
2d75ce25cb3a78f69f90fbd23f6e5c9f1a6ed92025f83ce0ab3e0320b64130d586fc2cd960f763e1ab2c82d35ef9650ebd7ff2a42a928a293e0e7428cc669119

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3064_1145404593\manifest.json

Filesize
102B

MD5
8062e1b9705b274fd46fcd2dd53efc81

SHA1
61912082d21780e22403555a43408c9a6cafc59a

SHA256
2f0e67d8b541936adc77ac9766c15a98e9b5de67477905b38624765e447fcd35

SHA512
98609cf9b126c7c2ad29a6ec92f617659d35251d5f6e226fff78fd9f660f7984e4c188e890495ab05ae6cf3fbe9bf712c81d814fbd94d9f62cf4ff13bbd9521a

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
180KB

MD5
3cafff21818ba5e51152524acad5ec8e

SHA1
2840648fa39fa8e3c061c57ea6222d109b921450

SHA256
6963b601ac0e7507eb34ec08b3b7a916116eeb586da6e0b4e9a86c331ba0a7f4

SHA512
30aaed28d4a319035f281b7ebcb5569439a91fec4fd0a0590d96ef91e58ca1ac6fae50908b889f6bfd2de5759b898dc0624f6a2407a5bc5b125df9688abd58cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\242db0f7-4d58-4744-8d33-8afabe35be65.tmp

Filesize
5KB

MD5
169105693ec8fb8cb215700f886417c3

SHA1
075445380191c2ef82082461837fa207d9211fe4

SHA256
4f476060d602aa1f199972483a2206c6d86abf6776daaa06e179e7375b22a41d

SHA512
1f78e0e53689c17501e625125893ff833f227eb8711b59bff0bd44d3635a532c1404bdb4616f35cb9db04053feadee6d47f7497233efcff0e3fa7b6ebf5ddd6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
70KB

MD5
4058c842c36317dcd384b6c2deaa8b95

SHA1
1085ddb12b29b79ffe51937ba9cd1957e5e229b4

SHA256
0e562969cad63d217848a5080273d1745dc4277d210b68a769c822f2fbfd75f6

SHA512
435a67024811360b12339e3916945b0639e2d9319e9d540b73e093848a467b030e91e01917b7fb804eb756dabce2fe53c2d7ea586554ee6cfee70e652a85924a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
41KB

MD5
9101760b0ce60082c6a23685b9752676

SHA1
0aa9ef19527562f1f7de1a8918559b6e83208245

SHA256
71e4b25e3f86e9e98d4e5ce316842dbf00f7950aad67050b85934b6b5fdfcca5

SHA512
cfa1dc3af7636d49401102181c910536e7e381975592db25ab8b3232bc2f98a4e530bb7457d05cbff449682072ed74a8b65c196d31acb59b9904031025da4af4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
1.2MB

MD5
c764a116bb5f3b348177ed1b293a515f

SHA1
10bdbd5398f0e8bb180bc2773a778345529a0a85

SHA256
63cea794b8bda830d5c18a6ced98cd2ae4f6b27be723af8de0b3fd30bc56e5ba

SHA512
b33bc90182b1b40163abe370a4da6fb81a169bf11a2235c46d350a66afd0daff29a1e6959dbaf9fb969f4d32bbfd2de5ee084e6f8b8f3d3c175b6d3058306585

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
90KB

MD5
48743a670fa866d07b162f046726b2ec

SHA1
5f180be674c56c4519f531f0796b5b958c20127c

SHA256
9d436fc2f3d4ec40a0e3ae981b315036ac944d2347995d37c27b059db59ce966

SHA512
cbeb13a3ab5e6cd811bc64a14304f389d56de091db12618d62fc223de96e686545393eda1fde83ffea24468ff77953054b25a4a7a87ae2d9f61283c3ec46f69f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
78KB

MD5
6e76ea04b9c228bb4d816c625d0b26e7

SHA1
8eddb57ec522f7ede9bd0aee4981fa417cbd68b4

SHA256
b8727a045b7b3dc8a1f37052f501fbd33e19a366b5c0ebed4364d460787de89c

SHA512
798929c5902e113c9b9f953ca6867530bdc13881d39ddb6c5da6e331e2a59c83c471edbcf70e864cd665a3d9aa1b730bcfb727c17d547ed386b60cd7db8bf937

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
1.5MB

MD5
70b11b0deaffc6bb12aecbfeff9a7e46

SHA1
1dbaee16af5005987881ca0a597e755414ea1b47

SHA256
9b64caa0a568fbe8c4e5037d3fefc1479c4ea5df2ea04aa621e55749718a081c

SHA512
05d211ceff06d98752b109627d6f8064f3c9679ab60f4cbebc3e4c68d71e2542eaca33e134b37a5e29fa786fdc7b20fa2aa54fcc918713da5824ea5c60303e07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020

Filesize
94KB

MD5
cde8740f4b1b735721a71dad5e935621

SHA1
75d908a389e02ad5bf0bbd2da74ba5d5ecc508a2

SHA256
f912cfe62914c0d6e9165ad23a9a84a3791ab874b3dc0a2304c924d09c4fee96

SHA512
f35292c5d88818a5a0c069f5f4b341e5b6832a1edc5a0806475e48f135f6b048eb15a8c5a89c06a4eea7a96e4381bd483187907989acf80c7bd0a32f35108695

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
78KB

MD5
35a46116980c974751122a331d47fd84

SHA1
cd6e9014e38596c681641a27706124b5b69f86fc

SHA256
ccab92b9bfa43457f743cd83e454bcc63a768deb352fbad2d06d718eb2815a66

SHA512
aa4f484d3ca65525d5613243797d7e025e552dbd4e68bd9887d88d32fc6928c13dd7a47e8f97c77436924478d451445fa121d1bc1958a0ba94a2a05159345048

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000025

Filesize
24KB

MD5
c594a826934b9505d591d0f7a7df80b7

SHA1
c04b8637e686f71f3fc46a29a86346ba9b04ae18

SHA256
e664eef3d68ac6336a28be033165d4780e8a5ab28f0d90df1b148ef86babb610

SHA512
04a1dfdb8ee2f5fefa101d5e3ff36e87659fd774e96aa8c5941d3353ccc268a125822cf01533c74839e5f1c54725da9cc437d3d69b88e5bf3f99caccd4d75961

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000026

Filesize
96KB

MD5
a2e02ff3bca160efbb95e1b5a66450d0

SHA1
6d080baa4b93143b07d36b13ef14c1b35a2b06be

SHA256
f1918b6f060acd72598c23fe53ebe7de2a5c52cea0e95d6eaf8260041070fedd

SHA512
7e4f4ff6d63fb1dbb3956bf9f0d27266745dcd9c0063aecb4b44893a2d487e4366f8fc92b8e3d5c56daeb2f79c2f3ff3da74d8306f5bf6b6f9c9b3e7e5924243

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000027

Filesize
20KB

MD5
1435f3cfd01bf0f3c24b8983e6780db0

SHA1
439ab7ffa6f9d5b654710691d8736eedf2b6e892

SHA256
8cd3f9f312e86bade2e77eb25c28eba805707909441d49e29288944677ce6d47

SHA512
dded0517b2c8f6c6ea045ba87f3ae870df63843291c3e2219e7bdeb4e33baf360b5fdb6065f0566fd1c79253105574ee4ca8cb13a11f7e6a51bf20eacf03155b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000028

Filesize
212KB

MD5
08ec57068db9971e917b9046f90d0e49

SHA1
28b80d73a861f88735d89e301fa98f2ae502e94b

SHA256
7a68efe41e5d8408eed6e9d91a7b7b965a3062e4e28eeffeefb8cdba6391f4d1

SHA512
b154142173145122bc49ddd7f9530149100f6f3c5fd2f2e7503b13f7b160147b8b876344f6faae5e8616208c51311633df4c578802ac5d34c005bb154e9057cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000029

Filesize
125KB

MD5
53436aca8627a49f4deaaa44dc9e3c05

SHA1
0bc0c675480d94ec7e8609dda6227f88c5d08d2c

SHA256
8265f64786397d6b832d1ca0aafdf149ad84e72759fffa9f7272e91a0fb015d1

SHA512
6655e0426eb0c78a7cb4d4216a3af7a6edd50aba8c92316608b1f79b8fc15f895cba9314beb7a35400228786e2a78a33e8c03322da04e0da94c2f109241547e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002a

Filesize
35KB

MD5
0eab7c229b83333cc132deba0def8481

SHA1
849063fc7129235badd05175e71fa71a81ddbd4a

SHA256
a86edc3ac775654ba07ce2aee3571be807eef05e6404bb00832695b2d5fe9a37

SHA512
ecdb1e18f8a63d89ad48f12a141667b03090e571842690440ceea8069febb4e3e1cd4de454157a89e9d8a1fe3f79fc1aa228a27337ff4bf6c877ab7bd62c423f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002e

Filesize
33KB

MD5
9e0ac32dd76a55cd2643d23b18325493

SHA1
3f73e7c5aeb04f128ea34ceff6d67e18849b2e13

SHA256
6d9d58bb624b7353d4dec90e679e77d1f0774290d81a05c7cad7d7a77fdf4349

SHA512
ce4d0e419e3680789e542a5eb3d12b555e944cfa73e2c8596127ef288dee84dc6d8fe000284015e0f6d04322a930629a018290991cc9c637ff36aa281a6c365a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000047

Filesize
20KB

MD5
d1a4a9d5260a03b0ed9a48d77f10f3fa

SHA1
e2325d4c4e759b9fc3bb453c5ed775151bdbc059

SHA256
69714a9a171fe5cde0e4b30bb8cfdf428bc61c1da869ff113c6b7d6432271147

SHA512
012032fd0e9338e33112b032196fca3efb0216a9f09c7d109091a112fe99a74d9ea02b2dd7aa9b19ebb77e227c6eb739e254adfffa2d09eccd8c621459e6bde8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000077

Filesize
100KB

MD5
2e52bee929ab7d56b2622ae84962e0dd

SHA1
7fd648bb1fb1f069578e992972d7f22ef1bfb36b

SHA256
58a0ed06b38f7886418d565ea4cdb15345b40a1d29e635e167870f45fe14ed4b

SHA512
c53ceaa60c9591ad0e61e82ebc1b5c6dd46a7b4a1b7ac303aeced0f4a0611e4af2b7a5e1febda5fb10041d0a9c76202ed05bc3e344bb6ac6cc35529e127e9d8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00012c

Filesize
51KB

MD5
588ee33c26fe83cb97ca65e3c66b2e87

SHA1
842429b803132c3e7827af42fe4dc7a66e736b37

SHA256
bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760

SHA512
6f7500b12fc7a9f57c00711af2bc8a7c62973f9a8e37012b88a0726d06063add02077420bc280e7163302d5f3a005ac8796aee97042c40954144d84c26adbd04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
48ddfa1731abf35db5e1efab35ca1638

SHA1
4dee06d43255800f7b8097f98b3d558dc774964f

SHA256
51babb6831f164bad8c932aa9b7c301c6f8b993a812fe493bc31051826c5c703

SHA512
5022b6298c4a940acebbffde48ea0bca3b42656d334a4e07cabeae49c7d42bdd4805a2a88e9e912007749dba2b91195419a6a49389e108d25d0933e44dc311fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
9KB

MD5
f3a6e5aa324389ad1638bc9278aff384

SHA1
69c6b282c861bf7bdbcd8eef36cd59bb45f800f9

SHA256
baa6757a025c75d8712abff348c9e7dd62801c7e695df0ddedaca78e5eaef2c1

SHA512
9bd13e2e9a4fcd094723268d0eebe098636145f77b200f31455eaff70c44a3694f237ce1f706a6beb263c5938d60c9cfcc2f1565fb4504da9cefc4f80f5819a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
10KB

MD5
d7552837e6ab0866561b64e56e10ef23

SHA1
6467f96f44c0d460f0d437489ca40c7c3d0cd84e

SHA256
7e32848331fcd4a31b211d0e8d2b15fc67fc6bc60d1eb3311b295c98ac5f5866

SHA512
329f9322860d6f2d6c778e9954b9601944e90837c8f677e5f89e17da04b08abe531271c664caf9303f85fe23bf79a3e67254ad4b27c2e2879409e6166e66650c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\000005.ldb

Filesize
1KB

MD5
cbd4452d0891ae0929d8e4078c21fe64

SHA1
14bc16c9fd64a9d86e67ead1fe1d671180fdb812

SHA256
c77d9a9c7bd1c8b5a5f8448736789c2b44370815e45a0255ce718df22f5f861b

SHA512
fca5def42a9aa8a3ee31e8fd4e48d06abb7c0c2e691d39ea7a7da14a9b271df97b473914bbbb17f81b3a17791de530c34e65f9ef74e7cbc85cb1f64a0acde3de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
392B

MD5
18ae7e76822803b0dd25eded474efe21

SHA1
2e0133aa6c43eef39dc6e7aecebc1370ae4bd5c7

SHA256
4c2f363cb64486751b428bfe1d5fa82ac2e29e725f6cb6000e1bea59d4bc34b0

SHA512
6293f7f5f05c19850f0b6241775822ff3089e7d4951c58702dac3a94921c6cd64b20ffefc0503adfb120108303fd24a6c90bebd3360bce1d524071b5b60af035

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
392B

MD5
118012d83c84408c3082bdf8ddf759e2

SHA1
067c99ab3aeaefda125db6f4469f9eb372f61053

SHA256
d1dd408f5d85f8cb6b138bf7303bdbeed5704eae64f5e100b8b75d6bfab93f9d

SHA512
7f5e314db18dcdff495e3ab2b2e721b3b2fe6b2f8e2b7543a910985187272451ea0047b31d9e979f2fabf20d30cac5441492d106e4a6dc49e62939a70e531b3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old~RFe5a6a15.TMP

Filesize
671B

MD5
8d4923fbfbb3a6aabbea4862b8a55b0c

SHA1
2f7113bdff4ecb9321c1d74deb7b8df586763119

SHA256
c504fac4f8dc9a7d7879eaa2616b32afc3754ab353a1a46a5c3da91ce71ac4fe

SHA512
d02a0c1fe9adef0d197a426773df6d401ed33f9ff8b684a03be6b03dcd95cc65b6b9f2b1938d74b9a071537a8a42e530a3addffd2dc294fad6988d878ee80408

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
100B

MD5
e2896794670f13dd2d4d13b86817b168

SHA1
58089c9c0955e754f116b29243b4c834e61e1570

SHA256
7a47c8951a8a2f9d0d66faa65fcb8653970dc9c8e08cc26287f6a9c2ec7cde7a

SHA512
2a14bdee064c729f2cacc90ac8f599cd355c02c0bdfcf7a543e1cbfe8626f3629626d3132810eae3eebd4685d71b306c9de99baa86be950f3698e48fa376f578

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
907faab316f4f8b0405b0f2879b6dbc4

SHA1
75accc591ef700c76b2323c8c92fec37dcac2ab5

SHA256
c872559d63444fec2f7d9775315e14417df7ff5f1522ae30fcda9d655dcb12ce

SHA512
43f81e846bf4086643eb3218d4377aebfb2ad26b6559dbb44e4334f50d0efdfea73f834b60b7f41848ef4a523897e4c36d6333786cbf5f1984d40d48e883dbab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
d323fccda29fd34e0db262f5368e6e54

SHA1
271927a8689074335e9eca58cc24ecc89e9758aa

SHA256
b3eb5945b8c01206ade805a9dd0b3bd2c3ff56d01ce278ea1db4329bbba5f61f

SHA512
c2e093a5657248d22c70035f8fe44eb1969c22d48ec3418f8ff29c519004eae5e6c3c1ddbe5a6d2ab0d67a90a1c9a2878f8f1fd3a66b68a9416e8d656151ec6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
11KB

MD5
ec57057258e2b9261188f6e2cad97062

SHA1
b9098c17b836d33142dcc98e4c1dc36048571279

SHA256
0b7cdb20500f4910702c383973d716bc2d4b789e0dfce6da45ca40c56021610e

SHA512
6e1b68fea402da023f88aa7c46bf980c145de1d1091b74bd31e20d0212d08930d44c65b30ee57aadee5ace05712e355d09e89b09a38a8974746354435934af77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
11KB

MD5
c288c44bf0b9dbbb6ea8066521fa4f36

SHA1
78f8d384f928d9b2936a5f0d3c7c65b94827f68e

SHA256
1dfe0d2a19fc4d4a64d18bc482c3310036703e68ac0bacf9120246b37285e17d

SHA512
24f65d19db6b839f4d69699836ffbfd00d0195c2b1546b5c0bec8cb43c5077adb5a9585b756e02df6ac46dd22c6542eaf209acf20e5f7f5326ade1a383c373eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
9fed9be73550137c1398ef91f1306b38

SHA1
dcf0a11c4d453ea894cee6bd267dc2efa1007b44

SHA256
853f327596be264e0a6c7147c6631684364caf8a626eae54ab563cab50be2e4d

SHA512
16b1945d6ea30f28ed53174ff0bf9326bdfece9bdfed341ca5ba66188d6278a611c37d42e312a219134bf0e3d7b9b622079461f585ec2bafe5c7f7146971133d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
fd599cd6dddc234338263216712cb652

SHA1
efc733891e0dee2fa716d2709e5c605eb6900440

SHA256
76ba68aae191e2f527ab24d0fe040a74e8b542df631a3af16780954bc66ae3e9

SHA512
49c71e19bf655c0fe930f9cd3172c246aa6ede75177d4467a3e00b037e54879c8348d79554e79d498055bc6453eda79d349b711c248a3e37bd8c81fc594c3701

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
31140858a519de085d26369a0ac5ae47

SHA1
7ef8c1a6cff11827677feda0c1e1ea17effec678

SHA256
831f1b4f34991e0f2fa972dc52fecd011584c8784faedc8b935c514683649b90

SHA512
8f038d15e9285cfa36af7365192b441e3a629b7899cf5bc74f5ca72dfd72fec6a2d9a4938dde3ad6804733e33ecd5642b95a15f40cd85de1df0bffec39a2f0d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
a45b2ccb84e4e9c386d2c389abeb4bb6

SHA1
cb6996a6745fb4088f7b14f868ea805013675de3

SHA256
e856de304bcbc8577f6d7be89e65e51ffb11cf763e35c77e1d12dbf1eb1b8d06

SHA512
f14d28319a149ed428c1e0a603a87afa0e04155d69a7b0e5c5b9d4ad6ac247ed7441c0b6d5b5d5a6e64477260a0edd4f90d25e5c22dea67834475fb3feb83de9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
2484622565977d82651d51f39bfa8c2f

SHA1
de059bc9c6ca36df48881564146b1e5aceb73b24

SHA256
d126d487f609b17d064c725a0ef26d436ab7c11ac1fce42a05d8d253bda504c8

SHA512
c0111bed0d4d9f96af13749abb28fe96a1f05bf43619700d1f8b0ff4509a07a321200e5b70b9adf81a82bd0e2267ec6e053d4cd93976fd7fc71e949ad4220d9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
e54d813161bdb33f35797bf48c809e18

SHA1
19ca441572faa2a41e6a9a184ee918010dfba8a9

SHA256
4ba6c39115de5757b754e9d7d60badbfbee28c8972209279c88c21194c5438d4

SHA512
9c42c55a0f8da9a1647657ae03673d847487c2464f57155818eda2854f2a959c2dca63c92683fec8b0a18e7af5a2d4a36e90b72a4985b74c610f59ba9c6aafa7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
068f9584ff8550fc83164e93f6c3d5e2

SHA1
c5e3515d3d385f531bc95fa44bd231f6e2c62c76

SHA256
99a48b24bf0921eaab441b153cb249ced097c9e5b3fd44182ce5e85dee71c17e

SHA512
5232c3b9364151a90d1ddfa0fffd97183214c47c3d38c2b41c5b22fbfe655bfef64e62aa00b96c22201e04c006e0a5d9b04f31f9f10c6b48040f9f80485869d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
58aa98fe35b23666482bcc1042332dc2

SHA1
15a4e1b6bbf4818dd2543cefb80aeedb2b9d1500

SHA256
c8508baac79c367901d2f3f4d09ae872754d019d73cfb1cb3c68bdfdfcdd0161

SHA512
345139fa3baacf242bd47b13bcbf0ec38a20cea5e9c8473add3a8ab4eeb4c28f21a278d7fb4ff5c96d46041d51fd75c5e7a3445cf831a8c3607b1e049cd25663

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
65d293e5c721317889beb87627bada39

SHA1
21118816ebf69d0b3b24e90f8ea2c292ce896ea1

SHA256
5a6f6d36d5bc65d4f3802c47d476b825278f81545e7a92e1dbc141eca5a4520e

SHA512
48dc500a54384d7e38ede5f45d3ec4dffc5ea00ce7e2c1d1bf77cd92dd8885d87a94b9b08dadeb09d2b8b205e4f584dbf925216d9d3a33fd388b0905079b41d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
0c4ca304f7f79b21c06190b99e9fd5a0

SHA1
a58f9139444a00aa18d10058a8e773cd591f2551

SHA256
670c229962939420c57d4ad4d7ff7079ee5e5258b7271c2073a94f028b9d8d6b

SHA512
fc872e863268d937eb866092a7a270e990a3974ad9d5b70e5f4720b4d7d616aceb797295a88ed850a8cbca02d0bc526a4038a573e49dd62fc3cf2bbe990e6dfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f8ad3c9d8a27a525df30eddb721099d5

SHA1
e7e8058e13c7b9d8eeca3a8aab1db19d262402f6

SHA256
0d9e46864151ad8602bc457dd41db00478371ec32ae74dcfc7c0270bc398440d

SHA512
454a792c2d6170ca9b7794965d4b7282c0ad448a0a2bb98e6dbf7fc9c8e07fdf5a3d78076f267a78b3e31f4001f4ffb2fbfe4420d433281794d10ebefbb3aa6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
cfa8b5cb693e0752c1d57a7bb8d70c93

SHA1
72a74e7888a83b7bc293fe4074e9fd19b03dc31d

SHA256
b38df340eb107959dffc135395495ee3dfd6b0742563fa8b0269ad32550465f4

SHA512
6bac8be808f736b1fba4bf825c4b3527745f484f3e0ce1048cfdf2b013c4227326fa4bf65af618020add69c3d8e8ded97ddd99879c0cf01146e6dbaf82e36195

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\198b1dbef7ece2ad03770a72810f2b485859f245\bb520d08-1570-4411-a81d-676cc4fb5231\index-dir\the-real-index

Filesize
600B

MD5
45670c43582251ec36a01758fe822472

SHA1
2e26ce9e1309d1a3c0b3485f4952e3e4763263fc

SHA256
da8702741856e5b44d60fe6940c0ffd675180f783e6499a5597e1022aeaa1103

SHA512
3cfb12fe763497ab8d248a9af4f5aeafebb0db885a04ee020cbd2a03b505ea0bf9b8a578b3d38f038301d3b0904467610344b5bb57075ccd9f8954f18f24fe3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\198b1dbef7ece2ad03770a72810f2b485859f245\bb520d08-1570-4411-a81d-676cc4fb5231\index-dir\the-real-index

Filesize
168B

MD5
ad104b612a4d2c7b4756ef5f5f663354

SHA1
8ed97482e6d233b08871f51c03e62832ab2a63d8

SHA256
c326c39b5c914fd4a6cb89293cf350eb0700c981c110e3ba0b862882407e03d5

SHA512
6ff6054e9767daa5360ba31d537f31be84e486042c8846daf687ff1d67c5c7e21f1231837c62c28cd710cebc521ce765ee1a94677be8ebaa4943b3a46312e11f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\198b1dbef7ece2ad03770a72810f2b485859f245\bb520d08-1570-4411-a81d-676cc4fb5231\index-dir\the-real-index~RFe590f19.TMP

Filesize
48B

MD5
13aade5e52c50853ec89c00665c56243

SHA1
7a1b636fd2f6c54906d37cc7ce79fa99e9582290

SHA256
c0d12d45d416fd74663ef6c572d75878fcadb494d5ed6dc399ba97885eb43fbe

SHA512
a5cd90be984cab8c4707f4cd5dd9638138910aabf2baf057740ca714ed95d1eb800e48a29cff00f17cdae3473ff7a4f4f277d80cc4ba5dbd690bbbba967fb644

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\198b1dbef7ece2ad03770a72810f2b485859f245\index.txt

Filesize
95B

MD5
94aa82d7ef214fd0bec48468a330beb0

SHA1
7400528ee704653826d38839236f70540659507b

SHA256
94799aa8bc51a11b624c5027de2ca605135bde620ccc4fa75fcf41cb6ea1a662

SHA512
09d8c6e4534e053f6af97ca860dda4fc963892b8450be5d9536085f3844d1ca2b86711b96f79019f8b5ea798a1831bfe8d8c7528b530a30acc646430df37ad0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\198b1dbef7ece2ad03770a72810f2b485859f245\index.txt

Filesize
90B

MD5
519854ae199676bef970b1257f8872c3

SHA1
c111e5a150c73bf22a25a11ca83b10479b1fe353

SHA256
2b3aa3bc4d4f2a8189d0383bbc23a80937a2d7db567d5eeb9a7c4bc1380415f1

SHA512
87f4a246ec10f88f715c1f5f1d5400d60f89adaef0a80b8b749b0a2fbcdbdae1b0de1ca891aa55dee566cbb88c64bef1843374649d4a794af5a0e8f12bd02742

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\198b1dbef7ece2ad03770a72810f2b485859f245\index.txt

Filesize
91B

MD5
06c705c3ada8f44743410f0f13c5cac6

SHA1
5de32b80152b83f595bb32b373f9264c7d8e46a7

SHA256
3a2a9d416dc059bdfbd2c2cb9d1ba5df2dd76da9ce1f4646349a4b7c58eec680

SHA512
e77b215a7342673f46452fcc0b30d21796ecaa1f19277000dbfe397ff62e30d89196ec63016e100f0f61e8787be8da11c7ee739b74141bda5f15c1a88781f849

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\32cadb2b6d359d069dd3f3d132c212a43d223701\index.txt

Filesize
99B

MD5
3bf6e33cc244cddf4c8edfce510e7479

SHA1
58f0e72b0fad87ab0c2fae0be3af5f31993c576e

SHA256
d7f6402f83dbf9da0a87e102c51331d05cc783252936fccc3c32b88d8c17d907

SHA512
e6cdeb437ec17344c1f88fb9cd16cf203e800906396e55f54fbc742cad87b7fa487a19760066c0991ae9b56835e68e10ac1d8b8199c7ed5ba6304880d5af12c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\32cadb2b6d359d069dd3f3d132c212a43d223701\index.txt

Filesize
35B

MD5
343859b4ad03856a60d076c8cd8f22c3

SHA1
7954a27de3329b4c5eefd4bdcb8450823881aad6

SHA256
8c79b653c087618aa7395d5e75198da7d3b04c08654c39e56b1027f9ef269c2f

SHA512
58014a4e7f2b4b0d446fae3570196b8fb95d0d1b70bdab0dd34a74d6c62cd8d7ca494a486f19c1a829988a3af83a08d401f18d1769ce1799a02ee09807234254

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\09f6e555-ee06-4efa-8617-a8360eac6f53\index-dir\the-real-index

Filesize
2KB

MD5
b886e2bf818de9f5937a4ce8928a8381

SHA1
f1eb00a893b7de83c0ef7805b6dda61fb0491ab6

SHA256
f8323f934c57bb4a19405f87498b4f696234e5390afb41f74d8e32c22a7344e5

SHA512
ac8a3344e0ec34c1c2fe8215c566b61dc6f20645c4410cae39b162fd39997882208c6067af677d0210429d17a3f0c93fedf28c673cdcf5f4ad13dfc6ce84c807

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\09f6e555-ee06-4efa-8617-a8360eac6f53\index-dir\the-real-index~RFe593109.TMP

Filesize
48B

MD5
888007ed162163f72e035a0cd227b243

SHA1
eb331b6c75a36db6e936f998ed8a5b7ab9245393

SHA256
b17411f62ddb3df327a092df257ce5b4bb311bbfe75ef4e5643f622dd25d0662

SHA512
aff1c941107d5dde06050f8fbd4e225d15e81b00f733274fe65be1b0126c151b4ce746568bef889474c88abe52c3883b6a97a519940ff26e30e775558e8f432a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\81a72ee0-adae-492e-8b87-a102a36f09a6\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
03a4c5dc9ac666e198715f914e9a43fd

SHA1
1d057fa3bdac4b9426fda156fea23c75f3f48cb2

SHA256
0fbc58cc9e6b518558bba7c04ede5ee5ec205affa389f05873dd7576d9762d64

SHA512
ee471d7ff4777c284daddf437c177b91b72628700015485d8e4860061416f6330b962aba72d0a5fa462c972d4390920d66c7278d4bae39cef82ab3370b929f15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
8fc93b0e3b45af77d91c3cb98747a476

SHA1
88ab56132f3d0ad30942332ae807d3545e763abf

SHA256
ecc38a364c0554632f58585087e95fbcdf4acef52b486cdefa08f3bc754d2528

SHA512
7a0235bc41ee38cf80729f7cac34cf8a689bbd4a4f6f9a01ec25afa5781e5c5a628e07c37d4983ff3ec32bdd29c058af4a0a942d7169eb16058a31985d6ba151

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
8519e8e7feb092cd6f324be3abbbee89

SHA1
a0a70ad723b6cec5d71bbd885d8eb627bb48c125

SHA256
fa967186144a2090eb0b9e446dbbc8e3e9c7e85f73207d5cc763b1a468c9ffbb

SHA512
9b22281b0c415837d667efe22f010cd436ee3da7404694910741e72b474ea5473e6bd8df1afc9b5528c5f2dfdaa6c5b92915552a497b358ddd8d2e2bf5c27219

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe58fa78.TMP

Filesize
89B

MD5
f28f538b3f5122cd0360095be7fcea66

SHA1
411f67ca2a51d9251764d5aca9e031ed2c726631

SHA256
157eeff21777aa723821838b2bfccc3b382bba6f481a82568814390696f46469

SHA512
0e142b8f1d49b1ba8cdb157a8bcf70c18019e15ec1d007609fc111a2a2c7978cd9fce005fba736e5fc1818f763fad1f4127fc0eacc768130ba960c282de1d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Filesize
122KB

MD5
f22e111a6a8d23f7bda44d8eccaaa45e

SHA1
c4354a43468a81e84246fa0ca7e0ef3a15015b77

SHA256
9ed063072867156ccae162f6cf138648ecb8755907e9356d5eb0a1f30896f118

SHA512
6253d75f0f9baa561521531e96b6b0d809491fa39e73f1def7b7e1600aabf8d9dd60c139459fcacc1c4f39ed17ce616eb2fcdf43ba93fad57cbf1567485609cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
43d0b29f298823b65302aaffb7951cbf

SHA1
573d0c895703ccc20e81ce1a833d6e58cb0c1318

SHA256
2f9dc9891cf40b2c8ba8042df9c6043550dce19fe3db2fdbd69def9cc33ac395

SHA512
8629329dc0ecb000afe567bc8a85f18fc5e384c1f0afdf1ff7c5c6f18a2fa954219c62950b88c9a00bc1f1a84e859804fada146f11c407d2b540a026c5992ab7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
8b5242f2670a54caeefe355ad5347d7b

SHA1
15be330bb43a99665a093aef14a8665944d443de

SHA256
bffc550e3d359a360c9095402e4b130bf267f93fc743705af21586713fa4f299

SHA512
1ae2dba83aa6fa8a1abd34dc5360016748597e8bd3e961cac46a3eec6c36c2417f7cd01824402df92c02c25bf2937f8fa3cccbb736a81b1bfdc355facf42168d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58ae9a.TMP

Filesize
48B

MD5
30ee120fcad846a37fa320f67edfec71

SHA1
074ac0b7944bf348dba1d06565adf3de7000bdbb

SHA256
de382165c0026863346e229c4c017347d766a3dabe98d6f946da89e4397152a9

SHA512
0b4f3d27f9177286735e298261263984bde06b4b1884ebebaae5e90b638ac57416c4508918386d2d9e41229fedf2f8e2f63327ba07b238fc06fa105832d04270

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
05571045fbce943275e919580d4ee9df

SHA1
7a75213d8cfb032f8df7e9333c85709534640795

SHA256
726c1b5efa29a0b22176e7acfe958f1548a67a211305c827e9234b66c7102e93

SHA512
4fe29262db4d6d494b0ffa1dea3859bc29d805c93258ce56470697ed95c8ec69a7b58270b54e96f9aa8308c280d859afc14fd27e77247961b44e69404268d905

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
dceb8a05ca8d38153068a8b01e639ca8

SHA1
cc2bd0d4de6f6c99b9e6b69677a7dde5d563f24f

SHA256
f0b398944afe565ffed34e814ce706a3ad91e47e2632c569a2b469c744e0370c

SHA512
da439c14f78488f6ad9aa951795e571d5d59bac08757c885d08f303e9b0603ccdc3774447c84ad3158424c245d6dae66e099097bb7ad2ee7aa4c0e053affc72f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
246e6448f0c4558af14ee2bccd3f2ac5

SHA1
6c155023dce02f20d5cdcb77f871c59d82a5bd3e

SHA256
886bdb4bd8a9c176e8f0edb70f20b1f8c113b312af669a9e61e1a90af4857afc

SHA512
95b9ceda5f905a1cae7c38643e8796690a97bad7787f0a2a2ff306d7da068dc39245b55ae52e64614fb7d8b8796ad1fede609187a0f86a0cfca5492fa55a336d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
70a897b3cf2cb646f45e70c5032dae00

SHA1
4060b0d6790872c03e50d444e0cae63bfc53863f

SHA256
f181485f12237ad4a2046433fccad89d16914ee86e394c6de3c8b205ab9621fa

SHA512
2ef5b0adcb530e1a46e27a0093f83e3d00526231ac67682c3bde0bd44e3aca06c61dde5a7abe3ea151bdb18f7fc58be7aedaeced04ff29645c722fb671a0e7ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
e7bc949086e3143141bbd8406bf0075f

SHA1
56f842bf1586d2c996e20c0278852c2accc3b0e5

SHA256
8aff7ea6db46cd116adef24ac0bb6e853e7d70cca0825973861f12a88bf70f23

SHA512
e6fddafd879bb62d3695db48640fba0e01c6315bbcbe9d45316bd82f4c4fc2ec5bbc2b728803f934d14cc8ad8a53c610535c8e03dae8fd8986ca1bba73770ad2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
8KB

MD5
2843fbb34b96851057512be8bd422897

SHA1
101cace8d604570ae03b708e4fb5f2603fd5dcac

SHA256
e728ff4c827bee967f108a9e348977fbd185e8850375ea48f8264e134c8f3be1

SHA512
5128dfd7302d819470c2a0b821bdc7126cd16aecd115f61d3564574a9fe7c89f30d8398d4d3ffa1661207fa9f66c4a6c48b005455e92967ab59488de4766c8a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
8KB

MD5
5b333dfa0bd6e230427720e4b7490c49

SHA1
d5c0de00850562d31d80cd577da08bb5b2bd91c4

SHA256
99a28bf387892619c02b3c5d14b2c6bd77c4df68b68a3c7297c73245863c0da9

SHA512
6f2888247095157f0c4f18c3ae9bf165b5f9677096a6cd89cf430096c588a19323a877c4fc412030db33b04dfcf7da86161349a4c553341e797028a490d522fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
8KB

MD5
2e7ec5655f508752f6cd371fd2638507

SHA1
a3a6d6bb18a00d9d1c26b890d208c0ec9aa33dbe

SHA256
b959788d9014eafc776f10357abff519cef8f68de0f233834a2aa10954e03c43

SHA512
c0482b9ca2006554081249290d3090366db388c149794a95871bcdeaf0d8c8d8248d794fdd228e675ae70920fbb91bb53c97bb884381458e03c9613f390a1c99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
e25c5bdd373c495f0f25f239edbfc1f3

SHA1
eb2aa263e9f9d989842433d76642f0b2ac25b7b2

SHA256
8eae6bd83c917cef2a069b845e0e3ccb03924f499d10212eb6e91f9ef87bd39e

SHA512
01eb33d4a875b7c38c83b22681641bd023234843cef948e94f794504ee19ef4018770dbf635958dc0077145ec243c5d4768dfc216f37a677399cf65cda27bf53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c8f7a7c7e0b8b170562fdadaac900994

SHA1
1b489475a408842ad0c6b53cd1568fa953aa7d92

SHA256
d54f9ba7302e474b5b7638154db2db0a02888df7e209d21cf1480b24732c70a6

SHA512
309e5284239871dde790c1ce0afeb4e1c372e5412fb054dd8bb53b39e7acfb8a0b66df808feff54ca1c65a7c0b4bc9393492a2fab6e6e453f9fa6bfe403d833b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
1978d2e0f9204dd447a5f6f9701868c5

SHA1
016b918e387e053fc6e8d86b1f2380238088f68b

SHA256
b9223e82c34b8fe5b12fa4643928652ddfb5ac795ae562d5f5c4638f28754497

SHA512
cc665726b4f54f5ef5da906845efff63b577eb00b81d096c51898683cef90747bf131ca9701bc7bd86610298c11f073f8443d9d4a5d933e09394229727061aab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
9e2e51546efb8fb2d1006de2b0ab7330

SHA1
29f0e2c8152321147a55c93d355faaaa5cf0deb4

SHA256
4d2b9b8fe5ee0f288e5e1e9ad1fc3653a444cb8d3f68a656d689675e946df42b

SHA512
5db0c2fb9dee75e35659700d2592cdbc9ce09d16e60ed26cabf4ec0db689e9cc28d1974dba15c4ed90f1c6c837ec9b4ee7d61c02e351faa7449b89af5a879de8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
57935ca31c4b95ba19df587301fada23

SHA1
788afe5ac9ac9d252cc63f1342624c6d311eceb0

SHA256
b0dc0e9efe62851b5af9a04549eaeed46eef627d314d0491c2a0102c032fd1d8

SHA512
7e0a4b2376b90f936305dd073429645eaa51d85b8750b7e6b9c5837a0a123a724f729332dffbd4fc37d70b9360b77fe8e784a9c6262ab4fc6382b0635e0b47e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
111e5c7193e929775225f49cf5843e90

SHA1
33e75c780ba73b70aadbb18546aefa26e69eb948

SHA256
7ffb4a01de0bdfbf8f624e2a9c52c68a991cd3e182d950099f6881f1a475799f

SHA512
eee6a5a79d11142495177b665d38e8c659155a0c84d7d8027cf53eb2085d303ac57123d1246ca7b7a0ade4cc379f415f3c6bbf710925874c25c367cd9125fbf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
8KB

MD5
e61d17efd4ef8baea570b8c179ad9dac

SHA1
f49982010f1986ba534030d750015e934477f085

SHA256
40e26f6198b4acf55be9e37a672c025ad9f57364458df79ad01942b574f674f9

SHA512
b4ee927187e7216e958903d6b7883a0a703de92dca9d6dc1cfda0c085af1ee1e1f824f30e4adaeb9340bb77d776c20dc1d33aea51b5f9bab3f61ac4e5b266e4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
8KB

MD5
0ad6bdae87ae98e28ef6e92a37d20b83

SHA1
78957c78a102aedc0fe7c727a1d0537f25754d3e

SHA256
44fe664bd0fc4f802eddcbd2d6d81edb08267eb40372f328214b1f3db09f9e78

SHA512
3d9dcd9339423a1b9276142c650f23b6f8ff09acbb74aa4635ccd2c187a9332abf3ff77405ba07c7de6a8662ba5897c92c677756f7043f4d87912e360ce59a4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
e934d851ccab7cfec37839a334654fd3

SHA1
e09dd48428a78dc3971940cdfa54d6c5225ee2af

SHA256
0801a48a79e95a3ae4f6f3a309741e14435a0786ef63054a123a483a5ed0271f

SHA512
c8e7d6e25d1a70ba58fc2a06313becd6f7343af2248b66e48ef90f0372fb188eea73cb00de924abf4c4f075d8847eea7697a441ac57a226efd8408b84c502a25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
509f6cae0bb093a97c0edda8eb005a09

SHA1
20495ddfd32062773ab82e082e631e3b44e909e0

SHA256
4b5d3070027680a445b52071b7a26498f091fa82292f96a617933624a01af463

SHA512
715c3a32879d0681bbb43bb0567aad7705594aced2e6316059c435b0c6b41f2c5ea35c47684c933cb8def16dd394f2119d4aaabafe5b00c8266465c5dcc77955

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
76a6a56956a626f6a3c0d1251667ef09

SHA1
ab87035b15e84fb0c07bd5e224504009a4f6ade5

SHA256
ab5738983dd557c2894c6fe1772a59283c369ee16eb3d0342887e2d73997ca8e

SHA512
37294d7469c743be6ebf438f5239caabcb746bf411c40b03f1c9a3389fac2ffe381612f961ad32d207e4b789d0e12fe714f36f4f8d0657dff57b7c1942c8178f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
8KB

MD5
533431ec7320a615a7cbf04398eb795c

SHA1
131d00ef69f913a918de83474ef59748acb4e94e

SHA256
7cc6d0e53a247c9425a8bc04147e33f355a97348b13a6f70148e0cb69227d456

SHA512
3ec15d08a3611dc54b9f673b6c6b8aaa114f1f445f6ec4a4409fa06b7cc99153b2fbdf3b105d1ae72377a557a5c9ea1fef287063c334a6f533ac9368510c0019

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
8KB

MD5
39013d959160fb4436dee91b2e447aaa

SHA1
fbecb570c0c0d523efed018b5a30b0d71e2c007c

SHA256
ca5e12f874342e9164125d2415aa5b08fe7a71234194a44f5775e0681ab30fb8

SHA512
984645c79f138925fb0bc3c8fff23b7d1f522f2211e45c1fd14aeb9d0f7ff560adaf8fe148cd20283667dd7e883f99f8a84af26cfa3e64c28269ebec8c9173b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
8KB

MD5
c9969409391ad7b4be56a0cc161cf2e8

SHA1
3a48f82006bbfb0cd945ebf768933e98121b3181

SHA256
387001b20efe439c1698aa069f8ddc5d4c7a32ed49391becb296426e5b525994

SHA512
b6b3dc9e3bf2c05ec4c03d64e6d3a82505c2c8526a5b86fa17b2c597175d8c3a886307dbada217394c1457ef7e18097811fe62898ece2d7a5da83d5e88997f49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
3a51c7d8b7f7691c5b2a79a1eb087f4c

SHA1
0a7ca4b629565b46fa8efcf3686ffd42636de6f1

SHA256
2829d9ce08e1e4113be3a07932ce41de5c90bbfd02504959b3229fe188763bc8

SHA512
0a83d40379bbe6d4ec88930fbfaee76e3a7d89fa0f9b230babdb17831ff4b5480b44984ac4cce9abe271e4ed0d3eb01d9f5f974f0e5ffe45bfa436619907eedf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
8KB

MD5
483fb9c2cb34b455c0144e7893780990

SHA1
788f67dfe7cb10e9d2b80edf3be9bcea669254e3

SHA256
fa879b0baa7d199dc5d7075373376132d37160ecc2199d0d762e0f8141df08e7

SHA512
58bb229c0ba12908043139567b670bff15433733378b3d94094fbb93c00741a0ee297aeba6f971789f23954374b50fbd805b9bae9bffe251de2206b661ba6204

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
d141a04002e19e366b324f3fa8e861ee

SHA1
6cd6688b3763bd5260ffcab4e47ed8fa270b1366

SHA256
7a11523437fcfe8d2c58af44dcc3afba58098f3c15de97c6265651b9d69ed91d

SHA512
7e6dc71d413d4e6628ff5a717511b5d10c525d77ac2274b3a11d9a6c0b7a4696e73fc64cb3cfb96c0dbea70b250fcd465842a61954a9fb64c91d515fc5b8fd5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580c4f.TMP

Filesize
707B

MD5
c24d0683dfe0e1c7def8dcc9400f42ac

SHA1
ba8a57a0950ccefa868a42292d89bcfd9ea9845f

SHA256
06286b6cf7458a4dd9bd3749cda75ff151c3772d3980af6de197ea2b2a5c4874

SHA512
677ba7905f47bf7a8adec1c78d3988475ee4d158cdd9108995d39bd88f8786db184947f913a450e57c72446b8d745917a05d39e324d1c81af9bc2e7bcf08d2a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c80a24dd-2bf4-46e1-acd1-d13be9b39a9d.tmp

Filesize
10KB

MD5
76f553b9fef09a89d9837a8ca69465a7

SHA1
14bd23a9d70c5a97ba491b8fd024308290750fdf

SHA256
07ad5a8490c6d67b8dfcf5bbd6e45926631a14b08a607e45e3350db92ecc2b3a

SHA512
bc2012299aaf4bc3224cec1f4220f8bfca286556e41c1da8b9c31491415ce6b57b6bf09a5c137665135c84c2371858453878b6a9fcefd31cad09fed65fdd9e18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000004.dbtmp

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bbd234a659c703c894deb01f53678bb3

SHA1
55397c37f3107ffea06ee053be87f28097202caa

SHA256
c74610d4f95a84d8643c85e3bb800f8e3bfc885bf12ac630aecef3d1716d5578

SHA512
4942822addf1fe0380fc0518ac0b210fcaa0d694474205fe26357f2e35d5385cb1ae0c23327cd47a1147c0800e7bb7a377a153a0008b1c8e901e63da22b931c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5d37a05c776dbfafc257a9417392112a

SHA1
b043e46ddf1911751ae48860ef354e21b634d305

SHA256
36664cddec9c2703a27f41b2037b857fb3430fb961a6c548bead31d8d9c6dfc9

SHA512
d21103da2e9a2d88ffbc57b165d4e58b9afa1df519ccec3381a269348cd5929bfb07d279fa08b7cfa0954b4286adbea67f01750ed4d1d2d49f5b305078c24bc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b0d825fcb51d80a107d0a7ebdf9f3ee7

SHA1
f4f81f6e3211187fbbe7dcb1343bc8315300e41e

SHA256
fb84440d8aacb41901aa4eaced3e18698ee32273deb8f61caa10ac2b59ce67ce

SHA512
5babc35c20c6ed678e484e63ed81240a39883c1e72fbf6d71b709e41bc63ccc76a9d2aca0b0cd77174c96fcf354c9c1df75e0bcbbec9d6a2484d1f6997f5ef55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d99881eb571f0889027577733f103300

SHA1
ce5167fad69ee15161a6c8807fc1d678f21ef316

SHA256
97330534d4d67ae0068fd719f6a5f8fa7ec216ba5160b616d5ecd27b4b16bcd2

SHA512
6ad7633577e06d802ab6c8febc31ae36c7366125a8410e7cd554ee0eeeb0604111e5048650869cf740888749711ebafa80088cbefec8f55f2abfab6e2ebe0839

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0780d2bf1f01cc2681af6dc6be8a7d01

SHA1
65f91514378c11ebeb1d345edd0e4252a4f5dfe7

SHA256
9d53837cdf3216891064cad6e5fea6c04a9356e85af677b9307a2448f48eac6e

SHA512
f662ea0596daf3aee5c1eb0702e727599889687219682661b471905310e135f0a1f4a095022bc55dd3cca2c7ead708d0be66d12b66e5af4aecdf3bac87864f3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
efdcf7cc75ef081828ed5e3fcc038843

SHA1
d0c4b1cc0475679fce3f5fa617dd6f092637a049

SHA256
f941fead967191b3b2061b3ed98995b10cd9d891df57d3cde1b1fdfac827d0ec

SHA512
96c6f069b566571e2cad604cc29922e44a259e8dec40f5320438c206b49bdeaa5add882401d63084a4b8cd3003854961c62c3c7fbf66a8a901c0c5de6b9c3b60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e27a146ac898db79e76026680fad9eeb

SHA1
f61230910862bba533900ce1b169312b881e0889

SHA256
3d71fcb63d3ad3436424271ea1f82bcb961d7d17f523360d91895d3cbed7db9c

SHA512
4c2c19c9ffa65a69edf84f7fbc66a317c0a711880f2886579ffd447179d8beebf05103a94fc28fa5a46c60c57d5129b1b311c9bbb56916724f6abbf5969f28d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
0080d7780464ab20fddd307e76e30a64

SHA1
631e02ef5e46219e6485fb779435f8398e3363e6

SHA256
593fb1ae02472e1dca93793436daf341578ae7fcd46d254039cb974023ffa0a7

SHA512
24a83aed2693f3ae9ea181d54ed9f0ff0602ab2cfc7b3824f0547548c0eb81458438a5bbfedaf3b7b29be0389afef3837e3a7de99e38dcc78e34c65b03507ffd

Download Submit
C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\fc50e85cb9ad55cadbda754bdba12554

Filesize
5.9MB

MD5
fc50e85cb9ad55cadbda754bdba12554

SHA1
e0b5545f4456615184ef9100210bd07c93aa9873

SHA256
e562e965f6d076f0f779e0c44e1086ba697614bf13a4112082003f4fc4fa6e71

SHA512
eaf666e530afaf3ed2f22a132c91ff10a0c136c68668717af54b00957cc927761b0e8bf1b9f6c2973bbe70fc6c467d588d209ffccedd3e45bf14a4e205201717

Download Submit
C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Crashpad\settings.dat

Filesize
280B

MD5
940296d47082d307881d4e781e505417

SHA1
2110f2ec22617ec21cd7f4f031b9bf40f3106272

SHA256
033001942bedfd4eb534c1ba7001a45070d285635bd86c41ef2e8c4f017d957f

SHA512
cb0946f2437182c4d3013256d6e8dc9f45d8d10a2bfb705f9deb6f73aa6acf62844e111632b476c0f5cc2e57937b8048eabd2c827585bf29e47afdddedfd0d77

Download Submit
C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Default\87595818-247f-455d-998c-b1d36bc7371c.tmp

Filesize
6KB

MD5
d2cf4d5a56fe636dfba7f361f91b8cc2

SHA1
c71c7d8b608ff85d76d83c984b7b80554e48c03f

SHA256
1e55d7003672c9e624ae1ee080021eed2d5947bc7bd9efbc68c8d38596dd819f

SHA512
700fad3d93e4ce092440b988ed44688e696d06dd2eb3a727c6366113ce6751effc99add62bafb878d744464f9ea62fccf2bd5fe35769b7c152d420c82dbd869e

Download Submit
C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
53f820031f6c9523ebd895ceb6bdf73d

SHA1
68bc487a8890fd37ac3eb1dc0dec4cc90d3cbd48

SHA256
7ea995f449fccd7b999dae969dafa0357d672063505a710419f13df1533d1d2d

SHA512
61216f731e1af6fd7bfee89af6bb807400af1489a1d10a9107489ea6720f95f2f2f9e56f1675d71481c05bb3f9383b9f74b72ec85e0bf54c5d77aa83e3f4edd4

Download Submit
C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5d908b.TMP

Filesize
48B

MD5
817ae1abc778123953e4836be571c0cf

SHA1
59ced8f2ed3d3896f71c2adafcfe3b089c266206

SHA256
b197d9ff6ec7b453fad9c73873e8e18baf78d0014cd43ddf39ef43c4a4416c8e

SHA512
b04e4e37b56e87bef9fd3b77f6c9459db3476fce2e86075052b82869cd8cf0ae4449cb513f440234f1d1ca662f6f4c87d0754437a3422c16592fb2ffe867c888

Download Submit
C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Default\DawnGraphiteCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Default\Network\Network Persistent State

Filesize
827B

MD5
504563e338411e13f0c20cf126087c17

SHA1
3fe884079d0675bfbc47bdc51c604b169272134d

SHA256
af6b04bafdd9ce2847a3abad0e6368396522aad32df68b62ee104ef973f256fa

SHA512
944136340cfff7fcc74f0a2e2292134c30ac0346acbe765c439b8d3662549dd4e1f3b14de36f6d2237e897821448a5ce1b47cd1d3a5124f9de959ce38cf5ff09

Download Submit
C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Default\Network\Network Persistent State~RFe5e536d.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Default\Preferences

Filesize
6KB

MD5
d65a316128ec7b604da7ac09bd6ff93a

SHA1
e05a99f8c24b3ae93d0587e863758521cde3e83d

SHA256
49f1249f67d1e44af98bd492b3bb54cd51d5b9d3a7f3b61d984cc35bc34e1688

SHA512
e08411e31c117c1b1c61a1b576efc1cb692cd23cbaa9d109052be10972dd74e0af13b13816da3b21e97feb61473178d07df39ce796a507ef76eee4b05cd308cb

Download Submit
C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Default\Site Characteristics Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\GrShaderCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\GrShaderCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\GrShaderCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Local State

Filesize
1KB

MD5
ae8158babe24239cc4eb73c59896fcf2

SHA1
3c2dc8c94cd03d4a818cab06cc0bcfa2b6029a06

SHA256
327ca37d966064c2d8b81b78410c322d17ee2e0ed6d3d9f14bf37f71e7bf7f1f

SHA512
b092422522e1d9502d6c78b16b21a190811c967afc65145d7d70d0416083f55facb579e57fe5cb6171331a2375794994ced2efe8c185b35c102d8bf33634ba75

Download Submit
C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Local State

Filesize
2KB

MD5
249fdad1b52fa0bfed8388d47562963b

SHA1
57f5ff07b80f31966100a0864dda80ab1d71d9a1

SHA256
6de0cb603fce23165276ceae0fd832b32ca7680cfaa6ec9d8894fd43eb1e1f34

SHA512
f2db1523f622a4c3ada25c7177cd1b5fb969a1cd4c39aae9bc341c6f00595f3da0051a95adc37aae94984a16435e24959efbad9eb5c07fd18fdc7382d47ba217

Download Submit
C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Local State

Filesize
3KB

MD5
4bd9b59ae7ad6e0ba7b989048e645fba

SHA1
ccae529042f3b26894dbb7524a1d32b954337053

SHA256
03cd290b5b678ab8a2e207ef443d591baf755f7fd0de4c7b3f6973ac6bb3f948

SHA512
f38fa7d25c860d9781a8eab756d9c4311a2943fbd0cdece1b8cf37b98ca74afe6869031d08669f7d620a9022f497e9de021fdb8f1b361fb924e0ea494e544043

Download Submit
C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Local State

Filesize
16KB

MD5
f048dbceaad4939c9858002c32fa6d48

SHA1
e30d1ae8feeb72cf66d825bbc0d94ee3e8c58c42

SHA256
e2ab444aa34a0dfdf2f40cdf01aaf2df641b6817d5dcbaa22e9ef41ed86a8040

SHA512
832649865976d85b29397bdc530095b2c87211cf5190628d8f8b52249d17d238f0514e389f819095759c2a41d5b2657598f3058b8c0875643517cc37bc7f4fdb

Download Submit
C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Local State

Filesize
17KB

MD5
00ba12dbb3c5080a740d0b42120fa309

SHA1
1095b47ed3036592eb1e5540bb171cbe7d195c62

SHA256
da31976707ccd6529e0446c91f50b3483e0e590dd928c801533de6a52a8a5137

SHA512
68a444c778f5245286e291bba2c22e8999b740b9f50913d7a8f03afabed7945045b135ddb6cbf918e9adc6afba703498d25cb6f78c97ad98d845e8f0681ad425

Download Submit
C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Local State

Filesize
17KB

MD5
68e0ed483b58eda8f855d8c9757afaf4

SHA1
b6d5061e19025d6d189e4d1dce98d6ff435fe732

SHA256
26462a69c9cba5a1596452ba73611777c9baff5b314c92ff75e84a49bfad3ba1

SHA512
db4d76445e22d44a87bbf25ffa1ac5cbad8cd251ca4465ac74b84d1b1addef355620e08912e912fb13eb9182d0e6e43c8752e0ff6b8dbac0bf9270147a3476c4

Download Submit
C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Local State~RFe5d3f6d.TMP

Filesize
1KB

MD5
0db034c7f3a6fe136ece9ffcbbbbbf62

SHA1
9d71bef7de80bfb36b2e22e8c124a14a5ef018e3

SHA256
cc1683e2a8ace89e3b652fbccab3ffd338d2530b4ff7210b57ab8e8ee8d204a8

SHA512
27dbabe0734c52299ba91e69be17d2bc3500b69d402483f0883d49386569165b2a734c13dd9298a6ef84344e1ef153d7f9190a6403d31f4cf2b109dae528e247

Download Submit
C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\PKIMetadata\13.0.0.0\ct_config.pb

Filesize
7KB

MD5
df3d937079b894c891f9b0b741874928

SHA1
ed93fc386807b3a28fcc7988a88ae4741bfe1b15

SHA256
c7cbb0db6e924cbfccf4a6e8223e3fed4d93f5d78a3122c30213b6e38ee195f4

SHA512
5728bdd930283a4906e7e07acd3eadecb813a3154ffb41729738444bf13aab27dceb01e05a27c77bb13cc498c1d5c2d492ac653ddbfe4b14004b1c7a5bc54f1b

Download Submit
C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\PKIMetadata\13.0.0.0\kp_pinslist.pb

Filesize
11KB

MD5
d43d041e531dc757a69a90cb657ef437

SHA1
09138b427565bc276cfd3ba9f59b0c8bad78e91d

SHA256
9431360a5534ad2f8eddde157cce39704b99da035fcb6d2cca11220700b11ccb

SHA512
476a98122059b9cc19492b7ae557c61381842c8c347f85c686e0a493bfd0e8707ce3491b690e7978b3fb7d7d2a4daa2767e4a590398a50562519bf32e8d12ec6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
e8d868e3008baf8d4f667cf80b8831d2

SHA1
6da260ca72417bb71c4854722e0d90fd0d21995e

SHA256
f3d1e8d198273200e492dfe8a86d3a2620f20a0943c2fb600e58401c05c856c7

SHA512
84fb6661e6fab5f3fdea6b03369962fdd7d049caa1d96a377817861612e16f92551e25c6e73eb7227caba1cd6bbdb1c208c7730a00ecb34e9d92801f9f370f92

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
de3c85610402cb374fffbbf9d44f9115

SHA1
355882114e81ed12c8024ea9a9ab2773b4d1752a

SHA256
78094479bb6798fbe19fcf8e5bdeca9945167a9907f0e7f87a22d6eaf79587ac

SHA512
a6248e2b97cd6117afa37925911595112d33d4c57f630103004d79ec0403b29b0d63857c9f1a3f5c6f0b5b6c9aba5012573c929aa3952f3e3150ba0ea58361a5

Download Submit
C:\Users\Admin\Downloads\Bloxshade.zip

Filesize
3.9MB

MD5
0061bb7a33111f4ed9024f430f71008e

SHA1
08f4b78d2a94aad176e45172f081130ae69b2175

SHA256
1067d5fc2c01cd6fbea314191b539cfdaace7796b81a21a1574c72028228bf7e

SHA512
3973bd4412143d366d62df52df52c964fb54b74dfed27178e0d5b7b0eefe9fde63a845a802c8ac4aa01404bbd424733369aa7ffdccfa7a034d83ca240295fcfb

Download Submit
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe

Filesize
5.6MB

MD5
c72a2850592803f68bac20e08308a403

SHA1
e461f8f6fdba9896208af464eb997102b4c8938f

SHA256
59dbebff0000ec259b4fc2cbd89626fe27ef6e0d8437c6b83a4a46d469ca3d8f

SHA512
b49f9f57d3a4f44a1637805307bba9ade8140e4d4ffb101b68ab2644c19907e99863942a65d7b9de374459b4d92776fc883bae415837adfa1b2a99a1a37e4994

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 283271.crdownload

Filesize
1.6MB

MD5
d2ebd82a5d3fac11d44d90d8df253bb9

SHA1
ba94b456e111ea9573fe150ad4090a66540c9938

SHA256
04b65aa7b23d0c7ebbd6e022a600fbc43c0ee896ed280e48ac59e17fb0a2311d

SHA512
49e9ef8066200cd6ec079943c1fbcda95cab2d3042f635ed57949e0c0701ecdf34ea8f16324994dc77bc3ec9fc67882ea88b4d543974e90bf4e8cf69b15e073c

Download Submit
memory/1716-2816-0x0000000074400000-0x0000000074625000-memory.dmp

Filesize
2.1MB

Download
memory/1716-2860-0x0000000074400000-0x0000000074625000-memory.dmp

Filesize
2.1MB

Download
memory/1716-3175-0x0000000000230000-0x0000000000265000-memory.dmp

Filesize
212KB

Download
memory/1716-2815-0x0000000000230000-0x0000000000265000-memory.dmp

Filesize
212KB

Download
memory/4268-3307-0x00007FFF2EE00000-0x00007FFF2EE10000-memory.dmp

Filesize
64KB

Download
memory/4268-3328-0x00007FFF2CA70000-0x00007FFF2CAA0000-memory.dmp

Filesize
192KB

Download
memory/4268-3327-0x00007FFF2C900000-0x00007FFF2C910000-memory.dmp

Filesize
64KB

Download
memory/4268-3326-0x00007FFF2C900000-0x00007FFF2C910000-memory.dmp

Filesize
64KB

Download
memory/4268-3325-0x00007FFF2C7F0000-0x00007FFF2C800000-memory.dmp

Filesize
64KB

Download
memory/4268-3324-0x00007FFF2C7F0000-0x00007FFF2C800000-memory.dmp

Filesize
64KB

Download
memory/4268-3321-0x00007FFF2D750000-0x00007FFF2D760000-memory.dmp

Filesize
64KB

Download
memory/4268-3320-0x00007FFF2D750000-0x00007FFF2D760000-memory.dmp

Filesize
64KB

Download
memory/4268-3319-0x00007FFF2D750000-0x00007FFF2D760000-memory.dmp

Filesize
64KB

Download
memory/4268-3318-0x00007FFF2D730000-0x00007FFF2D740000-memory.dmp

Filesize
64KB

Download
memory/4268-3317-0x00007FFF2D730000-0x00007FFF2D740000-memory.dmp

Filesize
64KB

Download
memory/4268-3316-0x00007FFF2D6A0000-0x00007FFF2D6B0000-memory.dmp

Filesize
64KB

Download
memory/4268-3315-0x00007FFF2D6A0000-0x00007FFF2D6B0000-memory.dmp

Filesize
64KB

Download
memory/4268-3329-0x00007FFF2CA70000-0x00007FFF2CAA0000-memory.dmp

Filesize
192KB

Download
memory/4268-3330-0x00007FFF2CA70000-0x00007FFF2CAA0000-memory.dmp

Filesize
192KB

Download
memory/4268-3333-0x00007FFF2EA70000-0x00007FFF2EA80000-memory.dmp

Filesize
64KB

Download
memory/4268-3334-0x00007FFF2EA70000-0x00007FFF2EA80000-memory.dmp

Filesize
64KB

Download
memory/4268-3335-0x00007FFF2EB20000-0x00007FFF2EB2E000-memory.dmp

Filesize
56KB

Download
memory/4268-3336-0x00007FFF2EB20000-0x00007FFF2EB2E000-memory.dmp

Filesize
56KB

Download
memory/4268-3337-0x00007FFF2EB20000-0x00007FFF2EB2E000-memory.dmp

Filesize
56KB

Download
memory/4268-3340-0x00007FFF2E120000-0x00007FFF2E130000-memory.dmp

Filesize
64KB

Download
memory/4268-3341-0x00007FFF2E120000-0x00007FFF2E130000-memory.dmp

Filesize
64KB

Download
memory/4268-3342-0x00007FFF2E140000-0x00007FFF2E14B000-memory.dmp

Filesize
44KB

Download
memory/4268-3343-0x00007FFF2E140000-0x00007FFF2E14B000-memory.dmp

Filesize
44KB

Download
memory/4268-3344-0x00007FFF2E140000-0x00007FFF2E14B000-memory.dmp

Filesize
44KB

Download
memory/4268-3345-0x00007FFF2E140000-0x00007FFF2E14B000-memory.dmp

Filesize
44KB

Download
memory/4268-3347-0x00007FFF2C490000-0x00007FFF2C4A0000-memory.dmp

Filesize
64KB

Download
memory/4268-3348-0x00007FFF2C490000-0x00007FFF2C4A0000-memory.dmp

Filesize
64KB

Download
memory/4268-3349-0x00007FFF2C590000-0x00007FFF2C5A0000-memory.dmp

Filesize
64KB

Download
memory/4268-3350-0x00007FFF2C590000-0x00007FFF2C5A0000-memory.dmp

Filesize
64KB

Download
memory/4268-3351-0x00007FFF2C5C0000-0x00007FFF2C5E6000-memory.dmp

Filesize
152KB

Download
memory/4268-3346-0x00007FFF2E140000-0x00007FFF2E14B000-memory.dmp

Filesize
44KB

Download
memory/4268-3338-0x00007FFF2EB20000-0x00007FFF2EB2E000-memory.dmp

Filesize
56KB

Download
memory/4268-3339-0x00007FFF2EB20000-0x00007FFF2EB2E000-memory.dmp

Filesize
56KB

Download
memory/4268-3331-0x00007FFF2CA70000-0x00007FFF2CAA0000-memory.dmp

Filesize
192KB

Download
memory/4268-3332-0x00007FFF2CA70000-0x00007FFF2CAA0000-memory.dmp

Filesize
192KB

Download
memory/4268-3322-0x00007FFF2D750000-0x00007FFF2D760000-memory.dmp

Filesize
64KB

Download
memory/4268-3323-0x00007FFF2D750000-0x00007FFF2D760000-memory.dmp

Filesize
64KB

Download
memory/4268-3305-0x00007FFF2ECF0000-0x00007FFF2ED00000-memory.dmp

Filesize
64KB

Download
memory/4268-3311-0x00007FFF2EE50000-0x00007FFF2EE80000-memory.dmp

Filesize
192KB

Download
memory/4268-3306-0x00007FFF2ECF0000-0x00007FFF2ED00000-memory.dmp

Filesize
64KB

Download
memory/4268-3308-0x00007FFF2EE00000-0x00007FFF2EE10000-memory.dmp

Filesize
64KB

Download
memory/4268-3309-0x00007FFF2EE50000-0x00007FFF2EE80000-memory.dmp

Filesize
192KB

Download
memory/4268-3310-0x00007FFF2EE50000-0x00007FFF2EE80000-memory.dmp

Filesize
192KB

Download
memory/4268-3313-0x00007FFF2EE50000-0x00007FFF2EE80000-memory.dmp

Filesize
192KB

Download
memory/4268-3314-0x00007FFF2EEE0000-0x00007FFF2EEE5000-memory.dmp

Filesize
20KB

Download
memory/4268-3312-0x00007FFF2EE50000-0x00007FFF2EE80000-memory.dmp

Filesize
192KB

Download