Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
448s -
max time network
447s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/09/2024, 12:40
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://bloxshade.com/
Resource
win10v2004-20240802-en
General
-
Target
https://bloxshade.com/
Malware Config
Signatures
-
Downloads MZ/PE file
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" MicrosoftEdgeUpdate.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation msedgewebview2.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation msedgewebview2.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 27 IoCs
pid Process 928 MicrosoftEdgeWebview2Setup.exe 1716 MicrosoftEdgeUpdate.exe 4732 MicrosoftEdgeUpdate.exe 4972 MicrosoftEdgeUpdate.exe 556 MicrosoftEdgeUpdateComRegisterShell64.exe 4172 MicrosoftEdgeUpdateComRegisterShell64.exe 6032 MicrosoftEdgeUpdateComRegisterShell64.exe 4280 MicrosoftEdgeUpdate.exe 5656 MicrosoftEdgeUpdate.exe 1888 MicrosoftEdgeUpdate.exe 3280 MicrosoftEdgeUpdate.exe 4804 MicrosoftEdge_X64_128.0.2739.63.exe 2384 setup.exe 3972 setup.exe 3940 MicrosoftEdgeUpdate.exe 5392 RobloxPlayerInstaller.exe 4268 RobloxPlayerBeta.exe 1188 setup.exe 3064 msedgewebview2.exe 4756 msedgewebview2.exe 4828 msedgewebview2.exe 5504 msedgewebview2.exe 4740 msedgewebview2.exe 5096 msedgewebview2.exe 1192 installer.exe 1892 RobloxPlayerBeta.exe 5980 msedgewebview2.exe -
Loads dropped DLL 40 IoCs
pid Process 1716 MicrosoftEdgeUpdate.exe 4732 MicrosoftEdgeUpdate.exe 4972 MicrosoftEdgeUpdate.exe 556 MicrosoftEdgeUpdateComRegisterShell64.exe 4972 MicrosoftEdgeUpdate.exe 4172 MicrosoftEdgeUpdateComRegisterShell64.exe 4972 MicrosoftEdgeUpdate.exe 6032 MicrosoftEdgeUpdateComRegisterShell64.exe 4972 MicrosoftEdgeUpdate.exe 4280 MicrosoftEdgeUpdate.exe 5656 MicrosoftEdgeUpdate.exe 1888 MicrosoftEdgeUpdate.exe 1888 MicrosoftEdgeUpdate.exe 5656 MicrosoftEdgeUpdate.exe 3280 MicrosoftEdgeUpdate.exe 3940 MicrosoftEdgeUpdate.exe 4268 RobloxPlayerBeta.exe 1188 setup.exe 3064 msedgewebview2.exe 4756 msedgewebview2.exe 3064 msedgewebview2.exe 3064 msedgewebview2.exe 3064 msedgewebview2.exe 4828 msedgewebview2.exe 5504 msedgewebview2.exe 4828 msedgewebview2.exe 5504 msedgewebview2.exe 4828 msedgewebview2.exe 4828 msedgewebview2.exe 4828 msedgewebview2.exe 4828 msedgewebview2.exe 4740 msedgewebview2.exe 4740 msedgewebview2.exe 5096 msedgewebview2.exe 5096 msedgewebview2.exe 5096 msedgewebview2.exe 3064 msedgewebview2.exe 1892 RobloxPlayerBeta.exe 5980 msedgewebview2.exe 5980 msedgewebview2.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxPlayerInstaller.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA setup.exe -
Checks system information in the registry 2 TTPs 12 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer msedgewebview2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName msedgewebview2.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
pid Process 4268 RobloxPlayerBeta.exe 1892 RobloxPlayerBeta.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 36 IoCs
pid Process 4268 RobloxPlayerBeta.exe 4268 RobloxPlayerBeta.exe 4268 RobloxPlayerBeta.exe 4268 RobloxPlayerBeta.exe 4268 RobloxPlayerBeta.exe 4268 RobloxPlayerBeta.exe 4268 RobloxPlayerBeta.exe 4268 RobloxPlayerBeta.exe 4268 RobloxPlayerBeta.exe 4268 RobloxPlayerBeta.exe 4268 RobloxPlayerBeta.exe 4268 RobloxPlayerBeta.exe 4268 RobloxPlayerBeta.exe 4268 RobloxPlayerBeta.exe 4268 RobloxPlayerBeta.exe 4268 RobloxPlayerBeta.exe 4268 RobloxPlayerBeta.exe 4268 RobloxPlayerBeta.exe 1892 RobloxPlayerBeta.exe 1892 RobloxPlayerBeta.exe 1892 RobloxPlayerBeta.exe 1892 RobloxPlayerBeta.exe 1892 RobloxPlayerBeta.exe 1892 RobloxPlayerBeta.exe 1892 RobloxPlayerBeta.exe 1892 RobloxPlayerBeta.exe 1892 RobloxPlayerBeta.exe 1892 RobloxPlayerBeta.exe 1892 RobloxPlayerBeta.exe 1892 RobloxPlayerBeta.exe 1892 RobloxPlayerBeta.exe 1892 RobloxPlayerBeta.exe 1892 RobloxPlayerBeta.exe 1892 RobloxPlayerBeta.exe 1892 RobloxPlayerBeta.exe 1892 RobloxPlayerBeta.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\AssetImport\btn_dark_resetcam_28x28.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\ui\Controls\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\ExtraContent\textures\ui\LuaApp\ExternalSite\twitter.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\fonts\families\Montserrat.json RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\ui\VoiceChat\New\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\ExtraContent\textures\ui\LuaApp\ExternalSite\amazon.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\ExtraContent\textures\ui\LuaChatV2\common_search.png RobloxPlayerInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.63\v8_context_snapshot.bin setup.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\RoduxDevtools\StateTabs\Diff.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\StudioToolbox\ScrollBarBottom.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\ExtraContent\textures\ui\LuaApp\graphic\gr-avatar mask-84x84.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\ExtraContent\textures\ui\LuaChat\graphic\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\ExtraContent\textures\ui\LuaChat\icons\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\ui\PlayerList\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\ui\PurchasePrompt\RightButtonDown.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\fonts\Kalam-Regular.ttf RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\ui\Controls\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\ui\Controls\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\ExtraContent\textures\ui\InGameMenu\drop_shadow_favorite.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\ExtraContent\textures\ui\LuaApp\icons\ic-more-events.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\ExtraContent\textures\ui\LuaChat\graphic\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Microsoft\Temp\EU1C2F.tmp\EdgeUpdate.dat MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.63\Trust Protection Lists\Sigma\Other setup.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\ExtraContent\textures\ui\Gamepad\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\avatar\unification\AdapterReference.rbxm RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\ui\Settings\LeaveGame\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\ui\VoiceChat\New\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\AvatarImporter\icon_AvatarImporter.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\CompositorDebugger\blend1d.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\StudioSharedUI\alert_error_withbg.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\ui\Controls\XboxController\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\ExtraContent\textures\ui\LuaChatV2\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.63\Locales\gd.pak setup.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\ui\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\ui\VoiceChat\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Microsoft\Temp\EU1C2F.tmp\msedgeupdateres_fil.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\ui\Controls\graveaccent.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\ui\PlayerList\NotificationOff.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\ui\VoiceChat\SpeakerLight\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.63\Trust Protection Lists\Sigma\Content setup.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\models\MaterialManager\material_model.rbxm RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\TerrainTools\progress_bar.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\ui\TopBar\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\ExtraContent\textures\ui\LuaApp\graphic\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\ExtraContent\textures\ui\LuaApp\icons\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\ui\ResetIcon.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\ui\Controls\DesignSystem\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source2384_1165036280\MSEDGE.7z setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.63\Locales\or.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.63\Trust Protection Lists\manifest.json setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.63\Locales\et.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.63\Locales\mt.pak setup.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\MaterialGenerator\Materials\Metal.png RobloxPlayerInstaller.exe File opened for modification C:\Program Files\MsEdgeCrashpad\throttle_store.dat setup.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\advCursor-default.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\ui\dialog_purpose_quest.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\ui\InspectMenu\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\ExtraContent\textures\ui\LuaChat\graphic\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Microsoft\Temp\EU1C2F.tmp\msedgeupdateres_ja.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.63\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig setup.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\MotorCursor.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\ui\VoiceChat\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\content\textures\ui\VoiceChat\Misc\Unmute.png RobloxPlayerInstaller.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeWebview2Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RobloxPlayerInstaller.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4280 MicrosoftEdgeUpdate.exe 3280 MicrosoftEdgeUpdate.exe 3940 MicrosoftEdgeUpdate.exe -
Enumerates system info in registry 2 TTPs 8 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer RobloxPlayerInstaller.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS RobloxPlayerInstaller.exe -
Kills process with taskkill 2 IoCs
pid Process 1056 taskkill.exe 5092 taskkill.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox RobloxPlayerInstaller.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0" RobloxPlayerInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio RobloxPlayerInstaller.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0" RobloxPlayerInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player RobloxPlayerInstaller.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0" RobloxPlayerInstaller.exe -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133700139922937333" msedgewebview2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedgewebview2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-7201700b36284abb" RobloxPlayerInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\VersionIndependentProgID MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ = "IAppVersionWeb" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32\ = "{31FB561A-CD57-4AF0-AE52-5652A86256B1}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32\ = "{31FB561A-CD57-4AF0-AE52-5652A86256B1}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachine\CLSID\ = "{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32\ = "{31FB561A-CD57-4AF0-AE52-5652A86256B1}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32\ = "{31FB561A-CD57-4AF0-AE52-5652A86256B1}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32\ = "{31FB561A-CD57-4AF0-AE52-5652A86256B1}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC} MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32\ = "{31FB561A-CD57-4AF0-AE52-5652A86256B1}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0B4C1840-3931-4AA5-A64F-95339D05E614} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\NumMethods\ = "41" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ = "IApp" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods\ = "4" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback.1.0\ = "Microsoft Edge Update Legacy On Demand" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ = "IAppBundleWeb" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell RobloxPlayerInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NumMethods MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\ELEVATION MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebSvc.1.0\CLSID\ = "{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32\ = "{31FB561A-CD57-4AF0-AE52-5652A86256B1}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\LocalServer32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods\ = "4" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods\ = "10" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ProxyStubClsid32\ = "{31FB561A-CD57-4AF0-AE52-5652A86256B1}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods\ = "10" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachine\CurVer\ = "MicrosoftEdgeUpdate.OnDemandCOMClassMachine.1.0" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{31FB561A-CD57-4AF0-AE52-5652A86256B1}\ = "PSFactoryBuffer" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods\ = "10" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\ProgID\ = "MicrosoftEdgeUpdate.ProcessLauncher.1.0" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\NumMethods\ = "17" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\VERSIONINDEPENDENTPROGID MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\ = "Microsoft Edge Update Core Class" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback\CLSID\ = "{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}" MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\PROGID MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\ = "IPolicyStatus5" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32\ = "{31FB561A-CD57-4AF0-AE52-5652A86256B1}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachineFallback.1.0\CLSID\ = "{E421557C-0628-43FB-BF2B-7C9F8A4D067C}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-3f7e4622625145b8\\RobloxPlayerBeta.exe" RobloxPlayerInstaller.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32\ = "{31FB561A-CD57-4AF0-AE52-5652A86256B1}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ = "IProgressWndEvents" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\ProgID\ = "MicrosoftEdgeUpdate.PolicyStatusMachine.1.0" MicrosoftEdgeUpdate.exe -
NTFS ADS 4 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\Unconfirmed 283271.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 849467.crdownload:SmartScreen msedge.exe File created C:\Program Files (x86)\Microsoft\Temp\EU1C2F.tmp\MicrosoftEdgeUpdateSetup.exe\:SmartScreen:$DATA MicrosoftEdgeWebview2Setup.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 148567.crdownload:SmartScreen msedge.exe -
Suspicious behavior: EnumeratesProcesses 29 IoCs
pid Process 2076 msedge.exe 2076 msedge.exe 4124 msedge.exe 4124 msedge.exe 4044 identity_helper.exe 4044 identity_helper.exe 2484 msedge.exe 2484 msedge.exe 3304 msedge.exe 3304 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3996 msedge.exe 3996 msedge.exe 632 msedge.exe 1716 MicrosoftEdgeUpdate.exe 1716 MicrosoftEdgeUpdate.exe 4520 msedge.exe 4520 msedge.exe 1716 MicrosoftEdgeUpdate.exe 1716 MicrosoftEdgeUpdate.exe 1716 MicrosoftEdgeUpdate.exe 1716 MicrosoftEdgeUpdate.exe 5392 RobloxPlayerInstaller.exe 5392 RobloxPlayerInstaller.exe 4268 RobloxPlayerBeta.exe 1892 RobloxPlayerBeta.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 49 IoCs
pid Process 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 3064 msedgewebview2.exe 4124 msedge.exe 4124 msedge.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: 33 1896 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1896 AUDIODG.EXE Token: SeDebugPrivilege 1716 MicrosoftEdgeUpdate.exe Token: SeDebugPrivilege 1716 MicrosoftEdgeUpdate.exe Token: SeDebugPrivilege 1056 taskkill.exe Token: SeDebugPrivilege 5092 taskkill.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 1188 setup.exe 4124 msedge.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 5292 Setup - Bloxshade.exe 1048 Setup - Bloxshade.exe 1188 setup.exe 1192 installer.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 4268 RobloxPlayerBeta.exe 1892 RobloxPlayerBeta.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4124 wrote to memory of 4032 4124 msedge.exe 83 PID 4124 wrote to memory of 4032 4124 msedge.exe 83 PID 4124 wrote to memory of 3884 4124 msedge.exe 84 PID 4124 wrote to memory of 3884 4124 msedge.exe 84 PID 4124 wrote to memory of 3884 4124 msedge.exe 84 PID 4124 wrote to memory of 3884 4124 msedge.exe 84 PID 4124 wrote to memory of 3884 4124 msedge.exe 84 PID 4124 wrote to memory of 3884 4124 msedge.exe 84 PID 4124 wrote to memory of 3884 4124 msedge.exe 84 PID 4124 wrote to memory of 3884 4124 msedge.exe 84 PID 4124 wrote to memory of 3884 4124 msedge.exe 84 PID 4124 wrote to memory of 3884 4124 msedge.exe 84 PID 4124 wrote to memory of 3884 4124 msedge.exe 84 PID 4124 wrote to memory of 3884 4124 msedge.exe 84 PID 4124 wrote to memory of 3884 4124 msedge.exe 84 PID 4124 wrote to memory of 3884 4124 msedge.exe 84 PID 4124 wrote to memory of 3884 4124 msedge.exe 84 PID 4124 wrote to memory of 3884 4124 msedge.exe 84 PID 4124 wrote to memory of 3884 4124 msedge.exe 84 PID 4124 wrote to memory of 3884 4124 msedge.exe 84 PID 4124 wrote to memory of 3884 4124 msedge.exe 84 PID 4124 wrote to memory of 3884 4124 msedge.exe 84 PID 4124 wrote to memory of 3884 4124 msedge.exe 84 PID 4124 wrote to memory of 3884 4124 msedge.exe 84 PID 4124 wrote to memory of 3884 4124 msedge.exe 84 PID 4124 wrote to memory of 3884 4124 msedge.exe 84 PID 4124 wrote to memory of 3884 4124 msedge.exe 84 PID 4124 wrote to memory of 3884 4124 msedge.exe 84 PID 4124 wrote to memory of 3884 4124 msedge.exe 84 PID 4124 wrote to memory of 3884 4124 msedge.exe 84 PID 4124 wrote to memory of 3884 4124 msedge.exe 84 PID 4124 wrote to memory of 3884 4124 msedge.exe 84 PID 4124 wrote to memory of 3884 4124 msedge.exe 84 PID 4124 wrote to memory of 3884 4124 msedge.exe 84 PID 4124 wrote to memory of 3884 4124 msedge.exe 84 PID 4124 wrote to memory of 3884 4124 msedge.exe 84 PID 4124 wrote to memory of 3884 4124 msedge.exe 84 PID 4124 wrote to memory of 3884 4124 msedge.exe 84 PID 4124 wrote to memory of 3884 4124 msedge.exe 84 PID 4124 wrote to memory of 3884 4124 msedge.exe 84 PID 4124 wrote to memory of 3884 4124 msedge.exe 84 PID 4124 wrote to memory of 3884 4124 msedge.exe 84 PID 4124 wrote to memory of 2076 4124 msedge.exe 85 PID 4124 wrote to memory of 2076 4124 msedge.exe 85 PID 4124 wrote to memory of 888 4124 msedge.exe 86 PID 4124 wrote to memory of 888 4124 msedge.exe 86 PID 4124 wrote to memory of 888 4124 msedge.exe 86 PID 4124 wrote to memory of 888 4124 msedge.exe 86 PID 4124 wrote to memory of 888 4124 msedge.exe 86 PID 4124 wrote to memory of 888 4124 msedge.exe 86 PID 4124 wrote to memory of 888 4124 msedge.exe 86 PID 4124 wrote to memory of 888 4124 msedge.exe 86 PID 4124 wrote to memory of 888 4124 msedge.exe 86 PID 4124 wrote to memory of 888 4124 msedge.exe 86 PID 4124 wrote to memory of 888 4124 msedge.exe 86 PID 4124 wrote to memory of 888 4124 msedge.exe 86 PID 4124 wrote to memory of 888 4124 msedge.exe 86 PID 4124 wrote to memory of 888 4124 msedge.exe 86 PID 4124 wrote to memory of 888 4124 msedge.exe 86 PID 4124 wrote to memory of 888 4124 msedge.exe 86 PID 4124 wrote to memory of 888 4124 msedge.exe 86 PID 4124 wrote to memory of 888 4124 msedge.exe 86 PID 4124 wrote to memory of 888 4124 msedge.exe 86 PID 4124 wrote to memory of 888 4124 msedge.exe 86 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection msedgewebview2.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://bloxshade.com/1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff204346f8,0x7fff20434708,0x7fff204347182⤵PID:4032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:22⤵PID:3884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:82⤵PID:888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:12⤵PID:4936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:12⤵PID:2168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:12⤵PID:448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:82⤵PID:3628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:12⤵PID:3000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:12⤵PID:1732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:12⤵PID:1512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:12⤵PID:3972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:12⤵PID:2952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5644 /prefetch:82⤵PID:4276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:12⤵PID:2916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6192 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3032 /prefetch:12⤵PID:5608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:12⤵PID:5724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6756 /prefetch:82⤵PID:5848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6436 /prefetch:12⤵PID:6112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:12⤵PID:5392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:12⤵PID:4712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:12⤵PID:4352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5924 /prefetch:82⤵PID:872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6524 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6632 /prefetch:12⤵PID:6004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6612 /prefetch:12⤵PID:6016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7164 /prefetch:12⤵PID:5160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5532 /prefetch:82⤵PID:5284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7344 /prefetch:12⤵PID:5700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7136 /prefetch:12⤵PID:5132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6768 /prefetch:12⤵PID:2368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7304 /prefetch:12⤵PID:4624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:12⤵PID:4744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6616 /prefetch:82⤵PID:4256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:12⤵PID:5124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1992 /prefetch:12⤵PID:5384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7516 /prefetch:12⤵PID:5292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2008 /prefetch:12⤵PID:536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7856 /prefetch:12⤵PID:6068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7188 /prefetch:12⤵PID:4984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1788 /prefetch:12⤵PID:5348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4748 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7100 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7732 /prefetch:12⤵PID:1832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7596 /prefetch:12⤵PID:5264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7544 /prefetch:12⤵PID:1888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7332 /prefetch:12⤵PID:4472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7592 /prefetch:12⤵PID:1496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7540 /prefetch:12⤵PID:2908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7532 /prefetch:12⤵PID:208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:12⤵PID:5380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1760 /prefetch:12⤵PID:5036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3084 /prefetch:12⤵PID:3520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=6676 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6836 /prefetch:12⤵PID:116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2448 /prefetch:12⤵PID:5748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=8428 /prefetch:82⤵PID:5928
-
-
C:\Users\Admin\Downloads\MicrosoftEdgeWebview2Setup.exe"C:\Users\Admin\Downloads\MicrosoftEdgeWebview2Setup.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
PID:928 -
C:\Program Files (x86)\Microsoft\Temp\EU1C2F.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EU1C2F.tmp\MicrosoftEdgeUpdate.exe" /installsource taggedmi /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"3⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1716 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4732
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4972 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.19\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.19\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:556
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.19\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.19\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:4172
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.19\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.19\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:6032
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTkiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OTkwMTY5MzMtM0I0NS00MUQ5LTk3QjMtRkM1NEI2MkM1NjY3fSIgdXNlcmlkPSJ7NkE2M0NFODItQ0ZDNy00QzNFLTlCNTktREMzODkwNUM4Q0RCfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezgwOTJGNzYzLTBCNjItNEUwMi04RjA2LTVDQjg1NTg2MDY0Q30iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTk1LjE1IiBuZXh0dmVyc2lvbj0iMS4zLjE5NS4xOSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzA3OTY5MDAyMiIgaW5zdGFsbF90aW1lX21zPSI1NDciLz48L2FwcD48L3JlcXVlc3Q-4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:4280
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource taggedmi /sessionid "{99016933-3B45-41D9-97B3-FC54B62C5667}"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5656
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8464 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8500 /prefetch:12⤵PID:1740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7760 /prefetch:12⤵PID:924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7836 /prefetch:12⤵PID:5132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7500 /prefetch:12⤵PID:1840
-
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5392 -
C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\RobloxPlayerBeta.exe" -app -isInstallerLaunch -clientLaunchTimeEpochMs 03⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:4268
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:12⤵PID:1736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7344 /prefetch:12⤵PID:2672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2168,11882088390851756424,5828018899686357777,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5104 /prefetch:82⤵PID:2116
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2108
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:512
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:624
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5216
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Bloxshade.zip\Setup - Bloxshade.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_Bloxshade.zip\Setup - Bloxshade.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:5292 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/p/?LinkId=21247032⤵PID:5540
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff204346f8,0x7fff20434708,0x7fff204347183⤵PID:5556
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x33c 0x4a01⤵
- Suspicious use of AdjustPrivilegeToken
PID:1896
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5988
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1888 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTkiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OTkwMTY5MzMtM0I0NS00MUQ5LTk3QjMtRkM1NEI2MkM1NjY3fSIgdXNlcmlkPSJ7NkE2M0NFODItQ0ZDNy00QzNFLTlCNTktREMzODkwNUM4Q0RCfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7MEQ2QzY3NzAtQzJGRS00RURELUI4NEQtQUVENUYzREE5RjFGfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0o3VmlaamJOeXgxR1ZySFcrUmQvUGdWaXpuRit0cXhpVXRXWG9GdEloZlU9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIzMyIgaW5zdGFsbGRhdGV0aW1lPSIxNzIyNjAyNzEzIiBvb2JlX2luc3RhbGxfdGltZT0iMTMzNjcwNzUyNzAwMTQ5Mzc0IiBmaXJzdF9mcmVfc2Vlbl90aW1lPSIxMzM3MDAxMzYyMjQ3Njk3MzIiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMzExMTg5IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3MDg1MzI5OTQ1Ii8-PC9hcHA-PC9yZXF1ZXN0Pg2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:3280
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9452A050-106B-42CB-9614-865D2ACA3585}\MicrosoftEdge_X64_128.0.2739.63.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9452A050-106B-42CB-9614-865D2ACA3585}\MicrosoftEdge_X64_128.0.2739.63.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level2⤵
- Executes dropped EXE
PID:4804 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9452A050-106B-42CB-9614-865D2ACA3585}\EDGEMITMP_37C00.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9452A050-106B-42CB-9614-865D2ACA3585}\EDGEMITMP_37C00.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9452A050-106B-42CB-9614-865D2ACA3585}\MicrosoftEdge_X64_128.0.2739.63.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2384 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9452A050-106B-42CB-9614-865D2ACA3585}\EDGEMITMP_37C00.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9452A050-106B-42CB-9614-865D2ACA3585}\EDGEMITMP_37C00.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=128.0.6613.120 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9452A050-106B-42CB-9614-865D2ACA3585}\EDGEMITMP_37C00.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=128.0.2739.63 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ff6992206d8,0x7ff6992206e4,0x7ff6992206f04⤵
- Executes dropped EXE
PID:3972
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTkiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OTkwMTY5MzMtM0I0NS00MUQ5LTk3QjMtRkM1NEI2MkM1NjY3fSIgdXNlcmlkPSJ7NkE2M0NFODItQ0ZDNy00QzNFLTlCNTktREMzODkwNUM4Q0RCfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezY1NDZFQ0E3LTBDQTEtNDY1Qy04MkM1LTQ1NkM0MjRBREU1Nn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMjguMC4yNzM5LjYzIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3MTAxMjQwMTYxIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzEwMTQ0MDAxNiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc0NzI3Njc5MzQiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5mLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzg1YWYyOWQ5LTQzNjgtNDQyYi1hNmY5LTZmOTJmZTIxNDg1Mj9QMT0xNzI2MTQ1MDU0JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PVdjN29tT0pmSkVMb1JjbUNocXglMmJsaWtTUDE2T2p6ZElzbDV1WVJRZ1pqOXNuWWhhUUtlMDRzY3JwSUpROERoJTJmVkZiaWRoUE12MlpkSUslMmJ0WVZ2NjFBJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTczODU0Nzc2IiB0b3RhbD0iMTczODU0Nzc2IiBkb3dubG9hZF90aW1lX21zPSIzMDcwMSIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc0NzI5MDg0MzciIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3NDg5OTA3ODA1IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3OTMzMjYwODMwIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMTE1MiIgZG93bmxvYWRfdGltZV9tcz0iMzcxMzciIGRvd25sb2FkZWQ9IjE3Mzg1NDc3NiIgdG90YWw9IjE3Mzg1NDc3NiIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iNDQzMzQiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:3940
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Bloxshade.zip\Setup - Bloxshade.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_Bloxshade.zip\Setup - Bloxshade.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:1048 -
C:\Windows\system32\cmd.execmd.exe /c taskkill /F /IM installer.exe2⤵PID:4104
-
C:\Windows\system32\taskkill.exetaskkill /F /IM installer.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1056
-
-
-
C:\Windows\system32\cmd.execmd.exe /c taskkill /F /IM setup.exe2⤵PID:1208
-
C:\Windows\system32\taskkill.exetaskkill /F /IM setup.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5092
-
-
-
C:\Program Files\Bloxshade\setup.exe"C:\Program Files\Bloxshade\setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1188 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.63\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.63\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=setup.exe --webview-exe-version=2.8.11 --user-data-dir="C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --mojo-named-platform-channel-pipe=1188.4844.121991194551861703783⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- System policy modification
PID:3064 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.63\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.63\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=128.0.6613.120 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.63\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=128.0.2739.63 --initial-client-data=0x174,0x178,0x17c,0x150,0x184,0x7fff0c549fd8,0x7fff0c549fe4,0x7fff0c549ff04⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4756
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.63\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.63\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView" --webview-exe-name=setup.exe --webview-exe-version=2.8.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1812,i,13617649339729918172,11398297182688003483,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1808 /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4828
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.63\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.63\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView" --webview-exe-name=setup.exe --webview-exe-version=2.8.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=2076,i,13617649339729918172,11398297182688003483,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5504
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.63\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.63\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView" --webview-exe-name=setup.exe --webview-exe-version=2.8.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=2216,i,13617649339729918172,11398297182688003483,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4740
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.63\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.63\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView" --webview-exe-name=setup.exe --webview-exe-version=2.8.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3560,i,13617649339729918172,11398297182688003483,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:5096
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.63\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.63\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView" --webview-exe-name=setup.exe --webview-exe-version=2.8.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=3752,i,13617649339729918172,11398297182688003483,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5980
-
-
-
C:\Program Files\Bloxshade\installer.exe"C:\Program Files\Bloxshade\installer.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1192 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.roblox.com/download/client4⤵PID:4820
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff204346f8,0x7fff20434708,0x7fff204347185⤵PID:4092
-
-
-
-
-
C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-3f7e4622625145b8\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:1892
Network
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.6MB
MD50306115e5983a950a7c1df77dac6ebad
SHA17fa1850fe1c9683eead8cc201bfeb6e8c5f2898c
SHA2563f20b4d5ccc612ace1a94fbdd43414feb1bf4c52f04b30891042d0611277b0de
SHA51254d1d00fd6979076f30c209cb814efcd0f1d24ea22f9765767c4f39cbec8b9c75405f9c80a27e035e82adfbb2d54afd43dd15349c16b77442ca1efad454dc2ec
-
Filesize
201KB
MD5b0d94ffd264b31a419e84a9b027d926b
SHA14c36217abe4aebe9844256bf6b0354bb2c1ba739
SHA256f471d9ff608fe58da68a49af83a7fd9a3d6bf5a5757d340f7b8224b6cd8bddf6
SHA512d68737f1d87b9aa410d13b494c1817d5391e8f098d1cdf7b672f57713b289268a2d1e532f2fc7fec44339444205affb996e32b23c3162e2a539984be05bb20c4
-
Filesize
262KB
MD5e468fe744cbaebc00b08578f6c71fbc0
SHA12ae65aadb9ab82d190bdcb080e00ff9414e3c933
SHA2567c75c35f4222e83088de98ba25595eb76013450fc959d7feefcab592d1c9839f
SHA512184a6f2378463c3ccc0f491f4a12d6cac38b10a916c8525a27acd91f681eb8fb0be956fc4bdb99e5a6c7b76f871069f939c996e93a68ff0a6c305195a6049276
-
Filesize
2.1MB
MD5b0da0a3975239134c6454035e5c3ed79
SHA1fbea5c89ef828564f3d3640d38b8a9662c5260e6
SHA256c590d1af571d75d85cfe6cb3d1aa0808c702bcefd1b74b93ea423676859fb8ba
SHA5125fbfa431a855d634bcbef4c54e5cc62b6435629305efee11559f66473c427ad0775c09364d37aaa7a4a8a963800886f6547a52ae680a1ff2c4dcc52c87d994bb
-
Filesize
27KB
MD5be845ba29484bdc95909f5253192c774
SHA170e17729024ab1e13328ac9821d495de1ac7d752
SHA25628414cd85efe921a07537f8c84c0a98a2a85fdbd5dfa3141e722ed7b433d0a96
SHA5122800ec29ece429151c4cd463c5042492ac24e82b4999a323607d142a6e1a08cb69258190a6722afbbcfb3c9cdc6eebdedf89ee6549e0f420f6fbae3aa0501fd4
-
Filesize
5.5MB
MD5929a709b2e6c4b26c0249a380ecc62ec
SHA120b9623b5c0f539b382767952c724cd2b347644a
SHA25654feb2119e5b6f99a4172639d3671724bb998fc2d61454920d90db7dd6cfb2b4
SHA5127c36e695fc87c40550be600a3f63b43f99230331c46a64aaa496c3233de4daec858f3e4a96100cf542fc5bc0a0a4514c052e7bad4c02c48ad425b22a5006b7ab
-
Filesize
280B
MD5aa2bdcbff7d470104013a39183dd91ca
SHA1444e3ea43dbb2a8775523db07a73bf434402b7c9
SHA2564c58551ca99a529ff210e33064a3dfc66448546ef137ca88915727ef8a1bbedc
SHA512cf980ab878b64a22fa56f2132feb7aa151bbf36224a4cd0864583c99f16a6b89d8c1d8c788776e6813e6dd8cb305537d3e448786dc52da72b2a06883cbd9cb18
-
Filesize
278KB
MD5981a9155cad975103b6a26acef33a866
SHA11965290a94d172c4def1ac7199736c26dccca33e
SHA256971393390616fbe53c63865274a40a0b4a8e731c529664275bdc764f09a28e2d
SHA5122d75ce25cb3a78f69f90fbd23f6e5c9f1a6ed92025f83ce0ab3e0320b64130d586fc2cd960f763e1ab2c82d35ef9650ebd7ff2a42a928a293e0e7428cc669119
-
Filesize
102B
MD58062e1b9705b274fd46fcd2dd53efc81
SHA161912082d21780e22403555a43408c9a6cafc59a
SHA2562f0e67d8b541936adc77ac9766c15a98e9b5de67477905b38624765e447fcd35
SHA51298609cf9b126c7c2ad29a6ec92f617659d35251d5f6e226fff78fd9f660f7984e4c188e890495ab05ae6cf3fbe9bf712c81d814fbd94d9f62cf4ff13bbd9521a
-
Filesize
180KB
MD53cafff21818ba5e51152524acad5ec8e
SHA12840648fa39fa8e3c061c57ea6222d109b921450
SHA2566963b601ac0e7507eb34ec08b3b7a916116eeb586da6e0b4e9a86c331ba0a7f4
SHA51230aaed28d4a319035f281b7ebcb5569439a91fec4fd0a0590d96ef91e58ca1ac6fae50908b889f6bfd2de5759b898dc0624f6a2407a5bc5b125df9688abd58cb
-
Filesize
152B
MD5e4f80e7950cbd3bb11257d2000cb885e
SHA110ac643904d539042d8f7aa4a312b13ec2106035
SHA2561184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124
SHA5122b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0
-
Filesize
152B
MD52dc1a9f2f3f8c3cfe51bb29b078166c5
SHA1eaf3c3dad3c8dc6f18dc3e055b415da78b704402
SHA256dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa
SHA512682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\242db0f7-4d58-4744-8d33-8afabe35be65.tmp
Filesize5KB
MD5169105693ec8fb8cb215700f886417c3
SHA1075445380191c2ef82082461837fa207d9211fe4
SHA2564f476060d602aa1f199972483a2206c6d86abf6776daaa06e179e7375b22a41d
SHA5121f78e0e53689c17501e625125893ff833f227eb8711b59bff0bd44d3635a532c1404bdb4616f35cb9db04053feadee6d47f7497233efcff0e3fa7b6ebf5ddd6d
-
Filesize
64KB
MD5d6b36c7d4b06f140f860ddc91a4c659c
SHA1ccf16571637b8d3e4c9423688c5bd06167bfb9e9
SHA25634013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92
SHA5122a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487
-
Filesize
70KB
MD54058c842c36317dcd384b6c2deaa8b95
SHA11085ddb12b29b79ffe51937ba9cd1957e5e229b4
SHA2560e562969cad63d217848a5080273d1745dc4277d210b68a769c822f2fbfd75f6
SHA512435a67024811360b12339e3916945b0639e2d9319e9d540b73e093848a467b030e91e01917b7fb804eb756dabce2fe53c2d7ea586554ee6cfee70e652a85924a
-
Filesize
41KB
MD59101760b0ce60082c6a23685b9752676
SHA10aa9ef19527562f1f7de1a8918559b6e83208245
SHA25671e4b25e3f86e9e98d4e5ce316842dbf00f7950aad67050b85934b6b5fdfcca5
SHA512cfa1dc3af7636d49401102181c910536e7e381975592db25ab8b3232bc2f98a4e530bb7457d05cbff449682072ed74a8b65c196d31acb59b9904031025da4af4
-
Filesize
19KB
MD52e86a72f4e82614cd4842950d2e0a716
SHA1d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA256c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
SHA5127a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
-
Filesize
63KB
MD5710d7637cc7e21b62fd3efe6aba1fd27
SHA18645d6b137064c7b38e10c736724e17787db6cf3
SHA256c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b
SHA51219aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44
-
Filesize
88KB
MD5b38fbbd0b5c8e8b4452b33d6f85df7dc
SHA1386ba241790252df01a6a028b3238de2f995a559
SHA256b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd
SHA512546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16
-
Filesize
1.2MB
MD5c764a116bb5f3b348177ed1b293a515f
SHA110bdbd5398f0e8bb180bc2773a778345529a0a85
SHA25663cea794b8bda830d5c18a6ced98cd2ae4f6b27be723af8de0b3fd30bc56e5ba
SHA512b33bc90182b1b40163abe370a4da6fb81a169bf11a2235c46d350a66afd0daff29a1e6959dbaf9fb969f4d32bbfd2de5ee084e6f8b8f3d3c175b6d3058306585
-
Filesize
90KB
MD548743a670fa866d07b162f046726b2ec
SHA15f180be674c56c4519f531f0796b5b958c20127c
SHA2569d436fc2f3d4ec40a0e3ae981b315036ac944d2347995d37c27b059db59ce966
SHA512cbeb13a3ab5e6cd811bc64a14304f389d56de091db12618d62fc223de96e686545393eda1fde83ffea24468ff77953054b25a4a7a87ae2d9f61283c3ec46f69f
-
Filesize
78KB
MD56e76ea04b9c228bb4d816c625d0b26e7
SHA18eddb57ec522f7ede9bd0aee4981fa417cbd68b4
SHA256b8727a045b7b3dc8a1f37052f501fbd33e19a366b5c0ebed4364d460787de89c
SHA512798929c5902e113c9b9f953ca6867530bdc13881d39ddb6c5da6e331e2a59c83c471edbcf70e864cd665a3d9aa1b730bcfb727c17d547ed386b60cd7db8bf937
-
Filesize
1.5MB
MD570b11b0deaffc6bb12aecbfeff9a7e46
SHA11dbaee16af5005987881ca0a597e755414ea1b47
SHA2569b64caa0a568fbe8c4e5037d3fefc1479c4ea5df2ea04aa621e55749718a081c
SHA51205d211ceff06d98752b109627d6f8064f3c9679ab60f4cbebc3e4c68d71e2542eaca33e134b37a5e29fa786fdc7b20fa2aa54fcc918713da5824ea5c60303e07
-
Filesize
94KB
MD5cde8740f4b1b735721a71dad5e935621
SHA175d908a389e02ad5bf0bbd2da74ba5d5ecc508a2
SHA256f912cfe62914c0d6e9165ad23a9a84a3791ab874b3dc0a2304c924d09c4fee96
SHA512f35292c5d88818a5a0c069f5f4b341e5b6832a1edc5a0806475e48f135f6b048eb15a8c5a89c06a4eea7a96e4381bd483187907989acf80c7bd0a32f35108695
-
Filesize
78KB
MD535a46116980c974751122a331d47fd84
SHA1cd6e9014e38596c681641a27706124b5b69f86fc
SHA256ccab92b9bfa43457f743cd83e454bcc63a768deb352fbad2d06d718eb2815a66
SHA512aa4f484d3ca65525d5613243797d7e025e552dbd4e68bd9887d88d32fc6928c13dd7a47e8f97c77436924478d451445fa121d1bc1958a0ba94a2a05159345048
-
Filesize
20KB
MD587e8230a9ca3f0c5ccfa56f70276e2f2
SHA1eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7
SHA256e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9
SHA51237690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8
-
Filesize
24KB
MD5c594a826934b9505d591d0f7a7df80b7
SHA1c04b8637e686f71f3fc46a29a86346ba9b04ae18
SHA256e664eef3d68ac6336a28be033165d4780e8a5ab28f0d90df1b148ef86babb610
SHA51204a1dfdb8ee2f5fefa101d5e3ff36e87659fd774e96aa8c5941d3353ccc268a125822cf01533c74839e5f1c54725da9cc437d3d69b88e5bf3f99caccd4d75961
-
Filesize
96KB
MD5a2e02ff3bca160efbb95e1b5a66450d0
SHA16d080baa4b93143b07d36b13ef14c1b35a2b06be
SHA256f1918b6f060acd72598c23fe53ebe7de2a5c52cea0e95d6eaf8260041070fedd
SHA5127e4f4ff6d63fb1dbb3956bf9f0d27266745dcd9c0063aecb4b44893a2d487e4366f8fc92b8e3d5c56daeb2f79c2f3ff3da74d8306f5bf6b6f9c9b3e7e5924243
-
Filesize
20KB
MD51435f3cfd01bf0f3c24b8983e6780db0
SHA1439ab7ffa6f9d5b654710691d8736eedf2b6e892
SHA2568cd3f9f312e86bade2e77eb25c28eba805707909441d49e29288944677ce6d47
SHA512dded0517b2c8f6c6ea045ba87f3ae870df63843291c3e2219e7bdeb4e33baf360b5fdb6065f0566fd1c79253105574ee4ca8cb13a11f7e6a51bf20eacf03155b
-
Filesize
212KB
MD508ec57068db9971e917b9046f90d0e49
SHA128b80d73a861f88735d89e301fa98f2ae502e94b
SHA2567a68efe41e5d8408eed6e9d91a7b7b965a3062e4e28eeffeefb8cdba6391f4d1
SHA512b154142173145122bc49ddd7f9530149100f6f3c5fd2f2e7503b13f7b160147b8b876344f6faae5e8616208c51311633df4c578802ac5d34c005bb154e9057cf
-
Filesize
125KB
MD553436aca8627a49f4deaaa44dc9e3c05
SHA10bc0c675480d94ec7e8609dda6227f88c5d08d2c
SHA2568265f64786397d6b832d1ca0aafdf149ad84e72759fffa9f7272e91a0fb015d1
SHA5126655e0426eb0c78a7cb4d4216a3af7a6edd50aba8c92316608b1f79b8fc15f895cba9314beb7a35400228786e2a78a33e8c03322da04e0da94c2f109241547e8
-
Filesize
35KB
MD50eab7c229b83333cc132deba0def8481
SHA1849063fc7129235badd05175e71fa71a81ddbd4a
SHA256a86edc3ac775654ba07ce2aee3571be807eef05e6404bb00832695b2d5fe9a37
SHA512ecdb1e18f8a63d89ad48f12a141667b03090e571842690440ceea8069febb4e3e1cd4de454157a89e9d8a1fe3f79fc1aa228a27337ff4bf6c877ab7bd62c423f
-
Filesize
33KB
MD59e0ac32dd76a55cd2643d23b18325493
SHA13f73e7c5aeb04f128ea34ceff6d67e18849b2e13
SHA2566d9d58bb624b7353d4dec90e679e77d1f0774290d81a05c7cad7d7a77fdf4349
SHA512ce4d0e419e3680789e542a5eb3d12b555e944cfa73e2c8596127ef288dee84dc6d8fe000284015e0f6d04322a930629a018290991cc9c637ff36aa281a6c365a
-
Filesize
20KB
MD5d1a4a9d5260a03b0ed9a48d77f10f3fa
SHA1e2325d4c4e759b9fc3bb453c5ed775151bdbc059
SHA25669714a9a171fe5cde0e4b30bb8cfdf428bc61c1da869ff113c6b7d6432271147
SHA512012032fd0e9338e33112b032196fca3efb0216a9f09c7d109091a112fe99a74d9ea02b2dd7aa9b19ebb77e227c6eb739e254adfffa2d09eccd8c621459e6bde8
-
Filesize
100KB
MD52e52bee929ab7d56b2622ae84962e0dd
SHA17fd648bb1fb1f069578e992972d7f22ef1bfb36b
SHA25658a0ed06b38f7886418d565ea4cdb15345b40a1d29e635e167870f45fe14ed4b
SHA512c53ceaa60c9591ad0e61e82ebc1b5c6dd46a7b4a1b7ac303aeced0f4a0611e4af2b7a5e1febda5fb10041d0a9c76202ed05bc3e344bb6ac6cc35529e127e9d8c
-
Filesize
51KB
MD5588ee33c26fe83cb97ca65e3c66b2e87
SHA1842429b803132c3e7827af42fe4dc7a66e736b37
SHA256bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760
SHA5126f7500b12fc7a9f57c00711af2bc8a7c62973f9a8e37012b88a0726d06063add02077420bc280e7163302d5f3a005ac8796aee97042c40954144d84c26adbd04
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize288B
MD548ddfa1731abf35db5e1efab35ca1638
SHA14dee06d43255800f7b8097f98b3d558dc774964f
SHA25651babb6831f164bad8c932aa9b7c301c6f8b993a812fe493bc31051826c5c703
SHA5125022b6298c4a940acebbffde48ea0bca3b42656d334a4e07cabeae49c7d42bdd4805a2a88e9e912007749dba2b91195419a6a49389e108d25d0933e44dc311fc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize9KB
MD5f3a6e5aa324389ad1638bc9278aff384
SHA169c6b282c861bf7bdbcd8eef36cd59bb45f800f9
SHA256baa6757a025c75d8712abff348c9e7dd62801c7e695df0ddedaca78e5eaef2c1
SHA5129bd13e2e9a4fcd094723268d0eebe098636145f77b200f31455eaff70c44a3694f237ce1f706a6beb263c5938d60c9cfcc2f1565fb4504da9cefc4f80f5819a6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize10KB
MD5d7552837e6ab0866561b64e56e10ef23
SHA16467f96f44c0d460f0d437489ca40c7c3d0cd84e
SHA2567e32848331fcd4a31b211d0e8d2b15fc67fc6bc60d1eb3311b295c98ac5f5866
SHA512329f9322860d6f2d6c778e9954b9601944e90837c8f677e5f89e17da04b08abe531271c664caf9303f85fe23bf79a3e67254ad4b27c2e2879409e6166e66650c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\000005.ldb
Filesize1KB
MD5cbd4452d0891ae0929d8e4078c21fe64
SHA114bc16c9fd64a9d86e67ead1fe1d671180fdb812
SHA256c77d9a9c7bd1c8b5a5f8448736789c2b44370815e45a0255ce718df22f5f861b
SHA512fca5def42a9aa8a3ee31e8fd4e48d06abb7c0c2e691d39ea7a7da14a9b271df97b473914bbbb17f81b3a17791de530c34e65f9ef74e7cbc85cb1f64a0acde3de
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old
Filesize392B
MD518ae7e76822803b0dd25eded474efe21
SHA12e0133aa6c43eef39dc6e7aecebc1370ae4bd5c7
SHA2564c2f363cb64486751b428bfe1d5fa82ac2e29e725f6cb6000e1bea59d4bc34b0
SHA5126293f7f5f05c19850f0b6241775822ff3089e7d4951c58702dac3a94921c6cd64b20ffefc0503adfb120108303fd24a6c90bebd3360bce1d524071b5b60af035
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old
Filesize392B
MD5118012d83c84408c3082bdf8ddf759e2
SHA1067c99ab3aeaefda125db6f4469f9eb372f61053
SHA256d1dd408f5d85f8cb6b138bf7303bdbeed5704eae64f5e100b8b75d6bfab93f9d
SHA5127f5e314db18dcdff495e3ab2b2e721b3b2fe6b2f8e2b7543a910985187272451ea0047b31d9e979f2fabf20d30cac5441492d106e4a6dc49e62939a70e531b3b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old~RFe5a6a15.TMP
Filesize671B
MD58d4923fbfbb3a6aabbea4862b8a55b0c
SHA12f7113bdff4ecb9321c1d74deb7b8df586763119
SHA256c504fac4f8dc9a7d7879eaa2616b32afc3754ab353a1a46a5c3da91ce71ac4fe
SHA512d02a0c1fe9adef0d197a426773df6d401ed33f9ff8b684a03be6b03dcd95cc65b6b9f2b1938d74b9a071537a8a42e530a3addffd2dc294fad6988d878ee80408
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001
Filesize100B
MD5e2896794670f13dd2d4d13b86817b168
SHA158089c9c0955e754f116b29243b4c834e61e1570
SHA2567a47c8951a8a2f9d0d66faa65fcb8653970dc9c8e08cc26287f6a9c2ec7cde7a
SHA5122a14bdee064c729f2cacc90ac8f599cd355c02c0bdfcf7a543e1cbfe8626f3629626d3132810eae3eebd4685d71b306c9de99baa86be950f3698e48fa376f578
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Filesize23B
MD53fd11ff447c1ee23538dc4d9724427a3
SHA11335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA256720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
SHA51210a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
-
Filesize
4KB
MD5907faab316f4f8b0405b0f2879b6dbc4
SHA175accc591ef700c76b2323c8c92fec37dcac2ab5
SHA256c872559d63444fec2f7d9775315e14417df7ff5f1522ae30fcda9d655dcb12ce
SHA51243f81e846bf4086643eb3218d4377aebfb2ad26b6559dbb44e4334f50d0efdfea73f834b60b7f41848ef4a523897e4c36d6333786cbf5f1984d40d48e883dbab
-
Filesize
5KB
MD5d323fccda29fd34e0db262f5368e6e54
SHA1271927a8689074335e9eca58cc24ecc89e9758aa
SHA256b3eb5945b8c01206ade805a9dd0b3bd2c3ff56d01ce278ea1db4329bbba5f61f
SHA512c2e093a5657248d22c70035f8fe44eb1969c22d48ec3418f8ff29c519004eae5e6c3c1ddbe5a6d2ab0d67a90a1c9a2878f8f1fd3a66b68a9416e8d656151ec6c
-
Filesize
11KB
MD5ec57057258e2b9261188f6e2cad97062
SHA1b9098c17b836d33142dcc98e4c1dc36048571279
SHA2560b7cdb20500f4910702c383973d716bc2d4b789e0dfce6da45ca40c56021610e
SHA5126e1b68fea402da023f88aa7c46bf980c145de1d1091b74bd31e20d0212d08930d44c65b30ee57aadee5ace05712e355d09e89b09a38a8974746354435934af77
-
Filesize
11KB
MD5c288c44bf0b9dbbb6ea8066521fa4f36
SHA178f8d384f928d9b2936a5f0d3c7c65b94827f68e
SHA2561dfe0d2a19fc4d4a64d18bc482c3310036703e68ac0bacf9120246b37285e17d
SHA51224f65d19db6b839f4d69699836ffbfd00d0195c2b1546b5c0bec8cb43c5077adb5a9585b756e02df6ac46dd22c6542eaf209acf20e5f7f5326ade1a383c373eb
-
Filesize
9KB
MD59fed9be73550137c1398ef91f1306b38
SHA1dcf0a11c4d453ea894cee6bd267dc2efa1007b44
SHA256853f327596be264e0a6c7147c6631684364caf8a626eae54ab563cab50be2e4d
SHA51216b1945d6ea30f28ed53174ff0bf9326bdfece9bdfed341ca5ba66188d6278a611c37d42e312a219134bf0e3d7b9b622079461f585ec2bafe5c7f7146971133d
-
Filesize
7KB
MD5fd599cd6dddc234338263216712cb652
SHA1efc733891e0dee2fa716d2709e5c605eb6900440
SHA25676ba68aae191e2f527ab24d0fe040a74e8b542df631a3af16780954bc66ae3e9
SHA51249c71e19bf655c0fe930f9cd3172c246aa6ede75177d4467a3e00b037e54879c8348d79554e79d498055bc6453eda79d349b711c248a3e37bd8c81fc594c3701
-
Filesize
9KB
MD531140858a519de085d26369a0ac5ae47
SHA17ef8c1a6cff11827677feda0c1e1ea17effec678
SHA256831f1b4f34991e0f2fa972dc52fecd011584c8784faedc8b935c514683649b90
SHA5128f038d15e9285cfa36af7365192b441e3a629b7899cf5bc74f5ca72dfd72fec6a2d9a4938dde3ad6804733e33ecd5642b95a15f40cd85de1df0bffec39a2f0d8
-
Filesize
9KB
MD5a45b2ccb84e4e9c386d2c389abeb4bb6
SHA1cb6996a6745fb4088f7b14f868ea805013675de3
SHA256e856de304bcbc8577f6d7be89e65e51ffb11cf763e35c77e1d12dbf1eb1b8d06
SHA512f14d28319a149ed428c1e0a603a87afa0e04155d69a7b0e5c5b9d4ad6ac247ed7441c0b6d5b5d5a6e64477260a0edd4f90d25e5c22dea67834475fb3feb83de9
-
Filesize
11KB
MD52484622565977d82651d51f39bfa8c2f
SHA1de059bc9c6ca36df48881564146b1e5aceb73b24
SHA256d126d487f609b17d064c725a0ef26d436ab7c11ac1fce42a05d8d253bda504c8
SHA512c0111bed0d4d9f96af13749abb28fe96a1f05bf43619700d1f8b0ff4509a07a321200e5b70b9adf81a82bd0e2267ec6e053d4cd93976fd7fc71e949ad4220d9a
-
Filesize
12KB
MD5e54d813161bdb33f35797bf48c809e18
SHA119ca441572faa2a41e6a9a184ee918010dfba8a9
SHA2564ba6c39115de5757b754e9d7d60badbfbee28c8972209279c88c21194c5438d4
SHA5129c42c55a0f8da9a1647657ae03673d847487c2464f57155818eda2854f2a959c2dca63c92683fec8b0a18e7af5a2d4a36e90b72a4985b74c610f59ba9c6aafa7
-
Filesize
8KB
MD5068f9584ff8550fc83164e93f6c3d5e2
SHA1c5e3515d3d385f531bc95fa44bd231f6e2c62c76
SHA25699a48b24bf0921eaab441b153cb249ced097c9e5b3fd44182ce5e85dee71c17e
SHA5125232c3b9364151a90d1ddfa0fffd97183214c47c3d38c2b41c5b22fbfe655bfef64e62aa00b96c22201e04c006e0a5d9b04f31f9f10c6b48040f9f80485869d9
-
Filesize
11KB
MD558aa98fe35b23666482bcc1042332dc2
SHA115a4e1b6bbf4818dd2543cefb80aeedb2b9d1500
SHA256c8508baac79c367901d2f3f4d09ae872754d019d73cfb1cb3c68bdfdfcdd0161
SHA512345139fa3baacf242bd47b13bcbf0ec38a20cea5e9c8473add3a8ab4eeb4c28f21a278d7fb4ff5c96d46041d51fd75c5e7a3445cf831a8c3607b1e049cd25663
-
Filesize
12KB
MD565d293e5c721317889beb87627bada39
SHA121118816ebf69d0b3b24e90f8ea2c292ce896ea1
SHA2565a6f6d36d5bc65d4f3802c47d476b825278f81545e7a92e1dbc141eca5a4520e
SHA51248dc500a54384d7e38ede5f45d3ec4dffc5ea00ce7e2c1d1bf77cd92dd8885d87a94b9b08dadeb09d2b8b205e4f584dbf925216d9d3a33fd388b0905079b41d9
-
Filesize
12KB
MD50c4ca304f7f79b21c06190b99e9fd5a0
SHA1a58f9139444a00aa18d10058a8e773cd591f2551
SHA256670c229962939420c57d4ad4d7ff7079ee5e5258b7271c2073a94f028b9d8d6b
SHA512fc872e863268d937eb866092a7a270e990a3974ad9d5b70e5f4720b4d7d616aceb797295a88ed850a8cbca02d0bc526a4038a573e49dd62fc3cf2bbe990e6dfe
-
Filesize
6KB
MD5f8ad3c9d8a27a525df30eddb721099d5
SHA1e7e8058e13c7b9d8eeca3a8aab1db19d262402f6
SHA2560d9e46864151ad8602bc457dd41db00478371ec32ae74dcfc7c0270bc398440d
SHA512454a792c2d6170ca9b7794965d4b7282c0ad448a0a2bb98e6dbf7fc9c8e07fdf5a3d78076f267a78b3e31f4001f4ffb2fbfe4420d433281794d10ebefbb3aa6a
-
Filesize
12KB
MD5cfa8b5cb693e0752c1d57a7bb8d70c93
SHA172a74e7888a83b7bc293fe4074e9fd19b03dc31d
SHA256b38df340eb107959dffc135395495ee3dfd6b0742563fa8b0269ad32550465f4
SHA5126bac8be808f736b1fba4bf825c4b3527745f484f3e0ce1048cfdf2b013c4227326fa4bf65af618020add69c3d8e8ded97ddd99879c0cf01146e6dbaf82e36195
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\198b1dbef7ece2ad03770a72810f2b485859f245\bb520d08-1570-4411-a81d-676cc4fb5231\index-dir\the-real-index
Filesize600B
MD545670c43582251ec36a01758fe822472
SHA12e26ce9e1309d1a3c0b3485f4952e3e4763263fc
SHA256da8702741856e5b44d60fe6940c0ffd675180f783e6499a5597e1022aeaa1103
SHA5123cfb12fe763497ab8d248a9af4f5aeafebb0db885a04ee020cbd2a03b505ea0bf9b8a578b3d38f038301d3b0904467610344b5bb57075ccd9f8954f18f24fe3b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\198b1dbef7ece2ad03770a72810f2b485859f245\bb520d08-1570-4411-a81d-676cc4fb5231\index-dir\the-real-index
Filesize168B
MD5ad104b612a4d2c7b4756ef5f5f663354
SHA18ed97482e6d233b08871f51c03e62832ab2a63d8
SHA256c326c39b5c914fd4a6cb89293cf350eb0700c981c110e3ba0b862882407e03d5
SHA5126ff6054e9767daa5360ba31d537f31be84e486042c8846daf687ff1d67c5c7e21f1231837c62c28cd710cebc521ce765ee1a94677be8ebaa4943b3a46312e11f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\198b1dbef7ece2ad03770a72810f2b485859f245\bb520d08-1570-4411-a81d-676cc4fb5231\index-dir\the-real-index~RFe590f19.TMP
Filesize48B
MD513aade5e52c50853ec89c00665c56243
SHA17a1b636fd2f6c54906d37cc7ce79fa99e9582290
SHA256c0d12d45d416fd74663ef6c572d75878fcadb494d5ed6dc399ba97885eb43fbe
SHA512a5cd90be984cab8c4707f4cd5dd9638138910aabf2baf057740ca714ed95d1eb800e48a29cff00f17cdae3473ff7a4f4f277d80cc4ba5dbd690bbbba967fb644
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\198b1dbef7ece2ad03770a72810f2b485859f245\index.txt
Filesize95B
MD594aa82d7ef214fd0bec48468a330beb0
SHA17400528ee704653826d38839236f70540659507b
SHA25694799aa8bc51a11b624c5027de2ca605135bde620ccc4fa75fcf41cb6ea1a662
SHA51209d8c6e4534e053f6af97ca860dda4fc963892b8450be5d9536085f3844d1ca2b86711b96f79019f8b5ea798a1831bfe8d8c7528b530a30acc646430df37ad0f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\198b1dbef7ece2ad03770a72810f2b485859f245\index.txt
Filesize90B
MD5519854ae199676bef970b1257f8872c3
SHA1c111e5a150c73bf22a25a11ca83b10479b1fe353
SHA2562b3aa3bc4d4f2a8189d0383bbc23a80937a2d7db567d5eeb9a7c4bc1380415f1
SHA51287f4a246ec10f88f715c1f5f1d5400d60f89adaef0a80b8b749b0a2fbcdbdae1b0de1ca891aa55dee566cbb88c64bef1843374649d4a794af5a0e8f12bd02742
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\198b1dbef7ece2ad03770a72810f2b485859f245\index.txt
Filesize91B
MD506c705c3ada8f44743410f0f13c5cac6
SHA15de32b80152b83f595bb32b373f9264c7d8e46a7
SHA2563a2a9d416dc059bdfbd2c2cb9d1ba5df2dd76da9ce1f4646349a4b7c58eec680
SHA512e77b215a7342673f46452fcc0b30d21796ecaa1f19277000dbfe397ff62e30d89196ec63016e100f0f61e8787be8da11c7ee739b74141bda5f15c1a88781f849
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\32cadb2b6d359d069dd3f3d132c212a43d223701\index.txt
Filesize99B
MD53bf6e33cc244cddf4c8edfce510e7479
SHA158f0e72b0fad87ab0c2fae0be3af5f31993c576e
SHA256d7f6402f83dbf9da0a87e102c51331d05cc783252936fccc3c32b88d8c17d907
SHA512e6cdeb437ec17344c1f88fb9cd16cf203e800906396e55f54fbc742cad87b7fa487a19760066c0991ae9b56835e68e10ac1d8b8199c7ed5ba6304880d5af12c6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\32cadb2b6d359d069dd3f3d132c212a43d223701\index.txt
Filesize35B
MD5343859b4ad03856a60d076c8cd8f22c3
SHA17954a27de3329b4c5eefd4bdcb8450823881aad6
SHA2568c79b653c087618aa7395d5e75198da7d3b04c08654c39e56b1027f9ef269c2f
SHA51258014a4e7f2b4b0d446fae3570196b8fb95d0d1b70bdab0dd34a74d6c62cd8d7ca494a486f19c1a829988a3af83a08d401f18d1769ce1799a02ee09807234254
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\09f6e555-ee06-4efa-8617-a8360eac6f53\index-dir\the-real-index
Filesize2KB
MD5b886e2bf818de9f5937a4ce8928a8381
SHA1f1eb00a893b7de83c0ef7805b6dda61fb0491ab6
SHA256f8323f934c57bb4a19405f87498b4f696234e5390afb41f74d8e32c22a7344e5
SHA512ac8a3344e0ec34c1c2fe8215c566b61dc6f20645c4410cae39b162fd39997882208c6067af677d0210429d17a3f0c93fedf28c673cdcf5f4ad13dfc6ce84c807
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\09f6e555-ee06-4efa-8617-a8360eac6f53\index-dir\the-real-index~RFe593109.TMP
Filesize48B
MD5888007ed162163f72e035a0cd227b243
SHA1eb331b6c75a36db6e936f998ed8a5b7ab9245393
SHA256b17411f62ddb3df327a092df257ce5b4bb311bbfe75ef4e5643f622dd25d0662
SHA512aff1c941107d5dde06050f8fbd4e225d15e81b00f733274fe65be1b0126c151b4ce746568bef889474c88abe52c3883b6a97a519940ff26e30e775558e8f432a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\81a72ee0-adae-492e-8b87-a102a36f09a6\index
Filesize24B
MD554cb446f628b2ea4a5bce5769910512e
SHA1c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA256fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
SHA5128f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize146B
MD503a4c5dc9ac666e198715f914e9a43fd
SHA11d057fa3bdac4b9426fda156fea23c75f3f48cb2
SHA2560fbc58cc9e6b518558bba7c04ede5ee5ec205affa389f05873dd7576d9762d64
SHA512ee471d7ff4777c284daddf437c177b91b72628700015485d8e4860061416f6330b962aba72d0a5fa462c972d4390920d66c7278d4bae39cef82ab3370b929f15
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize84B
MD58fc93b0e3b45af77d91c3cb98747a476
SHA188ab56132f3d0ad30942332ae807d3545e763abf
SHA256ecc38a364c0554632f58585087e95fbcdf4acef52b486cdefa08f3bc754d2528
SHA5127a0235bc41ee38cf80729f7cac34cf8a689bbd4a4f6f9a01ec25afa5781e5c5a628e07c37d4983ff3ec32bdd29c058af4a0a942d7169eb16058a31985d6ba151
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize82B
MD58519e8e7feb092cd6f324be3abbbee89
SHA1a0a70ad723b6cec5d71bbd885d8eb627bb48c125
SHA256fa967186144a2090eb0b9e446dbbc8e3e9c7e85f73207d5cc763b1a468c9ffbb
SHA5129b22281b0c415837d667efe22f010cd436ee3da7404694910741e72b474ea5473e6bd8df1afc9b5528c5f2dfdaa6c5b92915552a497b358ddd8d2e2bf5c27219
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe58fa78.TMP
Filesize89B
MD5f28f538b3f5122cd0360095be7fcea66
SHA1411f67ca2a51d9251764d5aca9e031ed2c726631
SHA256157eeff21777aa723821838b2bfccc3b382bba6f481a82568814390696f46469
SHA5120e142b8f1d49b1ba8cdb157a8bcf70c18019e15ec1d007609fc111a2a2c7978cd9fce005fba736e5fc1818f763fad1f4127fc0eacc768130ba960c282de1d20d
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Filesize122KB
MD5f22e111a6a8d23f7bda44d8eccaaa45e
SHA1c4354a43468a81e84246fa0ca7e0ef3a15015b77
SHA2569ed063072867156ccae162f6cf138648ecb8755907e9356d5eb0a1f30896f118
SHA5126253d75f0f9baa561521531e96b6b0d809491fa39e73f1def7b7e1600aabf8d9dd60c139459fcacc1c4f39ed17ce616eb2fcdf43ba93fad57cbf1567485609cf
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize72B
MD543d0b29f298823b65302aaffb7951cbf
SHA1573d0c895703ccc20e81ce1a833d6e58cb0c1318
SHA2562f9dc9891cf40b2c8ba8042df9c6043550dce19fe3db2fdbd69def9cc33ac395
SHA5128629329dc0ecb000afe567bc8a85f18fc5e384c1f0afdf1ff7c5c6f18a2fa954219c62950b88c9a00bc1f1a84e859804fada146f11c407d2b540a026c5992ab7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize72B
MD58b5242f2670a54caeefe355ad5347d7b
SHA115be330bb43a99665a093aef14a8665944d443de
SHA256bffc550e3d359a360c9095402e4b130bf267f93fc743705af21586713fa4f299
SHA5121ae2dba83aa6fa8a1abd34dc5360016748597e8bd3e961cac46a3eec6c36c2417f7cd01824402df92c02c25bf2937f8fa3cccbb736a81b1bfdc355facf42168d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58ae9a.TMP
Filesize48B
MD530ee120fcad846a37fa320f67edfec71
SHA1074ac0b7944bf348dba1d06565adf3de7000bdbb
SHA256de382165c0026863346e229c4c017347d766a3dabe98d6f946da89e4397152a9
SHA5120b4f3d27f9177286735e298261263984bde06b4b1884ebebaae5e90b638ac57416c4508918386d2d9e41229fedf2f8e2f63327ba07b238fc06fa105832d04270
-
Filesize
1KB
MD505571045fbce943275e919580d4ee9df
SHA17a75213d8cfb032f8df7e9333c85709534640795
SHA256726c1b5efa29a0b22176e7acfe958f1548a67a211305c827e9234b66c7102e93
SHA5124fe29262db4d6d494b0ffa1dea3859bc29d805c93258ce56470697ed95c8ec69a7b58270b54e96f9aa8308c280d859afc14fd27e77247961b44e69404268d905
-
Filesize
3KB
MD5dceb8a05ca8d38153068a8b01e639ca8
SHA1cc2bd0d4de6f6c99b9e6b69677a7dde5d563f24f
SHA256f0b398944afe565ffed34e814ce706a3ad91e47e2632c569a2b469c744e0370c
SHA512da439c14f78488f6ad9aa951795e571d5d59bac08757c885d08f303e9b0603ccdc3774447c84ad3158424c245d6dae66e099097bb7ad2ee7aa4c0e053affc72f
-
Filesize
5KB
MD5246e6448f0c4558af14ee2bccd3f2ac5
SHA16c155023dce02f20d5cdcb77f871c59d82a5bd3e
SHA256886bdb4bd8a9c176e8f0edb70f20b1f8c113b312af669a9e61e1a90af4857afc
SHA51295b9ceda5f905a1cae7c38643e8796690a97bad7787f0a2a2ff306d7da068dc39245b55ae52e64614fb7d8b8796ad1fede609187a0f86a0cfca5492fa55a336d
-
Filesize
7KB
MD570a897b3cf2cb646f45e70c5032dae00
SHA14060b0d6790872c03e50d444e0cae63bfc53863f
SHA256f181485f12237ad4a2046433fccad89d16914ee86e394c6de3c8b205ab9621fa
SHA5122ef5b0adcb530e1a46e27a0093f83e3d00526231ac67682c3bde0bd44e3aca06c61dde5a7abe3ea151bdb18f7fc58be7aedaeced04ff29645c722fb671a0e7ff
-
Filesize
7KB
MD5e7bc949086e3143141bbd8406bf0075f
SHA156f842bf1586d2c996e20c0278852c2accc3b0e5
SHA2568aff7ea6db46cd116adef24ac0bb6e853e7d70cca0825973861f12a88bf70f23
SHA512e6fddafd879bb62d3695db48640fba0e01c6315bbcbe9d45316bd82f4c4fc2ec5bbc2b728803f934d14cc8ad8a53c610535c8e03dae8fd8986ca1bba73770ad2
-
Filesize
8KB
MD52843fbb34b96851057512be8bd422897
SHA1101cace8d604570ae03b708e4fb5f2603fd5dcac
SHA256e728ff4c827bee967f108a9e348977fbd185e8850375ea48f8264e134c8f3be1
SHA5125128dfd7302d819470c2a0b821bdc7126cd16aecd115f61d3564574a9fe7c89f30d8398d4d3ffa1661207fa9f66c4a6c48b005455e92967ab59488de4766c8a3
-
Filesize
8KB
MD55b333dfa0bd6e230427720e4b7490c49
SHA1d5c0de00850562d31d80cd577da08bb5b2bd91c4
SHA25699a28bf387892619c02b3c5d14b2c6bd77c4df68b68a3c7297c73245863c0da9
SHA5126f2888247095157f0c4f18c3ae9bf165b5f9677096a6cd89cf430096c588a19323a877c4fc412030db33b04dfcf7da86161349a4c553341e797028a490d522fa
-
Filesize
8KB
MD52e7ec5655f508752f6cd371fd2638507
SHA1a3a6d6bb18a00d9d1c26b890d208c0ec9aa33dbe
SHA256b959788d9014eafc776f10357abff519cef8f68de0f233834a2aa10954e03c43
SHA512c0482b9ca2006554081249290d3090366db388c149794a95871bcdeaf0d8c8d8248d794fdd228e675ae70920fbb91bb53c97bb884381458e03c9613f390a1c99
-
Filesize
7KB
MD5e25c5bdd373c495f0f25f239edbfc1f3
SHA1eb2aa263e9f9d989842433d76642f0b2ac25b7b2
SHA2568eae6bd83c917cef2a069b845e0e3ccb03924f499d10212eb6e91f9ef87bd39e
SHA51201eb33d4a875b7c38c83b22681641bd023234843cef948e94f794504ee19ef4018770dbf635958dc0077145ec243c5d4768dfc216f37a677399cf65cda27bf53
-
Filesize
1KB
MD5c8f7a7c7e0b8b170562fdadaac900994
SHA11b489475a408842ad0c6b53cd1568fa953aa7d92
SHA256d54f9ba7302e474b5b7638154db2db0a02888df7e209d21cf1480b24732c70a6
SHA512309e5284239871dde790c1ce0afeb4e1c372e5412fb054dd8bb53b39e7acfb8a0b66df808feff54ca1c65a7c0b4bc9393492a2fab6e6e453f9fa6bfe403d833b
-
Filesize
2KB
MD51978d2e0f9204dd447a5f6f9701868c5
SHA1016b918e387e053fc6e8d86b1f2380238088f68b
SHA256b9223e82c34b8fe5b12fa4643928652ddfb5ac795ae562d5f5c4638f28754497
SHA512cc665726b4f54f5ef5da906845efff63b577eb00b81d096c51898683cef90747bf131ca9701bc7bd86610298c11f073f8443d9d4a5d933e09394229727061aab
-
Filesize
7KB
MD59e2e51546efb8fb2d1006de2b0ab7330
SHA129f0e2c8152321147a55c93d355faaaa5cf0deb4
SHA2564d2b9b8fe5ee0f288e5e1e9ad1fc3653a444cb8d3f68a656d689675e946df42b
SHA5125db0c2fb9dee75e35659700d2592cdbc9ce09d16e60ed26cabf4ec0db689e9cc28d1974dba15c4ed90f1c6c837ec9b4ee7d61c02e351faa7449b89af5a879de8
-
Filesize
7KB
MD557935ca31c4b95ba19df587301fada23
SHA1788afe5ac9ac9d252cc63f1342624c6d311eceb0
SHA256b0dc0e9efe62851b5af9a04549eaeed46eef627d314d0491c2a0102c032fd1d8
SHA5127e0a4b2376b90f936305dd073429645eaa51d85b8750b7e6b9c5837a0a123a724f729332dffbd4fc37d70b9360b77fe8e784a9c6262ab4fc6382b0635e0b47e6
-
Filesize
7KB
MD5111e5c7193e929775225f49cf5843e90
SHA133e75c780ba73b70aadbb18546aefa26e69eb948
SHA2567ffb4a01de0bdfbf8f624e2a9c52c68a991cd3e182d950099f6881f1a475799f
SHA512eee6a5a79d11142495177b665d38e8c659155a0c84d7d8027cf53eb2085d303ac57123d1246ca7b7a0ade4cc379f415f3c6bbf710925874c25c367cd9125fbf5
-
Filesize
8KB
MD5e61d17efd4ef8baea570b8c179ad9dac
SHA1f49982010f1986ba534030d750015e934477f085
SHA25640e26f6198b4acf55be9e37a672c025ad9f57364458df79ad01942b574f674f9
SHA512b4ee927187e7216e958903d6b7883a0a703de92dca9d6dc1cfda0c085af1ee1e1f824f30e4adaeb9340bb77d776c20dc1d33aea51b5f9bab3f61ac4e5b266e4e
-
Filesize
8KB
MD50ad6bdae87ae98e28ef6e92a37d20b83
SHA178957c78a102aedc0fe7c727a1d0537f25754d3e
SHA25644fe664bd0fc4f802eddcbd2d6d81edb08267eb40372f328214b1f3db09f9e78
SHA5123d9dcd9339423a1b9276142c650f23b6f8ff09acbb74aa4635ccd2c187a9332abf3ff77405ba07c7de6a8662ba5897c92c677756f7043f4d87912e360ce59a4c
-
Filesize
5KB
MD5e934d851ccab7cfec37839a334654fd3
SHA1e09dd48428a78dc3971940cdfa54d6c5225ee2af
SHA2560801a48a79e95a3ae4f6f3a309741e14435a0786ef63054a123a483a5ed0271f
SHA512c8e7d6e25d1a70ba58fc2a06313becd6f7343af2248b66e48ef90f0372fb188eea73cb00de924abf4c4f075d8847eea7697a441ac57a226efd8408b84c502a25
-
Filesize
7KB
MD5509f6cae0bb093a97c0edda8eb005a09
SHA120495ddfd32062773ab82e082e631e3b44e909e0
SHA2564b5d3070027680a445b52071b7a26498f091fa82292f96a617933624a01af463
SHA512715c3a32879d0681bbb43bb0567aad7705594aced2e6316059c435b0c6b41f2c5ea35c47684c933cb8def16dd394f2119d4aaabafe5b00c8266465c5dcc77955
-
Filesize
7KB
MD576a6a56956a626f6a3c0d1251667ef09
SHA1ab87035b15e84fb0c07bd5e224504009a4f6ade5
SHA256ab5738983dd557c2894c6fe1772a59283c369ee16eb3d0342887e2d73997ca8e
SHA51237294d7469c743be6ebf438f5239caabcb746bf411c40b03f1c9a3389fac2ffe381612f961ad32d207e4b789d0e12fe714f36f4f8d0657dff57b7c1942c8178f
-
Filesize
8KB
MD5533431ec7320a615a7cbf04398eb795c
SHA1131d00ef69f913a918de83474ef59748acb4e94e
SHA2567cc6d0e53a247c9425a8bc04147e33f355a97348b13a6f70148e0cb69227d456
SHA5123ec15d08a3611dc54b9f673b6c6b8aaa114f1f445f6ec4a4409fa06b7cc99153b2fbdf3b105d1ae72377a557a5c9ea1fef287063c334a6f533ac9368510c0019
-
Filesize
8KB
MD539013d959160fb4436dee91b2e447aaa
SHA1fbecb570c0c0d523efed018b5a30b0d71e2c007c
SHA256ca5e12f874342e9164125d2415aa5b08fe7a71234194a44f5775e0681ab30fb8
SHA512984645c79f138925fb0bc3c8fff23b7d1f522f2211e45c1fd14aeb9d0f7ff560adaf8fe148cd20283667dd7e883f99f8a84af26cfa3e64c28269ebec8c9173b0
-
Filesize
8KB
MD5c9969409391ad7b4be56a0cc161cf2e8
SHA13a48f82006bbfb0cd945ebf768933e98121b3181
SHA256387001b20efe439c1698aa069f8ddc5d4c7a32ed49391becb296426e5b525994
SHA512b6b3dc9e3bf2c05ec4c03d64e6d3a82505c2c8526a5b86fa17b2c597175d8c3a886307dbada217394c1457ef7e18097811fe62898ece2d7a5da83d5e88997f49
-
Filesize
874B
MD53a51c7d8b7f7691c5b2a79a1eb087f4c
SHA10a7ca4b629565b46fa8efcf3686ffd42636de6f1
SHA2562829d9ce08e1e4113be3a07932ce41de5c90bbfd02504959b3229fe188763bc8
SHA5120a83d40379bbe6d4ec88930fbfaee76e3a7d89fa0f9b230babdb17831ff4b5480b44984ac4cce9abe271e4ed0d3eb01d9f5f974f0e5ffe45bfa436619907eedf
-
Filesize
8KB
MD5483fb9c2cb34b455c0144e7893780990
SHA1788f67dfe7cb10e9d2b80edf3be9bcea669254e3
SHA256fa879b0baa7d199dc5d7075373376132d37160ecc2199d0d762e0f8141df08e7
SHA51258bb229c0ba12908043139567b670bff15433733378b3d94094fbb93c00741a0ee297aeba6f971789f23954374b50fbd805b9bae9bffe251de2206b661ba6204
-
Filesize
7KB
MD5d141a04002e19e366b324f3fa8e861ee
SHA16cd6688b3763bd5260ffcab4e47ed8fa270b1366
SHA2567a11523437fcfe8d2c58af44dcc3afba58098f3c15de97c6265651b9d69ed91d
SHA5127e6dc71d413d4e6628ff5a717511b5d10c525d77ac2274b3a11d9a6c0b7a4696e73fc64cb3cfb96c0dbea70b250fcd465842a61954a9fb64c91d515fc5b8fd5b
-
Filesize
707B
MD5c24d0683dfe0e1c7def8dcc9400f42ac
SHA1ba8a57a0950ccefa868a42292d89bcfd9ea9845f
SHA25606286b6cf7458a4dd9bd3749cda75ff151c3772d3980af6de197ea2b2a5c4874
SHA512677ba7905f47bf7a8adec1c78d3988475ee4d158cdd9108995d39bd88f8786db184947f913a450e57c72446b8d745917a05d39e324d1c81af9bc2e7bcf08d2a4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c80a24dd-2bf4-46e1-acd1-d13be9b39a9d.tmp
Filesize10KB
MD576f553b9fef09a89d9837a8ca69465a7
SHA114bd23a9d70c5a97ba491b8fd024308290750fdf
SHA25607ad5a8490c6d67b8dfcf5bbd6e45926631a14b08a607e45e3350db92ecc2b3a
SHA512bc2012299aaf4bc3224cec1f4220f8bfca286556e41c1da8b9c31491415ce6b57b6bf09a5c137665135c84c2371858453878b6a9fcefd31cad09fed65fdd9e18
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000004.dbtmp
Filesize16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5bbd234a659c703c894deb01f53678bb3
SHA155397c37f3107ffea06ee053be87f28097202caa
SHA256c74610d4f95a84d8643c85e3bb800f8e3bfc885bf12ac630aecef3d1716d5578
SHA5124942822addf1fe0380fc0518ac0b210fcaa0d694474205fe26357f2e35d5385cb1ae0c23327cd47a1147c0800e7bb7a377a153a0008b1c8e901e63da22b931c5
-
Filesize
10KB
MD55d37a05c776dbfafc257a9417392112a
SHA1b043e46ddf1911751ae48860ef354e21b634d305
SHA25636664cddec9c2703a27f41b2037b857fb3430fb961a6c548bead31d8d9c6dfc9
SHA512d21103da2e9a2d88ffbc57b165d4e58b9afa1df519ccec3381a269348cd5929bfb07d279fa08b7cfa0954b4286adbea67f01750ed4d1d2d49f5b305078c24bc0
-
Filesize
11KB
MD5b0d825fcb51d80a107d0a7ebdf9f3ee7
SHA1f4f81f6e3211187fbbe7dcb1343bc8315300e41e
SHA256fb84440d8aacb41901aa4eaced3e18698ee32273deb8f61caa10ac2b59ce67ce
SHA5125babc35c20c6ed678e484e63ed81240a39883c1e72fbf6d71b709e41bc63ccc76a9d2aca0b0cd77174c96fcf354c9c1df75e0bcbbec9d6a2484d1f6997f5ef55
-
Filesize
11KB
MD5d99881eb571f0889027577733f103300
SHA1ce5167fad69ee15161a6c8807fc1d678f21ef316
SHA25697330534d4d67ae0068fd719f6a5f8fa7ec216ba5160b616d5ecd27b4b16bcd2
SHA5126ad7633577e06d802ab6c8febc31ae36c7366125a8410e7cd554ee0eeeb0604111e5048650869cf740888749711ebafa80088cbefec8f55f2abfab6e2ebe0839
-
Filesize
11KB
MD50780d2bf1f01cc2681af6dc6be8a7d01
SHA165f91514378c11ebeb1d345edd0e4252a4f5dfe7
SHA2569d53837cdf3216891064cad6e5fea6c04a9356e85af677b9307a2448f48eac6e
SHA512f662ea0596daf3aee5c1eb0702e727599889687219682661b471905310e135f0a1f4a095022bc55dd3cca2c7ead708d0be66d12b66e5af4aecdf3bac87864f3a
-
Filesize
11KB
MD5efdcf7cc75ef081828ed5e3fcc038843
SHA1d0c4b1cc0475679fce3f5fa617dd6f092637a049
SHA256f941fead967191b3b2061b3ed98995b10cd9d891df57d3cde1b1fdfac827d0ec
SHA51296c6f069b566571e2cad604cc29922e44a259e8dec40f5320438c206b49bdeaa5add882401d63084a4b8cd3003854961c62c3c7fbf66a8a901c0c5de6b9c3b60
-
Filesize
11KB
MD5e27a146ac898db79e76026680fad9eeb
SHA1f61230910862bba533900ce1b169312b881e0889
SHA2563d71fcb63d3ad3436424271ea1f82bcb961d7d17f523360d91895d3cbed7db9c
SHA5124c2c19c9ffa65a69edf84f7fbc66a317c0a711880f2886579ffd447179d8beebf05103a94fc28fa5a46c60c57d5129b1b311c9bbb56916724f6abbf5969f28d4
-
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Filesize2KB
MD50080d7780464ab20fddd307e76e30a64
SHA1631e02ef5e46219e6485fb779435f8398e3363e6
SHA256593fb1ae02472e1dca93793436daf341578ae7fcd46d254039cb974023ffa0a7
SHA51224a83aed2693f3ae9ea181d54ed9f0ff0602ab2cfc7b3824f0547548c0eb81458438a5bbfedaf3b7b29be0389afef3837e3a7de99e38dcc78e34c65b03507ffd
-
Filesize
5.9MB
MD5fc50e85cb9ad55cadbda754bdba12554
SHA1e0b5545f4456615184ef9100210bd07c93aa9873
SHA256e562e965f6d076f0f779e0c44e1086ba697614bf13a4112082003f4fc4fa6e71
SHA512eaf666e530afaf3ed2f22a132c91ff10a0c136c68668717af54b00957cc927761b0e8bf1b9f6c2973bbe70fc6c467d588d209ffccedd3e45bf14a4e205201717
-
Filesize
280B
MD5940296d47082d307881d4e781e505417
SHA12110f2ec22617ec21cd7f4f031b9bf40f3106272
SHA256033001942bedfd4eb534c1ba7001a45070d285635bd86c41ef2e8c4f017d957f
SHA512cb0946f2437182c4d3013256d6e8dc9f45d8d10a2bfb705f9deb6f73aa6acf62844e111632b476c0f5cc2e57937b8048eabd2c827585bf29e47afdddedfd0d77
-
C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Default\87595818-247f-455d-998c-b1d36bc7371c.tmp
Filesize6KB
MD5d2cf4d5a56fe636dfba7f361f91b8cc2
SHA1c71c7d8b608ff85d76d83c984b7b80554e48c03f
SHA2561e55d7003672c9e624ae1ee080021eed2d5947bc7bd9efbc68c8d38596dd819f
SHA512700fad3d93e4ce092440b988ed44688e696d06dd2eb3a727c6366113ce6751effc99add62bafb878d744464f9ea62fccf2bd5fe35769b7c152d420c82dbd869e
-
C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Filesize72B
MD553f820031f6c9523ebd895ceb6bdf73d
SHA168bc487a8890fd37ac3eb1dc0dec4cc90d3cbd48
SHA2567ea995f449fccd7b999dae969dafa0357d672063505a710419f13df1533d1d2d
SHA51261216f731e1af6fd7bfee89af6bb807400af1489a1d10a9107489ea6720f95f2f2f9e56f1675d71481c05bb3f9383b9f74b72ec85e0bf54c5d77aa83e3f4edd4
-
C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5d908b.TMP
Filesize48B
MD5817ae1abc778123953e4836be571c0cf
SHA159ced8f2ed3d3896f71c2adafcfe3b089c266206
SHA256b197d9ff6ec7b453fad9c73873e8e18baf78d0014cd43ddf39ef43c4a4416c8e
SHA512b04e4e37b56e87bef9fd3b77f6c9459db3476fce2e86075052b82869cd8cf0ae4449cb513f440234f1d1ca662f6f4c87d0754437a3422c16592fb2ffe867c888
-
Filesize
264KB
MD5d0d388f3865d0523e451d6ba0be34cc4
SHA18571c6a52aacc2747c048e3419e5657b74612995
SHA256902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
SHA512376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
-
Filesize
827B
MD5504563e338411e13f0c20cf126087c17
SHA13fe884079d0675bfbc47bdc51c604b169272134d
SHA256af6b04bafdd9ce2847a3abad0e6368396522aad32df68b62ee104ef973f256fa
SHA512944136340cfff7fcc74f0a2e2292134c30ac0346acbe765c439b8d3662549dd4e1f3b14de36f6d2237e897821448a5ce1b47cd1d3a5124f9de959ce38cf5ff09
-
C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Default\Network\Network Persistent State~RFe5e536d.TMP
Filesize59B
MD52800881c775077e1c4b6e06bf4676de4
SHA12873631068c8b3b9495638c865915be822442c8b
SHA256226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
-
C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Default\Network\SCT Auditing Pending Reports
Filesize2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
6KB
MD5d65a316128ec7b604da7ac09bd6ff93a
SHA1e05a99f8c24b3ae93d0587e863758521cde3e83d
SHA25649f1249f67d1e44af98bd492b3bb54cd51d5b9d3a7f3b61d984cc35bc34e1688
SHA512e08411e31c117c1b1c61a1b576efc1cb692cd23cbaa9d109052be10972dd74e0af13b13816da3b21e97feb61473178d07df39ce796a507ef76eee4b05cd308cb
-
C:\Users\Admin\AppData\Local\com.bloxshade.tauri\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Filesize41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
Filesize
8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
Filesize
1KB
MD5ae8158babe24239cc4eb73c59896fcf2
SHA13c2dc8c94cd03d4a818cab06cc0bcfa2b6029a06
SHA256327ca37d966064c2d8b81b78410c322d17ee2e0ed6d3d9f14bf37f71e7bf7f1f
SHA512b092422522e1d9502d6c78b16b21a190811c967afc65145d7d70d0416083f55facb579e57fe5cb6171331a2375794994ced2efe8c185b35c102d8bf33634ba75
-
Filesize
2KB
MD5249fdad1b52fa0bfed8388d47562963b
SHA157f5ff07b80f31966100a0864dda80ab1d71d9a1
SHA2566de0cb603fce23165276ceae0fd832b32ca7680cfaa6ec9d8894fd43eb1e1f34
SHA512f2db1523f622a4c3ada25c7177cd1b5fb969a1cd4c39aae9bc341c6f00595f3da0051a95adc37aae94984a16435e24959efbad9eb5c07fd18fdc7382d47ba217
-
Filesize
3KB
MD54bd9b59ae7ad6e0ba7b989048e645fba
SHA1ccae529042f3b26894dbb7524a1d32b954337053
SHA25603cd290b5b678ab8a2e207ef443d591baf755f7fd0de4c7b3f6973ac6bb3f948
SHA512f38fa7d25c860d9781a8eab756d9c4311a2943fbd0cdece1b8cf37b98ca74afe6869031d08669f7d620a9022f497e9de021fdb8f1b361fb924e0ea494e544043
-
Filesize
16KB
MD5f048dbceaad4939c9858002c32fa6d48
SHA1e30d1ae8feeb72cf66d825bbc0d94ee3e8c58c42
SHA256e2ab444aa34a0dfdf2f40cdf01aaf2df641b6817d5dcbaa22e9ef41ed86a8040
SHA512832649865976d85b29397bdc530095b2c87211cf5190628d8f8b52249d17d238f0514e389f819095759c2a41d5b2657598f3058b8c0875643517cc37bc7f4fdb
-
Filesize
17KB
MD500ba12dbb3c5080a740d0b42120fa309
SHA11095b47ed3036592eb1e5540bb171cbe7d195c62
SHA256da31976707ccd6529e0446c91f50b3483e0e590dd928c801533de6a52a8a5137
SHA51268a444c778f5245286e291bba2c22e8999b740b9f50913d7a8f03afabed7945045b135ddb6cbf918e9adc6afba703498d25cb6f78c97ad98d845e8f0681ad425
-
Filesize
17KB
MD568e0ed483b58eda8f855d8c9757afaf4
SHA1b6d5061e19025d6d189e4d1dce98d6ff435fe732
SHA25626462a69c9cba5a1596452ba73611777c9baff5b314c92ff75e84a49bfad3ba1
SHA512db4d76445e22d44a87bbf25ffa1ac5cbad8cd251ca4465ac74b84d1b1addef355620e08912e912fb13eb9182d0e6e43c8752e0ff6b8dbac0bf9270147a3476c4
-
Filesize
1KB
MD50db034c7f3a6fe136ece9ffcbbbbbf62
SHA19d71bef7de80bfb36b2e22e8c124a14a5ef018e3
SHA256cc1683e2a8ace89e3b652fbccab3ffd338d2530b4ff7210b57ab8e8ee8d204a8
SHA51227dbabe0734c52299ba91e69be17d2bc3500b69d402483f0883d49386569165b2a734c13dd9298a6ef84344e1ef153d7f9190a6403d31f4cf2b109dae528e247
-
Filesize
7KB
MD5df3d937079b894c891f9b0b741874928
SHA1ed93fc386807b3a28fcc7988a88ae4741bfe1b15
SHA256c7cbb0db6e924cbfccf4a6e8223e3fed4d93f5d78a3122c30213b6e38ee195f4
SHA5125728bdd930283a4906e7e07acd3eadecb813a3154ffb41729738444bf13aab27dceb01e05a27c77bb13cc498c1d5c2d492ac653ddbfe4b14004b1c7a5bc54f1b
-
Filesize
11KB
MD5d43d041e531dc757a69a90cb657ef437
SHA109138b427565bc276cfd3ba9f59b0c8bad78e91d
SHA2569431360a5534ad2f8eddde157cce39704b99da035fcb6d2cca11220700b11ccb
SHA512476a98122059b9cc19492b7ae557c61381842c8c347f85c686e0a493bfd0e8707ce3491b690e7978b3fb7d7d2a4daa2767e4a590398a50562519bf32e8d12ec6
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize10KB
MD5e8d868e3008baf8d4f667cf80b8831d2
SHA16da260ca72417bb71c4854722e0d90fd0d21995e
SHA256f3d1e8d198273200e492dfe8a86d3a2620f20a0943c2fb600e58401c05c856c7
SHA51284fb6661e6fab5f3fdea6b03369962fdd7d049caa1d96a377817861612e16f92551e25c6e73eb7227caba1cd6bbdb1c208c7730a00ecb34e9d92801f9f370f92
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize10KB
MD5de3c85610402cb374fffbbf9d44f9115
SHA1355882114e81ed12c8024ea9a9ab2773b4d1752a
SHA25678094479bb6798fbe19fcf8e5bdeca9945167a9907f0e7f87a22d6eaf79587ac
SHA512a6248e2b97cd6117afa37925911595112d33d4c57f630103004d79ec0403b29b0d63857c9f1a3f5c6f0b5b6c9aba5012573c929aa3952f3e3150ba0ea58361a5
-
Filesize
3.9MB
MD50061bb7a33111f4ed9024f430f71008e
SHA108f4b78d2a94aad176e45172f081130ae69b2175
SHA2561067d5fc2c01cd6fbea314191b539cfdaace7796b81a21a1574c72028228bf7e
SHA5123973bd4412143d366d62df52df52c964fb54b74dfed27178e0d5b7b0eefe9fde63a845a802c8ac4aa01404bbd424733369aa7ffdccfa7a034d83ca240295fcfb
-
Filesize
5.6MB
MD5c72a2850592803f68bac20e08308a403
SHA1e461f8f6fdba9896208af464eb997102b4c8938f
SHA25659dbebff0000ec259b4fc2cbd89626fe27ef6e0d8437c6b83a4a46d469ca3d8f
SHA512b49f9f57d3a4f44a1637805307bba9ade8140e4d4ffb101b68ab2644c19907e99863942a65d7b9de374459b4d92776fc883bae415837adfa1b2a99a1a37e4994
-
Filesize
1.6MB
MD5d2ebd82a5d3fac11d44d90d8df253bb9
SHA1ba94b456e111ea9573fe150ad4090a66540c9938
SHA25604b65aa7b23d0c7ebbd6e022a600fbc43c0ee896ed280e48ac59e17fb0a2311d
SHA51249e9ef8066200cd6ec079943c1fbcda95cab2d3042f635ed57949e0c0701ecdf34ea8f16324994dc77bc3ec9fc67882ea88b4d543974e90bf4e8cf69b15e073c