hxxp://google[.]com

Resubmissions

25/09/2024, 23:05

240925-22wq5ssglq 10

25/09/2024, 22:58

240925-2xx4easemn 8

Analysis

max time kernel
300s
max time network
299s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
25/09/2024, 22:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://google.com

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
5028	Bloxstrap-v2.7.0.exe
6844	RobloxPlayerBeta.exe
3200	Bloxstrap.exe
7332	RobloxPlayerBeta.exe

Loads dropped DLL 2 IoCs

pid	Process
6844	RobloxPlayerBeta.exe
7332	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

flow	ioc
21	raw.githubusercontent.com
60	camo.githubusercontent.com
61	camo.githubusercontent.com
62	camo.githubusercontent.com
63	camo.githubusercontent.com
64	camo.githubusercontent.com
65	camo.githubusercontent.com
20	camo.githubusercontent.com

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
6844	RobloxPlayerBeta.exe
7332	RobloxPlayerBeta.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 36 IoCs

pid	Process
6844	RobloxPlayerBeta.exe
6844	RobloxPlayerBeta.exe
6844	RobloxPlayerBeta.exe
6844	RobloxPlayerBeta.exe
6844	RobloxPlayerBeta.exe
6844	RobloxPlayerBeta.exe
6844	RobloxPlayerBeta.exe
6844	RobloxPlayerBeta.exe
6844	RobloxPlayerBeta.exe
6844	RobloxPlayerBeta.exe
6844	RobloxPlayerBeta.exe
6844	RobloxPlayerBeta.exe
6844	RobloxPlayerBeta.exe
6844	RobloxPlayerBeta.exe
6844	RobloxPlayerBeta.exe
6844	RobloxPlayerBeta.exe
6844	RobloxPlayerBeta.exe
6844	RobloxPlayerBeta.exe
7332	RobloxPlayerBeta.exe
7332	RobloxPlayerBeta.exe
7332	RobloxPlayerBeta.exe
7332	RobloxPlayerBeta.exe
7332	RobloxPlayerBeta.exe
7332	RobloxPlayerBeta.exe
7332	RobloxPlayerBeta.exe
7332	RobloxPlayerBeta.exe
7332	RobloxPlayerBeta.exe
7332	RobloxPlayerBeta.exe
7332	RobloxPlayerBeta.exe
7332	RobloxPlayerBeta.exe
7332	RobloxPlayerBeta.exe
7332	RobloxPlayerBeta.exe
7332	RobloxPlayerBeta.exe
7332	RobloxPlayerBeta.exe
7332	RobloxPlayerBeta.exe
7332	RobloxPlayerBeta.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Bloxstrap-v2.7.0.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 54 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings	Bloxstrap-v2.7.0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Bloxstrap-v2.7.0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	Bloxstrap-v2.7.0.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\roblox-player\shell\open	Bloxstrap-v2.7.0.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	Bloxstrap-v2.7.0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	Bloxstrap-v2.7.0.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Bloxstrap-v2.7.0.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	Bloxstrap-v2.7.0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Bloxstrap-v2.7.0.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\roblox-player\shell\open\command	Bloxstrap-v2.7.0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\roblox-player\ = "URL: Roblox Protocol"	Bloxstrap-v2.7.0.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Bloxstrap-v2.7.0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Bloxstrap-v2.7.0.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\roblox\shell	Bloxstrap-v2.7.0.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	Bloxstrap-v2.7.0.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	Bloxstrap-v2.7.0.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	Bloxstrap-v2.7.0.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	Bloxstrap-v2.7.0.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\roblox	Bloxstrap-v2.7.0.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\roblox-player\shell	Bloxstrap-v2.7.0.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Bloxstrap-v2.7.0.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\roblox-player	Bloxstrap-v2.7.0.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	Bloxstrap-v2.7.0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\roblox\ = "URL: Roblox Protocol"	Bloxstrap-v2.7.0.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\roblox-player\DefaultIcon	Bloxstrap-v2.7.0.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Bloxstrap-v2.7.0.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Bloxstrap-v2.7.0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Bloxstrap-v2.7.0.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	Bloxstrap-v2.7.0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Bloxstrap-v2.7.0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\roblox\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe"	Bloxstrap-v2.7.0.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-661032028-162657920-1226909816-1000\{BEFABB90-7859-4E0B-94C5-20D8777DDECD}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Bloxstrap-v2.7.0.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\roblox\shell\open\command	Bloxstrap-v2.7.0.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\roblox\shell\open	Bloxstrap-v2.7.0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	Bloxstrap-v2.7.0.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Bloxstrap-v2.7.0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\roblox-player\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe\" %1"	Bloxstrap-v2.7.0.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Bloxstrap-v2.7.0.exe
Key created	\Registry\User\S-1-5-21-661032028-162657920-1226909816-1000_Classes\NotificationData	Bloxstrap-v2.7.0.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	Bloxstrap-v2.7.0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Bloxstrap-v2.7.0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Bloxstrap-v2.7.0.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Bloxstrap-v2.7.0.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\roblox\DefaultIcon	Bloxstrap-v2.7.0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\roblox-player\URL Protocol	Bloxstrap-v2.7.0.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Bloxstrap-v2.7.0.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	Bloxstrap-v2.7.0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\roblox-player\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe"	Bloxstrap-v2.7.0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Bloxstrap-v2.7.0.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	Bloxstrap-v2.7.0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\roblox\URL Protocol	Bloxstrap-v2.7.0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\roblox\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe\" %1"	Bloxstrap-v2.7.0.exe

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 408262.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Bloxstrap-v2.7.0.exe:Zone.Identifier	msedge.exe
File created	C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe\:SmartScreen:$DATA	Bloxstrap-v2.7.0.exe
File created	C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe\:Zone.Identifier:$DATA	Bloxstrap-v2.7.0.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2956	msedge.exe
2956	msedge.exe
1392	msedge.exe
1392	msedge.exe
3592	msedge.exe
3592	msedge.exe
1520	identity_helper.exe
1520	identity_helper.exe
2476	msedge.exe
2476	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3656	msedge.exe
3656	msedge.exe
5028	Bloxstrap-v2.7.0.exe
5028	Bloxstrap-v2.7.0.exe
6844	RobloxPlayerBeta.exe
5028	Bloxstrap-v2.7.0.exe
5028	Bloxstrap-v2.7.0.exe
5028	Bloxstrap-v2.7.0.exe
5028	Bloxstrap-v2.7.0.exe
5028	Bloxstrap-v2.7.0.exe
5028	Bloxstrap-v2.7.0.exe
5028	Bloxstrap-v2.7.0.exe
5028	Bloxstrap-v2.7.0.exe
5028	Bloxstrap-v2.7.0.exe
5028	Bloxstrap-v2.7.0.exe
5028	Bloxstrap-v2.7.0.exe
5028	Bloxstrap-v2.7.0.exe
5028	Bloxstrap-v2.7.0.exe
5028	Bloxstrap-v2.7.0.exe
5028	Bloxstrap-v2.7.0.exe
5028	Bloxstrap-v2.7.0.exe
5028	Bloxstrap-v2.7.0.exe
5028	Bloxstrap-v2.7.0.exe
7404	taskmgr.exe
7404	taskmgr.exe
5028	Bloxstrap-v2.7.0.exe
7404	taskmgr.exe
7404	taskmgr.exe
5028	Bloxstrap-v2.7.0.exe
7404	taskmgr.exe
5028	Bloxstrap-v2.7.0.exe
7404	taskmgr.exe
5028	Bloxstrap-v2.7.0.exe
7404	taskmgr.exe
5028	Bloxstrap-v2.7.0.exe
7404	taskmgr.exe
5028	Bloxstrap-v2.7.0.exe
7404	taskmgr.exe
5028	Bloxstrap-v2.7.0.exe
7404	taskmgr.exe
5028	Bloxstrap-v2.7.0.exe
7404	taskmgr.exe
5028	Bloxstrap-v2.7.0.exe
7404	taskmgr.exe
5028	Bloxstrap-v2.7.0.exe
7404	taskmgr.exe
5028	Bloxstrap-v2.7.0.exe
7404	taskmgr.exe
5028	Bloxstrap-v2.7.0.exe
7404	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5028	Bloxstrap-v2.7.0.exe
Token: SeDebugPrivilege	7404	taskmgr.exe
Token: SeSystemProfilePrivilege	7404	taskmgr.exe
Token: SeCreateGlobalPrivilege	7404	taskmgr.exe
Token: SeDebugPrivilege	3200	Bloxstrap.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
5028	Bloxstrap-v2.7.0.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
5028	Bloxstrap-v2.7.0.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe
7404	taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5028	Bloxstrap-v2.7.0.exe
7120	MiniSearchHost.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
6844	RobloxPlayerBeta.exe
7332	RobloxPlayerBeta.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 4688	1392	msedge.exe	78
PID 1392 wrote to memory of 4688	1392	msedge.exe	78
PID 1392 wrote to memory of 4156	1392	msedge.exe	79
PID 1392 wrote to memory of 4156	1392	msedge.exe	79
PID 1392 wrote to memory of 4156	1392	msedge.exe	79
PID 1392 wrote to memory of 4156	1392	msedge.exe	79
PID 1392 wrote to memory of 4156	1392	msedge.exe	79
PID 1392 wrote to memory of 4156	1392	msedge.exe	79
PID 1392 wrote to memory of 4156	1392	msedge.exe	79
PID 1392 wrote to memory of 4156	1392	msedge.exe	79
PID 1392 wrote to memory of 4156	1392	msedge.exe	79
PID 1392 wrote to memory of 4156	1392	msedge.exe	79
PID 1392 wrote to memory of 4156	1392	msedge.exe	79
PID 1392 wrote to memory of 4156	1392	msedge.exe	79
PID 1392 wrote to memory of 4156	1392	msedge.exe	79
PID 1392 wrote to memory of 4156	1392	msedge.exe	79
PID 1392 wrote to memory of 4156	1392	msedge.exe	79
PID 1392 wrote to memory of 4156	1392	msedge.exe	79
PID 1392 wrote to memory of 4156	1392	msedge.exe	79
PID 1392 wrote to memory of 4156	1392	msedge.exe	79
PID 1392 wrote to memory of 4156	1392	msedge.exe	79
PID 1392 wrote to memory of 4156	1392	msedge.exe	79
PID 1392 wrote to memory of 4156	1392	msedge.exe	79
PID 1392 wrote to memory of 4156	1392	msedge.exe	79
PID 1392 wrote to memory of 4156	1392	msedge.exe	79
PID 1392 wrote to memory of 4156	1392	msedge.exe	79
PID 1392 wrote to memory of 4156	1392	msedge.exe	79
PID 1392 wrote to memory of 4156	1392	msedge.exe	79
PID 1392 wrote to memory of 4156	1392	msedge.exe	79
PID 1392 wrote to memory of 4156	1392	msedge.exe	79
PID 1392 wrote to memory of 4156	1392	msedge.exe	79
PID 1392 wrote to memory of 4156	1392	msedge.exe	79
PID 1392 wrote to memory of 4156	1392	msedge.exe	79
PID 1392 wrote to memory of 4156	1392	msedge.exe	79
PID 1392 wrote to memory of 4156	1392	msedge.exe	79
PID 1392 wrote to memory of 4156	1392	msedge.exe	79
PID 1392 wrote to memory of 4156	1392	msedge.exe	79
PID 1392 wrote to memory of 4156	1392	msedge.exe	79
PID 1392 wrote to memory of 4156	1392	msedge.exe	79
PID 1392 wrote to memory of 4156	1392	msedge.exe	79
PID 1392 wrote to memory of 4156	1392	msedge.exe	79
PID 1392 wrote to memory of 4156	1392	msedge.exe	79
PID 1392 wrote to memory of 2956	1392	msedge.exe	80
PID 1392 wrote to memory of 2956	1392	msedge.exe	80
PID 1392 wrote to memory of 4460	1392	msedge.exe	81
PID 1392 wrote to memory of 4460	1392	msedge.exe	81
PID 1392 wrote to memory of 4460	1392	msedge.exe	81
PID 1392 wrote to memory of 4460	1392	msedge.exe	81
PID 1392 wrote to memory of 4460	1392	msedge.exe	81
PID 1392 wrote to memory of 4460	1392	msedge.exe	81
PID 1392 wrote to memory of 4460	1392	msedge.exe	81
PID 1392 wrote to memory of 4460	1392	msedge.exe	81
PID 1392 wrote to memory of 4460	1392	msedge.exe	81
PID 1392 wrote to memory of 4460	1392	msedge.exe	81
PID 1392 wrote to memory of 4460	1392	msedge.exe	81
PID 1392 wrote to memory of 4460	1392	msedge.exe	81
PID 1392 wrote to memory of 4460	1392	msedge.exe	81
PID 1392 wrote to memory of 4460	1392	msedge.exe	81
PID 1392 wrote to memory of 4460	1392	msedge.exe	81
PID 1392 wrote to memory of 4460	1392	msedge.exe	81
PID 1392 wrote to memory of 4460	1392	msedge.exe	81
PID 1392 wrote to memory of 4460	1392	msedge.exe	81
PID 1392 wrote to memory of 4460	1392	msedge.exe	81
PID 1392 wrote to memory of 4460	1392	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.com
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd7d6d3cb8,0x7ffd7d6d3cc8,0x7ffd7d6d3cd8
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,9286636549962564062,4174032981679574051,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1880 /prefetch:2
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1868,9286636549962564062,4174032981679574051,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1868,9286636549962564062,4174032981679574051,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9286636549962564062,4174032981679574051,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9286636549962564062,4174032981679574051,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9286636549962564062,4174032981679574051,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9286636549962564062,4174032981679574051,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3812 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9286636549962564062,4174032981679574051,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1868,9286636549962564062,4174032981679574051,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4016 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9286636549962564062,4174032981679574051,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3824 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9286636549962564062,4174032981679574051,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1868,9286636549962564062,4174032981679574051,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9286636549962564062,4174032981679574051,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9286636549962564062,4174032981679574051,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1868,9286636549962564062,4174032981679574051,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4796 /prefetch:8
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1868,9286636549962564062,4174032981679574051,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4848 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9286636549962564062,4174032981679574051,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9286636549962564062,4174032981679574051,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9286636549962564062,4174032981679574051,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9286636549962564062,4174032981679574051,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9286636549962564062,4174032981679574051,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9286636549962564062,4174032981679574051,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6648 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9286636549962564062,4174032981679574051,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6660 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,9286636549962564062,4174032981679574051,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4728 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9286636549962564062,4174032981679574051,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6636 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1868,9286636549962564062,4174032981679574051,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6888 /prefetch:8
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1868,9286636549962564062,4174032981679574051,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3656
- C:\Users\Admin\Downloads\Bloxstrap-v2.7.0.exe
  "C:\Users\Admin\Downloads\Bloxstrap-v2.7.0.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5028
- - C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-b591875ddfbc4294\RobloxPlayerBeta.exe
    "C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-b591875ddfbc4294\RobloxPlayerBeta.exe" --app -channel production
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of UnmapMainImage
    PID:6844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2236

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:7120

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:7404

C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe
"C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3200
- C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-b591875ddfbc4294\RobloxPlayerBeta.exe
  "C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-b591875ddfbc4294\RobloxPlayerBeta.exe" --app -channel production
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of UnmapMainImage
  PID:7332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Bloxstrap\Modifications\ClientSettings\ClientAppSettings.json

Filesize
79B

MD5
eab6dcc312473d43c2fa8cc41280d79c

SHA1
b4e9ec7e579d06dfcaa5ac616de2751308a153c3

SHA256
0a27d3c9100ab7ab6f03c45daeb0f0cd586f3aeb59daf7986e853f9614e954fe

SHA512
1ce0fdc237110d644bcc8238f184554f25813ccf7142fd312ce96fbb6659081db677b04485bf66d52100136da6bb9688e48b1287455725c7b4950153aa2a4595

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Modifications\content\sounds\ouch.ogg

Filesize
6KB

MD5
9404c52d6f311da02d65d4320bfebb59

SHA1
0b5b5c2e7c631894953d5828fec06bdf6adba55f

SHA256
c9775e361392877d1d521d0450a5368ee92d37dc542bc5e514373c9d5003f317

SHA512
22aa1acbcdcf56f571170d9c32fd0d025c50936387203a7827dbb925f352d2bc082a8a79db61c2d1f1795ad979e93367c80205d9141b73d806ae08fa089837c4

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Settings.json

Filesize
716B

MD5
c06c166bf9f4a76114f73c66635cafe6

SHA1
d38d5ebbe1d51305f2ebb276dfffb5583344c009

SHA256
004ec9fc8296e28f52c3ed31058b8525ec5bb51fd4bbeba9c0ce708eda9c965c

SHA512
9a8b9a412d26319b028d1b0526116cee633f097f313486305438d95227e3ed8f3f6a833d18467789873f0ae2dd968aae6947de9602a4d4d6f2db427554036c45

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\State.json

Filesize
269B

MD5
f07c4ac994a80bc7deb85998af501348

SHA1
c26a1f7d6e0aca9aaa942d192407c0a9b0dd0c0b

SHA256
86b5e6ac5221e58294c5eef0c934d6e3aa867c99918ca5df5c0007e6450bebcc

SHA512
68af45acc13d5741acfe10052cfe553ff5338b2296e94d415cf511fbafe85442b2821942f3d6e305540847155398b3b0a953154f58b23e333a38b27559d2d629

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-b591875ddfbc4294\RobloxPlayerBeta.dll

Filesize
18.5MB

MD5
78dc9f08202382db76ecce3d70a7107f

SHA1
110a23181673ba65356b953f28e13e5382e6da6b

SHA256
1f334bd39e9e17919c8dba82b2eaaae1a45154c574aff195b1c001c5fc1cb159

SHA512
c37bc98958b830101245ff422aad635c040fea0ab379556c870246964626073921440818a44c4fac5ce56d290969e3e6640f56f734cec74d986a793a59fa1be3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9af507866fb23dace6259791c377531f

SHA1
5a5914fc48341ac112bfcd71b946fc0b2619f933

SHA256
5fb3ec65ce1e6f47694e56a07c63e3b8af9876d80387a71f1917deae690d069f

SHA512
c58c963ecd2c53f0c427f91dc41d9b2a9b766f2e04d7dae5236cb3c769d1f048e4a342ea75e4a690f3a207baa1d3add672160c1f317abfe703fd1d2216b1baf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b0177afa818e013394b36a04cb111278

SHA1
dbc5c47e7a7df24259d67edf5fbbfa1b1fae3fe5

SHA256
ffc2c53bfd37576b435309c750a5b81580a076c83019d34172f6635ff20c2a9d

SHA512
d3b9e3a0a99f191edcf33f3658abd3c88afbb12d7b14d3b421b72b74d551b64d2a13d07db94c90b85606198ee6c9e52072e1017f8c8c6144c03acf509793a9db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

Filesize
109KB

MD5
91aba671d01790cd073f98f07d478bd1

SHA1
30f5a51338c58dbb585eb80f5cdc9a3586694e79

SHA256
03e18dd23a3368f2e4b5ce9949ce008e9472c79f6b5db37fdad39fcbb95eb1b0

SHA512
0312f460b117b2e154a5404b422f0d52f1281fda1cf05a04fbd35bcd40041298c3bb7bf9adeb2006e95c838e6bf3a1c5b299ac603c59cc94138e5bd83ccd9558

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
99KB

MD5
82184d01f31478829c8f00e74cc3ab12

SHA1
102dd35019bde5d1ae354ca78a3f47bdf6ae5806

SHA256
a4f60d0546b7d64ce364731a1fb8a9386bed39a70111e811c3977f3c2773e22b

SHA512
4fa76b197bdaccf85a36e22292103edea0a6ba8802350563c7e6bb87a9f1f3e7086bce687d840d0441f3a47f10225dd9855c786e4a034dddc91e487eb67fb941

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000025

Filesize
141KB

MD5
d3d747f42b7b13b2aad27fd2a18be80b

SHA1
4e3077cb7ef676a4c7d81b18bc9429c473e46de1

SHA256
99eff48a135ed9e4e343b096a2c08cf3ca47cfb8a7e4957bd2a0f0814c24389b

SHA512
76381c4c21e8481091b1396698a6fb5868ba2b5985b6d0711617c412d57fef6c9466f7446239b19615b9c2460eea252974a25afedc2ea53d131616bd1fd415ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
63978ef6cf92ea1b6ada2e59f562bf7a

SHA1
f4128935628d5dbe2d34a22f80523faca4baf9a6

SHA256
0b001d843ef6037ab57fdf659afa60bee732ee8b0baf36d48b7f1a44489186fd

SHA512
625fb0c7b5b532d39d06830de21c6364f1f424d82e97d1c78a7f241b3b1b9c3a7725c8975aba89259a05fc67396c05ff3debca398c70eafa79bd52b8f1fda373

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
853f34a4793aed5ff84cc167e17c0107

SHA1
3c057544a0105d9ccf377f4d5113b83fdff4671d

SHA256
a7f0f36c7a9eecff056812926947067de6059c64c7d839c8765975b0c6ea775c

SHA512
03b8e43a24b439410295b9d0604103b4baf6f1df08ee3472bebfa52e75a2d0a8cbecdf5d2612405cd01d6f91a2fef423de867e4c2f19107e5718dd24296b5088

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
542a80dcd648ee4620957acbebdb0a7b

SHA1
f13ed7a345cbd18bf8f60b1c294f4f230e5680ae

SHA256
4f2214f310fcc55444456a9ce088eea67ae402a7aa5a94ea5ceeaa146e65d405

SHA512
6f346e6f91fba77f9bde6c4e08b814b42cb9dd8169f3463651ba99023207c974ef09896c145d7e1fb8662c757f0b955486f49927c767791c6ba59fe7c50afda5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
490677119d61a80113c9d12179505814

SHA1
05d25d853f90a22dc2281553d5f776df8a6ab5fd

SHA256
e73eb939c1a4c6d553e527e2489ac16cf1f007f0ef3d02374162effb705a5958

SHA512
04275d84b66a2ebd423ef26957a93638168e975e9138fae7ff7c9c0571b602890dfe5acb855dc0fe277840d49eb6988b2cfca9d5125963296f2f9d0af43ff468

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
31f564bb893156fa04be158b311d4dbc

SHA1
138dbed5d51f7b59cf53204ea01586363adcab3f

SHA256
b020f51026caffe7e33521c1fbd99c8ddf7ee7a6aba8114a62b5ddf3f3fc8c66

SHA512
ea7febb6adae1da452674a09299f9edc1f03df1edb07903c4e851b786ab4a72dd53e9baa44650c8a7029b2fff1d150f1d5338a961d720f4ee7b79f1006907b1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5c6f5a5a9a26066b4160d9bc73d1403e

SHA1
94194f6a3ad2b84e6e2b5d047e616629206e1f13

SHA256
3bb5a4cd4297a97b267e8321d648fef64ed1a70a4e9a55c45482921673a3988f

SHA512
3d73b74c177d6d75bb05a1c94cde20accf41001b19f2f87177a159b3ce7b2da17e5179b7633be67d58b4b093d96f35edf73477c5496a09431f3b57e3db546e5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fdb1df1386cd645db0803567d078fd48

SHA1
d206a015de2d4d177fb76df5be2808f6997ecab7

SHA256
a84ba81742bd305da413bfe983bca4d1c6a85ad036676f71d31608e658feb816

SHA512
15c0cc5995e3fc7ece0e3f0cb71355b3593dd0d72f1e1c452c4a8d0858d00378650b44cccdcec9fb4d82185cc30a8171c7c9f30004b27d4582771e38f5dd76ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
a8404e6a7316617f86998067521d895d

SHA1
c293328f5c37b5eb458426a853185d3e3a0322b1

SHA256
a71a8fd64f83d75cc02fe33a2d395d93f35e32c33052680aeeb921763e92481b

SHA512
8186748d1bdfd79ff203f734d368b18875cc674bb191a5d59d31ace460208b988eed97e4abb38d6c91bc53687dbc21b0ac35b8c0c65043eccd2f07af0630700b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
95f68e5ea732029126c90b68c2fb4b20

SHA1
fd35ec821c88114c9ab00ae28c1705f59f0fb066

SHA256
4064a870776f59e85302d43a2175094b353acd7c4ea207f72168e0932b598812

SHA512
2100d053cc8633fc0c545a30c484394d28bcae03589584a36c09eb5ee27c1e2bc3cd4142184fe9c68e33c9522eef117dae2190a948b240ef1c1446cc3deca80f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
ec3e2825deef8840c9d6c099a0d7f80d

SHA1
95a173d4bb50f1ac0ac71a68591aa2aea7478655

SHA256
dd2349f02be4b669c947ade682fd1fde164ff7312c44956b63eeac32a1b35b60

SHA512
2015c6c368fce7060c4ba4e214cc6d07170c52de4dd88850e5548c4edb4c7cb36fb18227aeb4e6079452ddfac2a4ae35f30ee529a1bc7e862396a8d97fbdeaef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
3edea24fd25808cc4feb7ecfbc324831

SHA1
ed94f89f4dcccc65e187e200dae73a74f86a2462

SHA256
31322eaace86597d255a231e6617424c7a009c1efc421a3698600e5ee6f44828

SHA512
309e129d5369b17f6e6a43cb352d315a313f9d2f64b9844bf745afbc21c4b551232d940f1fb0c5dda720eb856cc1fc31f7e97d2fe93d075dd8045d26cb016213

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
f411e18d44d992652269e3960bff899c

SHA1
f229edb70ae0edabdc30300f6f21d0318fd21872

SHA256
c9bbfd4c122644dc017e81035eb551e970b504d20e39cb8cbe8eccfdfec417c4

SHA512
31c3c71f67e95fda98ccdfb21072ddc0a6374776abc8b4f427b4977bfd12c1a239990f85c4db1d531cf70bef4d64f5cbd35ff38e83e6646cdd116a12708085e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58215e.TMP

Filesize
372B

MD5
5ce51ec80ea09c4cd35881b10b771ef9

SHA1
b579cad3873a17664203d9811dd258914af4d69f

SHA256
ba2d286466c362886bfba17d532cb5ec804fc1dc91301a17eae1615bff6183bd

SHA512
3eebd010eecbd03ded155f1b20614de409cdc051a4760b4578be599754f4edd345417a5f3a0881d324e762bf9867babef6c0a50a466690ccf3726580555068ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
aa33b8b34d4df0a6fbf49192793d2189

SHA1
2d2b5ca8ec155ab4da247ba784a30fa962367265

SHA256
9eebc711f344085c646c8d77894a02b91c1d793983e19c55a2489cf5473cb40e

SHA512
e58a10ae68a4561e33950291e5a02f7e65c04db4e81fd6a7ea1737904f5211f3ffb8e75289bfa1b99584b4f86ad3406d27764a6a0373612eb75a4f2bc9c6e267

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
27e658a8ce017cca508864f7399b4394

SHA1
fe607e0ce173aa48b257df0f5c0c3b7376070956

SHA256
fc1b0757ad260816a0bf252018fd3e4659d50b99b9594fd4232e7271a9eef3d8

SHA512
24a5e31cb539cc4177049f50498d4b57e1482e5cff1f60ad9be56517472a932d57d77fc25b3ef5eba6896c19ddb7417c97a6d37dd2dac11e0aef6d3eccf680a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
08d0f1d10183419b78dabc481c0035d9

SHA1
d5ca8e5011a55f78b35a0f85cd7262ea4d0fad7d

SHA256
3160ddc50daebbaa547113946ef7197a077020f681c230869d82756d831c2a47

SHA512
dc762384c48dd10ed00c4d03968571c974fda7f8f14590fab91816c99b88a6512b891cefa55fadb438bc32286292b6efe9a8af05fed5614ecf45b46760ac54c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e1d964620440abf285bd8929e51952b3

SHA1
dc3d141847a4d210ce6566b80c8ac867c6d2623d

SHA256
9297737e0a718a2da99076a1ca75b218f4a17d21424f0f8bdae7efd431cc20be

SHA512
dd9aa483bf3250df41dcf5e23985b3140a2202c4b810ce1c212f9b3a9e94e68b8cedd627450e225d648c3f70e5214026a6c8e1529ad6f4b95154fcd5c03edb2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e7168185-2c3d-4529-9b74-a6cbafe0775a.tmp

Filesize
11KB

MD5
5de4fea59002c3946a1770c789533af6

SHA1
8a819e9ddfc2793f4f4ef87724da0a2da3114eac

SHA256
ebe1c03f80018f34d15cecf875d605d91fbe790182cd90318bf1393e7b1c4cea

SHA512
e2cefef96df26e5f00124b61a1b400daba2d3598ffb417cfb4850888bfb86a7bec0a1dadaad328e54967e5ee3e0077342a4c6733672ba99e2d85170506345ee7

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
198f782de35af7a91fe69620c36b5678

SHA1
dc32e8b9a6b01dcca84af8d429f51f9751c05666

SHA256
bad741c6cbdf43ee030b033d3f6d879be5a0df6089425fe135f648bf5b5afae5

SHA512
eaa1b075328a024209813bd628e82dea85e47a08c47a463025e0aaad3139125259a4e5a1d1de8d33a0fc01aea6a56fd106bd64c3a61ef3ed4ef9fba777e7b43e

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
cb7f12dcfdc6b608d86b97369da20559

SHA1
a0c46e2add40a9688adec2f4b935fb6995b708b7

SHA256
9fc7074def0916577b2407558a84bf96a9275f88a0bc825f531abcd6b946d997

SHA512
a252846389d80fdba0998b5dba13a8fa4b42c7e76fdc5de39c6741e6bf99baf05b0ef31dda6621f697eb4aaaa2241210a6ac33b96ba291e2394092a2ebc73cce

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bloxstrap\Play Roblox.lnk

Filesize
2KB

MD5
1cc961a6e06ba4b8672305081a92c565

SHA1
ed1e91e5c1701d1251ac847d30f1910a42e41b56

SHA256
5faf100e5c9817e2f311efeddcb273b57c36a1cc21d9b2bd4789b9154b262110

SHA512
762f8f0265c1ee2069c83712b40253ab1f952aed809a32de55ea3717b1e6cd72e73cbe7d17e28dbf0fd475d0108790de10acacca370c614b528b10b8027215c4

Download Submit
C:\Users\Admin\Downloads\Bloxstrap-v2.7.0.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 408262.crdownload

Filesize
10.1MB

MD5
2c752edef5b0aa0962a3e01c4c82a2fa

SHA1
9c3afd1c63f2b0dbdc2dc487709471222d2cb81e

SHA256
891846bf656253ca1cdd28584a28681e9604e2a03d74cd6b99313e3bff11daf8

SHA512
04d25fe7d40c8c320ffc545a038ad6ea458df6a8a552b0e0393b369a03b9bf273c72f30169bd54e8eb10757c04bdddf3859c601c1eb9e1a12fe4d15658906dfe

Download Submit
memory/6844-4279-0x00007FFD8A3D0000-0x00007FFD8A3F0000-memory.dmp

Filesize
128KB

Download
memory/6844-4261-0x00007FFD8B640000-0x00007FFD8B650000-memory.dmp

Filesize
64KB

Download
memory/6844-4291-0x00007FFD8C830000-0x00007FFD8C860000-memory.dmp

Filesize
192KB

Download
memory/6844-4290-0x00007FFD8C830000-0x00007FFD8C860000-memory.dmp

Filesize
192KB

Download
memory/6844-4289-0x00007FFD8C6B0000-0x00007FFD8C6B1000-memory.dmp

Filesize
4KB

Download
memory/6844-4288-0x00007FFD89CD0000-0x00007FFD89CF6000-memory.dmp

Filesize
152KB

Download
memory/6844-4287-0x00007FFD89CD0000-0x00007FFD89CF6000-memory.dmp

Filesize
152KB

Download
memory/6844-4286-0x00007FFD89CD0000-0x00007FFD89CF6000-memory.dmp

Filesize
152KB

Download
memory/6844-4285-0x00007FFD89CD0000-0x00007FFD89CF6000-memory.dmp

Filesize
152KB

Download
memory/6844-4284-0x00007FFD89CD0000-0x00007FFD89CF6000-memory.dmp

Filesize
152KB

Download
memory/6844-4283-0x00007FFD8A3D0000-0x00007FFD8A3F0000-memory.dmp

Filesize
128KB

Download
memory/6844-4282-0x00007FFD8A3D0000-0x00007FFD8A3F0000-memory.dmp

Filesize
128KB

Download
memory/6844-4281-0x00007FFD8A3D0000-0x00007FFD8A3F0000-memory.dmp

Filesize
128KB

Download
memory/6844-4280-0x00007FFD8A3D0000-0x00007FFD8A3F0000-memory.dmp

Filesize
128KB

Download
memory/6844-4257-0x00007FFD8A250000-0x00007FFD8A260000-memory.dmp

Filesize
64KB

Download
memory/6844-4278-0x00007FFD8A3A0000-0x00007FFD8A3B0000-memory.dmp

Filesize
64KB

Download
memory/6844-4277-0x00007FFD8A3A0000-0x00007FFD8A3B0000-memory.dmp

Filesize
64KB

Download
memory/6844-4275-0x00007FFD8A290000-0x00007FFD8A2A0000-memory.dmp

Filesize
64KB

Download
memory/6844-4274-0x00007FFD8C590000-0x00007FFD8C599000-memory.dmp

Filesize
36KB

Download
memory/6844-4273-0x00007FFD8C590000-0x00007FFD8C599000-memory.dmp

Filesize
36KB

Download
memory/6844-4272-0x00007FFD8C590000-0x00007FFD8C599000-memory.dmp

Filesize
36KB

Download
memory/6844-4271-0x00007FFD8C590000-0x00007FFD8C599000-memory.dmp

Filesize
36KB

Download
memory/6844-4270-0x00007FFD8C590000-0x00007FFD8C599000-memory.dmp

Filesize
36KB

Download
memory/6844-4269-0x00007FFD8C570000-0x00007FFD8C580000-memory.dmp

Filesize
64KB

Download
memory/6844-4268-0x00007FFD8C570000-0x00007FFD8C580000-memory.dmp

Filesize
64KB

Download
memory/6844-4267-0x00007FFD8C570000-0x00007FFD8C580000-memory.dmp

Filesize
64KB

Download
memory/6844-4266-0x00007FFD8B680000-0x00007FFD8B68D000-memory.dmp

Filesize
52KB

Download
memory/6844-4265-0x00007FFD8B680000-0x00007FFD8B68D000-memory.dmp

Filesize
52KB

Download
memory/6844-4264-0x00007FFD8B680000-0x00007FFD8B68D000-memory.dmp

Filesize
52KB

Download
memory/6844-4263-0x00007FFD8B680000-0x00007FFD8B68D000-memory.dmp

Filesize
52KB

Download
memory/6844-4262-0x00007FFD8B680000-0x00007FFD8B68D000-memory.dmp

Filesize
52KB

Download
memory/6844-4276-0x00007FFD8A290000-0x00007FFD8A2A0000-memory.dmp

Filesize
64KB

Download
memory/6844-4260-0x00007FFD8B640000-0x00007FFD8B650000-memory.dmp

Filesize
64KB

Download
memory/6844-4259-0x00007FFD8B5D0000-0x00007FFD8B5E0000-memory.dmp

Filesize
64KB

Download
memory/6844-4258-0x00007FFD8B5D0000-0x00007FFD8B5E0000-memory.dmp

Filesize
64KB

Download
memory/6844-4256-0x00007FFD8A250000-0x00007FFD8A260000-memory.dmp

Filesize
64KB

Download
memory/6844-4255-0x00007FFD8A250000-0x00007FFD8A260000-memory.dmp

Filesize
64KB

Download
memory/6844-4254-0x00007FFD8A230000-0x00007FFD8A240000-memory.dmp

Filesize
64KB

Download
memory/6844-4253-0x00007FFD8A230000-0x00007FFD8A240000-memory.dmp

Filesize
64KB

Download
memory/6844-4252-0x00007FFD8A230000-0x00007FFD8A240000-memory.dmp

Filesize
64KB

Download
memory/6844-4251-0x00007FFD8A080000-0x00007FFD8A090000-memory.dmp

Filesize
64KB

Download
memory/6844-4250-0x00007FFD8A080000-0x00007FFD8A090000-memory.dmp

Filesize
64KB

Download
memory/6844-4249-0x00007FFD89F10000-0x00007FFD89F20000-memory.dmp

Filesize
64KB

Download
memory/6844-4248-0x00007FFD89F10000-0x00007FFD89F20000-memory.dmp

Filesize
64KB

Download
memory/6844-4245-0x00007FFD8AED0000-0x00007FFD8AEF0000-memory.dmp

Filesize
128KB

Download
memory/6844-4243-0x00007FFD8AED0000-0x00007FFD8AEF0000-memory.dmp

Filesize
128KB

Download
memory/6844-4242-0x00007FFD8AED0000-0x00007FFD8AEF0000-memory.dmp

Filesize
128KB

Download
memory/6844-4241-0x00007FFD8AEB0000-0x00007FFD8AEC0000-memory.dmp

Filesize
64KB

Download
memory/6844-4240-0x00007FFD8AEB0000-0x00007FFD8AEC0000-memory.dmp

Filesize
64KB

Download
memory/6844-4239-0x00007FFD8AE20000-0x00007FFD8AE30000-memory.dmp

Filesize
64KB

Download
memory/6844-4238-0x00007FFD8AE20000-0x00007FFD8AE30000-memory.dmp

Filesize
64KB

Download
memory/6844-4233-0x00007FFD8C830000-0x00007FFD8C860000-memory.dmp

Filesize
192KB

Download
memory/6844-4231-0x00007FFD8C7E0000-0x00007FFD8C7F0000-memory.dmp

Filesize
64KB

Download
memory/6844-4230-0x00007FFD8C7E0000-0x00007FFD8C7F0000-memory.dmp

Filesize
64KB

Download
memory/6844-4229-0x00007FFD8C6C0000-0x00007FFD8C6D0000-memory.dmp

Filesize
64KB

Download
memory/6844-4237-0x00007FFD8C8C0000-0x00007FFD8C8C9000-memory.dmp

Filesize
36KB

Download
memory/6844-4246-0x00007FFD8AED0000-0x00007FFD8AEF0000-memory.dmp

Filesize
128KB

Download
memory/6844-4247-0x00007FFD8AFC0000-0x00007FFD8AFCC000-memory.dmp

Filesize
48KB

Download
memory/6844-4244-0x00007FFD8AED0000-0x00007FFD8AEF0000-memory.dmp

Filesize
128KB

Download
memory/6844-4234-0x00007FFD8C830000-0x00007FFD8C860000-memory.dmp

Filesize
192KB

Download
memory/6844-4235-0x00007FFD8C830000-0x00007FFD8C860000-memory.dmp

Filesize
192KB

Download
memory/6844-4236-0x00007FFD8C830000-0x00007FFD8C860000-memory.dmp

Filesize
192KB

Download
memory/6844-4232-0x00007FFD8C830000-0x00007FFD8C860000-memory.dmp

Filesize
192KB

Download
memory/6844-4228-0x00007FFD8C6C0000-0x00007FFD8C6D0000-memory.dmp

Filesize
64KB

Download