Analysis

  • max time kernel
    287s
  • max time network
    287s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/04/2024, 00:40

General

  • Target

    https://dosya.co/khzjsc2hoxwf/WaveTrial.rar.html

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Downloads MZ/PE file
  • Sets file execution options in registry 2 TTPs 2 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 7 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 30 IoCs
  • Loads dropped DLL 58 IoCs
  • Registers COM server for autorun 1 TTPs 33 IoCs
  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs
  • Checks system information in the registry 2 TTPs 10 IoCs

    System information is often read in order to detect sandboxing environments.

  • Suspicious use of NtCreateThreadExHideFromDebugger 3 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 55 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 41 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 34 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 27 IoCs
  • Suspicious use of UnmapMainImage 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://dosya.co/khzjsc2hoxwf/WaveTrial.rar.html
    1⤵
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4960
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8ccd546f8,0x7ff8ccd54708,0x7ff8ccd54718
      2⤵
        PID:4228
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
        2⤵
          PID:1164
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:5108
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
          2⤵
            PID:4856
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
            2⤵
              PID:3220
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
              2⤵
                PID:3488
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
                2⤵
                  PID:1380
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:1
                  2⤵
                    PID:2764
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
                    2⤵
                      PID:4104
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 /prefetch:8
                      2⤵
                        PID:784
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4024
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
                        2⤵
                          PID:568
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4756 /prefetch:8
                          2⤵
                            PID:848
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6444 /prefetch:1
                            2⤵
                              PID:5676
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6448 /prefetch:1
                              2⤵
                                PID:5228
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
                                2⤵
                                  PID:5692
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6292 /prefetch:1
                                  2⤵
                                    PID:4720
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6576 /prefetch:1
                                    2⤵
                                      PID:3280
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
                                      2⤵
                                        PID:1712
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5236 /prefetch:8
                                        2⤵
                                          PID:488
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6308 /prefetch:8
                                          2⤵
                                          • Modifies registry class
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:2608
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
                                          2⤵
                                            PID:4932
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6728 /prefetch:1
                                            2⤵
                                              PID:3016
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
                                              2⤵
                                                PID:4984
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
                                                2⤵
                                                  PID:5224
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6944 /prefetch:1
                                                  2⤵
                                                    PID:5188
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6528 /prefetch:1
                                                    2⤵
                                                      PID:1648
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7336 /prefetch:1
                                                      2⤵
                                                        PID:1272
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7040 /prefetch:1
                                                        2⤵
                                                          PID:820
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6212 /prefetch:8
                                                          2⤵
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:3544
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6500 /prefetch:1
                                                          2⤵
                                                            PID:1712
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=7452 /prefetch:8
                                                            2⤵
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:4440
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7848 /prefetch:1
                                                            2⤵
                                                              PID:464
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7800 /prefetch:1
                                                              2⤵
                                                                PID:5940
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7600 /prefetch:1
                                                                2⤵
                                                                  PID:5032
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7984 /prefetch:1
                                                                  2⤵
                                                                    PID:2160
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7404 /prefetch:8
                                                                    2⤵
                                                                      PID:752
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7520 /prefetch:8
                                                                      2⤵
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:1304
                                                                    • C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
                                                                      "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      • Checks whether UAC is enabled
                                                                      • Drops file in Program Files directory
                                                                      • Modifies Internet Explorer settings
                                                                      • Modifies registry class
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:2064
                                                                      • C:\Program Files (x86)\Roblox\Versions\version-8950870ea20941f9\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
                                                                        MicrosoftEdgeWebview2Setup.exe /silent /install
                                                                        3⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Program Files directory
                                                                        PID:1804
                                                                        • C:\Program Files (x86)\Microsoft\Temp\EU139E.tmp\MicrosoftEdgeUpdate.exe
                                                                          "C:\Program Files (x86)\Microsoft\Temp\EU139E.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
                                                                          4⤵
                                                                          • Sets file execution options in registry
                                                                          • Checks computer location settings
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          • Checks system information in the registry
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:5664
                                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
                                                                            5⤵
                                                                            • Executes dropped EXE
                                                                            • Loads dropped DLL
                                                                            • Modifies registry class
                                                                            PID:2484
                                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
                                                                            5⤵
                                                                            • Executes dropped EXE
                                                                            • Loads dropped DLL
                                                                            • Modifies registry class
                                                                            PID:5196
                                                                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                                              6⤵
                                                                              • Executes dropped EXE
                                                                              • Loads dropped DLL
                                                                              • Registers COM server for autorun
                                                                              • Modifies registry class
                                                                              PID:2860
                                                                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                                              6⤵
                                                                              • Executes dropped EXE
                                                                              • Loads dropped DLL
                                                                              • Registers COM server for autorun
                                                                              • Modifies registry class
                                                                              PID:4920
                                                                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                                              6⤵
                                                                              • Executes dropped EXE
                                                                              • Loads dropped DLL
                                                                              • Registers COM server for autorun
                                                                              • Modifies registry class
                                                                              PID:4440
                                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTIwNUIyQkQtNTg3MC00RjdDLUI5NEEtMkY4QkI4RDdGMjkwfSIgdXNlcmlkPSJ7MEQyMTUyOEYtOTNERS00ODkwLTg2MzYtRDdFRkEyNERFNTY2fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins1MzUzRkRGOC0wNDlDLTQ0ODMtOUFGNi00N0ZBNUIzQzlDNTF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3FXSlN6V3dQZmRjTFIrWEdJdjZ4clpmaVlPeGhQVTJzMU5XbWpXY2FGUGc9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xODEuNSIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU3NDkzMjk5NzgiIGluc3RhbGxfdGltZV9tcz0iNTI2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
                                                                            5⤵
                                                                            • Executes dropped EXE
                                                                            • Loads dropped DLL
                                                                            • Checks system information in the registry
                                                                            PID:5136
                                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{A205B2BD-5870-4F7C-B94A-2F8BB8D7F290}" /silent
                                                                            5⤵
                                                                            • Executes dropped EXE
                                                                            • Loads dropped DLL
                                                                            PID:1048
                                                                      • C:\Program Files (x86)\Roblox\Versions\version-8950870ea20941f9\RobloxPlayerBeta.exe
                                                                        "C:\Program Files (x86)\Roblox\Versions\version-8950870ea20941f9\RobloxPlayerBeta.exe" -app -isInstallerLaunch
                                                                        3⤵
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        • Suspicious use of NtCreateThreadExHideFromDebugger
                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of UnmapMainImage
                                                                        PID:7952
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7720 /prefetch:2
                                                                      2⤵
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:4980
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7032 /prefetch:1
                                                                      2⤵
                                                                        PID:1872
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6808 /prefetch:1
                                                                        2⤵
                                                                          PID:4612
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7760 /prefetch:1
                                                                          2⤵
                                                                            PID:2396
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:1
                                                                            2⤵
                                                                              PID:4348
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
                                                                              2⤵
                                                                                PID:5748
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7936 /prefetch:1
                                                                                2⤵
                                                                                  PID:3172
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2012 /prefetch:1
                                                                                  2⤵
                                                                                    PID:824
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5956 /prefetch:8
                                                                                    2⤵
                                                                                      PID:5116
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8028 /prefetch:8
                                                                                      2⤵
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      PID:5956
                                                                                    • C:\Users\Admin\Downloads\Bloxstrap-v2.5.4.exe
                                                                                      "C:\Users\Admin\Downloads\Bloxstrap-v2.5.4.exe"
                                                                                      2⤵
                                                                                      • Checks computer location settings
                                                                                      • Executes dropped EXE
                                                                                      • NTFS ADS
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      • Suspicious use of SendNotifyMessage
                                                                                      PID:4476
                                                                                      • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-8950870ea20941f9\RobloxPlayerBeta.exe
                                                                                        "C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-8950870ea20941f9\RobloxPlayerBeta.exe" --app -channel production
                                                                                        3⤵
                                                                                        • Executes dropped EXE
                                                                                        • Loads dropped DLL
                                                                                        • Suspicious use of NtCreateThreadExHideFromDebugger
                                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of UnmapMainImage
                                                                                        PID:3164
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
                                                                                      2⤵
                                                                                        PID:10020
                                                                                      • C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe
                                                                                        "C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe" roblox-player:1+launchmode:play+gameinfo:IaNYlDDQyqm5DGAxYr-6s9KzKUSxe1ldOIZ19q60ilVYBWRJQ3qod9iqHYdqheEWWKr0fCOBW4U7ew0vFX3PTbXu9wIrCKTbguF15NNaLWNeQTyuLDZ3S3KkW2MSS1EFKBGrc_JO2zcwpHnt9oK_0C5lLcVu0hXniDErBzw94ARfrY4o_cca6FxNUpJ1hBCW7daOl0U7RDUZq3Dp8GHC31yLM7equeSIX_aINCudJuI+launchtime:1712882498820+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1712882459324020%26placeId%3D189707%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3D5aadbc4f-b272-41b8-bad8-abd41e2e2ab0%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1712882459324020+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
                                                                                        2⤵
                                                                                        • Checks computer location settings
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        • Suspicious use of SendNotifyMessage
                                                                                        PID:9888
                                                                                        • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-8950870ea20941f9\RobloxPlayerBeta.exe
                                                                                          "C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-8950870ea20941f9\RobloxPlayerBeta.exe" --app -t IaNYlDDQyqm5DGAxYr-6s9KzKUSxe1ldOIZ19q60ilVYBWRJQ3qod9iqHYdqheEWWKr0fCOBW4U7ew0vFX3PTbXu9wIrCKTbguF15NNaLWNeQTyuLDZ3S3KkW2MSS1EFKBGrc_JO2zcwpHnt9oK_0C5lLcVu0hXniDErBzw94ARfrY4o_cca6FxNUpJ1hBCW7daOl0U7RDUZq3Dp8GHC31yLM7equeSIX_aINCudJuI --launchtime=1712882681206 -j https://www.roblox.com/Game/PlaceLauncher.ashx?request=RequestGame&browserTrackerId=1712882459324020&placeId=189707&isPlayTogetherGame=false&joinAttemptId=5aadbc4f-b272-41b8-bad8-abd41e2e2ab0&joinAttemptOrigin=PlayButton -b 1712882459324020 --rloc en_us --gloc en_us -channel production
                                                                                          3⤵
                                                                                          • Executes dropped EXE
                                                                                          • Loads dropped DLL
                                                                                          • Suspicious use of NtCreateThreadExHideFromDebugger
                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                          • Suspicious use of UnmapMainImage
                                                                                          PID:2020
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10581666562539215946,18361258573689623284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7956 /prefetch:1
                                                                                        2⤵
                                                                                          PID:5780
                                                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                        1⤵
                                                                                          PID:4528
                                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                          1⤵
                                                                                            PID:3992
                                                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                            1⤵
                                                                                              PID:464
                                                                                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
                                                                                              1⤵
                                                                                              • Executes dropped EXE
                                                                                              • Loads dropped DLL
                                                                                              • Checks system information in the registry
                                                                                              • Modifies data under HKEY_USERS
                                                                                              PID:3860
                                                                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTIwNUIyQkQtNTg3MC00RjdDLUI5NEEtMkY4QkI4RDdGMjkwfSIgdXNlcmlkPSJ7MEQyMTUyOEYtOTNERS00ODkwLTg2MzYtRDdFRkEyNERFNTY2fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins3MzE4REI4NS0wMkJBLTRBOEQtQjlGMi0yRkQ4M0VFODcyMTd9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3I0NTJ0MStrMlRncS9IWHpqdkZOQlJob3BCV1I5c2JqWHhxZVVESDl1WDA9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEwNi4wLjUyNDkuMTE5IiBuZXh0dmVyc2lvbj0iMTA2LjAuNTI0OS4xMTkiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSI1IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NzU1NTYwMDkxIi8-PC9hcHA-PC9yZXF1ZXN0Pg
                                                                                                2⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Checks system information in the registry
                                                                                                PID:5008
                                                                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FF804F7C-8AE5-472B-B0EF-8E67667228A7}\MicrosoftEdge_X64_123.0.2420.81.exe
                                                                                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FF804F7C-8AE5-472B-B0EF-8E67667228A7}\MicrosoftEdge_X64_123.0.2420.81.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                                                                                                2⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:220
                                                                                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FF804F7C-8AE5-472B-B0EF-8E67667228A7}\EDGEMITMP_D30D0.tmp\setup.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FF804F7C-8AE5-472B-B0EF-8E67667228A7}\EDGEMITMP_D30D0.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FF804F7C-8AE5-472B-B0EF-8E67667228A7}\MicrosoftEdge_X64_123.0.2420.81.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                                                                                                  3⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Drops file in Program Files directory
                                                                                                  PID:3236
                                                                                                  • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FF804F7C-8AE5-472B-B0EF-8E67667228A7}\EDGEMITMP_D30D0.tmp\setup.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FF804F7C-8AE5-472B-B0EF-8E67667228A7}\EDGEMITMP_D30D0.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=123.0.6312.106 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FF804F7C-8AE5-472B-B0EF-8E67667228A7}\EDGEMITMP_D30D0.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=123.0.2420.81 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ff76360baf8,0x7ff76360bb04,0x7ff76360bb10
                                                                                                    4⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:1932
                                                                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTIwNUIyQkQtNTg3MC00RjdDLUI5NEEtMkY4QkI4RDdGMjkwfSIgdXNlcmlkPSJ7MEQyMTUyOEYtOTNERS00ODkwLTg2MzYtRDdFRkEyNERFNTY2fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins3MkE4Qzk0MS1EQTM1LTQyRTAtODVFOC02QTc0NUY2RTVDRTZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O1ZQUW9QMUYrZnExNXdSemgxa1BMNFBNcFdoOE9STUI1aXp2ck9DL2NoalE9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEyMy4wLjI0MjAuODEiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU3Njg1OTAxMTIiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NzY4NzEwMTEwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjE5OTMzMDAyMCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmYudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvN2EwYTBiZDYtYjljOS00YzU2LTk2NDktZTllOWMyMmZiZTQzP1AxPTE3MTM0ODczNTEmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9SzFPMUFoRlYySzJYJTJiSyUyZiUyYjlxNGJPRFVPalhSYXRMSSUyYk0wM1B3UUpCVUdGWEticlVUQVgyQTQlMmYyWDFweDhGVTUwaCUyZmFSUm80cFF1aDlUQjM1T2lnT0ElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzIwODY3NDQiIHRvdGFsPSIxNzIwODY3NDQiIGRvd25sb2FkX3RpbWVfbXM9IjM2ODQxIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjE5OTQ0MDAzOSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjYyMTQ1Nzk5NjciIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjY3MDkxMjAwNzgiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI0MjUiIGRvd25sb2FkX3RpbWVfbXM9IjQzMDY3IiBkb3dubG9hZGVkPSIxNzIwODY3NDQiIHRvdGFsPSIxNzIwODY3NDQiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjQ5NDUxIi8-PC9hcHA-PC9yZXF1ZXN0Pg
                                                                                                2⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Checks system information in the registry
                                                                                                PID:7892
                                                                                            • C:\Windows\System32\rundll32.exe
                                                                                              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                              1⤵
                                                                                                PID:6900
                                                                                              • C:\Program Files\7-Zip\7zG.exe
                                                                                                "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\WaveTrial\" -spe -an -ai#7zMap12551:80:7zEvent10246
                                                                                                1⤵
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:6984
                                                                                              • C:\Users\Admin\Downloads\WaveTrial\Wave.exe
                                                                                                "C:\Users\Admin\Downloads\WaveTrial\Wave.exe"
                                                                                                1⤵
                                                                                                • Checks computer location settings
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:8520
                                                                                                • C:\Users\Admin\Downloads\WaveTrial\CefSharp.BrowserSubprocess.exe
                                                                                                  "C:\Users\Admin\Downloads\WaveTrial\CefSharp.BrowserSubprocess.exe" --type=gpu-process --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --log-file="C:\Users\Admin\Downloads\WaveTrial\debug.log" --field-trial-handle=2084,i,7918397948095805913,8651301378378010085,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:2 --host-process-id=8520
                                                                                                  2⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Loads dropped DLL
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:8516
                                                                                                • C:\Users\Admin\Downloads\WaveTrial\dist\node.exe
                                                                                                  "C:\Users\Admin\Downloads\WaveTrial\dist\node.exe" server
                                                                                                  2⤵
                                                                                                  • Checks computer location settings
                                                                                                  • Executes dropped EXE
                                                                                                  PID:8628
                                                                                                  • C:\Users\Admin\Downloads\WaveTrial\dist\shared\bin\wave-luau.exe
                                                                                                    C:\Users\Admin\Downloads\WaveTrial\dist\shared\bin\wave-luau.exe lsp --definitions=C:\Users\Admin\Downloads\WaveTrial\dist\shared\bin\globalTypes.d.luau --definitions=C:\Users\Admin\Downloads\WaveTrial\dist\shared\bin\wave.d.luau --docs=C:\Users\Admin\Downloads\WaveTrial\dist\shared\bin\en-us.json
                                                                                                    3⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:9652
                                                                                                • C:\Users\Admin\Downloads\WaveTrial\CefSharp.BrowserSubprocess.exe
                                                                                                  "C:\Users\Admin\Downloads\WaveTrial\CefSharp.BrowserSubprocess.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --log-file="C:\Users\Admin\Downloads\WaveTrial\debug.log" --field-trial-handle=2724,i,7918397948095805913,8651301378378010085,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3 --host-process-id=8520
                                                                                                  2⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Loads dropped DLL
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:8848
                                                                                                • C:\Users\Admin\Downloads\WaveTrial\CefSharp.BrowserSubprocess.exe
                                                                                                  "C:\Users\Admin\Downloads\WaveTrial\CefSharp.BrowserSubprocess.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --log-file="C:\Users\Admin\Downloads\WaveTrial\debug.log" --field-trial-handle=3916,i,7918397948095805913,8651301378378010085,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=3912 /prefetch:8 --host-process-id=8520
                                                                                                  2⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Loads dropped DLL
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:9348
                                                                                                • C:\Users\Admin\Downloads\WaveTrial\CefSharp.BrowserSubprocess.exe
                                                                                                  "C:\Users\Admin\Downloads\WaveTrial\CefSharp.BrowserSubprocess.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --no-sandbox --log-file="C:\Users\Admin\Downloads\WaveTrial\debug.log" --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3984,i,7918397948095805913,8651301378378010085,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=3980 --host-process-id=8520 /prefetch:1
                                                                                                  2⤵
                                                                                                  • Checks computer location settings
                                                                                                  • Executes dropped EXE
                                                                                                  • Loads dropped DLL
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:9316
                                                                                                • C:\Users\Admin\Downloads\WaveTrial\CefSharp.BrowserSubprocess.exe
                                                                                                  "C:\Users\Admin\Downloads\WaveTrial\CefSharp.BrowserSubprocess.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --no-sandbox --log-file="C:\Users\Admin\Downloads\WaveTrial\debug.log" --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=4008,i,7918397948095805913,8651301378378010085,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=4000 --host-process-id=8520 /prefetch:1
                                                                                                  2⤵
                                                                                                  • Checks computer location settings
                                                                                                  • Executes dropped EXE
                                                                                                  • Loads dropped DLL
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:9300
                                                                                                • C:\Users\Admin\Downloads\WaveTrial\Injector.exe
                                                                                                  "C:\Users\Admin\Downloads\WaveTrial\Injector.exe" 2020
                                                                                                  2⤵
                                                                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                  • Checks BIOS information in registry
                                                                                                  • Executes dropped EXE
                                                                                                  • Loads dropped DLL
                                                                                                  • Checks whether UAC is enabled
                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                                  PID:6148

                                                                                              Network

                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                    Replay Monitor

                                                                                                    Loading Replay Monitor...

                                                                                                    Downloads

                                                                                                    • C:\Program Files (x86)\Microsoft\EdgeCore\123.0.2420.81\Installer\setup.exe

                                                                                                      Filesize

                                                                                                      6.8MB

                                                                                                      MD5

                                                                                                      149e6b831dee17cc2122c64124654b5a

                                                                                                      SHA1

                                                                                                      c4f67f0781345cfc6fdfc5670dcbecf3848afee2

                                                                                                      SHA256

                                                                                                      3095052d066346ec2b48726ef87623f3e5e93400c6dd8b1e45a628fc0d72cf40

                                                                                                      SHA512

                                                                                                      679966f6a48ccf9cac63c36a8f6823ed1476198b08d29368db94584b2be2ba4cb1278f4f6510a520933fd09bb83594ab544c94be4c0b05f1d8ee99443fc49085

                                                                                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\123.0.2420.81\MicrosoftEdge_X64_123.0.2420.81.exe

                                                                                                      Filesize

                                                                                                      164.1MB

                                                                                                      MD5

                                                                                                      cf5144a59c3b26558c05a5226c4b53fe

                                                                                                      SHA1

                                                                                                      bcf541fbd1bf0168a2d63ead5b06d8918b89b296

                                                                                                      SHA256

                                                                                                      3a848782e612b4fd77d4910acb1a6f91b1eea3336065d4643486ff17e24970ea

                                                                                                      SHA512

                                                                                                      2d46fdc92c09257cfafc9bdd659413d7925f405d7b78a6d9a44e353984d9fd70b7c3e9b87475eeee80f984377fdbb884055f4a4f10b7972746811326bfeb9a34

                                                                                                    • C:\Program Files (x86)\Microsoft\Temp\EU139E.tmp\EdgeUpdate.dat

                                                                                                      Filesize

                                                                                                      12KB

                                                                                                      MD5

                                                                                                      369bbc37cff290adb8963dc5e518b9b8

                                                                                                      SHA1

                                                                                                      de0ef569f7ef55032e4b18d3a03542cc2bbac191

                                                                                                      SHA256

                                                                                                      3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

                                                                                                      SHA512

                                                                                                      4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

                                                                                                    • C:\Program Files (x86)\Microsoft\Temp\EU139E.tmp\MicrosoftEdgeComRegisterShellARM64.exe

                                                                                                      Filesize

                                                                                                      179KB

                                                                                                      MD5

                                                                                                      7a160c6016922713345454265807f08d

                                                                                                      SHA1

                                                                                                      e36ee184edd449252eb2dfd3016d5b0d2edad3c6

                                                                                                      SHA256

                                                                                                      35a14bd84e74dd6d8e2683470243fb1bb9071178d9283b12ebbfb405c8cd4aa9

                                                                                                      SHA512

                                                                                                      c0f1d5c8455cf14f2088ede062967d6dfa7c39ca2ac9636b10ed46dfbea143f64106a4f03c285e89dd8cf4405612f1eef25a8ec4f15294ca3350053891fc3d7e

                                                                                                    • C:\Program Files (x86)\Microsoft\Temp\EU139E.tmp\MicrosoftEdgeUpdate.exe

                                                                                                      Filesize

                                                                                                      201KB

                                                                                                      MD5

                                                                                                      4dc57ab56e37cd05e81f0d8aaafc5179

                                                                                                      SHA1

                                                                                                      494a90728d7680f979b0ad87f09b5b58f16d1cd5

                                                                                                      SHA256

                                                                                                      87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

                                                                                                      SHA512

                                                                                                      320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

                                                                                                    • C:\Program Files (x86)\Microsoft\Temp\EU139E.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

                                                                                                      Filesize

                                                                                                      212KB

                                                                                                      MD5

                                                                                                      60dba9b06b56e58f5aea1a4149c743d2

                                                                                                      SHA1

                                                                                                      a7e456acf64dd99ca30259cf45b88cf2515a69b3

                                                                                                      SHA256

                                                                                                      4d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112

                                                                                                      SHA512

                                                                                                      e98088a368d4c4468e325a1d62bee49661f597e5c1cd1fe2dabad3911b8ac07e1cc4909e7324cb4ab39f30fa32a34807685fcfba767f88884ef84ca69a0049e7

                                                                                                    • C:\Program Files (x86)\Microsoft\Temp\EU139E.tmp\MicrosoftEdgeUpdateCore.exe

                                                                                                      Filesize

                                                                                                      257KB

                                                                                                      MD5

                                                                                                      c044dcfa4d518df8fc9d4a161d49cece

                                                                                                      SHA1

                                                                                                      91bd4e933b22c010454fd6d3e3b042ab6e8b2149

                                                                                                      SHA256

                                                                                                      9f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2

                                                                                                      SHA512

                                                                                                      f26b89085aa22ac62a28610689e81b4dfe3c38a9015ec56dfeaff02fdb6fa64e784b86a961509b52ad968400faa1ef0487f29f07a41e37239fe4c3262a11ac2c

                                                                                                    • C:\Program Files (x86)\Microsoft\Temp\EU139E.tmp\NOTICE.TXT

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      MD5

                                                                                                      6dd5bf0743f2366a0bdd37e302783bcd

                                                                                                      SHA1

                                                                                                      e5ff6e044c40c02b1fc78304804fe1f993fed2e6

                                                                                                      SHA256

                                                                                                      91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

                                                                                                      SHA512

                                                                                                      f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

                                                                                                    • C:\Program Files (x86)\Microsoft\Temp\EU139E.tmp\msedgeupdate.dll

                                                                                                      Filesize

                                                                                                      2.0MB

                                                                                                      MD5

                                                                                                      965b3af7886e7bf6584488658c050ca2

                                                                                                      SHA1

                                                                                                      72daabdde7cd500c483d0eeecb1bd19708f8e4a5

                                                                                                      SHA256

                                                                                                      d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19

                                                                                                      SHA512

                                                                                                      1c57dc7b89e7f13f21eaec7736b724cd864c443a2f09829308a4f23cb03e9a5f2a1e5bcdc441301e33119767e656a95d0f9ede0e5114bf67f5dce6e55de7b0a4

                                                                                                    • C:\Program Files (x86)\Microsoft\Temp\EU139E.tmp\msedgeupdateres_af.dll

                                                                                                      Filesize

                                                                                                      28KB

                                                                                                      MD5

                                                                                                      567aec2d42d02675eb515bbd852be7db

                                                                                                      SHA1

                                                                                                      66079ae8ac619ff34e3ddb5fb0823b1790ba7b37

                                                                                                      SHA256

                                                                                                      a881788359b2a7d90ac70a76c45938fb337c2064487dcb8be00b9c311d10c24c

                                                                                                      SHA512

                                                                                                      3a7414e95c2927d5496f29814556d731aef19efa531fb58988079287669dfc033f3e04c8740697571df76bfecfe3b75659511783ce34682d2a2ea704dfa115b3

                                                                                                    • C:\Program Files (x86)\Microsoft\Temp\EU139E.tmp\msedgeupdateres_am.dll

                                                                                                      Filesize

                                                                                                      24KB

                                                                                                      MD5

                                                                                                      f6c1324070b6c4e2a8f8921652bfbdfa

                                                                                                      SHA1

                                                                                                      988e6190f26e4ca8f7ea3caabb366cf1edcdcbbf

                                                                                                      SHA256

                                                                                                      986b0654a8b5f7b23478463ff051bffe1e9bbdeb48744e4aa1bd3d89a7520717

                                                                                                      SHA512

                                                                                                      63092cf13e8a19966181df695eb021b0a9993afe8f98b1309973ea999fdf4cd9b6ffd609968d4aa0b2cde41e872688a283fd922d8b22cb5ad06339fe18221100

                                                                                                    • C:\Program Files (x86)\Microsoft\Temp\EU139E.tmp\msedgeupdateres_ar.dll

                                                                                                      Filesize

                                                                                                      26KB

                                                                                                      MD5

                                                                                                      570efe7aa117a1f98c7a682f8112cb6d

                                                                                                      SHA1

                                                                                                      536e7c49e24e9aa068a021a8f258e3e4e69fa64f

                                                                                                      SHA256

                                                                                                      e2cc8017bc24e73048c7ee68d3787ed63c3898eec61299a9ca1bab8aeaa8da01

                                                                                                      SHA512

                                                                                                      5e963dd55a5739a1da19cec7277dc3d07afdb682330998fd8c33a1b5949942019521967d8b5af0752a7a8e2cf536faa7e62982501170319558ceaa21ed657ae8

                                                                                                    • C:\Program Files (x86)\Microsoft\Temp\EU139E.tmp\msedgeupdateres_as.dll

                                                                                                      Filesize

                                                                                                      28KB

                                                                                                      MD5

                                                                                                      a8d3210e34bf6f63a35590245c16bc1b

                                                                                                      SHA1

                                                                                                      f337f2cbec05b7e20ca676d7c2b1a8d5ae8bf693

                                                                                                      SHA256

                                                                                                      3b82de846ad028544013383e3c9fb570d2a09abf2c854e8a4d641bd7fc3b3766

                                                                                                      SHA512

                                                                                                      6e47ffe8f7c2532e7854dcae3cbd4e6533f0238815cb6af5ea85087c51017ea284542b988f07692d0297ebab1bad80d7613bf424ff532e10b01c8e528ab1043a

                                                                                                    • C:\Program Files (x86)\Microsoft\Temp\EU139E.tmp\msedgeupdateres_az.dll

                                                                                                      Filesize

                                                                                                      29KB

                                                                                                      MD5

                                                                                                      7937c407ebe21170daf0975779f1aa49

                                                                                                      SHA1

                                                                                                      4c2a40e76209abd2492dfaaf65ef24de72291346

                                                                                                      SHA256

                                                                                                      5ab96e4e6e065dbce3b643c6be2c668f5570984ead1a8b3578bbd2056fbad4e9

                                                                                                      SHA512

                                                                                                      8670746941660e6573732077f5ed1b630f94a825cf4ac9dbe5018772eaac1c48216334757a2aeaa561034b4d907162a370b8f0bae83b34a09457fafe165fb5d7

                                                                                                    • C:\Program Files (x86)\Microsoft\Temp\EU139E.tmp\msedgeupdateres_bg.dll

                                                                                                      Filesize

                                                                                                      29KB

                                                                                                      MD5

                                                                                                      8375b1b756b2a74a12def575351e6bbd

                                                                                                      SHA1

                                                                                                      802ec096425dc1cab723d4cf2fd1a868315d3727

                                                                                                      SHA256

                                                                                                      a12df15afac4eb2695626d7a8a2888bdf54c8db671043b0677180f746d8ad105

                                                                                                      SHA512

                                                                                                      aec4bb94fde884db79a629abcff27fd8afb7f229d055514f51fa570fb47a85f8dfc9a54a8f69607d2bcaf82fae1ec7ffab0b246795a77a589be11fad51b24d19

                                                                                                    • C:\Program Files (x86)\Microsoft\Temp\EU139E.tmp\msedgeupdateres_bn-IN.dll

                                                                                                      Filesize

                                                                                                      29KB

                                                                                                      MD5

                                                                                                      a94cf5e8b1708a43393263a33e739edd

                                                                                                      SHA1

                                                                                                      1068868bdc271a52aaae6f749028ed3170b09cce

                                                                                                      SHA256

                                                                                                      5b01fe11016610d5606f815281c970c86025732fc597b99c031a018626cd9f3c

                                                                                                      SHA512

                                                                                                      920f7fed1b720afdb569aec2961bd827a6fc54b4598c0704f65da781d142b1707e5106a459f0c289e0f476b054d93c0b733806af036b68f46377dde0541af2e7

                                                                                                    • C:\Program Files (x86)\Microsoft\Temp\EU139E.tmp\msedgeupdateres_bn.dll

                                                                                                      Filesize

                                                                                                      29KB

                                                                                                      MD5

                                                                                                      7dc58c4e27eaf84ae9984cff2cc16235

                                                                                                      SHA1

                                                                                                      3f53499ddc487658932a8c2bcf562ba32afd3bda

                                                                                                      SHA256

                                                                                                      e32f77ed3067d7735d10f80e5a0aa0c50c993b59b82dc834f2583c314e28fa98

                                                                                                      SHA512

                                                                                                      bdec1300cf83ea06dfd351fe1252b850fecea08f9ef9cb1207fce40ce30742348db953107ade6cdb0612af2e774345faf03a8a6476f2f26735eb89153b4256dc

                                                                                                    • C:\Program Files (x86)\Microsoft\Temp\EU139E.tmp\msedgeupdateres_bs.dll

                                                                                                      Filesize

                                                                                                      28KB

                                                                                                      MD5

                                                                                                      e338dccaa43962697db9f67e0265a3fc

                                                                                                      SHA1

                                                                                                      4c6c327efc12d21c4299df7b97bf2c45840e0d83

                                                                                                      SHA256

                                                                                                      99b1b7e25fbc2c64489c0607cef0ae5ff720ab529e11093ed9860d953adeba04

                                                                                                      SHA512

                                                                                                      e0c15b166892433ef31ddf6b086680c55e1a515bed89d51edbdf526fcac71fb4e8cb2fadc739ac75ae5c2d9819fc985ca873b0e9e2a2925f82e0a456210898f9

                                                                                                    • C:\Program Files (x86)\Microsoft\Temp\EU139E.tmp\msedgeupdateres_ca-Es-VALENCIA.dll

                                                                                                      Filesize

                                                                                                      29KB

                                                                                                      MD5

                                                                                                      2929e8d496d95739f207b9f59b13f925

                                                                                                      SHA1

                                                                                                      7c1c574194d9e31ca91e2a21a5c671e5e95c734c

                                                                                                      SHA256

                                                                                                      2726c48a468f8f6debc2d9a6a0706b640b2852c885e603e6b2dec638756160df

                                                                                                      SHA512

                                                                                                      ea459305d3c3fa7a546194f649722b76072f31e75d59da149c57ff05f4af8f38a809066054df809303937bbca917e67441da2f0e1ea37b50007c25ae99429957

                                                                                                    • C:\Program Files (x86)\Microsoft\Temp\EU139E.tmp\msedgeupdateres_ca.dll

                                                                                                      Filesize

                                                                                                      30KB

                                                                                                      MD5

                                                                                                      39551d8d284c108a17dc5f74a7084bb5

                                                                                                      SHA1

                                                                                                      6e43fc5cec4b4b0d44f3b45253c5e0b032e8e884

                                                                                                      SHA256

                                                                                                      8dbd55ed532073874f4fe006ef456e31642317145bd18ddc30f681ce9e0c8e07

                                                                                                      SHA512

                                                                                                      6fa5013a9ce62deca9fa90a98849401b6e164bbad8bef00a8a8b228427520dd584e28cba19c71e2c658692390fe29be28f0398cb6c0f9324c56290bb245d06d2

                                                                                                    • C:\Program Files (x86)\Microsoft\Temp\EU139E.tmp\msedgeupdateres_cs.dll

                                                                                                      Filesize

                                                                                                      28KB

                                                                                                      MD5

                                                                                                      16c84ad1222284f40968a851f541d6bb

                                                                                                      SHA1

                                                                                                      bc26d50e15ccaed6a5fbe801943117269b3b8e6b

                                                                                                      SHA256

                                                                                                      e0f0026ddcbeafc6c991da6ba7c52927d050f928dba4a7153552efcea893a35b

                                                                                                      SHA512

                                                                                                      d3018619469ed25d84713bd6b6515c9a27528810765ed41741ac92caf0a3f72345c465a5bda825041df69e1264aada322b62e10c7ed20b3d1bcde82c7e146b7e

                                                                                                    • C:\Program Files (x86)\Microsoft\Temp\EU139E.tmp\msedgeupdateres_cy.dll

                                                                                                      Filesize

                                                                                                      28KB

                                                                                                      MD5

                                                                                                      34d991980016595b803d212dc356d765

                                                                                                      SHA1

                                                                                                      e3a35df6488c3463c2a7adf89029e1dd8308f816

                                                                                                      SHA256

                                                                                                      252b6f9bf5a9cb59ad1c072e289cc9695c0040b363d4bfbcc9618a12df77d18e

                                                                                                      SHA512

                                                                                                      8a6cbcf812af37e3ead789fbec6cba9c4e1829dbeea6200f0abbdae15efd1eda38c3a2576e819d95ed2df0aafd2370480daa24a3fe6aeb8081a936d5e1f8d8ed

                                                                                                    • C:\Program Files (x86)\Microsoft\Temp\EU139E.tmp\msedgeupdateres_da.dll

                                                                                                      Filesize

                                                                                                      28KB

                                                                                                      MD5

                                                                                                      d34380d302b16eab40d5b63cfb4ed0fe

                                                                                                      SHA1

                                                                                                      1d3047119e353a55dc215666f2b7b69f0ede775b

                                                                                                      SHA256

                                                                                                      fd98159338d1f3b03814af31440d37d15ab183c1a230e6261fbb90e402f85d5f

                                                                                                      SHA512

                                                                                                      45ce58f4343755e392037a9c6fc301ad9392e280a72b9d4b6d328866fe26877b2988c39e05c4e7f1d5b046c0864714b897d35285e222fd668f0d71b7b10e6538

                                                                                                    • C:\Program Files (x86)\Microsoft\Temp\EU139E.tmp\msedgeupdateres_de.dll

                                                                                                      Filesize

                                                                                                      30KB

                                                                                                      MD5

                                                                                                      aab01f0d7bdc51b190f27ce58701c1da

                                                                                                      SHA1

                                                                                                      1a21aabab0875651efd974100a81cda52c462997

                                                                                                      SHA256

                                                                                                      061a7cdaff9867ddb0bd3de2c0760d6919d8d2ca7c7f889ec2d32265d7e7a75c

                                                                                                      SHA512

                                                                                                      5edbda45205b61ac48ea6e874411bb1031989001539650de6e424528f72ec8071bd709c037c956450bb0558ee37d026c26fdb966efceb990ed1219f135b09e6e

                                                                                                    • C:\Program Files (x86)\Microsoft\Temp\EU139E.tmp\msedgeupdateres_el.dll

                                                                                                      Filesize

                                                                                                      30KB

                                                                                                      MD5

                                                                                                      ac275b6e825c3bd87d96b52eac36c0f6

                                                                                                      SHA1

                                                                                                      29e537d81f5d997285b62cd2efea088c3284d18f

                                                                                                      SHA256

                                                                                                      223d2db0bc2cc82bda04a0a2cd2b7f6cb589e2fa5c0471a2d5eb04d2ffcfcfa0

                                                                                                      SHA512

                                                                                                      bba581412c4297c4daf245550a2656cdc2923f77158b171e0eacf6e933c174eac84580864813cf6d75d73d1a58e0caf46170aee3cee9d84dc468379252b16679

                                                                                                    • C:\Program Files (x86)\Microsoft\Temp\EU139E.tmp\msedgeupdateres_en.dll

                                                                                                      Filesize

                                                                                                      27KB

                                                                                                      MD5

                                                                                                      4a1e3cf488e998ef4d22ac25ccc520a5

                                                                                                      SHA1

                                                                                                      dc568a6e3c9465474ef0d761581c733b3371b1cd

                                                                                                      SHA256

                                                                                                      9afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011

                                                                                                      SHA512

                                                                                                      ce3bffb6568ff2ef83ef7c89fd668f6b5972f1484ce3fbd5597dcac0eaec851d5705ed17a5280dd08cd9812d6faec58a5561217b897c9209566545db2f3e1245

                                                                                                    • C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe

                                                                                                      Filesize

                                                                                                      5.1MB

                                                                                                      MD5

                                                                                                      4f9d28edc0c431adbfcc19d8fa47702f

                                                                                                      SHA1

                                                                                                      37a6e145fec66acce633199ea7261bf5dd3d855b

                                                                                                      SHA256

                                                                                                      17e5cfe0cd5e01c1cf679b2fb7da7f3eae6cac2481c41f355c23df375ee0b48d

                                                                                                      SHA512

                                                                                                      bb7a5f33e2ef384347f8ffa09381aee5609a5b4997a205c972e7d431effa8c89f47e065b41f3acd86c2a395e0fdcd2fa656b57c84c3b94bb2fbde52ed2284dc3

                                                                                                    • C:\Program Files (x86)\Roblox\Versions\version-8950870ea20941f9\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe

                                                                                                      Filesize

                                                                                                      1.5MB

                                                                                                      MD5

                                                                                                      610b1b60dc8729bad759c92f82ee2804

                                                                                                      SHA1

                                                                                                      9992b7ae7a9c4e17a0a6d58ffd91b14cbb576552

                                                                                                      SHA256

                                                                                                      921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08

                                                                                                      SHA512

                                                                                                      0614c4e421ccd5f4475a690ba46aac5bbb7d15caea66e2961895724e07e1ec7ee09589ca9394f6b2bcfb2160b17ac53798d3cf40fb207b6e4c6381c8f81ab6b4

                                                                                                    • C:\Program Files\MsEdgeCrashpad\settings.dat

                                                                                                      Filesize

                                                                                                      280B

                                                                                                      MD5

                                                                                                      a2f38268aa677ba21a6f969cacb1246e

                                                                                                      SHA1

                                                                                                      320a2e443f7b7d102ce4f0f80290af4ad3d97462

                                                                                                      SHA256

                                                                                                      bacfc67458c2d35d2538d8724dcf5c775ac55669d02333afa15d37613aea4e34

                                                                                                      SHA512

                                                                                                      a588ddaaf3f12436988b61e0bb1df31d31c6c751203440e7fb22abc10c2b7890e78667a8b65decc7cc21cf61f15050f558b1589bef75f3be768ede935f8e8318

                                                                                                    • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

                                                                                                      Filesize

                                                                                                      100KB

                                                                                                      MD5

                                                                                                      7d29328fdc84ad550e5a0431b8bc26f4

                                                                                                      SHA1

                                                                                                      7e48830f800bd6a4d5c2dd5d6bd98f586dffbced

                                                                                                      SHA256

                                                                                                      bba68047c9d0e50b3b41313a82a873a99768716ab329325ffdd41e6300659c10

                                                                                                      SHA512

                                                                                                      d746fa4ca1e17b71967f160cfd994977a11c50e914b0accfbb7ff1c29a99c9286b589efa013c85dec811147dc664554dbb43da42055fb7d9cf462fd24daa150d

                                                                                                    • C:\Users\Admin\AppData\Local\Bloxstrap\Modifications\ClientSettings\ClientAppSettings.json

                                                                                                      Filesize

                                                                                                      120B

                                                                                                      MD5

                                                                                                      636492f4af87f25c20bd34a731007d86

                                                                                                      SHA1

                                                                                                      22a5c237a739ab0df4ff87c9e3d79dbe0c89b56a

                                                                                                      SHA256

                                                                                                      22a1e85723295eeb854345be57f7d6fb56f02b232a95d69405bf9d9e67a0fa0d

                                                                                                      SHA512

                                                                                                      cd2e3a738f535eb1a119bd4c319555899bcd4ce1049d7f8591a1a68c26844f33c1bd1e171706533b5c36263ade5e275b55d40f5710e0210e010925969182cd0c

                                                                                                    • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-8950870ea20941f9\ExtraContent\textures\ui\LuaApp\graphic\shimmer_lightTheme.png

                                                                                                      Filesize

                                                                                                      20KB

                                                                                                      MD5

                                                                                                      4f8f43c5d5c2895640ed4fdca39737d5

                                                                                                      SHA1

                                                                                                      fb46095bdfcab74d61e1171632c25f783ef495fa

                                                                                                      SHA256

                                                                                                      fc57f32c26087eef61b37850d60934eda1100ca8773f08e487191a74766053d1

                                                                                                      SHA512

                                                                                                      7aebc0f79b2b23a76fb41df8bab4411813ffb1abc5e2797810679c0eaa690e7af7561b8473405694bd967470be337417fa42e30f0318acbf171d8f31620a31aa

                                                                                                    • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-8950870ea20941f9\ExtraContent\textures\ui\LuaApp\graphic\[email protected]

                                                                                                      Filesize

                                                                                                      71KB

                                                                                                      MD5

                                                                                                      3fec0191b36b9d9448a73ff1a937a1f7

                                                                                                      SHA1

                                                                                                      bee7d28204245e3088689ac08da18b43eae531ba

                                                                                                      SHA256

                                                                                                      1a03e6f6a0de045aa588544c392d671c040b82a5598b4246af04f5a74910dc89

                                                                                                      SHA512

                                                                                                      a8ab2bc2d937963af36d3255c6ea09cae6ab1599996450004bb18e8b8bdfbdde728821ac1662d8a0466680679011d8f366577b143766838fe91edf08a40353ce

                                                                                                    • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-8950870ea20941f9\ExtraContent\textures\ui\LuaDiscussions\buttonFill.png

                                                                                                      Filesize

                                                                                                      247B

                                                                                                      MD5

                                                                                                      81ce54dfd6605840a1bd2f9b0b3f807d

                                                                                                      SHA1

                                                                                                      4a3a4c05b9c14c305a8bb06c768abc4958ba2f1c

                                                                                                      SHA256

                                                                                                      0a6a5cafb4dee0d8c1d182ddec9f68ca0471d7fc820cf8dc2d68f27a35cd3386

                                                                                                      SHA512

                                                                                                      57069c8ac03dd0fdfd97e2844c19138800ff6f7d508c26e5bc400b30fe78baa0991cc39f0f86fa10cd5d12b6b11b0b09c1a770e5cb2fdca157c2c8986a09e5ff

                                                                                                    • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-8950870ea20941f9\PlatformContent\pc\textures\corrodedmetal\normaldetail.dds

                                                                                                      Filesize

                                                                                                      176B

                                                                                                      MD5

                                                                                                      f527b5859d7ca6c080ba954f3013883f

                                                                                                      SHA1

                                                                                                      3d00b598b1fb762ae0921bcc49ca189f05f417d2

                                                                                                      SHA256

                                                                                                      ff11c95774ee0405666fa313f1e53ebb46b1352bfff3456ac2b2caccdab07b4d

                                                                                                      SHA512

                                                                                                      e908a29c4316a15f5c16a005c69b402e0525b80e0c3284d6f19074ab8b05d62d079ecf43974b223a68d7c56cbf1789df69ab260553de1aab0edfbdad5e6d654d

                                                                                                    • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-8950870ea20941f9\content\configs\DateTimeLocaleConfigs\zh-hans.json

                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      fb6605abd624d1923aef5f2122b5ae58

                                                                                                      SHA1

                                                                                                      6e98c0a31fa39c781df33628b55568e095be7d71

                                                                                                      SHA256

                                                                                                      7b993133d329c46c0c437d985eead54432944d7b46db6ad6ea755505b8629d00

                                                                                                      SHA512

                                                                                                      97a14eda2010033265b379aa5553359293baf4988a4cdde8a40b0315e318a7b30feee7f5e14c68131e85610c00585d0c67e636999e3af9b5b2209e1a27a82223

                                                                                                    • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-8950870ea20941f9\content\configs\DateTimeLocaleConfigs\zh-tw.json

                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      702c9879f2289959ceaa91d3045f28aa

                                                                                                      SHA1

                                                                                                      775072f139acc8eafb219af355f60b2f57094276

                                                                                                      SHA256

                                                                                                      a92a6988175f9c1d073e4b54bf6a31f9b5d3652eebdf6a351fb5e12bda76cbd5

                                                                                                      SHA512

                                                                                                      815a6bef134c0db7a5926f0cf4b3f7702d71b0b2f13eca9539cd2fc5a61eea81b1884e4c4bc0b3398880589bff809ac8d5df833e7e4aeda4a1244e9a875d1e97

                                                                                                    • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-8950870ea20941f9\content\sounds\ouch.ogg

                                                                                                      Filesize

                                                                                                      6KB

                                                                                                      MD5

                                                                                                      9404c52d6f311da02d65d4320bfebb59

                                                                                                      SHA1

                                                                                                      0b5b5c2e7c631894953d5828fec06bdf6adba55f

                                                                                                      SHA256

                                                                                                      c9775e361392877d1d521d0450a5368ee92d37dc542bc5e514373c9d5003f317

                                                                                                      SHA512

                                                                                                      22aa1acbcdcf56f571170d9c32fd0d025c50936387203a7827dbb925f352d2bc082a8a79db61c2d1f1795ad979e93367c80205d9141b73d806ae08fa089837c4

                                                                                                    • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-8950870ea20941f9\content\textures\Cursors\KeyboardMouse\IBeamCursor.png

                                                                                                      Filesize

                                                                                                      292B

                                                                                                      MD5

                                                                                                      464c4983fa06ad6cf235ec6793de5f83

                                                                                                      SHA1

                                                                                                      8afeb666c8aee7290ab587a2bfb29fc3551669e8

                                                                                                      SHA256

                                                                                                      99fd7f104948c6ab002d1ec69ffd6c896c91f9accc499588df0980b4346ecbed

                                                                                                      SHA512

                                                                                                      f805f5f38535fe487b899486c8de6cf630114964e2c3ebc2af7152a82c6f6faef681b4d936a1867b5dff6566b688b5c01105074443cc2086b3fe71f7e6e404b1

                                                                                                    • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-8950870ea20941f9\content\textures\StudioToolbox\Clear.png

                                                                                                      Filesize

                                                                                                      538B

                                                                                                      MD5

                                                                                                      fa8eaf9266c707e151bb20281b3c0988

                                                                                                      SHA1

                                                                                                      3ca097ad4cd097745d33d386cc2d626ece8cb969

                                                                                                      SHA256

                                                                                                      8cf08bf7e50fea7b38f59f162ed956346c55a714ed8a9a8b0a1ada7e18480bc2

                                                                                                      SHA512

                                                                                                      e29274300eab297c6de895bb39170f73f0a4ffa2a8c3732caeeeac16e2c25fb58bb401fdd5823cc62d9c413ec6c43d7c46861d7e14d52f8d9d8ff632e29f167c

                                                                                                    • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-8950870ea20941f9\content\textures\StudioUIEditor\valueBoxRoundedRectangle.png

                                                                                                      Filesize

                                                                                                      130B

                                                                                                      MD5

                                                                                                      521fb651c83453bf42d7432896040e5e

                                                                                                      SHA1

                                                                                                      8fdbf2cc2617b5b58aaa91b94b0bf755d951cad9

                                                                                                      SHA256

                                                                                                      630303ec4701779eaf86cc9fbf744b625becda53badc7271cbb6ddc56e638d70

                                                                                                      SHA512

                                                                                                      8fa0a50e52a3c7c53735c7dd7af275ebc9c1843f55bb30ebe0587a85955a8da94ff993822d233f7ed118b1070a7d67718b55ba4a597dc49ed2bf2a3836c696f6

                                                                                                    • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-8950870ea20941f9\content\textures\TerrainTools\checkbox_square.png

                                                                                                      Filesize

                                                                                                      985B

                                                                                                      MD5

                                                                                                      2cb16991a26dc803f43963bdc7571e3f

                                                                                                      SHA1

                                                                                                      12ad66a51b60eeaed199bc521800f7c763a3bc7b

                                                                                                      SHA256

                                                                                                      c7bae6d856f3bd9f00c122522eb3534d0d198a9473b6a379a5c3458181870646

                                                                                                      SHA512

                                                                                                      4c9467e5e2d83b778d0fb8b6fd97964f8d8126f07bfd50c5d68c256703f291ceaed56be057e8e2c591b2d2c49f6b7e099a2b7088d0bf5bdd901433459663b1f8

                                                                                                    • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-8950870ea20941f9\content\textures\ui\Controls\XboxController\Thumbstick1.png

                                                                                                      Filesize

                                                                                                      641B

                                                                                                      MD5

                                                                                                      2cbe38df9a03133ddf11a940c09b49cd

                                                                                                      SHA1

                                                                                                      6fb5c191ed8ce9495c66b90aaf53662bfe199846

                                                                                                      SHA256

                                                                                                      0835a661199a7d8df7249e8ae925987184efcc4fb85d9efac3cc2c1495020517

                                                                                                      SHA512

                                                                                                      dcef5baccef9fff632456fe7bc3c4f4a403363d9103a8047a55f4bd4c413d0c5f751a2e37385fe9eba7a420dbdb77ca2ff883d47fcdd35af222191cc5bd5c7a9

                                                                                                    • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-8950870ea20941f9\content\textures\ui\Controls\XboxController\[email protected]

                                                                                                      Filesize

                                                                                                      1KB

                                                                                                      MD5

                                                                                                      e8c88cf5c5ef7ae5ddee2d0e8376b32f

                                                                                                      SHA1

                                                                                                      77f2a5b11436d247d1acc3bac8edffc99c496839

                                                                                                      SHA256

                                                                                                      9607af14604a8e8eb1dec45d3eeca01fed33140c0ccc3e6ef8ca4a1f6219b5dd

                                                                                                      SHA512

                                                                                                      32f5a1e907705346a56fbddfe0d8841d05415ff7abe28ae9281ba46fedf8270b982be0090b72e2e32de0ce36e21934f80eaf508fd010f7ab132d39f5305fb68f

                                                                                                    • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-8950870ea20941f9\content\textures\ui\Controls\XboxController\[email protected]

                                                                                                      Filesize

                                                                                                      1KB

                                                                                                      MD5

                                                                                                      499333dae156bb4c9e9309a4842be4c8

                                                                                                      SHA1

                                                                                                      d18c4c36bdb297208589dc93715560acaf761c3a

                                                                                                      SHA256

                                                                                                      d35a74469f1436f114c27c730a5ec0793073bcf098db37f10158d562a3174591

                                                                                                      SHA512

                                                                                                      91c64173d2cdabc045c70e0538d45e1022cc74ec04989565b85f0f26fe3e788b700a0956a07a8c91d34c06fc1b7fad43bbdbb41b0c6f15b9881c3e46def8103e

                                                                                                    • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-8950870ea20941f9\content\textures\ui\Controls\XboxController\Thumbstick2.png

                                                                                                      Filesize

                                                                                                      738B

                                                                                                      MD5

                                                                                                      a402aacac8be906bcc07d50669d32061

                                                                                                      SHA1

                                                                                                      9d75c1afbe9fc482983978cae4c553aa32625640

                                                                                                      SHA256

                                                                                                      62a313b6cc9ffe7dd86bc9c4fcd7b8e8d1f14a15cdf41a53fb69af4ae3416102

                                                                                                      SHA512

                                                                                                      d11567bcaad8bbd9e2b9f497c3215102c7e7546caf425e93791502d3d2b3f78dec13609796fcd6e1e7f5c7d794bac074d00a74001e7fe943d63463b483877546

                                                                                                    • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-8950870ea20941f9\content\textures\ui\Controls\XboxController\[email protected]

                                                                                                      Filesize

                                                                                                      1KB

                                                                                                      MD5

                                                                                                      83e9b7823c0a5c4c67a603a734233dec

                                                                                                      SHA1

                                                                                                      2eaf04ad636bf71afdf73b004d17d366ac6d333e

                                                                                                      SHA256

                                                                                                      3b5e06eb1a89975def847101f700f0caa60fe0198f53e51974ef1608c6e1e067

                                                                                                      SHA512

                                                                                                      e8abb39a1ec340ac5c7d63137f607cd09eae0e885e4f73b84d8adad1b8f574155b92fbf2c9d3013f64ebbb6d55ead5419e7546b0f70dcde976d49e7440743b0f

                                                                                                    • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-8950870ea20941f9\content\textures\ui\Controls\XboxController\[email protected]

                                                                                                      Filesize

                                                                                                      1KB

                                                                                                      MD5

                                                                                                      55b64987636b9740ab1de7debd1f0b2f

                                                                                                      SHA1

                                                                                                      96f67222ce7d7748ec968e95a2f6495860f9d9c9

                                                                                                      SHA256

                                                                                                      f4a6bb3347ee3e603ea0b2f009bfa802103bc434ae3ff1db1f2043fa8cace8fc

                                                                                                      SHA512

                                                                                                      73a88a278747de3fefbaabb3ff90c1c0750c8d6c17746787f17061f4eff933620407336bf9b755f4222b0943b07d8c4d01de1815d42ea65e78e0daa7072591e9

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                      Filesize

                                                                                                      152B

                                                                                                      MD5

                                                                                                      4d6e17218d9a99976d1a14c6f6944c96

                                                                                                      SHA1

                                                                                                      9e54a19d6c61d99ac8759c5f07b2f0d5faab447f

                                                                                                      SHA256

                                                                                                      32e343d2794af8bc6f2f7c905b5df11d53db4ad8922b92ad5e7cc9c856509d93

                                                                                                      SHA512

                                                                                                      3fa166b3e2d1236298d8dda7071a6fcf2bde283f181b8b0a07c0bb8ba756d6f55fa8a847ca5286d4dbabc6dace67e842a118866320ac01bd5f93cccd3a032e47

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\592dc790-825e-4f19-a199-5677756e31fe.tmp

                                                                                                      Filesize

                                                                                                      5KB

                                                                                                      MD5

                                                                                                      e4df10a62dea9784ac145a532e5f9a53

                                                                                                      SHA1

                                                                                                      f1feb5d373b5e1f98f666661e102f5ec44ed2714

                                                                                                      SHA256

                                                                                                      a5dc8e079b4417bf1e77c91fba82733dea8e359bc8c1b37b6e28f82531a5024e

                                                                                                      SHA512

                                                                                                      0d20d1a5315ff308b95cf80f5a46cb4d424406d7b4ac2d6c28dd8455a904b413d160448bef4ba915ee62bf8fee6855bc04cb41d75c610602432566d9af9b6baf

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

                                                                                                      Filesize

                                                                                                      62KB

                                                                                                      MD5

                                                                                                      c3c0eb5e044497577bec91b5970f6d30

                                                                                                      SHA1

                                                                                                      d833f81cf21f68d43ba64a6c28892945adc317a6

                                                                                                      SHA256

                                                                                                      eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

                                                                                                      SHA512

                                                                                                      83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

                                                                                                      Filesize

                                                                                                      67KB

                                                                                                      MD5

                                                                                                      d2d55f8057f8b03c94a81f3839b348b9

                                                                                                      SHA1

                                                                                                      37c399584539734ff679e3c66309498c8b2dd4d9

                                                                                                      SHA256

                                                                                                      6e273f3491917d37f4dbb6c3f4d3f862cada25c20a36b245ea7c6bd860fb400c

                                                                                                      SHA512

                                                                                                      7bcdbb9e8d005a532ec12485a9c4b777ddec4aee66333757cdae3f84811099a574e719d45eb4487072d0162fa4654349dd73705a8d1913834535b1a3e2247dc6

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

                                                                                                      Filesize

                                                                                                      35KB

                                                                                                      MD5

                                                                                                      18b7cbdaa111d16fb368010c02e56799

                                                                                                      SHA1

                                                                                                      e6f3abc76376bd4a42a0b9aa4b66acbe0ce87e56

                                                                                                      SHA256

                                                                                                      eb3ddfe63402d19db11efc538dbc527ed8c0657acef5c0bcda964e3dec5dd62d

                                                                                                      SHA512

                                                                                                      2743f3db00a9f5fce12b0ec409dbd7b5cc95315feddc9a4d1a51d99a27ab7bbb80452a0157b640eabcbb78a370402f17a958b41928efa175b7c7369d56ec14a0

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

                                                                                                      Filesize

                                                                                                      19KB

                                                                                                      MD5

                                                                                                      76a3f1e9a452564e0f8dce6c0ee111e8

                                                                                                      SHA1

                                                                                                      11c3d925cbc1a52d53584fd8606f8f713aa59114

                                                                                                      SHA256

                                                                                                      381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c

                                                                                                      SHA512

                                                                                                      a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

                                                                                                      Filesize

                                                                                                      63KB

                                                                                                      MD5

                                                                                                      710d7637cc7e21b62fd3efe6aba1fd27

                                                                                                      SHA1

                                                                                                      8645d6b137064c7b38e10c736724e17787db6cf3

                                                                                                      SHA256

                                                                                                      c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

                                                                                                      SHA512

                                                                                                      19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

                                                                                                      Filesize

                                                                                                      84KB

                                                                                                      MD5

                                                                                                      74e33b4b54f4d1f3da06ab47c5936a13

                                                                                                      SHA1

                                                                                                      6e5976d593b6ee3dca3c4dbbb90071b76e1cd85c

                                                                                                      SHA256

                                                                                                      535fc48679c38decd459ad656bdd6914e539754265244d0cc7b1da6bddf3e287

                                                                                                      SHA512

                                                                                                      79218e8ee50484af968480ff9b211815c97c3f3035414e685aa5d15d9b4152682d87b66202339f212bf3b463a074bf7a4431107b50303f28e2eb4b17843991c2

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

                                                                                                      Filesize

                                                                                                      1.1MB

                                                                                                      MD5

                                                                                                      d404b61450122b2ad393c3ece0597317

                                                                                                      SHA1

                                                                                                      d18809185baef8ec6bbbaca300a2fdb4b76a1f56

                                                                                                      SHA256

                                                                                                      03551254e2231ecd9c7ee816b488ecbde5d899009cd9abbe44351d98fbf2f5fb

                                                                                                      SHA512

                                                                                                      cb1a2867cc53733dc72cd294d1b549fa571a041d72de0fa4d7d9195bcac9f8245c2095e6a6f1ece0e55279fa26337cdcc82d4c269e1dd186cbbd2b974e2d6a70

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

                                                                                                      Filesize

                                                                                                      86KB

                                                                                                      MD5

                                                                                                      af56e21d0eb0a70963ca6df325c4248b

                                                                                                      SHA1

                                                                                                      ce625101c2ca32b2024c87f1f1bdd2b57128257b

                                                                                                      SHA256

                                                                                                      369a10dab457a277f4b7d86d330658d2d3f3623caf810c43d39134b2432c3453

                                                                                                      SHA512

                                                                                                      3574f999fd7a17c418c6590e32fccf565ab32437509c10810524f7a92e2418ecc66c4c44dad75fbff1852b0fe09c8e4bf69c2fd427f8fd06218fd63ff6374286

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                      Filesize

                                                                                                      9KB

                                                                                                      MD5

                                                                                                      758fba659a228462de0810ce6a0bc65f

                                                                                                      SHA1

                                                                                                      91f2ed762886cafbf906255a6b6336454f74c2ed

                                                                                                      SHA256

                                                                                                      e2a7ecc264256168dbc8446122a80223bfba55bc5b8e0ebdae52b8912c20b5ee

                                                                                                      SHA512

                                                                                                      2fef5ac678291f690f230f458202de63e5e4948241b6b07144cce86d8a554782689f9fecbfb7867a1d301b3c1f43b41cdb518c3e97f0307344f19b5afb5d70f5

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      MD5

                                                                                                      b1481f79e467e7c9b6c9c3e7e7ef8fc9

                                                                                                      SHA1

                                                                                                      0c41936466f8d5b4811e2d0100ab1b34c6c85420

                                                                                                      SHA256

                                                                                                      3b86931f8bfdc4def59ffb01788ab1564ef8dd230f4f630754b91613c11a6689

                                                                                                      SHA512

                                                                                                      f3ca88850ea754370153a000b67c605f2c41f950e94ae54d893a84aa974b375bff7fb8def9b8944c1b07483747c451b6bdf004de54b6bda04b15494d40f50202

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                      Filesize

                                                                                                      720B

                                                                                                      MD5

                                                                                                      fa7b5b51a7e8805305b9ef1006fcb223

                                                                                                      SHA1

                                                                                                      51483aed3f890a40f874bf77370cd0a4ce896eca

                                                                                                      SHA256

                                                                                                      30f07d86f921bde96554a934f3be945f166b30122c96076ea41d7e1449e8eaba

                                                                                                      SHA512

                                                                                                      d8041c343deabcb8a033a5dbfef16d3f4b22829fba0b1cbf81947816e46b22ac3e86e3511d1e3bb06ed54df85865d20e7151c34abc0968ff912a4d571918c535

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                      Filesize

                                                                                                      6KB

                                                                                                      MD5

                                                                                                      69443dd78d55cab8a4076904ae48e80b

                                                                                                      SHA1

                                                                                                      e3ca16386867daf6069628a1e5489462be3f7ea5

                                                                                                      SHA256

                                                                                                      691792fddc91608c8794d81eded199aec26751e4295fdb519ca34e24322af44e

                                                                                                      SHA512

                                                                                                      6a3f976fc058c1d05fa7df39a16505b62f0b0aae75aa9c9da87a16be83a554a6835b5f317a9918437f9f7cec614d5bae1c6aeb164ffa78d159b39b34110ab3f9

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001

                                                                                                      Filesize

                                                                                                      23B

                                                                                                      MD5

                                                                                                      3fd11ff447c1ee23538dc4d9724427a3

                                                                                                      SHA1

                                                                                                      1335e6f71cc4e3cf7025233523b4760f8893e9c9

                                                                                                      SHA256

                                                                                                      720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

                                                                                                      SHA512

                                                                                                      10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                      Filesize

                                                                                                      5KB

                                                                                                      MD5

                                                                                                      2c4d6b6b417e281e2d78d016672c2633

                                                                                                      SHA1

                                                                                                      ffd312a2f55a79131c124e4311304cdf16323ccd

                                                                                                      SHA256

                                                                                                      7505eb57a0a5e8ab93fa8e60d38f4b872d320ba5239779ad750c6015112f3d43

                                                                                                      SHA512

                                                                                                      384e56e36dd6f000462c69e42dde95cf57ee55f4e257dbef1acd93e8516a7acf52420d821185c0389fcbaf810ce3a226daa416e6777fbfce4d90176a51dd1d95

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                      Filesize

                                                                                                      12KB

                                                                                                      MD5

                                                                                                      15322c7bc4e31b8b30def8f0e92d1f4f

                                                                                                      SHA1

                                                                                                      203a0e0f17ab8b6b5a4385142b3063062703ee95

                                                                                                      SHA256

                                                                                                      efa7948daafd2e64c80ae09ccd856277a5966ea344055e72bcb7a7dd17932cf3

                                                                                                      SHA512

                                                                                                      fcbd8d14a146f16d06c2012f0a2212b9ca13de70549d3bb3f184ba8e5da2050628b5db6e3f930d8b937b97d5d1c8d16a40ab98178b5c2b2a959aaa471e30ce50

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                      Filesize

                                                                                                      111B

                                                                                                      MD5

                                                                                                      285252a2f6327d41eab203dc2f402c67

                                                                                                      SHA1

                                                                                                      acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                                                      SHA256

                                                                                                      5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                                                      SHA512

                                                                                                      11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                      Filesize

                                                                                                      7KB

                                                                                                      MD5

                                                                                                      97cd68e672dc17d89f8d0f933ea0a205

                                                                                                      SHA1

                                                                                                      b82c16b3e9777fff618ded109d76590d00df183b

                                                                                                      SHA256

                                                                                                      634dceb7a38a5363a451bbc80c10c51b1e392d13ea1a9685da9156da8c562eef

                                                                                                      SHA512

                                                                                                      4ad6fa2ee71d943952c841daf6ddb1c32c10541c3c846b2e6d75387d60a3c5723eb9edd373d3e78027a60148605eb3d3e78721f66885dc8e05dc2a0492e650ce

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                      MD5

                                                                                                      622ebfed229caa2f2d4f69264bccc93f

                                                                                                      SHA1

                                                                                                      97e9395ce7bafcc1177b2bc730eee7ce768457e6

                                                                                                      SHA256

                                                                                                      ecb261dfc3b294b122e7e8d73a83392d9b556c5660745b30c4469bc6b6e6be0f

                                                                                                      SHA512

                                                                                                      a2e07c03b4280ed79729f7a7b7148eddfd53f29fb83fd64c0f6982bcea989c939dd24a8d9cc983238a0e1c9781f392e9ac52f7f41ef7dbc545a2804f2e3c7db3

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                      Filesize

                                                                                                      5KB

                                                                                                      MD5

                                                                                                      073847915ba1279f86857df804ec4327

                                                                                                      SHA1

                                                                                                      14daf374d3fd20b02ed6ed40c82773923c5262a9

                                                                                                      SHA256

                                                                                                      1eef5e19c78c02d10b3cb2fe6b40630cb517ccd2855e3dbc75be8d53375cd71b

                                                                                                      SHA512

                                                                                                      a7f62b87eb97258f4db3f417151f487856d7d80bfe4f415a5e04e8b5443d4b377e9530729f51e61b2b6d49e0b621d554a19826c883037e5a51737b6cb74e7ecd

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                      Filesize

                                                                                                      7KB

                                                                                                      MD5

                                                                                                      89668fb89b43b23ad0f6a131c090c5ef

                                                                                                      SHA1

                                                                                                      16f1a0a4b0a3817d1ed5c1c54614b5b8e95a8292

                                                                                                      SHA256

                                                                                                      d573b9d74097447ebf06477b8d6e118edd9b89d68f46df2dc1ee6345af34e4cd

                                                                                                      SHA512

                                                                                                      e39694f48ed33b28a50714ba250166f871391d0f49b74a87badeb1ecae754a48f498414640c5a97a5b7ee213bd62b4b059021c14cf4f9f63acda06d71c49fb95

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                      MD5

                                                                                                      e5a3a9f7f50364fd351a29af23b24f6e

                                                                                                      SHA1

                                                                                                      8523a66adf008652cb5e5708e3b85ec72634b927

                                                                                                      SHA256

                                                                                                      6996fdff519ccc33b183ba05861f8108b1e8a3548bc358cb5f8ed52bd1175009

                                                                                                      SHA512

                                                                                                      dabd150bb6d249291de9d427fc5c2c7b5272392d3fdb241016e1276948069ad8fdad9339d18ac7caa744d1c4086960b54583a317c7c32e066fd20d3c0eccde7c

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                      MD5

                                                                                                      97a24118e7494b7352c98e5e41bdbe5e

                                                                                                      SHA1

                                                                                                      947dba3d8016a304bcaa5088b5679b74674d7aa5

                                                                                                      SHA256

                                                                                                      7f1c6b519029976e99f0fe8fe1f38cbb38ecb1ce739f538d424d5f981258e573

                                                                                                      SHA512

                                                                                                      35203821820a2052198cd1e33b14a21c05435201f59b753e87e0b622eb7193556c232e973c8492571537ae63fb545105c9a3874b805fab33545e241f7598013f

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                      MD5

                                                                                                      b764d8913f05f1c17a06f5b175f6debb

                                                                                                      SHA1

                                                                                                      acc3ac994dc2fb8d52947ee445f722a2750d977a

                                                                                                      SHA256

                                                                                                      8d7322f0c21a95c48be3bb2f272bbad91666078e708719937ae1b4cddfbfa41b

                                                                                                      SHA512

                                                                                                      ae1f92d2f10f10541edc15ff1cb7f784e9adf1d39d781d57efb23fe7b2306ff84c2af7a1f17ef05d5357408deac69177757abec16b27a53375c82c886568fa91

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                      MD5

                                                                                                      a3ed696e1cdf04026662b4eb6ed218fb

                                                                                                      SHA1

                                                                                                      4ad7f8dd566e4f3ce510f2f3990b449bc99f5802

                                                                                                      SHA256

                                                                                                      f40fff65ce03da01d707b226263b7ebf86699ce6a43236666e3995dbf178df4e

                                                                                                      SHA512

                                                                                                      0038e3ab6e6b783772f637960e9334b66f70edb1be913a462f59f617fe92f84b24032e39b6c4c44170761c8fc52eeace29a3f718a3161a6d898dbdf88ea750ad

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                                                      Filesize

                                                                                                      24KB

                                                                                                      MD5

                                                                                                      c2ef1d773c3f6f230cedf469f7e34059

                                                                                                      SHA1

                                                                                                      e410764405adcfead3338c8d0b29371fd1a3f292

                                                                                                      SHA256

                                                                                                      185450d538a894e4dcf55b428f506f3d7baa86664fbbc67afd6c255b65178521

                                                                                                      SHA512

                                                                                                      2ef93803da4d630916bed75d678382fd1c72bff1700a1a72e2612431c6d5e11410ced4eaf522b388028aeadb08e8a77513e16594e6ab081f6d6203e4caa7d549

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                      Filesize

                                                                                                      7KB

                                                                                                      MD5

                                                                                                      9b3ff65d1a7c330ba9c3eebc66d46719

                                                                                                      SHA1

                                                                                                      8b08ced67be4bfc655646e4397fc52c713c27a22

                                                                                                      SHA256

                                                                                                      ad24f9a2bab4db8d42e801a42d3fd709923a659e269892fae432a6f6e938bdad

                                                                                                      SHA512

                                                                                                      13f0aebc173b4faa3afa1d71f587bc404c51fcfc3bb0832954bb2524c2f1ae64a818c432ddfcfcd81c82357d5d25d9bef56eaa98495a08412dc917fa1261594b

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                      Filesize

                                                                                                      7KB

                                                                                                      MD5

                                                                                                      ed8df4ac071d25ca4ff1bb1bb6c82ca3

                                                                                                      SHA1

                                                                                                      f68283b74b844eca4fc867f3213cd736e01c4e34

                                                                                                      SHA256

                                                                                                      4c3b5464dd74c704983c184d3b4f8bed5dbdaa52572da4409a22d84e177f1ce2

                                                                                                      SHA512

                                                                                                      318404965bf7d3fe9ed44fd634a3a67f2f1964d176a4bbd6184a9f0e42a23b0b7bf871351ff51c3b1c8a4940eb07b5a1309390cd8a17b8c6eafba01e766c7b6e

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      8c3281fddc4699c288ebf5d2fc635243

                                                                                                      SHA1

                                                                                                      5f672ac380c22cdfbb8df46d828dc13782338001

                                                                                                      SHA256

                                                                                                      0618e33d5aa7b4b2a86b9a7521d8b8331f8cc206e1949c5002e063f7fd0818d3

                                                                                                      SHA512

                                                                                                      419506962b534524de8544338928f9d5c113a06385a0201eeb60a165388a804fa6168d9a8d5d309b37f76c370c77fe368575b0342e1d386cb06491e393a634c9

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                      Filesize

                                                                                                      7KB

                                                                                                      MD5

                                                                                                      07127a07966cc606689919a48f085f71

                                                                                                      SHA1

                                                                                                      a845e628f5a419785205596bb70a3d1cbd984599

                                                                                                      SHA256

                                                                                                      2436c63e5556a1cf1de998d8d8a74eef06c491741f1c4288b9780f64f049a5ca

                                                                                                      SHA512

                                                                                                      ad040ddcf7cb023770c03780b5bde09304ec3f2933ab4f3fee72e482afd059ec5dcd94736e31794615d3c3794d318929cc325b6739bed530029c3fb4a826acec

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                      Filesize

                                                                                                      7KB

                                                                                                      MD5

                                                                                                      7a63b95c48f7e7c8c11f8bb6b5875e16

                                                                                                      SHA1

                                                                                                      2ec54ab0296780af018c159cc0ad03a14d3cb32b

                                                                                                      SHA256

                                                                                                      605b864f249e77bbd2b527af9dd565c9e46d68033b98d8533d864cd70c34209c

                                                                                                      SHA512

                                                                                                      81c4721da77159073018b120c784f77679e548c1b264e41a0c932b113d868bd2faaf258f053278d71fdb41badb1850bae2ae20639af8d634088c219e3058e05e

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      MD5

                                                                                                      1d17fb473ecabfddc1c39dd544d7adf3

                                                                                                      SHA1

                                                                                                      2d1f0ad963da2c7bbc8cfdbe5d1e1210bf3a9974

                                                                                                      SHA256

                                                                                                      95f17871b00a55212b52d3f08e15c73e6211d3ef3b6643c3a1f316e5eb3c575c

                                                                                                      SHA512

                                                                                                      dbc15475713909c3b29a0a70f706e6aab59e183639712923f5fe5ec1b94e0d20c5052ec8f472e70b792a66edb5b959fde85be8ccc538da5b296829360fa98142

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                      Filesize

                                                                                                      5KB

                                                                                                      MD5

                                                                                                      a4578cbc440bca68af0d5b2e84c05b84

                                                                                                      SHA1

                                                                                                      ec896c6892a529e7f2d5197e624f34743feb0e8a

                                                                                                      SHA256

                                                                                                      537f3b1a880f0e21d9ddee974fdbad11d41d51d3c57b9c5020f31cf214d70ca6

                                                                                                      SHA512

                                                                                                      e5ea21cb02247573e24d59da71ea830e67f34e3c46a0c93724c8b3ad800f1bd449397971f88a6717677311675a0fa0b081550146df0a1ab91be112bbe6fb4285

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                      Filesize

                                                                                                      6KB

                                                                                                      MD5

                                                                                                      3b1fcc1f17439a03e57cceed7030d9ec

                                                                                                      SHA1

                                                                                                      640c5e1ada111b8c0d509e28f53168f152b8bef0

                                                                                                      SHA256

                                                                                                      087d3cb2034fdc086264a410736cd5882d1500a2b08636283c8db52d4783a951

                                                                                                      SHA512

                                                                                                      5699c4d468c57f727dbf5ce55b75669e93e392f1338cc33a62fd1fd53a3ea8741df128ad513cabbbb81a669bd69c55b57c94e9d5a1ff2ae33f586613e33e79a4

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                      Filesize

                                                                                                      7KB

                                                                                                      MD5

                                                                                                      ca69a37b73a2872257e61b2047f396b4

                                                                                                      SHA1

                                                                                                      c07a9a7c6b2ece8eef60648aad5babfce3b55d7f

                                                                                                      SHA256

                                                                                                      37f3369a216bcc78127ada496dac0faace55b010fb37f44a97105cff1df73f85

                                                                                                      SHA512

                                                                                                      d33a49595d02a0b0c7f00231f9406ee82907ba5f884eb6a3ebc6dcbca38a15cff50af9c1fc5f1a9c544496314f0d6c7f3212e4dd477c9ad768339981d61442b3

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                      Filesize

                                                                                                      7KB

                                                                                                      MD5

                                                                                                      d8903e215495c285a8e349b8848ba792

                                                                                                      SHA1

                                                                                                      7f287573a16cef763bbd77ab1598cf4d3e2eb7ba

                                                                                                      SHA256

                                                                                                      8586b61e77b900817209a46a11955c367e776738473ce12b4e9a00124a0432f7

                                                                                                      SHA512

                                                                                                      510ff1e326845f4e84df95930fc7284f110d764bedd9b0237038e7f38b1323489fe37d8dc1282e037bf2c9ae25cd9bb4ef96d94c2af1253fd953acd88a44786b

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                      Filesize

                                                                                                      7KB

                                                                                                      MD5

                                                                                                      03d9579a02edfda7ae61d241bf2fe350

                                                                                                      SHA1

                                                                                                      8a3a8618fc23f9984bda52b9c1b9506e6d1bbd8d

                                                                                                      SHA256

                                                                                                      8fd532c7ac86cba6d7ae4e5d86b4eab9bb05e61920eaf3aace0bf9eb76bba2c5

                                                                                                      SHA512

                                                                                                      4f692616490d25d309faccb0377bff5daeeb62bbfaf0a09ac00c145065f05017911fd2f218487e739d1c2b407c62e3e5e7c527b44abbdb5dce6d1682938e7e6d

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                      Filesize

                                                                                                      7KB

                                                                                                      MD5

                                                                                                      3dab89b1376773c2780568be67d0c84f

                                                                                                      SHA1

                                                                                                      6a02a2c5fa822f0d82180436e9413f9700f629b9

                                                                                                      SHA256

                                                                                                      1608ca2e4ca9e6394f68e5d064c46c5cd0a0fcb6f6ef092a60eac9fad8f197d5

                                                                                                      SHA512

                                                                                                      99f9a240cdc4e412f50aad0baefaad7653f39766b109ea3acce93a4baac046f8882cb34e104262ca77d48e0bd908ea851ad0c590d0c7359d91faa7c1b0f8a09e

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                      Filesize

                                                                                                      7KB

                                                                                                      MD5

                                                                                                      d366d9929ce6aa45b6b687807c46b650

                                                                                                      SHA1

                                                                                                      23fb06daf48f481e0ce9d92a91e9809807b524dd

                                                                                                      SHA256

                                                                                                      eb7d6f39ee23c7e5624aad4eb0e11696d9c9192b54325d3a1d332ae3d5aeb8a7

                                                                                                      SHA512

                                                                                                      2b77ff044d9b3c6c78046cfa0ea08cb6baabf02c376bbbc763361f833031da4b45c24042aa385720a1dc57ebdbcb5b946f1c6dbcc5a61ca674436e4188951fd2

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      fcad1502c90725f1fcc1ae20cc1216ad

                                                                                                      SHA1

                                                                                                      5336b5dd7ff2bf58471e3be8b04f0adda6dac5e8

                                                                                                      SHA256

                                                                                                      3feaf59632a757a35a835b6940522d4d14ad5f359f2283aabf2a7f9094274fe9

                                                                                                      SHA512

                                                                                                      158a45a820512070410dc99233bebdea97aab3e2925c8d63adfa3c7d1054459d720657a3ebdb9c78e2461f7aa1e4842ebd55fcfc6d77c50e807d9411463767a0

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                      Filesize

                                                                                                      5KB

                                                                                                      MD5

                                                                                                      2d82afd6110d2a6dc868fe9f3b69f7a3

                                                                                                      SHA1

                                                                                                      6b61a261593b78cc2a2c286943cc1165b9a398a7

                                                                                                      SHA256

                                                                                                      6e38a61e6a25b62f19e47db2f1a773c8c3b41a2a6dd47e1135e2845f7beadf1a

                                                                                                      SHA512

                                                                                                      93783bc402705e37553fe61ce68103508bc2f8f52e9d8b39f7cc8b65a99194628dec49cf8c666e5b0a4bb333ee903443d2a181ebae9c0569b48e7f2f85cdc5ae

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                      Filesize

                                                                                                      5KB

                                                                                                      MD5

                                                                                                      cd206880d9edcff514307554000ce6ea

                                                                                                      SHA1

                                                                                                      5dbcf00dc7a61666580d8ab357111a32b04fe1a1

                                                                                                      SHA256

                                                                                                      8975dbf31cc1d472451c7111bf5fa51a2f54b17dfe81f19407b159e479bc8187

                                                                                                      SHA512

                                                                                                      48ea812d3926e325a193f48074e541be376bb524acbdc9b1438d9a11f21094f29e2c520c6988a4f03a411b464b943b275b6cd7932a0beff189de27889d36125f

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                      Filesize

                                                                                                      7KB

                                                                                                      MD5

                                                                                                      fa69f1b0e41ec628d23d6c978781fc9c

                                                                                                      SHA1

                                                                                                      2f07613c61dad98f89a6a2517bfe4b4ac0459c4e

                                                                                                      SHA256

                                                                                                      f912a584c2cf8a9eb22467e6028ca188ad7a8b3f45c9cfe50735341c5d9309db

                                                                                                      SHA512

                                                                                                      dc77550cfebbce90a434eecb53f2c96401be5aaea3baec5034c456d0a18f699deb8f9a7b2a83815e58e37b3a0c25a470fdc8367bbc1619582dbf55c18c2d530e

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                      Filesize

                                                                                                      7KB

                                                                                                      MD5

                                                                                                      6013818a618b10fac2a7f0981f050c35

                                                                                                      SHA1

                                                                                                      f6ebf4378c62addf20e644397bd240335f3efc0f

                                                                                                      SHA256

                                                                                                      429375606eace69ed9ba49d3641d4688d841b7500eeb06e7490be48c39008cf0

                                                                                                      SHA512

                                                                                                      5ae5e803142bd1319dae37b294c91df5372084247edf7b37a7ffa598d881eb765f96307806c84b46f299e02e2302cef5ca2139134184e0562233eef9efb34d3b

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      21f74eae3eec8a2652e8fd14d5daea97

                                                                                                      SHA1

                                                                                                      d0c19c39ff50c5064a686965c8559afe0f01a642

                                                                                                      SHA256

                                                                                                      e94751457262ea05aaa8de2c3a39d4170aaba8bf23cc5b55fe52029d25d81d55

                                                                                                      SHA512

                                                                                                      5db584d2970fef4a447da8e610a4800da258bdc664808affc0ba83ac94c008f68220f8d25a66f3b69e85d50a34af7a634978985e8da316916475fb87749bd85d

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                      Filesize

                                                                                                      5KB

                                                                                                      MD5

                                                                                                      d502ddb769523714a4370d2a52fbb843

                                                                                                      SHA1

                                                                                                      0614d6ff25a68cb53bdd8a023e22b630ff29b9d7

                                                                                                      SHA256

                                                                                                      0e1206b12f5c1fe8344d6ba61a5ba8d5f5d23e99fba58847514dc45c2b03b478

                                                                                                      SHA512

                                                                                                      4237fd01787b9a1f05940ee1ea90f55732b18e9a76d2a79380b385faa11d6023950004a1d4f6160f61065e11aed1e85b8de5d6206456d6f81de0b810e5955d50

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                      Filesize

                                                                                                      7KB

                                                                                                      MD5

                                                                                                      c0bcd6744168e1a6165595227a9d5609

                                                                                                      SHA1

                                                                                                      f81e637d95ac5c6f3211104c2c85c242f726d6f8

                                                                                                      SHA256

                                                                                                      846e4071567f7516fd5523ed1ad93f08118d388957b8c4603203d47af2378d99

                                                                                                      SHA512

                                                                                                      d77f8c99c2231eef782b516299749d8b745f62da03deb63adcb60c2a9978bd0ff7df18e62970181b242ef5e4ecee767393313dd6963a7c2be53c3529746fc8da

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                      Filesize

                                                                                                      7KB

                                                                                                      MD5

                                                                                                      28c3b6c864e349d62df627e2adee14d2

                                                                                                      SHA1

                                                                                                      9ab472f90700029cc62c2fe658eed1809b177528

                                                                                                      SHA256

                                                                                                      2bb476e72add8149bc6eed6e9de4bbcec8b83cc40e703a671f9dc7467d7d454d

                                                                                                      SHA512

                                                                                                      5880452b331364bdc07b072345400e564bccdeee3f840d7d4048a839b8717f0dcf2136a4733c76a64f3ad494c3f9c98387c27b53377dfe2540ee84454d7905eb

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c2e2.TMP

                                                                                                      Filesize

                                                                                                      865B

                                                                                                      MD5

                                                                                                      45b7d9ba8b1d75803d18b7ca3384b4a7

                                                                                                      SHA1

                                                                                                      2dbdef2b7af1b6d62438f25f7af7492a2e059ab5

                                                                                                      SHA256

                                                                                                      114a6980f78e047178062253be8a070273ca16e9ea5c19a2e2f77249f1c33eb3

                                                                                                      SHA512

                                                                                                      28f18aa9faecd8705078a24dd3828016ce0793a082cbf0a8501dc78e33c3d49de2ec895e3ccf2fd1fb7a24d51b547f8d508e66be1dc55d9d69deff2b73104a1d

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                      Filesize

                                                                                                      16B

                                                                                                      MD5

                                                                                                      6752a1d65b201c13b62ea44016eb221f

                                                                                                      SHA1

                                                                                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                      SHA256

                                                                                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                      SHA512

                                                                                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                      Filesize

                                                                                                      10KB

                                                                                                      MD5

                                                                                                      6b9ba4631d2a6c67a2cbd5bdcbd2e661

                                                                                                      SHA1

                                                                                                      81e4f90a233397d525fd045fb73362a20aaee261

                                                                                                      SHA256

                                                                                                      a6e087259718f3b164b10f7232defd923f729d06294f8e9af2a89922950ce2c0

                                                                                                      SHA512

                                                                                                      d2425f73bac45a09a52bd4c8113bb0a7a3f993f1bae019793d5ba8e63927bb7db4e9fedfabfe30cb40e03b8463200d9909551e4b537d1f8c74786b993dd642ae

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                      Filesize

                                                                                                      12KB

                                                                                                      MD5

                                                                                                      6e0285af2e52ed269a7ddc1a1b2140c7

                                                                                                      SHA1

                                                                                                      f517baf0138467256c41ca9ca05e3c643afbe066

                                                                                                      SHA256

                                                                                                      94b0afe38e5a36585e9370acdc754700e8217909047d11c089cdcfd70c4a6881

                                                                                                      SHA512

                                                                                                      3d3cad88f595bad1a8c8e5e760808280e399f2a3ce39d97d1b40fc5275b2e9da4da3215a6d579d6cc0073b58e5b0b0e80f8815f819f54893d3998e22464c496d

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                      Filesize

                                                                                                      12KB

                                                                                                      MD5

                                                                                                      fbe2db061674f924e70b5667e9c99b65

                                                                                                      SHA1

                                                                                                      47e5f7e966a91b45a84ef497deaf74982e8ead3f

                                                                                                      SHA256

                                                                                                      cc3b7de86470e340dbdd3e645cdc0d0389d30ecf0db96bd634128b0aac262340

                                                                                                      SHA512

                                                                                                      8f77f3aa911494ed87f698183c90036b250e848b3fe046a821ca913bcfb60a13288538812384b06dad160cde41472c8ad84233769964a9263afb231fc3231bd9

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                      Filesize

                                                                                                      12KB

                                                                                                      MD5

                                                                                                      9a999d25a40d96b12ceb1ee489ba110c

                                                                                                      SHA1

                                                                                                      f2bfae922084307c8e9601a5818204c770fccfff

                                                                                                      SHA256

                                                                                                      8e585c1d1118800b283b5bd5c0f1d0acef6f48106196346d2acd991d62370d6b

                                                                                                      SHA512

                                                                                                      6329782a1cde65c58f36ab152f7a524340d5c8a55f6ee8ef1078ee6676cf691c1a7e62b360d4c71b6dfbd41fff6a0e5a159f1eb7d4d647a31048df1e91dadc03

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                      Filesize

                                                                                                      12KB

                                                                                                      MD5

                                                                                                      82eb0fa2ddccfbc0198439b9bb740d41

                                                                                                      SHA1

                                                                                                      ff3cf8534e58ff628f14e3c81173a30028fcf026

                                                                                                      SHA256

                                                                                                      ccb771ceb7eebdf9084a5468b59e74ff5097cedbdbac083445ece42ac14dc469

                                                                                                      SHA512

                                                                                                      40922f220364249e13f52233cec29f43d75046d4ad2f59be830c5b87f253395194857f2b589e327f8fc55c92aa783e2af3bbd306dc413e254467d04059dd9955

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                      Filesize

                                                                                                      12KB

                                                                                                      MD5

                                                                                                      94b68ade9fbfcd2a8c4682c831223294

                                                                                                      SHA1

                                                                                                      d81fec8cc1c5d975fdfec1c13791e831213de11e

                                                                                                      SHA256

                                                                                                      c9e2a1067c5127c5c4aec75fa413853d9087b05eaee5cef28a147da918c5cd35

                                                                                                      SHA512

                                                                                                      6afe6a6b275e44b943a207294485f2f2d5619ebd2b3631588e36d3f8f6149e7335190e093b918aeabd424c1a09ce1aa481cdffd82847ec53d797892190809b8c

                                                                                                    • C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\f3b8e82c20c4bb3f94a2d7bcd2a82cd1

                                                                                                      Filesize

                                                                                                      5.6MB

                                                                                                      MD5

                                                                                                      f3b8e82c20c4bb3f94a2d7bcd2a82cd1

                                                                                                      SHA1

                                                                                                      89618596be7cb90317eaaf2d09b05d522d008260

                                                                                                      SHA256

                                                                                                      7de6a5a45227b0f21ac7dd50af250e37f20b8bf2d6f4aa53a7f643d77515bd07

                                                                                                      SHA512

                                                                                                      82f15e37366efd29879add4f50cedbdc27d4eb885e190dd54c8e89787b51d59ccc21473f431292da679c7e8aa7cf2d0ce7219e1503d59a0f356e078f9feece55

                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

                                                                                                      Filesize

                                                                                                      2B

                                                                                                      MD5

                                                                                                      f3b25701fe362ec84616a93a45ce9998

                                                                                                      SHA1

                                                                                                      d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                                                                                      SHA256

                                                                                                      b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                                                                                      SHA512

                                                                                                      98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                                                                                                    • C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe

                                                                                                      Filesize

                                                                                                      5.2MB

                                                                                                      MD5

                                                                                                      9fb66ffa1e1f4dedfd16eb3a8170bafd

                                                                                                      SHA1

                                                                                                      69b5d57ddda6b97adde820b9ceaddae9c33d53bd

                                                                                                      SHA256

                                                                                                      7953b28b736795aaa54e6cd5cb591e794e2f770c1045ca2e33af5ff19f480eaa

                                                                                                      SHA512

                                                                                                      4b141802e7a4cb6bd4a7498d30086a9d83c62d37f2137f4910ca7d3fb7009079d4dc59b95050849cfc720210b0cb44bf588d15c08e3ba830aae19c0a27e8e6d5

                                                                                                    • C:\Users\Admin\Downloads\Unconfirmed 455167.crdownload

                                                                                                      Filesize

                                                                                                      7.6MB

                                                                                                      MD5

                                                                                                      dbb820772caf0003967ef0f269fbdeb1

                                                                                                      SHA1

                                                                                                      31992bd4977a7dfeba67537a2da6c9ca64bc304c

                                                                                                      SHA256

                                                                                                      b2ac1e407ed3ecd7c7faa6de929a68fb51145662cf793c40b69eb59295bba6bc

                                                                                                      SHA512

                                                                                                      e8ac879c7198dffb78bc6ee4ad49b5de40a5a7dbbda53d427d0a034941487d13c8bb2b8d590a1fcdd81cd6abb8f21fdfcd52924eb00c45a42ee06c1e4b3d590f

                                                                                                    • C:\Users\Admin\Downloads\WaveTrial\data\settings.json

                                                                                                      Filesize

                                                                                                      302B

                                                                                                      MD5

                                                                                                      801b80146dc98d71f1e858ecb80a0ffb

                                                                                                      SHA1

                                                                                                      e81e181133354fd8c83a58230e71887dbe406219

                                                                                                      SHA256

                                                                                                      6aca09ff0ab2488bd827b04d268f0be01427c4bd42b8e457bf1b67b2d968b388

                                                                                                      SHA512

                                                                                                      72dbeea7f9200824e91d08d859b758a897803bc0d8aabf00e8de43bb743c38c2fff30a59402c0a905e5cff6a9a9d4da339b3280a1405770e2757beaf0e716f0c

                                                                                                    • C:\Users\Admin\Downloads\WaveTrial\dist\client\assets\index-daab.js

                                                                                                      Filesize

                                                                                                      3.4MB

                                                                                                      MD5

                                                                                                      a19bf5e804004e0397a4547f9a8568fe

                                                                                                      SHA1

                                                                                                      daad35851be0986f1a99f5563976309c2f7fc800

                                                                                                      SHA256

                                                                                                      66909b895c0b86eb1edaf95c0d728939a4986f01bf5112023bf52a6afc021155

                                                                                                      SHA512

                                                                                                      2e98dedf48e2f16543ef28cdfad832f77a6250f6e71cadd2245e58aa4872a91934f390ad8552a1c59b035ead123904b95c31a1fb3d7ba3dbf49968b018755c5a

                                                                                                    • memory/2020-10266-0x000001CFBD670000-0x000001CFBD671000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/2020-10277-0x00007FF8DBE20000-0x00007FF8DBE21000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/3164-9341-0x00007FF8DBB50000-0x00007FF8DBB60000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/3164-9377-0x00007FF8D9E00000-0x00007FF8D9E27000-memory.dmp

                                                                                                      Filesize

                                                                                                      156KB

                                                                                                    • memory/3164-9340-0x00007FF8DBB50000-0x00007FF8DBB60000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/3164-9338-0x00007FF8DBB30000-0x00007FF8DBB40000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/3164-9335-0x00007FF8DBAA0000-0x00007FF8DBAB0000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/3164-9339-0x00007FF8DBB50000-0x00007FF8DBB60000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/3164-9337-0x00007FF8DBB30000-0x00007FF8DBB40000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/3164-9342-0x00007FF8DBB50000-0x00007FF8DBB60000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/3164-9343-0x00007FF8DBB50000-0x00007FF8DBB60000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/3164-9344-0x00007FF8D95E0000-0x00007FF8D95F0000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/3164-9345-0x00007FF8D95E0000-0x00007FF8D95F0000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/3164-9346-0x00007FF8D96F0000-0x00007FF8D9700000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/3164-9347-0x00007FF8D96F0000-0x00007FF8D9700000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/3164-9348-0x00007FF8D9860000-0x00007FF8D9890000-memory.dmp

                                                                                                      Filesize

                                                                                                      192KB

                                                                                                    • memory/3164-9349-0x00007FF8D9860000-0x00007FF8D9890000-memory.dmp

                                                                                                      Filesize

                                                                                                      192KB

                                                                                                    • memory/3164-9350-0x00007FF8D9860000-0x00007FF8D9890000-memory.dmp

                                                                                                      Filesize

                                                                                                      192KB

                                                                                                    • memory/3164-9351-0x00007FF8D9860000-0x00007FF8D9890000-memory.dmp

                                                                                                      Filesize

                                                                                                      192KB

                                                                                                    • memory/3164-9352-0x00007FF8D9860000-0x00007FF8D9890000-memory.dmp

                                                                                                      Filesize

                                                                                                      192KB

                                                                                                    • memory/3164-9354-0x00007FF8DABF0000-0x00007FF8DAC00000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/3164-9353-0x00007FF8DABF0000-0x00007FF8DAC00000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/3164-9356-0x00007FF8DACA0000-0x00007FF8DACAE000-memory.dmp

                                                                                                      Filesize

                                                                                                      56KB

                                                                                                    • memory/3164-9355-0x00007FF8DACA0000-0x00007FF8DACAE000-memory.dmp

                                                                                                      Filesize

                                                                                                      56KB

                                                                                                    • memory/3164-9358-0x00007FF8DACA0000-0x00007FF8DACAE000-memory.dmp

                                                                                                      Filesize

                                                                                                      56KB

                                                                                                    • memory/3164-9357-0x00007FF8DACA0000-0x00007FF8DACAE000-memory.dmp

                                                                                                      Filesize

                                                                                                      56KB

                                                                                                    • memory/3164-9359-0x00007FF8DACA0000-0x00007FF8DACAE000-memory.dmp

                                                                                                      Filesize

                                                                                                      56KB

                                                                                                    • memory/3164-9360-0x00007FF8D9E80000-0x00007FF8D9E90000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/3164-9361-0x00007FF8D9E80000-0x00007FF8D9E90000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/3164-9362-0x00007FF8D9EA0000-0x00007FF8D9EAB000-memory.dmp

                                                                                                      Filesize

                                                                                                      44KB

                                                                                                    • memory/3164-9363-0x00007FF8D9EA0000-0x00007FF8D9EAB000-memory.dmp

                                                                                                      Filesize

                                                                                                      44KB

                                                                                                    • memory/3164-9365-0x00007FF8D9EA0000-0x00007FF8D9EAB000-memory.dmp

                                                                                                      Filesize

                                                                                                      44KB

                                                                                                    • memory/3164-9364-0x00007FF8D9EA0000-0x00007FF8D9EAB000-memory.dmp

                                                                                                      Filesize

                                                                                                      44KB

                                                                                                    • memory/3164-9366-0x00007FF8D9EA0000-0x00007FF8D9EAB000-memory.dmp

                                                                                                      Filesize

                                                                                                      44KB

                                                                                                    • memory/3164-9368-0x00007FF8D9B90000-0x00007FF8D9BA0000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/3164-9367-0x00007FF8D9B90000-0x00007FF8D9BA0000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/3164-9369-0x00007FF8D9C90000-0x00007FF8D9CA0000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/3164-9370-0x00007FF8D9C90000-0x00007FF8D9CA0000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/3164-9371-0x00007FF8D9CC0000-0x00007FF8D9CE6000-memory.dmp

                                                                                                      Filesize

                                                                                                      152KB

                                                                                                    • memory/3164-9378-0x00007FF8D9E00000-0x00007FF8D9E27000-memory.dmp

                                                                                                      Filesize

                                                                                                      156KB

                                                                                                    • memory/3164-9379-0x00007FF8D9E00000-0x00007FF8D9E27000-memory.dmp

                                                                                                      Filesize

                                                                                                      156KB

                                                                                                    • memory/3164-9332-0x00007FF8DC020000-0x00007FF8DC025000-memory.dmp

                                                                                                      Filesize

                                                                                                      20KB

                                                                                                    • memory/3164-9376-0x00007FF8D9E00000-0x00007FF8D9E27000-memory.dmp

                                                                                                      Filesize

                                                                                                      156KB

                                                                                                    • memory/3164-9375-0x00007FF8D9CC0000-0x00007FF8D9CE6000-memory.dmp

                                                                                                      Filesize

                                                                                                      152KB

                                                                                                    • memory/3164-9374-0x00007FF8D9CC0000-0x00007FF8D9CE6000-memory.dmp

                                                                                                      Filesize

                                                                                                      152KB

                                                                                                    • memory/3164-9373-0x00007FF8D9CC0000-0x00007FF8D9CE6000-memory.dmp

                                                                                                      Filesize

                                                                                                      152KB

                                                                                                    • memory/3164-9372-0x00007FF8D9CC0000-0x00007FF8D9CE6000-memory.dmp

                                                                                                      Filesize

                                                                                                      152KB

                                                                                                    • memory/3164-9386-0x00007FF8D9550000-0x00007FF8D9572000-memory.dmp

                                                                                                      Filesize

                                                                                                      136KB

                                                                                                    • memory/3164-9387-0x00007FF8D9550000-0x00007FF8D9572000-memory.dmp

                                                                                                      Filesize

                                                                                                      136KB

                                                                                                    • memory/3164-9385-0x00007FF8D9550000-0x00007FF8D9572000-memory.dmp

                                                                                                      Filesize

                                                                                                      136KB

                                                                                                    • memory/3164-9388-0x00007FF8DBE20000-0x00007FF8DBE21000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/3164-9384-0x00007FF8D9550000-0x00007FF8D9572000-memory.dmp

                                                                                                      Filesize

                                                                                                      136KB

                                                                                                    • memory/3164-9383-0x00007FF8D9550000-0x00007FF8D9572000-memory.dmp

                                                                                                      Filesize

                                                                                                      136KB

                                                                                                    • memory/3164-9382-0x00007FF8D9E00000-0x00007FF8D9E27000-memory.dmp

                                                                                                      Filesize

                                                                                                      156KB

                                                                                                    • memory/3164-9381-0x00007FF8D9E00000-0x00007FF8D9E27000-memory.dmp

                                                                                                      Filesize

                                                                                                      156KB

                                                                                                    • memory/3164-9380-0x00007FF8D9E00000-0x00007FF8D9E27000-memory.dmp

                                                                                                      Filesize

                                                                                                      156KB

                                                                                                    • memory/3164-9331-0x00007FF8DBF90000-0x00007FF8DBFC0000-memory.dmp

                                                                                                      Filesize

                                                                                                      192KB

                                                                                                    • memory/3164-9334-0x00007FF8DBAA0000-0x00007FF8DBAB0000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/3164-9329-0x00007FF8DBF90000-0x00007FF8DBFC0000-memory.dmp

                                                                                                      Filesize

                                                                                                      192KB

                                                                                                    • memory/3164-10131-0x00007FF8BB5E0000-0x00007FF8BBADE000-memory.dmp

                                                                                                      Filesize

                                                                                                      5.0MB

                                                                                                    • memory/3164-9330-0x00007FF8DBF90000-0x00007FF8DBFC0000-memory.dmp

                                                                                                      Filesize

                                                                                                      192KB

                                                                                                    • memory/3164-9327-0x00007FF8DBF90000-0x00007FF8DBFC0000-memory.dmp

                                                                                                      Filesize

                                                                                                      192KB

                                                                                                    • memory/3164-9313-0x00007FF8BB5E0000-0x00007FF8BBADE000-memory.dmp

                                                                                                      Filesize

                                                                                                      5.0MB

                                                                                                    • memory/3164-9324-0x00007FF8DBE30000-0x00007FF8DBE40000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/3164-9323-0x00007FF8DBE30000-0x00007FF8DBE40000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/3164-9336-0x00007FF8DBE20000-0x00007FF8DBE21000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/3164-9326-0x00007FF8DBF40000-0x00007FF8DBF50000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/3164-9328-0x00007FF8DBF90000-0x00007FF8DBFC0000-memory.dmp

                                                                                                      Filesize

                                                                                                      192KB

                                                                                                    • memory/3164-9325-0x00007FF8DBF40000-0x00007FF8DBF50000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/4476-2203-0x00007FF8BB5E0000-0x00007FF8BBADE000-memory.dmp

                                                                                                      Filesize

                                                                                                      5.0MB

                                                                                                    • memory/4476-10189-0x00007FF8BB5E0000-0x00007FF8BBADE000-memory.dmp

                                                                                                      Filesize

                                                                                                      5.0MB

                                                                                                    • memory/4476-9333-0x00007FF8BB5E0000-0x00007FF8BBADE000-memory.dmp

                                                                                                      Filesize

                                                                                                      5.0MB

                                                                                                    • memory/6148-10369-0x00007FF6A0F80000-0x00007FF6A18E0000-memory.dmp

                                                                                                      Filesize

                                                                                                      9.4MB

                                                                                                    • memory/6148-10370-0x00007FF8DBE30000-0x00007FF8DC025000-memory.dmp

                                                                                                      Filesize

                                                                                                      2.0MB

                                                                                                    • memory/7952-10050-0x00007FF8DBE20000-0x00007FF8DBE21000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/8516-10165-0x0000028128810000-0x0000028128816000-memory.dmp

                                                                                                      Filesize

                                                                                                      24KB

                                                                                                    • memory/8516-10167-0x00007FF8A68D0000-0x00007FF8A7391000-memory.dmp

                                                                                                      Filesize

                                                                                                      10.8MB

                                                                                                    • memory/8516-10166-0x0000028142CB0000-0x0000028142DCE000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.1MB

                                                                                                    • memory/8516-10168-0x0000028142E60000-0x0000028142E70000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/8516-10243-0x0000028142E60000-0x0000028142E70000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/8516-10237-0x00007FF8A68D0000-0x00007FF8A7391000-memory.dmp

                                                                                                      Filesize

                                                                                                      10.8MB

                                                                                                    • memory/8520-10150-0x00000283B70B0000-0x00000283B7196000-memory.dmp

                                                                                                      Filesize

                                                                                                      920KB

                                                                                                    • memory/8520-10191-0x00000283B77E0000-0x00000283B7882000-memory.dmp

                                                                                                      Filesize

                                                                                                      648KB

                                                                                                    • memory/8520-10195-0x00000283B7620000-0x00000283B762C000-memory.dmp

                                                                                                      Filesize

                                                                                                      48KB

                                                                                                    • memory/8520-10196-0x00000283BB780000-0x00000283BB7E6000-memory.dmp

                                                                                                      Filesize

                                                                                                      408KB

                                                                                                    • memory/8520-10197-0x00000283B7630000-0x00000283B763A000-memory.dmp

                                                                                                      Filesize

                                                                                                      40KB

                                                                                                    • memory/8520-10198-0x00000283B7780000-0x00000283B77A6000-memory.dmp

                                                                                                      Filesize

                                                                                                      152KB

                                                                                                    • memory/8520-10199-0x00000283BB8E0000-0x00000283BB912000-memory.dmp

                                                                                                      Filesize

                                                                                                      200KB

                                                                                                    • memory/8520-10200-0x000002839CDA0000-0x000002839CDB0000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/8520-10201-0x00000283BB7F0000-0x00000283BB7F8000-memory.dmp

                                                                                                      Filesize

                                                                                                      32KB

                                                                                                    • memory/8520-10203-0x00000283BDE90000-0x00000283BDE9E000-memory.dmp

                                                                                                      Filesize

                                                                                                      56KB

                                                                                                    • memory/8520-10202-0x00000283BDEC0000-0x00000283BDEF8000-memory.dmp

                                                                                                      Filesize

                                                                                                      224KB

                                                                                                    • memory/8520-10204-0x00000283BDF50000-0x00000283BDF94000-memory.dmp

                                                                                                      Filesize

                                                                                                      272KB

                                                                                                    • memory/8520-10193-0x00000283B7730000-0x00000283B774E000-memory.dmp

                                                                                                      Filesize

                                                                                                      120KB

                                                                                                    • memory/8520-10216-0x00007FF8A68D0000-0x00007FF8A7391000-memory.dmp

                                                                                                      Filesize

                                                                                                      10.8MB

                                                                                                    • memory/8520-10146-0x000002839C2C0000-0x000002839C9C8000-memory.dmp

                                                                                                      Filesize

                                                                                                      7.0MB

                                                                                                    • memory/8520-10147-0x00007FF8A68D0000-0x00007FF8A7391000-memory.dmp

                                                                                                      Filesize

                                                                                                      10.8MB

                                                                                                    • memory/8520-10220-0x000002839CDA0000-0x000002839CDB0000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/8520-10221-0x000002839CDA0000-0x000002839CDB0000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/8520-10148-0x000002839CDA0000-0x000002839CDB0000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/8520-10224-0x00000283C2840000-0x00000283C2D68000-memory.dmp

                                                                                                      Filesize

                                                                                                      5.2MB

                                                                                                    • memory/8520-10149-0x00000283B6F90000-0x00000283B6FB4000-memory.dmp

                                                                                                      Filesize

                                                                                                      144KB

                                                                                                    • memory/8520-10225-0x00000283C2310000-0x00000283C2496000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.5MB

                                                                                                    • memory/8520-10192-0x00000283B7640000-0x00000283B765A000-memory.dmp

                                                                                                      Filesize

                                                                                                      104KB

                                                                                                    • memory/8520-10194-0x00000283BB830000-0x00000283BB8D2000-memory.dmp

                                                                                                      Filesize

                                                                                                      648KB

                                                                                                    • memory/8520-10190-0x00000283B7600000-0x00000283B761E000-memory.dmp

                                                                                                      Filesize

                                                                                                      120KB

                                                                                                    • memory/8520-10151-0x00000283B71A0000-0x00000283B7361000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                    • memory/8520-10152-0x00000283B7470000-0x00000283B7522000-memory.dmp

                                                                                                      Filesize

                                                                                                      712KB

                                                                                                    • memory/8520-10153-0x00000283B6FF0000-0x00000283B7012000-memory.dmp

                                                                                                      Filesize

                                                                                                      136KB

                                                                                                    • memory/8520-10187-0x00000283B7660000-0x00000283B76D6000-memory.dmp

                                                                                                      Filesize

                                                                                                      472KB

                                                                                                    • memory/8520-10263-0x000002839CDA0000-0x000002839CDB0000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/8520-10356-0x000002839CDA0000-0x000002839CDB0000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/8520-10159-0x00000283B9520000-0x00000283B956A000-memory.dmp

                                                                                                      Filesize

                                                                                                      296KB

                                                                                                    • memory/8848-10247-0x00000180D2BF0000-0x00000180D2C00000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/8848-10184-0x00007FF8A68D0000-0x00007FF8A7391000-memory.dmp

                                                                                                      Filesize

                                                                                                      10.8MB

                                                                                                    • memory/8848-10246-0x00007FF8A68D0000-0x00007FF8A7391000-memory.dmp

                                                                                                      Filesize

                                                                                                      10.8MB

                                                                                                    • memory/8848-10185-0x00000180D2BF0000-0x00000180D2C00000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/9300-10264-0x00007FF8A68D0000-0x00007FF8A7391000-memory.dmp

                                                                                                      Filesize

                                                                                                      10.8MB

                                                                                                    • memory/9300-10357-0x0000025B8E850000-0x0000025B8E860000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/9300-10217-0x00007FF8A68D0000-0x00007FF8A7391000-memory.dmp

                                                                                                      Filesize

                                                                                                      10.8MB

                                                                                                    • memory/9316-10368-0x00007FF8A68D0000-0x00007FF8A7391000-memory.dmp

                                                                                                      Filesize

                                                                                                      10.8MB

                                                                                                    • memory/9316-10223-0x00007FF8A68D0000-0x00007FF8A7391000-memory.dmp

                                                                                                      Filesize

                                                                                                      10.8MB

                                                                                                    • memory/9348-10358-0x0000022066F80000-0x0000022066F90000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/9348-10265-0x00007FF8A68D0000-0x00007FF8A7391000-memory.dmp

                                                                                                      Filesize

                                                                                                      10.8MB

                                                                                                    • memory/9348-10222-0x0000022066F80000-0x0000022066F90000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/9348-10219-0x00007FF8A68D0000-0x00007FF8A7391000-memory.dmp

                                                                                                      Filesize

                                                                                                      10.8MB

                                                                                                    • memory/9888-10248-0x00007FF8BB5E0000-0x00007FF8BBADE000-memory.dmp

                                                                                                      Filesize

                                                                                                      5.0MB

                                                                                                    • memory/9888-10983-0x00007FF8BB5E0000-0x00007FF8BBADE000-memory.dmp

                                                                                                      Filesize

                                                                                                      5.0MB