Analysis Overview
Threat Level: Shows suspicious behavior
The file https://github.com/pizzaboxers/bloxstrap/releases/download/v2.5.4/bloxstrap.2.5.4.exe was found to be: Shows suspicious behavior.
Malicious Activity Summary
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Drops startup file
Reads user/profile data of web browsers
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Checks installed software on the system
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of NtCreateThreadExHideFromDebugger
Detects Pyinstaller
Suspicious behavior: EnumeratesProcesses
Suspicious use of UnmapMainImage
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies registry class
Kills process with taskkill
Suspicious use of FindShellTrayWindow
Modifies system certificate store
Suspicious use of SendNotifyMessage
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-05-29 11:41
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-05-29 11:41
Reported
2024-05-29 11:44
Platform
win10v2004-20240226-en
Max time kernel
211s
Max time network
201s
Command Line
Signatures
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.5.4 (2).exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.5.4 (2).exe | N/A |
Drops startup file
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\main.exe | C:\Users\Admin\AppData\Local\Temp\main.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\main.exe | C:\Users\Admin\AppData\Local\Temp\main.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\main.exe | C:\Users\Admin\AppData\Local\Temp\main.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.5.4 (2).exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.5.4 (2).exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-0a57b2f24afe434b\RobloxPlayerBeta.exe | N/A |
Loads dropped DLL
Reads user/profile data of web browsers
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | api.ipify.org | N/A | N/A |
| N/A | api.ipify.org | N/A | N/A |
| N/A | api.ipify.org | N/A | N/A |
Suspicious use of NtCreateThreadExHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-0a57b2f24afe434b\RobloxPlayerBeta.exe | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
Detects Pyinstaller
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SYSTEM32\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\SYSTEM32\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\SYSTEM32\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\SYSTEM32\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\SYSTEM32\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\SYSTEM32\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\SYSTEM32\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\SYSTEM32\taskkill.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\roblox\DefaultIcon | C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.5.4 (2).exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\roblox\shell\open | C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.5.4 (2).exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\roblox\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe" | C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.5.4 (2).exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\roblox-player\ = "URL: Roblox Protocol" | C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.5.4 (2).exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\roblox-player\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe" | C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.5.4 (2).exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\roblox-player\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe\" %1" | C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.5.4 (2).exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\roblox\shell | C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.5.4 (2).exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\roblox\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe\" %1" | C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.5.4 (2).exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\roblox-player\shell\open\command | C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.5.4 (2).exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\roblox-player\shell | C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.5.4 (2).exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\roblox\shell\open\command | C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.5.4 (2).exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\roblox\ = "URL: Roblox Protocol" | C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.5.4 (2).exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\roblox\URL Protocol | C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.5.4 (2).exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\roblox-player\shell\open | C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.5.4 (2).exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\roblox | C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.5.4 (2).exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\roblox-player | C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.5.4 (2).exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\roblox-player\DefaultIcon | C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.5.4 (2).exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\roblox-player\URL Protocol | C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.5.4 (2).exe | N/A |
Modifies system certificate store
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A | C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-0a57b2f24afe434b\RobloxPlayerBeta.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 | C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-0a57b2f24afe434b\RobloxPlayerBeta.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.5.4 (2).exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.5.4 (2).exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: 36 | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: 36 | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.5.4 (2).exe | N/A |
Suspicious use of SendNotifyMessage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.5.4 (2).exe | N/A |
Suspicious use of UnmapMainImage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-0a57b2f24afe434b\RobloxPlayerBeta.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/pizzaboxers/bloxstrap/releases/download/v2.5.4/bloxstrap.2.5.4.exe
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=3956 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=4092 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5572 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --no-appcompat-clear --mojo-platform-channel-handle=2628 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=4164 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --mojo-platform-channel-handle=6148 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --mojo-platform-channel-handle=6372 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --mojo-platform-channel-handle=1040 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x140 0x2fc
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=6624 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5876 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
C:\Users\Admin\Downloads\bloxstrap.2.5.4.exe
"C:\Users\Admin\Downloads\bloxstrap.2.5.4.exe"
C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.5.4 (2).exe
"C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.5.4 (2).exe"
C:\Users\Admin\Downloads\bloxstrap.2.5.4.exe
"C:\Users\Admin\Downloads\bloxstrap.2.5.4.exe"
C:\Users\Admin\AppData\Local\Temp\main.exe
"C:\Users\Admin\AppData\Local\Temp\main.exe"
C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.5.4 (2).exe
"C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.5.4 (2).exe"
C:\Users\Admin\AppData\Local\Temp\main.exe
"C:\Users\Admin\AppData\Local\Temp\main.exe"
C:\Users\Admin\AppData\Local\Temp\main.exe
"C:\Users\Admin\AppData\Local\Temp\main.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "ver"
C:\Users\Admin\AppData\Local\Temp\main.exe
"C:\Users\Admin\AppData\Local\Temp\main.exe"
C:\Windows\System32\Wbem\wmic.exe
wmic csproduct get UUID
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "ver"
C:\Windows\System32\Wbem\wmic.exe
wmic csproduct get UUID
C:\Windows\SYSTEM32\taskkill.exe
taskkill /F /IM chrome.exe
C:\Windows\SYSTEM32\taskkill.exe
taskkill /F /IM msedge.exe
C:\Windows\System32\Wbem\wmic.exe
wmic csproduct get UUID
C:\Windows\SYSTEM32\taskkill.exe
taskkill /F /IM brave.exe
C:\Windows\SYSTEM32\taskkill.exe
taskkill /F /IM opera.exe
C:\Windows\System32\Wbem\wmic.exe
wmic csproduct get UUID
C:\Windows\SYSTEM32\taskkill.exe
taskkill /F /IM chrome.exe
C:\Windows\System32\Wbem\wmic.exe
wmic csproduct get UUID
C:\Windows\SYSTEM32\taskkill.exe
taskkill /F /IM msedge.exe
C:\Windows\SYSTEM32\taskkill.exe
taskkill /F /IM brave.exe
C:\Windows\System32\Wbem\wmic.exe
wmic csproduct get UUID
C:\Windows\SYSTEM32\taskkill.exe
taskkill /F /IM opera.exe
C:\Windows\System32\Wbem\wmic.exe
wmic csproduct get UUID
C:\Windows\System32\Wbem\wmic.exe
wmic csproduct get UUID
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-0a57b2f24afe434b\RobloxPlayerBeta.exe
"C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-0a57b2f24afe434b\RobloxPlayerBeta.exe" --app -channel production
Network
| Country | Destination | Domain | Proto |
| GB | 142.250.187.234:443 | tcp | |
| US | 8.8.8.8:53 | github.com | udp |
| US | 8.8.8.8:53 | github.com | udp |
| US | 8.8.8.8:53 | github.com | udp |
| GB | 20.26.156.215:443 | github.com | tcp |
| US | 8.8.8.8:53 | nav-edge.smartscreen.microsoft.com | udp |
| US | 8.8.8.8:53 | nav-edge.smartscreen.microsoft.com | udp |
| GB | 51.11.108.188:443 | nav-edge.smartscreen.microsoft.com | tcp |
| GB | 51.11.108.188:443 | nav-edge.smartscreen.microsoft.com | tcp |
| US | 8.8.8.8:53 | business.bing.com | udp |
| US | 8.8.8.8:53 | business.bing.com | udp |
| US | 13.107.6.158:443 | business.bing.com | tcp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 8.8.8.8:53 | objects.githubusercontent.com | udp |
| US | 8.8.8.8:53 | objects.githubusercontent.com | udp |
| US | 8.8.8.8:53 | objects.githubusercontent.com | udp |
| BE | 2.21.17.194:443 | www.microsoft.com | tcp |
| US | 185.199.108.133:443 | objects.githubusercontent.com | tcp |
| US | 8.8.8.8:53 | bzib.nelreports.net | udp |
| US | 8.8.8.8:53 | bzib.nelreports.net | udp |
| US | 2.22.144.159:443 | bzib.nelreports.net | tcp |
| US | 8.8.8.8:53 | 215.156.26.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 164.189.21.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 158.6.107.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 8.8.8.8:53 | dl-edge.smartscreen.microsoft.com | udp |
| US | 8.8.8.8:53 | dl-edge.smartscreen.microsoft.com | udp |
| GB | 51.140.242.104:443 | dl-edge.smartscreen.microsoft.com | tcp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | 194.17.21.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.108.199.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 159.144.22.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.242.140.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | c.s-microsoft.com | udp |
| US | 8.8.8.8:53 | c.s-microsoft.com | udp |
| US | 8.8.8.8:53 | edgestatic.azureedge.net | udp |
| US | 8.8.8.8:53 | edgestatic.azureedge.net | udp |
| US | 13.107.246.64:443 | edgestatic.azureedge.net | tcp |
| US | 13.107.246.64:443 | edgestatic.azureedge.net | tcp |
| US | 13.107.246.64:443 | edgestatic.azureedge.net | tcp |
| US | 13.107.246.64:443 | edgestatic.azureedge.net | tcp |
| US | 13.107.246.64:443 | edgestatic.azureedge.net | tcp |
| US | 13.107.246.64:443 | edgestatic.azureedge.net | tcp |
| US | 13.107.246.64:443 | edgestatic.azureedge.net | tcp |
| US | 8.8.8.8:53 | wcpstatic.microsoft.com | udp |
| US | 8.8.8.8:53 | wcpstatic.microsoft.com | udp |
| US | 13.107.246.64:443 | wcpstatic.microsoft.com | tcp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 69.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 147.177.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | nw-umwatson.events.data.microsoft.com | udp |
| US | 20.189.173.20:443 | nw-umwatson.events.data.microsoft.com | tcp |
| US | 8.8.8.8:53 | 20.173.189.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.142.211.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 13.107.253.64:443 | tcp | |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | app-edge.smartscreen.microsoft.com | udp |
| US | 8.8.8.8:53 | app-edge.smartscreen.microsoft.com | udp |
| NL | 23.62.61.138:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 138.61.62.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | api.ipify.org | udp |
| US | 104.26.13.205:443 | api.ipify.org | tcp |
| US | 8.8.8.8:53 | 205.13.26.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | discord.com | udp |
| US | 162.159.128.233:443 | discord.com | tcp |
| US | 162.159.137.232:443 | discord.com | tcp |
| US | 162.159.138.232:443 | discord.com | tcp |
| US | 162.159.136.232:443 | discord.com | tcp |
| US | 162.159.135.232:443 | discord.com | tcp |
| US | 8.8.8.8:53 | 233.128.159.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.138.159.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.137.159.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.136.159.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.135.159.162.in-addr.arpa | udp |
| US | 104.26.13.205:443 | api.ipify.org | tcp |
| US | 162.159.128.233:443 | discord.com | tcp |
| US | 162.159.137.232:443 | discord.com | tcp |
| US | 162.159.138.232:443 | discord.com | tcp |
| US | 162.159.136.232:443 | discord.com | tcp |
| US | 162.159.135.232:443 | discord.com | tcp |
| US | 8.8.8.8:53 | 48.229.111.52.in-addr.arpa | udp |
| N/A | 127.0.0.1:50095 | tcp | |
| N/A | 127.0.0.1:50097 | tcp | |
| N/A | 127.0.0.1:50099 | tcp | |
| N/A | 127.0.0.1:50105 | tcp | |
| N/A | 127.0.0.1:50107 | tcp | |
| N/A | 127.0.0.1:50173 | tcp | |
| US | 8.8.8.8:53 | clientsettingscdn.roblox.com | udp |
| BE | 104.68.69.233:443 | clientsettingscdn.roblox.com | tcp |
| US | 8.8.8.8:53 | setup.rbxcdn.com | udp |
| FR | 3.162.38.113:443 | setup.rbxcdn.com | tcp |
| US | 8.8.8.8:53 | 233.69.68.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 113.38.162.3.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.5.4 (2).exe
| MD5 | dbb820772caf0003967ef0f269fbdeb1 |
| SHA1 | 31992bd4977a7dfeba67537a2da6c9ca64bc304c |
| SHA256 | b2ac1e407ed3ecd7c7faa6de929a68fb51145662cf793c40b69eb59295bba6bc |
| SHA512 | e8ac879c7198dffb78bc6ee4ad49b5de40a5a7dbbda53d427d0a034941487d13c8bb2b8d590a1fcdd81cd6abb8f21fdfcd52924eb00c45a42ee06c1e4b3d590f |
C:\Users\Admin\AppData\Local\Temp\main.exe
| MD5 | 31e6ed8e2a7068700a14bd9e155d3323 |
| SHA1 | 3d34dc8a19a4a1e90a3388197f92857f79abba87 |
| SHA256 | 1bf8b146a1e7798385b198c6230365d952a7fe73d7dfe86945dda44507c5dfdb |
| SHA512 | 448a66722bd33830c52129cc4caab5a5033993c1819dd3ca2225f2c47b266e7ee4cf69c41aabc1f96183dd1dd7e677675b7cc0d23216d9d2d02b59a3d1be7538 |
C:\Users\Admin\AppData\Local\Temp\_MEI34322\setuptools-65.5.0.dist-info\INSTALLER
| MD5 | 365c9bfeb7d89244f2ce01c1de44cb85 |
| SHA1 | d7a03141d5d6b1e88b6b59ef08b6681df212c599 |
| SHA256 | ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508 |
| SHA512 | d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1 |
C:\Users\Admin\AppData\Local\Temp\_MEI34322\python311.dll
| MD5 | 387bb2c1e40bde1517f06b46313766be |
| SHA1 | 601f83ef61c7699652dec17edd5a45d6c20786c4 |
| SHA256 | 0817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364 |
| SHA512 | 521cde6eaa5d4a2e0ef6bbfdea50b00750ae022c1c7bd66b20654c035552b49c9d2fac18ef503bbd136a7a307bdeb97f759d45c25228a0bf0c37739b6e897bad |
C:\Users\Admin\AppData\Local\Temp\_MEI34322\VCRUNTIME140.dll
| MD5 | be8dbe2dc77ebe7f88f910c61aec691a |
| SHA1 | a19f08bb2b1c1de5bb61daf9f2304531321e0e40 |
| SHA256 | 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83 |
| SHA512 | 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655 |
C:\Users\Admin\AppData\Local\Temp\_MEI34322\_ctypes.pyd
| MD5 | 565d011ce1cee4d48e722c7421300090 |
| SHA1 | 9dc300e04e5e0075de4c0205be2e8aae2064ae19 |
| SHA256 | c148292328f0aab7863af82f54f613961e7cb95b7215f7a81cafaf45bd4c42b7 |
| SHA512 | 5af370884b5f82903fd93b566791a22e5b0cded7f743e6524880ea0c41ee73037b71df0be9f07d3224c733b076bec3be756e7e77f9e7ed5c2dd9505f35b0e4f5 |
C:\Users\Admin\AppData\Local\Temp\_MEI34322\python3.DLL
| MD5 | 7e07c63636a01df77cd31cfca9a5c745 |
| SHA1 | 593765bc1729fdca66dd45bbb6ea9fcd882f42a6 |
| SHA256 | db84bc052cfb121fe4db36242ba5f1d2c031b600ef5d8d752cf25b7c02b6bac6 |
| SHA512 | 8c538625be972481c495c7271398993cfe188e2f0a71d38fb51eb18b62467205fe3944def156d0ff09a145670af375d2fc974c6b18313fa275ce6b420decc729 |
C:\Users\Admin\AppData\Local\Temp\_MEI34322\base_library.zip
| MD5 | 4b011f052728ae5007f9ec4e97a4f625 |
| SHA1 | 9d940561f08104618ec9e901a9cd0cd13e8b355d |
| SHA256 | c88cd8549debc046a980b0be3bf27956ae72dcdcf1a448e55892194752c570e6 |
| SHA512 | be405d80d78a188a563086809c372c44bcd1ccab5a472d50714f559559795a1df49437c1712e15eb0403917c7f6cfaf872d6bb0c8e4dd67a512c2c4a5ae93055 |
C:\Users\Admin\AppData\Local\Temp\_MEI34322\libffi-8.dll
| MD5 | 0f8e4992ca92baaf54cc0b43aaccce21 |
| SHA1 | c7300975df267b1d6adcbac0ac93fd7b1ab49bd2 |
| SHA256 | eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a |
| SHA512 | 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978 |
C:\Users\Admin\AppData\Local\Temp\_MEI34322\_lzma.pyd
| MD5 | b86b9f292af12006187ebe6c606a377d |
| SHA1 | 604224e12514c21ab6db4c285365b0996c7f2139 |
| SHA256 | f5e01b516c2c23035f7703e23569dec26c5616c05a929b2580ae474a5c6722c5 |
| SHA512 | d4e97f554d57048b488bf6515c35fddadeb9d101133ee27a449381ebe75ac3556930b05e218473eba5254f3c441436e12f3d0166fb1b1e3cd7b0946d5efab312 |
C:\Users\Admin\AppData\Local\Temp\_MEI34322\_uuid.pyd
| MD5 | cc2fc10d528ec8eac403f3955a214d5b |
| SHA1 | 3eefd8e449532c13ae160aa631fdb0ad8f6f2ea4 |
| SHA256 | e6aa7f1637e211251c9d6f467203b2b6d85e5bc2d901699f2a55af637fa89250 |
| SHA512 | bf18089bd0b3a880930827d2035302060ea9db529ad1020879e5be6de42693bd0a01b40270b4e93ceaea3cfed20dad1e2942d983cde8bb2c99159b32209b34bb |
C:\Users\Admin\AppData\Local\Temp\_MEI34322\pyexpat.pyd
| MD5 | 79561bc9f70383f8ae073802a321adfb |
| SHA1 | 5f378f47888e5092598c20c56827419d9f480fa7 |
| SHA256 | c7c7564f7f874fb660a46384980a2cf28bc3e245ca83628a197ccf861eab5560 |
| SHA512 | 476c839f544b730c5b133e2ae08112144cac07b6dfb8332535058f5cbf54ce7ed4a72efb38e6d56007ae755694b05e81e247d0a10210c993376484a057f2217c |
C:\Users\Admin\AppData\Local\Temp\_MEI34322\_socket.pyd
| MD5 | b77017baa2004833ef3847a3a3141280 |
| SHA1 | 39666f74bd076015b376fc81250dff89dff4b0a6 |
| SHA256 | a19e3c7c03ef1b5625790b1c9c42594909311ab6df540fbf43c6aa93300ab166 |
| SHA512 | 6b24d0e038c433b995bd05de7c8fe7dd7b0a11152937c189b8854c95780b0220a9435de0db7ac796a7de11a59c61d56b1aef9a8dbaba62d02325122ceb8b003d |
C:\Users\Admin\AppData\Local\Temp\_MEI34322\select.pyd
| MD5 | e4ab524f78a4cf31099b43b35d2faec3 |
| SHA1 | a9702669ef49b3a043ca5550383826d075167291 |
| SHA256 | bae0974390945520eb99ab32486c6a964691f8f4a028ac408d98fa8fb0db7d90 |
| SHA512 | 5fccfb3523c87ad5ab2cde4b9c104649c613388bc35b6561517ae573d3324f9191dd53c0f118b9808ba2907440cbc92aecfc77d0512ef81534e970118294cdee |
C:\Users\Admin\AppData\Local\Temp\_MEI34322\pywin32_system32\pythoncom311.dll
| MD5 | f98264f2dacfc8e299391ed1180ab493 |
| SHA1 | 849551b6d9142bf983e816fef4c05e639d2c1018 |
| SHA256 | 0fe49ec1143a0efe168809c9d48fe3e857e2ac39b19db3fd8718c56a4056696b |
| SHA512 | 6bb3dbd9f4d3e6b7bd294f3cb8b2ef4c29b9eff85c0cfd5e2d2465be909014a7b2ecd3dc06265b1b58196892bb04d3e6b0aa4b2ccbf3a716e0ff950eb28db11c |
C:\Users\Admin\AppData\Local\Temp\_MEI34322\win32\win32api.pyd
| MD5 | 1d6762b494dc9e60ca95f7238ae1fb14 |
| SHA1 | aa0397d96a0ed41b2f03352049dafe040d59ad5d |
| SHA256 | fae5323e2119a8f678055f4244177b5806c7b6b171b1945168f685631b913664 |
| SHA512 | 0b561f651161a34c37ff8d115f154c52202f573d049681f8cdd7bba2e966bb8203780c19ba824b4a693ef12ef1eeef6aeeef96eb369e4b6129f1deb6b26aaa00 |
C:\Users\Admin\AppData\Local\Temp\_MEI34322\VCRUNTIME140_1.dll
| MD5 | f8dfa78045620cf8a732e67d1b1eb53d |
| SHA1 | ff9a604d8c99405bfdbbf4295825d3fcbc792704 |
| SHA256 | a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5 |
| SHA512 | ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371 |
C:\Users\Admin\AppData\Local\Temp\_MEI34322\pywin32_system32\pywintypes311.dll
| MD5 | 90b786dc6795d8ad0870e290349b5b52 |
| SHA1 | 592c54e67cf5d2d884339e7a8d7a21e003e6482f |
| SHA256 | 89f2a5c6be1e70b3d895318fdd618506b8c0e9a63b6a1a4055dff4abdc89f18a |
| SHA512 | c6e1dbf25d260c723a26c88ec027d40d47f5e28fc9eb2dbc72a88813a1d05c7f75616b31836b68b87df45c65eef6f3eaed2a9f9767f9e2f12c45f672c2116e72 |
C:\Users\Admin\AppData\Local\Temp\_MEI34322\_queue.pyd
| MD5 | 7f52ef40b083f34fd5e723e97b13382f |
| SHA1 | 626d47df812738f28bc87c7667344b92847fdf6a |
| SHA256 | 3f8e7e6aa13b417acc78b63434fb1144e6319a010a9fc376c54d6e69b638fe4c |
| SHA512 | 48f7723a8c039abd6ccb2906fbd310f0cfa170dcbdf89a6437dd02c8f77f20e6c7c402d29b922cdaabd357d3a33e34c3ad826127134f38d77a4d6d9c83371949 |
C:\Users\Admin\AppData\Local\Temp\_MEI34322\_ssl.pyd
| MD5 | 0f02eccd7933b7a7c2bdedca2a72aab6 |
| SHA1 | 0b4c551d8fe34d8128e5cf97daa19eb4c97db06e |
| SHA256 | ba5388d6a6557d431e086734a3323621dc447f63ba299b0a815e5837cf869678 |
| SHA512 | 90a64082dab51380e05c76047ee40e259c719d7170fb4acb247b68a03b710461b350da3821b426fd13167895ded32f9c5ec0e07587ad4125683a18a3495f5ed5 |
C:\Users\Admin\AppData\Local\Temp\_MEI34322\_sqlite3.pyd
| MD5 | 68d89aaab48b82a7d76fb65e9c613a24 |
| SHA1 | b872497ebe4aba49025c9f836f4b2a3f1f033e5e |
| SHA256 | ff6a2a2f38b21b7784f97d604c99961d8c07ef455f7908110a4e893835d42b76 |
| SHA512 | 5eec9169ab29c291010f0e171c3123552d8c68e943a615dc2f8e1ae75f809a54343572737279d9582b585997ed390af856f551dadeada85ae2f1aa908fc9b39c |
C:\Users\Admin\AppData\Local\Temp\_MEI34322\libssl-3.dll
| MD5 | 19a2aba25456181d5fb572d88ac0e73e |
| SHA1 | 656ca8cdfc9c3a6379536e2027e93408851483db |
| SHA256 | 2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006 |
| SHA512 | df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337 |
C:\Users\Admin\AppData\Local\Temp\_MEI34322\_overlapped.pyd
| MD5 | 78e8049e26df6fd3a4011562ff8e74a0 |
| SHA1 | d5a91c720e4672c40e1dd6d54b3197b4a1f8b633 |
| SHA256 | ca106e4dfdeafeabf9e98956d3d8d0cb73e109f1a96f1a7e35bc47dbd7c7e164 |
| SHA512 | ea7a54d38cefed870cee65dd9460b6c51131ae5219933ddc998a86d12bb093784242cb5471c77bc324ccf59fa42c2914865dcf582f74c440fa52b7d15d9faeac |
C:\Users\Admin\AppData\Local\Temp\_MEI34322\_multiprocessing.pyd
| MD5 | cf0b31f01a95e9f181d87197786b96ca |
| SHA1 | 6214361452f7eaef5c710719a5cfb6109906975c |
| SHA256 | 975c1947798e3c39898c86675ca1eb68249f77361f41f172f9800275227213b9 |
| SHA512 | d56b096780bb263e3f7282f163da02353ed5d8767f964937deaff997156e95749312180f25582d5963d3c351260b8ff196221652e7bf088a8c6a4e766118abd3 |
C:\Users\Admin\AppData\Local\Temp\_MEI34322\_hashlib.pyd
| MD5 | b4ff25b1aca23d48897fc616e102e9b6 |
| SHA1 | 8295ee478191eb5f741a5f6a3f4ab4576ceec8d2 |
| SHA256 | 87dd0c858620287454fd6d31d52b6a48eddbb2a08e09e8b2d9fdb0b92200d766 |
| SHA512 | a7adcf652bc88f8878dae2742a37af75599936d80223e62fe74755d6bafaafd985678595872fb696c715f69a1f963f12e3d52cd3d7e7a83747983b2ee244e8a2 |
C:\Users\Admin\AppData\Local\Temp\_MEI34322\_decimal.pyd
| MD5 | c88282908ba54510eda3887c488198eb |
| SHA1 | 94ed1b44f99642b689f5f3824d2e490252936899 |
| SHA256 | 980a63f2b39cf16910f44384398e25f24482346a482addb00de42555b17d4278 |
| SHA512 | 312b081a90a275465787a539e48412d07f1a4c32bab0f3aa024e6e3fe534ac9c07595238d51dc4d6f13c8d03c2441f788dff9fe3d7ca2aad3940609501d273bd |
C:\Users\Admin\AppData\Local\Temp\_MEI34322\_cffi_backend.cp311-win_amd64.pyd
| MD5 | 210def84bb2c35115a2b2ac25e3ffd8f |
| SHA1 | 0376b275c81c25d4df2be4789c875b31f106bd09 |
| SHA256 | 59767b0918859beddf28a7d66a50431411ffd940c32b3e8347e6d938b60facdf |
| SHA512 | cd5551eb7afd4645860c7edd7b0abd375ee6e1da934be21a6099879c8ee3812d57f2398cad28fbb6f75bba77471d9b32c96c7c1e9d3b4d26c7fc838745746c7f |
C:\Users\Admin\AppData\Local\Temp\_MEI34322\_asyncio.pyd
| MD5 | 07a6e6dcc30e1c4c7e0cdc41a457a887 |
| SHA1 | 53bc820b63d88cbe889944e242b50662b4b2cb42 |
| SHA256 | 746bc8fa88282afe19dc60e426cc0a75bea3bd137cca06a0b57a30bd31459403 |
| SHA512 | 837f1e40db9bdf1bc73b2a700df6086a3acdb7d52afc903239410b2d226ffd1dd5e8b5f317401bcf58dd042bd56787af6cdc49af96fcb588bcf0127d536b6c6d |
C:\Users\Admin\AppData\Local\Temp\_MEI34322\unicodedata.pyd
| MD5 | fd9132f966ee6d214e0076bf0492fb30 |
| SHA1 | 89b95957f002bf382435d015e26962a42032cb97 |
| SHA256 | 37c68617fa02a2cadced17ef724e2d450ef12a8a37215da789a4679fde1c5c02 |
| SHA512 | e35729abc45e5561aae1fb9e0e7c711dd7d3c1491520aa5c44fcc50c955f549f81d90897959327e930d02a5356afe08d6195adf002c87801a7a11235670639b5 |
C:\Users\Admin\AppData\Local\Temp\_MEI34322\sqlite3.dll
| MD5 | 89c2845bd090082406649f337c0cca62 |
| SHA1 | 956736454f9c9e1e3d629c87d2c330f0a4443ae9 |
| SHA256 | 314bba62f4a1628b986afc94c09dc29cdaf08210eae469440fbf46bcdb86d3fd |
| SHA512 | 1c467a7a3d325f0febb0c6a7f8f7ce49e4f9e3c4514e613352ef7705a338be5e448c351a47da2fb80bf5fc3d37dbd69e31c935e7ff58ead06b2155a893728a82 |
C:\Users\Admin\AppData\Local\Temp\_MEI34322\libcrypto-3.dll
| MD5 | e547cf6d296a88f5b1c352c116df7c0c |
| SHA1 | cafa14e0367f7c13ad140fd556f10f320a039783 |
| SHA256 | 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de |
| SHA512 | 9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d |
C:\Users\Admin\AppData\Local\Temp\_MEI34322\config.aes
| MD5 | d317dada5287ecb73998689d0ff3131e |
| SHA1 | c4f806fe41461dfc6a54b8cedc8135144e115af6 |
| SHA256 | 5f04587e07e90c3b81fd2441f05c95f232f73df08f33d04d80e44061fe3c27cd |
| SHA512 | 2178c5f32005e5f8535d9fffbe8ee3de07061100db44a1ee4d96cb69e87441c33c55ffb88b7b9682a467750626394252a452625dd5b531966f40842d535eee04 |
C:\Users\Admin\AppData\Local\Temp\_MEI34322\_bz2.pyd
| MD5 | aa1083bde6d21cabfc630a18f51b1926 |
| SHA1 | e40e61dba19301817a48fd66ceeaade79a934389 |
| SHA256 | 00b8ca9a338d2b47285c9e56d6d893db2a999b47216756f18439997fb80a56e3 |
| SHA512 | 2df0d07065170fee50e0cd6208b0cc7baa3a295813f4ad02bec5315aa2a14b7345da4cdf7cac893da2c7fc21b201062271f655a85ceb51940f0acb99bb6a1d4c |
C:\Users\Admin\AppData\Local\Temp\_MEI34322\multidict\_multidict.cp311-win_amd64.pyd
| MD5 | 53c003dec693f83c57f326b6df5d5f05 |
| SHA1 | 6977ebcbf74a039501825697021c504d7cc63928 |
| SHA256 | 32555defdb044714dbaaec281820fa7a0c226545d40561b905294d2e0bdba102 |
| SHA512 | 2c4b9dff022d25906981d52f68a9bda8e7840597bea6cbea9bc8036392dea56fbecaedcd1b9f6547074c28b018266e424ca0ae8e66bad947544a8571f83fd2f4 |
C:\Users\Admin\AppData\Local\Temp\v6b6wekr7zmua4lz
| MD5 | 4c2e2189b87f507edc2e72d7d55583a0 |
| SHA1 | 1f06e340f76d41ea0d1e8560acd380a901b2a5bd |
| SHA256 | 99a5f8dea08b5cf512ed888b3e533cc77c08dc644078793dc870abd8828c1bca |
| SHA512 | 8b6b49e55afe8a697aaf71d975fab9e906143339827f75a57876a540d0d7b9e3cbbcdd8b5435d6198900a73895cc52d2082e66ee8cec342e72f2e427dde71600 |
C:\Users\Admin\AppData\Local\Temp\3ot1c6i08p6jhyr6
| MD5 | 90a1d4b55edf36fa8b4cc6974ed7d4c4 |
| SHA1 | aba1b8d0e05421e7df5982899f626211c3c4b5c1 |
| SHA256 | 7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c |
| SHA512 | ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2 |
C:\Users\Admin\AppData\Local\Temp\sfi8zxoy4c1wcwey
| MD5 | d7177a424b4e78bee78fa05bcdf07641 |
| SHA1 | ae155ef31bda6d692109247103353f4f70a6134d |
| SHA256 | aac59f2984fee02486cf44d19eece506b35219e05e662bcfdd374b7ba84a8f7d |
| SHA512 | 91be19b87f549de1215cfb5f82a9afe2bd999fba49d053c1153a2b9745100ed5a8d5b4c61e236190fd43408743e52152ece11b1759c28c7037f2fe37e3cff869 |
C:\Users\Admin\AppData\Local\Temp\ymkcrthkicyot649
| MD5 | e288c49fee6663ad9c445bdf872ecfab |
| SHA1 | db3849b3a4b7be17969c5e92833cd595bc48e48d |
| SHA256 | c19e8530d4e4b0fa2be5d6e1de98e681d5e8430202e68646777f3bab034243e1 |
| SHA512 | f8e0e0e1fd7d5fdc370f226bd667d5e0d2cf611364a6f7f2254f2d8af2415d2ceca36f28ac253bc836d3c951c9e0dd6f23a3635f9657e05ddf83c111e73c9318 |
C:\Users\Admin\AppData\Roaming\ndiq7doohp9vq7rs\00000000-0000-0000-0000-000000000000\Browser Credentials\download_history.txt
| MD5 | a19a38d7021688237940a102bcca34a2 |
| SHA1 | 476be250ad90ebb31ae283c2e1afe6992497d444 |
| SHA256 | 927171702d35443c00eaae1737b72be621ee2f80cbe0ad28d0c54986fd6a044f |
| SHA512 | e795133f54e9f833cce40387c6913a79ae9ffa9fd5b4932acfc4ba9546faed8b2fa6cfc09546544e7ad0e74d3eca2c41ccbf0da4b83e664d935cbfcca863f7cf |
C:\Users\Admin\AppData\Local\Temp\zabk1g2jbopiipvg
| MD5 | c9ff7748d8fcef4cf84a5501e996a641 |
| SHA1 | 02867e5010f62f97ebb0cfb32cb3ede9449fe0c9 |
| SHA256 | 4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988 |
| SHA512 | d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73 |
C:\Users\Admin\AppData\Local\Temp\1r73ib0c67897sz3
| MD5 | 02d2c46697e3714e49f46b680b9a6b83 |
| SHA1 | 84f98b56d49f01e9b6b76a4e21accf64fd319140 |
| SHA256 | 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9 |
| SHA512 | 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac |
C:\Users\Admin\AppData\Roaming\ndiq7doohp9vq7rs\00000000-0000-0000-0000-000000000000\Browser Credentials\browsing_history.txt
| MD5 | 7e6a17ecc79ecf9aceb010da5c7c3742 |
| SHA1 | 2115d79fb3462cf16ac7a30e17d19c801661ccda |
| SHA256 | 9afb0fa6cdaca6f09ccdef28efda37a723fc7b0fd6e5e573c3829ee77c4925c2 |
| SHA512 | 1fc934bfd539ff3feec30c8de2e84c567fa8c10664646c73eb0a2a94eabb8c69fe201ab849f3aff884f06310aa07001dbfea6ed4c26c75d155ae4c78dbe0c8dd |
C:\Users\Admin\AppData\Local\Temp\lgo7nd0iubi54d1l
| MD5 | d444c807029c83b8a892ac0c4971f955 |
| SHA1 | fa58ce7588513519dc8fed939b26b05dc25e53b5 |
| SHA256 | 8297a7698f19bb81539a18363db100c55e357fa73f773c2b883d2c4161f6a259 |
| SHA512 | b7958b843639d4223bef65cdc6c664d7d15b76ac4e0a8b1575201dd47a32899feff32389dcc047314f47944ebe7b774cd59e51d49202f49541bbd70ecbb31a2e |
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-0a57b2f24afe434b\content\configs\DateTimeLocaleConfigs\zh-tw.json
| MD5 | 702c9879f2289959ceaa91d3045f28aa |
| SHA1 | 775072f139acc8eafb219af355f60b2f57094276 |
| SHA256 | a92a6988175f9c1d073e4b54bf6a31f9b5d3652eebdf6a351fb5e12bda76cbd5 |
| SHA512 | 815a6bef134c0db7a5926f0cf4b3f7702d71b0b2f13eca9539cd2fc5a61eea81b1884e4c4bc0b3398880589bff809ac8d5df833e7e4aeda4a1244e9a875d1e97 |
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-0a57b2f24afe434b\content\configs\DateTimeLocaleConfigs\zh-hans.json
| MD5 | fb6605abd624d1923aef5f2122b5ae58 |
| SHA1 | 6e98c0a31fa39c781df33628b55568e095be7d71 |
| SHA256 | 7b993133d329c46c0c437d985eead54432944d7b46db6ad6ea755505b8629d00 |
| SHA512 | 97a14eda2010033265b379aa5553359293baf4988a4cdde8a40b0315e318a7b30feee7f5e14c68131e85610c00585d0c67e636999e3af9b5b2209e1a27a82223 |
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-0a57b2f24afe434b\content\textures\Cursors\KeyboardMouse\IBeamCursor.png
| MD5 | 464c4983fa06ad6cf235ec6793de5f83 |
| SHA1 | 8afeb666c8aee7290ab587a2bfb29fc3551669e8 |
| SHA256 | 99fd7f104948c6ab002d1ec69ffd6c896c91f9accc499588df0980b4346ecbed |
| SHA512 | f805f5f38535fe487b899486c8de6cf630114964e2c3ebc2af7152a82c6f6faef681b4d936a1867b5dff6566b688b5c01105074443cc2086b3fe71f7e6e404b1 |
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-0a57b2f24afe434b\content\textures\StudioToolbox\Clear.png
| MD5 | fa8eaf9266c707e151bb20281b3c0988 |
| SHA1 | 3ca097ad4cd097745d33d386cc2d626ece8cb969 |
| SHA256 | 8cf08bf7e50fea7b38f59f162ed956346c55a714ed8a9a8b0a1ada7e18480bc2 |
| SHA512 | e29274300eab297c6de895bb39170f73f0a4ffa2a8c3732caeeeac16e2c25fb58bb401fdd5823cc62d9c413ec6c43d7c46861d7e14d52f8d9d8ff632e29f167c |
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-0a57b2f24afe434b\content\textures\StudioUIEditor\valueBoxRoundedRectangle.png
| MD5 | 521fb651c83453bf42d7432896040e5e |
| SHA1 | 8fdbf2cc2617b5b58aaa91b94b0bf755d951cad9 |
| SHA256 | 630303ec4701779eaf86cc9fbf744b625becda53badc7271cbb6ddc56e638d70 |
| SHA512 | 8fa0a50e52a3c7c53735c7dd7af275ebc9c1843f55bb30ebe0587a85955a8da94ff993822d233f7ed118b1070a7d67718b55ba4a597dc49ed2bf2a3836c696f6 |
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-0a57b2f24afe434b\content\textures\TerrainTools\checkbox_square.png
| MD5 | 2cb16991a26dc803f43963bdc7571e3f |
| SHA1 | 12ad66a51b60eeaed199bc521800f7c763a3bc7b |
| SHA256 | c7bae6d856f3bd9f00c122522eb3534d0d198a9473b6a379a5c3458181870646 |
| SHA512 | 4c9467e5e2d83b778d0fb8b6fd97964f8d8126f07bfd50c5d68c256703f291ceaed56be057e8e2c591b2d2c49f6b7e099a2b7088d0bf5bdd901433459663b1f8 |
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-0a57b2f24afe434b\ExtraContent\textures\ui\LuaApp\graphic\[email protected]
| MD5 | 3fec0191b36b9d9448a73ff1a937a1f7 |
| SHA1 | bee7d28204245e3088689ac08da18b43eae531ba |
| SHA256 | 1a03e6f6a0de045aa588544c392d671c040b82a5598b4246af04f5a74910dc89 |
| SHA512 | a8ab2bc2d937963af36d3255c6ea09cae6ab1599996450004bb18e8b8bdfbdde728821ac1662d8a0466680679011d8f366577b143766838fe91edf08a40353ce |
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-0a57b2f24afe434b\ExtraContent\textures\ui\LuaApp\graphic\shimmer_lightTheme.png
| MD5 | 4f8f43c5d5c2895640ed4fdca39737d5 |
| SHA1 | fb46095bdfcab74d61e1171632c25f783ef495fa |
| SHA256 | fc57f32c26087eef61b37850d60934eda1100ca8773f08e487191a74766053d1 |
| SHA512 | 7aebc0f79b2b23a76fb41df8bab4411813ffb1abc5e2797810679c0eaa690e7af7561b8473405694bd967470be337417fa42e30f0318acbf171d8f31620a31aa |
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-0a57b2f24afe434b\content\textures\ui\Controls\XboxController\[email protected]
| MD5 | 55b64987636b9740ab1de7debd1f0b2f |
| SHA1 | 96f67222ce7d7748ec968e95a2f6495860f9d9c9 |
| SHA256 | f4a6bb3347ee3e603ea0b2f009bfa802103bc434ae3ff1db1f2043fa8cace8fc |
| SHA512 | 73a88a278747de3fefbaabb3ff90c1c0750c8d6c17746787f17061f4eff933620407336bf9b755f4222b0943b07d8c4d01de1815d42ea65e78e0daa7072591e9 |
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-0a57b2f24afe434b\content\textures\ui\Controls\XboxController\[email protected]
| MD5 | 83e9b7823c0a5c4c67a603a734233dec |
| SHA1 | 2eaf04ad636bf71afdf73b004d17d366ac6d333e |
| SHA256 | 3b5e06eb1a89975def847101f700f0caa60fe0198f53e51974ef1608c6e1e067 |
| SHA512 | e8abb39a1ec340ac5c7d63137f607cd09eae0e885e4f73b84d8adad1b8f574155b92fbf2c9d3013f64ebbb6d55ead5419e7546b0f70dcde976d49e7440743b0f |
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-0a57b2f24afe434b\content\textures\ui\Controls\XboxController\Thumbstick2.png
| MD5 | a402aacac8be906bcc07d50669d32061 |
| SHA1 | 9d75c1afbe9fc482983978cae4c553aa32625640 |
| SHA256 | 62a313b6cc9ffe7dd86bc9c4fcd7b8e8d1f14a15cdf41a53fb69af4ae3416102 |
| SHA512 | d11567bcaad8bbd9e2b9f497c3215102c7e7546caf425e93791502d3d2b3f78dec13609796fcd6e1e7f5c7d794bac074d00a74001e7fe943d63463b483877546 |
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-0a57b2f24afe434b\content\textures\ui\Controls\XboxController\[email protected]
| MD5 | 499333dae156bb4c9e9309a4842be4c8 |
| SHA1 | d18c4c36bdb297208589dc93715560acaf761c3a |
| SHA256 | d35a74469f1436f114c27c730a5ec0793073bcf098db37f10158d562a3174591 |
| SHA512 | 91c64173d2cdabc045c70e0538d45e1022cc74ec04989565b85f0f26fe3e788b700a0956a07a8c91d34c06fc1b7fad43bbdbb41b0c6f15b9881c3e46def8103e |
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-0a57b2f24afe434b\content\textures\ui\Controls\XboxController\[email protected]
| MD5 | e8c88cf5c5ef7ae5ddee2d0e8376b32f |
| SHA1 | 77f2a5b11436d247d1acc3bac8edffc99c496839 |
| SHA256 | 9607af14604a8e8eb1dec45d3eeca01fed33140c0ccc3e6ef8ca4a1f6219b5dd |
| SHA512 | 32f5a1e907705346a56fbddfe0d8841d05415ff7abe28ae9281ba46fedf8270b982be0090b72e2e32de0ce36e21934f80eaf508fd010f7ab132d39f5305fb68f |
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-0a57b2f24afe434b\content\textures\ui\Controls\XboxController\Thumbstick1.png
| MD5 | 2cbe38df9a03133ddf11a940c09b49cd |
| SHA1 | 6fb5c191ed8ce9495c66b90aaf53662bfe199846 |
| SHA256 | 0835a661199a7d8df7249e8ae925987184efcc4fb85d9efac3cc2c1495020517 |
| SHA512 | dcef5baccef9fff632456fe7bc3c4f4a403363d9103a8047a55f4bd4c413d0c5f751a2e37385fe9eba7a420dbdb77ca2ff883d47fcdd35af222191cc5bd5c7a9 |
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-0a57b2f24afe434b\content\textures\ui\ErrorPrompt\PrimaryButton.png
| MD5 | 81ce54dfd6605840a1bd2f9b0b3f807d |
| SHA1 | 4a3a4c05b9c14c305a8bb06c768abc4958ba2f1c |
| SHA256 | 0a6a5cafb4dee0d8c1d182ddec9f68ca0471d7fc820cf8dc2d68f27a35cd3386 |
| SHA512 | 57069c8ac03dd0fdfd97e2844c19138800ff6f7d508c26e5bc400b30fe78baa0991cc39f0f86fa10cd5d12b6b11b0b09c1a770e5cb2fdca157c2c8986a09e5ff |
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-0a57b2f24afe434b\content\sounds\ouch.ogg
| MD5 | 9404c52d6f311da02d65d4320bfebb59 |
| SHA1 | 0b5b5c2e7c631894953d5828fec06bdf6adba55f |
| SHA256 | c9775e361392877d1d521d0450a5368ee92d37dc542bc5e514373c9d5003f317 |
| SHA512 | 22aa1acbcdcf56f571170d9c32fd0d025c50936387203a7827dbb925f352d2bc082a8a79db61c2d1f1795ad979e93367c80205d9141b73d806ae08fa089837c4 |
C:\Users\Admin\AppData\Local\Bloxstrap\Modifications\ClientSettings\ClientAppSettings.json
| MD5 | 636492f4af87f25c20bd34a731007d86 |
| SHA1 | 22a5c237a739ab0df4ff87c9e3d79dbe0c89b56a |
| SHA256 | 22a1e85723295eeb854345be57f7d6fb56f02b232a95d69405bf9d9e67a0fa0d |
| SHA512 | cd2e3a738f535eb1a119bd4c319555899bcd4ce1049d7f8591a1a68c26844f33c1bd1e171706533b5c36263ade5e275b55d40f5710e0210e010925969182cd0c |
memory/1128-7307-0x00007FFD5F250000-0x00007FFD5F260000-memory.dmp
memory/1128-7311-0x00007FFD5F3B0000-0x00007FFD5F3E0000-memory.dmp
memory/1128-7315-0x00007FFD5F440000-0x00007FFD5F445000-memory.dmp
memory/1128-7324-0x00007FFD5F110000-0x00007FFD5F120000-memory.dmp
memory/1128-7323-0x00007FFD5F110000-0x00007FFD5F120000-memory.dmp
memory/1128-7322-0x00007FFD5F110000-0x00007FFD5F120000-memory.dmp
memory/1128-7321-0x00007FFD5F110000-0x00007FFD5F120000-memory.dmp
memory/1128-7320-0x00007FFD5F110000-0x00007FFD5F120000-memory.dmp
memory/1128-7319-0x00007FFD5F0F0000-0x00007FFD5F100000-memory.dmp
memory/1128-7318-0x00007FFD5F0F0000-0x00007FFD5F100000-memory.dmp
memory/1128-7317-0x00007FFD5F060000-0x00007FFD5F070000-memory.dmp
memory/1128-7316-0x00007FFD5F060000-0x00007FFD5F070000-memory.dmp
memory/1128-7314-0x00007FFD5F3B0000-0x00007FFD5F3E0000-memory.dmp
memory/1128-7313-0x00007FFD5F3B0000-0x00007FFD5F3E0000-memory.dmp
memory/1128-7312-0x00007FFD5F3B0000-0x00007FFD5F3E0000-memory.dmp
memory/1128-7309-0x00007FFD5F360000-0x00007FFD5F370000-memory.dmp
memory/1128-7308-0x00007FFD5F360000-0x00007FFD5F370000-memory.dmp
memory/1128-7310-0x00007FFD5F3B0000-0x00007FFD5F3E0000-memory.dmp
memory/1128-7306-0x00007FFD5F250000-0x00007FFD5F260000-memory.dmp
memory/1128-7325-0x00007FFD5C9C0000-0x00007FFD5C9D0000-memory.dmp
memory/1128-7329-0x00007FFD5CC40000-0x00007FFD5CC70000-memory.dmp
memory/1128-7333-0x00007FFD5CC40000-0x00007FFD5CC70000-memory.dmp
memory/1128-7332-0x00007FFD5CC40000-0x00007FFD5CC70000-memory.dmp
memory/1128-7330-0x00007FFD5CC40000-0x00007FFD5CC70000-memory.dmp
memory/1128-7328-0x00007FFD5CAD0000-0x00007FFD5CAE0000-memory.dmp
memory/1128-7327-0x00007FFD5CAD0000-0x00007FFD5CAE0000-memory.dmp
memory/1128-7326-0x00007FFD5C9C0000-0x00007FFD5C9D0000-memory.dmp
memory/1128-7331-0x00007FFD5CC40000-0x00007FFD5CC70000-memory.dmp
memory/1128-7335-0x00007FFD5D570000-0x00007FFD5D580000-memory.dmp
memory/1128-7340-0x00007FFD5D620000-0x00007FFD5D62E000-memory.dmp
memory/1128-7347-0x00007FFD5D530000-0x00007FFD5D53B000-memory.dmp
memory/1128-7346-0x00007FFD5D530000-0x00007FFD5D53B000-memory.dmp
memory/1128-7345-0x00007FFD5D530000-0x00007FFD5D53B000-memory.dmp
memory/1128-7344-0x00007FFD5D530000-0x00007FFD5D53B000-memory.dmp
memory/1128-7343-0x00007FFD5D530000-0x00007FFD5D53B000-memory.dmp
memory/1128-7342-0x00007FFD5D510000-0x00007FFD5D520000-memory.dmp
memory/1128-7341-0x00007FFD5D510000-0x00007FFD5D520000-memory.dmp
memory/1128-7339-0x00007FFD5D620000-0x00007FFD5D62E000-memory.dmp
memory/1128-7338-0x00007FFD5D620000-0x00007FFD5D62E000-memory.dmp
memory/1128-7337-0x00007FFD5D620000-0x00007FFD5D62E000-memory.dmp
memory/1128-7336-0x00007FFD5D620000-0x00007FFD5D62E000-memory.dmp
memory/1128-7334-0x00007FFD5D570000-0x00007FFD5D580000-memory.dmp
memory/1128-7351-0x00007FFD5CEF0000-0x00007FFD5CF00000-memory.dmp
memory/1128-7356-0x00007FFD5CF20000-0x00007FFD5CF46000-memory.dmp
memory/1128-7355-0x00007FFD5CF20000-0x00007FFD5CF46000-memory.dmp
memory/1128-7354-0x00007FFD5CF20000-0x00007FFD5CF46000-memory.dmp
memory/1128-7368-0x00007FFD5CD90000-0x00007FFD5CDB2000-memory.dmp
memory/1128-7367-0x00007FFD5CD90000-0x00007FFD5CDB2000-memory.dmp
memory/1128-7366-0x00007FFD5CD90000-0x00007FFD5CDB2000-memory.dmp
memory/1128-7365-0x00007FFD5CD90000-0x00007FFD5CDB2000-memory.dmp
memory/1128-7364-0x00007FFD5CD90000-0x00007FFD5CDB2000-memory.dmp
memory/1128-7363-0x00007FFD5CDC0000-0x00007FFD5CDE7000-memory.dmp
memory/1128-7362-0x00007FFD5CDC0000-0x00007FFD5CDE7000-memory.dmp
memory/1128-7361-0x00007FFD5CDC0000-0x00007FFD5CDE7000-memory.dmp
memory/1128-7360-0x00007FFD5CDC0000-0x00007FFD5CDE7000-memory.dmp
memory/1128-7369-0x00007FFD5F240000-0x00007FFD5F241000-memory.dmp
memory/1128-7359-0x00007FFD5CDC0000-0x00007FFD5CDE7000-memory.dmp
memory/1128-7358-0x00007FFD5CDC0000-0x00007FFD5CDE7000-memory.dmp
memory/1128-7357-0x00007FFD5CDC0000-0x00007FFD5CDE7000-memory.dmp
memory/1128-7353-0x00007FFD5CF20000-0x00007FFD5CF46000-memory.dmp
memory/1128-7352-0x00007FFD5CF20000-0x00007FFD5CF46000-memory.dmp
memory/1128-7350-0x00007FFD5CEF0000-0x00007FFD5CF00000-memory.dmp
memory/1128-7349-0x00007FFD5CDF0000-0x00007FFD5CE00000-memory.dmp
memory/1128-7348-0x00007FFD5CDF0000-0x00007FFD5CE00000-memory.dmp