8581823244a50bbed9709d09f3eba29dd9989681d96bff2b6c19245053069feb

Analysis

max time kernel
344s
max time network
345s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2024, 05:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WaveInstaller.exe
Size

1.5MB
MD5

b075f4320e46d0d5e78a649e8ee011cc
SHA1

b0dd50171323f0f83dbea0340e9ed8cf44bea38e
SHA256

8581823244a50bbed9709d09f3eba29dd9989681d96bff2b6c19245053069feb
SHA512

e08024b5fa50dc344ca18413a6c21e0f20490c22c90c565d6f663014f1673643da1d5d748e0cefca8a7cbae91a62470289803ad588d3aa5cf3dc6292d7393d47
SSDEEP

24576:VviinbT3ipyqwPx4x3RyFoBkkAd04wJAAh/jV1gJcPNZI6fntX3HOt2pq081ind2:MinbT3ipTD0anywJAaD/3U2pqjindT

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	Bloxstrap.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	WaveInstaller.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	WaveWindows.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	Bloxstrap.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	node.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	CefSharp.BrowserSubprocess.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	CefSharp.BrowserSubprocess.exe

Executes dropped EXE 13 IoCs

pid	Process
4248	WaveWindows.exe
4188	CefSharp.BrowserSubprocess.exe
4484	CefSharp.BrowserSubprocess.exe
3056	node.exe
3868	Bloxstrap.exe
7164	CefSharp.BrowserSubprocess.exe
1572	CefSharp.BrowserSubprocess.exe
5628	CefSharp.BrowserSubprocess.exe
5636	CefSharp.BrowserSubprocess.exe
5592	wave-luau.exe
5484	CefSharp.BrowserSubprocess.exe
6840	Bloxstrap.exe
5480	RobloxPlayerBeta.exe

Loads dropped DLL 61 IoCs

pid	Process
4248	WaveWindows.exe
4248	WaveWindows.exe
4248	WaveWindows.exe
4248	WaveWindows.exe
4248	WaveWindows.exe
4188	CefSharp.BrowserSubprocess.exe
4188	CefSharp.BrowserSubprocess.exe
4188	CefSharp.BrowserSubprocess.exe
4188	CefSharp.BrowserSubprocess.exe
4188	CefSharp.BrowserSubprocess.exe
4188	CefSharp.BrowserSubprocess.exe
4188	CefSharp.BrowserSubprocess.exe
4188	CefSharp.BrowserSubprocess.exe
4188	CefSharp.BrowserSubprocess.exe
4188	CefSharp.BrowserSubprocess.exe
4188	CefSharp.BrowserSubprocess.exe
4484	CefSharp.BrowserSubprocess.exe
4484	CefSharp.BrowserSubprocess.exe
4484	CefSharp.BrowserSubprocess.exe
4484	CefSharp.BrowserSubprocess.exe
4484	CefSharp.BrowserSubprocess.exe
4484	CefSharp.BrowserSubprocess.exe
4484	CefSharp.BrowserSubprocess.exe
4248	WaveWindows.exe
7164	CefSharp.BrowserSubprocess.exe
7164	CefSharp.BrowserSubprocess.exe
7164	CefSharp.BrowserSubprocess.exe
7164	CefSharp.BrowserSubprocess.exe
7164	CefSharp.BrowserSubprocess.exe
7164	CefSharp.BrowserSubprocess.exe
7164	CefSharp.BrowserSubprocess.exe
1572	CefSharp.BrowserSubprocess.exe
1572	CefSharp.BrowserSubprocess.exe
1572	CefSharp.BrowserSubprocess.exe
1572	CefSharp.BrowserSubprocess.exe
1572	CefSharp.BrowserSubprocess.exe
1572	CefSharp.BrowserSubprocess.exe
1572	CefSharp.BrowserSubprocess.exe
1572	CefSharp.BrowserSubprocess.exe
5636	CefSharp.BrowserSubprocess.exe
5636	CefSharp.BrowserSubprocess.exe
5628	CefSharp.BrowserSubprocess.exe
5628	CefSharp.BrowserSubprocess.exe
5636	CefSharp.BrowserSubprocess.exe
5636	CefSharp.BrowserSubprocess.exe
5636	CefSharp.BrowserSubprocess.exe
5628	CefSharp.BrowserSubprocess.exe
5628	CefSharp.BrowserSubprocess.exe
5628	CefSharp.BrowserSubprocess.exe
5636	CefSharp.BrowserSubprocess.exe
5636	CefSharp.BrowserSubprocess.exe
5628	CefSharp.BrowserSubprocess.exe
5628	CefSharp.BrowserSubprocess.exe
5484	CefSharp.BrowserSubprocess.exe
5484	CefSharp.BrowserSubprocess.exe
5484	CefSharp.BrowserSubprocess.exe
5484	CefSharp.BrowserSubprocess.exe
5484	CefSharp.BrowserSubprocess.exe
5484	CefSharp.BrowserSubprocess.exe
5484	CefSharp.BrowserSubprocess.exe
5480	RobloxPlayerBeta.exe

Checks for any installed AV software in registry 1 TTPs 28 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\KasperskyLab\LastUsername	WaveWindows.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\KasperskyLab\Session = "Bearer 3a2339ae-9085-4da1-9441-2d14133024e3"	WaveWindows.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\KasperskyLab\RefreshRate	WaveWindows.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\KasperskyLab\FontSize = "14"	WaveWindows.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\KasperskyLab\SendCurrentDocument	WaveWindows.exe
Key queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\KasperskyLab	WaveWindows.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\KasperskyLab\RedirectCompilerError	WaveWindows.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\KasperskyLab\InlayHints	WaveWindows.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\KasperskyLab\RefreshRate = "30"	WaveWindows.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\KasperskyLab\ContinueOnStartUp = "0"	WaveWindows.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\KasperskyLab\UsePerformanceMode = "0"	WaveWindows.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\KasperskyLab\FontSize	WaveWindows.exe
Key opened	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\KasperskyLab	WaveWindows.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\KasperskyLab	WaveWindows.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\KasperskyLab\RedirectCompilerError = "1"	WaveWindows.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\KasperskyLab\UsePerformanceMode	WaveWindows.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\KasperskyLab\RefreshRate = "60"	WaveWindows.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\KasperskyLab\Session	WaveWindows.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\KasperskyLab\LastUsername = "sdsdasd"	WaveWindows.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\KasperskyLab\TopMost = "0"	WaveWindows.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\KasperskyLab\SendCurrentDocument = "1"	WaveWindows.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\KasperskyLab\ContinueOnStartUp	WaveWindows.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\KasperskyLab\Minimap = "0"	WaveWindows.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\KasperskyLab\TopMost	WaveWindows.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\KasperskyLab\Minimap	WaveWindows.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\KasperskyLab\InlayHints = "1"	WaveWindows.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\KasperskyLab\RefreshRate = "43"	WaveWindows.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\KasperskyLab\RefreshRate = "37"	WaveWindows.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	WaveWindows.exe
File opened (read-only)	\??\Z:	WaveWindows.exe
File opened (read-only)	\??\B:	WaveWindows.exe
File opened (read-only)	\??\H:	WaveWindows.exe
File opened (read-only)	\??\K:	WaveWindows.exe
File opened (read-only)	\??\L:	WaveWindows.exe
File opened (read-only)	\??\R:	WaveWindows.exe
File opened (read-only)	\??\S:	WaveWindows.exe
File opened (read-only)	\??\P:	WaveWindows.exe
File opened (read-only)	\??\Q:	WaveWindows.exe
File opened (read-only)	\??\W:	WaveWindows.exe
File opened (read-only)	\??\Y:	WaveWindows.exe
File opened (read-only)	\??\T:	WaveWindows.exe
File opened (read-only)	\??\E:	WaveWindows.exe
File opened (read-only)	\??\G:	WaveWindows.exe
File opened (read-only)	\??\I:	WaveWindows.exe
File opened (read-only)	\??\M:	WaveWindows.exe
File opened (read-only)	\??\N:	WaveWindows.exe
File opened (read-only)	\??\O:	WaveWindows.exe
File opened (read-only)	\??\A:	WaveWindows.exe
File opened (read-only)	\??\J:	WaveWindows.exe
File opened (read-only)	\??\V:	WaveWindows.exe
File opened (read-only)	\??\X:	WaveWindows.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
76	raw.githubusercontent.com
78	raw.githubusercontent.com
260	raw.githubusercontent.com
261	raw.githubusercontent.com
262	raw.githubusercontent.com
265	raw.githubusercontent.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
5480	RobloxPlayerBeta.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 18 IoCs

pid	Process
5480	RobloxPlayerBeta.exe
5480	RobloxPlayerBeta.exe
5480	RobloxPlayerBeta.exe
5480	RobloxPlayerBeta.exe
5480	RobloxPlayerBeta.exe
5480	RobloxPlayerBeta.exe
5480	RobloxPlayerBeta.exe
5480	RobloxPlayerBeta.exe
5480	RobloxPlayerBeta.exe
5480	RobloxPlayerBeta.exe
5480	RobloxPlayerBeta.exe
5480	RobloxPlayerBeta.exe
5480	RobloxPlayerBeta.exe
5480	RobloxPlayerBeta.exe
5480	RobloxPlayerBeta.exe
5480	RobloxPlayerBeta.exe
5480	RobloxPlayerBeta.exe
5480	RobloxPlayerBeta.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4248_613292377\manifest.json	WaveWindows.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4248_613292377\_metadata\verified_contents.json	WaveWindows.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4248_613292377\manifest.fingerprint	WaveWindows.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4248_613292377\_platform_specific\win_x86\widevinecdm.dll.sig	WaveWindows.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4248_613292377\_platform_specific\win_x86\widevinecdm.dll	WaveWindows.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4248_613292377\LICENSE	WaveWindows.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133641125546432370"	chrome.exe

Modifies registry class 21 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\roblox	Bloxstrap.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\roblox\shell	Bloxstrap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\roblox-player\URL Protocol	Bloxstrap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\roblox-player\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe\" %1"	Bloxstrap.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4204450073-1267028356-951339405-1000\{36A23A13-42BB-44F3-B691-505F1B525D7F}	WaveWindows.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\roblox\shell\open	Bloxstrap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\roblox\URL Protocol	Bloxstrap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\roblox\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe\" %1"	Bloxstrap.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\roblox-player	Bloxstrap.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\roblox\DefaultIcon	Bloxstrap.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\roblox-player\DefaultIcon	Bloxstrap.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\roblox-player\shell	Bloxstrap.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\roblox-player\shell\open	Bloxstrap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\roblox-player\ = "URL: Roblox Protocol"	Bloxstrap.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4204450073-1267028356-951339405-1000\{92EB1357-6E81-4009-AE92-6BBCCB2F5753}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\roblox\shell\open\command	Bloxstrap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\roblox\ = "URL: Roblox Protocol"	Bloxstrap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\roblox\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe"	Bloxstrap.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\roblox-player\shell\open\command	Bloxstrap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\roblox-player\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe"	Bloxstrap.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3588	chrome.exe
3588	chrome.exe
4248	WaveWindows.exe
4248	WaveWindows.exe
4188	CefSharp.BrowserSubprocess.exe
4188	CefSharp.BrowserSubprocess.exe
4484	CefSharp.BrowserSubprocess.exe
4484	CefSharp.BrowserSubprocess.exe
4248	WaveWindows.exe
3868	Bloxstrap.exe
3868	Bloxstrap.exe
7672	chrome.exe
7672	chrome.exe
7164	CefSharp.BrowserSubprocess.exe
7164	CefSharp.BrowserSubprocess.exe
1572	CefSharp.BrowserSubprocess.exe
1572	CefSharp.BrowserSubprocess.exe
1572	CefSharp.BrowserSubprocess.exe
1572	CefSharp.BrowserSubprocess.exe
5636	CefSharp.BrowserSubprocess.exe
5636	CefSharp.BrowserSubprocess.exe
5628	CefSharp.BrowserSubprocess.exe
5628	CefSharp.BrowserSubprocess.exe
5484	CefSharp.BrowserSubprocess.exe
5484	CefSharp.BrowserSubprocess.exe
6840	Bloxstrap.exe
6840	Bloxstrap.exe
4248	WaveWindows.exe
4248	WaveWindows.exe
5480	RobloxPlayerBeta.exe
5480	RobloxPlayerBeta.exe
6840	Bloxstrap.exe
6840	Bloxstrap.exe
6840	Bloxstrap.exe
6840	Bloxstrap.exe
6840	Bloxstrap.exe
6840	Bloxstrap.exe
6840	Bloxstrap.exe
6840	Bloxstrap.exe
6840	Bloxstrap.exe
6840	Bloxstrap.exe
6840	Bloxstrap.exe
6840	Bloxstrap.exe
6840	Bloxstrap.exe
6840	Bloxstrap.exe
6840	Bloxstrap.exe
6840	Bloxstrap.exe
6840	Bloxstrap.exe
6840	Bloxstrap.exe
6840	Bloxstrap.exe
6840	Bloxstrap.exe
6840	Bloxstrap.exe
6840	Bloxstrap.exe
6840	Bloxstrap.exe
6840	Bloxstrap.exe
6840	Bloxstrap.exe
6840	Bloxstrap.exe
6840	Bloxstrap.exe
6840	Bloxstrap.exe
6840	Bloxstrap.exe
6840	Bloxstrap.exe
6840	Bloxstrap.exe
6840	Bloxstrap.exe
6840	Bloxstrap.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1744	WaveInstaller.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe

Suspicious use of FindShellTrayWindow 32 IoCs

pid	Process
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3868	Bloxstrap.exe
3868	Bloxstrap.exe
4248	WaveWindows.exe
6840	Bloxstrap.exe
4248	WaveWindows.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3868	Bloxstrap.exe
3868	Bloxstrap.exe
6840	Bloxstrap.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
5480	RobloxPlayerBeta.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3588 wrote to memory of 2196	3588	chrome.exe	96
PID 3588 wrote to memory of 2196	3588	chrome.exe	96
PID 3588 wrote to memory of 3524	3588	chrome.exe	97
PID 3588 wrote to memory of 3524	3588	chrome.exe	97
PID 3588 wrote to memory of 3524	3588	chrome.exe	97
PID 3588 wrote to memory of 3524	3588	chrome.exe	97
PID 3588 wrote to memory of 3524	3588	chrome.exe	97
PID 3588 wrote to memory of 3524	3588	chrome.exe	97
PID 3588 wrote to memory of 3524	3588	chrome.exe	97
PID 3588 wrote to memory of 3524	3588	chrome.exe	97
PID 3588 wrote to memory of 3524	3588	chrome.exe	97
PID 3588 wrote to memory of 3524	3588	chrome.exe	97
PID 3588 wrote to memory of 3524	3588	chrome.exe	97
PID 3588 wrote to memory of 3524	3588	chrome.exe	97
PID 3588 wrote to memory of 3524	3588	chrome.exe	97
PID 3588 wrote to memory of 3524	3588	chrome.exe	97
PID 3588 wrote to memory of 3524	3588	chrome.exe	97
PID 3588 wrote to memory of 3524	3588	chrome.exe	97
PID 3588 wrote to memory of 3524	3588	chrome.exe	97
PID 3588 wrote to memory of 3524	3588	chrome.exe	97
PID 3588 wrote to memory of 3524	3588	chrome.exe	97
PID 3588 wrote to memory of 3524	3588	chrome.exe	97
PID 3588 wrote to memory of 3524	3588	chrome.exe	97
PID 3588 wrote to memory of 3524	3588	chrome.exe	97
PID 3588 wrote to memory of 3524	3588	chrome.exe	97
PID 3588 wrote to memory of 3524	3588	chrome.exe	97
PID 3588 wrote to memory of 3524	3588	chrome.exe	97
PID 3588 wrote to memory of 3524	3588	chrome.exe	97
PID 3588 wrote to memory of 3524	3588	chrome.exe	97
PID 3588 wrote to memory of 3524	3588	chrome.exe	97
PID 3588 wrote to memory of 3524	3588	chrome.exe	97
PID 3588 wrote to memory of 3524	3588	chrome.exe	97
PID 3588 wrote to memory of 3524	3588	chrome.exe	97
PID 3588 wrote to memory of 4608	3588	chrome.exe	98
PID 3588 wrote to memory of 4608	3588	chrome.exe	98
PID 3588 wrote to memory of 4220	3588	chrome.exe	99
PID 3588 wrote to memory of 4220	3588	chrome.exe	99
PID 3588 wrote to memory of 4220	3588	chrome.exe	99
PID 3588 wrote to memory of 4220	3588	chrome.exe	99
PID 3588 wrote to memory of 4220	3588	chrome.exe	99
PID 3588 wrote to memory of 4220	3588	chrome.exe	99
PID 3588 wrote to memory of 4220	3588	chrome.exe	99
PID 3588 wrote to memory of 4220	3588	chrome.exe	99
PID 3588 wrote to memory of 4220	3588	chrome.exe	99
PID 3588 wrote to memory of 4220	3588	chrome.exe	99
PID 3588 wrote to memory of 4220	3588	chrome.exe	99
PID 3588 wrote to memory of 4220	3588	chrome.exe	99
PID 3588 wrote to memory of 4220	3588	chrome.exe	99
PID 3588 wrote to memory of 4220	3588	chrome.exe	99
PID 3588 wrote to memory of 4220	3588	chrome.exe	99
PID 3588 wrote to memory of 4220	3588	chrome.exe	99
PID 3588 wrote to memory of 4220	3588	chrome.exe	99
PID 3588 wrote to memory of 4220	3588	chrome.exe	99
PID 3588 wrote to memory of 4220	3588	chrome.exe	99
PID 3588 wrote to memory of 4220	3588	chrome.exe	99
PID 3588 wrote to memory of 4220	3588	chrome.exe	99
PID 3588 wrote to memory of 4220	3588	chrome.exe	99
PID 3588 wrote to memory of 4220	3588	chrome.exe	99
PID 3588 wrote to memory of 4220	3588	chrome.exe	99
PID 3588 wrote to memory of 4220	3588	chrome.exe	99
PID 3588 wrote to memory of 4220	3588	chrome.exe	99
PID 3588 wrote to memory of 4220	3588	chrome.exe	99
PID 3588 wrote to memory of 4220	3588	chrome.exe	99
PID 3588 wrote to memory of 4220	3588	chrome.exe	99

C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
PID:1744
- C:\Users\Admin\AppData\Local\Wave\WaveWindows.exe
  "C:\Users\Admin\AppData\Local\Wave\WaveWindows.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks for any installed AV software in registry
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:4248
- - C:\Users\Admin\AppData\Local\CefSharp\CefSharp.BrowserSubprocess.exe
    "C:\Users\Admin\AppData\Local\CefSharp\CefSharp.BrowserSubprocess.exe" --type=gpu-process --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\CefSharp\locales" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\CefSharp" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2052,i,295053349161090174,5272697566652612011,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:2 --host-process-id=4248
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:4188
- - C:\Users\Admin\AppData\Local\Luau Language Server\node.exe
    "C:\Users\Admin\AppData\Local\Luau Language Server\node.exe" server --process-id=4248
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:3056
  - - C:\Users\Admin\AppData\Local\Luau Language Server\shared\bin\wave-luau.exe
      "C:\Users\Admin\AppData\Local\Luau Language Server\shared\bin\wave-luau.exe" lsp "--definitions=C:\Users\Admin\AppData\Local\Luau Language Server\shared\bin\globalTypes.d.luau" "--definitions=C:\Users\Admin\AppData\Local\Luau Language Server\shared\bin\wave.d.luau" "--docs=C:\Users\Admin\AppData\Local\Luau Language Server\shared\bin\en-us.json"
      4⤵
      Executes dropped EXE
      PID:5592
- - C:\Users\Admin\AppData\Local\CefSharp\CefSharp.BrowserSubprocess.exe
    "C:\Users\Admin\AppData\Local\CefSharp\CefSharp.BrowserSubprocess.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\CefSharp\locales" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\CefSharp" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --field-trial-handle=2324,i,295053349161090174,5272697566652612011,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:3 --host-process-id=4248
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:4484
- - C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe
    "C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:3868
- - C:\Users\Admin\AppData\Local\CefSharp\CefSharp.BrowserSubprocess.exe
    "C:\Users\Admin\AppData\Local\CefSharp\CefSharp.BrowserSubprocess.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\CefSharp\locales" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\CefSharp" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --field-trial-handle=4524,i,295053349161090174,5272697566652612011,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8 --host-process-id=4248
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:7164
- - C:\Users\Admin\AppData\Local\CefSharp\CefSharp.BrowserSubprocess.exe
    "C:\Users\Admin\AppData\Local\CefSharp\CefSharp.BrowserSubprocess.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\CefSharp\locales" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\CefSharp" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4464,i,295053349161090174,5272697566652612011,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:8 --host-process-id=4248
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:1572
- - C:\Users\Admin\AppData\Local\CefSharp\CefSharp.BrowserSubprocess.exe
    "C:\Users\Admin\AppData\Local\CefSharp\CefSharp.BrowserSubprocess.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\CefSharp\locales" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\CefSharp" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --field-trial-handle=7328,i,295053349161090174,5272697566652612011,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=7324 /prefetch:8 --host-process-id=4248
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:5628
- - C:\Users\Admin\AppData\Local\CefSharp\CefSharp.BrowserSubprocess.exe
    "C:\Users\Admin\AppData\Local\CefSharp\CefSharp.BrowserSubprocess.exe" --type=renderer --locales-dir-path="C:\Users\Admin\AppData\Local\CefSharp\locales" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\CefSharp" --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --no-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=7408,i,295053349161090174,5272697566652612011,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=7404 --host-process-id=4248 /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:5484
- - C:\Users\Admin\AppData\Local\CefSharp\CefSharp.BrowserSubprocess.exe
    "C:\Users\Admin\AppData\Local\CefSharp\CefSharp.BrowserSubprocess.exe" --type=renderer --locales-dir-path="C:\Users\Admin\AppData\Local\CefSharp\locales" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\CefSharp" --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --no-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=7424,i,295053349161090174,5272697566652612011,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=7416 --host-process-id=4248 /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:5636

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd3ffaab58,0x7ffd3ffaab68,0x7ffd3ffaab78
  2⤵
  PID:2196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1632 --field-trial-handle=1896,i,14923074007621306657,18292522863292815501,131072 /prefetch:2
  2⤵
  PID:3524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1896,i,14923074007621306657,18292522863292815501,131072 /prefetch:8
  2⤵
  PID:4608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2228 --field-trial-handle=1896,i,14923074007621306657,18292522863292815501,131072 /prefetch:8
  2⤵
  PID:4220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3088 --field-trial-handle=1896,i,14923074007621306657,18292522863292815501,131072 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3120 --field-trial-handle=1896,i,14923074007621306657,18292522863292815501,131072 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4332 --field-trial-handle=1896,i,14923074007621306657,18292522863292815501,131072 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4400 --field-trial-handle=1896,i,14923074007621306657,18292522863292815501,131072 /prefetch:8
  2⤵
  PID:2852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4616 --field-trial-handle=1896,i,14923074007621306657,18292522863292815501,131072 /prefetch:8
  2⤵
  PID:2716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4616 --field-trial-handle=1896,i,14923074007621306657,18292522863292815501,131072 /prefetch:8
  2⤵
  PID:1016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4724 --field-trial-handle=1896,i,14923074007621306657,18292522863292815501,131072 /prefetch:8
  2⤵
  PID:3680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4988 --field-trial-handle=1896,i,14923074007621306657,18292522863292815501,131072 /prefetch:8
  2⤵
  PID:2904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4516 --field-trial-handle=1896,i,14923074007621306657,18292522863292815501,131072 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4116 --field-trial-handle=1896,i,14923074007621306657,18292522863292815501,131072 /prefetch:8
  2⤵
  PID:376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4564 --field-trial-handle=1896,i,14923074007621306657,18292522863292815501,131072 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5024 --field-trial-handle=1896,i,14923074007621306657,18292522863292815501,131072 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3320 --field-trial-handle=1896,i,14923074007621306657,18292522863292815501,131072 /prefetch:8
  2⤵
  - Modifies registry class
  PID:3980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 --field-trial-handle=1896,i,14923074007621306657,18292522863292815501,131072 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5208 --field-trial-handle=1896,i,14923074007621306657,18292522863292815501,131072 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5268 --field-trial-handle=1896,i,14923074007621306657,18292522863292815501,131072 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1748 --field-trial-handle=1896,i,14923074007621306657,18292522863292815501,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:7672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=2556 --field-trial-handle=1896,i,14923074007621306657,18292522863292815501,131072 /prefetch:1
  2⤵
  PID:6760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=2316 --field-trial-handle=1896,i,14923074007621306657,18292522863292815501,131072 /prefetch:1
  2⤵
  PID:8032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5608 --field-trial-handle=1896,i,14923074007621306657,18292522863292815501,131072 /prefetch:8
  2⤵
  PID:8140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5648 --field-trial-handle=1896,i,14923074007621306657,18292522863292815501,131072 /prefetch:8
  2⤵
  PID:8060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=5288 --field-trial-handle=1896,i,14923074007621306657,18292522863292815501,131072 /prefetch:1
  2⤵
  PID:6736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=2308 --field-trial-handle=1896,i,14923074007621306657,18292522863292815501,131072 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=1536 --field-trial-handle=1896,i,14923074007621306657,18292522863292815501,131072 /prefetch:1
  2⤵
  PID:5924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=5532 --field-trial-handle=1896,i,14923074007621306657,18292522863292815501,131072 /prefetch:1
  2⤵
  PID:6016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 --field-trial-handle=1896,i,14923074007621306657,18292522863292815501,131072 /prefetch:8
  2⤵
  PID:2488
- C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe
  "C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe" roblox-player:1+launchmode:play+gameinfo:ZL_P9OpUZe3p5XkmQqnW42ciIhOHQy9dstkjImoHzxMV65aTK0rbJJXHMBZp5Iz2bL0PaSpCnxjgsOL-doVoIPD6zZXAAItv6E-rVXghcIbqRaL9RFjKM_DqrC_JJFAqgs77NtvArH8_Q131hGq1X8q7B5IZAYy8qEEFQ_jCdk7SR1hbix987gh95XUgD6X7bSjvoZKYvWKVEGg0_qJ9Mm-HwmzIfg--w7obVG2mgMM+launchtime:1719639191111+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1719638960053013%26placeId%3D10449761463%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3Deea6c9b8-768a-4c08-b5cc-faaf832fa227%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1719638960053013+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:6840
- - C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\RobloxPlayerBeta.exe
    "C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\RobloxPlayerBeta.exe" --app -t ZL_P9OpUZe3p5XkmQqnW42ciIhOHQy9dstkjImoHzxMV65aTK0rbJJXHMBZp5Iz2bL0PaSpCnxjgsOL-doVoIPD6zZXAAItv6E-rVXghcIbqRaL9RFjKM_DqrC_JJFAqgs77NtvArH8_Q131hGq1X8q7B5IZAYy8qEEFQ_jCdk7SR1hbix987gh95XUgD6X7bSjvoZKYvWKVEGg0_qJ9Mm-HwmzIfg--w7obVG2mgMM --launchtime=1719639195599 -j https://www.roblox.com/Game/PlaceLauncher.ashx?request=RequestGame&browserTrackerId=1719638960053013&placeId=10449761463&isPlayTogetherGame=false&joinAttemptId=eea6c9b8-768a-4c08-b5cc-faaf832fa227&joinAttemptOrigin=PlayButton -b 1719638960053013 --rloc en_us --gloc en_us -channel production
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of UnmapMainImage
    PID:5480

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4384

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4ec 0x4a8
1⤵
PID:7576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4248_613292377\LICENSE

Filesize
473B

MD5
f6719687bed7403612eaed0b191eb4a9

SHA1
dd03919750e45507743bd089a659e8efcefa7af1

SHA256
afb514e4269594234b32c873ba2cd3cc8892e836861137b531a40a1232820c59

SHA512
dd14a7eae05d90f35a055a5098d09cd2233d784f6ac228b5927925241689bff828e573b7a90a5196bfdd7aaeecf00f5c94486ad9e3910cfb07475fcfbb7f0d56

Download Submit
C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4248_613292377\manifest.json

Filesize
984B

MD5
0359d5b66d73a97ce5dc9f89ed84c458

SHA1
ce17e52eaac909dd63d16d93410de675d3e6ec0d

SHA256
beeab2f8d3833839399dde15ce9085c17b304445577d21333e883d6db6d0b755

SHA512
8fd94a098a4ab5c0fcd48c2cef2bb03328dd4d25c899bf5ed1ca561347d74a8aab8a214ba2d3180a86df72c52eb26987a44631d0ecd9edc84976c28d6c9dc16a

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe

Filesize
249KB

MD5
772c9fecbd0397f6cfb3d866cf3a5d7d

SHA1
6de3355d866d0627a756d0d4e29318e67650dacf

SHA256
2f88ea7e1183d320fb2b7483de2e860da13dc0c0caaf58f41a888528d78c809f

SHA512
82048bd6e50d38a863379a623b8cfda2d1553d8141923acf13f990c7245c833082523633eaa830362a12bfff300da61b3d8b3cccbe038ce2375fdfbd20dbca31

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Modifications\ClientSettings\ClientAppSettings.json

Filesize
120B

MD5
636492f4af87f25c20bd34a731007d86

SHA1
22a5c237a739ab0df4ff87c9e3d79dbe0c89b56a

SHA256
22a1e85723295eeb854345be57f7d6fb56f02b232a95d69405bf9d9e67a0fa0d

SHA512
cd2e3a738f535eb1a119bd4c319555899bcd4ce1049d7f8591a1a68c26844f33c1bd1e171706533b5c36263ade5e275b55d40f5710e0210e010925969182cd0c

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\ExtraContent\textures\ui\LuaApp\graphic\shimmer_lightTheme.png

Filesize
20KB

MD5
4f8f43c5d5c2895640ed4fdca39737d5

SHA1
fb46095bdfcab74d61e1171632c25f783ef495fa

SHA256
fc57f32c26087eef61b37850d60934eda1100ca8773f08e487191a74766053d1

SHA512
7aebc0f79b2b23a76fb41df8bab4411813ffb1abc5e2797810679c0eaa690e7af7561b8473405694bd967470be337417fa42e30f0318acbf171d8f31620a31aa

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\ExtraContent\textures\ui\LuaApp\graphic\[email protected]

Filesize
71KB

MD5
3fec0191b36b9d9448a73ff1a937a1f7

SHA1
bee7d28204245e3088689ac08da18b43eae531ba

SHA256
1a03e6f6a0de045aa588544c392d671c040b82a5598b4246af04f5a74910dc89

SHA512
a8ab2bc2d937963af36d3255c6ea09cae6ab1599996450004bb18e8b8bdfbdde728821ac1662d8a0466680679011d8f366577b143766838fe91edf08a40353ce

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\ExtraContent\textures\ui\LuaDiscussions\buttonFill.png

Filesize
247B

MD5
81ce54dfd6605840a1bd2f9b0b3f807d

SHA1
4a3a4c05b9c14c305a8bb06c768abc4958ba2f1c

SHA256
0a6a5cafb4dee0d8c1d182ddec9f68ca0471d7fc820cf8dc2d68f27a35cd3386

SHA512
57069c8ac03dd0fdfd97e2844c19138800ff6f7d508c26e5bc400b30fe78baa0991cc39f0f86fa10cd5d12b6b11b0b09c1a770e5cb2fdca157c2c8986a09e5ff

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\content\configs\DateTimeLocaleConfigs\zh-hans.json

Filesize
2KB

MD5
fb6605abd624d1923aef5f2122b5ae58

SHA1
6e98c0a31fa39c781df33628b55568e095be7d71

SHA256
7b993133d329c46c0c437d985eead54432944d7b46db6ad6ea755505b8629d00

SHA512
97a14eda2010033265b379aa5553359293baf4988a4cdde8a40b0315e318a7b30feee7f5e14c68131e85610c00585d0c67e636999e3af9b5b2209e1a27a82223

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\content\configs\DateTimeLocaleConfigs\zh-tw.json

Filesize
2KB

MD5
702c9879f2289959ceaa91d3045f28aa

SHA1
775072f139acc8eafb219af355f60b2f57094276

SHA256
a92a6988175f9c1d073e4b54bf6a31f9b5d3652eebdf6a351fb5e12bda76cbd5

SHA512
815a6bef134c0db7a5926f0cf4b3f7702d71b0b2f13eca9539cd2fc5a61eea81b1884e4c4bc0b3398880589bff809ac8d5df833e7e4aeda4a1244e9a875d1e97

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\content\sounds\ouch.ogg

Filesize
6KB

MD5
9404c52d6f311da02d65d4320bfebb59

SHA1
0b5b5c2e7c631894953d5828fec06bdf6adba55f

SHA256
c9775e361392877d1d521d0450a5368ee92d37dc542bc5e514373c9d5003f317

SHA512
22aa1acbcdcf56f571170d9c32fd0d025c50936387203a7827dbb925f352d2bc082a8a79db61c2d1f1795ad979e93367c80205d9141b73d806ae08fa089837c4

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\content\textures\Cursors\KeyboardMouse\IBeamCursor.png

Filesize
292B

MD5
464c4983fa06ad6cf235ec6793de5f83

SHA1
8afeb666c8aee7290ab587a2bfb29fc3551669e8

SHA256
99fd7f104948c6ab002d1ec69ffd6c896c91f9accc499588df0980b4346ecbed

SHA512
f805f5f38535fe487b899486c8de6cf630114964e2c3ebc2af7152a82c6f6faef681b4d936a1867b5dff6566b688b5c01105074443cc2086b3fe71f7e6e404b1

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\content\textures\StudioToolbox\Clear.png

Filesize
538B

MD5
fa8eaf9266c707e151bb20281b3c0988

SHA1
3ca097ad4cd097745d33d386cc2d626ece8cb969

SHA256
8cf08bf7e50fea7b38f59f162ed956346c55a714ed8a9a8b0a1ada7e18480bc2

SHA512
e29274300eab297c6de895bb39170f73f0a4ffa2a8c3732caeeeac16e2c25fb58bb401fdd5823cc62d9c413ec6c43d7c46861d7e14d52f8d9d8ff632e29f167c

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\content\textures\StudioUIEditor\valueBoxRoundedRectangle.png

Filesize
130B

MD5
521fb651c83453bf42d7432896040e5e

SHA1
8fdbf2cc2617b5b58aaa91b94b0bf755d951cad9

SHA256
630303ec4701779eaf86cc9fbf744b625becda53badc7271cbb6ddc56e638d70

SHA512
8fa0a50e52a3c7c53735c7dd7af275ebc9c1843f55bb30ebe0587a85955a8da94ff993822d233f7ed118b1070a7d67718b55ba4a597dc49ed2bf2a3836c696f6

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\content\textures\TerrainTools\checkbox_square.png

Filesize
985B

MD5
2cb16991a26dc803f43963bdc7571e3f

SHA1
12ad66a51b60eeaed199bc521800f7c763a3bc7b

SHA256
c7bae6d856f3bd9f00c122522eb3534d0d198a9473b6a379a5c3458181870646

SHA512
4c9467e5e2d83b778d0fb8b6fd97964f8d8126f07bfd50c5d68c256703f291ceaed56be057e8e2c591b2d2c49f6b7e099a2b7088d0bf5bdd901433459663b1f8

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\content\textures\ui\Controls\XboxController\Thumbstick1.png

Filesize
641B

MD5
2cbe38df9a03133ddf11a940c09b49cd

SHA1
6fb5c191ed8ce9495c66b90aaf53662bfe199846

SHA256
0835a661199a7d8df7249e8ae925987184efcc4fb85d9efac3cc2c1495020517

SHA512
dcef5baccef9fff632456fe7bc3c4f4a403363d9103a8047a55f4bd4c413d0c5f751a2e37385fe9eba7a420dbdb77ca2ff883d47fcdd35af222191cc5bd5c7a9

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\content\textures\ui\Controls\XboxController\[email protected]

Filesize
1KB

MD5
e8c88cf5c5ef7ae5ddee2d0e8376b32f

SHA1
77f2a5b11436d247d1acc3bac8edffc99c496839

SHA256
9607af14604a8e8eb1dec45d3eeca01fed33140c0ccc3e6ef8ca4a1f6219b5dd

SHA512
32f5a1e907705346a56fbddfe0d8841d05415ff7abe28ae9281ba46fedf8270b982be0090b72e2e32de0ce36e21934f80eaf508fd010f7ab132d39f5305fb68f

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\content\textures\ui\Controls\XboxController\[email protected]

Filesize
1KB

MD5
499333dae156bb4c9e9309a4842be4c8

SHA1
d18c4c36bdb297208589dc93715560acaf761c3a

SHA256
d35a74469f1436f114c27c730a5ec0793073bcf098db37f10158d562a3174591

SHA512
91c64173d2cdabc045c70e0538d45e1022cc74ec04989565b85f0f26fe3e788b700a0956a07a8c91d34c06fc1b7fad43bbdbb41b0c6f15b9881c3e46def8103e

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\content\textures\ui\Controls\XboxController\Thumbstick2.png

Filesize
738B

MD5
a402aacac8be906bcc07d50669d32061

SHA1
9d75c1afbe9fc482983978cae4c553aa32625640

SHA256
62a313b6cc9ffe7dd86bc9c4fcd7b8e8d1f14a15cdf41a53fb69af4ae3416102

SHA512
d11567bcaad8bbd9e2b9f497c3215102c7e7546caf425e93791502d3d2b3f78dec13609796fcd6e1e7f5c7d794bac074d00a74001e7fe943d63463b483877546

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\content\textures\ui\Controls\XboxController\[email protected]

Filesize
1KB

MD5
83e9b7823c0a5c4c67a603a734233dec

SHA1
2eaf04ad636bf71afdf73b004d17d366ac6d333e

SHA256
3b5e06eb1a89975def847101f700f0caa60fe0198f53e51974ef1608c6e1e067

SHA512
e8abb39a1ec340ac5c7d63137f607cd09eae0e885e4f73b84d8adad1b8f574155b92fbf2c9d3013f64ebbb6d55ead5419e7546b0f70dcde976d49e7440743b0f

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\content\textures\ui\Controls\XboxController\[email protected]

Filesize
1KB

MD5
55b64987636b9740ab1de7debd1f0b2f

SHA1
96f67222ce7d7748ec968e95a2f6495860f9d9c9

SHA256
f4a6bb3347ee3e603ea0b2f009bfa802103bc434ae3ff1db1f2043fa8cace8fc

SHA512
73a88a278747de3fefbaabb3ff90c1c0750c8d6c17746787f17061f4eff933620407336bf9b755f4222b0943b07d8c4d01de1815d42ea65e78e0daa7072591e9

Download Submit
C:\Users\Admin\AppData\Local\CEF\User Data\LocalPrefs.json

Filesize
643B

MD5
593430fcbc8ada1739290e231e258b5a

SHA1
afd42c1c7762018833ce7d77297ad8c55bfb6006

SHA256
0d13c04a0af9efffc04c4bec86142fc3beaa147171db11f3b9c29a26d4b91a7f

SHA512
1bc933e948d1d82bece5eccbb16765f80b92573f29f7b94423d9955f05d63d97c6b2a8d0273c7c3bc3cb6f114e7af331325a7821cd9dc6eca2f53a8825c2b288

Download Submit
C:\Users\Admin\AppData\Local\CEF\User Data\LocalPrefs.json

Filesize
755B

MD5
23445297e86a8612187e52f0e8c5a488

SHA1
b2c01107b419fbf4a20c5e6f70114e0573af378b

SHA256
7b9b96dd2b965b132d833659314be4019a8431a7e71a75aaffd1da88f7f94150

SHA512
5d289055f3c90d2239fa61f653e6ec7adf63bf1ec1c78dcb4b8de2d2261202276e77b81f0164038d2297d6b9096c75fa9e8bd8b6375f33c8147f5e8110c3fb68

Download Submit
C:\Users\Admin\AppData\Local\CEF\User Data\LocalPrefs.json

Filesize
850B

MD5
3bf8ac4078daafe174abcc7baaec0786

SHA1
4767ff2f78d890ad60287d25fe88ed4f7ad1ab50

SHA256
eab9edcc2f3aff2b1abe1b5564a56e397c32f7131917649205c6347e303924d0

SHA512
478ceebb7803d5acb1f5b943e751e1bea8c4f9b412bc38c98928af2f955c215a2c7911b54f33a0f8cef6d374e9e7406b7bfae3dde3abb8cdc228678f1b48fbc0

Download Submit
C:\Users\Admin\AppData\Local\CEF\User Data\LocalPrefs.json~RFe59a270.TMP

Filesize
434B

MD5
752fe6d98da79b7c401e695387ab0284

SHA1
e4276138ba3935cd9dc711fc5e90b9df54453cc5

SHA256
7f21f75f6fb44105defad817f0e9332fba936474e58c8c75a1e75e2ee532dc36

SHA512
8d6295c5d711126a9c53ff1437f179c78ebaefb3ac0dce4d3efdad7e853e121c1364d2673b1348394ce62baf9b475585735968dfe991c90b055384190123db09

Download Submit
C:\Users\Admin\AppData\Local\CefSharp\CefSharp.BrowserSubprocess.Core.dll

Filesize
915KB

MD5
100c32f77e68a2ce962e1a28997567ea

SHA1
a80a1f4019b8d44df6b5833fb0c51b929fa79843

SHA256
c0b9e29b240d8328f2f9a29ca0298ca4d967a926f3174a3442c3730c00d5a926

SHA512
f95530ef439fa5c4e3bc02db249b6a76e9d56849816ead83c9cd9bcd49d3443ccb88651d829165c98a67af40b3ef02b922971114f29c5c735e662ca35c0fb6ed

Download Submit
C:\Users\Admin\AppData\Local\CefSharp\CefSharp.BrowserSubprocess.exe

Filesize
7KB

MD5
516ff62b2e1f4642caa954c0968719e8

SHA1
e349d0ce82e2109dd0d18416d9cf46e8411b7f15

SHA256
19da58849cec5933860116e60a1e94b08e30d90e0f955768270b47998d612045

SHA512
7aa4a0c87b29c2a84f585a884d8208fc2352a43f2cdb549c100e3b121837ad5f8dadb1101f57d1d3fcb7ebec9d9f22e07dc14239b7d2e2d25793c999becf288b

Download Submit
C:\Users\Admin\AppData\Local\CefSharp\CefSharp.dll

Filesize
272KB

MD5
9ca06a8f9e5f7239ca225ab810274023

SHA1
e1a219f567a7b7d3af9386df51b14c76e769c044

SHA256
5fd00ae3e83e6ca156647ff6df87b49ffc7cad47c23fe3ae07c067c5adf6f74a

SHA512
430c9bceed5439b987d5bd4840cfe32411ca61594f18597aca1948aa39a22c9d70beadf3bb9b1dd0373f81a94a25dcba17fa8e8c73abf06cba28d0971d5614c5

Download Submit
C:\Users\Admin\AppData\Local\CefSharp\chrome_100_percent.pak

Filesize
667KB

MD5
ae195e80859781a20414cf5faa52db06

SHA1
b18ecb5ec141415e3a210880e2b3d37470636485

SHA256
9957802c0792e621f76bbdb1c630fbad519922743b5d193294804164babda552

SHA512
c6fef84615fe20d1760ca496c98629feb4e533556724e9631d4282622748e7601225cf19dfb8351f4b540ae3f83785c1bcea6fe8c246cf70388e527654097c1c

Download Submit
C:\Users\Admin\AppData\Local\CefSharp\chrome_200_percent.pak

Filesize
1.0MB

MD5
1abf6bad0c39d59e541f04162e744224

SHA1
db93c38253338a0b85e431bd4194d9e7bddb22c6

SHA256
01cb663a75f18bb2d0d800640a114f153a34bd8a5f2aa0ed7daa9b32967dc29e

SHA512
945d519221d626421094316f13b818766826b3bedddab0165c041540dddadc93136e32784c0562d26a420cb29479d04d2aa317b8d605cd242e5152bf05af197e

Download Submit
C:\Users\Admin\AppData\Local\CefSharp\chrome_elf.dll

Filesize
1020KB

MD5
7191d97ce7886a1a93a013e90868db96

SHA1
52dd736cb589dd1def87130893d6b9449a6a36e3

SHA256
32f925f833aa59e3f05322549fc3c326ac6fc604358f4efbf94c59d5c08b8dc6

SHA512
38ebb62c34d466935eabb157197c7c364d4345f22aa3b2641b636196ca1aeaa2152ac75d613ff90817cb94825189612ddd12fb96df29469511a46a7d9620e724

Download Submit
C:\Users\Admin\AppData\Local\CefSharp\d3dcompiler_47.dll

Filesize
3.9MB

MD5
3b4647bcb9feb591c2c05d1a606ed988

SHA1
b42c59f96fb069fd49009dfd94550a7764e6c97c

SHA256
35773c397036b368c1e75d4e0d62c36d98139ebe74e42c1ff7be71c6b5a19fd7

SHA512
00cd443b36f53985212ac43b44f56c18bf70e25119bbf9c59d05e2358ff45254b957f1ec63fc70fb57b1726fd8f76ccfad8103c67454b817a4f183f9122e3f50

Download Submit
C:\Users\Admin\AppData\Local\CefSharp\icudtl.dat

Filesize
10.2MB

MD5
74bded81ce10a426df54da39cfa132ff

SHA1
eb26bcc7d24be42bd8cfbded53bd62d605989bbf

SHA256
7bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9

SHA512
bd7b7b52d31803b2d4b1fd8cb76481931ed8abb98d779b893d3965231177bdd33386461e1a820b384712013904da094e3cd15ee24a679ddc766132677a8be54a

Download Submit
C:\Users\Admin\AppData\Local\CefSharp\libEGL.dll

Filesize
359KB

MD5
7dd6b0e4a31d35a0fae5ff425707073c

SHA1
fbd12e9f8e2252c52ce555c2ebbd7f07e62a0140

SHA256
8762d8001fc3ddd90e3129dfea172817e8d09b9936eaae391957de4326c8c906

SHA512
726968df6b83ab5f589276672250d92f532fe2dcea2176e42031a7f1dcecf578b0320cfe2a7d88bb9883ad99387d71c6ebf1e9968272bb5e62850ef09abd2648

Download Submit
C:\Users\Admin\AppData\Local\CefSharp\libGLESv2.dll

Filesize
6.6MB

MD5
8803db5b167fb5a5f8a8c595c4e4d7c6

SHA1
7fde861151f3bea66c65b6c2487a30728048811a

SHA256
52a58d25a41f4bd31cdb4a0d306217862e04ebf7c1925cc85330054a5523d719

SHA512
2fa9a0eda221982896e41eb387b5e156198615ac1a1fbac0acffd13008919368b41a240df416c1fce2e48c20a14cd7af7cca9fba476ada5e64a0cadde84a44b7

Download Submit
C:\Users\Admin\AppData\Local\CefSharp\locales\en-US.pak

Filesize
456KB

MD5
4430b1833d56bc8eb1f7dc82bb7f4bc9

SHA1
dc15e6306625f155683326e859d83f846153c547

SHA256
b44ddcfac9df4934007e6c55a3c7f5e7f14c7e5e29f35c81de917fc3b22aabbc

SHA512
faf93bf371b2a88c1b874a5e2c54e4487fd152ad19c2a406a46f55ae75ecd421a779888c2e4c170857b16bfb5d8744bc1815a4732ed50b064b3cbd0c5ffad889

Download Submit
C:\Users\Admin\AppData\Local\CefSharp\resources.pak

Filesize
8.0MB

MD5
4933d92c99afa246fc59eef010d5c858

SHA1
98d443654e93c73dd317f9f847f71fba3d5b3135

SHA256
62f4674daa15245ee081920b8ee191e72f36ca8fe24f6b986a832f45676915b2

SHA512
a3a69523c8e7310716daeebc06c2ba4fce673eccd1958e824ff179b82f4502d0ec095190179bbb387342e4150f952ea7533182fb6ba90377d17dafba8f4da623

Download Submit
C:\Users\Admin\AppData\Local\CefSharp\v8_context_snapshot.bin

Filesize
643KB

MD5
28477a60b4fbd51dfef5237245817690

SHA1
b0afd5ea9f9d550124f23c65bc7851ddeffc662f

SHA256
169ea86f544e5cdf2a460675f876a9abb7f56bbe122782e94bb03d624931fc12

SHA512
3520658583bb498d5032a7f7ae77195fd2e5f8ed03c6531e56dee8320d8701102a723766e59f7766ab223f837e65a6d85cf862bb2bef6d2755ce45e672a47b22

Download Submit
C:\Users\Admin\AppData\Local\CefSharp\vk_swiftshader.dll

Filesize
4.4MB

MD5
0ec149455727ace9acc09b3ba2c3a2b2

SHA1
6eeb990876cef6a34115b67f3190255db589f723

SHA256
e2d8ef53897e864b5b66bc73606681c99461798a9f4c1e13ca5cef7bc774d7fd

SHA512
c8eaa598c9439b1f2375fdac1f58896853510bddbd640707b9142c0d3793836120b28d7c2bd0407f0d5656dd19f14b312f37b7ac0165c9cc8b4c1a0f2af62531

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009

Filesize
86KB

MD5
9ddd0737c0ca1606ae31f23fce133795

SHA1
6ec113b7d5bb4e00796f66609d14d10d3e829020

SHA256
dc1ee60f8f7100aed48f6b043412dab4ac371d67c41a035216dd7b8d979d0b28

SHA512
12de1a1427acee3dc855205be52956322903270b033b78312a0b3a3c570fb8c97cb7914ea824e59260d4bf363c61647d3666e862ea95786121b499e8b6eee745

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001d

Filesize
147KB

MD5
759ab24cf5846f06c5cdb324ee4887ea

SHA1
41969c5b737bc40bbb54817da755e3aa7d02f3c6

SHA256
7037e6c967c38477a5fcd583c74892e16b7a9066cd60287c7035bf0760d05471

SHA512
3470ae07eb7c54feee1e791e63a365cfb0da42f570a66e6c84faf5db6bf8395173c6cb60e8c5cf28eae409f26ea5433c3c5d6ea32eb07e5997c979c6e3ccf4be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000039

Filesize
51KB

MD5
588ee33c26fe83cb97ca65e3c66b2e87

SHA1
842429b803132c3e7827af42fe4dc7a66e736b37

SHA256
bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760

SHA512
6f7500b12fc7a9f57c00711af2bc8a7c62973f9a8e37012b88a0726d06063add02077420bc280e7163302d5f3a005ac8796aee97042c40954144d84c26adbd04

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
616e7234d17a2c615703bf81be3bff34

SHA1
b934ead5385a796f3f699980c2dc2815615346c4

SHA256
7c2052596a6fb1362c8883ede6b59aa1fdd8e9de20b22a8d4750b26812c30078

SHA512
39dc5d416a7c5814843397a182bf7f7a52f498426e17509e209af8de0ae6b180021ec6a4c1cb2a4e4ba3c2f793c880704c2d83fc75e2d4abe0bfaaf6c72c6e2d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
c7011a1a74d511b11dd5203ad8f4a3d9

SHA1
597177318a77acfde000696f047729d2cb19e387

SHA256
1e510ed3166fa9f658186f864caff71ec52a697b813ef35f682f1f051b09016b

SHA512
8ca6b02c1ae16a613fa27cde8e1c656ec49eac94e1cc6a0463e52800fb3780b350f6ae493b862ae5438063ac4b91322ed5b7f6c7279aa5479509d5231c0d522a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
951ad649161da9f0322ca32c5d9be23a

SHA1
f125b49bcd19ed400cd047cbb72dcd447834b8b4

SHA256
9ad74b7699f94012b3e84acc86b0d00b2c957230f0e66e1ab22177c469c914a2

SHA512
ee9877b8da461083fd7b91c296daf6212daaca395c580d2a40e4e09f4c081216bfd1f8431570a540cc3c6c4f108d4a22008fb4dba4dac43bd1374f8ebb41c107

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
11ead154db431daa2d9cf97e69787590

SHA1
6c4681c13f4a68a4620fee5be9f4cdea2738852e

SHA256
f05843906a118a68c170ad34e221dd6f8b9cd253f12fd64b7812a28df3668e49

SHA512
940f52a7778e3973ed252cc4c2f62852e688c6888e31c2d8419919421370d3edf0923a4ce18bad3bebb8f1ec42b8e0d01f526b5bb8f54203dae3b5d0c3e14067

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
387B

MD5
1294e369443a1967aff84bab9165753a

SHA1
9484953ea42ec7e45c9f130e5dd791fb23510aaf

SHA256
8bf5fe91af7c2990ad4284db14c03bdf2c8d650972c8b1da3c58a552728c3f33

SHA512
88e272defaea877d71f30d9bce20d02721f3d62c62519c8109f313e9d50be55c5b2f78afc2539ed64ecdcc317a3c4e17c660ddccbf7346a7e947ef30f3769d6c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
387B

MD5
b7187ae879a5b696c825ff405319ba0a

SHA1
677ea6a2b9969a54c538daca18aff3cecc338195

SHA256
c78e748a67dc0ce7451330c32e563e0880690ba6c39cf4df82839ba90ca2bdc7

SHA512
10d782f88e8b6056fdbca1f88a4cbd37c12ad5c6dd8d66a1fb07e0a17fe4fe4054097fee80007b8e23b0976519aa387b8ef3cd13a29ab9632d952fe90c409114

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old~RFe58a6f9.TMP

Filesize
347B

MD5
c9e343511da9a08dc472ae2fc6700478

SHA1
782ff645fb7cea19a295542ce95fde82e5c64462

SHA256
0522744274cbdccd0996471ee33f10e525445de8ce738763cde9bf29bd65ca9a

SHA512
99452613aa7cfe2526ff8bada5ef2f3a553f8ea6fe5bc96b83e70fdf5d3cf2f52e666d013330d41da03ce640e4ed7be0010404070aed5495e2435011e312807f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
10KB

MD5
0e5881327e3998afefe07cf5dea19e99

SHA1
102fa5e40e977b6864b3f9cec9c4db50331e3594

SHA256
68143e6d3bc15397ff0750a026441105242511a396ddca82d7a3d735d8b19112

SHA512
579f1b0c05ab3e6c0e618aec031e0ef8135f3c87f95e7a60636ee4727821c4b6caf63350f4b072d749cf0346deb477b3fd65a13db6be90b2ae9c7b7fa2442079

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
10KB

MD5
73918963c7f1d2efcca16d6a17c812f5

SHA1
fbb9ddd10915cb35d9cd53a5553b95c74013a244

SHA256
b03fca331338097ca855b82fb878c553f14b7b0f3b3b348541dc7a32b16aa65d

SHA512
0e59364953083823930fe82a9c9061e6d576debf0b9a6eefeb6d8111a00a468215c5a54fa4ea7f8b801fba8afea85fba93057c4c71bbe094f6e262b6f40c7214

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
8KB

MD5
e3b61bbce5e4969864fd6faab0f3bc04

SHA1
537a375102b2ad97c1160aef10b25348b4ca742a

SHA256
905ac27c2609610484015343f9134ac05333a3151963bf7bbb9f0449781d940a

SHA512
4b83eed853861c23e262fe1aab5800e993d2c42f890f6d056dd0d167f7a5ae2123ed4e6e7338686298af4ddfcd0c4437fdb1409b06e379a551377ad750d05970

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
11KB

MD5
120ee39a31ecaac74251769adf80ff6b

SHA1
bf6109de83144d60e49df23cae4a8303fd37a96a

SHA256
ff7d8e6c4a40749c363f4a34e234338bac87e1469c8f3e2940ad494253b3207c

SHA512
45cbc6e2e2848f32ebcf696a7a8a8b02bd1f399ff3190463c0d83756a33fd1692ca499915172cb876a7b4e6904c77d526a776e5449999177ab326556b72febf2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
c2f449e1462b08ef6e964f6aa0700bb4

SHA1
b56e556c8bca5f39d0238207c406e6142f00e375

SHA256
18ea6241562a48a78c15c31f2bef2cac5369b12f22533863b7995ea06d48f485

SHA512
034f7ddd64f9c3efd2d521afc2da34fc0e3ef7aee1699fc7e2817a49dd3b1667d2af2da1e23507f797594ab87a870c8869a956f4282b017d45c27078710f448c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
5e70d39cccff462760956884ed646a19

SHA1
8fc22ceecdbbac976889dbdc112f94ca381cc0b2

SHA256
b0a50b2362b076982a4f7afd030e0ac9de7aabd23fbd80054dabb186a238cd41

SHA512
93866dc61c875bd93bba25e4739b8a657a2062ed3fe0512759c43b1c1a2ac262e88e47c0880f54d3b0af4558e8f416e6a9104f828c2b751bd60b1d1adc3c9ada

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
adbf56dd863cecb03d0e344558746aa6

SHA1
6d50d43d9f795481a7e82d780ea5275005b066d2

SHA256
945326518b800ff467041b2464bf8911c19715021c8e4aad9cac916d91240cfb

SHA512
e07736af5c664ebc973f27764ff71a46730f168690d83b97c59c9cfb1bc1cdd1afa917404bbd9f04ce2c9145fd0b103ad30ac61af336aaeb143b8f9937c72996

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
cff49975f529c1537c56a1e181593fe0

SHA1
58c3181bd7e876b5768b5e61e5319693328ba356

SHA256
284f5ef9ea7ee662d96f2d10299d4d02743582b9b42d24bee622185bdffb2884

SHA512
bb03a39a36d0af4f79b5fda76ff939a5449c227a93160e379966f1e1a21b587b0172077a11982a10438cfca4bb4ca828a9f617c5f94cd2f90891f33068e4a116

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
7740ec3a01660940ea37f94641510a97

SHA1
fc5e1213e7ba5790d585c0d65cda5fc7030aac5a

SHA256
9813814fe30c1d95dea138a644bbedaeccf3f788a98ce2654f90a129b277fb12

SHA512
c33b4bae02ada66d13372648cdb1d64123da524a1dacf9ffd7fb8ef5e8f50adc24c113dc89e022405b39b8dae9a4497e4c8a91874a19c6906161dc3db756a7eb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
b3e8a3fa852c5ed38e0f816d41b62c30

SHA1
ec20b53560c2aeec7582923d0a3aae0245474840

SHA256
ba707e7ac09565f55858fc90123ff2df472d67f83f1df7808a7ebede10efd64d

SHA512
37f71cd2c615d9e5d064de9cc44c04f6a59b7d0fb68c071c04c5869b68752a5f663eab4f48e19c0db81c51ffb6d78f77fea6d4ae0a266db17b41022c502c5e67

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
ce399574953e50a7f45595220993ee3f

SHA1
ae1f0b6d0b2229b5fbf1d8b0d814e7799231cb23

SHA256
0440bb49639f7c5b5fa78c166532581a537603876419f63ff0ecfe198ff5947e

SHA512
f40a1617c6108bfb0277b92e777da4ea87a8543acf792b01d38dfae64a4ecb6a5ebeb4915b727f52dd579fcbc3dfca2a54afccf2cdd38e8d37fa91e2603a9968

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
f463c940bf70990b9fea2ce4d739e796

SHA1
473833cb3a65a6e9d0e201edda6440fcad0ff434

SHA256
9c6819cf5890baec4490e7f26680efcd92c3e775e7a8c5e333875ba2cb4ccdc7

SHA512
21a55bcdc258b44623e008e1dd307088385bd68b6c554221da192db6e58d296bcd8017cd00c322ce4f297d825f66818f72c6c8730573da8d01a9862d104c398f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
5890273c1fe6296f77e8255a4d588dbc

SHA1
23f7df41f8193dd12abc036d9fcc0c0ae80afc71

SHA256
fba13c2af9b6f22df24bd90d5bf0620c840d81c1fc9eb7aa3a05f8d66d7b343c

SHA512
709f4cee7268e31362748c3071c965de1f335613bd638dcf5c4a3cc8981c2050f70533c3808747052eab0818d2228b6a8e184a3faeea085acd720914abd880c7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
6d34073f94ffb83c1a0486b3735c9a29

SHA1
53731c848a5e49b85b22ad929c2ea1ee0d738d27

SHA256
4d65e5a0f9e47b61c9d4c0af96e9ee38720ba0e68d696fa004bdce12009b86b9

SHA512
8c3f248e0c69fda16ba9781482e0bcbacc7ee5d96910dbdc2617c8dee302445d1a947e22af4006423f651cf163d99587381dde2d3cd7e95a46dbf0e40232997a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
a03ce3d3d135f17d35cc1d1a80fb6aad

SHA1
6ed83d760bc81ca34f39cb0cadde773074352262

SHA256
6f1fa2bc1a330fce8886a64364f9cd29f2bd14a85d467b19aea84ea38abcf9a2

SHA512
680277701441b1cedaa15df9a818b099a732869a1898f4375b0bbfde89d604a66a61b8135a5c4a577f497301340f3f635538f8d9b5503647dd8290a546247bb1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
35157c98abf6e40179bbc618826359fc

SHA1
d9daecc594b4600483f0db38e1846ee7e50bba67

SHA256
78ccc9bac7c8340419e33a0eaf998502d9761b79dbd4df8a91101fb7a8790c91

SHA512
e9620e5d19305fd2a6d1a38c811e3078a45c8feba346d68bec66d8767a3caeedc82b83817bed90bdfd249e6c85932d84ce591b40e50c544b64cfa4857dbdd1c8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
0ef45e93b878d32b36217405bd59eb18

SHA1
2355517115f9082a35537d2c13df64964b28eed3

SHA256
367f83968858f0a96d9a2d6c38b69461abc3b8cae63f7fd0e171a63466d87901

SHA512
cddb6cfa674a151f9b9ab489e1a66b28182e84d9bbab10e93bf5dfc0f764d59d3c4c557ff83a79411722d5c2ab72413c5acc812172a87720b024b293fb53d5ed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
42657bd3297c1c98690ba3920ca2df48

SHA1
c2d18f9990a7a245c8fb164ee779d890b3e76fde

SHA256
bcf6ad2a8ef04a9c9c58c76b1ef1a81223b0401eda50926bdfb9aae3896d2903

SHA512
3db33397e784a4a23a670fdf7545ea2701670c85deb539cd38d4fd1275079f218df865bf862968ed4c0c26b98c1027e0ac9d766d84154000febd51e9df7e9c72

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
26941bba3baea11e795c9498efccb12a

SHA1
ce95a90e6c19a0dda07de42de4bd52ffb8e18be4

SHA256
32b698ce515f4f8d5770297ad4173e3507e5bdaf1fdcc9c7a5adecc6a83e77f6

SHA512
dabdad4381a566a9e3d9c80f8e817901a321b7c1456989f9ed665d9862613707d522e2e6182b6f82f74fcad02a730f5f0ff24184d1dc63b87cc8827704ec82f4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
5f7313f69ddbbf4f194255df86a20af1

SHA1
4cc12e78f002aab38774eedad9ab1813a944def7

SHA256
20cc4c32d5f7065a1cedf31d8f31be5209157d5c6ac5539b91a2f0419019362f

SHA512
cde905f56416a6dd99250070d27630f61663fe5c9a19a269596f5f295f006b9cada5fcab985482f155de72cc958fb505ab55a67555cdaa813ba1e9b609dc5d65

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
7ffa236b657b2feabbe64ae3ed4be367

SHA1
11cea0a96550841691723c2b07e3461be80db1ef

SHA256
9d04bf444eda14a25b8b7823089e24d71ff5cd29f5b664bf55c078018004d350

SHA512
bf19e1854688780a3d654fca7c7c3adf024932d893de5ad51451b2ba1af223cd0a835edc841758a18a97f6549ab01edb458a93bc9802e0853fa937c3ddca908b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
1fcdf3acbd7a63da78d398ca7343b5e6

SHA1
28cee59ab71e5d48b2ed5fe0e35069da1c23730c

SHA256
cdf90c8b12dc5feb2d3092f031fa53f7db5d21465e2e35a8be4bb2aabe2ed042

SHA512
4ebaf01f139b06f702073bdf97b4438fd273615f79489266dd68f4562e023dbb90a4ea30fb77eb7f72175f941781f2e7b672f295f2b931e7b691006e345a255e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
e71f9b45bfca9fbb615767ae7d94c018

SHA1
f8fc4a443e3b9275031deaeab26a8192a68db4c9

SHA256
aabd433d692af278482c5207a2b5675d4d9f10ce2cebc141115091ae87d384e8

SHA512
41f0848dc39072078306248037f98d7361d5fe3af3b30a6174e6b298ad023a50952a94635948eb29a9b936f69d89eeecf90eca80ff4a6274db898c0a8eeff1be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
48dd67b11e4e350ea4d93d567311574e

SHA1
c82001859cede54f0ae8c5cc449e389fcaa1592e

SHA256
02111271186ed928775829c5626a23c72b8512fe0dd63a0d6526c44ff6a49c5e

SHA512
d9865c0fbcf18813d7c6200c77fad74180e9770b17f5f216b1a615fef1b8ae184a4163a313e6253fd907f745a8a825c1a354e597fef1fc6fd992a97020448814

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
fd4fce8541d22d029bdcf52a6f47d023

SHA1
b4c1a8993bd4af75272319fc3211433f21caf098

SHA256
0b3e27b70a5834fe419def770b4d567f33b8ee2cfee15e56e424475dcc629cd8

SHA512
50175a146f2447a40f2a1167628bd546e093c67064dbf824aa6722e87297de5feffe99d89a7262f8127bfaea2335629c1fa5dfaed66052998bac87b091e7dcaf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
064a3881323794ab859b177c428b6166

SHA1
3687c18e729ede2309868141085942f835adfbe8

SHA256
815e5fa365695dd52c16f692fee136b8cc246980a006bca89d5fffea2492add8

SHA512
8676fb9cb97d29addc4243e3a745aaefb8dc067f43251e45430efd295116c50c41421850cf1affaff165ff08694a7e7b5665cce3ae3bc6118254fa9a7f995c65

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
cab50d6018d42e4e14cc8c7a0592261b

SHA1
d26fa5a3c8539d2a131eb2d4f9118b9481f98aa7

SHA256
b1c9085f6734538df1237ffeef36d86bc7508d25f62a1c2ff64e84c354cb705a

SHA512
2456af3288aac43c0a72eb22355f9439147d9adb93ee9d70fcde4b1897b8c5ec5c3342db96e02a05b2bb0ba8ccd6409622d01f9f3680593601f7ebd18affdf60

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
fee1888b1f517fbe2fe897150001e28c

SHA1
59f75bfcf681dc594d83c8333f577a5f5b032fda

SHA256
23623fdc9ceee244b5a87b3a7d8083c2d9d942fcdcbcb1eb9fc27f7035502f6b

SHA512
b583f025ff1b471b9620f9cbb1db51a8839b979ddc49519a0bcf339a8a250f4482c6051180dfe00d6989286ff1616df4eb4db2bc2f34cc5186d08931e3ad663f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
6b762f48893f485b7dcb1ab8e05eb41b

SHA1
993c83bfeb231e7882b50a28c203520b8adf970a

SHA256
520d62ed5431c3ca69d2dc275d8e5a6ec8d7c34686b1f9278479f8db402e6c31

SHA512
490cb5c48b1946e6f51b7f47e97b7c153e187198e7584a83430348158a1606172ccf981f5bcecfdb3dcc6440d440105ea2a747c72e7db9b4b7972519d922628b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
50f5ebc1e93895a6a4d22fadaef96949

SHA1
884a8f0ffe9aee9254da420f30f319c33c55383d

SHA256
53fb0908d4fecdd85c9b0f2f061343758c94b8fe74640bb482bb1ceec5fba32e

SHA512
de989b312f2fd7dbca90ed1d5112199075e9bb862382e102a61de8e06cfdebf7e8e7d1d5075a590fa9f8fcb1753bcb879678dafba3d591af52446a5fe2493fb6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
84764cfcd3956f85374087966a2c2bc2

SHA1
40ea7de2f94407eb28cfb32ce6e0e23eac9bc7ca

SHA256
471bf0d26827767cdbcbb1047f05b8ad3842333d30b98dc98d3db706bb6b7f7d

SHA512
f201cf48c0bd135d0b32051c06baf2e8f5ba9d825da5f100adefd5508dc2ed576ade8d7e1307bbae2125b59e5ace2d38f18ed6afdeb2e9c6ae527c1b4cb9f8ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
ab79fa3fd07eee300981bde649fd51ff

SHA1
7579ab320bc60fa73f632c608428dc816408aeed

SHA256
0cf93bb66c117e02fd3e247d43510a9f8b40fe9456ea16b306effcb147f709b1

SHA512
41542de28bf5c24a7dc00771828d2c8ab25ed1bfc4b3b135dba8003b73899c0a404c076a19a3f480047ebebec5e1926b1e14df51d61e2fd200a9756b4019aa04

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
00703cfbc68b391e465cbac0562671fe

SHA1
40f4806e5467e8db88fb39ca123c0ff06b8466e0

SHA256
fcf2edd5a9cdd8d04fbe2195ced65d19d2e687e899b36339c47af9e0c3125ab4

SHA512
193867b712328410be4237bb1d8e944d26f9949bf278ad2ad609a2c6b746051f0c2c4963a1c2fd0f2eeb529ce0f92ba559b1531dd16dd46b688d976b501fb2db

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
5be8974a4b14b7f0922b6e971045c02b

SHA1
380cbc9218c5247c6cee7fed9e4f6718905b196b

SHA256
c1c7c096eb2ba9825abe2cb9b27673d7edc92670d5cfdd547492e522e08b8ab5

SHA512
9171ca83a6f22794aa2d09f13412540d05204948512d5c30e445166f2223e0ac1e20acf591f2f3f852ae69441189fd8c96f6f62cef5f59310859225f978e0d50

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
440992fce128308359df622c32eb7b7e

SHA1
1ba349154b7b41e9e7461681b728fecf230f01db

SHA256
76b5398d1e77a01154fe9233731d8220ad1e70d8a81d400f12ecddc384aa68ce

SHA512
705efd2ef9910460b31866500b5f623a6e824da7c637f7f31849321d40f46c32c889aa238e67068952a24cdb7ea595ac1a5c30ad38e035b57c3af07dc46d24b6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
fb7cf8065e4d37fd7c4c01d9afda999e

SHA1
0098414e1a1ba9a71d9c2db93b2423d468116876

SHA256
929dc6210348c8e9906f177fb486a08dcb5f08211ea9695274e9f314e03598a1

SHA512
2855670d44bfbc4c6fc93da75c58311e31e72a553884c45b4efa56f8596df4b325a595388b6d78a65677ed71d9ce19b02cec04969bc68cdbb54d0b2a0dce860e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
281KB

MD5
e6f760b581af35c7753de08b72100dfc

SHA1
cd1237f7d31e90724bf5f454842b9761983e9e9c

SHA256
4939cb746f09edb55e551c7d5f28e19c2ba566a4f1953f982e952d50a7d7f67c

SHA512
70adf3e7d543d1810469ece63c2895c8fe20116a795a4146a2125fa150a24ecc49161ec498f36908aca56ae89761a25dd7f4234aea40407ed43c3b2a6072248b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
281KB

MD5
9f7337be854bb1497f7578a09202813c

SHA1
3db0e669396f6ba62d1f4ff6a45d42b10465d82c

SHA256
7630db31cb7104307f766fe154271d295d553ee18426c5562bf689d6696d27e7

SHA512
484370f64e72e6ca5517379ef0a35b342545c9b4c5cb6b3f44de13710a4a5dd1db43dc2100a14f18daadf18883f98fb95d459e906b7f3b43325527f1f517252f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
92KB

MD5
16e973abdcdc3fa6fb07c54f5e74b03d

SHA1
287ee0915d08dc7adf2b43e2c9e352826d019947

SHA256
43acbd0826c034fd12b9144743c45514e6880a3e9f5778d5a8b8601afc68a833

SHA512
9e309c773fb39e07288ba851af959db92d1d5a10ba77639e69a88481880317e2dfa2a741cdb2f2ce891a1ecdbc9599f0182ec4d6acf1ab45aeb561a826d08ffc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
101KB

MD5
408e7a3809e79766096045ddfefc2b03

SHA1
461796ccb262a21633ed1d2e3f86d9d3be108f3f

SHA256
3e2c6e17c7cf7b83e4dabac90be8d8b10503d19390b3d024ba866cb680ea960e

SHA512
bb36815561b88fbd002743fd1b4c2c560c7360f154797a5b95cf5afd31b7e5b5e3d172b4d2932e9e93f036323da7ecd98c329ada6bde7bc0c36f2821621086e5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
89KB

MD5
bc3fe04e5915d83dfb8d86feef708fcd

SHA1
f8835883b25a76d3cb6452bfc80db34dd0b33692

SHA256
0cfda8c47bbd7810d9f8d5267cfc0f5dc07922d682b3d58263b54c7c3e5760d2

SHA512
52801f17624b36d006160dc23e27dd83b7ccaed9c2cc9bbd68c9bc07cc681aee7e75a6da705d0a4981483983e81382804263f55361ec34ce6f5a651b61daf850

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5811ae.TMP

Filesize
88KB

MD5
0a18c191b878b6f285549a88d9d2643f

SHA1
745e065fa15b4f5f25619bdbf072ac4ce2aa65d9

SHA256
3bd29c036e86aa572a9bd8932351cbaf44c85e17b2fec2534ef90f10f16fd50b

SHA512
76db31fa5d78afe7ea929b164a8262abddab4449995654fbdd38765fb1af71c69b2a16572aba1d5a2463295dcd54b75fc211805a5bb0871f67af41d6063ddddb

Download Submit
C:\Users\Admin\AppData\Local\Luau Language Server\server\index.js

Filesize
6.1MB

MD5
6b1cad741d0b6374435f7e1faa93b5e7

SHA1
7b1957e63c10f4422421245e4dc64074455fd62a

SHA256
6f17add2a8c8c2d9f592adb65d88e08558e25c15cedd82e3f013c8146b5d840f

SHA512
a662fc83536eff797b8d59e2fb4a2fb7cd903be8fc4137de8470b341312534326383bb3af58991628f15f93e3bdd57621622d9d9b634fb5e6e03d4aa06977253

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
896KB

MD5
9e25d233a1b2aeaa2a7dfc40a74a8399

SHA1
745cb76691f828b1e777b310eeb554fd64496441

SHA256
c121f2e300e1e9a19a8c8bf80acc0a5dd4fe7b1b1a40bda945b56fa5ac56da8c

SHA512
bd6ec6ed335d9f3101bbe35b49a6bad85d48ff9e2e4e1d05c0015ce68dd65452069075c1e0e8435bd063d8978b294150da4f89a1cfbdea2eb92d96155906b235

Download Submit
C:\Users\Admin\AppData\Local\Wave\CefSharp.Core.Runtime.dll

Filesize
1.3MB

MD5
09cba584aa0aae9fc600745567393ef6

SHA1
bbd1f93cb0db9cf9e01071b3bed1b4afd6e31279

SHA256
0babd84d4e7dc2713e7265d5ac25a3c28d412e705870cded6f5c7c550a5bf8d5

SHA512
5f914fa33a63a6d4b46f39c7279687f313728fd5f8437ec592369a2da3256ccff6f325f78ace0e6d3a2c37da1f681058556f7603da13c45b03f2808f779d2aa1

Download Submit
C:\Users\Admin\AppData\Local\Wave\WaveWindows.exe

Filesize
7.5MB

MD5
8a2cd9abb3b07e6d39a196d489905b16

SHA1
f632456bb3f8121efe7a93a5a440188eb69d76dd

SHA256
32908075eab8e0137e3f4e02e1101fdc53906b56085ec84a2990a27fe147fb63

SHA512
f31741334464b5e3d962e0e4c8d4a9634d7191e369023582af389261298295862b718eda01b123c0540e494d887b34cf5b3dd204953d778c814c57cf7629154f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/1572-8989-0x000000000A290000-0x000000000A291000-memory.dmp

Filesize
4KB

Download
memory/1572-8987-0x000000000A290000-0x000000000A291000-memory.dmp

Filesize
4KB

Download
memory/1572-8993-0x000000000A290000-0x000000000A291000-memory.dmp

Filesize
4KB

Download
memory/1572-8994-0x000000000A290000-0x000000000A291000-memory.dmp

Filesize
4KB

Download
memory/1572-8995-0x000000000A290000-0x000000000A291000-memory.dmp

Filesize
4KB

Download
memory/1572-8996-0x000000000A290000-0x000000000A291000-memory.dmp

Filesize
4KB

Download
memory/1572-8997-0x000000000A290000-0x000000000A291000-memory.dmp

Filesize
4KB

Download
memory/1572-8998-0x000000000A290000-0x000000000A291000-memory.dmp

Filesize
4KB

Download
memory/1572-8999-0x000000000A290000-0x000000000A291000-memory.dmp

Filesize
4KB

Download
memory/1572-8988-0x000000000A290000-0x000000000A291000-memory.dmp

Filesize
4KB

Download
memory/1744-254-0x0000000005470000-0x0000000005506000-memory.dmp

Filesize
600KB

Download
memory/1744-0-0x0000000074F5E000-0x0000000074F5F000-memory.dmp

Filesize
4KB

Download
memory/1744-255-0x000000000AFC0000-0x000000000AFE6000-memory.dmp

Filesize
152KB

Download
memory/1744-4-0x00000000093F0000-0x0000000009428000-memory.dmp

Filesize
224KB

Download
memory/1744-5-0x00000000093D0000-0x00000000093DE000-memory.dmp

Filesize
56KB

Download
memory/1744-256-0x0000000005740000-0x0000000005748000-memory.dmp

Filesize
32KB

Download
memory/1744-2-0x0000000074F50000-0x0000000075700000-memory.dmp

Filesize
7.7MB

Download
memory/1744-258-0x000000000B7F0000-0x000000000B862000-memory.dmp

Filesize
456KB

Download
memory/1744-259-0x000000000ADF0000-0x000000000ADFA000-memory.dmp

Filesize
40KB

Download
memory/1744-1-0x00000000000F0000-0x0000000000282000-memory.dmp

Filesize
1.6MB

Download
memory/1744-260-0x000000000AFF0000-0x000000000AFFA000-memory.dmp

Filesize
40KB

Download
memory/1744-42-0x0000000074F50000-0x0000000075700000-memory.dmp

Filesize
7.7MB

Download
memory/1744-7-0x0000000074F5E000-0x0000000074F5F000-memory.dmp

Filesize
4KB

Download
memory/1744-48-0x0000000074F50000-0x0000000075700000-memory.dmp

Filesize
7.7MB

Download
memory/1744-1341-0x0000000074F50000-0x0000000075700000-memory.dmp

Filesize
7.7MB

Download
memory/1744-47-0x0000000074F50000-0x0000000075700000-memory.dmp

Filesize
7.7MB

Download
memory/1744-3-0x0000000074F50000-0x0000000075700000-memory.dmp

Filesize
7.7MB

Download
memory/1744-6-0x0000000074F50000-0x0000000075700000-memory.dmp

Filesize
7.7MB

Download
memory/4188-1373-0x00000000053E0000-0x00000000054CA000-memory.dmp

Filesize
936KB

Download
memory/4188-1380-0x0000000005590000-0x00000000055DA000-memory.dmp

Filesize
296KB

Download
memory/4188-1369-0x0000000000C00000-0x0000000000C08000-memory.dmp

Filesize
32KB

Download
memory/4248-1428-0x000000000EA50000-0x000000000EDA4000-memory.dmp

Filesize
3.3MB

Download
memory/4248-9031-0x0000000005A40000-0x0000000005A50000-memory.dmp

Filesize
64KB

Download
memory/4248-9013-0x0000000005A80000-0x0000000005A90000-memory.dmp

Filesize
64KB

Download
memory/4248-9015-0x0000000005A80000-0x0000000005A90000-memory.dmp

Filesize
64KB

Download
memory/4248-9014-0x0000000005A80000-0x0000000005A90000-memory.dmp

Filesize
64KB

Download
memory/4248-9016-0x0000000005A30000-0x0000000005A40000-memory.dmp

Filesize
64KB

Download
memory/4248-9024-0x0000000005A80000-0x0000000005A90000-memory.dmp

Filesize
64KB

Download
memory/4248-9023-0x0000000005A80000-0x0000000005A90000-memory.dmp

Filesize
64KB

Download
memory/4248-9022-0x0000000005A80000-0x0000000005A90000-memory.dmp

Filesize
64KB

Download
memory/4248-9025-0x0000000005A30000-0x0000000005A40000-memory.dmp

Filesize
64KB

Download
memory/4248-9021-0x0000000005A80000-0x0000000005A90000-memory.dmp

Filesize
64KB

Download
memory/4248-9020-0x0000000005A80000-0x0000000005A90000-memory.dmp

Filesize
64KB

Download
memory/4248-9026-0x0000000005A40000-0x0000000005A50000-memory.dmp

Filesize
64KB

Download
memory/4248-9028-0x0000000005A80000-0x0000000005A90000-memory.dmp

Filesize
64KB

Download
memory/4248-9029-0x0000000005A80000-0x0000000005A90000-memory.dmp

Filesize
64KB

Download
memory/4248-9027-0x0000000005A40000-0x0000000005A50000-memory.dmp

Filesize
64KB

Download
memory/4248-9019-0x0000000005A80000-0x0000000005A90000-memory.dmp

Filesize
64KB

Download
memory/4248-9018-0x0000000005A40000-0x0000000005A50000-memory.dmp

Filesize
64KB

Download
memory/4248-9017-0x0000000005A40000-0x0000000005A50000-memory.dmp

Filesize
64KB

Download
memory/4248-8897-0x000000000A520000-0x000000000A5C0000-memory.dmp

Filesize
640KB

Download
memory/4248-9030-0x0000000005A40000-0x0000000005A50000-memory.dmp

Filesize
64KB

Download
memory/4248-1824-0x0000000074F50000-0x0000000075700000-memory.dmp

Filesize
7.7MB

Download
memory/4248-9003-0x0000000005AA0000-0x0000000005AA8000-memory.dmp

Filesize
32KB

Download
memory/4248-9053-0x0000000020290000-0x0000000020416000-memory.dmp

Filesize
1.5MB

Download
memory/4248-9054-0x0000000004ED0000-0x0000000004EDA000-memory.dmp

Filesize
40KB

Download
memory/4248-1427-0x000000000D0A0000-0x000000000D0C2000-memory.dmp

Filesize
136KB

Download
memory/4248-9002-0x00000000061C0000-0x0000000006226000-memory.dmp

Filesize
408KB

Download
memory/4248-1412-0x000000000CAC0000-0x000000000CB72000-memory.dmp

Filesize
712KB

Download
memory/4248-9001-0x0000000006110000-0x000000000614E000-memory.dmp

Filesize
248KB

Download
memory/4248-8898-0x0000000011540000-0x0000000011A6C000-memory.dmp

Filesize
5.2MB

Download
memory/4248-1335-0x0000000074F50000-0x0000000075700000-memory.dmp

Filesize
7.7MB

Download
memory/4248-1339-0x0000000000370000-0x0000000000AFC000-memory.dmp

Filesize
7.5MB

Download
memory/4248-6185-0x0000000074F50000-0x0000000075700000-memory.dmp

Filesize
7.7MB

Download
memory/4248-1344-0x0000000074F50000-0x0000000075700000-memory.dmp

Filesize
7.7MB

Download
memory/4248-1343-0x00000000053A0000-0x00000000053C4000-memory.dmp

Filesize
144KB

Download
memory/4248-1342-0x0000000005350000-0x000000000539A000-memory.dmp

Filesize
296KB

Download
memory/4248-1346-0x0000000005B40000-0x0000000005C26000-memory.dmp

Filesize
920KB

Download
memory/4248-9012-0x0000000005A80000-0x0000000005A90000-memory.dmp

Filesize
64KB

Download
memory/4248-1354-0x0000000005EB0000-0x000000000600B000-memory.dmp

Filesize
1.4MB

Download
memory/4248-8896-0x0000000000BC0000-0x0000000000BF8000-memory.dmp

Filesize
224KB

Download
memory/5480-9263-0x00007FFD5E0A0000-0x00007FFD5E0AE000-memory.dmp

Filesize
56KB

Download
memory/5480-9258-0x00007FFD5C340000-0x00007FFD5C370000-memory.dmp

Filesize
192KB

Download
memory/5480-9257-0x00007FFD5C340000-0x00007FFD5C370000-memory.dmp

Filesize
192KB

Download
memory/5480-9256-0x00007FFD5C340000-0x00007FFD5C370000-memory.dmp

Filesize
192KB

Download
memory/5480-9255-0x00007FFD5C340000-0x00007FFD5C370000-memory.dmp

Filesize
192KB

Download
memory/5480-9254-0x00007FFD5C1D0000-0x00007FFD5C1E0000-memory.dmp

Filesize
64KB

Download
memory/5480-9253-0x00007FFD5C1D0000-0x00007FFD5C1E0000-memory.dmp

Filesize
64KB

Download
memory/5480-9252-0x00007FFD5C0C0000-0x00007FFD5C0D0000-memory.dmp

Filesize
64KB

Download
memory/5480-9251-0x00007FFD5C0C0000-0x00007FFD5C0D0000-memory.dmp

Filesize
64KB

Download
memory/5480-9247-0x00007FFD5D020000-0x00007FFD5D030000-memory.dmp

Filesize
64KB

Download
memory/5480-9246-0x00007FFD5D020000-0x00007FFD5D030000-memory.dmp

Filesize
64KB

Download
memory/5480-9245-0x00007FFD5D000000-0x00007FFD5D010000-memory.dmp

Filesize
64KB

Download
memory/5480-9244-0x00007FFD5D000000-0x00007FFD5D010000-memory.dmp

Filesize
64KB

Download
memory/5480-9243-0x00007FFD5CF70000-0x00007FFD5CF80000-memory.dmp

Filesize
64KB

Download
memory/5480-9242-0x00007FFD5CF70000-0x00007FFD5CF80000-memory.dmp

Filesize
64KB

Download
memory/5480-9240-0x00007FFD5E930000-0x00007FFD5E960000-memory.dmp

Filesize
192KB

Download
memory/5480-9239-0x00007FFD5E930000-0x00007FFD5E960000-memory.dmp

Filesize
192KB

Download
memory/5480-9238-0x00007FFD5E930000-0x00007FFD5E960000-memory.dmp

Filesize
192KB

Download
memory/5480-9237-0x00007FFD5E930000-0x00007FFD5E960000-memory.dmp

Filesize
192KB

Download
memory/5480-9236-0x00007FFD5E930000-0x00007FFD5E960000-memory.dmp

Filesize
192KB

Download
memory/5480-9235-0x00007FFD5E8E0000-0x00007FFD5E8F0000-memory.dmp

Filesize
64KB

Download
memory/5480-9234-0x00007FFD5E8E0000-0x00007FFD5E8F0000-memory.dmp

Filesize
64KB

Download
memory/5480-9233-0x00007FFD5E7D0000-0x00007FFD5E7E0000-memory.dmp

Filesize
64KB

Download
memory/5480-9232-0x00007FFD5E7D0000-0x00007FFD5E7E0000-memory.dmp

Filesize
64KB

Download
memory/5480-9260-0x00007FFD5DFF0000-0x00007FFD5E000000-memory.dmp

Filesize
64KB

Download
memory/5480-9261-0x00007FFD5DFF0000-0x00007FFD5E000000-memory.dmp

Filesize
64KB

Download
memory/5480-9262-0x00007FFD5E0A0000-0x00007FFD5E0AE000-memory.dmp

Filesize
56KB

Download
memory/5480-9264-0x00007FFD5E0A0000-0x00007FFD5E0AE000-memory.dmp

Filesize
56KB

Download
memory/5480-9265-0x00007FFD5E0A0000-0x00007FFD5E0AE000-memory.dmp

Filesize
56KB

Download
memory/5480-9259-0x00007FFD5C340000-0x00007FFD5C370000-memory.dmp

Filesize
192KB

Download
memory/5480-9248-0x00007FFD5D020000-0x00007FFD5D030000-memory.dmp

Filesize
64KB

Download
memory/5480-9249-0x00007FFD5D020000-0x00007FFD5D030000-memory.dmp

Filesize
64KB

Download
memory/5480-9250-0x00007FFD5D020000-0x00007FFD5D030000-memory.dmp

Filesize
64KB

Download
memory/5480-9241-0x00007FFD5E9C0000-0x00007FFD5E9C5000-memory.dmp

Filesize
20KB

Download