Analysis
-
max time kernel
1383s -
max time network
1145s -
platform
windows11-21h2_x64 -
resource
win11-20240709-en -
resource tags
arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system -
submitted
30-07-2024 04:29
Static task
static1
Behavioral task
behavioral1
Sample
WaveInstaller Official.exe
Resource
win11-20240709-en
General
-
Target
WaveInstaller Official.exe
-
Size
1.5MB
-
MD5
c822ab5332b11c9185765b157d0b6e17
-
SHA1
7fe909d73a24ddd87171896079cceb8b03663ad4
-
SHA256
344700d3141170111a9b77db100f6961cc54a2988d964d34f7e1ca57aa42aa2a
-
SHA512
a8612836fb4714b939d03f7fe08391bbc635ca83ab853fc677159e5db6b00f76b9b586bdae9c19d2406d9a2713d1caf614132cb6c14e1dddc6ac45e47f7e5a5d
-
SSDEEP
24576:9viinbT3ipyqwPx4x3RyFoBkkAd04wJAAh/jV1gJcPNZI6fntX3HOt2pbs81ind2:EinbT3ipTD0anywJAaD/3U2pb7indT
Malware Config
Signatures
-
Executes dropped EXE 13 IoCs
Processes:
WaveBootstrapper.exeWaveWindows.exenode.exeBloxstrap.exeWaveBootstrapper.exeWaveWindows.exenode.exeWaveBootstrapper.exeWaveWindows.exenode.exeWaveBootstrapper.exeWaveWindows.exenode.exepid process 2784 WaveBootstrapper.exe 2920 WaveWindows.exe 4164 node.exe 1176 Bloxstrap.exe 644 WaveBootstrapper.exe 5172 WaveWindows.exe 5316 node.exe 5728 WaveBootstrapper.exe 5888 WaveWindows.exe 5964 node.exe 6732 WaveBootstrapper.exe 7244 WaveWindows.exe 7340 node.exe -
Checks for any installed AV software in registry 1 TTPs 16 IoCs
Processes:
WaveWindows.exeWaveWindows.exeWaveWindows.exeWaveWindows.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000\Software\KasperskyLab WaveWindows.exe Key value queried \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000\Software\KasperskyLab\LastUsername WaveWindows.exe Key value queried \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000\Software\KasperskyLab\Session WaveWindows.exe Key value queried \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000\Software\KasperskyLab\LastUsername WaveWindows.exe Key value queried \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000\Software\KasperskyLab\Session WaveWindows.exe Key opened \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000\Software\KasperskyLab WaveWindows.exe Key opened \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000\Software\KasperskyLab WaveWindows.exe Key value queried \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000\Software\KasperskyLab\Session WaveWindows.exe Key value queried \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000\Software\KasperskyLab\Session WaveWindows.exe Key opened \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000\Software\KasperskyLab WaveWindows.exe Key queried \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000\Software\KasperskyLab WaveWindows.exe Set value (str) \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000\Software\KasperskyLab\LastUsername = "Chartiplier3" WaveWindows.exe Set value (str) \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000\Software\KasperskyLab\Session = "Bearer 12cdc5eb-1d00-4fa9-8541-2b1f35f7c21b" WaveWindows.exe Key opened \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000\Software\KasperskyLab WaveWindows.exe Key value queried \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000\Software\KasperskyLab\LastUsername WaveWindows.exe Key value queried \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000\Software\KasperskyLab\LastUsername WaveWindows.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
WaveWindows.exeWaveWindows.exeWaveWindows.exeWaveWindows.exedescription ioc process File opened (read-only) \??\O: WaveWindows.exe File opened (read-only) \??\U: WaveWindows.exe File opened (read-only) \??\X: WaveWindows.exe File opened (read-only) \??\E: WaveWindows.exe File opened (read-only) \??\V: WaveWindows.exe File opened (read-only) \??\U: WaveWindows.exe File opened (read-only) \??\J: WaveWindows.exe File opened (read-only) \??\T: WaveWindows.exe File opened (read-only) \??\W: WaveWindows.exe File opened (read-only) \??\B: WaveWindows.exe File opened (read-only) \??\X: WaveWindows.exe File opened (read-only) \??\I: WaveWindows.exe File opened (read-only) \??\G: WaveWindows.exe File opened (read-only) \??\Y: WaveWindows.exe File opened (read-only) \??\Y: WaveWindows.exe File opened (read-only) \??\E: WaveWindows.exe File opened (read-only) \??\M: WaveWindows.exe File opened (read-only) \??\P: WaveWindows.exe File opened (read-only) \??\S: WaveWindows.exe File opened (read-only) \??\Q: WaveWindows.exe File opened (read-only) \??\W: WaveWindows.exe File opened (read-only) \??\Z: WaveWindows.exe File opened (read-only) \??\M: WaveWindows.exe File opened (read-only) \??\Z: WaveWindows.exe File opened (read-only) \??\O: WaveWindows.exe File opened (read-only) \??\R: WaveWindows.exe File opened (read-only) \??\A: WaveWindows.exe File opened (read-only) \??\H: WaveWindows.exe File opened (read-only) \??\Y: WaveWindows.exe File opened (read-only) \??\Z: WaveWindows.exe File opened (read-only) \??\N: WaveWindows.exe File opened (read-only) \??\V: WaveWindows.exe File opened (read-only) \??\L: WaveWindows.exe File opened (read-only) \??\P: WaveWindows.exe File opened (read-only) \??\L: WaveWindows.exe File opened (read-only) \??\S: WaveWindows.exe File opened (read-only) \??\T: WaveWindows.exe File opened (read-only) \??\G: WaveWindows.exe File opened (read-only) \??\T: WaveWindows.exe File opened (read-only) \??\O: WaveWindows.exe File opened (read-only) \??\X: WaveWindows.exe File opened (read-only) \??\B: WaveWindows.exe File opened (read-only) \??\L: WaveWindows.exe File opened (read-only) \??\R: WaveWindows.exe File opened (read-only) \??\Q: WaveWindows.exe File opened (read-only) \??\U: WaveWindows.exe File opened (read-only) \??\P: WaveWindows.exe File opened (read-only) \??\S: WaveWindows.exe File opened (read-only) \??\X: WaveWindows.exe File opened (read-only) \??\E: WaveWindows.exe File opened (read-only) \??\R: WaveWindows.exe File opened (read-only) \??\W: WaveWindows.exe File opened (read-only) \??\Y: WaveWindows.exe File opened (read-only) \??\W: WaveWindows.exe File opened (read-only) \??\A: WaveWindows.exe File opened (read-only) \??\E: WaveWindows.exe File opened (read-only) \??\A: WaveWindows.exe File opened (read-only) \??\M: WaveWindows.exe File opened (read-only) \??\N: WaveWindows.exe File opened (read-only) \??\Q: WaveWindows.exe File opened (read-only) \??\S: WaveWindows.exe File opened (read-only) \??\V: WaveWindows.exe File opened (read-only) \??\N: WaveWindows.exe File opened (read-only) \??\P: WaveWindows.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
Processes:
flow ioc 56 raw.githubusercontent.com 65 raw.githubusercontent.com 66 raw.githubusercontent.com 67 raw.githubusercontent.com 68 raw.githubusercontent.com 48 raw.githubusercontent.com -
Drops file in Windows directory 4 IoCs
Processes:
UserOOBEBroker.exedescription ioc process File opened for modification C:\Windows\Panther\UnattendGC\setupact.log UserOOBEBroker.exe File opened for modification C:\Windows\Panther\UnattendGC\setuperr.log UserOOBEBroker.exe File opened for modification C:\Windows\Panther\UnattendGC\diagerr.xml UserOOBEBroker.exe File opened for modification C:\Windows\Panther\UnattendGC\diagwrn.xml UserOOBEBroker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 872 2920 WerFault.exe WaveWindows.exe 328 5172 WerFault.exe WaveWindows.exe 6344 5888 WerFault.exe WaveWindows.exe 6896 7244 WerFault.exe WaveWindows.exe -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
WaveWindows.exeWaveWindows.exeWaveBootstrapper.exeWaveInstaller Official.exeWaveBootstrapper.exeWaveBootstrapper.exeWaveBootstrapper.exeWaveWindows.exeWaveWindows.exeFileCoAuth.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WaveWindows.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WaveWindows.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WaveBootstrapper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WaveInstaller Official.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WaveBootstrapper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WaveBootstrapper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WaveBootstrapper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WaveWindows.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WaveWindows.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FileCoAuth.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exetaskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe -
Modifies registry class 23 IoCs
Processes:
Bloxstrap.exeWaveWindows.exeWaveWindows.exeWaveWindows.exetaskmgr.exeWaveWindows.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\roblox-player\ = "URL: Roblox Protocol" Bloxstrap.exe Set value (str) \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\roblox-player\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe" Bloxstrap.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3766757357-1293853516-507035944-1000\{CFD85297-9F77-4201-A4BF-4201F2724442} WaveWindows.exe Set value (str) \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\roblox\ = "URL: Roblox Protocol" Bloxstrap.exe Set value (str) \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\roblox\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe" Bloxstrap.exe Key created \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\roblox-player\shell\open\command Bloxstrap.exe Key created \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\roblox-player\shell\open Bloxstrap.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3766757357-1293853516-507035944-1000\{681F55BF-AFD0-49BD-A0F0-8B69FAD1596C} WaveWindows.exe Key created \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\roblox\DefaultIcon Bloxstrap.exe Set value (str) \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\roblox\URL Protocol Bloxstrap.exe Set value (str) \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\roblox-player\URL Protocol Bloxstrap.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3766757357-1293853516-507035944-1000\{636F7D0B-E5CC-43E3-8997-89CCCE10B51B} WaveWindows.exe Key created \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\Local Settings taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\roblox\shell\open\command Bloxstrap.exe Key created \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\roblox\shell\open Bloxstrap.exe Key created \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\roblox-player Bloxstrap.exe Set value (str) \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\roblox-player\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe\" %1" Bloxstrap.exe Key created \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\roblox-player\shell Bloxstrap.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3766757357-1293853516-507035944-1000\{379B89A7-F608-4296-A386-2BF81A44D3E8} WaveWindows.exe Key created \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\roblox Bloxstrap.exe Key created \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\roblox\shell Bloxstrap.exe Set value (str) \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\roblox\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe\" %1" Bloxstrap.exe Key created \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\roblox-player\DefaultIcon Bloxstrap.exe -
Suspicious behavior: EnumeratesProcesses 59 IoCs
Processes:
WaveWindows.exeBloxstrap.exeWaveWindows.exeWaveWindows.exetaskmgr.exeWaveWindows.exetaskmgr.exepid process 2920 WaveWindows.exe 2920 WaveWindows.exe 1176 Bloxstrap.exe 5172 WaveWindows.exe 5888 WaveWindows.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 7244 WaveWindows.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 4676 taskmgr.exe 4676 taskmgr.exe 4676 taskmgr.exe 4676 taskmgr.exe 4676 taskmgr.exe 4676 taskmgr.exe 4676 taskmgr.exe 4676 taskmgr.exe 4676 taskmgr.exe 4676 taskmgr.exe 4676 taskmgr.exe 4676 taskmgr.exe 4676 taskmgr.exe 4676 taskmgr.exe 4676 taskmgr.exe 4676 taskmgr.exe 4676 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WaveInstaller Official.exeWaveBootstrapper.exeWaveWindows.exeBloxstrap.exeAUDIODG.EXEWaveBootstrapper.exeWaveWindows.exeWaveBootstrapper.exeWaveWindows.exetaskmgr.exeWaveBootstrapper.exeWaveWindows.exedescription pid process Token: SeDebugPrivilege 3540 WaveInstaller Official.exe Token: SeDebugPrivilege 2784 WaveBootstrapper.exe Token: SeDebugPrivilege 2920 WaveWindows.exe Token: SeDebugPrivilege 1176 Bloxstrap.exe Token: SeShutdownPrivilege 2920 WaveWindows.exe Token: SeCreatePagefilePrivilege 2920 WaveWindows.exe Token: SeShutdownPrivilege 2920 WaveWindows.exe Token: SeCreatePagefilePrivilege 2920 WaveWindows.exe Token: 33 1556 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1556 AUDIODG.EXE Token: 33 2920 WaveWindows.exe Token: SeIncBasePriorityPrivilege 2920 WaveWindows.exe Token: SeShutdownPrivilege 2920 WaveWindows.exe Token: SeCreatePagefilePrivilege 2920 WaveWindows.exe Token: SeShutdownPrivilege 2920 WaveWindows.exe Token: SeCreatePagefilePrivilege 2920 WaveWindows.exe Token: SeDebugPrivilege 644 WaveBootstrapper.exe Token: SeDebugPrivilege 5172 WaveWindows.exe Token: SeShutdownPrivilege 5172 WaveWindows.exe Token: SeCreatePagefilePrivilege 5172 WaveWindows.exe Token: SeShutdownPrivilege 5172 WaveWindows.exe Token: SeCreatePagefilePrivilege 5172 WaveWindows.exe Token: 33 5172 WaveWindows.exe Token: SeIncBasePriorityPrivilege 5172 WaveWindows.exe Token: SeShutdownPrivilege 5172 WaveWindows.exe Token: SeCreatePagefilePrivilege 5172 WaveWindows.exe Token: SeShutdownPrivilege 5172 WaveWindows.exe Token: SeCreatePagefilePrivilege 5172 WaveWindows.exe Token: SeShutdownPrivilege 5172 WaveWindows.exe Token: SeCreatePagefilePrivilege 5172 WaveWindows.exe Token: SeShutdownPrivilege 5172 WaveWindows.exe Token: SeCreatePagefilePrivilege 5172 WaveWindows.exe Token: SeDebugPrivilege 5728 WaveBootstrapper.exe Token: SeDebugPrivilege 5888 WaveWindows.exe Token: SeShutdownPrivilege 5888 WaveWindows.exe Token: SeCreatePagefilePrivilege 5888 WaveWindows.exe Token: SeShutdownPrivilege 5888 WaveWindows.exe Token: SeCreatePagefilePrivilege 5888 WaveWindows.exe Token: 33 5888 WaveWindows.exe Token: SeIncBasePriorityPrivilege 5888 WaveWindows.exe Token: SeShutdownPrivilege 5888 WaveWindows.exe Token: SeCreatePagefilePrivilege 5888 WaveWindows.exe Token: SeShutdownPrivilege 5888 WaveWindows.exe Token: SeCreatePagefilePrivilege 5888 WaveWindows.exe Token: SeShutdownPrivilege 5888 WaveWindows.exe Token: SeCreatePagefilePrivilege 5888 WaveWindows.exe Token: SeShutdownPrivilege 5888 WaveWindows.exe Token: SeCreatePagefilePrivilege 5888 WaveWindows.exe Token: SeDebugPrivilege 6492 taskmgr.exe Token: SeSystemProfilePrivilege 6492 taskmgr.exe Token: SeCreateGlobalPrivilege 6492 taskmgr.exe Token: SeDebugPrivilege 6732 WaveBootstrapper.exe Token: SeDebugPrivilege 7244 WaveWindows.exe Token: SeShutdownPrivilege 7244 WaveWindows.exe Token: SeCreatePagefilePrivilege 7244 WaveWindows.exe Token: SeShutdownPrivilege 7244 WaveWindows.exe Token: SeCreatePagefilePrivilege 7244 WaveWindows.exe Token: 33 7244 WaveWindows.exe Token: SeIncBasePriorityPrivilege 7244 WaveWindows.exe Token: SeShutdownPrivilege 7244 WaveWindows.exe Token: SeCreatePagefilePrivilege 7244 WaveWindows.exe Token: SeShutdownPrivilege 7244 WaveWindows.exe Token: SeCreatePagefilePrivilege 7244 WaveWindows.exe Token: SeShutdownPrivilege 7244 WaveWindows.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
Bloxstrap.exetaskmgr.exetaskmgr.exepid process 1176 Bloxstrap.exe 1176 Bloxstrap.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 4676 taskmgr.exe 4676 taskmgr.exe 4676 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
Bloxstrap.exetaskmgr.exetaskmgr.exepid process 1176 Bloxstrap.exe 1176 Bloxstrap.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 6492 taskmgr.exe 4676 taskmgr.exe 4676 taskmgr.exe 4676 taskmgr.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
node.exenode.exenode.exepid process 5316 node.exe 5964 node.exe 7340 node.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
WaveInstaller Official.exeWaveBootstrapper.exeWaveWindows.exeWaveBootstrapper.exeWaveWindows.exeWaveBootstrapper.exeWaveWindows.exeWaveBootstrapper.exeWaveWindows.exedescription pid process target process PID 3540 wrote to memory of 2784 3540 WaveInstaller Official.exe WaveBootstrapper.exe PID 3540 wrote to memory of 2784 3540 WaveInstaller Official.exe WaveBootstrapper.exe PID 3540 wrote to memory of 2784 3540 WaveInstaller Official.exe WaveBootstrapper.exe PID 2784 wrote to memory of 2920 2784 WaveBootstrapper.exe WaveWindows.exe PID 2784 wrote to memory of 2920 2784 WaveBootstrapper.exe WaveWindows.exe PID 2784 wrote to memory of 2920 2784 WaveBootstrapper.exe WaveWindows.exe PID 2920 wrote to memory of 4164 2920 WaveWindows.exe node.exe PID 2920 wrote to memory of 4164 2920 WaveWindows.exe node.exe PID 2920 wrote to memory of 1176 2920 WaveWindows.exe Bloxstrap.exe PID 2920 wrote to memory of 1176 2920 WaveWindows.exe Bloxstrap.exe PID 644 wrote to memory of 5172 644 WaveBootstrapper.exe WaveWindows.exe PID 644 wrote to memory of 5172 644 WaveBootstrapper.exe WaveWindows.exe PID 644 wrote to memory of 5172 644 WaveBootstrapper.exe WaveWindows.exe PID 5172 wrote to memory of 5316 5172 WaveWindows.exe node.exe PID 5172 wrote to memory of 5316 5172 WaveWindows.exe node.exe PID 5728 wrote to memory of 5888 5728 WaveBootstrapper.exe WaveWindows.exe PID 5728 wrote to memory of 5888 5728 WaveBootstrapper.exe WaveWindows.exe PID 5728 wrote to memory of 5888 5728 WaveBootstrapper.exe WaveWindows.exe PID 5888 wrote to memory of 5964 5888 WaveWindows.exe node.exe PID 5888 wrote to memory of 5964 5888 WaveWindows.exe node.exe PID 6732 wrote to memory of 7244 6732 WaveBootstrapper.exe WaveWindows.exe PID 6732 wrote to memory of 7244 6732 WaveBootstrapper.exe WaveWindows.exe PID 6732 wrote to memory of 7244 6732 WaveBootstrapper.exe WaveWindows.exe PID 7244 wrote to memory of 7340 7244 WaveWindows.exe node.exe PID 7244 wrote to memory of 7340 7244 WaveWindows.exe node.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller Official.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller Official.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Wave\WaveBootstrapper.exe"C:\Users\Admin\AppData\Local\Wave\WaveBootstrapper.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Wave\WaveWindows.exe"C:\Users\Admin\AppData\Local\Wave\WaveWindows.exe"3⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Luau Language Server\node.exe"C:\Users\Admin\AppData\Local\Luau Language Server\node.exe" server --process-id=29204⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe"C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe"4⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 59004⤵
- Program crash
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x00000000000004E81⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2920 -ip 29201⤵
-
C:\Users\Admin\AppData\Local\Wave\WaveBootstrapper.exe"C:\Users\Admin\AppData\Local\Wave\WaveBootstrapper.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Wave\WaveWindows.exe"C:\Users\Admin\AppData\Local\Wave\WaveWindows.exe"2⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Luau Language Server\node.exe"C:\Users\Admin\AppData\Local\Luau Language Server\node.exe" server --process-id=51723⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5172 -s 57243⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5172 -ip 51721⤵
-
C:\Users\Admin\AppData\Local\Wave\WaveBootstrapper.exe"C:\Users\Admin\AppData\Local\Wave\WaveBootstrapper.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Wave\WaveWindows.exe"C:\Users\Admin\AppData\Local\Wave\WaveWindows.exe"2⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Luau Language Server\node.exe"C:\Users\Admin\AppData\Local\Luau Language Server\node.exe" server --process-id=58883⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5888 -s 56403⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5888 -ip 58881⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Wave\WaveBootstrapper.exe"C:\Users\Admin\AppData\Local\Wave\WaveBootstrapper.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Wave\WaveWindows.exe"C:\Users\Admin\AppData\Local\Wave\WaveWindows.exe"2⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Luau Language Server\node.exe"C:\Users\Admin\AppData\Local\Luau Language Server\node.exe" server --process-id=72443⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7244 -s 56963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 7244 -ip 72441⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.dllFilesize
4.3MB
MD56546ceb273f079342df5e828a60f551b
SHA1ede41c27df51c39cd731797c340fcb8feda51ea3
SHA256e440da74de73212d80da3f27661fcb9436d03d9e8dbbb44c9c148aaf38071ca5
SHA512f0ea83bf836e93ff7b58582329a05ba183a25c92705fab36f576ec0c20cf687ce16a68e483698bda4215d441dec5916ffbdfa1763fb357e14ab5e0f1ffcaf824
-
C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exeFilesize
249KB
MD5772c9fecbd0397f6cfb3d866cf3a5d7d
SHA16de3355d866d0627a756d0d4e29318e67650dacf
SHA2562f88ea7e1183d320fb2b7483de2e860da13dc0c0caaf58f41a888528d78c809f
SHA51282048bd6e50d38a863379a623b8cfda2d1553d8141923acf13f990c7245c833082523633eaa830362a12bfff300da61b3d8b3cccbe038ce2375fdfbd20dbca31
-
C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.runtimeconfig.jsonFilesize
372B
MD5d94cf983fba9ab1bb8a6cb3ad4a48f50
SHA104855d8b7a76b7ec74633043ef9986d4500ca63c
SHA2561eca0f0c70070aa83bb609e4b749b26dcb4409784326032726394722224a098a
SHA51209a9667d4f4622817116c8bc27d3d481d5d160380a2e19b8944bdd1271a83f718415ce5e6d66e82e36819e575ec1b55f19c45213e0013b877b8d61e6feb9d998
-
C:\Users\Admin\AppData\Local\Bloxstrap\Modifications\ClientSettings\ClientAppSettings.jsonFilesize
120B
MD5636492f4af87f25c20bd34a731007d86
SHA122a5c237a739ab0df4ff87c9e3d79dbe0c89b56a
SHA25622a1e85723295eeb854345be57f7d6fb56f02b232a95d69405bf9d9e67a0fa0d
SHA512cd2e3a738f535eb1a119bd4c319555899bcd4ce1049d7f8591a1a68c26844f33c1bd1e171706533b5c36263ade5e275b55d40f5710e0210e010925969182cd0c
-
C:\Users\Admin\AppData\Local\Bloxstrap\Settings.jsonFilesize
693B
MD59615e7328938f0ebad0cfe426a167fa9
SHA154ea72c2edfdc705cf95cc7925906a52544c2bcf
SHA256dbcf7b7d6466ce437b6919ae3a6dc1c39739c81defb9b633b7e42d61a59c5b64
SHA512d685a6da1693fdd0a589643806573514a21fee859bbcc52860373686d0c24df34af22b34f167a1e20fc60bb19ece7a1918ef4e279b0af07871f07be24df83d07
-
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-2e10d35f26294ab6\ExtraContent\textures\ui\LuaApp\graphic\shimmer_lightTheme.pngFilesize
20KB
MD54f8f43c5d5c2895640ed4fdca39737d5
SHA1fb46095bdfcab74d61e1171632c25f783ef495fa
SHA256fc57f32c26087eef61b37850d60934eda1100ca8773f08e487191a74766053d1
SHA5127aebc0f79b2b23a76fb41df8bab4411813ffb1abc5e2797810679c0eaa690e7af7561b8473405694bd967470be337417fa42e30f0318acbf171d8f31620a31aa
-
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-2e10d35f26294ab6\ExtraContent\textures\ui\LuaApp\graphic\[email protected]Filesize
71KB
MD53fec0191b36b9d9448a73ff1a937a1f7
SHA1bee7d28204245e3088689ac08da18b43eae531ba
SHA2561a03e6f6a0de045aa588544c392d671c040b82a5598b4246af04f5a74910dc89
SHA512a8ab2bc2d937963af36d3255c6ea09cae6ab1599996450004bb18e8b8bdfbdde728821ac1662d8a0466680679011d8f366577b143766838fe91edf08a40353ce
-
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-2e10d35f26294ab6\ExtraContent\textures\ui\LuaDiscussions\buttonFill.pngFilesize
247B
MD581ce54dfd6605840a1bd2f9b0b3f807d
SHA14a3a4c05b9c14c305a8bb06c768abc4958ba2f1c
SHA2560a6a5cafb4dee0d8c1d182ddec9f68ca0471d7fc820cf8dc2d68f27a35cd3386
SHA51257069c8ac03dd0fdfd97e2844c19138800ff6f7d508c26e5bc400b30fe78baa0991cc39f0f86fa10cd5d12b6b11b0b09c1a770e5cb2fdca157c2c8986a09e5ff
-
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-2e10d35f26294ab6\content\configs\DateTimeLocaleConfigs\zh-hans.jsonFilesize
2KB
MD5fb6605abd624d1923aef5f2122b5ae58
SHA16e98c0a31fa39c781df33628b55568e095be7d71
SHA2567b993133d329c46c0c437d985eead54432944d7b46db6ad6ea755505b8629d00
SHA51297a14eda2010033265b379aa5553359293baf4988a4cdde8a40b0315e318a7b30feee7f5e14c68131e85610c00585d0c67e636999e3af9b5b2209e1a27a82223
-
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-2e10d35f26294ab6\content\configs\DateTimeLocaleConfigs\zh-tw.jsonFilesize
2KB
MD5702c9879f2289959ceaa91d3045f28aa
SHA1775072f139acc8eafb219af355f60b2f57094276
SHA256a92a6988175f9c1d073e4b54bf6a31f9b5d3652eebdf6a351fb5e12bda76cbd5
SHA512815a6bef134c0db7a5926f0cf4b3f7702d71b0b2f13eca9539cd2fc5a61eea81b1884e4c4bc0b3398880589bff809ac8d5df833e7e4aeda4a1244e9a875d1e97
-
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-2e10d35f26294ab6\content\sounds\ouch.oggFilesize
6KB
MD59404c52d6f311da02d65d4320bfebb59
SHA10b5b5c2e7c631894953d5828fec06bdf6adba55f
SHA256c9775e361392877d1d521d0450a5368ee92d37dc542bc5e514373c9d5003f317
SHA51222aa1acbcdcf56f571170d9c32fd0d025c50936387203a7827dbb925f352d2bc082a8a79db61c2d1f1795ad979e93367c80205d9141b73d806ae08fa089837c4
-
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-2e10d35f26294ab6\content\textures\Cursors\KeyboardMouse\IBeamCursor.pngFilesize
292B
MD5464c4983fa06ad6cf235ec6793de5f83
SHA18afeb666c8aee7290ab587a2bfb29fc3551669e8
SHA25699fd7f104948c6ab002d1ec69ffd6c896c91f9accc499588df0980b4346ecbed
SHA512f805f5f38535fe487b899486c8de6cf630114964e2c3ebc2af7152a82c6f6faef681b4d936a1867b5dff6566b688b5c01105074443cc2086b3fe71f7e6e404b1
-
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-2e10d35f26294ab6\content\textures\StudioToolbox\Clear.pngFilesize
538B
MD5fa8eaf9266c707e151bb20281b3c0988
SHA13ca097ad4cd097745d33d386cc2d626ece8cb969
SHA2568cf08bf7e50fea7b38f59f162ed956346c55a714ed8a9a8b0a1ada7e18480bc2
SHA512e29274300eab297c6de895bb39170f73f0a4ffa2a8c3732caeeeac16e2c25fb58bb401fdd5823cc62d9c413ec6c43d7c46861d7e14d52f8d9d8ff632e29f167c
-
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-2e10d35f26294ab6\content\textures\StudioUIEditor\valueBoxRoundedRectangle.pngFilesize
130B
MD5521fb651c83453bf42d7432896040e5e
SHA18fdbf2cc2617b5b58aaa91b94b0bf755d951cad9
SHA256630303ec4701779eaf86cc9fbf744b625becda53badc7271cbb6ddc56e638d70
SHA5128fa0a50e52a3c7c53735c7dd7af275ebc9c1843f55bb30ebe0587a85955a8da94ff993822d233f7ed118b1070a7d67718b55ba4a597dc49ed2bf2a3836c696f6
-
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-2e10d35f26294ab6\content\textures\TerrainTools\checkbox_square.pngFilesize
985B
MD52cb16991a26dc803f43963bdc7571e3f
SHA112ad66a51b60eeaed199bc521800f7c763a3bc7b
SHA256c7bae6d856f3bd9f00c122522eb3534d0d198a9473b6a379a5c3458181870646
SHA5124c9467e5e2d83b778d0fb8b6fd97964f8d8126f07bfd50c5d68c256703f291ceaed56be057e8e2c591b2d2c49f6b7e099a2b7088d0bf5bdd901433459663b1f8
-
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-2e10d35f26294ab6\content\textures\ui\Controls\XboxController\Thumbstick1.pngFilesize
641B
MD52cbe38df9a03133ddf11a940c09b49cd
SHA16fb5c191ed8ce9495c66b90aaf53662bfe199846
SHA2560835a661199a7d8df7249e8ae925987184efcc4fb85d9efac3cc2c1495020517
SHA512dcef5baccef9fff632456fe7bc3c4f4a403363d9103a8047a55f4bd4c413d0c5f751a2e37385fe9eba7a420dbdb77ca2ff883d47fcdd35af222191cc5bd5c7a9
-
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-2e10d35f26294ab6\content\textures\ui\Controls\XboxController\[email protected]Filesize
1KB
MD5e8c88cf5c5ef7ae5ddee2d0e8376b32f
SHA177f2a5b11436d247d1acc3bac8edffc99c496839
SHA2569607af14604a8e8eb1dec45d3eeca01fed33140c0ccc3e6ef8ca4a1f6219b5dd
SHA51232f5a1e907705346a56fbddfe0d8841d05415ff7abe28ae9281ba46fedf8270b982be0090b72e2e32de0ce36e21934f80eaf508fd010f7ab132d39f5305fb68f
-
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-2e10d35f26294ab6\content\textures\ui\Controls\XboxController\[email protected]Filesize
1KB
MD5499333dae156bb4c9e9309a4842be4c8
SHA1d18c4c36bdb297208589dc93715560acaf761c3a
SHA256d35a74469f1436f114c27c730a5ec0793073bcf098db37f10158d562a3174591
SHA51291c64173d2cdabc045c70e0538d45e1022cc74ec04989565b85f0f26fe3e788b700a0956a07a8c91d34c06fc1b7fad43bbdbb41b0c6f15b9881c3e46def8103e
-
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-2e10d35f26294ab6\content\textures\ui\Controls\XboxController\Thumbstick2.pngFilesize
738B
MD5a402aacac8be906bcc07d50669d32061
SHA19d75c1afbe9fc482983978cae4c553aa32625640
SHA25662a313b6cc9ffe7dd86bc9c4fcd7b8e8d1f14a15cdf41a53fb69af4ae3416102
SHA512d11567bcaad8bbd9e2b9f497c3215102c7e7546caf425e93791502d3d2b3f78dec13609796fcd6e1e7f5c7d794bac074d00a74001e7fe943d63463b483877546
-
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-2e10d35f26294ab6\content\textures\ui\Controls\XboxController\[email protected]Filesize
1KB
MD583e9b7823c0a5c4c67a603a734233dec
SHA12eaf04ad636bf71afdf73b004d17d366ac6d333e
SHA2563b5e06eb1a89975def847101f700f0caa60fe0198f53e51974ef1608c6e1e067
SHA512e8abb39a1ec340ac5c7d63137f607cd09eae0e885e4f73b84d8adad1b8f574155b92fbf2c9d3013f64ebbb6d55ead5419e7546b0f70dcde976d49e7440743b0f
-
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-2e10d35f26294ab6\content\textures\ui\Controls\XboxController\[email protected]Filesize
1KB
MD555b64987636b9740ab1de7debd1f0b2f
SHA196f67222ce7d7748ec968e95a2f6495860f9d9c9
SHA256f4a6bb3347ee3e603ea0b2f009bfa802103bc434ae3ff1db1f2043fa8cace8fc
SHA51273a88a278747de3fefbaabb3ff90c1c0750c8d6c17746787f17061f4eff933620407336bf9b755f4222b0943b07d8c4d01de1815d42ea65e78e0daa7072591e9
-
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idxFilesize
64KB
MD59e466b4837d8431be725d6b9c1b4d9ef
SHA13f247b7c89985a41d839cad351cd0fc182fcb284
SHA2562f9a5eeb5ac8cec52a3e73621e4d392f501f5d657dfec3215ccd40eec317208d
SHA51201de0fda555d63b5c38339b0f6d38c28de2a882643439679e63cf5d75f13516b57dc90e8dfb8c638bda328fc12342e58d1e501acec8f85b92dbd5589dac06418
-
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lockFilesize
4B
MD5f49655f856acb8884cc0ace29216f511
SHA1cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA2567852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
SHA512599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
-
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.valFilesize
960B
MD516846df493521e84fe47cd6b6451ec8f
SHA16d99eb017c5aec08d3a7e908bbd4a051ce250c02
SHA25669f19f2ab2f3625faca623477864766ab1ef3a21712bc892d7b2b0886585b3f9
SHA512aefa5121601b8273cff6b79b7f76417c71e29e835b66faf3e1a67d0d38fb9ebe90320b75493fd5c4a2d9ea3e3c485d0a84bcdbfb78c26a8ecee3175cd8bd93cd
-
C:\Users\Admin\AppData\Local\Luau Language Server\server\index.jsFilesize
6.1MB
MD56b1cad741d0b6374435f7e1faa93b5e7
SHA17b1957e63c10f4422421245e4dc64074455fd62a
SHA2566f17add2a8c8c2d9f592adb65d88e08558e25c15cedd82e3f013c8146b5d840f
SHA512a662fc83536eff797b8d59e2fb4a2fb7cd903be8fc4137de8470b341312534326383bb3af58991628f15f93e3bdd57621622d9d9b634fb5e6e03d4aa06977253
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\WaveBootstrapper.exe.logFilesize
2KB
MD542e80ac3d4f421f5e920dacdd3ba048d
SHA1fef20b38c04b51c2e0e32c3cb5237f7b04a916ed
SHA2562ac4fcd93273523ded3ad821492c8ea58d54ff60d45b9c9431d77b0ae346e98a
SHA512b66d76fd6b072d047c068fb02cd36d0ccffd285143c199b59d86b1453b178fc2f11fdafa24eedd318e72ef079c8cb5576654c87d42f1a06b7a630c095635abaa
-
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdbFilesize
896KB
MD58a410ca32cfa68b6af87dd2a15895e22
SHA178218033b8278df0e23513baaffdfc346efaf5cb
SHA256078710f879b2d154a2ca8d9983b4ba9a90fc0be52a52c98658ad9c2c5fa5592c
SHA512de46b955a9e9ca25d045efae4f34367a5b5832d36e49291d0c5e237381af12045a479b0d53777ab135db15b7af09f24152d48210ba24e4ffe0bc815b9936972e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XMLFilesize
9KB
MD57050d5ae8acfbe560fa11073fef8185d
SHA15bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
-
C:\Users\Admin\AppData\Local\Sentry\565BEE8550E2E5F1B7BAFF132ECD72B7217F6160\.installationFilesize
36B
MD5413b536df2d6ba794bf4e87ebd2ab1cb
SHA1af943e64299b242ac2dcc457d72d8314f205a30d
SHA256596246468c6b5bd4cd576c0f6c2eebf876e3fe5f27ccb773577b6eaa2d567d71
SHA5125a03074bee6bbe1b391ef750436bde46d57c094ce305429855382c27fa3ab04a636a76d144f41a5d977a1fa0ae54378afbfcea8288171c0bb7ce9f25f0878561
-
C:\Users\Admin\AppData\Local\Wave\WaveBootstrapper.exeFilesize
949KB
MD58fb51b92d496c6765f7ba44e6d4a8990
SHA1d3e5a8465622cd5adae05babeb7e34b2b5c777d7
SHA256ab49d6166a285b747e5f279620ab9cea12f33f7656d732aa75900fcb981a5394
SHA51220de93a52fff7b092cb9d77bd26944abed5f5cb67146e6d2d70be6a431283b6de52eb37a0e13dc8bc57dcf8be2d5a95b9c11b3b030a3e2f03dd6e4efc23527a6
-
C:\Users\Admin\AppData\Local\Wave\WaveWindows.exeFilesize
8.0MB
MD5b8631bbd78d3935042e47b672c19ccc3
SHA1cd0ea137f1544a31d2a62aaed157486dce3ecebe
SHA2569cfda541d595dc20a55df5422001dfb58debd401df3abff21b1eee8ede28451c
SHA5120c51d6247e39f7851538a5916b24972e845abfe429f0abdc7b532f654b4afe73dc6e1936f1b062da63bfc90273d3cbc297bf6c802e615f3711d0f180c070aa26
-
C:\Users\Admin\AppData\Local\Wave\bin\Background.mp4Filesize
4.6MB
MD59782180eb68f73030fe24ef6a1735932
SHA1589827fe098ba048c9f871a28db8eae3e3537ff4
SHA2563a1cbb800f8f25c2ab703ba8bfdb01e938e4143c3bc0fea8ca734fb5ba779ba7
SHA512dc768638bae2d6d47d8910252ae64a656d8a6fd88efdf24165ddce51b7afdb4acb3fddd41dfe788737a2cab4fab66174db2f0d2f48bc8669af76d1656bca8be1
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wave.lnkFilesize
1KB
MD55d913854068d2373b5ae7da8ab2ec8a6
SHA17ea27c0b7061d1204ee5e65918245bb2b5c13f9e
SHA256e326eb627daf217a23a3020fb35c6bbe4953b20ece4de5e8c63ee761c4676faa
SHA512244225c3701a83ddbb7be43683e0f32b719fdbd00a04356be04b2fe8ca023ebf9e80153e36afcb682a32d7964c06ac30e1669ecbe9e36704e5b78da84d723e39
-
memory/2784-238-0x0000000074E20000-0x00000000755D1000-memory.dmpFilesize
7.7MB
-
memory/2784-237-0x0000000074E20000-0x00000000755D1000-memory.dmpFilesize
7.7MB
-
memory/2784-236-0x0000000000C70000-0x0000000000D62000-memory.dmpFilesize
968KB
-
memory/2784-249-0x0000000074E20000-0x00000000755D1000-memory.dmpFilesize
7.7MB
-
memory/2784-245-0x0000000009C20000-0x0000000009C3E000-memory.dmpFilesize
120KB
-
memory/2784-244-0x0000000009BC0000-0x0000000009BC8000-memory.dmpFilesize
32KB
-
memory/2784-243-0x0000000009B80000-0x0000000009B8A000-memory.dmpFilesize
40KB
-
memory/2784-242-0x0000000009B40000-0x0000000009B56000-memory.dmpFilesize
88KB
-
memory/2784-241-0x0000000008D20000-0x0000000008E24000-memory.dmpFilesize
1.0MB
-
memory/2920-7326-0x000000000A680000-0x000000000A690000-memory.dmpFilesize
64KB
-
memory/2920-7322-0x000000000A8A0000-0x000000000A8B0000-memory.dmpFilesize
64KB
-
memory/2920-263-0x0000000008FF0000-0x0000000009012000-memory.dmpFilesize
136KB
-
memory/2920-258-0x0000000009890000-0x0000000009942000-memory.dmpFilesize
712KB
-
memory/2920-253-0x00000000057E0000-0x00000000057E8000-memory.dmpFilesize
32KB
-
memory/2920-252-0x00000000058B0000-0x0000000005950000-memory.dmpFilesize
640KB
-
memory/2920-251-0x0000000005800000-0x00000000058B2000-memory.dmpFilesize
712KB
-
memory/2920-250-0x0000000000580000-0x0000000000D82000-memory.dmpFilesize
8.0MB
-
memory/2920-264-0x000000000B1C0000-0x000000000B517000-memory.dmpFilesize
3.3MB
-
memory/2920-7355-0x0000000022220000-0x0000000022296000-memory.dmpFilesize
472KB
-
memory/2920-7353-0x0000000016E80000-0x0000000016EB2000-memory.dmpFilesize
200KB
-
memory/2920-7352-0x000000001D1D0000-0x000000001D246000-memory.dmpFilesize
472KB
-
memory/2920-7351-0x0000000012D20000-0x0000000012E7B000-memory.dmpFilesize
1.4MB
-
memory/2920-7338-0x0000000015500000-0x00000000155E6000-memory.dmpFilesize
920KB
-
memory/2920-7300-0x0000000001360000-0x0000000001398000-memory.dmpFilesize
224KB
-
memory/2920-7301-0x000000000D980000-0x000000000DEAC000-memory.dmpFilesize
5.2MB
-
memory/2920-7302-0x0000000006680000-0x00000000066BE000-memory.dmpFilesize
248KB
-
memory/2920-7303-0x0000000006730000-0x0000000006796000-memory.dmpFilesize
408KB
-
memory/2920-7304-0x0000000006700000-0x0000000006708000-memory.dmpFilesize
32KB
-
memory/2920-7337-0x000000000A8A0000-0x000000000A8B0000-memory.dmpFilesize
64KB
-
memory/2920-7323-0x000000000A680000-0x000000000A690000-memory.dmpFilesize
64KB
-
memory/2920-7319-0x000000000A680000-0x000000000A690000-memory.dmpFilesize
64KB
-
memory/2920-7317-0x000000000A680000-0x000000000A690000-memory.dmpFilesize
64KB
-
memory/2920-7318-0x000000000A680000-0x000000000A690000-memory.dmpFilesize
64KB
-
memory/2920-7316-0x000000000A680000-0x000000000A690000-memory.dmpFilesize
64KB
-
memory/2920-7320-0x000000000A820000-0x000000000A830000-memory.dmpFilesize
64KB
-
memory/2920-7321-0x000000000A8A0000-0x000000000A8B0000-memory.dmpFilesize
64KB
-
memory/2920-7324-0x000000000A680000-0x000000000A690000-memory.dmpFilesize
64KB
-
memory/2920-7328-0x000000000A680000-0x000000000A690000-memory.dmpFilesize
64KB
-
memory/2920-7327-0x000000000A680000-0x000000000A690000-memory.dmpFilesize
64KB
-
memory/2920-7336-0x0000000008ED0000-0x0000000008F1A000-memory.dmpFilesize
296KB
-
memory/2920-7333-0x000000000A680000-0x000000000A690000-memory.dmpFilesize
64KB
-
memory/2920-7332-0x000000000A680000-0x000000000A690000-memory.dmpFilesize
64KB
-
memory/2920-7331-0x000000000A8A0000-0x000000000A8B0000-memory.dmpFilesize
64KB
-
memory/2920-7330-0x000000000A8A0000-0x000000000A8B0000-memory.dmpFilesize
64KB
-
memory/2920-7334-0x0000000008E30000-0x0000000008E54000-memory.dmpFilesize
144KB
-
memory/2920-7329-0x000000000A820000-0x000000000A830000-memory.dmpFilesize
64KB
-
memory/2920-7335-0x000000000A8A0000-0x000000000A8B0000-memory.dmpFilesize
64KB
-
memory/2920-7325-0x000000000A680000-0x000000000A690000-memory.dmpFilesize
64KB
-
memory/3540-21-0x000000000B1C0000-0x000000000B1CA000-memory.dmpFilesize
40KB
-
memory/3540-16-0x000000000B110000-0x000000000B136000-memory.dmpFilesize
152KB
-
memory/3540-8-0x0000000074E20000-0x00000000755D1000-memory.dmpFilesize
7.7MB
-
memory/3540-15-0x0000000001750000-0x00000000017E6000-memory.dmpFilesize
600KB
-
memory/3540-0-0x0000000074E2E000-0x0000000074E2F000-memory.dmpFilesize
4KB
-
memory/3540-7-0x0000000074E20000-0x00000000755D1000-memory.dmpFilesize
7.7MB
-
memory/3540-5-0x0000000006210000-0x000000000621E000-memory.dmpFilesize
56KB
-
memory/3540-19-0x000000000B150000-0x000000000B1C2000-memory.dmpFilesize
456KB
-
memory/3540-17-0x0000000001920000-0x0000000001928000-memory.dmpFilesize
32KB
-
memory/3540-20-0x000000000A0D0000-0x000000000A0DA000-memory.dmpFilesize
40KB
-
memory/3540-6-0x0000000074E2E000-0x0000000074E2F000-memory.dmpFilesize
4KB
-
memory/3540-1-0x0000000000D90000-0x0000000000F22000-memory.dmpFilesize
1.6MB
-
memory/3540-240-0x0000000074E20000-0x00000000755D1000-memory.dmpFilesize
7.7MB
-
memory/3540-2-0x0000000074E20000-0x00000000755D1000-memory.dmpFilesize
7.7MB
-
memory/3540-3-0x0000000074E20000-0x00000000755D1000-memory.dmpFilesize
7.7MB
-
memory/3540-4-0x0000000006490000-0x00000000064C8000-memory.dmpFilesize
224KB
-
memory/5172-7367-0x000000000AF80000-0x000000000AF90000-memory.dmpFilesize
64KB
-
memory/5172-7372-0x000000000AF80000-0x000000000AF90000-memory.dmpFilesize
64KB
-
memory/5172-7378-0x000000000AF80000-0x000000000AF90000-memory.dmpFilesize
64KB
-
memory/5172-7377-0x000000000AF80000-0x000000000AF90000-memory.dmpFilesize
64KB
-
memory/5172-7379-0x000000000B060000-0x000000000B070000-memory.dmpFilesize
64KB
-
memory/5172-7380-0x000000000B060000-0x000000000B070000-memory.dmpFilesize
64KB
-
memory/5172-7376-0x000000000B060000-0x000000000B070000-memory.dmpFilesize
64KB
-
memory/5172-7375-0x000000000B060000-0x000000000B070000-memory.dmpFilesize
64KB
-
memory/5172-7371-0x000000000B060000-0x000000000B070000-memory.dmpFilesize
64KB
-
memory/5172-7370-0x000000000B060000-0x000000000B070000-memory.dmpFilesize
64KB
-
memory/5172-7365-0x000000000AF80000-0x000000000AF90000-memory.dmpFilesize
64KB
-
memory/5172-7364-0x000000000AF80000-0x000000000AF90000-memory.dmpFilesize
64KB
-
memory/5172-7362-0x000000000AF80000-0x000000000AF90000-memory.dmpFilesize
64KB
-
memory/5172-7361-0x000000000AF80000-0x000000000AF90000-memory.dmpFilesize
64KB
-
memory/5172-7368-0x000000000AF80000-0x000000000AF90000-memory.dmpFilesize
64KB
-
memory/5172-7382-0x0000000018FE0000-0x0000000019337000-memory.dmpFilesize
3.3MB
-
memory/5172-7383-0x0000000019860000-0x00000000199E8000-memory.dmpFilesize
1.5MB
-
memory/5172-7374-0x000000000B010000-0x000000000B020000-memory.dmpFilesize
64KB
-
memory/5172-7363-0x000000000AF80000-0x000000000AF90000-memory.dmpFilesize
64KB
-
memory/5172-7366-0x000000000AF80000-0x000000000AF90000-memory.dmpFilesize
64KB
-
memory/5172-7369-0x000000000B010000-0x000000000B020000-memory.dmpFilesize
64KB
-
memory/5172-7373-0x000000000AF80000-0x000000000AF90000-memory.dmpFilesize
64KB
-
memory/5888-7391-0x000000000BD80000-0x000000000BD90000-memory.dmpFilesize
64KB
-
memory/5888-7403-0x000000000BB40000-0x000000000BB50000-memory.dmpFilesize
64KB
-
memory/5888-7390-0x000000000BD80000-0x000000000BD90000-memory.dmpFilesize
64KB
-
memory/5888-7389-0x000000000BD80000-0x000000000BD90000-memory.dmpFilesize
64KB
-
memory/5888-7397-0x000000000BA70000-0x000000000BA80000-memory.dmpFilesize
64KB
-
memory/5888-7398-0x000000000BB40000-0x000000000BB50000-memory.dmpFilesize
64KB
-
memory/5888-7399-0x000000000BB40000-0x000000000BB50000-memory.dmpFilesize
64KB
-
memory/5888-7401-0x000000000BD80000-0x000000000BD90000-memory.dmpFilesize
64KB
-
memory/5888-7400-0x000000000BD80000-0x000000000BD90000-memory.dmpFilesize
64KB
-
memory/5888-7402-0x000000000BA70000-0x000000000BA80000-memory.dmpFilesize
64KB
-
memory/5888-7406-0x000000000BD80000-0x000000000BD90000-memory.dmpFilesize
64KB
-
memory/5888-7405-0x000000000BD80000-0x000000000BD90000-memory.dmpFilesize
64KB
-
memory/5888-7404-0x000000000BB40000-0x000000000BB50000-memory.dmpFilesize
64KB
-
memory/5888-7392-0x000000000BD80000-0x000000000BD90000-memory.dmpFilesize
64KB
-
memory/5888-7407-0x000000000BB40000-0x000000000BB50000-memory.dmpFilesize
64KB
-
memory/5888-7408-0x000000000BB40000-0x000000000BB50000-memory.dmpFilesize
64KB
-
memory/5888-7409-0x0000000013920000-0x0000000013C77000-memory.dmpFilesize
3.3MB
-
memory/5888-7396-0x000000000BD80000-0x000000000BD90000-memory.dmpFilesize
64KB
-
memory/5888-7395-0x000000000BD80000-0x000000000BD90000-memory.dmpFilesize
64KB
-
memory/5888-7394-0x000000000BD80000-0x000000000BD90000-memory.dmpFilesize
64KB
-
memory/5888-7393-0x000000000BD80000-0x000000000BD90000-memory.dmpFilesize
64KB
-
memory/6492-7416-0x0000014A160D0000-0x0000014A160D1000-memory.dmpFilesize
4KB
-
memory/6492-7411-0x0000014A160D0000-0x0000014A160D1000-memory.dmpFilesize
4KB
-
memory/6492-7410-0x0000014A160D0000-0x0000014A160D1000-memory.dmpFilesize
4KB
-
memory/6492-7412-0x0000014A160D0000-0x0000014A160D1000-memory.dmpFilesize
4KB