Overview

overview

7

Static

static

3

$RTCAS64.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    316s
  • max time network
    317s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    08/08/2024, 17:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    $RTCAS64.exe

  • Size

    2.3MB

  • MD5

    8ad8b6593c91d7960dad476d6d4af34f

  • SHA1

    0a95f110c8264cde7768a3fd76db5687fda830ea

  • SHA256

    43e6ae7e38488e95741b1cad60843e7ce49419889285433eb4e697c175a153ab

  • SHA512

    09b522da0958f8b173e97b31b6c7141cb67de5d30db9ff71bc6e61ca9a97c09bff6b17d6eaa03c840500996aad25b3419391af64de1c59e98ff6a8eac636b686

  • SSDEEP

    49152:6inbT3qpTDQSmanAmwJAaDMg33U2pLYiniT:6inKpTJmWAmmAMPWin

Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 59 IoCs
  • Checks for any installed AV software in registry 1 TTPs 29 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
  • Network Service Discovery 1 TTPs 6 IoCs

    Attempt to gather information on host's network.

    discovery
  • Drops file in Windows directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 52 IoCs
  • Suspicious behavior: AddClipboardFormatListener 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$RTCAS64.exe
    "C:\Users\Admin\AppData\Local\Temp\$RTCAS64.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4464
    • C:\Users\Admin\AppData\Local\Wave\WaveBootstrapper.exe
      "C:\Users\Admin\AppData\Local\Wave\WaveBootstrapper.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1708
      • C:\Users\Admin\AppData\Local\Wave\WaveWindows.exe
        "C:\Users\Admin\AppData\Local\Wave\WaveWindows.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks for any installed AV software in registry
        • Enumerates connected drives
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:568
        • C:\Users\Admin\AppData\Local\Luau Language Server\node.exe
          "C:\Users\Admin\AppData\Local\Luau Language Server\node.exe" server --process-id=568
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4220
          • C:\Users\Admin\AppData\Local\Luau Language Server\shared\bin\wave-luau.exe
            "C:\Users\Admin\AppData\Local\Luau Language Server\shared\bin\wave-luau.exe" lsp "--definitions=C:\Users\Admin\AppData\Local\Luau Language Server\shared\bin\globalTypes.d.luau" "--definitions=C:\Users\Admin\AppData\Local\Luau Language Server\shared\bin\wave.d.luau" "--docs=C:\Users\Admin\AppData\Local\Luau Language Server\shared\bin\en-us.json"
            5⤵
            • Executes dropped EXE
            PID:3960
        • C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe
          "C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe"
          4⤵
          • Executes dropped EXE
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:3724
        • C:\Users\Admin\AppData\Local\Wave\CefSharp.BrowserSubprocess.exe
          "C:\Users\Admin\AppData\Local\Wave\CefSharp.BrowserSubprocess.exe" --type=gpu-process --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=6660,i,17100593397424169618,1260442284804098598,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --enable-logging=handle --log-file=6664 --mojo-platform-channel-handle=6092 /prefetch:2 --host-process-id=568
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Network Service Discovery
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3448
        • C:\Users\Admin\AppData\Local\Wave\CefSharp.BrowserSubprocess.exe
          "C:\Users\Admin\AppData\Local\Wave\CefSharp.BrowserSubprocess.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --field-trial-handle=7088,i,17100593397424169618,1260442284804098598,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --enable-logging=handle --log-file=7092 --mojo-platform-channel-handle=7084 /prefetch:8 --host-process-id=568
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Network Service Discovery
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3120
        • C:\Users\Admin\AppData\Local\Wave\CefSharp.BrowserSubprocess.exe
          "C:\Users\Admin\AppData\Local\Wave\CefSharp.BrowserSubprocess.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --field-trial-handle=7240,i,17100593397424169618,1260442284804098598,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --enable-logging=handle --log-file=7244 --mojo-platform-channel-handle=7236 /prefetch:3 --host-process-id=568
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Network Service Discovery
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5040
        • C:\Users\Admin\AppData\Local\Wave\CefSharp.BrowserSubprocess.exe
          "C:\Users\Admin\AppData\Local\Wave\CefSharp.BrowserSubprocess.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --no-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=7516,i,17100593397424169618,1260442284804098598,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --enable-logging=handle --log-file=7520 --mojo-platform-channel-handle=7512 --host-process-id=568 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Network Service Discovery
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:444
        • C:\Users\Admin\AppData\Local\Wave\CefSharp.BrowserSubprocess.exe
          "C:\Users\Admin\AppData\Local\Wave\CefSharp.BrowserSubprocess.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --no-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=7532,i,17100593397424169618,1260442284804098598,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --enable-logging=handle --log-file=7540 --mojo-platform-channel-handle=7524 --host-process-id=568 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Network Service Discovery
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:760
        • C:\Users\Admin\AppData\Local\Wave\CefSharp.BrowserSubprocess.exe
          "C:\Users\Admin\AppData\Local\Wave\CefSharp.BrowserSubprocess.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --field-trial-handle=8080,i,17100593397424169618,1260442284804098598,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --enable-logging=handle --log-file=7772 --mojo-platform-channel-handle=5412 /prefetch:8 --host-process-id=568
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Network Service Discovery
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:6384
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
    1⤵
      PID:2224
    • C:\Windows\System32\oobe\UserOOBEBroker.exe
      C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
      1⤵
      • Drops file in Windows directory
      PID:2856
    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
      C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
      1⤵
      • System Location Discovery: System Language Discovery
      PID:904
    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3056
    • C:\Windows\system32\control.exe
      "C:\Windows\system32\control.exe" /name Microsoft.AdministrativeTools
      1⤵
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:1224
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
      1⤵
      • System Location Discovery: System Language Discovery
      PID:4696
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2328
      • C:\Windows\system32\msinfo32.exe
        "C:\Windows\system32\msinfo32.exe"
        2⤵
        • Checks SCSI registry key(s)
        • Enumerates system info in registry
        • Suspicious behavior: GetForegroundWindowSpam
        PID:1204
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\TestPush.docx" /o ""
      1⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:4576
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x0000000000000484 0x000000000000048C
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3360

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.dll
      Filesize

      4.3MB

      MD5

      6546ceb273f079342df5e828a60f551b

      SHA1

      ede41c27df51c39cd731797c340fcb8feda51ea3

      SHA256

      e440da74de73212d80da3f27661fcb9436d03d9e8dbbb44c9c148aaf38071ca5

      SHA512

      f0ea83bf836e93ff7b58582329a05ba183a25c92705fab36f576ec0c20cf687ce16a68e483698bda4215d441dec5916ffbdfa1763fb357e14ab5e0f1ffcaf824

      Download Submit

    • C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe
      Filesize

      249KB

      MD5

      772c9fecbd0397f6cfb3d866cf3a5d7d

      SHA1

      6de3355d866d0627a756d0d4e29318e67650dacf

      SHA256

      2f88ea7e1183d320fb2b7483de2e860da13dc0c0caaf58f41a888528d78c809f

      SHA512

      82048bd6e50d38a863379a623b8cfda2d1553d8141923acf13f990c7245c833082523633eaa830362a12bfff300da61b3d8b3cccbe038ce2375fdfbd20dbca31

      Download Submit

    • C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.runtimeconfig.json
      Filesize

      372B

      MD5

      d94cf983fba9ab1bb8a6cb3ad4a48f50

      SHA1

      04855d8b7a76b7ec74633043ef9986d4500ca63c

      SHA256

      1eca0f0c70070aa83bb609e4b749b26dcb4409784326032726394722224a098a

      SHA512

      09a9667d4f4622817116c8bc27d3d481d5d160380a2e19b8944bdd1271a83f718415ce5e6d66e82e36819e575ec1b55f19c45213e0013b877b8d61e6feb9d998

      Download Submit

    • C:\Users\Admin\AppData\Local\Bloxstrap\Modifications\ClientSettings\ClientAppSettings.json
      Filesize

      120B

      MD5

      636492f4af87f25c20bd34a731007d86

      SHA1

      22a5c237a739ab0df4ff87c9e3d79dbe0c89b56a

      SHA256

      22a1e85723295eeb854345be57f7d6fb56f02b232a95d69405bf9d9e67a0fa0d

      SHA512

      cd2e3a738f535eb1a119bd4c319555899bcd4ce1049d7f8591a1a68c26844f33c1bd1e171706533b5c36263ade5e275b55d40f5710e0210e010925969182cd0c

      Download Submit

    • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-6fdcfe060c6440cd\ExtraContent\textures\ui\LuaApp\graphic\shimmer_lightTheme.png
      Filesize

      20KB

      MD5

      4f8f43c5d5c2895640ed4fdca39737d5

      SHA1

      fb46095bdfcab74d61e1171632c25f783ef495fa

      SHA256

      fc57f32c26087eef61b37850d60934eda1100ca8773f08e487191a74766053d1

      SHA512

      7aebc0f79b2b23a76fb41df8bab4411813ffb1abc5e2797810679c0eaa690e7af7561b8473405694bd967470be337417fa42e30f0318acbf171d8f31620a31aa

      Download Submit

    • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-6fdcfe060c6440cd\ExtraContent\textures\ui\LuaApp\graphic\[email protected]
      Filesize

      71KB

      MD5

      3fec0191b36b9d9448a73ff1a937a1f7

      SHA1

      bee7d28204245e3088689ac08da18b43eae531ba

      SHA256

      1a03e6f6a0de045aa588544c392d671c040b82a5598b4246af04f5a74910dc89

      SHA512

      a8ab2bc2d937963af36d3255c6ea09cae6ab1599996450004bb18e8b8bdfbdde728821ac1662d8a0466680679011d8f366577b143766838fe91edf08a40353ce

      Download Submit

    • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-6fdcfe060c6440cd\ExtraContent\textures\ui\LuaDiscussions\buttonFill.png
      Filesize

      247B

      MD5

      81ce54dfd6605840a1bd2f9b0b3f807d

      SHA1

      4a3a4c05b9c14c305a8bb06c768abc4958ba2f1c

      SHA256

      0a6a5cafb4dee0d8c1d182ddec9f68ca0471d7fc820cf8dc2d68f27a35cd3386

      SHA512

      57069c8ac03dd0fdfd97e2844c19138800ff6f7d508c26e5bc400b30fe78baa0991cc39f0f86fa10cd5d12b6b11b0b09c1a770e5cb2fdca157c2c8986a09e5ff

      Download Submit

    • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-6fdcfe060c6440cd\content\configs\DateTimeLocaleConfigs\zh-hans.json
      Filesize

      2KB

      MD5

      fb6605abd624d1923aef5f2122b5ae58

      SHA1

      6e98c0a31fa39c781df33628b55568e095be7d71

      SHA256

      7b993133d329c46c0c437d985eead54432944d7b46db6ad6ea755505b8629d00

      SHA512

      97a14eda2010033265b379aa5553359293baf4988a4cdde8a40b0315e318a7b30feee7f5e14c68131e85610c00585d0c67e636999e3af9b5b2209e1a27a82223

      Download Submit

    • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-6fdcfe060c6440cd\content\configs\DateTimeLocaleConfigs\zh-tw.json
      Filesize

      2KB

      MD5

      702c9879f2289959ceaa91d3045f28aa

      SHA1

      775072f139acc8eafb219af355f60b2f57094276

      SHA256

      a92a6988175f9c1d073e4b54bf6a31f9b5d3652eebdf6a351fb5e12bda76cbd5

      SHA512

      815a6bef134c0db7a5926f0cf4b3f7702d71b0b2f13eca9539cd2fc5a61eea81b1884e4c4bc0b3398880589bff809ac8d5df833e7e4aeda4a1244e9a875d1e97

      Download Submit

    • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-6fdcfe060c6440cd\content\sounds\ouch.ogg
      Filesize

      6KB

      MD5

      9404c52d6f311da02d65d4320bfebb59

      SHA1

      0b5b5c2e7c631894953d5828fec06bdf6adba55f

      SHA256

      c9775e361392877d1d521d0450a5368ee92d37dc542bc5e514373c9d5003f317

      SHA512

      22aa1acbcdcf56f571170d9c32fd0d025c50936387203a7827dbb925f352d2bc082a8a79db61c2d1f1795ad979e93367c80205d9141b73d806ae08fa089837c4

      Download Submit

    • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-6fdcfe060c6440cd\content\textures\Cursors\KeyboardMouse\IBeamCursor.png
      Filesize

      292B

      MD5

      464c4983fa06ad6cf235ec6793de5f83

      SHA1

      8afeb666c8aee7290ab587a2bfb29fc3551669e8

      SHA256

      99fd7f104948c6ab002d1ec69ffd6c896c91f9accc499588df0980b4346ecbed

      SHA512

      f805f5f38535fe487b899486c8de6cf630114964e2c3ebc2af7152a82c6f6faef681b4d936a1867b5dff6566b688b5c01105074443cc2086b3fe71f7e6e404b1

      Download Submit

    • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-6fdcfe060c6440cd\content\textures\DeveloperFramework\PageNavigation\button_control_next.png
      Filesize

      1KB

      MD5

      34a4a4801e02097cef3e46e6b9c67c41

      SHA1

      2f271ae04352f39bb72c677a16da03f19a51f672

      SHA256

      7ca0bdacdebc16eace9d67078a5ecbc8d9f6098fad80e0d8c09fb5f708ad389b

      SHA512

      87a29f06c2539a6df2f043fbee747812f0672a9a6a97df906d8a38b9ede7a7e7ad2a61850888e39ad6b45f422680f4c89cc40c3724b1b4a0312dde8c35ed2a75

      Download Submit

    • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-6fdcfe060c6440cd\content\textures\DeveloperFramework\PageNavigation\button_control_previous.png
      Filesize

      1KB

      MD5

      6e8a105456aaf54799b1ae4c90000ff1

      SHA1

      5a9a277b6ef822caaede13b34c222fb69451c141

      SHA256

      fac4a9e1c49c9f3fc07dbce40f4648987cf90f4c2ed0a96827630341621e9845

      SHA512

      8e74329066b3c0c4b8303976cc4207b94ebc7ee38b74dedd490c2006feb53a99a0671e407ec649ec9da6a4d3ddff46bb7150963dfa8254364ab619db9ec3fd54

      Download Submit

    • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-6fdcfe060c6440cd\content\textures\StudioToolbox\AssetConfig\[email protected]
      Filesize

      922B

      MD5

      97788161324392fe1af78ff82b9c953b

      SHA1

      e9992beba9b73f7a03e7426dbf12fdd219633c4e

      SHA256

      cf2c4273a398e58620f7f751ab9ccae36da95fbd39055184b4f3cc96393ebadc

      SHA512

      447fca7cd7249597403de54621bb53663f3e378fa043d439ef1abd4363775d28402c6670d4a06d23381073b7585b30661dbf9aea35eef66ea92c8a2501730266

      Download Submit

    • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-6fdcfe060c6440cd\content\textures\StudioToolbox\Clear.png
      Filesize

      538B

      MD5

      fa8eaf9266c707e151bb20281b3c0988

      SHA1

      3ca097ad4cd097745d33d386cc2d626ece8cb969

      SHA256

      8cf08bf7e50fea7b38f59f162ed956346c55a714ed8a9a8b0a1ada7e18480bc2

      SHA512

      e29274300eab297c6de895bb39170f73f0a4ffa2a8c3732caeeeac16e2c25fb58bb401fdd5823cc62d9c413ec6c43d7c46861d7e14d52f8d9d8ff632e29f167c

      Download Submit

    • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-6fdcfe060c6440cd\content\textures\StudioUIEditor\valueBoxRoundedRectangle.png
      Filesize

      130B

      MD5

      521fb651c83453bf42d7432896040e5e

      SHA1

      8fdbf2cc2617b5b58aaa91b94b0bf755d951cad9

      SHA256

      630303ec4701779eaf86cc9fbf744b625becda53badc7271cbb6ddc56e638d70

      SHA512

      8fa0a50e52a3c7c53735c7dd7af275ebc9c1843f55bb30ebe0587a85955a8da94ff993822d233f7ed118b1070a7d67718b55ba4a597dc49ed2bf2a3836c696f6

      Download Submit

    • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-6fdcfe060c6440cd\content\textures\TerrainTools\checkbox_square.png
      Filesize

      985B

      MD5

      2cb16991a26dc803f43963bdc7571e3f

      SHA1

      12ad66a51b60eeaed199bc521800f7c763a3bc7b

      SHA256

      c7bae6d856f3bd9f00c122522eb3534d0d198a9473b6a379a5c3458181870646

      SHA512

      4c9467e5e2d83b778d0fb8b6fd97964f8d8126f07bfd50c5d68c256703f291ceaed56be057e8e2c591b2d2c49f6b7e099a2b7088d0bf5bdd901433459663b1f8

      Download Submit

    • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-6fdcfe060c6440cd\content\textures\ui\Controls\XboxController\Thumbstick1.png
      Filesize

      641B

      MD5

      2cbe38df9a03133ddf11a940c09b49cd

      SHA1

      6fb5c191ed8ce9495c66b90aaf53662bfe199846

      SHA256

      0835a661199a7d8df7249e8ae925987184efcc4fb85d9efac3cc2c1495020517

      SHA512

      dcef5baccef9fff632456fe7bc3c4f4a403363d9103a8047a55f4bd4c413d0c5f751a2e37385fe9eba7a420dbdb77ca2ff883d47fcdd35af222191cc5bd5c7a9

      Download Submit

    • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-6fdcfe060c6440cd\content\textures\ui\Controls\XboxController\[email protected]
      Filesize

      1KB

      MD5

      e8c88cf5c5ef7ae5ddee2d0e8376b32f

      SHA1

      77f2a5b11436d247d1acc3bac8edffc99c496839

      SHA256

      9607af14604a8e8eb1dec45d3eeca01fed33140c0ccc3e6ef8ca4a1f6219b5dd

      SHA512

      32f5a1e907705346a56fbddfe0d8841d05415ff7abe28ae9281ba46fedf8270b982be0090b72e2e32de0ce36e21934f80eaf508fd010f7ab132d39f5305fb68f

      Download Submit

    • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-6fdcfe060c6440cd\content\textures\ui\Controls\XboxController\[email protected]
      Filesize

      1KB

      MD5

      499333dae156bb4c9e9309a4842be4c8

      SHA1

      d18c4c36bdb297208589dc93715560acaf761c3a

      SHA256

      d35a74469f1436f114c27c730a5ec0793073bcf098db37f10158d562a3174591

      SHA512

      91c64173d2cdabc045c70e0538d45e1022cc74ec04989565b85f0f26fe3e788b700a0956a07a8c91d34c06fc1b7fad43bbdbb41b0c6f15b9881c3e46def8103e

      Download Submit

    • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-6fdcfe060c6440cd\content\textures\ui\Controls\XboxController\Thumbstick2.png
      Filesize

      738B

      MD5

      a402aacac8be906bcc07d50669d32061

      SHA1

      9d75c1afbe9fc482983978cae4c553aa32625640

      SHA256

      62a313b6cc9ffe7dd86bc9c4fcd7b8e8d1f14a15cdf41a53fb69af4ae3416102

      SHA512

      d11567bcaad8bbd9e2b9f497c3215102c7e7546caf425e93791502d3d2b3f78dec13609796fcd6e1e7f5c7d794bac074d00a74001e7fe943d63463b483877546

      Download Submit

    • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-6fdcfe060c6440cd\content\textures\ui\Controls\XboxController\[email protected]
      Filesize

      1KB

      MD5

      83e9b7823c0a5c4c67a603a734233dec

      SHA1

      2eaf04ad636bf71afdf73b004d17d366ac6d333e

      SHA256

      3b5e06eb1a89975def847101f700f0caa60fe0198f53e51974ef1608c6e1e067

      SHA512

      e8abb39a1ec340ac5c7d63137f607cd09eae0e885e4f73b84d8adad1b8f574155b92fbf2c9d3013f64ebbb6d55ead5419e7546b0f70dcde976d49e7440743b0f

      Download Submit

    • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-6fdcfe060c6440cd\content\textures\ui\Controls\XboxController\[email protected]
      Filesize

      1KB

      MD5

      55b64987636b9740ab1de7debd1f0b2f

      SHA1

      96f67222ce7d7748ec968e95a2f6495860f9d9c9

      SHA256

      f4a6bb3347ee3e603ea0b2f009bfa802103bc434ae3ff1db1f2043fa8cace8fc

      SHA512

      73a88a278747de3fefbaabb3ff90c1c0750c8d6c17746787f17061f4eff933620407336bf9b755f4222b0943b07d8c4d01de1815d42ea65e78e0daa7072591e9

      Download Submit

    • C:\Users\Admin\AppData\Local\CEF\User Data\LocalPrefs.json
      Filesize

      738B

      MD5

      75d37723adcb864c1014d2272657c0c5

      SHA1

      f5bca8ca472101ee4703003ecba60e9d97b5c38f

      SHA256

      b2b3e7e28878c8730e4074df7e5d5df9478ff09d7331bb37836e58777fe6c6d4

      SHA512

      e0ffd6008648e03ced8578aa0fb7323e92eccac37b055fae6de438e8cd067fab91b5e420c50b32b2121ac863eb4e7cffc1e0fdf960f54528835be353646a3157

      Download Submit

    • C:\Users\Admin\AppData\Local\CEF\User Data\LocalPrefs.json
      Filesize

      850B

      MD5

      2e5c2f0e7fd7a93529a29e481032fa57

      SHA1

      b45e36d661fdc89e135b078007848e7e770f4cb1

      SHA256

      d6c8de8d4a028176df64006c1db60a34aac83df54ad64d7bd8487bcffee9b5a6

      SHA512

      85bb45d219c780e92bc8fe7ee207b6a0ec0bdc1d087aa76d941c5793d4f4af5f69bc40bd595b695568341f9716d61ec8aefc696a371d9ba24fb7747b9e7be397

      Download Submit

    • C:\Users\Admin\AppData\Local\CEF\User Data\LocalPrefs.json~RFe5bf0c5.TMP
      Filesize

      529B

      MD5

      5e4072967a25dcecefefbf6e0ff9039c

      SHA1

      0964e7e9c996090459669839755173f61f51e02e

      SHA256

      8a0165e2143abb126587d7589e4599b24534e1432b06262de6090b6bcff1c157

      SHA512

      318b41b74a17037c3d1a78df821bf8355c8725f5819a07cc23a6d6609da0aefc388d5be496c785e1960a661c31c220e4c9004c9409b1c717b65487596cbc9e7d

      Download Submit

    • C:\Users\Admin\AppData\Local\Luau Language Server\server\index.js
      Filesize

      6.1MB

      MD5

      6b1cad741d0b6374435f7e1faa93b5e7

      SHA1

      7b1957e63c10f4422421245e4dc64074455fd62a

      SHA256

      6f17add2a8c8c2d9f592adb65d88e08558e25c15cedd82e3f013c8146b5d840f

      SHA512

      a662fc83536eff797b8d59e2fb4a2fb7cd903be8fc4137de8470b341312534326383bb3af58991628f15f93e3bdd57621622d9d9b634fb5e6e03d4aa06977253

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
      Filesize

      896KB

      MD5

      8b06433b972596f00981b3f80afa86ac

      SHA1

      f215f7de6f8d39a82b0bd3574f44d69a21539ae8

      SHA256

      7d8c0be9ac591428fec771c4295a6268a6ef8497eece4216528ba92249c5e02c

      SHA512

      948a7f9bfad247e018624fb130a87d186a4ebd47cdfbbe4f08e7f787210fd8a76e0b2158be9dbec4f6d49f720ed07ff4df0e02d4e5e10c590246d7c5e3e078f5

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
      Filesize

      9KB

      MD5

      7050d5ae8acfbe560fa11073fef8185d

      SHA1

      5bc38e77ff06785fe0aec5a345c4ccd15752560e

      SHA256

      cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

      SHA512

      a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
      Filesize

      10KB

      MD5

      a73ea6e1db27acedbe4055c448f82ef7

      SHA1

      01769a266d26c4b4b374099606e86b8874ddd55f

      SHA256

      c3059c62596021e555ec7901361fcde75078ad931bcac6027539930bef8b77d9

      SHA512

      f9cfe99077e40ac3ff11ab39020d6e159ec06cf50f9b1d156858198d48851d29de8882a18609a17dd30ddea421c6c415683b8d7b14fa30a51ddd1cd76032deb4

      Download Submit

    • C:\Users\Admin\AppData\Local\Wave\CefSharp.BrowserSubprocess.Core.dll
      Filesize

      915KB

      MD5

      100c32f77e68a2ce962e1a28997567ea

      SHA1

      a80a1f4019b8d44df6b5833fb0c51b929fa79843

      SHA256

      c0b9e29b240d8328f2f9a29ca0298ca4d967a926f3174a3442c3730c00d5a926

      SHA512

      f95530ef439fa5c4e3bc02db249b6a76e9d56849816ead83c9cd9bcd49d3443ccb88651d829165c98a67af40b3ef02b922971114f29c5c735e662ca35c0fb6ed

      Download Submit

    • C:\Users\Admin\AppData\Local\Wave\CefSharp.BrowserSubprocess.exe
      Filesize

      7KB

      MD5

      516ff62b2e1f4642caa954c0968719e8

      SHA1

      e349d0ce82e2109dd0d18416d9cf46e8411b7f15

      SHA256

      19da58849cec5933860116e60a1e94b08e30d90e0f955768270b47998d612045

      SHA512

      7aa4a0c87b29c2a84f585a884d8208fc2352a43f2cdb549c100e3b121837ad5f8dadb1101f57d1d3fcb7ebec9d9f22e07dc14239b7d2e2d25793c999becf288b

      Download Submit

    • C:\Users\Admin\AppData\Local\Wave\CefSharp.Core.Runtime.dll
      Filesize

      1.3MB

      MD5

      09cba584aa0aae9fc600745567393ef6

      SHA1

      bbd1f93cb0db9cf9e01071b3bed1b4afd6e31279

      SHA256

      0babd84d4e7dc2713e7265d5ac25a3c28d412e705870cded6f5c7c550a5bf8d5

      SHA512

      5f914fa33a63a6d4b46f39c7279687f313728fd5f8437ec592369a2da3256ccff6f325f78ace0e6d3a2c37da1f681058556f7603da13c45b03f2808f779d2aa1

      Download Submit

    • C:\Users\Admin\AppData\Local\Wave\CefSharp.Core.dll
      Filesize

      898KB

      MD5

      1bb24b22d9bd996c038d26b600ed18a8

      SHA1

      c2629a8a26c9c0969501923f84874838087cca2b

      SHA256

      944b987a0b677d354e24ee15bba65f73b0f051338f576234a975a49493399873

      SHA512

      38578e0d1a39ccc9851ff80d3a0f5342a34303229e2898c3ca32dad11017d4277720f54b472c2f1a0b73f47d5ba6352aa7be8ae2ed72b3b25a01dd8292591421

      Download Submit

    • C:\Users\Admin\AppData\Local\Wave\CefSharp.Wpf.dll
      Filesize

      114KB

      MD5

      ceaf0bad83fac8ce71853cd820e4ed9d

      SHA1

      4eed686fbba7d4603b596fb8e494b8f452a05886

      SHA256

      eaced1f76adb8ee756033baee29a47b1f4d4b657ebd105a7e25c8dc4fbc48cba

      SHA512

      4ed3f83e797eade8f0d1c6b80ce49d18f00daaf5d69421a4920e3cea2e7d78c3622193ca65b6ab1dab14c57e7f893a7b1edb27b83f343ea4df731d80aa21ff82

      Download Submit

    • C:\Users\Admin\AppData\Local\Wave\CefSharp.dll
      Filesize

      272KB

      MD5

      9ca06a8f9e5f7239ca225ab810274023

      SHA1

      e1a219f567a7b7d3af9386df51b14c76e769c044

      SHA256

      5fd00ae3e83e6ca156647ff6df87b49ffc7cad47c23fe3ae07c067c5adf6f74a

      SHA512

      430c9bceed5439b987d5bd4840cfe32411ca61594f18597aca1948aa39a22c9d70beadf3bb9b1dd0373f81a94a25dcba17fa8e8c73abf06cba28d0971d5614c5

      Download Submit

    • C:\Users\Admin\AppData\Local\Wave\D3DCOMPILER_47.dll
      Filesize

      3.9MB

      MD5

      3b4647bcb9feb591c2c05d1a606ed988

      SHA1

      b42c59f96fb069fd49009dfd94550a7764e6c97c

      SHA256

      35773c397036b368c1e75d4e0d62c36d98139ebe74e42c1ff7be71c6b5a19fd7

      SHA512

      00cd443b36f53985212ac43b44f56c18bf70e25119bbf9c59d05e2358ff45254b957f1ec63fc70fb57b1726fd8f76ccfad8103c67454b817a4f183f9122e3f50

      Download Submit

    • C:\Users\Admin\AppData\Local\Wave\WaveBootstrapper.exe
      Filesize

      949KB

      MD5

      8fb51b92d496c6765f7ba44e6d4a8990

      SHA1

      d3e5a8465622cd5adae05babeb7e34b2b5c777d7

      SHA256

      ab49d6166a285b747e5f279620ab9cea12f33f7656d732aa75900fcb981a5394

      SHA512

      20de93a52fff7b092cb9d77bd26944abed5f5cb67146e6d2d70be6a431283b6de52eb37a0e13dc8bc57dcf8be2d5a95b9c11b3b030a3e2f03dd6e4efc23527a6

      Download Submit

    • C:\Users\Admin\AppData\Local\Wave\WaveWindows.exe
      Filesize

      8.0MB

      MD5

      b8631bbd78d3935042e47b672c19ccc3

      SHA1

      cd0ea137f1544a31d2a62aaed157486dce3ecebe

      SHA256

      9cfda541d595dc20a55df5422001dfb58debd401df3abff21b1eee8ede28451c

      SHA512

      0c51d6247e39f7851538a5916b24972e845abfe429f0abdc7b532f654b4afe73dc6e1936f1b062da63bfc90273d3cbc297bf6c802e615f3711d0f180c070aa26

      Download Submit

    • C:\Users\Admin\AppData\Local\Wave\bin\Background.mp4
      Filesize

      4.6MB

      MD5

      9782180eb68f73030fe24ef6a1735932

      SHA1

      589827fe098ba048c9f871a28db8eae3e3537ff4

      SHA256

      3a1cbb800f8f25c2ab703ba8bfdb01e938e4143c3bc0fea8ca734fb5ba779ba7

      SHA512

      dc768638bae2d6d47d8910252ae64a656d8a6fd88efdf24165ddce51b7afdb4acb3fddd41dfe788737a2cab4fab66174db2f0d2f48bc8669af76d1656bca8be1

      Download Submit

    • C:\Users\Admin\AppData\Local\Wave\chrome_100_percent.pak
      Filesize

      667KB

      MD5

      ae195e80859781a20414cf5faa52db06

      SHA1

      b18ecb5ec141415e3a210880e2b3d37470636485

      SHA256

      9957802c0792e621f76bbdb1c630fbad519922743b5d193294804164babda552

      SHA512

      c6fef84615fe20d1760ca496c98629feb4e533556724e9631d4282622748e7601225cf19dfb8351f4b540ae3f83785c1bcea6fe8c246cf70388e527654097c1c

      Download Submit

    • C:\Users\Admin\AppData\Local\Wave\chrome_200_percent.pak
      Filesize

      1.0MB

      MD5

      1abf6bad0c39d59e541f04162e744224

      SHA1

      db93c38253338a0b85e431bd4194d9e7bddb22c6

      SHA256

      01cb663a75f18bb2d0d800640a114f153a34bd8a5f2aa0ed7daa9b32967dc29e

      SHA512

      945d519221d626421094316f13b818766826b3bedddab0165c041540dddadc93136e32784c0562d26a420cb29479d04d2aa317b8d605cd242e5152bf05af197e

      Download Submit

    • C:\Users\Admin\AppData\Local\Wave\chrome_elf.dll
      Filesize

      1020KB

      MD5

      7191d97ce7886a1a93a013e90868db96

      SHA1

      52dd736cb589dd1def87130893d6b9449a6a36e3

      SHA256

      32f925f833aa59e3f05322549fc3c326ac6fc604358f4efbf94c59d5c08b8dc6

      SHA512

      38ebb62c34d466935eabb157197c7c364d4345f22aa3b2641b636196ca1aeaa2152ac75d613ff90817cb94825189612ddd12fb96df29469511a46a7d9620e724

      Download Submit

    • C:\Users\Admin\AppData\Local\Wave\icudtl.dat
      Filesize

      10.2MB

      MD5

      74bded81ce10a426df54da39cfa132ff

      SHA1

      eb26bcc7d24be42bd8cfbded53bd62d605989bbf

      SHA256

      7bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9

      SHA512

      bd7b7b52d31803b2d4b1fd8cb76481931ed8abb98d779b893d3965231177bdd33386461e1a820b384712013904da094e3cd15ee24a679ddc766132677a8be54a

      Download Submit

    • C:\Users\Admin\AppData\Local\Wave\libEGL.dll
      Filesize

      359KB

      MD5

      7dd6b0e4a31d35a0fae5ff425707073c

      SHA1

      fbd12e9f8e2252c52ce555c2ebbd7f07e62a0140

      SHA256

      8762d8001fc3ddd90e3129dfea172817e8d09b9936eaae391957de4326c8c906

      SHA512

      726968df6b83ab5f589276672250d92f532fe2dcea2176e42031a7f1dcecf578b0320cfe2a7d88bb9883ad99387d71c6ebf1e9968272bb5e62850ef09abd2648

      Download Submit

    • C:\Users\Admin\AppData\Local\Wave\libglesv2.dll
      Filesize

      6.6MB

      MD5

      8803db5b167fb5a5f8a8c595c4e4d7c6

      SHA1

      7fde861151f3bea66c65b6c2487a30728048811a

      SHA256

      52a58d25a41f4bd31cdb4a0d306217862e04ebf7c1925cc85330054a5523d719

      SHA512

      2fa9a0eda221982896e41eb387b5e156198615ac1a1fbac0acffd13008919368b41a240df416c1fce2e48c20a14cd7af7cca9fba476ada5e64a0cadde84a44b7

      Download Submit

    • C:\Users\Admin\AppData\Local\Wave\locales\en-US.pak
      Filesize

      456KB

      MD5

      4430b1833d56bc8eb1f7dc82bb7f4bc9

      SHA1

      dc15e6306625f155683326e859d83f846153c547

      SHA256

      b44ddcfac9df4934007e6c55a3c7f5e7f14c7e5e29f35c81de917fc3b22aabbc

      SHA512

      faf93bf371b2a88c1b874a5e2c54e4487fd152ad19c2a406a46f55ae75ecd421a779888c2e4c170857b16bfb5d8744bc1815a4732ed50b064b3cbd0c5ffad889

      Download Submit

    • C:\Users\Admin\AppData\Local\Wave\resources.pak
      Filesize

      8.0MB

      MD5

      4933d92c99afa246fc59eef010d5c858

      SHA1

      98d443654e93c73dd317f9f847f71fba3d5b3135

      SHA256

      62f4674daa15245ee081920b8ee191e72f36ca8fe24f6b986a832f45676915b2

      SHA512

      a3a69523c8e7310716daeebc06c2ba4fce673eccd1958e824ff179b82f4502d0ec095190179bbb387342e4150f952ea7533182fb6ba90377d17dafba8f4da623

      Download Submit

    • C:\Users\Admin\AppData\Local\Wave\vk_swiftshader.dll
      Filesize

      4.4MB

      MD5

      0ec149455727ace9acc09b3ba2c3a2b2

      SHA1

      6eeb990876cef6a34115b67f3190255db589f723

      SHA256

      e2d8ef53897e864b5b66bc73606681c99461798a9f4c1e13ca5cef7bc774d7fd

      SHA512

      c8eaa598c9439b1f2375fdac1f58896853510bddbd640707b9142c0d3793836120b28d7c2bd0407f0d5656dd19f14b312f37b7ac0165c9cc8b4c1a0f2af62531

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
      Filesize

      212B

      MD5

      3bec4d14f7aa5dfc91a6639aaa114afa

      SHA1

      bb368cb6d724d37901707a1b5b484f568956bf22

      SHA256

      04cc9e905155e68f00d0b9269872eb22d7e30f04d26d4a8d5774df75733ac7ba

      SHA512

      095972a30e7a2955ed1cc3ea4d6a4748dea4c5c84e8c7a911aed27f1637c4ae6519fae59c1dacc73f8893b698d1ef3637f503b906ee12995505b45c0d8f71e90

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
      Filesize

      2B

      MD5

      f3b25701fe362ec84616a93a45ce9998

      SHA1

      d62636d8caec13f04e28442a0a6fa1afeb024bbb

      SHA256

      b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

      SHA512

      98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

      Download Submit

    • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping568_2012959142\manifest.json
      Filesize

      984B

      MD5

      0359d5b66d73a97ce5dc9f89ed84c458

      SHA1

      ce17e52eaac909dd63d16d93410de675d3e6ec0d

      SHA256

      beeab2f8d3833839399dde15ce9085c17b304445577d21333e883d6db6d0b755

      SHA512

      8fd94a098a4ab5c0fcd48c2cef2bb03328dd4d25c899bf5ed1ca561347d74a8aab8a214ba2d3180a86df72c52eb26987a44631d0ecd9edc84976c28d6c9dc16a

      Download Submit

    • memory/568-368-0x0000000011900000-0x0000000011A88000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/568-377-0x0000000011110000-0x0000000011120000-memory.dmp

      Filesize

      64KB

      Download

    • memory/568-349-0x00000000062B0000-0x00000000062EE000-memory.dmp

      Filesize

      248KB

      Download

    • memory/568-350-0x0000000006380000-0x00000000063E6000-memory.dmp

      Filesize

      408KB

      Download

    • memory/568-351-0x0000000009A00000-0x0000000009A08000-memory.dmp

      Filesize

      32KB

      Download

    • memory/568-347-0x00000000063F0000-0x0000000006428000-memory.dmp

      Filesize

      224KB

      Download

    • memory/568-331-0x000000000B760000-0x000000000BAB7000-memory.dmp

      Filesize

      3.3MB

      Download

    • memory/568-365-0x000000000DC40000-0x000000000DC50000-memory.dmp

      Filesize

      64KB

      Download

    • memory/568-364-0x000000000DC40000-0x000000000DC50000-memory.dmp

      Filesize

      64KB

      Download

    • memory/568-363-0x000000000DC40000-0x000000000DC50000-memory.dmp

      Filesize

      64KB

      Download

    • memory/568-366-0x000000000DC40000-0x000000000DC50000-memory.dmp

      Filesize

      64KB

      Download

    • memory/568-367-0x0000000010F30000-0x0000000010F40000-memory.dmp

      Filesize

      64KB

      Download

    • memory/568-7585-0x000000000DC40000-0x000000000DC50000-memory.dmp

      Filesize

      64KB

      Download

    • memory/568-369-0x0000000011110000-0x0000000011120000-memory.dmp

      Filesize

      64KB

      Download

    • memory/568-370-0x0000000011110000-0x0000000011120000-memory.dmp

      Filesize

      64KB

      Download

    • memory/568-374-0x000000000DC40000-0x000000000DC50000-memory.dmp

      Filesize

      64KB

      Download

    • memory/568-373-0x000000000DC40000-0x000000000DC50000-memory.dmp

      Filesize

      64KB

      Download

    • memory/568-372-0x000000000DC40000-0x000000000DC50000-memory.dmp

      Filesize

      64KB

      Download

    • memory/568-371-0x000000000DC40000-0x000000000DC50000-memory.dmp

      Filesize

      64KB

      Download

    • memory/568-375-0x000000000DC40000-0x000000000DC50000-memory.dmp

      Filesize

      64KB

      Download

    • memory/568-376-0x000000000DC40000-0x000000000DC50000-memory.dmp

      Filesize

      64KB

      Download

    • memory/568-399-0x000000000DA50000-0x000000000DBAB000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/568-378-0x0000000010F30000-0x0000000010F40000-memory.dmp

      Filesize

      64KB

      Download

    • memory/568-382-0x000000000DC40000-0x000000000DC50000-memory.dmp

      Filesize

      64KB

      Download

    • memory/568-381-0x000000000DC40000-0x000000000DC50000-memory.dmp

      Filesize

      64KB

      Download

    • memory/568-380-0x0000000011110000-0x0000000011120000-memory.dmp

      Filesize

      64KB

      Download

    • memory/568-383-0x0000000011110000-0x0000000011120000-memory.dmp

      Filesize

      64KB

      Download

    • memory/568-379-0x0000000011110000-0x0000000011120000-memory.dmp

      Filesize

      64KB

      Download

    • memory/568-395-0x0000000012E80000-0x0000000012F66000-memory.dmp

      Filesize

      920KB

      Download

    • memory/568-330-0x000000000AA10000-0x000000000AA32000-memory.dmp

      Filesize

      136KB

      Download

    • memory/568-324-0x0000000009D70000-0x0000000009E22000-memory.dmp

      Filesize

      712KB

      Download

    • memory/568-319-0x0000000005C50000-0x0000000005CF0000-memory.dmp

      Filesize

      640KB

      Download

    • memory/568-318-0x0000000000920000-0x0000000001122000-memory.dmp

      Filesize

      8.0MB

      Download

    • memory/568-391-0x0000000009360000-0x00000000093AA000-memory.dmp

      Filesize

      296KB

      Download

    • memory/568-387-0x00000000092E0000-0x0000000009304000-memory.dmp

      Filesize

      144KB

      Download

    • memory/568-7584-0x000000000DC40000-0x000000000DC50000-memory.dmp

      Filesize

      64KB

      Download

    • memory/568-348-0x000000000D520000-0x000000000DA4C000-memory.dmp

      Filesize

      5.2MB

      Download

    • memory/1708-309-0x00000000088B0000-0x00000000089B4000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/1708-310-0x00000000095D0000-0x00000000095E6000-memory.dmp

      Filesize

      88KB

      Download

    • memory/1708-311-0x0000000009610000-0x000000000961A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/1708-306-0x0000000000800000-0x00000000008F2000-memory.dmp

      Filesize

      968KB

      Download

    • memory/1708-312-0x00000000096B0000-0x00000000096CE000-memory.dmp

      Filesize

      120KB

      Download

    • memory/3448-436-0x0000000004980000-0x0000000004A6A000-memory.dmp

      Filesize

      936KB

      Download

    • memory/3448-432-0x00000000001F0000-0x00000000001F8000-memory.dmp

      Filesize

      32KB

      Download

    • memory/4464-7-0x000000000A160000-0x000000000A198000-memory.dmp

      Filesize

      224KB

      Download

    • memory/4464-13-0x00000000750E0000-0x0000000075891000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4464-0-0x00000000750EE000-0x00000000750EF000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4464-1-0x0000000000B60000-0x0000000000DAA000-memory.dmp

      Filesize

      2.3MB

      Download

    • memory/4464-308-0x00000000750E0000-0x0000000075891000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4464-2-0x00000000750E0000-0x0000000075891000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4464-3-0x0000000005970000-0x0000000005A22000-memory.dmp

      Filesize

      712KB

      Download

    • memory/4464-4-0x0000000005A20000-0x0000000005AA2000-memory.dmp

      Filesize

      520KB

      Download

    • memory/4464-31-0x000000000B5F0000-0x000000000B686000-memory.dmp

      Filesize

      600KB

      Download

    • memory/4464-5-0x0000000005910000-0x0000000005918000-memory.dmp

      Filesize

      32KB

      Download

    • memory/4464-6-0x0000000005920000-0x0000000005928000-memory.dmp

      Filesize

      32KB

      Download

    • memory/4464-36-0x000000000AB20000-0x000000000AB2A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/4464-37-0x000000000AB30000-0x000000000AB3A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/4464-35-0x000000000BA00000-0x000000000BA72000-memory.dmp

      Filesize

      456KB

      Download

    • memory/4464-8-0x000000000A120000-0x000000000A12E000-memory.dmp

      Filesize

      56KB

      Download

    • memory/4464-33-0x0000000006190000-0x0000000006198000-memory.dmp

      Filesize

      32KB

      Download

    • memory/4464-9-0x00000000750E0000-0x0000000075891000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4464-32-0x0000000006B30000-0x0000000006B56000-memory.dmp

      Filesize

      152KB

      Download

    • memory/4464-12-0x00000000750E0000-0x0000000075891000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4464-11-0x00000000750EE000-0x00000000750EF000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4464-10-0x00000000750E0000-0x0000000075891000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4576-243-0x00007FF7EF8B0000-0x00007FF7EF8C0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4576-294-0x00007FF7EF8B0000-0x00007FF7EF8C0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4576-293-0x00007FF7EF8B0000-0x00007FF7EF8C0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4576-241-0x00007FF7EF8B0000-0x00007FF7EF8C0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4576-242-0x00007FF7EF8B0000-0x00007FF7EF8C0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4576-244-0x00007FF7EF8B0000-0x00007FF7EF8C0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4576-245-0x00007FF7EF8B0000-0x00007FF7EF8C0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4576-246-0x00007FF7ED0B0000-0x00007FF7ED0C0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4576-295-0x00007FF7EF8B0000-0x00007FF7EF8C0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4576-292-0x00007FF7EF8B0000-0x00007FF7EF8C0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4576-247-0x00007FF7ED0B0000-0x00007FF7ED0C0000-memory.dmp

      Filesize

      64KB

      Download