Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

Roblox Acc...er.exe

windows7-x64

3

Roblox Acc...er.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/08/2024, 01:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Roblox Account Manager.exe

  • Size

    5.4MB

  • MD5

    334728f32a1144c893fdffc579a7709b

  • SHA1

    97d2eb634d45841c1453749acb911ce1303196c0

  • SHA256

    be9ddcdedf8c36c64e6b0a32d2686b74a112913c54217ccaa46675bfd1dc82f1

  • SHA512

    5df9d63136098d23918eba652b44a87e979430b2ce3e78a3eb8faef3dd4bd9599d6c31980f9eaf2bd6a071e966421bc6cec950c28b3b917f90130e8a582c2a1f

  • SSDEEP

    98304:42bT1Qm7d9G4/Ml61KO9bjRxMLywnrmYa0kqXf0FJ7WLhrBzcgPgL6b:/Qm59RMowO9bjRmmYiYa0kSIJ7zgPE

Score
8/10
credential_accessdiscoverypersistencestealer

Malware Config

Signatures

  • Downloads MZ/PE file
  • Uses browser remote debugging 2 TTPs 6 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Checks computer location settings 2 TTPs 8 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 19 IoCs
  • Loads dropped DLL 39 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Checks system information in the registry 2 TTPs 2 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 49 IoCs
  • Drops file in Windows directory 18 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 11 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe
    "C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2548
    • C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe
      "C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe" -restart
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4056
      • C:\Users\Admin\AppData\Local\Temp\vcredist.tmp
        "C:\Users\Admin\AppData\Local\Temp\vcredist.tmp" /q /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4436
        • C:\Windows\Temp\{3FF8E52B-E95F-44F0-BA8C-ECEB2F756BAA}\.cr\vcredist.tmp
          "C:\Windows\Temp\{3FF8E52B-E95F-44F0-BA8C-ECEB2F756BAA}\.cr\vcredist.tmp" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\vcredist.tmp" -burn.filehandle.attached=544 -burn.filehandle.self=552 /q /norestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5024
          • C:\Windows\Temp\{602264DA-4BAA-4097-871C-B6090A8E3A7C}\.be\VC_redist.x86.exe
            "C:\Windows\Temp\{602264DA-4BAA-4097-871C-B6090A8E3A7C}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{E3B40129-9786-4675-B292-8175FBDB4975} {31C919B2-B71B-4EA3-9863-67DF5FA66040} 5024
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4112
            • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
              "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={47109d57-d746-4f8b-9618-ed6a17cc922b} -burn.filehandle.self=1060 -burn.embedded BurnPipe.{8666E174-ED4A-4BB6-BD64-B5E2B8DED1BE} {3690ABEE-39D3-43FE-88D3-598C36F91E0B} 4112
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3260
              • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={47109d57-d746-4f8b-9618-ed6a17cc922b} -burn.filehandle.self=1060 -burn.embedded BurnPipe.{8666E174-ED4A-4BB6-BD64-B5E2B8DED1BE} {3690ABEE-39D3-43FE-88D3-598C36F91E0B} 4112
                7⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2452
                • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                  "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{4D59E5F1-C3D5-4115-A304-8BD184E370D4} {E04455AA-67D3-4D05-9821-0CFDC98203BA} 2452
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  PID:1644
      • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
        "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --allow-pre-commit-input --disable-background-networking --disable-background-timer-throttling --disable-backgrounding-occluded-windows --disable-breakpad --disable-client-side-phishing-detection --disable-component-extensions-with-background-pages --disable-component-update --disable-default-apps --disable-dev-shm-usage --disable-extensions --disable-field-trial-config --disable-hang-monitor --disable-infobars --disable-ipc-flooding-protection --disable-popup-blocking --disable-prompt-on-repost --disable-renderer-backgrounding --disable-search-engine-choice-screen --disable-sync --enable-automation --enable-blink-features=IdleDetection --export-tagged-pdf --generate-pdf-document-outline --force-color-profile=srgb --metrics-recording-only --no-first-run --password-store=basic --use-mock-keychain --disable-features=Translate,AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold --enable-features= about:blank --disable-web-security --window-size="880,740" --window-position="200,-30" --remote-debugging-port=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv"
        3⤵
        • Uses browser remote debugging
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks system information in the registry
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        PID:3892
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv /prefetch:4 --monitor-self --monitor-self-argument=--type=crashpad-handler --monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv --monitor-self-argument=/prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv\Crashpad --annotation=plat=Win64 "--annotation=prod=Google Chrome for Testing" --annotation=ver=124.0.6367.201 --initial-client-data=0xe0,0xe4,0xd8,0xdc,0x108,0x7ffc426bcc70,0x7ffc426bcc7c,0x7ffc426bcc88
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3412
          • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
            C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv /prefetch:4 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv\Crashpad --annotation=plat=Win64 "--annotation=prod=Google Chrome for Testing" --annotation=ver=124.0.6367.201 --initial-client-data=0x138,0x13c,0x140,0x114,0x144,0x7ff6ea0a9900,0x7ff6ea0a990c,0x7ff6ea0a9918
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:64
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=gpu-process --disable-breakpad --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv" --no-appcompat-clear --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2060,i,4863962641344153166,18337602868651687502,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3288
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv" --no-appcompat-clear --start-stack-profiler --field-trial-handle=1936,i,4863962641344153166,18337602868651687502,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:3
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4076
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv" --no-appcompat-clear --field-trial-handle=2216,i,4863962641344153166,18337602868651687502,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4156
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv" --no-appcompat-clear --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --allow-pre-commit-input --enable-blink-features=IdleDetection --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2964,i,4863962641344153166,18337602868651687502,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:1
          4⤵
          • Uses browser remote debugging
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1720
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv" --no-appcompat-clear --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --allow-pre-commit-input --enable-blink-features=IdleDetection --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2968,i,4863962641344153166,18337602868651687502,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:1
          4⤵
          • Uses browser remote debugging
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4812
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv" --no-appcompat-clear --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --allow-pre-commit-input --enable-blink-features=IdleDetection --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=2268,i,4863962641344153166,18337602868651687502,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:1
          4⤵
          • Uses browser remote debugging
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5444
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv" --no-appcompat-clear --field-trial-handle=5000,i,4863962641344153166,18337602868651687502,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5128
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv" --no-appcompat-clear --field-trial-handle=5088,i,4863962641344153166,18337602868651687502,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1216
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv" --no-appcompat-clear --field-trial-handle=4016,i,4863962641344153166,18337602868651687502,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3848
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv" --no-appcompat-clear --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --allow-pre-commit-input --enable-blink-features=IdleDetection --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5188,i,4863962641344153166,18337602868651687502,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:1
          4⤵
          • Uses browser remote debugging
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5304
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv" --no-appcompat-clear --start-stack-profiler --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --allow-pre-commit-input --enable-blink-features=IdleDetection --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5312,i,4863962641344153166,18337602868651687502,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:1
          4⤵
          • Uses browser remote debugging
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3740
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv" --no-appcompat-clear --field-trial-handle=5604,i,4863962641344153166,18337602868651687502,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2016
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv" --no-appcompat-clear --field-trial-handle=5588,i,4863962641344153166,18337602868651687502,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5124
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:2464
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
      PID:3828
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1088
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      PID:1624
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault26b9ad98he30ch49e4ha538h791b212ef120
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:3936
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffc412746f8,0x7ffc41274708,0x7ffc41274718
        2⤵
          PID:3376
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,5623157881049677750,2509937844475247928,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
          2⤵
            PID:4668
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,5623157881049677750,2509937844475247928,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:2400
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,5623157881049677750,2509937844475247928,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
            2⤵
              PID:2308
          • C:\Windows\System32\CompPkgSrv.exe
            C:\Windows\System32\CompPkgSrv.exe -Embedding
            1⤵
              PID:3412
            • C:\Windows\System32\CompPkgSrv.exe
              C:\Windows\System32\CompPkgSrv.exe -Embedding
              1⤵
                PID:2484
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                1⤵
                  PID:5196

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Config.Msi\e58491f.rbs
                  Filesize

                  16KB

                  MD5

                  8963dd83069822944cea5ac2a45b607f

                  SHA1

                  7e4071adfab075c3e6f8e269c98c8c1fb3a47f1c

                  SHA256

                  21e2b8669e0046850fc64b47368d8f1282fa2818ae8eb01c62954ed13407a139

                  SHA512

                  c8fd3360c038e19b4146cc3fdbcefe3909cc0b870db7b2daf5680c6c3c7f9b384fa81264b54ec5b1c918db6683329e655df771ace3d182e89fb65d0ef8345fbf

                  Download Submit

                • C:\Config.Msi\e584924.rbs
                  Filesize

                  18KB

                  MD5

                  c039a740c046876f9820483deafad80a

                  SHA1

                  f32b73a9c81a2385192b4984d4a2edc4354e6d28

                  SHA256

                  ac772d436d8ddb8f9fccc81f05c382361701353b20cf1f7f3c124114c0fff9bb

                  SHA512

                  8f0977b1df004424b66b28ba2b52d5c61722f42d453e5c6a342110e6c2d8a1b3ec9c89d3a3a4515d9ba195dce314da708a2bfb1eb6b5e7d5209e4be009e0b0e3

                  Download Submit

                • C:\Config.Msi\e586978.rbs
                  Filesize

                  20KB

                  MD5

                  2b227fe61104a06b6925cd65932cf91a

                  SHA1

                  60890a0e3c26d44790ae7c08c2209dd998e752dc

                  SHA256

                  5a55f268a498639b7a275e22ad2b786b3dddc675f937bcc697bd5ae22c311e32

                  SHA512

                  53264581ccb67b62a673371f8faafd37346a473234265b45737bf7bd36d34dbd50cd52b09b88eed9396a88c6999ec301a4505f86524f49b6f0b5a0a64b79313d

                  Download Submit

                • C:\Config.Msi\e586987.rbs
                  Filesize

                  19KB

                  MD5

                  676a555ad87d4b6540df110d9776ff76

                  SHA1

                  ddbd0a73444879bc8de6fed3ca6d9882ceedc433

                  SHA256

                  3b8936eba88afaaceb9371d1673cddd00e622027c8fe7942b46fc83704330df5

                  SHA512

                  5c0bd50d6b111911e72920e47c90b1ebbe1ac36bfaa738cc345d8d63393e4386465d00a28838f934588cb4d95967195442b9120167ef9ae295e499a746cc0ba1

                  Download Submit

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Roblox Account Manager.exe.log
                  Filesize

                  1KB

                  MD5

                  a02e8a8a790f0e0861e3b6b0dbe56062

                  SHA1

                  a3e65805e5c78641cafebc1052906d7350da9d2e

                  SHA256

                  7fada0f81b63e1ecb265e9620ace8f5f0d40773626081849f5d98e668bc4e594

                  SHA512

                  108a81f818aa027834d621c771e427ee3f300c59d9dc10d853b94b1e8d635cf6bc06338dce31da30b08660c6fb06a39f9069c983bb585049f5fe9f50b753eb42

                  Download Submit

                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5b1f4657-0c75-4bf0-bafc-9522782d3c73.tmp
                  Filesize

                  8KB

                  MD5

                  7c182a99ceb19b3bd91290f6dbabd54f

                  SHA1

                  c148f9708967a2d1f62292dea839f9a35da9528b

                  SHA256

                  1053488e0e6c10092f691560123385b78f7d03984fb891feebc66fa0b2609313

                  SHA512

                  0aa8f995df7453baaa865d5157b0576ef41cc7c6c9b6d55a072fa6def8617e0064bd4e0fb801316cf48d5cf63733572eec06cacd532f205c2fe32ba0964fb228

                  Download Submit

                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                  Filesize

                  152B

                  MD5

                  b9569e123772ae290f9bac07e0d31748

                  SHA1

                  5806ed9b301d4178a959b26d7b7ccf2c0abc6741

                  SHA256

                  20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

                  SHA512

                  cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

                  Download Submit

                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                  Filesize

                  6KB

                  MD5

                  3fb45fe3921618ac0fe4babd8411e2b2

                  SHA1

                  1ffc3035d7b63f2682d4c995d134a18b8acb9f6c

                  SHA256

                  6ad9aab29aa39af169578efc974fb86037119da4ac10907313fc87f5ad01883a

                  SHA512

                  e9503ff987f357a36abd569847907640df06b61ca068feba18c8c741345bc9f18ee017010b8d8b516fbf0e87b58873990b90af833a14904f88f16bae7c7ba599

                  Download Submit

                • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\D3DCompiler_47.dll
                  Filesize

                  4.7MB

                  MD5

                  a7b7470c347f84365ffe1b2072b4f95c

                  SHA1

                  57a96f6fb326ba65b7f7016242132b3f9464c7a3

                  SHA256

                  af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a

                  SHA512

                  83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d

                  Download Submit

                • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
                  Filesize

                  2.5MB

                  MD5

                  f26dfce9583f0d7d41b31ee11e56be43

                  SHA1

                  5718e9ea9c5ec6888a3d5eae9c090b0880414b0a

                  SHA256

                  613536f294de53d1e9bb53a31269300fef4427f5e461ff6c7a1de3fa88c7667c

                  SHA512

                  88447cf2767667a2d470b62b2f2be79483343003e40e02deeafc20ea27d63b66cd336ceede04f850edb920009672682e32290050b18daf9c575bd020d7bd4966

                  Download Submit

                • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome_100_percent.pak
                  Filesize

                  665KB

                  MD5

                  f796340aed680b64c37657912c63b050

                  SHA1

                  8fccd026e7e88c733cbd37b495e9e0afff0b24be

                  SHA256

                  329113e1ab3c6ac34d8375fd0a66e6ba12c1c49675101d10e231316b5a14c8c2

                  SHA512

                  98a8d6858b23bebdee8c7d13d5534aa568bffd2e9c030aec2263778ac2bdd7dea5c7e38b942352089ec4123d789eeaa2376623fba652e119db61cc006d3ace56

                  Download Submit

                • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome_200_percent.pak
                  Filesize

                  1.0MB

                  MD5

                  e7f0c4a2f06aa4c40206cdc1bfb9166e

                  SHA1

                  14679473561d6f3d710a2514620e2f97650e5791

                  SHA256

                  3cd793c813d79579e5dafb3b63204e2ccb525f6b27a6dc25525c9fafabce4d29

                  SHA512

                  fcca36df17760212654f3d08a0265fbce42b51a3ca13e70012dd723fd6ea084775036744fe32d0439fcf496c2fb2d5a733fbb87bdd3f318a64bb4611c7ff5f58

                  Download Submit

                • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome_elf.dll
                  Filesize

                  1.2MB

                  MD5

                  561916711c707fe011411fd3d2cf71a8

                  SHA1

                  f7780da112a6abb515e7a9883810cf82a634674a

                  SHA256

                  0d2ccf801ceabba978a77238e1b79afc9a66983a11c07e011f876c063a71ffdb

                  SHA512

                  29b11fa1ffff586df4bae7a141a5e69500e327b54aa19efc32bd5bdd2f9652bbb641bc7bdc3116c95ca27022022894da5f9c94c987ce6c9793fce93f668b9c5a

                  Download Submit

                • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\dxil.dll
                  Filesize

                  1.4MB

                  MD5

                  30da04b06e0abec33fecc55db1aa9b95

                  SHA1

                  de711585acfe49c510b500328803d3a411a4e515

                  SHA256

                  a5fe1d8d9caa2ff29daffd53f73a9a4e19c250351b2abe4fc7b57e60ce67ac68

                  SHA512

                  67790874377e308d1448d0e41df9dd353a5f63686df4eb9a8e70a4da449b0c63a5d3655ab38d24b145ad3c57971b1c6793ea6c5ac2257b6eb2e8964a44ab0f08

                  Download Submit

                • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\icudtl.dat
                  Filesize

                  10.2MB

                  MD5

                  74bded81ce10a426df54da39cfa132ff

                  SHA1

                  eb26bcc7d24be42bd8cfbded53bd62d605989bbf

                  SHA256

                  7bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9

                  SHA512

                  bd7b7b52d31803b2d4b1fd8cb76481931ed8abb98d779b893d3965231177bdd33386461e1a820b384712013904da094e3cd15ee24a679ddc766132677a8be54a

                  Download Submit

                • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\libEGL.dll
                  Filesize

                  460KB

                  MD5

                  06ed270c198a3d563ee931ac6f825683

                  SHA1

                  3c34e2bcf9099413a176085a3e1cade95035d3d2

                  SHA256

                  89c3cf5576b06b8114450f55f16f5fa0c2197db45a7ef0e57bc0eda872dcd6f5

                  SHA512

                  e865bae51bc2c2687049919a5581339a70f66beb9eb62488830be06ec1892f8bb11bc5728f9c7665469dae7333bfa110312696d954f19d0c86aad8277453a713

                  Download Submit

                • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\libGLESv2.dll
                  Filesize

                  7.6MB

                  MD5

                  acd281e2a183ef45f130663118d20897

                  SHA1

                  dcab723cc20477a40d99a62e6bbfb75fa470c47f

                  SHA256

                  6cebea494ff17a5ec8c54b7fd5e13834eae556178ac42e7eab545263646aa080

                  SHA512

                  a59c491002224e86b4598104927b4c10107bf964ea7ad192f9ac6dca8a9a5b39d0e37c888c6d2e36234eb0b48c60a55da36852d377f4a506ca41274f834703ee

                  Download Submit

                • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\locales\en-US.pak
                  Filesize

                  394KB

                  MD5

                  a8af211968e7d1fbc577fc55e1859f6d

                  SHA1

                  1fbf54c0be76318b4c4ede2daea08191221df890

                  SHA256

                  92efd174fffe9e958e20edf1acdb9394ce81ae38b9d1a04203cb35585ecbb5b7

                  SHA512

                  11c2d88467135e8d39c06dffe27be53c471d0c917b1767050d6c36dd7701ecac22680313203efc312ac6ffe867da658cc38ccb9ba19962e78a5accc6e5df0e21

                  Download Submit

                • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\resources.pak
                  Filesize

                  8.0MB

                  MD5

                  d092e6572493590a6cb2498e029509dc

                  SHA1

                  f3564c4fec2e855486d63a90e34b1abb59e40ecb

                  SHA256

                  103ba11595d71025abc07c1f32e9f0fa11d9a191afeba6ee950154c5b358ac0b

                  SHA512

                  e8894be07117dd7fa624a8d48dafa9371623bad475bc2523eaa5d0da1aa026deecb03062678a35a79c9798d5215a008ed812548ae2107d22bbe226940499d7ff

                  Download Submit

                • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\v8_context_snapshot.bin
                  Filesize

                  641KB

                  MD5

                  0753b1e35ebc257c8511b6f219fac1ec

                  SHA1

                  7acd65cbcc253130b0127a0a189601671e9fc1d1

                  SHA256

                  ddd3a5acffc4e8d6b9211c84733debdf394c3cb12d702598e1a5e56b13c89c61

                  SHA512

                  b9dfac660d834aacb30e6e1e272c4f0669659514f48aadc8b5542dd42ca1bd5aca4bbd00941c2ccacccc9ca068f133623dedc9994f5ccbbf1ac36bbdef99aee2

                  Download Submit

                • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\vk_swiftshader.dll
                  Filesize

                  5.0MB

                  MD5

                  50b6baa8afafbf849557eef9a6c600af

                  SHA1

                  8f050d6b8a89be5d27209ae26c90874757a8eb5f

                  SHA256

                  b1bdf61233010357f8bf5d5837719229b527581ac2ebcd5c9662f04471f2cc9e

                  SHA512

                  60866cc0fd0aa65febdf1da751701bcaf3cd90edf3cca3a8b3058c1aed26b56ba74332be697d22b30214446234477030a86605cc71b85940ea8adc6c169e7f35

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\RAMSettings.ini
                  Filesize

                  1014B

                  MD5

                  1d917eaf5dcc8e06dd032c33f3a3d36a

                  SHA1

                  1eacb4eced22393fd5140910d30070f2e054e2fe

                  SHA256

                  787fa9af1c32b7e198119469c0e2c02c06b34ec7c990b62b9f4fb9bc8cedaa5f

                  SHA512

                  3cf5bc6160262ad454477cc0fab401696a7e5dff9e6fae1cdcfa0579ded640ea8c383dfcea6194f55c914927058e2355fd661d1fa83f87c10aeffa6a91cb9fcd

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\RAMTheme.ini
                  Filesize

                  314B

                  MD5

                  f18fa783f4d27e35e54e54417334bfb4

                  SHA1

                  94511cdf37213bebdaf42a6140c9fe5be8eb07ba

                  SHA256

                  563eb35fd613f4298cd4dceff67652a13ba516a6244d9407c5709323c4ca4bb1

                  SHA512

                  602f6a68562bc89a4b3c3a71c2477377f161470bf8ae8e6925bf35691367115abfa9809925bd09c35596c6a3e5a7e9d090e5198e6a885a6658049c8732a05071

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe.config
                  Filesize

                  6KB

                  MD5

                  0a86fa27d09e26491dbbb4fe27f4b410

                  SHA1

                  63e4b5afb8bdb67fc1d6f8dddeb40be20939289e

                  SHA256

                  2b6d99db8369b0ff6372737d89d1c9e4101815b4168a3852c7b513f2897e7f3d

                  SHA512

                  fbebc4dc0925d5d67271cac04c1ed324091442ef4c9f6243d2c1c523c9aa6b338c6a594e4987fc142dd3b2a023338a267c8a3454e47fbf0b3e0dbd7b3b65cc0d

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20240806013648_000_vcRuntimeMinimum_x86.log
                  Filesize

                  2KB

                  MD5

                  6081d79a8f2cc6336a15061217e17932

                  SHA1

                  c9985e0a56cdd5b78eaa8c1526a2f1333c05abb1

                  SHA256

                  5cc9e9af6d3144b19ff31684297d63249e7466a4aeaeefe61bba43f5ec2e3ee2

                  SHA512

                  8d8c2bd5169ccb3ad590fa05b18637968365958727f313df4d6ab3718de13f7696f8c8772ff0d68d75b4b623056a1ba5adc052dd4969b5fb32fc8500126b8ff3

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20240806013648_001_vcRuntimeAdditional_x86.log
                  Filesize

                  2KB

                  MD5

                  a6bb156ddbdd1851aaca8407b80be540

                  SHA1

                  a63759406d17bbce220872c843020612ee36b7bc

                  SHA256

                  24b56630001c4423f940fcd1121f136e817389f970d4a00684008abfcb894e5b

                  SHA512

                  3e614448d0c72da3087238ace5f9cce783493db070113857b73e0ed725b47325b9119b20647e8b17d87e041fb4dc18f2b04e0eafa34bb39ee1093b9db7e909be

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20240806013648_001_vcRuntimeAdditional_x86.log
                  Filesize

                  2B

                  MD5

                  f3b25701fe362ec84616a93a45ce9998

                  SHA1

                  d62636d8caec13f04e28442a0a6fa1afeb024bbb

                  SHA256

                  b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                  SHA512

                  98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20240806013648_001_vcRuntimeAdditional_x86.log
                  Filesize

                  2KB

                  MD5

                  02b0c6d686696e6f348c9f54299edf67

                  SHA1

                  07f7bfbd8b97aaf0370e136331119c7ffebde015

                  SHA256

                  fccd2e36b384459b3ce1f9ec9c7a9156b0bb7e1e1ba1f7beea91d8a474858e4e

                  SHA512

                  61661b1380cb91791b91a57c7cae6b66ea67b198e960c123fbc467b73a47f75267ba48c28bef8af309a72503298176697eed0467bb24a6bb7ba4ed5cd859d3a5

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\libsodium.dll
                  Filesize

                  477KB

                  MD5

                  4f6426e3626d5d46fb19c13043cb84de

                  SHA1

                  9dfa32f957c19c843a568b57d555d6d5cbc61579

                  SHA256

                  7a960129f6d3f8d44b4c6be27f587c29aa8bafb9c4d3c85bb84a5f5d8fa6e2ba

                  SHA512

                  7a83adf2b36973ceb52bfc95591bc91d4ac778a4e11d11723f6d8bf208811b8fa7d072851cfed73407c9413455de717e9a42f8e6bb1a133cb2b1981c66bb5832

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\log4.config
                  Filesize

                  936B

                  MD5

                  e4659ac08af3582a23f38bf6c562f841

                  SHA1

                  19cb4f014ba96285fa1798f008deabce632c7e76

                  SHA256

                  e4b10630d9ec2af508de31752fbbc6816c7426c40a3e57f0a085ce7f42c77bd5

                  SHA512

                  5bfa1e021cc7ee5e7a00da865d68684202b3b92d3d369b85b80c591fffa67725d434398325dc1e37c659eab62c0a4118b3e279ac0096b95790d252ceb6254249

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv\Default\Code Cache\js\index-dir\the-real-index
                  Filesize

                  48B

                  MD5

                  a1ca3bccfac02f2fa4451d977169046a

                  SHA1

                  03db947b2b932bf898055169621228200131708d

                  SHA256

                  62b440144961924cdd0b06daeeda4fd4707265045a0fef029f5650aef9f690de

                  SHA512

                  c012816ad5609e124756b79119043cbb8cc5a5b0ef06d7daf4650db1b6ff3c184ea73099a26c56eb63c2b18d216194a5e5b2b48985d3d7de981927461cec315a

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv\Default\Code Cache\js\index-dir\the-real-index
                  Filesize

                  2KB

                  MD5

                  2475e35892fee14f71553b23944640d1

                  SHA1

                  3e6110a59b188bc46c52c79138db440bb1587d55

                  SHA256

                  317fdb9a2b22c4163436d41cc35f0b6165654a1fef51299fd9b849540d09d2dd

                  SHA512

                  bb16acae38dd3401b8426a4e8450dfc86f184b490afd0fc4a2c09591af3ee0c363e15ebe41c8e7ad271ffb1af28c7a5e877cd3f84681d885066cb20bf806e503

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv\Default\Extension Scripts\MANIFEST-000001
                  Filesize

                  41B

                  MD5

                  5af87dfd673ba2115e2fcf5cfdb727ab

                  SHA1

                  d5b5bbf396dc291274584ef71f444f420b6056f1

                  SHA256

                  f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                  SHA512

                  de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv\Default\Network\Network Persistent State
                  Filesize

                  5KB

                  MD5

                  d1223b97c6b4d7968d02e3b145be12a0

                  SHA1

                  eccddd3d221699448d407b711965d848a6357fa3

                  SHA256

                  c61ccbe637133bec948aac708e50d469c5952d134174e39ff6a50a54fd1bc495

                  SHA512

                  19a57b50b2aba6219da7b92ef6abf010d0edf674620e7c4d8b2461bb4678d64beca9625054806cafc6787c489876e50e4dc3d0595302ada819785d7a83eafa62

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv\Default\Network\Network Persistent State~RFe59e8b0.TMP
                  Filesize

                  59B

                  MD5

                  2800881c775077e1c4b6e06bf4676de4

                  SHA1

                  2873631068c8b3b9495638c865915be822442c8b

                  SHA256

                  226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

                  SHA512

                  e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv\Default\Network\SCT Auditing Pending Reports
                  Filesize

                  2B

                  MD5

                  d751713988987e9331980363e24189ce

                  SHA1

                  97d170e1550eee4afc0af065b78cda302a97674c

                  SHA256

                  4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                  SHA512

                  b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv\Default\Network\TransportSecurity
                  Filesize

                  1KB

                  MD5

                  003445b698a39e24968e97d7bd75bec4

                  SHA1

                  726006e262ae97321945616d177444fc33a1888c

                  SHA256

                  6234048096a7675ee845999ed8c48401e677c705687b689e8322009dc14b8fbd

                  SHA512

                  0ea86611aace4c16e143627db4941e25b3409a4fc52c2cf750f2bbf391455df8fddf4b246671af02fa5966a2077be06a456339752b1a25fd3a13d15129f4703e

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv\Default\Network\TransportSecurity
                  Filesize

                  1KB

                  MD5

                  0391be95b9b2c47f06d7fedd6c14af0f

                  SHA1

                  16b0f4ab62c9c563b802a48392778376c5f18d3d

                  SHA256

                  f10a26f15bc34b77608233fa810e5107e7233fdddca9abe55a1bd656c74b5d4f

                  SHA512

                  1bd4504a420d7a5d5347ad70b68991652e72f017602d0d1ef933e3c16b396624e6132187f2d94185f824160c792e07d40c9a466102d679bc2996e561e7de180f

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv\Default\Network\TransportSecurity
                  Filesize

                  2KB

                  MD5

                  e051a92e1da3eb2c4f0bbc1ea9a23105

                  SHA1

                  0a9930bcfa4b1375e3be9581cc2e7856d2580b9b

                  SHA256

                  bccb975dc1168f7cfbc3e0323f54fbc3983fa2a8e9c588c705ee357e1d266c40

                  SHA512

                  aa191948f5cc6c2d5b3a9248707f07b4396152f0d3445f3f53a7a4f1257334727d293589f1d8fd9ee85a145e1ee073652aded8c25a9b4576db57a7bb2c58a3e5

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv\Default\Network\TransportSecurity
                  Filesize

                  3KB

                  MD5

                  81f25de2a6e61debd04259a449f4b119

                  SHA1

                  8ea450e9e99b99b01980c5392b26ad5cc050d207

                  SHA256

                  bd880e69c8c0bee6083503f7aadc9575d1bc06c5e3c7c57a5bef204b5d5184ee

                  SHA512

                  783e3f3b9ef382a7fcdbf873040f63292ffa3ae018075a08276ea25b5fa8b21500b8ca091f74ad1b65dff7dea978c3b658fcd2c2f9a8cb4fdd7002ad35041df8

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv\Default\Network\TransportSecurity
                  Filesize

                  3KB

                  MD5

                  c82a182e949379032047d78a96cf5450

                  SHA1

                  f6231645e5daf14d9fadb94d0a1294d47992b6d2

                  SHA256

                  a97df5a488a4a3246be3432ffc113956853f108cceac7e8ad0b4b97a43530d0d

                  SHA512

                  089ce38c3375d29eaa9a46cc3007703bfbece438d924d611ea3a1ad8b3f67ed1a772b54ece50b98e599d0f9a03f0eae9d0138106081eaee58b4599fc8bb1f9a6

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv\Default\Network\TransportSecurity
                  Filesize

                  3KB

                  MD5

                  a724a21c3718db9a15960f09352e0d48

                  SHA1

                  f663d0087821970624cfdd0e38242b02c1cc4d61

                  SHA256

                  d14b71d2d6cee9aa832e6fc5703d6de15ae670f16efd1854ae1b51e4d3073445

                  SHA512

                  3ac8c97773c096726d10e04c40ea9bed84e90e05c89ce4a434b2064d977cdb316c57e171f8a9ea0b79127e46bd46e3b1951f9d111c35532c0552fb5b0765160b

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv\Default\Network\TransportSecurity~RFe592d40.TMP
                  Filesize

                  1KB

                  MD5

                  3a8c7842a904676df21d8d8923e01c15

                  SHA1

                  d5033d812ef8d4a5287ce35739646de61756056b

                  SHA256

                  d232c215eb3538e98ba0657dd26e5a8901207c1c511653d11a08d14c25eed3a7

                  SHA512

                  ba7cfe770e44b4d6664265c9f75ab7c779f08fcb1ffe27c7d439acf29c14067b1b553d772b8764e4a9709fefc35aba776f9f8487cb6628217aa5c82348e50b66

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv\Default\Preferences
                  Filesize

                  5KB

                  MD5

                  f2b3ba124c4e07b0b40c2ab31e0f4a9b

                  SHA1

                  20bd076d57a4acc739c7d47e122156fcc584637b

                  SHA256

                  072e5c923cdc17274e4481b2227a01f86a9bee8e0355e3380859d857aee37232

                  SHA512

                  3e8de9680a75096f350374e939cf14561db0d9bfa4181d398237739d12d85d3af7d9cfdc6ae2ce88dd141191e4bd071540dc58979cfc497287635e8faee51439

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv\Default\Preferences
                  Filesize

                  5KB

                  MD5

                  9e9454802a7fa4fe4afb3452e3dcaff5

                  SHA1

                  298bb372520c8b8d5dcbaaaeb68e638fed0dd0f7

                  SHA256

                  077aaef0332994d6dfa872f6e1b487a54a7f1a85a2bc3a0bd5253dd42896ce4a

                  SHA512

                  ef2ab62221c9dfe809d3d11100cc77655d7943695c47e4bf5e0d2bdcb98e463634ec6a22ca3389cc85a2a70b7a63925a7e0b795245d73015908648bbdad4ce21

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv\Default\Preferences
                  Filesize

                  5KB

                  MD5

                  761687d58494d7e7da7485f4dd40a9fa

                  SHA1

                  7d17004674f1d27c762f359aac041e3933ed3bf4

                  SHA256

                  a623f2bffee1f81c4fdec261055cf6f83bc172c7001eb72f1fa93cbe0507c87b

                  SHA512

                  fa2c3374200bfd83b5386e9d04a26897a33e627565194a2ef0ab21151ed23618c32467ebbe8f34f4c9a8e66e695691405d298f14d90906d5efa0fa7c37e87e95

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv\Default\Preferences
                  Filesize

                  6KB

                  MD5

                  55bd98756011d4c3b1a05ae58c7dd136

                  SHA1

                  428579d0d018b45835ba2f61e5f9c8c85209dd53

                  SHA256

                  6969c43aaecef2d60559daa8e858883c4701e9ab2f7aa13b31ae8d5468bd49c4

                  SHA512

                  5a5b16742c554e786050ad18663570d0ba798dd96c8cd6ec748b727563b58e00cb586fd08407ef132a4caeffe6080516cef22bc7c77f9d79395fe52b68389b45

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv\Default\Preferences~RFe592ef6.TMP
                  Filesize

                  5KB

                  MD5

                  97d4effcbc05114844844badbf388d9c

                  SHA1

                  93e41664ec523f136aed8099abb8559daf458719

                  SHA256

                  6e5816a9dabacfeb399b2e637f934a981f57bb3823074539f447a9abcc656f93

                  SHA512

                  25a32b7fabb2b6e2c0678df2c455677f7513be0c1464d69635f0069a9260e005b6de7087ea32d5585a8c5ece13aee3f8ba376ab89ff32baed189228f4a7ec4e4

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv\Default\Site Characteristics Database\CURRENT
                  Filesize

                  16B

                  MD5

                  46295cac801e5d4857d09837238a6394

                  SHA1

                  44e0fa1b517dbf802b18faf0785eeea6ac51594b

                  SHA256

                  0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                  SHA512

                  8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv\GrShaderCache\data_0
                  Filesize

                  8KB

                  MD5

                  cf89d16bb9107c631daabf0c0ee58efb

                  SHA1

                  3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

                  SHA256

                  d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

                  SHA512

                  8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv\GrShaderCache\data_2
                  Filesize

                  8KB

                  MD5

                  0962291d6d367570bee5454721c17e11

                  SHA1

                  59d10a893ef321a706a9255176761366115bedcb

                  SHA256

                  ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

                  SHA512

                  f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv\GrShaderCache\data_3
                  Filesize

                  8KB

                  MD5

                  41876349cb12d6db992f1309f22df3f0

                  SHA1

                  5cf26b3420fc0302cd0a71e8d029739b8765be27

                  SHA256

                  e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

                  SHA512

                  e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv\Local State
                  Filesize

                  3KB

                  MD5

                  99b68870acc9f00e9a7be0ce60434adc

                  SHA1

                  e4fcfff01bfbb883f6c71ddfe073396078ce6aad

                  SHA256

                  d8ddaa326ea661e22730dfecd1e42afeaa295bc6dd63c7eaafef6c8c8fc80fdc

                  SHA512

                  98c276a60106f11dbf47113ea76f1a8335fc88b5c0ece26204e43c898892d0567726e1c99624b90aa1c5df72791a101266dc67094d3d44f5d049989c5e967a54

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv\Local State
                  Filesize

                  3KB

                  MD5

                  f6eea31953b6e758763f46ba5f096468

                  SHA1

                  c904c841e04d7c1592ad3342a67b7f062158f1a7

                  SHA256

                  9c70e95eada3209aecee47a99106277693bc71f7d9135b4d337b2be8eccaaddb

                  SHA512

                  847e44329524f254b8acb2b6b5181b237205420254e9dffa3e12cd70ab537df81c19adfce58005790b6e74e61eefab4c27f4d5f87e2f91489fe7f8616db59b0e

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv\Local State
                  Filesize

                  3KB

                  MD5

                  ae60cec2aa11a20214e430fc9e5db627

                  SHA1

                  699b86a5b6319344aa4d3a497b04d5fe9474b4eb

                  SHA256

                  63a82721c4f10a05df186b0619593d59f99f6294d0b8728fd88b9baa649d60ba

                  SHA512

                  abfe548637e98c47bacc02827c9e36afc16b3629df8f5df2289b3bb004727c36b1b21c36f2a93fd4f1adbdd7b2d0389313c8d65e255d6390d886eae72a1cb641

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv\Local State~RFe58f42f.TMP
                  Filesize

                  914B

                  MD5

                  11c34d5d22eae9b6410b24a92cf3dcfc

                  SHA1

                  76eb1695c40849f2b4821da2e8ca555413577e35

                  SHA256

                  62f6cb9f0d2f72bd74c4a3f7368332cd4d25538d411a4a16eeb17815523e8209

                  SHA512

                  3ac9980e75506b24145b703a8f4f3b59f34cc4e0ab77bec21b9f76a2d605784401fc973236dfe8ed3481ecc84d143cf8af1944a92c86964b3433d1b9b789d5b5

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\lxoyerym.ymv\ShaderCache\data_1
                  Filesize

                  264KB

                  MD5

                  d0d388f3865d0523e451d6ba0be34cc4

                  SHA1

                  8571c6a52aacc2747c048e3419e5657b74612995

                  SHA256

                  902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

                  SHA512

                  376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\vcredist.tmp
                  Filesize

                  13.2MB

                  MD5

                  8457542fd4be74cb2c3a92b3386ae8e9

                  SHA1

                  198722b4f5fc62721910569d9d926dce22730c22

                  SHA256

                  a32dd41eaab0c5e1eaa78be3c0bb73b48593de8d97a7510b97de3fd993538600

                  SHA512

                  91a6283f774f9e2338b65aa835156854e9e76aed32f821b13cfd070dd6c87e1542ce2d5845beb5e4af1ddb102314bb6e0ad6214d896bb3e387590a01eae0c182

                  Download Submit

                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log
                  Filesize

                  155KB

                  MD5

                  0c6708dfeeaae45a36f0af69fde3b4d9

                  SHA1

                  80c1f39ba1323f19c4509624868cc979ddb66a65

                  SHA256

                  2e805b5d32c33d169b882b9289a8e49ae25ec9d8c4909deb9e47ea0d07031ed0

                  SHA512

                  56d5f1a6f896cbd1e18b5a11298347b459f977413c8d7105d4bae4bc6de888149ac4011c4ada53af8009212b50c7671025f59d5b2c54e3bce50fe55acb917a05

                  Download Submit

                • C:\Windows\Temp\{3FF8E52B-E95F-44F0-BA8C-ECEB2F756BAA}\.cr\vcredist.tmp
                  Filesize

                  634KB

                  MD5

                  337b547d2771fdad56de13ac94e6b528

                  SHA1

                  3aeecc5933e7d8977e7a3623e8e44d4c3d0b4286

                  SHA256

                  81873c2f6c8bc4acaad66423a1b4d90e70214e59710ea7f11c8aeb069acd4cd0

                  SHA512

                  0d0102fafb7f471a6836708d81952f2c90c2b126ad1b575f2e2e996540c99f7275ebd1f570cafcc945d26700debb1e86b19b090ae5cdec2326dd0a6a918b7a36

                  Download Submit

                • C:\Windows\Temp\{602264DA-4BAA-4097-871C-B6090A8E3A7C}\.ba\logo.png
                  Filesize

                  1KB

                  MD5

                  d6bd210f227442b3362493d046cea233

                  SHA1

                  ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

                  SHA256

                  335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

                  SHA512

                  464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

                  Download Submit

                • C:\Windows\Temp\{602264DA-4BAA-4097-871C-B6090A8E3A7C}\.ba\wixstdba.dll
                  Filesize

                  191KB

                  MD5

                  eab9caf4277829abdf6223ec1efa0edd

                  SHA1

                  74862ecf349a9bedd32699f2a7a4e00b4727543d

                  SHA256

                  a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

                  SHA512

                  45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

                  Download Submit

                • C:\Windows\Temp\{602264DA-4BAA-4097-871C-B6090A8E3A7C}\cab54A5CABBE7274D8A22EB58060AAB7623
                  Filesize

                  822KB

                  MD5

                  25bd21af44d3968a692e9b8a85f5c11d

                  SHA1

                  d805d1624553199529a82151f23a1330ac596888

                  SHA256

                  f4576ef2e843c282d2a932f7c55d71cc3fcbb35b0a17a0a640eb5f21731cc809

                  SHA512

                  ed3660183bf4e0d39e4f43a643007afc143b1d4ec0b45f0fdce28d8e896f646ec24a2a7a5429e8b10f4379cb4ffd1572adba10fc426990d05c0cafefdd87a4fb

                  Download Submit

                • C:\Windows\Temp\{602264DA-4BAA-4097-871C-B6090A8E3A7C}\cabB3E1576D1FEFBB979E13B1A5379E0B16
                  Filesize

                  4.9MB

                  MD5

                  3a7979fbe74502ddc0a9087ee9ca0bdf

                  SHA1

                  3c63238363807c2f254163769d0a582528e115af

                  SHA256

                  7327d37634cc8e966342f478168b8850bea36a126d002c38c7438a7bd557c4ca

                  SHA512

                  6435db0f210ad317f4cd00bb3300eb41fb86649f7a0e3a05e0f64f8d0163ab53dbdb3c98f99a15102ce09fcd437a148347bab7bfd4afe4c90ff2ea05bb4febff

                  Download Submit

                • C:\Windows\Temp\{602264DA-4BAA-4097-871C-B6090A8E3A7C}\vcRuntimeAdditional_x86
                  Filesize

                  180KB

                  MD5

                  2ba51e907b5ee6b2aef6dfe5914ae3e3

                  SHA1

                  6cc2c49734bf9965fe0f3977705a417ed8548718

                  SHA256

                  be137dc2b1ec7e85ae7a003a09537d3706605e34059361404ea3110874895e3a

                  SHA512

                  e3ba5aa8f366e3b1a92d8258daa74f327248fb21f168b7472b035f8d38f549f5f556eb9093eb8483ca51b78e9a77ee6e5b6e52378381cce50918d81e8e982d47

                  Download Submit

                • C:\Windows\Temp\{602264DA-4BAA-4097-871C-B6090A8E3A7C}\vcRuntimeMinimum_x86
                  Filesize

                  180KB

                  MD5

                  828f217e9513cfff708ffe62d238cfc5

                  SHA1

                  9fb65d4edb892bf940399d5fd6ae3a4b15c2e4ba

                  SHA256

                  a2ad58d741be5d40af708e15bf0dd5e488187bf28f0b699d391a9ef96f899886

                  SHA512

                  ffc72b92f1431bbd07889e28b55d14ea11f8401e2d0b180e43a898914209893941affacc0a4ea34eeefc9b0ca4bc84a3045591cd98aae6bdb11ae831dc6bb121

                  Download Submit

                • memory/1644-429-0x0000000000390000-0x0000000000407000-memory.dmp

                  Filesize

                  476KB

                  Download

                • memory/2452-466-0x0000000000390000-0x0000000000407000-memory.dmp

                  Filesize

                  476KB

                  Download

                • memory/2548-1-0x0000000000650000-0x0000000000BBC000-memory.dmp

                  Filesize

                  5.4MB

                  Download

                • memory/2548-2-0x0000000005BF0000-0x0000000006194000-memory.dmp

                  Filesize

                  5.6MB

                  Download

                • memory/2548-4-0x0000000005540000-0x0000000005586000-memory.dmp

                  Filesize

                  280KB

                  Download

                • memory/2548-3-0x0000000075230000-0x00000000759E0000-memory.dmp

                  Filesize

                  7.7MB

                  Download

                • memory/2548-5-0x00000000056E0000-0x0000000005772000-memory.dmp

                  Filesize

                  584KB

                  Download

                • memory/2548-6-0x00000000055D0000-0x00000000055F6000-memory.dmp

                  Filesize

                  152KB

                  Download

                • memory/2548-7-0x0000000005610000-0x000000000562E000-memory.dmp

                  Filesize

                  120KB

                  Download

                • memory/2548-0-0x000000007523E000-0x000000007523F000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/2548-14-0x0000000075230000-0x00000000759E0000-memory.dmp

                  Filesize

                  7.7MB

                  Download

                • memory/3260-467-0x0000000000390000-0x0000000000407000-memory.dmp

                  Filesize

                  476KB

                  Download

                • memory/3892-929-0x000002C574CC0000-0x000002C5753E9000-memory.dmp

                  Filesize

                  7.2MB

                  Download

                • memory/4056-34-0x000000000DB00000-0x000000000DB22000-memory.dmp

                  Filesize

                  136KB

                  Download

                • memory/4056-26-0x000000000BEC0000-0x000000000BF60000-memory.dmp

                  Filesize

                  640KB

                  Download

                • memory/4056-274-0x00000000058A0000-0x00000000058A8000-memory.dmp

                  Filesize

                  32KB

                  Download

                • memory/4056-273-0x0000000007340000-0x0000000007390000-memory.dmp

                  Filesize

                  320KB

                  Download

                • memory/4056-271-0x0000000075230000-0x00000000759E0000-memory.dmp

                  Filesize

                  7.7MB

                  Download

                • memory/4056-270-0x0000000075230000-0x00000000759E0000-memory.dmp

                  Filesize

                  7.7MB

                  Download

                • memory/4056-586-0x0000000005720000-0x0000000005730000-memory.dmp

                  Filesize

                  64KB

                  Download

                • memory/4056-588-0x00000000057B0000-0x00000000057B8000-memory.dmp

                  Filesize

                  32KB

                  Download

                • memory/4056-102-0x0000000007220000-0x000000000722A000-memory.dmp

                  Filesize

                  40KB

                  Download

                • memory/4056-103-0x0000000007250000-0x0000000007262000-memory.dmp

                  Filesize

                  72KB

                  Download

                • memory/4056-100-0x0000000075230000-0x00000000759E0000-memory.dmp

                  Filesize

                  7.7MB

                  Download

                • memory/4056-37-0x000000000DC50000-0x000000000DC58000-memory.dmp

                  Filesize

                  32KB

                  Download

                • memory/4056-36-0x000000000DC20000-0x000000000DC3A000-memory.dmp

                  Filesize

                  104KB

                  Download

                • memory/4056-587-0x0000000005780000-0x0000000005794000-memory.dmp

                  Filesize

                  80KB

                  Download

                • memory/4056-758-0x0000000007270000-0x000000000727A000-memory.dmp

                  Filesize

                  40KB

                  Download

                • memory/4056-297-0x0000000075230000-0x00000000759E0000-memory.dmp

                  Filesize

                  7.7MB

                  Download

                • memory/4056-35-0x000000000DB30000-0x000000000DC24000-memory.dmp

                  Filesize

                  976KB

                  Download

                • memory/4056-33-0x000000000D900000-0x000000000D9B2000-memory.dmp

                  Filesize

                  712KB

                  Download

                • memory/4056-31-0x000000000D820000-0x000000000D878000-memory.dmp

                  Filesize

                  352KB

                  Download

                • memory/4056-272-0x0000000005880000-0x0000000005894000-memory.dmp

                  Filesize

                  80KB

                  Download

                • memory/4056-25-0x000000000BEA0000-0x000000000BEAA000-memory.dmp

                  Filesize

                  40KB

                  Download

                • memory/4056-24-0x0000000075230000-0x00000000759E0000-memory.dmp

                  Filesize

                  7.7MB

                  Download

                • memory/4056-23-0x000000000B340000-0x000000000B37A000-memory.dmp

                  Filesize

                  232KB

                  Download

                • memory/4056-22-0x0000000075230000-0x00000000759E0000-memory.dmp

                  Filesize

                  7.7MB

                  Download

                • memory/4056-20-0x0000000006620000-0x000000000662A000-memory.dmp

                  Filesize

                  40KB

                  Download

                • memory/4056-19-0x0000000006480000-0x00000000064F4000-memory.dmp

                  Filesize

                  464KB

                  Download

                • memory/4056-16-0x0000000075230000-0x00000000759E0000-memory.dmp

                  Filesize

                  7.7MB

                  Download

                • memory/4056-15-0x0000000075230000-0x00000000759E0000-memory.dmp

                  Filesize

                  7.7MB

                  Download

                • memory/4056-308-0x000000000E490000-0x000000000E7E4000-memory.dmp

                  Filesize

                  3.3MB

                  Download

                • memory/4056-531-0x000000006E7C0000-0x000000006E7D5000-memory.dmp

                  Filesize

                  84KB

                  Download

                • memory/4056-1343-0x0000000005AF0000-0x0000000005B06000-memory.dmp

                  Filesize

                  88KB

                  Download

                • memory/4056-582-0x00000000056C0000-0x00000000056CA000-memory.dmp

                  Filesize

                  40KB

                  Download

                • memory/4056-583-0x00000000056E0000-0x00000000056EA000-memory.dmp

                  Filesize

                  40KB

                  Download

                • memory/4056-584-0x0000000005700000-0x0000000005714000-memory.dmp

                  Filesize

                  80KB

                  Download

                • memory/4056-585-0x0000000005730000-0x000000000576E000-memory.dmp

                  Filesize

                  248KB

                  Download

                • memory/4156-637-0x00007FFC600C0000-0x00007FFC600C1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/4156-638-0x00007FFC61C70000-0x00007FFC61C71000-memory.dmp

                  Filesize

                  4KB

                  Download