Overview

overview

8

Static

static

3

Roblox.Acc....2.zip

windows11-21h2-x64

1

Roblox Acc...er.exe

windows11-21h2-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    346s
  • max time network
    340s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    16/04/2026, 15:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Roblox Account Manager.exe
  • Size 5.4MB
  • Sample260416-tcb2faev5n
  • SHA256 be9ddcdedf8c36c64e6b0a32d2686b74a112913c54217ccaa46675bfd1dc82f1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarecredential_accessdiscoveryexecutionpersistenceransomwarespywarestealer

Malware Config

Signatures

  • Uses browser remote debugging 2 TTPs 4 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Executes dropped EXE 21 IoCs
  • Loads dropped DLL 42 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 49 IoCs
  • Drops file in Windows directory 24 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 11 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe
    "C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2136
    • C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe
      "C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe" -restart
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:6104
      • C:\Users\Admin\AppData\Local\Temp\vcredist.tmp
        "C:\Users\Admin\AppData\Local\Temp\vcredist.tmp" /q /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5112
        • C:\Windows\Temp\{D7D585F0-6476-42E8-A72C-AA1320BB2D91}\.cr\vcredist.tmp
          "C:\Windows\Temp\{D7D585F0-6476-42E8-A72C-AA1320BB2D91}\.cr\vcredist.tmp" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\vcredist.tmp" -burn.filehandle.attached=728 -burn.filehandle.self=732 /q /norestart
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5436
          • C:\Windows\Temp\{0920241F-B162-4307-B496-7949AC738AFC}\.be\VC_redist.x86.exe
            "C:\Windows\Temp\{0920241F-B162-4307-B496-7949AC738AFC}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{86BF2141-BB30-4737-856F-800C57F7FCCE} {751FE978-C349-49BC-8259-8F417BB75D4B} 5436
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:5424
            • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
              "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={0b5169e3-39da-4313-808e-1f9c0407f3bf} -burn.filehandle.self=984 -burn.embedded BurnPipe.{871AD9C4-26D8-40C6-87CF-01D82DFB27E7} {0038901A-53E7-44BE-8609-6BF5D49981C6} 5424
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5732
              • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=544 -burn.filehandle.self=560 -uninstall -quiet -burn.related.upgrade -burn.ancestors={0b5169e3-39da-4313-808e-1f9c0407f3bf} -burn.filehandle.self=984 -burn.embedded BurnPipe.{871AD9C4-26D8-40C6-87CF-01D82DFB27E7} {0038901A-53E7-44BE-8609-6BF5D49981C6} 5424
                7⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:464
                • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                  "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{A8C5D4A7-108A-46B6-A67E-819F8CF4C97C} {4D809354-D132-4F72-8874-E151C139F9BB} 464
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:4284
      • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
        "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --allow-pre-commit-input --disable-background-networking --disable-background-timer-throttling --disable-backgrounding-occluded-windows --disable-breakpad --disable-client-side-phishing-detection --disable-component-extensions-with-background-pages --disable-component-update --disable-default-apps --disable-dev-shm-usage --disable-extensions --disable-field-trial-config --disable-hang-monitor --disable-infobars --disable-ipc-flooding-protection --disable-popup-blocking --disable-prompt-on-repost --disable-renderer-backgrounding --disable-search-engine-choice-screen --disable-sync --enable-automation --enable-blink-features=IdleDetection --export-tagged-pdf --generate-pdf-document-outline --force-color-profile=srgb --metrics-recording-only --no-first-run --password-store=basic --use-mock-keychain --disable-features=Translate,AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold --enable-features= about:blank --disable-web-security --window-size="880,740" --window-position="520,146" --remote-debugging-port=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb"
        3⤵
        • Uses browser remote debugging
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:752
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb\Crashpad --annotation=plat=Win64 "--annotation=prod=Google Chrome for Testing" --annotation=ver=124.0.6367.201 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff9a1acc70,0x7fff9a1acc7c,0x7fff9a1acc88
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5816
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=gpu-process --disable-breakpad --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb" --no-appcompat-clear --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2000,i,18072598791306738261,456358190167805604,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=1996 /prefetch:2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3616
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb" --no-appcompat-clear --start-stack-profiler --field-trial-handle=1820,i,18072598791306738261,456358190167805604,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:3
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2384
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb" --no-appcompat-clear --field-trial-handle=2180,i,18072598791306738261,456358190167805604,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=1808 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1732
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb" --no-appcompat-clear --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --allow-pre-commit-input --enable-blink-features=IdleDetection --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2988,i,18072598791306738261,456358190167805604,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=3156 /prefetch:1
          4⤵
          • Uses browser remote debugging
          • Executes dropped EXE
          • Loads dropped DLL
          PID:660
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb" --no-appcompat-clear --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --allow-pre-commit-input --enable-blink-features=IdleDetection --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2992,i,18072598791306738261,456358190167805604,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:1
          4⤵
          • Uses browser remote debugging
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1036
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb" --no-appcompat-clear --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --allow-pre-commit-input --disable-gpu-compositing --enable-blink-features=IdleDetection --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4396,i,18072598791306738261,456358190167805604,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:1
          4⤵
          • Uses browser remote debugging
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5700
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb" --no-appcompat-clear --field-trial-handle=4852,i,18072598791306738261,456358190167805604,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:568
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb" --no-appcompat-clear --field-trial-handle=4876,i,18072598791306738261,456358190167805604,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4820
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb" --no-appcompat-clear --field-trial-handle=4560,i,18072598791306738261,456358190167805604,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1968
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --disable-breakpad --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb" --no-appcompat-clear --start-stack-profiler --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1108,i,18072598791306738261,456358190167805604,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          PID:3948
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb" --no-appcompat-clear --field-trial-handle=4724,i,18072598791306738261,456358190167805604,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5212
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb" --no-appcompat-clear --field-trial-handle=3352,i,18072598791306738261,456358190167805604,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=216 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2860
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c start ms-settings:developers
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1868
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command "Get-AppxPackage *Roblox* | Format-List -Property InstallLocation"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4928
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command "Get-AppxPackage ROBLOXCORPORATION.ROBLOX.* | Format-List -Property Name, PackageFullName"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:5740
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command "Get-AppxPackage *Roblox* | Format-List -Property InstallLocation"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4240
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command "Get-AppxPackage ROBLOXCORPORATION.ROBLOX.* | Format-List -Property Name, PackageFullName"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:104
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:2212
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
      PID:3144
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Badlisted process makes network request
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4920
    • C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
      "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" /burn.runonce
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1276
      • C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
        "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260416165529.log"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4764
        • C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
          "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -burn.filehandle.attached=548 -burn.filehandle.self=564 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260416165529.log"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5776
          • C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
            "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{0E7CE73F-3C58-4DD9-A65A-6BCD46ADD1FC} {571ADB9A-37AB-4564-AECA-7324856A166A} 5776
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:4592
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
      1⤵
        PID:6136
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
        1⤵
          PID:3672
        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
          1⤵
          • Suspicious use of SetWindowsHookEx
          PID:4468
        • C:\Windows\system32\SystemSettingsAdminFlows.exe
          "C:\Windows\system32\SystemSettingsAdminFlows.exe" TurnOnDeveloperFeatures DeveloperUnlock
          1⤵
          • Suspicious use of SetWindowsHookEx
          PID:5108

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              e58d513.rbs
              • Path C:\Config.Msi\e58d513.rbs
              • Size 16KB
              • SHA256 b81bb1c8eb7ca0ea46126ee8306ed9292710228d29abf0e13fbd28b1523ba56b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              e58d518.rbs
              • Path C:\Config.Msi\e58d518.rbs
              • Size 18KB
              • SHA256 43402509a1ef0fd5889cf6f80f946fb71784d45ea1df21d119e94bd1817a9c27
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              e58d525.rbs
              • Path C:\Config.Msi\e58d525.rbs
              • Size 20KB
              • SHA256 da7e53003fcf83dcda519d6be51995e0836bfa65d62ffca544efc9d26c2b195f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              e58d534.rbs
              • Path C:\Config.Msi\e58d534.rbs
              • Size 19KB
              • SHA256 21d693ee85c955293e06ab2f6a6ac1c000e2ea7c5fdb734b53d5d28b5b9c2880
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              state.rsm
              • Path C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\state.rsm
              • Size 914B
              • SHA256 74d8b860d1c83f3f8bd8475909411851ab97f21f923c5a936af422a91ece5999
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Roblox Account Manager.exe.log
              • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Roblox Account Manager.exe.log
              • Size 1KB
              • SHA256 180f825c19263ae06fc891efcde51f993b720a27bd6e563742a110b40cb3fe41
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              D3DCompiler_47.dll
              • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\D3DCompiler_47.dll
              • Size 4.7MB
              • SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrome.exe
              • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
              • Size 2.5MB
              • SHA256 613536f294de53d1e9bb53a31269300fef4427f5e461ff6c7a1de3fa88c7667c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrome_100_percent.pak
              • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome_100_percent.pak
              • Size 665KB
              • SHA256 329113e1ab3c6ac34d8375fd0a66e6ba12c1c49675101d10e231316b5a14c8c2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrome_200_percent.pak
              • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome_200_percent.pak
              • Size 1.0MB
              • SHA256 3cd793c813d79579e5dafb3b63204e2ccb525f6b27a6dc25525c9fafabce4d29
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrome_elf.dll
              • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome_elf.dll
              • Size 1.2MB
              • SHA256 0d2ccf801ceabba978a77238e1b79afc9a66983a11c07e011f876c063a71ffdb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              icudtl.dat
              • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\icudtl.dat
              • Size 10.2MB
              • SHA256 7bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              libEGL.dll
              • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\libEGL.dll
              • Size 460KB
              • SHA256 89c3cf5576b06b8114450f55f16f5fa0c2197db45a7ef0e57bc0eda872dcd6f5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              libGLESv2.dll
              • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\libGLESv2.dll
              • Size 7.6MB
              • SHA256 6cebea494ff17a5ec8c54b7fd5e13834eae556178ac42e7eab545263646aa080
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              en-US.pak
              • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\locales\en-US.pak
              • Size 394KB
              • SHA256 92efd174fffe9e958e20edf1acdb9394ce81ae38b9d1a04203cb35585ecbb5b7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              resources.pak
              • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\resources.pak
              • Size 8.0MB
              • SHA256 103ba11595d71025abc07c1f32e9f0fa11d9a191afeba6ee950154c5b358ac0b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              v8_context_snapshot.bin
              • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\v8_context_snapshot.bin
              • Size 641KB
              • SHA256 ddd3a5acffc4e8d6b9211c84733debdf394c3cb12d702598e1a5e56b13c89c61
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vk_swiftshader_icd.json
              • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\vk_swiftshader_icd.json
              • Size 106B
              • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              vulkan-1.dll
              • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\vulkan-1.dll
              • Size 925KB
              • SHA256 d8e0d487912f248f867ac88d3b0754cb106b73a4fc4c8a1e4db1dec6c4180f84
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              RAMSettings.ini
              • Path C:\Users\Admin\AppData\Local\Temp\RAMSettings.ini
              • Size 1014B
              • SHA256 787fa9af1c32b7e198119469c0e2c02c06b34ec7c990b62b9f4fb9bc8cedaa5f
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              RAMTheme.ini
              • Path C:\Users\Admin\AppData\Local\Temp\RAMTheme.ini
              • Size 314B
              • SHA256 563eb35fd613f4298cd4dceff67652a13ba516a6244d9407c5709323c4ca4bb1
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Roblox Account Manager.exe.config
              • Path C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe.config
              • Size 6KB
              • SHA256 2b6d99db8369b0ff6372737d89d1c9e4101815b4168a3852c7b513f2897e7f3d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              __PSScriptPolicyTest_3zupac5s.wz3.ps1
              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3zupac5s.wz3.ps1
              • Size 60B
              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              dd_vcredist_x86_20260416165529.log
              • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260416165529.log
              • Size 17KB
              • SHA256 cc778e025fd8e7c763772428d0e5e06a06bf90c55b3e080ee3c8e0d5d93e019a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dd_vcredist_x86_20260416165529_000_vcRuntimeMinimum_x86.log
              • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260416165529_000_vcRuntimeMinimum_x86.log
              • Size 2KB
              • SHA256 58a1ff8f8aa597f068f924d23925ff84f6d99ca0f8259ca6ca1fce536576b4db
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              dd_vcredist_x86_20260416165529_001_vcRuntimeAdditional_x86.log
              • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260416165529_001_vcRuntimeAdditional_x86.log
              • Size 2KB
              • SHA256 6951e53781f94366a9bcda34462ef360d0f84d26770a0e02f85e3ae9dc8c8ef4
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              the-real-index
              • Path C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb\Default\Code Cache\js\index-dir\the-real-index
              • Size 2KB
              • SHA256 9f83153ed4be64ba795ba50fea136dbf50791f562e6799d5c6722d844fa960e0
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              the-real-index
              • Path C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb\Default\Code Cache\js\index-dir\the-real-index
              • Size 3KB
              • SHA256 83088b6867bd678b82f7c5b0d71d2a894ceaa3cf9ace89f15489948eb0237537
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              the-real-index
              • Path C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb\Default\Code Cache\js\index-dir\the-real-index
              • Size 3KB
              • SHA256 5f14d8f216772102219b2af4f6a2947a22f8774c251d7ca3a2ab60d2d0e01bdb
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              the-real-index
              • Path C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb\Default\Code Cache\js\index-dir\the-real-index
              • Size 48B
              • SHA256 21edf9945f225bd331d3fc72267873105874ae1a86bd1f7ed36d895c88391247
              • MD5 SHA1 SHA512
              Submit Download

              MANIFEST-000001
              • Path C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb\Default\Extension Rules\MANIFEST-000001
              • Size 41B
              • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
              • MD5 SHA1 SHA512
              Submit Download

              Network Persistent State
              • Path C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb\Default\Network\Network Persistent State
              • Size 1KB
              • SHA256 e9d90ce6a68d647662a14cc223a734b294ffdcc1c8185471eab9051faa26ae07
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Network Persistent State
              • Path C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb\Default\Network\Network Persistent State
              • Size 2KB
              • SHA256 bd179ddc494d007ed02cf7356586ecc8be3d23f7a191326e562c3915fb685bf9
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Network Persistent State~RFe5aa70f.TMP
              • Path C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb\Default\Network\Network Persistent State~RFe5aa70f.TMP
              • Size 59B
              • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              SCT Auditing Pending Reports
              • Path C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb\Default\Network\SCT Auditing Pending Reports
              • Size 2B
              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
              • MD5 SHA1 SHA512
              Submit Download

              TransportSecurity
              • Path C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb\Default\Network\TransportSecurity
              • Size 1KB
              • SHA256 a68f527ef02178632bf320dead1d3e3fc2311b5f318b6d6facc9ab5fb6af8184
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              TransportSecurity
              • Path C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb\Default\Network\TransportSecurity
              • Size 1KB
              • SHA256 a59dcc856472cbe0508da9101e2162b7d518bea914da45b1fce851d4eb301bed
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              TransportSecurity
              • Path C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb\Default\Network\TransportSecurity
              • Size 2KB
              • SHA256 2eb6557e918b00bf755edd5f88b32334dcca04ada59615d88e90f0a9c451e5be
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              TransportSecurity
              • Path C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb\Default\Network\TransportSecurity
              • Size 1KB
              • SHA256 c9efc196833aba5bfb8fafb0aa5f9a8e6635f5c942f7c861f81adbfb7b88e561
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              TransportSecurity
              • Path C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb\Default\Network\TransportSecurity
              • Size 2KB
              • SHA256 24cc12db86f098177abdb3f23ffa0acd001edb1acb19edd91d399212233f2686
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              TransportSecurity
              • Path C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb\Default\Network\TransportSecurity
              • Size 1KB
              • SHA256 24fc2f999a654d362821a740cd7cbc12cdb3fe2cf95648a3f65a7218ab9cfb3f
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              TransportSecurity
              • Path C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb\Default\Network\TransportSecurity
              • Size 1KB
              • SHA256 288d6364ce4fefcaaec5e94b920b37d72f194fe1ed052828f7e6aa600a1e2097
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              TransportSecurity
              • Path C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb\Default\Network\TransportSecurity
              • Size 2KB
              • SHA256 569e2fdcacf0198fe5dc5d5acc8d003a690c40ad3356ea2f2a12f21e873bf076
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              TransportSecurity
              • Path C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb\Default\Network\TransportSecurity
              • Size 1KB
              • SHA256 1e5aa9d43874157859c84d01e89e770a19f28ab18a7e17e3070240d298213703
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              TransportSecurity
              • Path C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb\Default\Network\TransportSecurity
              • Size 1KB
              • SHA256 b1c5fb8c2ef618fce575d0e43ef5e2381a2d30c24cd72466925c4464b2e6e424
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              TransportSecurity
              • Path C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb\Default\Network\TransportSecurity
              • Size 2KB
              • SHA256 c2489bb33a6b3e8d5b9ed39f3196b9ec2cfdf6b1943561f78bff9f0e07df1cde
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              TransportSecurity
              • Path C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb\Default\Network\TransportSecurity
              • Size 2KB
              • SHA256 d8287ddfb316df385dfefcfdbca77f325d3f8ce667d8eb40c5dc34d432ad4bb5
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              TransportSecurity
              • Path C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb\Default\Network\TransportSecurity
              • Size 2KB
              • SHA256 0c9f01f3b926474ac40f2f83f09c97beabed991d1710eaa1129fa7146c0f67ec
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              TransportSecurity
              • Path C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb\Default\Network\TransportSecurity
              • Size 1KB
              • SHA256 f31bedff8f1ce6c4e2d07acb021ce3b994bb0550f452bd5f075377be08ea2e93
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              TransportSecurity~RFe59ec4a.TMP
              • Path C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb\Default\Network\TransportSecurity~RFe59ec4a.TMP
              • Size 1KB
              • SHA256 d76b6f98110faf01f5328c136f2bad19e999b4e8156b4f14a4a79a8ff79c92d8
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Preferences
              • Path C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb\Default\Preferences
              • Size 5KB
              • SHA256 75f599f0f090c91d8bb2f9787a87f801c9b75964f64241e354b34a4d67c71e63
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Preferences
              • Path C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb\Default\Preferences
              • Size 6KB
              • SHA256 36cafd7131352df934db14fbd02da6ce2f08b03c731ab73d9641619863fd54f4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Preferences
              • Path C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb\Default\Preferences
              • Size 5KB
              • SHA256 a8a392b9dc8632dd35ef4593a95dd09ff8f43d3cd99dda3fed70bf9510a3f2d5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Preferences
              • Path C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb\Default\Preferences
              • Size 5KB
              • SHA256 57d83f070615a9d8f41364e9ebeba9adc8c0d02a447f807f5de130ed70c2c155
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Preferences~RFe59f459.TMP
              • Path C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb\Default\Preferences~RFe59f459.TMP
              • Size 5KB
              • SHA256 8de48f5ad98a8310dd5f119f75ad3fd1ff18b14706a58116ee2c157126f75ea8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              CURRENT
              • Path C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb\Default\Site Characteristics Database\CURRENT
              • Size 16B
              • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
              • MD5 SHA1 SHA512
              Submit Download

              data_0
              • Path C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb\GrShaderCache\data_0
              • Size 8KB
              • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              data_1
              • Path C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb\GrShaderCache\data_1
              • Size 264KB
              • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              data_2
              • Path C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb\GrShaderCache\data_2
              • Size 8KB
              • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              data_3
              • Path C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb\GrShaderCache\data_3
              • Size 8KB
              • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Local State
              • Path C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb\Local State
              • Size 3KB
              • SHA256 1f948d4b7f42012140fdcc5b4b13b0c0795ba0747d99de8548b86d6b2eb6c146
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Local State~RFe59b79e.TMP
              • Path C:\Users\Admin\AppData\Local\Temp\kxycxt14.qdb\Local State~RFe59b79e.TMP
              • Size 914B
              • SHA256 a57b01fb893a3183bad617d3e0f1a888a357de940ecb1bf08d3df4ce0f7db9c5
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              libsodium.dll
              • Path C:\Users\Admin\AppData\Local\Temp\libsodium.dll
              • Size 477KB
              • SHA256 7a960129f6d3f8d44b4c6be27f587c29aa8bafb9c4d3c85bb84a5f5d8fa6e2ba
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              log4.config
              • Path C:\Users\Admin\AppData\Local\Temp\log4.config
              • Size 936B
              • SHA256 e4b10630d9ec2af508de31752fbbc6816c7426c40a3e57f0a085ce7f42c77bd5
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              vcredist.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\vcredist.tmp
              • Size 13.3MB
              • SHA256 0c09f2611660441084ce0df425c51c11e147e6447963c3690f97e0b25c55ed64
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VCRUNTIME140.dll
              • Path C:\Windows\SysWOW64\VCRUNTIME140.dll
              • Size 89KB
              • SHA256 a9d7732a3c3de09f0601a7fa2555093dcb49f08e2fc62a86091461f0f38393ed
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              logo.png
              • Path C:\Windows\Temp\{0920241F-B162-4307-B496-7949AC738AFC}\.ba\logo.png
              • Size 1KB
              • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              wixstdba.dll
              • Path C:\Windows\Temp\{0920241F-B162-4307-B496-7949AC738AFC}\.ba\wixstdba.dll
              • Size 215KB
              • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              cab54A5CABBE7274D8A22EB58060AAB7623
              • Path C:\Windows\Temp\{0920241F-B162-4307-B496-7949AC738AFC}\cab54A5CABBE7274D8A22EB58060AAB7623
              • Size 838KB
              • SHA256 c9935322c0af2fe00ebb018f8b0b908018576048fa4d3c0376a30ebf0eb2cf50
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              cabB3E1576D1FEFBB979E13B1A5379E0B16
              • Path C:\Windows\Temp\{0920241F-B162-4307-B496-7949AC738AFC}\cabB3E1576D1FEFBB979E13B1A5379E0B16
              • Size 4.9MB
              • SHA256 01b11076177c8a5ee37eba745142cd6bbc4ac1ebfc4ebe48c85bd285a73ebf60
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vcRuntimeAdditional_x86
              • Path C:\Windows\Temp\{0920241F-B162-4307-B496-7949AC738AFC}\vcRuntimeAdditional_x86
              • Size 200KB
              • SHA256 3e4a528fe5263a5dc44455d0ab2717f0c02acdc120c918cf43730ce9f36ccbb5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vcRuntimeMinimum_x86
              • Path C:\Windows\Temp\{0920241F-B162-4307-B496-7949AC738AFC}\vcRuntimeMinimum_x86
              • Size 200KB
              • SHA256 c5ff4d6cd4be9f4965f93af273dd364948fbe44d40b123f34f82bcbcf64c8df4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              license.rtf
              • Path C:\Windows\Temp\{77F65BAF-B25F-4E1C-B372-6491E5FBF9DE}\.ba\license.rtf
              • Size 9KB
              • SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              thm.wxl
              • Path C:\Windows\Temp\{77F65BAF-B25F-4E1C-B372-6491E5FBF9DE}\.ba\thm.wxl
              • Size 2KB
              • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              thm.xml
              • Path C:\Windows\Temp\{77F65BAF-B25F-4E1C-B372-6491E5FBF9DE}\.ba\thm.xml
              • Size 8KB
              • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wixstdba.dll
              • Path C:\Windows\Temp\{77F65BAF-B25F-4E1C-B372-6491E5FBF9DE}\.ba\wixstdba.dll
              • Size 191KB
              • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vcredist.tmp
              • Path C:\Windows\Temp\{D7D585F0-6476-42E8-A72C-AA1320BB2D91}\.cr\vcredist.tmp
              • Size 669KB
              • SHA256 4a6e1044ff0f49d2e3b12f7c40352c7e573e0c58f3b3cc0b55b63c95ede87828
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/104-1158-0x00000000051B0000-0x00000000051C5000-memory.dmp
              Download

              memory/104-1148-0x000000006D1A0000-0x000000006D1EC000-memory.dmp
              Download

              memory/104-1156-0x0000000002C80000-0x0000000002C8B000-memory.dmp
              Download

              memory/104-1157-0x0000000002D00000-0x0000000002D8A000-memory.dmp
              Download

              memory/104-1159-0x00000000060C0000-0x00000000060F7000-memory.dmp
              Download

              memory/464-477-0x0000000003330000-0x000000000340A000-memory.dmp
              Download

              memory/464-476-0x0000000000A20000-0x0000000000A97000-memory.dmp
              Download

              memory/2136-3-0x00000000055B0000-0x00000000055F6000-memory.dmp
              Download

              memory/2136-2-0x0000000005680000-0x0000000005690000-memory.dmp
              Download

              memory/2136-8-0x0000000005680000-0x0000000005690000-memory.dmp
              Download

              memory/2136-0-0x00000000006D0000-0x0000000000C3C000-memory.dmp
              Download

              memory/2136-1-0x0000000005C40000-0x00000000061E6000-memory.dmp
              Download

              memory/2136-4-0x0000000005730000-0x00000000057C2000-memory.dmp
              Download

              memory/2136-5-0x0000000005610000-0x0000000005636000-memory.dmp
              Download

              memory/2136-15-0x00000000058D0000-0x00000000059AA000-memory.dmp
              Download

              memory/2136-7-0x00000000058D0000-0x00000000059AA000-memory.dmp
              Download

              memory/2136-6-0x0000000005650000-0x000000000566E000-memory.dmp
              Download

              memory/3948-1085-0x0000020C82320000-0x0000020C82321000-memory.dmp
              Download

              memory/3948-1083-0x0000020C82320000-0x0000020C82321000-memory.dmp
              Download

              memory/3948-1086-0x0000020C82320000-0x0000020C82321000-memory.dmp
              Download

              memory/3948-1084-0x0000020C82320000-0x0000020C82321000-memory.dmp
              Download

              memory/3948-1081-0x0000020C82320000-0x0000020C82321000-memory.dmp
              Download

              memory/3948-1087-0x0000020C82320000-0x0000020C82321000-memory.dmp
              Download

              memory/3948-1076-0x0000020C82320000-0x0000020C82321000-memory.dmp
              Download

              memory/3948-1077-0x0000020C82320000-0x0000020C82321000-memory.dmp
              Download

              memory/3948-1082-0x0000020C82320000-0x0000020C82321000-memory.dmp
              Download

              memory/3948-1075-0x0000020C82320000-0x0000020C82321000-memory.dmp
              Download

              memory/4240-1132-0x0000000005410000-0x0000000005425000-memory.dmp
              Download

              memory/4240-1133-0x0000000005430000-0x0000000005467000-memory.dmp
              Download

              memory/4240-1130-0x0000000002C20000-0x0000000002C2B000-memory.dmp
              Download

              memory/4240-1122-0x000000006D1A0000-0x000000006D1EC000-memory.dmp
              Download

              memory/4240-1131-0x0000000002CB0000-0x0000000002D3A000-memory.dmp
              Download

              memory/4284-474-0x00000000035B0000-0x000000000368A000-memory.dmp
              Download

              memory/4284-473-0x0000000000A20000-0x0000000000A97000-memory.dmp
              Download

              memory/4592-503-0x00000000034A0000-0x000000000357A000-memory.dmp
              Download

              memory/4920-1557-0x000001F26A510000-0x000001F26A51C000-memory.dmp
              Download

              memory/4920-505-0x000001F26A510000-0x000001F26A51C000-memory.dmp
              Download

              memory/4928-1049-0x0000000006240000-0x000000000628C000-memory.dmp
              Download

              memory/4928-1060-0x0000000007BD0000-0x000000000824A000-memory.dmp
              Download

              memory/4928-1068-0x0000000004CC0000-0x0000000004D4A000-memory.dmp
              Download

              memory/4928-1069-0x0000000005180000-0x0000000005195000-memory.dmp
              Download

              memory/4928-1070-0x0000000005A90000-0x0000000005AC7000-memory.dmp
              Download

              memory/4928-1067-0x0000000002BF0000-0x0000000002BFB000-memory.dmp
              Download

              memory/4928-1064-0x0000000007800000-0x0000000007826000-memory.dmp
              Download

              memory/4928-1063-0x0000000007420000-0x000000000742A000-memory.dmp
              Download

              memory/4928-1062-0x0000000007600000-0x000000000761C000-memory.dmp
              Download

              memory/4928-1061-0x0000000007580000-0x000000000759A000-memory.dmp
              Download

              memory/4928-1059-0x0000000007430000-0x00000000074D4000-memory.dmp
              Download

              memory/4928-1058-0x0000000007410000-0x000000000742E000-memory.dmp
              Download

              memory/4928-1051-0x000000006D4A0000-0x000000006D4EC000-memory.dmp
              Download

              memory/4928-1050-0x0000000006800000-0x0000000006834000-memory.dmp
              Download

              memory/4928-1037-0x0000000004C80000-0x0000000004CB6000-memory.dmp
              Download

              memory/4928-1038-0x00000000053A0000-0x00000000059CA000-memory.dmp
              Download

              memory/4928-1048-0x0000000006200000-0x000000000621E000-memory.dmp
              Download

              memory/4928-1040-0x0000000005CC0000-0x0000000005D26000-memory.dmp
              Download

              memory/4928-1039-0x0000000005AE0000-0x0000000005B46000-memory.dmp
              Download

              memory/5108-1088-0x0000022246960000-0x0000022246972000-memory.dmp
              Download

              memory/5108-1089-0x000002224A590000-0x000002224A59C000-memory.dmp
              Download

              memory/5424-122-0x0000000002DE0000-0x0000000002EBA000-memory.dmp
              Download

              memory/5424-480-0x0000000002DE0000-0x0000000002EBA000-memory.dmp
              Download

              memory/5436-482-0x0000000003470000-0x000000000354A000-memory.dmp
              Download

              memory/5436-120-0x0000000003470000-0x000000000354A000-memory.dmp
              Download

              memory/5732-478-0x0000000000A20000-0x0000000000A97000-memory.dmp
              Download

              memory/5740-1101-0x0000000005F50000-0x0000000005F9C000-memory.dmp
              Download

              memory/5740-1102-0x000000006D1A0000-0x000000006D1EC000-memory.dmp
              Download

              memory/5740-1114-0x0000000005420000-0x0000000005457000-memory.dmp
              Download

              memory/5740-1112-0x0000000004570000-0x00000000045FA000-memory.dmp
              Download

              memory/5740-1111-0x0000000002400000-0x000000000240B000-memory.dmp
              Download

              memory/5740-1113-0x0000000004B30000-0x0000000004B45000-memory.dmp
              Download

              memory/5740-1109-0x0000000006DD0000-0x0000000006E74000-memory.dmp
              Download

              memory/5776-504-0x0000000003470000-0x000000000354A000-memory.dmp
              Download

              memory/6104-1071-0x0000000005970000-0x00000000059FA000-memory.dmp
              Download

              memory/6104-1033-0x0000000005970000-0x00000000059FA000-memory.dmp
              Download

              memory/6104-1006-0x0000000005970000-0x00000000059FA000-memory.dmp
              Download

              memory/6104-980-0x0000000005970000-0x00000000059FA000-memory.dmp
              Download

              memory/6104-966-0x0000000005970000-0x00000000059FA000-memory.dmp
              Download

              memory/6104-116-0x0000000005970000-0x00000000059FA000-memory.dmp
              Download

              memory/6104-533-0x00000000078E0000-0x00000000078EA000-memory.dmp
              Download

              memory/6104-20-0x0000000006A70000-0x0000000006A7A000-memory.dmp
              Download

              memory/6104-687-0x0000000007FB0000-0x0000000007FBA000-memory.dmp
              Download

              memory/6104-556-0x0000000005970000-0x00000000059FA000-memory.dmp
              Download

              memory/6104-16-0x0000000005AB0000-0x0000000005AC0000-memory.dmp
              Download

              memory/6104-19-0x00000000068B0000-0x0000000006924000-memory.dmp
              Download

              memory/6104-895-0x0000000005970000-0x00000000059FA000-memory.dmp
              Download

              memory/6104-1093-0x0000000006AA0000-0x0000000006B7A000-memory.dmp
              Download

              memory/6104-22-0x0000000005AB0000-0x0000000005AC0000-memory.dmp
              Download

              memory/6104-538-0x0000000007E50000-0x0000000007E58000-memory.dmp
              Download

              memory/6104-537-0x0000000007E20000-0x0000000007E34000-memory.dmp
              Download

              memory/6104-536-0x00000000078F0000-0x0000000007900000-memory.dmp
              Download

              memory/6104-535-0x0000000007DE0000-0x0000000007E1E000-memory.dmp
              Download

              memory/6104-534-0x0000000007900000-0x0000000007914000-memory.dmp
              Download

              memory/6104-532-0x0000000005CD0000-0x0000000005CDA000-memory.dmp
              Download

              memory/6104-528-0x0000000007920000-0x0000000007C77000-memory.dmp
              Download

              memory/6104-524-0x0000000005970000-0x00000000059FA000-memory.dmp
              Download

              memory/6104-518-0x0000000005B30000-0x0000000005B38000-memory.dmp
              Download

              memory/6104-517-0x0000000005EB0000-0x0000000005F00000-memory.dmp
              Download

              memory/6104-516-0x0000000005B10000-0x0000000005B24000-memory.dmp
              Download

              memory/6104-506-0x0000000005970000-0x00000000059FA000-memory.dmp
              Download

              memory/6104-23-0x0000000005AB0000-0x0000000005AC0000-memory.dmp
              Download

              memory/6104-24-0x000000000B500000-0x000000000B53A000-memory.dmp
              Download

              memory/6104-25-0x000000000BB20000-0x000000000BB2A000-memory.dmp
              Download

              memory/6104-26-0x000000000BF30000-0x000000000BFD0000-memory.dmp
              Download

              memory/6104-31-0x000000000C7E0000-0x000000000C838000-memory.dmp
              Download

              memory/6104-1162-0x0000000006AA0000-0x0000000006B7A000-memory.dmp
              Download

              memory/6104-1160-0x0000000005970000-0x00000000059FA000-memory.dmp
              Download

              memory/6104-33-0x000000000DB20000-0x000000000DBD2000-memory.dmp
              Download

              memory/6104-282-0x0000000006AA0000-0x0000000006B7A000-memory.dmp
              Download

              memory/6104-280-0x0000000005970000-0x00000000059FA000-memory.dmp
              Download

              memory/6104-123-0x0000000005AB0000-0x0000000005AC0000-memory.dmp
              Download

              memory/6104-121-0x0000000005AB0000-0x0000000005AC0000-memory.dmp
              Download

              memory/6104-1387-0x00000000077E0000-0x00000000077F6000-memory.dmp
              Download

              memory/6104-1395-0x0000000005970000-0x00000000059FA000-memory.dmp
              Download

              memory/6104-117-0x0000000005940000-0x000000000594B000-memory.dmp
              Download

              memory/6104-118-0x0000000006AA0000-0x0000000006B7A000-memory.dmp
              Download

              memory/6104-119-0x0000000009CC0000-0x0000000009CC7000-memory.dmp
              Download

              memory/6104-103-0x0000000007F80000-0x0000000007F92000-memory.dmp
              Download

              memory/6104-102-0x0000000007F50000-0x0000000007F5A000-memory.dmp
              Download

              memory/6104-100-0x0000000005AB0000-0x0000000005AC0000-memory.dmp
              Download

              memory/6104-40-0x000000000DD40000-0x000000000DD62000-memory.dmp
              Download

              memory/6104-42-0x000000000F330000-0x000000000F424000-memory.dmp
              Download

              memory/6104-1531-0x0000000006AA0000-0x0000000006B7A000-memory.dmp
              Download

              memory/6104-1529-0x0000000005970000-0x00000000059FA000-memory.dmp
              Download

              memory/6104-44-0x000000000F440000-0x000000000F45A000-memory.dmp
              Download

              memory/6104-45-0x000000000F460000-0x000000000F468000-memory.dmp
              Download