Overview

overview

8

Static

static

3

Roblox Acc...er.exe

windows10-2004-x64

8

Roblox Acc...er.exe

windows11-21h2-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    68s
  • max time network
    70s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    11/05/2026, 18:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Roblox Account Manager.exe
  • Size 5.4MB
  • Sample260511-xeef5agx51
  • SHA256 be9ddcdedf8c36c64e6b0a32d2686b74a112913c54217ccaa46675bfd1dc82f1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarecredential_accessdiscoverypersistenceransomwarespywarestealer

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Uses browser remote debugging 2 TTPs 8 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Checks computer location settings 2 TTPs 11 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 24 IoCs
  • Loads dropped DLL 51 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 49 IoCs
  • Drops file in Windows directory 22 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 14 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 37 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe
    "C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4080
    • C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe
      "C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe" -restart
      2⤵
      • Downloads MZ/PE file
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3056
      • C:\Users\Admin\AppData\Local\Temp\vcredist.tmp
        "C:\Users\Admin\AppData\Local\Temp\vcredist.tmp" /q /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3488
        • C:\Windows\Temp\{57EA5815-EA0C-4390-9DDB-9C06FF5BDCBB}\.cr\vcredist.tmp
          "C:\Windows\Temp\{57EA5815-EA0C-4390-9DDB-9C06FF5BDCBB}\.cr\vcredist.tmp" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\vcredist.tmp" -burn.filehandle.attached=692 -burn.filehandle.self=696 /q /norestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3764
          • C:\Windows\Temp\{18FB3687-36D1-4D63-925F-2FFFFC1D58EE}\.be\VC_redist.x86.exe
            "C:\Windows\Temp\{18FB3687-36D1-4D63-925F-2FFFFC1D58EE}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{70F81571-CB45-40CB-B897-1050F341FB92} {D3955066-9EB5-4172-BD88-B8F034FF21A2} 3764
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3972
            • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
              "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={0b5169e3-39da-4313-808e-1f9c0407f3bf} -burn.filehandle.self=1128 -burn.embedded BurnPipe.{F4C4239F-7DCA-4503-96AA-4B00EE52751C} {DE452FCD-3A59-421C-80F8-5FADC279C4B2} 3972
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2720
              • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={0b5169e3-39da-4313-808e-1f9c0407f3bf} -burn.filehandle.self=1128 -burn.embedded BurnPipe.{F4C4239F-7DCA-4503-96AA-4B00EE52751C} {DE452FCD-3A59-421C-80F8-5FADC279C4B2} 3972
                7⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:1652
      • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
        "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --allow-pre-commit-input --disable-background-networking --disable-background-timer-throttling --disable-backgrounding-occluded-windows --disable-breakpad --disable-client-side-phishing-detection --disable-component-extensions-with-background-pages --disable-component-update --disable-default-apps --disable-dev-shm-usage --disable-extensions --disable-field-trial-config --disable-hang-monitor --disable-infobars --disable-ipc-flooding-protection --disable-popup-blocking --disable-prompt-on-repost --disable-renderer-backgrounding --disable-search-engine-choice-screen --disable-sync --enable-automation --enable-blink-features=IdleDetection --export-tagged-pdf --generate-pdf-document-outline --force-color-profile=srgb --metrics-recording-only --no-first-run --password-store=basic --use-mock-keychain --disable-features=Translate,AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold --enable-features= about:blank --disable-web-security --window-size="880,740" --window-position="520,150" --remote-debugging-port=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xlrxfqxa.qdl"
        3⤵
        • Uses browser remote debugging
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:468
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\xlrxfqxa.qdl /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\xlrxfqxa.qdl\Crashpad --annotation=plat=Win64 "--annotation=prod=Google Chrome for Testing" --annotation=ver=124.0.6367.201 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff2ea2cc70,0x7fff2ea2cc7c,0x7fff2ea2cc88
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1932
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=gpu-process --disable-breakpad --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xlrxfqxa.qdl" --no-appcompat-clear --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1920,i,12864510371749482156,7030379698507679137,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2988
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xlrxfqxa.qdl" --no-appcompat-clear --start-stack-profiler --field-trial-handle=2108,i,12864510371749482156,7030379698507679137,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:3
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2304
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xlrxfqxa.qdl" --no-appcompat-clear --field-trial-handle=2260,i,12864510371749482156,7030379698507679137,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2132
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xlrxfqxa.qdl" --no-appcompat-clear --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --allow-pre-commit-input --enable-blink-features=IdleDetection --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2924,i,12864510371749482156,7030379698507679137,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:1
          4⤵
          • Uses browser remote debugging
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2952
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xlrxfqxa.qdl" --no-appcompat-clear --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --allow-pre-commit-input --enable-blink-features=IdleDetection --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2928,i,12864510371749482156,7030379698507679137,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:1
          4⤵
          • Uses browser remote debugging
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2228
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xlrxfqxa.qdl" --no-appcompat-clear --field-trial-handle=4788,i,12864510371749482156,7030379698507679137,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1284
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xlrxfqxa.qdl" --no-appcompat-clear --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --allow-pre-commit-input --disable-gpu-compositing --enable-blink-features=IdleDetection --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4816,i,12864510371749482156,7030379698507679137,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:1
          4⤵
          • Uses browser remote debugging
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2324
      • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
        "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --allow-pre-commit-input --disable-background-networking --disable-background-timer-throttling --disable-backgrounding-occluded-windows --disable-breakpad --disable-client-side-phishing-detection --disable-component-extensions-with-background-pages --disable-component-update --disable-default-apps --disable-dev-shm-usage --disable-extensions --disable-field-trial-config --disable-hang-monitor --disable-infobars --disable-ipc-flooding-protection --disable-popup-blocking --disable-prompt-on-repost --disable-renderer-backgrounding --disable-search-engine-choice-screen --disable-sync --enable-automation --enable-blink-features=IdleDetection --export-tagged-pdf --generate-pdf-document-outline --force-color-profile=srgb --metrics-recording-only --no-first-run --password-store=basic --use-mock-keychain --disable-features=Translate,AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold --enable-features= about:blank --disable-web-security --window-size="880,740" --window-position="520,150" --remote-debugging-port=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\03ogpnwf.frv"
        3⤵
        • Uses browser remote debugging
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:5576
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\03ogpnwf.frv /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\03ogpnwf.frv\Crashpad --annotation=plat=Win64 "--annotation=prod=Google Chrome for Testing" --annotation=ver=124.0.6367.201 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff2ea2cc70,0x7fff2ea2cc7c,0x7fff2ea2cc88
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5588
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=gpu-process --disable-breakpad --user-data-dir="C:\Users\Admin\AppData\Local\Temp\03ogpnwf.frv" --no-appcompat-clear --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1996,i,3865179900930260257,7156066944263638875,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=1976 /prefetch:2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5764
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\03ogpnwf.frv" --no-appcompat-clear --start-stack-profiler --field-trial-handle=1892,i,3865179900930260257,7156066944263638875,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:3
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5776
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\03ogpnwf.frv" --no-appcompat-clear --field-trial-handle=2352,i,3865179900930260257,7156066944263638875,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5824
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\03ogpnwf.frv" --no-appcompat-clear --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --allow-pre-commit-input --enable-blink-features=IdleDetection --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3012,i,3865179900930260257,7156066944263638875,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:1
          4⤵
          • Uses browser remote debugging
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5924
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\03ogpnwf.frv" --no-appcompat-clear --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --allow-pre-commit-input --enable-blink-features=IdleDetection --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3016,i,3865179900930260257,7156066944263638875,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:1
          4⤵
          • Uses browser remote debugging
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5936
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\03ogpnwf.frv" --no-appcompat-clear --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --allow-pre-commit-input --disable-gpu-compositing --enable-blink-features=IdleDetection --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4520,i,3865179900930260257,7156066944263638875,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:1
          4⤵
          • Uses browser remote debugging
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5308
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:2696
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1704
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3052
  • C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
    "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" /burn.runonce
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3760
    • C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
      "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260511194559.log"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:784
      • C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
        "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260511194559.log"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4732
        • C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
          "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{800E0426-3A26-4F01-8818-D3E6005993A0} {2CF1F2FB-8AEB-477C-84AC-CBB9E911FB00} 4732
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:4144
          • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
            "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={0b5169e3-39da-4313-808e-1f9c0407f3bf} -burn.filehandle.self=1060 -burn.embedded BurnPipe.{A4D845BB-3244-4DAC-8695-DACD220AA45F} {601EB5EB-AD7C-4CFF-97AF-F276E67D8630} 4144
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2592
            • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
              "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={0b5169e3-39da-4313-808e-1f9c0407f3bf} -burn.filehandle.self=1060 -burn.embedded BurnPipe.{A4D845BB-3244-4DAC-8695-DACD220AA45F} {601EB5EB-AD7C-4CFF-97AF-F276E67D8630} 4144
              6⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4376
              • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{F23F96D3-91BB-4240-BC98-245D05E294AB} {293ABB5C-A406-4A1B-AA27-208545E36DC2} 4376
                7⤵
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                PID:2784
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    PID:2320
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
    1⤵
      PID:4948

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e5891ff.rbs
          • Path C:\Config.Msi\e5891ff.rbs
          • Size 16KB
          • SHA256 7538dd23108fe60b9710bd439e379cfa40ed2cd2809fb111e46184060c12213f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e589204.rbs
          • Path C:\Config.Msi\e589204.rbs
          • Size 18KB
          • SHA256 7c567bbefe23177cb04685a0f29f9251a09def2b83f9853272086ad762014239
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e589211.rbs
          • Path C:\Config.Msi\e589211.rbs
          • Size 20KB
          • SHA256 9203fdd475864211c9f65e569573df2ff64d443448eeaddba3c799db5fa2f9fa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e58afd4.rbs
          • Path C:\Config.Msi\e58afd4.rbs
          • Size 19KB
          • SHA256 a8ef8911a98949edade8ba1f8bd2bd345a57d9f0ad66f55216069bf343aaaacd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e58afd8.rbs
          • Path C:\Config.Msi\e58afd8.rbs
          • Size 3KB
          • SHA256 c72c5817a4319d747bc8e16e8a52d1bb63e32dabd7cb73f6c047a05cc565b10d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          state.rsm
          • Path C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\state.rsm
          • Size 914B
          • SHA256 74d8b860d1c83f3f8bd8475909411851ab97f21f923c5a936af422a91ece5999
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Roblox Account Manager.exe.log
          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Roblox Account Manager.exe.log
          • Size 1KB
          • SHA256 7fada0f81b63e1ecb265e9620ace8f5f0d40773626081849f5d98e668bc4e594
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          D3DCompiler_47.dll
          • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\D3DCompiler_47.dll
          • Size 4.7MB
          • SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          chrome.exe
          • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          • Size 2.5MB
          • SHA256 613536f294de53d1e9bb53a31269300fef4427f5e461ff6c7a1de3fa88c7667c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          chrome_100_percent.pak
          • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome_100_percent.pak
          • Size 665KB
          • SHA256 329113e1ab3c6ac34d8375fd0a66e6ba12c1c49675101d10e231316b5a14c8c2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          chrome_200_percent.pak
          • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome_200_percent.pak
          • Size 1.0MB
          • SHA256 3cd793c813d79579e5dafb3b63204e2ccb525f6b27a6dc25525c9fafabce4d29
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          chrome_elf.dll
          • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome_elf.dll
          • Size 1.2MB
          • SHA256 0d2ccf801ceabba978a77238e1b79afc9a66983a11c07e011f876c063a71ffdb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          icudtl.dat
          • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\icudtl.dat
          • Size 10.2MB
          • SHA256 7bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libEGL.dll
          • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\libEGL.dll
          • Size 460KB
          • SHA256 89c3cf5576b06b8114450f55f16f5fa0c2197db45a7ef0e57bc0eda872dcd6f5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libGLESv2.dll
          • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\libGLESv2.dll
          • Size 7.6MB
          • SHA256 6cebea494ff17a5ec8c54b7fd5e13834eae556178ac42e7eab545263646aa080
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          en-US.pak
          • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\locales\en-US.pak
          • Size 394KB
          • SHA256 92efd174fffe9e958e20edf1acdb9394ce81ae38b9d1a04203cb35585ecbb5b7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          resources.pak
          • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\resources.pak
          • Size 8.0MB
          • SHA256 103ba11595d71025abc07c1f32e9f0fa11d9a191afeba6ee950154c5b358ac0b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          v8_context_snapshot.bin
          • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\v8_context_snapshot.bin
          • Size 641KB
          • SHA256 ddd3a5acffc4e8d6b9211c84733debdf394c3cb12d702598e1a5e56b13c89c61
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vk_swiftshader_icd.json
          • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\vk_swiftshader_icd.json
          • Size 106B
          • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          vulkan-1.dll
          • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\vulkan-1.dll
          • Size 925KB
          • SHA256 d8e0d487912f248f867ac88d3b0754cb106b73a4fc4c8a1e4db1dec6c4180f84
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          the-real-index
          • Path C:\Users\Admin\AppData\Local\Temp\03ogpnwf.frv\Default\Code Cache\js\index-dir\the-real-index
          • Size 2KB
          • SHA256 f54ccb60fc83c071e93e8d12db83d1163aff79dbf7534cf3d30a600aba547123
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          the-real-index
          • Path C:\Users\Admin\AppData\Local\Temp\03ogpnwf.frv\Default\Code Cache\js\index-dir\the-real-index
          • Size 48B
          • SHA256 ff433211175c0c366fb73c79c3dfa617734f946da7aaaadf8f1e2333f22a2aa6
          • MD5 SHA1 SHA512
          Submit Download

          index
          • Path C:\Users\Admin\AppData\Local\Temp\03ogpnwf.frv\Default\Code Cache\wasm\index
          • Size 24B
          • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
          • MD5 SHA1 SHA512
          Submit Download

          index
          • Path C:\Users\Admin\AppData\Local\Temp\03ogpnwf.frv\Default\GPUCache\index
          • Size 256KB
          • SHA256 6ab650313c020163c6258c835d4624b7a49bce82a15149a27099eeb08bcba45b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\Temp\03ogpnwf.frv\Local State
          • Size 3KB
          • SHA256 5c0764e9e0ddedeb413c27120c34ff913ae9bc8f31781cbc6d52dee97721b847
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\Temp\03ogpnwf.frv\Local State
          • Size 3KB
          • SHA256 718679c34ed02e6155416e4fe75e134275af51b3fd8359517aa01a03ade2ca74
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Local State~RFe58fd56.TMP
          • Path C:\Users\Admin\AppData\Local\Temp\03ogpnwf.frv\Local State~RFe58fd56.TMP
          • Size 914B
          • SHA256 7de01e9fc56b4a562f5ed675310f62407cb585a279631b030858c51d27d539a5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MSI8af65.LOG
          • Path C:\Users\Admin\AppData\Local\Temp\MSI8af65.LOG
          • Size 2KB
          • SHA256 95800b0b9d52b4c428dcc70199acfd46a3b44cc2e1f673abcecca5e683e979b3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          RAMTheme.ini
          • Path C:\Users\Admin\AppData\Local\Temp\RAMTheme.ini
          • Size 314B
          • SHA256 563eb35fd613f4298cd4dceff67652a13ba516a6244d9407c5709323c4ca4bb1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Roblox Account Manager.exe.config
          • Path C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe.config
          • Size 6KB
          • SHA256 2b6d99db8369b0ff6372737d89d1c9e4101815b4168a3852c7b513f2897e7f3d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dd_vcredist_x86_20260511194559_000_vcRuntimeMinimum_x86.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260511194559_000_vcRuntimeMinimum_x86.log
          • Size 2KB
          • SHA256 342440150cb8ebc79f2dd46107fbdd64994e219d5a4c1a8c2d045f153f1c11a8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dd_vcredist_x86_20260511194559_001_vcRuntimeAdditional_x86.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260511194559_001_vcRuntimeAdditional_x86.log
          • Size 2KB
          • SHA256 20fdb1d884403f9d9046ecada5e5c821c513f34c0288fd8ecbfda5f9b222ca19
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dd_vcredist_x86_20260511194559_001_vcRuntimeAdditional_x86.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260511194559_001_vcRuntimeAdditional_x86.log
          • Size 2B
          • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
          • MD5 SHA1 SHA512
          Submit Download

          dd_vcredist_x86_20260511194559_001_vcRuntimeAdditional_x86.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260511194559_001_vcRuntimeAdditional_x86.log
          • Size 2KB
          • SHA256 df6b645a0dbc93da39391eae7921b3de316c63775d4f0e5ba976069d3f983f76
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          libsodium.dll
          • Path C:\Users\Admin\AppData\Local\Temp\libsodium.dll
          • Size 477KB
          • SHA256 7a960129f6d3f8d44b4c6be27f587c29aa8bafb9c4d3c85bb84a5f5d8fa6e2ba
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          log4.config
          • Path C:\Users\Admin\AppData\Local\Temp\log4.config
          • Size 936B
          • SHA256 e4b10630d9ec2af508de31752fbbc6816c7426c40a3e57f0a085ce7f42c77bd5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          vcredist.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\vcredist.tmp
          • Size 13.3MB
          • SHA256 0c09f2611660441084ce0df425c51c11e147e6447963c3690f97e0b25c55ed64
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          the-real-index
          • Path C:\Users\Admin\AppData\Local\Temp\xlrxfqxa.qdl\Default\Code Cache\js\index-dir\the-real-index
          • Size 2KB
          • SHA256 6382ab58ce34622dfc06f7a125630c0a948e2c3a7857be504acf74bf8b116c87
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          the-real-index~RFe58e8a6.TMP
          • Path C:\Users\Admin\AppData\Local\Temp\xlrxfqxa.qdl\Default\Code Cache\js\index-dir\the-real-index~RFe58e8a6.TMP
          • Size 48B
          • SHA256 d06068e0e6362f38de2ee28b109401c41c3898083dc81e0769d3958a396a292d
          • MD5 SHA1 SHA512
          Submit Download

          MANIFEST-000001
          • Path C:\Users\Admin\AppData\Local\Temp\xlrxfqxa.qdl\Default\Extension Rules\MANIFEST-000001
          • Size 41B
          • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
          • MD5 SHA1 SHA512
          Submit Download

          SCT Auditing Pending Reports
          • Path C:\Users\Admin\AppData\Local\Temp\xlrxfqxa.qdl\Default\Network\SCT Auditing Pending Reports
          • Size 2B
          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
          • MD5 SHA1 SHA512
          Submit Download

          CURRENT
          • Path C:\Users\Admin\AppData\Local\Temp\xlrxfqxa.qdl\Default\shared_proto_db\metadata\CURRENT
          • Size 16B
          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
          • MD5 SHA1 SHA512
          Submit Download

          data_0
          • Path C:\Users\Admin\AppData\Local\Temp\xlrxfqxa.qdl\GrShaderCache\data_0
          • Size 8KB
          • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          data_1
          • Path C:\Users\Admin\AppData\Local\Temp\xlrxfqxa.qdl\GrShaderCache\data_1
          • Size 264KB
          • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          data_2
          • Path C:\Users\Admin\AppData\Local\Temp\xlrxfqxa.qdl\GrShaderCache\data_2
          • Size 8KB
          • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          data_3
          • Path C:\Users\Admin\AppData\Local\Temp\xlrxfqxa.qdl\GrShaderCache\data_3
          • Size 8KB
          • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\Temp\xlrxfqxa.qdl\Local State
          • Size 3KB
          • SHA256 8f4f975805d82bf77a2b77861845cab6b07a2d62cc75098b4c820e885ffa7c90
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\Temp\xlrxfqxa.qdl\Local State
          • Size 3KB
          • SHA256 bddebaa160656696ac79b38a03a2b168f77ccdc9bc91c55a995d58c627013bb0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Local State~RFe58e8a6.TMP
          • Path C:\Users\Admin\AppData\Local\Temp\xlrxfqxa.qdl\Local State~RFe58e8a6.TMP
          • Size 914B
          • SHA256 e23a6631905b982075f25e382ed3f8cd05c97d6649764d5c6e8d75bbc6715b86
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ngen.log
          • Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log
          • Size 156KB
          • SHA256 ba45504804c5ccd8d9f1778bee096975436c3c3ac7fe39464f40fc1e3eb0e83f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          logo.png
          • Path C:\Windows\Temp\{18FB3687-36D1-4D63-925F-2FFFFC1D58EE}\.ba\logo.png
          • Size 1KB
          • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          wixstdba.dll
          • Path C:\Windows\Temp\{18FB3687-36D1-4D63-925F-2FFFFC1D58EE}\.ba\wixstdba.dll
          • Size 215KB
          • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cab54A5CABBE7274D8A22EB58060AAB7623
          • Path C:\Windows\Temp\{18FB3687-36D1-4D63-925F-2FFFFC1D58EE}\cab54A5CABBE7274D8A22EB58060AAB7623
          • Size 838KB
          • SHA256 c9935322c0af2fe00ebb018f8b0b908018576048fa4d3c0376a30ebf0eb2cf50
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cabB3E1576D1FEFBB979E13B1A5379E0B16
          • Path C:\Windows\Temp\{18FB3687-36D1-4D63-925F-2FFFFC1D58EE}\cabB3E1576D1FEFBB979E13B1A5379E0B16
          • Size 4.9MB
          • SHA256 01b11076177c8a5ee37eba745142cd6bbc4ac1ebfc4ebe48c85bd285a73ebf60
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcRuntimeAdditional_x86
          • Path C:\Windows\Temp\{18FB3687-36D1-4D63-925F-2FFFFC1D58EE}\vcRuntimeAdditional_x86
          • Size 200KB
          • SHA256 3e4a528fe5263a5dc44455d0ab2717f0c02acdc120c918cf43730ce9f36ccbb5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcRuntimeMinimum_x86
          • Path C:\Windows\Temp\{18FB3687-36D1-4D63-925F-2FFFFC1D58EE}\vcRuntimeMinimum_x86
          • Size 200KB
          • SHA256 c5ff4d6cd4be9f4965f93af273dd364948fbe44d40b123f34f82bcbcf64c8df4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcredist.tmp
          • Path C:\Windows\Temp\{57EA5815-EA0C-4390-9DDB-9C06FF5BDCBB}\.cr\vcredist.tmp
          • Size 669KB
          • SHA256 4a6e1044ff0f49d2e3b12f7c40352c7e573e0c58f3b3cc0b55b63c95ede87828
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{EF49EFEE-FBB7-4C43-B8E6-9901D5527458}\.ba\license.rtf
          • Size 9KB
          • SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{EF49EFEE-FBB7-4C43-B8E6-9901D5527458}\.ba\thm.wxl
          • Size 2KB
          • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          thm.xml
          • Path C:\Windows\Temp\{EF49EFEE-FBB7-4C43-B8E6-9901D5527458}\.ba\thm.xml
          • Size 8KB
          • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wixstdba.dll
          • Path C:\Windows\Temp\{EF49EFEE-FBB7-4C43-B8E6-9901D5527458}\.ba\wixstdba.dll
          • Size 191KB
          • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/468-1083-0x00000242B4610000-0x00000242B464B000-memory.dmp
          Download

          memory/468-1082-0x00000242B45E0000-0x00000242B4607000-memory.dmp
          Download

          memory/1652-554-0x00000000001D0000-0x0000000000247000-memory.dmp
          Download

          memory/2132-615-0x00007FFF4BD60000-0x00007FFF4BD61000-memory.dmp
          Download

          memory/2132-614-0x00007FFF4A250000-0x00007FFF4A251000-memory.dmp
          Download

          memory/2320-730-0x00000182366A0000-0x00000182366AC000-memory.dmp
          Download

          memory/2592-540-0x00000000001D0000-0x0000000000247000-memory.dmp
          Download

          memory/2720-555-0x00000000001D0000-0x0000000000247000-memory.dmp
          Download

          memory/2784-537-0x00000000001D0000-0x0000000000247000-memory.dmp
          Download

          memory/3052-396-0x000002008BE50000-0x000002008BE5C000-memory.dmp
          Download

          memory/3056-563-0x000000000E0F0000-0x000000000E0FA000-memory.dmp
          Download

          memory/3056-639-0x000000000CE90000-0x000000000CE9A000-memory.dmp
          Download

          memory/3056-564-0x000000000E110000-0x000000000E11A000-memory.dmp
          Download

          memory/3056-565-0x000000000F7B0000-0x000000000F7C4000-memory.dmp
          Download

          memory/3056-566-0x000000000F7D0000-0x000000000F7E0000-memory.dmp
          Download

          memory/3056-567-0x000000000F7E0000-0x000000000F7F4000-memory.dmp
          Download

          memory/3056-568-0x000000000F810000-0x000000000F818000-memory.dmp
          Download

          memory/3056-273-0x0000000007EF0000-0x0000000007F04000-memory.dmp
          Download

          memory/3056-274-0x000000000C550000-0x000000000C5A0000-memory.dmp
          Download

          memory/3056-275-0x000000000C500000-0x000000000C508000-memory.dmp
          Download

          memory/3056-271-0x00000000059F0000-0x0000000005A79000-memory.dmp
          Download

          memory/3056-270-0x0000000005AD0000-0x0000000005AE0000-memory.dmp
          Download

          memory/3056-269-0x0000000005AD0000-0x0000000005AE0000-memory.dmp
          Download

          memory/3056-115-0x0000000005AD0000-0x0000000005AE0000-memory.dmp
          Download

          memory/3056-113-0x00000000059F0000-0x0000000005A79000-memory.dmp
          Download

          memory/3056-114-0x0000000003580000-0x000000000358A000-memory.dmp
          Download

          memory/3056-560-0x00000000059F0000-0x0000000005A79000-memory.dmp
          Download

          memory/3056-559-0x0000000005DA0000-0x0000000005DDE000-memory.dmp
          Download

          memory/3056-99-0x0000000007E80000-0x0000000007E8A000-memory.dmp
          Download

          memory/3056-100-0x000000000FAB0000-0x000000000FAC2000-memory.dmp
          Download

          memory/3056-97-0x0000000007AB0000-0x0000000007AB8000-memory.dmp
          Download

          memory/3056-96-0x0000000007A80000-0x0000000007A9A000-memory.dmp
          Download

          memory/3056-95-0x0000000007990000-0x0000000007A84000-memory.dmp
          Download

          memory/3056-562-0x000000006E310000-0x000000006E325000-memory.dmp
          Download

          memory/3056-94-0x0000000007960000-0x0000000007982000-memory.dmp
          Download

          memory/3056-1555-0x00000000059F0000-0x0000000005A79000-memory.dmp
          Download

          memory/3056-91-0x00000000034E0000-0x0000000003538000-memory.dmp
          Download

          memory/3056-93-0x0000000007760000-0x0000000007812000-memory.dmp
          Download

          memory/3056-24-0x000000000C790000-0x000000000C830000-memory.dmp
          Download

          memory/3056-23-0x000000000C4C0000-0x000000000C4CA000-memory.dmp
          Download

          memory/3056-22-0x000000000C080000-0x000000000C0BA000-memory.dmp
          Download

          memory/3056-359-0x000000000E1B0000-0x000000000E504000-memory.dmp
          Download

          memory/3056-21-0x0000000005AD0000-0x0000000005AE0000-memory.dmp
          Download

          memory/3056-20-0x0000000005AD0000-0x0000000005AE0000-memory.dmp
          Download

          memory/3056-18-0x0000000006B40000-0x0000000006B4A000-memory.dmp
          Download

          memory/3056-17-0x00000000069C0000-0x0000000006A34000-memory.dmp
          Download

          memory/3056-14-0x0000000005AD0000-0x0000000005AE0000-memory.dmp
          Download

          memory/3056-371-0x00000000059F0000-0x0000000005A79000-memory.dmp
          Download

          memory/3056-1208-0x00000000059F0000-0x0000000005A79000-memory.dmp
          Download

          memory/4080-13-0x00000000015E0000-0x00000000016BC000-memory.dmp
          Download

          memory/4080-0-0x00000000006E0000-0x0000000000C4C000-memory.dmp
          Download

          memory/4080-6-0x0000000005770000-0x000000000578E000-memory.dmp
          Download

          memory/4080-5-0x0000000005730000-0x0000000005756000-memory.dmp
          Download

          memory/4080-4-0x0000000005810000-0x00000000058A2000-memory.dmp
          Download

          memory/4080-3-0x0000000005620000-0x0000000005666000-memory.dmp
          Download

          memory/4080-2-0x0000000005800000-0x0000000005810000-memory.dmp
          Download

          memory/4080-1-0x0000000005DC0000-0x0000000006364000-memory.dmp
          Download

          memory/4376-539-0x00000000001D0000-0x0000000000247000-memory.dmp
          Download