Overview

overview

8

Static

static

3

Roblox Acc...er.exe

windows10-ltsc_2021-x64

8

Roblox Acc...er.exe

windows11-21h2-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260513-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    16/05/2026, 12:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Roblox Account Manager.exe
  • Size 5.4MB
  • Sample260516-precwsdw4w
  • SHA256 be9ddcdedf8c36c64e6b0a32d2686b74a112913c54217ccaa46675bfd1dc82f1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarecredential_accessdiscoverypersistenceransomwarespywarestealer

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Uses browser remote debugging 2 TTPs 4 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 20 IoCs
  • Loads dropped DLL 38 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 49 IoCs
  • Drops file in Windows directory 16 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 11 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe
    "C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1432
    • C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe
      "C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe" -restart
      2⤵
      • Downloads MZ/PE file
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4504
      • C:\Users\Admin\AppData\Local\Temp\vcredist.tmp
        "C:\Users\Admin\AppData\Local\Temp\vcredist.tmp" /q /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3728
        • C:\Windows\Temp\{E4F953A0-A1F9-4E98-A526-CB2E9CA69E65}\.cr\vcredist.tmp
          "C:\Windows\Temp\{E4F953A0-A1F9-4E98-A526-CB2E9CA69E65}\.cr\vcredist.tmp" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\vcredist.tmp" -burn.filehandle.attached=692 -burn.filehandle.self=696 /q /norestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3860
          • C:\Windows\Temp\{655C029F-3E8A-43DC-8066-B70E1073F6FF}\.be\VC_redist.x86.exe
            "C:\Windows\Temp\{655C029F-3E8A-43DC-8066-B70E1073F6FF}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{D775BDA1-2A0B-4FBE-AA4A-F8FB3F45FA04} {03D25069-20AB-42BB-AC87-E09AA7FEFFF1} 3860
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2648
            • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
              "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={0b5169e3-39da-4313-808e-1f9c0407f3bf} -burn.filehandle.self=1060 -burn.embedded BurnPipe.{B8C3736F-8E7E-4687-84E8-B050905B7419} {26012CE8-D9A9-4D4C-8AEE-BAEF47A83B05} 2648
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3876
              • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={0b5169e3-39da-4313-808e-1f9c0407f3bf} -burn.filehandle.self=1060 -burn.embedded BurnPipe.{B8C3736F-8E7E-4687-84E8-B050905B7419} {26012CE8-D9A9-4D4C-8AEE-BAEF47A83B05} 2648
                7⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4712
                • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                  "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{B5CE3CD6-5EDD-46DB-B2A5-131FAA9BEAAE} {F6B0AB2A-2503-4E40-AB6B-12228BA4388A} 4712
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  PID:760
      • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
        "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --allow-pre-commit-input --disable-background-networking --disable-background-timer-throttling --disable-backgrounding-occluded-windows --disable-breakpad --disable-client-side-phishing-detection --disable-component-extensions-with-background-pages --disable-component-update --disable-default-apps --disable-dev-shm-usage --disable-extensions --disable-field-trial-config --disable-hang-monitor --disable-infobars --disable-ipc-flooding-protection --disable-popup-blocking --disable-prompt-on-repost --disable-renderer-backgrounding --disable-search-engine-choice-screen --disable-sync --enable-automation --enable-blink-features=IdleDetection --export-tagged-pdf --generate-pdf-document-outline --force-color-profile=srgb --metrics-recording-only --no-first-run --password-store=basic --use-mock-keychain --disable-features=Translate,AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold --enable-features= about:blank --disable-web-security --window-size="880,740" --window-position="520,150" --remote-debugging-port=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0xrssp4z.cw1"
        3⤵
        • Uses browser remote debugging
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4528
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\0xrssp4z.cw1 /prefetch:4 --monitor-self --monitor-self-argument=--type=crashpad-handler --monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Temp\0xrssp4z.cw1 --monitor-self-argument=/prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\0xrssp4z.cw1\Crashpad --annotation=plat=Win64 "--annotation=prod=Google Chrome for Testing" --annotation=ver=124.0.6367.201 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff910f7cc70,0x7ff910f7cc7c,0x7ff910f7cc88
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:4940
          • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
            C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\0xrssp4z.cw1 /prefetch:4 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\0xrssp4z.cw1\Crashpad --annotation=plat=Win64 "--annotation=prod=Google Chrome for Testing" --annotation=ver=124.0.6367.201 --initial-client-data=0x188,0x18c,0x190,0x150,0x19c,0x7ff7d6069900,0x7ff7d606990c,0x7ff7d6069918
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3872
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=gpu-process --disable-breakpad --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0xrssp4z.cw1" --no-appcompat-clear --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1980,i,10764537545014580214,2846228714956722457,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=1976 /prefetch:2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4160
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0xrssp4z.cw1" --no-appcompat-clear --start-stack-profiler --field-trial-handle=1920,i,10764537545014580214,2846228714956722457,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:3
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4980
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0xrssp4z.cw1" --no-appcompat-clear --field-trial-handle=2288,i,10764537545014580214,2846228714956722457,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1872
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0xrssp4z.cw1" --no-appcompat-clear --start-stack-profiler --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --allow-pre-commit-input --enable-blink-features=IdleDetection --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2976,i,10764537545014580214,2846228714956722457,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:1
          4⤵
          • Uses browser remote debugging
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2236
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0xrssp4z.cw1" --no-appcompat-clear --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --allow-pre-commit-input --enable-blink-features=IdleDetection --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2980,i,10764537545014580214,2846228714956722457,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:1
          4⤵
          • Uses browser remote debugging
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2296
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0xrssp4z.cw1" --no-appcompat-clear --field-trial-handle=4872,i,10764537545014580214,2846228714956722457,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3928
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0xrssp4z.cw1" --no-appcompat-clear --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --allow-pre-commit-input --disable-gpu-compositing --enable-blink-features=IdleDetection --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4836,i,10764537545014580214,2846228714956722457,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:1
          4⤵
          • Uses browser remote debugging
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          PID:828
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0xrssp4z.cw1" --no-appcompat-clear --field-trial-handle=3316,i,10764537545014580214,2846228714956722457,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4256
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0xrssp4z.cw1" --no-appcompat-clear --field-trial-handle=252,i,10764537545014580214,2846228714956722457,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5060
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0xrssp4z.cw1" --no-appcompat-clear --field-trial-handle=5476,i,10764537545014580214,2846228714956722457,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4584
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0xrssp4z.cw1" --no-appcompat-clear --field-trial-handle=5480,i,10764537545014580214,2846228714956722457,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:4232
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:2324
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
      PID:4820
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Badlisted process makes network request
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1576
    • C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
      "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" /burn.runonce
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2736
      • C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
        "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260516133346.log"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3644
        • C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
          "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260516133346.log"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:2468
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
      1⤵
        PID:4544

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e58c748.rbs
            • Path C:\Config.Msi\e58c748.rbs
            • Size 16KB
            • SHA256 8eadfbd87c281411af82195437b82856126cb52688f82a3b98d43378325f92a8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e58c74d.rbs
            • Path C:\Config.Msi\e58c74d.rbs
            • Size 18KB
            • SHA256 8a7cd8d1608d8f32ae70ff2f9d13108e4ea7483ff5899a60f8f058d2b6d0e16f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e58c75a.rbs
            • Path C:\Config.Msi\e58c75a.rbs
            • Size 20KB
            • SHA256 9ac610909d03dea223b308c07ca5bfaae243bdbacb203cb43e40ab9d5ad01175
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e58c769.rbs
            • Path C:\Config.Msi\e58c769.rbs
            • Size 19KB
            • SHA256 a922056c62be5a5654902d16166d5bb20aea66b9ee5a86faa113f57dd0e4e7c6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            state.rsm
            • Path C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\state.rsm
            • Size 914B
            • SHA256 74d8b860d1c83f3f8bd8475909411851ab97f21f923c5a936af422a91ece5999
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Roblox Account Manager.exe.log
            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Roblox Account Manager.exe.log
            • Size 1KB
            • SHA256 a2c487cfed45fd3f2af6795d4f12e449776a32205fd32978a7282bc7ffeec826
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            D3DCompiler_47.dll
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\D3DCompiler_47.dll
            • Size 4.7MB
            • SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome.exe
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
            • Size 2.5MB
            • SHA256 613536f294de53d1e9bb53a31269300fef4427f5e461ff6c7a1de3fa88c7667c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_100_percent.pak
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome_100_percent.pak
            • Size 665KB
            • SHA256 329113e1ab3c6ac34d8375fd0a66e6ba12c1c49675101d10e231316b5a14c8c2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_200_percent.pak
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome_200_percent.pak
            • Size 1.0MB
            • SHA256 3cd793c813d79579e5dafb3b63204e2ccb525f6b27a6dc25525c9fafabce4d29
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_elf.dll
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome_elf.dll
            • Size 1.2MB
            • SHA256 0d2ccf801ceabba978a77238e1b79afc9a66983a11c07e011f876c063a71ffdb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dxcompiler.dll
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\dxcompiler.dll
            • Size 20.9MB
            • SHA256 81b7a214c95ca2462addcc6061604fc69c4393f1fc2b4457e015f38cb7d54093
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dxil.dll
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\dxil.dll
            • Size 1.4MB
            • SHA256 a5fe1d8d9caa2ff29daffd53f73a9a4e19c250351b2abe4fc7b57e60ce67ac68
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            icudtl.dat
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\icudtl.dat
            • Size 10.2MB
            • SHA256 7bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libEGL.dll
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\libEGL.dll
            • Size 460KB
            • SHA256 89c3cf5576b06b8114450f55f16f5fa0c2197db45a7ef0e57bc0eda872dcd6f5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libGLESv2.dll
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\libGLESv2.dll
            • Size 7.6MB
            • SHA256 6cebea494ff17a5ec8c54b7fd5e13834eae556178ac42e7eab545263646aa080
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            en-US.pak
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\locales\en-US.pak
            • Size 394KB
            • SHA256 92efd174fffe9e958e20edf1acdb9394ce81ae38b9d1a04203cb35585ecbb5b7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            resources.pak
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\resources.pak
            • Size 8.0MB
            • SHA256 103ba11595d71025abc07c1f32e9f0fa11d9a191afeba6ee950154c5b358ac0b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            v8_context_snapshot.bin
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\v8_context_snapshot.bin
            • Size 641KB
            • SHA256 ddd3a5acffc4e8d6b9211c84733debdf394c3cb12d702598e1a5e56b13c89c61
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vk_swiftshader.dll
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\vk_swiftshader.dll
            • Size 5.0MB
            • SHA256 b1bdf61233010357f8bf5d5837719229b527581ac2ebcd5c9662f04471f2cc9e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vk_swiftshader_icd.json
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\vk_swiftshader_icd.json
            • Size 106B
            • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            vulkan-1.dll
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\vulkan-1.dll
            • Size 925KB
            • SHA256 d8e0d487912f248f867ac88d3b0754cb106b73a4fc4c8a1e4db1dec6c4180f84
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            the-real-index
            • Path C:\Users\Admin\AppData\Local\Temp\0xrssp4z.cw1\Default\Code Cache\js\index-dir\the-real-index
            • Size 3KB
            • SHA256 9dbd881a0b0eda8fa8cf5f36dd79102c08ef12d18c5a6bda2103a054dfb356de
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            the-real-index
            • Path C:\Users\Admin\AppData\Local\Temp\0xrssp4z.cw1\Default\Code Cache\js\index-dir\the-real-index
            • Size 3KB
            • SHA256 e3ba9837bbc6dee065a6c3e93c5ff0e7d6246bf1e91eae3bbe4b2435f095a230
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            the-real-index~RFe59ff65.TMP
            • Path C:\Users\Admin\AppData\Local\Temp\0xrssp4z.cw1\Default\Code Cache\js\index-dir\the-real-index~RFe59ff65.TMP
            • Size 48B
            • SHA256 66ebab01907e58335c9528530f2955faac3f973ec7f2f7ae9e34600a6acdca8d
            • MD5 SHA1 SHA512
            Submit Download

            Network Persistent State
            • Path C:\Users\Admin\AppData\Local\Temp\0xrssp4z.cw1\Default\Network\Network Persistent State
            • Size 59B
            • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Network Persistent State
            • Path C:\Users\Admin\AppData\Local\Temp\0xrssp4z.cw1\Default\Network\Network Persistent State
            • Size 2KB
            • SHA256 abe16245da9f02a951a72200dae0f6465943a67070585f9b4a8e6198fcce2e5d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Network Persistent State~RFe5993ca.TMP
            • Path C:\Users\Admin\AppData\Local\Temp\0xrssp4z.cw1\Default\Network\Network Persistent State~RFe5993ca.TMP
            • Size 59B
            • SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            SCT Auditing Pending Reports
            • Path C:\Users\Admin\AppData\Local\Temp\0xrssp4z.cw1\Default\Network\SCT Auditing Pending Reports
            • Size 2B
            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
            • MD5 SHA1 SHA512
            Submit Download

            TransportSecurity
            • Path C:\Users\Admin\AppData\Local\Temp\0xrssp4z.cw1\Default\Network\TransportSecurity
            • Size 2KB
            • SHA256 f5030ffae6b0424ac839cec9bc7098be133b259eadf3b7cde8bb981b4606eb27
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            TransportSecurity
            • Path C:\Users\Admin\AppData\Local\Temp\0xrssp4z.cw1\Default\Network\TransportSecurity
            • Size 2KB
            • SHA256 d4ac895e1e3200fdf887527c342cc87d74eb728b6a637570ef033563c7f7d04f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            TransportSecurity
            • Path C:\Users\Admin\AppData\Local\Temp\0xrssp4z.cw1\Default\Network\TransportSecurity
            • Size 2KB
            • SHA256 2d3545575fd67cf81ea2c19f058d834743939c65adcbeea9e5f6062731cf8343
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            TransportSecurity
            • Path C:\Users\Admin\AppData\Local\Temp\0xrssp4z.cw1\Default\Network\TransportSecurity
            • Size 2KB
            • SHA256 77b0dbaaa72e1b3827511d7df9813d731c184881cf873e8a95d347a2b282b99d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            TransportSecurity
            • Path C:\Users\Admin\AppData\Local\Temp\0xrssp4z.cw1\Default\Network\TransportSecurity
            • Size 2KB
            • SHA256 9c0b8d53fa29bd764bc8f543497306f163f01d1bb90a7af65606963caf9b7d3a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            TransportSecurity
            • Path C:\Users\Admin\AppData\Local\Temp\0xrssp4z.cw1\Default\Network\TransportSecurity
            • Size 2KB
            • SHA256 0677dcd99bf7065db52ef014790beeba6c761bafd2c591bfffa47e02b7826851
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            TransportSecurity~RFe5986f9.TMP
            • Path C:\Users\Admin\AppData\Local\Temp\0xrssp4z.cw1\Default\Network\TransportSecurity~RFe5986f9.TMP
            • Size 2KB
            • SHA256 762f2ee0f89c7b4a12bd3e2838c3c6820100fc68f8f0c36ba9dc16810c765f25
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Preferences
            • Path C:\Users\Admin\AppData\Local\Temp\0xrssp4z.cw1\Default\Preferences
            • Size 5KB
            • SHA256 5bbbc9232bf3dcf2497ae4501853eb9c51191b97f2f173bbddf09c8e8c911373
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Preferences
            • Path C:\Users\Admin\AppData\Local\Temp\0xrssp4z.cw1\Default\Preferences
            • Size 5KB
            • SHA256 28a4b32d004f87b304d2014067c57c8c91d8818bb58d76a5c169d4f87a898aa0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Preferences
            • Path C:\Users\Admin\AppData\Local\Temp\0xrssp4z.cw1\Default\Preferences
            • Size 5KB
            • SHA256 3f1307d3fa0b7d402da8a1e6f45dc2debad49090208cf363b4725a6fc1cba008
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Preferences~RFe59838e.TMP
            • Path C:\Users\Admin\AppData\Local\Temp\0xrssp4z.cw1\Default\Preferences~RFe59838e.TMP
            • Size 5KB
            • SHA256 237d8fbca30462b1c5a0eb8c40d582f58cb4fdf13709d2846690592ce5ff2c79
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CURRENT
            • Path C:\Users\Admin\AppData\Local\Temp\0xrssp4z.cw1\Default\Sync Data\LevelDB\CURRENT
            • Size 16B
            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
            • MD5 SHA1 SHA512
            Submit Download

            MANIFEST-000001
            • Path C:\Users\Admin\AppData\Local\Temp\0xrssp4z.cw1\Default\Sync Data\LevelDB\MANIFEST-000001
            • Size 41B
            • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
            • MD5 SHA1 SHA512
            Submit Download

            data_0
            • Path C:\Users\Admin\AppData\Local\Temp\0xrssp4z.cw1\GrShaderCache\data_0
            • Size 8KB
            • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_1
            • Path C:\Users\Admin\AppData\Local\Temp\0xrssp4z.cw1\GrShaderCache\data_1
            • Size 264KB
            • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_2
            • Path C:\Users\Admin\AppData\Local\Temp\0xrssp4z.cw1\GrShaderCache\data_2
            • Size 8KB
            • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_3
            • Path C:\Users\Admin\AppData\Local\Temp\0xrssp4z.cw1\GrShaderCache\data_3
            • Size 8KB
            • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Local\Temp\0xrssp4z.cw1\Local State
            • Size 3KB
            • SHA256 8ee061758178383d93e1f67fd97e2cac01f98067a2aae618cf52d0d8e276d0cb
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Local State~RFe594879.TMP
            • Path C:\Users\Admin\AppData\Local\Temp\0xrssp4z.cw1\Local State~RFe594879.TMP
            • Size 839B
            • SHA256 d19f569a347bf06533924751fb31cfcf6210d9789506119156c155cc8976363e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            RAMTheme.ini
            • Path C:\Users\Admin\AppData\Local\Temp\RAMTheme.ini
            • Size 314B
            • SHA256 563eb35fd613f4298cd4dceff67652a13ba516a6244d9407c5709323c4ca4bb1
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Roblox Account Manager.exe.config
            • Path C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe.config
            • Size 6KB
            • SHA256 2b6d99db8369b0ff6372737d89d1c9e4101815b4168a3852c7b513f2897e7f3d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dd_vcredist_x86_20260516133346.log
            • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260516133346.log
            • Size 17KB
            • SHA256 00621c7257dee3a64d4c56619941dca561f98e0029361a7c8d1b76b317bbba0f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dd_vcredist_x86_20260516133346_000_vcRuntimeMinimum_x86.log
            • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260516133346_000_vcRuntimeMinimum_x86.log
            • Size 2KB
            • SHA256 a55586e563fd202141a53584a06c8d36276e8128fe5f2fd78196209bf661c02c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            dd_vcredist_x86_20260516133346_001_vcRuntimeAdditional_x86.log
            • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260516133346_001_vcRuntimeAdditional_x86.log
            • Size 250KB
            • SHA256 0e6f21f45f287da5a394be7fc9de260002c110af8727e23e4d8ee005942864fb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libsodium.dll
            • Path C:\Users\Admin\AppData\Local\Temp\libsodium.dll
            • Size 477KB
            • SHA256 7a960129f6d3f8d44b4c6be27f587c29aa8bafb9c4d3c85bb84a5f5d8fa6e2ba
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            log4.config
            • Path C:\Users\Admin\AppData\Local\Temp\log4.config
            • Size 936B
            • SHA256 e4b10630d9ec2af508de31752fbbc6816c7426c40a3e57f0a085ce7f42c77bd5
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            vcredist.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\vcredist.tmp
            • Size 13.3MB
            • SHA256 0c09f2611660441084ce0df425c51c11e147e6447963c3690f97e0b25c55ed64
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            default.dic
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
            • Size 2B
            • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
            • MD5 SHA1 SHA512
            Submit Download

            vcruntime140.dll
            • Path C:\Windows\SysWOW64\vcruntime140.dll
            • Size 76KB
            • SHA256 47267b3ddec6deeb0b018afbde2b99d17350329a52f0ae49f66b5edc5fcc4366
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            logo.png
            • Path C:\Windows\Temp\{655C029F-3E8A-43DC-8066-B70E1073F6FF}\.ba\logo.png
            • Size 1KB
            • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            wixstdba.dll
            • Path C:\Windows\Temp\{655C029F-3E8A-43DC-8066-B70E1073F6FF}\.ba\wixstdba.dll
            • Size 215KB
            • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cab54A5CABBE7274D8A22EB58060AAB7623
            • Path C:\Windows\Temp\{655C029F-3E8A-43DC-8066-B70E1073F6FF}\cab54A5CABBE7274D8A22EB58060AAB7623
            • Size 838KB
            • SHA256 c9935322c0af2fe00ebb018f8b0b908018576048fa4d3c0376a30ebf0eb2cf50
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabB3E1576D1FEFBB979E13B1A5379E0B16
            • Path C:\Windows\Temp\{655C029F-3E8A-43DC-8066-B70E1073F6FF}\cabB3E1576D1FEFBB979E13B1A5379E0B16
            • Size 4.9MB
            • SHA256 01b11076177c8a5ee37eba745142cd6bbc4ac1ebfc4ebe48c85bd285a73ebf60
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vcRuntimeAdditional_x86
            • Path C:\Windows\Temp\{655C029F-3E8A-43DC-8066-B70E1073F6FF}\vcRuntimeAdditional_x86
            • Size 200KB
            • SHA256 3e4a528fe5263a5dc44455d0ab2717f0c02acdc120c918cf43730ce9f36ccbb5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vcRuntimeMinimum_x86
            • Path C:\Windows\Temp\{655C029F-3E8A-43DC-8066-B70E1073F6FF}\vcRuntimeMinimum_x86
            • Size 200KB
            • SHA256 c5ff4d6cd4be9f4965f93af273dd364948fbe44d40b123f34f82bcbcf64c8df4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            license.rtf
            • Path C:\Windows\Temp\{886A0710-78F4-49F3-B902-8A207A5C345A}\.ba\license.rtf
            • Size 9KB
            • SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            thm.wxl
            • Path C:\Windows\Temp\{886A0710-78F4-49F3-B902-8A207A5C345A}\.ba\thm.wxl
            • Size 2KB
            • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            thm.xml
            • Path C:\Windows\Temp\{886A0710-78F4-49F3-B902-8A207A5C345A}\.ba\thm.xml
            • Size 8KB
            • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wixstdba.dll
            • Path C:\Windows\Temp\{886A0710-78F4-49F3-B902-8A207A5C345A}\.ba\wixstdba.dll
            • Size 191KB
            • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vcredist.tmp
            • Path C:\Windows\Temp\{E4F953A0-A1F9-4E98-A526-CB2E9CA69E65}\.cr\vcredist.tmp
            • Size 669KB
            • SHA256 4a6e1044ff0f49d2e3b12f7c40352c7e573e0c58f3b3cc0b55b63c95ede87828
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/760-441-0x0000000000670000-0x00000000006E7000-memory.dmp
            Download

            memory/1432-0-0x0000000000A50000-0x0000000000FBC000-memory.dmp
            Download

            memory/1432-6-0x0000000005A10000-0x0000000005A2E000-memory.dmp
            Download

            memory/1432-5-0x00000000059C0000-0x00000000059E6000-memory.dmp
            Download

            memory/1432-4-0x0000000005AB0000-0x0000000005B42000-memory.dmp
            Download

            memory/1432-3-0x0000000005930000-0x0000000005976000-memory.dmp
            Download

            memory/1432-2-0x0000000003300000-0x0000000003310000-memory.dmp
            Download

            memory/1432-1-0x0000000005FC0000-0x0000000006566000-memory.dmp
            Download

            memory/1872-550-0x00007FF92E590000-0x00007FF92E591000-memory.dmp
            Download

            memory/1872-549-0x00007FF92DA10000-0x00007FF92DA11000-memory.dmp
            Download

            memory/3876-444-0x0000000000670000-0x00000000006E7000-memory.dmp
            Download

            memory/4504-102-0x0000000008370000-0x000000000837A000-memory.dmp
            Download

            memory/4504-103-0x000000000E8A0000-0x000000000E8B2000-memory.dmp
            Download

            memory/4504-492-0x000000000E7E0000-0x000000000E7F4000-memory.dmp
            Download

            memory/4504-491-0x0000000005770000-0x0000000005780000-memory.dmp
            Download

            memory/4504-490-0x000000000E7A0000-0x000000000E7DE000-memory.dmp
            Download

            memory/4504-489-0x000000000E780000-0x000000000E794000-memory.dmp
            Download

            memory/4504-488-0x0000000005060000-0x000000000506A000-memory.dmp
            Download

            memory/4504-487-0x0000000005030000-0x000000000503A000-memory.dmp
            Download

            memory/4504-472-0x000000000E9C0000-0x000000000ED17000-memory.dmp
            Download

            memory/4504-455-0x000000006DA10000-0x000000006DA25000-memory.dmp
            Download

            memory/4504-100-0x0000000005630000-0x0000000005640000-memory.dmp
            Download

            memory/4504-320-0x00000000057C0000-0x00000000057D4000-memory.dmp
            Download

            memory/4504-321-0x000000000E540000-0x000000000E590000-memory.dmp
            Download

            memory/4504-322-0x00000000057D0000-0x00000000057D8000-memory.dmp
            Download

            memory/4504-117-0x0000000005630000-0x0000000005640000-memory.dmp
            Download

            memory/4504-116-0x0000000005630000-0x0000000005640000-memory.dmp
            Download

            memory/4504-493-0x000000000E800000-0x000000000E808000-memory.dmp
            Download

            memory/4504-601-0x000000000EF20000-0x000000000EF2A000-memory.dmp
            Download

            memory/4504-13-0x0000000005630000-0x0000000005640000-memory.dmp
            Download

            memory/4504-84-0x0000000008320000-0x0000000008328000-memory.dmp
            Download

            memory/4504-82-0x0000000008210000-0x0000000008304000-memory.dmp
            Download

            memory/4504-83-0x0000000008300000-0x000000000831A000-memory.dmp
            Download

            memory/4504-81-0x0000000007BA0000-0x0000000007BC2000-memory.dmp
            Download

            memory/4504-1093-0x0000000001560000-0x0000000001576000-memory.dmp
            Download

            memory/4504-70-0x000000000E5C0000-0x000000000E672000-memory.dmp
            Download

            memory/4504-35-0x000000000E4E0000-0x000000000E538000-memory.dmp
            Download

            memory/4504-23-0x000000000CC90000-0x000000000CD30000-memory.dmp
            Download

            memory/4504-22-0x000000000CC60000-0x000000000CC6A000-memory.dmp
            Download

            memory/4504-21-0x000000000C940000-0x000000000C97A000-memory.dmp
            Download

            memory/4504-20-0x0000000005630000-0x0000000005640000-memory.dmp
            Download

            memory/4504-19-0x0000000005630000-0x0000000005640000-memory.dmp
            Download

            memory/4504-17-0x0000000006650000-0x000000000665A000-memory.dmp
            Download

            memory/4504-16-0x00000000064A0000-0x0000000006514000-memory.dmp
            Download

            memory/4712-443-0x0000000000670000-0x00000000006E7000-memory.dmp
            Download