8220df6218d573e40f05fa8e1ac503c0d82a1ec169007d3beba4516f12325650

Analysis

user interaction
yes
max time kernel
122s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 02:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 289KB
Sample261102-ch2qlszvbv
SHA256 8220df6218d573e40f05fa8e1ac503c0d82a1ec169007d3beba4516f12325650
MD5 6e8af7b5766c01538900e6bb8e14ea28
SHA1 168ed470bb01bed27b5988b8cfd6346a232556bc
SHA512 5c21531ea62b41f384d6ec8b2acd19bec33e9c662fcf7ff936dedcc733c39acea7deacf03209a6a47df4ce8cf667df6b16146eb5316eb7e70bfb5f1e3c92d94a
SSDEEP 3072:h+C9i9XHzqRivQIRiAqtnltR9r0UGmYKMn7IrrXdJ80P6KJZX:IC9i9Xzqw4IRiA8R9wsYKY7IfVJZX
TLSH
T1ED545B736200B53BA523DDA0A6BF6E4E3C25E12BCC1A42F8A5D1E520CFE2DB2151775D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence ransomware spyware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
151	2744	Roblox Account Manager.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	vcredist.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	VC_redist.x86.exe

Executes dropped EXE 7 IoCs

pid	Process
4612	vcredist.tmp
4036	vcredist.tmp
5384	VC_redist.x86.exe
6068	VC_redist.x86.exe
2652	VC_redist.x86.exe
5136	VC_redist.x86.exe
5360	VC_redist.x86.exe

Loads dropped DLL 3 IoCs

pid	Process
4036	vcredist.tmp
4124	VC_redist.x86.exe
5136	VC_redist.x86.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{0b5169e3-39da-4313-808e-1f9c0407f3bf} = "\"C:\\ProgramData\\Package Cache\\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\\VC_redist.x86.exe\" /burn.runonce"	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{0b5169e3-39da-4313-808e-1f9c0407f3bf} = "\"C:\\ProgramData\\Package Cache\\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\\VC_redist.x86.exe\" /burn.runonce"	VC_redist.x86.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
160	raw.githubusercontent.com
161	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Drops file in System32 directory 49 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140esn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcamp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcomp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140kor.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140rus.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140deu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140ita.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140rus.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcamp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140cht.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcruntime140_threads.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140enu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140kor.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140enu.dll	msiexec.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e5a40b4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a40b4.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI43F0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI477B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4E52.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C18FB403-1E88-43C8-AD8A-CED50F23DE8B}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI51FD.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a40db.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{922480B5-CAEB-4B1B-AAA4-9716EFDCE26B}	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a40c6.msi	msiexec.exe
File created	C:\Windows\Installer\e5a40c5.msi	msiexec.exe
File created	C:\Windows\Installer\e5a40c6.msi	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Roblox Account Manager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Roblox Account Manager.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1316	msedge.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000007ea4f5aeffb5eeca0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800007ea4f5ae0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809007ea4f5ae000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a7ea4f5ae000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d7ea4f5ae000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\TypedURLs	Roblox Account Manager.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\Dependents\{0b5169e3-39da-4313-808e-1f9c0407f3bf}	VC_redist.x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B084229BEACB1B4AA4A7961FECD2EB6	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\AdvertiseFlags = "388"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E8B87C56C0E773581D82F286F95E50	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\Dependents\{0b5169e3-39da-4313-808e-1f9c0407f3bf}	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\Dependents\{0b5169e3-39da-4313-808e-1f9c0407f3bf}	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5040806F8AF9AAC49928419ED5A1D3CA	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\Version = "237799819"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\60DB5E5629367203C8625813703DFCA1\5B084229BEACB1B4AA4A7961FECD2EB6	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.30,bundle	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.44,bundle\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.44.35211"	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B084229BEACB1B4AA4A7961FECD2EB6\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\Language = "1033"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\304BF81C88E18C34DAA8EC5DF032EDB8	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\304BF81C88E18C34DAA8EC5DF032EDB8\VC_Runtime_Additional	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_X86,V14\DEPENDENTS\{4D8DCF8C-A72A-43E1-9833-C12724DB736E}	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\60DB5E5629367203C8625813703DFCA1	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{922480B5-CAEB-4B1B-AAA4-9716EFDCE26B}v14.44.35211\\packages\\vcRuntimeMinimum_x86\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.44,bundle\ = "{0b5169e3-39da-4313-808e-1f9c0407f3bf}"	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B084229BEACB1B4AA4A7961FECD2EB6\VC_Runtime_Minimum	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\PackageCode = "73B56A9D9529BEC48BFF28F2B2D368B6"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\Version = "237799819"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\VC,redist.x86,x86,14.44,bundle	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.44,bundle\Dependents	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\ = "{922480B5-CAEB-4B1B-AAA4-9716EFDCE26B}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{C18FB403-1E88-43C8-AD8A-CED50F23DE8B}v14.44.35211\\packages\\vcRuntimeAdditional_x86\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_X86,V14\DEPENDENTS\{4D8DCF8C-A72A-43E1-9833-C12724DB736E}	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.44,bundle\ = "{0b5169e3-39da-4313-808e-1f9c0407f3bf}"	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\Version = "14.44.35211"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\Dependents\{0b5169e3-39da-4313-808e-1f9c0407f3bf}	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\SourceList\PackageName = "vc_runtimeMinimum_x86.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\DisplayName = "Microsoft Visual C++ 2022 X86 Additional Runtime - 14.44.35211"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14	VC_redist.x86.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.44,bundle\Version = "14.44.35211.0"	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\ = "{C18FB403-1E88-43C8-AD8A-CED50F23DE8B}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.44,bundle\Dependents\{0b5169e3-39da-4313-808e-1f9c0407f3bf}	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\Version = "14.44.35211"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{922480B5-CAEB-4B1B-AAA4-9716EFDCE26B}v14.44.35211\\packages\\vcRuntimeMinimum_x86\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{C18FB403-1E88-43C8-AD8A-CED50F23DE8B}v14.44.35211\\packages\\vcRuntimeAdditional_x86\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\VC,REDIST.X86,X86,14.30,BUNDLE\DEPENDENTS\{4D8DCF8C-A72A-43E1-9833-C12724DB736E}	VC_redist.x86.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5920	msiexec.exe
5920	msiexec.exe
5920	msiexec.exe
5920	msiexec.exe
5920	msiexec.exe
5920	msiexec.exe
5920	msiexec.exe
5920	msiexec.exe
2744	Roblox Account Manager.exe
2744	Roblox Account Manager.exe
5276	msedge.exe
5276	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2744	Roblox Account Manager.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2744	Roblox Account Manager.exe
Token: SeBackupPrivilege	5604	vssvc.exe
Token: SeRestorePrivilege	5604	vssvc.exe
Token: SeAuditPrivilege	5604	vssvc.exe
Token: SeShutdownPrivilege	5384	VC_redist.x86.exe
Token: SeIncreaseQuotaPrivilege	5384	VC_redist.x86.exe
Token: SeSecurityPrivilege	5920	msiexec.exe
Token: SeCreateTokenPrivilege	5384	VC_redist.x86.exe
Token: SeAssignPrimaryTokenPrivilege	5384	VC_redist.x86.exe
Token: SeLockMemoryPrivilege	5384	VC_redist.x86.exe
Token: SeIncreaseQuotaPrivilege	5384	VC_redist.x86.exe
Token: SeMachineAccountPrivilege	5384	VC_redist.x86.exe
Token: SeTcbPrivilege	5384	VC_redist.x86.exe
Token: SeSecurityPrivilege	5384	VC_redist.x86.exe
Token: SeTakeOwnershipPrivilege	5384	VC_redist.x86.exe
Token: SeLoadDriverPrivilege	5384	VC_redist.x86.exe
Token: SeSystemProfilePrivilege	5384	VC_redist.x86.exe
Token: SeSystemtimePrivilege	5384	VC_redist.x86.exe
Token: SeProfSingleProcessPrivilege	5384	VC_redist.x86.exe
Token: SeIncBasePriorityPrivilege	5384	VC_redist.x86.exe
Token: SeCreatePagefilePrivilege	5384	VC_redist.x86.exe
Token: SeCreatePermanentPrivilege	5384	VC_redist.x86.exe
Token: SeBackupPrivilege	5384	VC_redist.x86.exe
Token: SeRestorePrivilege	5384	VC_redist.x86.exe
Token: SeShutdownPrivilege	5384	VC_redist.x86.exe
Token: SeDebugPrivilege	5384	VC_redist.x86.exe
Token: SeAuditPrivilege	5384	VC_redist.x86.exe
Token: SeSystemEnvironmentPrivilege	5384	VC_redist.x86.exe
Token: SeChangeNotifyPrivilege	5384	VC_redist.x86.exe
Token: SeRemoteShutdownPrivilege	5384	VC_redist.x86.exe
Token: SeUndockPrivilege	5384	VC_redist.x86.exe
Token: SeSyncAgentPrivilege	5384	VC_redist.x86.exe
Token: SeEnableDelegationPrivilege	5384	VC_redist.x86.exe
Token: SeManageVolumePrivilege	5384	VC_redist.x86.exe
Token: SeImpersonatePrivilege	5384	VC_redist.x86.exe
Token: SeCreateGlobalPrivilege	5384	VC_redist.x86.exe
Token: SeRestorePrivilege	5920	msiexec.exe
Token: SeTakeOwnershipPrivilege	5920	msiexec.exe
Token: SeRestorePrivilege	5920	msiexec.exe
Token: SeTakeOwnershipPrivilege	5920	msiexec.exe
Token: SeRestorePrivilege	5920	msiexec.exe
Token: SeTakeOwnershipPrivilege	5920	msiexec.exe
Token: SeRestorePrivilege	5920	msiexec.exe
Token: SeTakeOwnershipPrivilege	5920	msiexec.exe
Token: SeRestorePrivilege	5920	msiexec.exe
Token: SeTakeOwnershipPrivilege	5920	msiexec.exe
Token: SeRestorePrivilege	5920	msiexec.exe
Token: SeTakeOwnershipPrivilege	5920	msiexec.exe
Token: SeRestorePrivilege	5920	msiexec.exe
Token: SeTakeOwnershipPrivilege	5920	msiexec.exe
Token: SeRestorePrivilege	5920	msiexec.exe
Token: SeTakeOwnershipPrivilege	5920	msiexec.exe
Token: SeRestorePrivilege	5920	msiexec.exe
Token: SeTakeOwnershipPrivilege	5920	msiexec.exe
Token: SeRestorePrivilege	5920	msiexec.exe
Token: SeTakeOwnershipPrivilege	5920	msiexec.exe
Token: SeRestorePrivilege	5920	msiexec.exe
Token: SeTakeOwnershipPrivilege	5920	msiexec.exe
Token: SeRestorePrivilege	5920	msiexec.exe
Token: SeTakeOwnershipPrivilege	5920	msiexec.exe
Token: SeRestorePrivilege	5920	msiexec.exe
Token: SeTakeOwnershipPrivilege	5920	msiexec.exe
Token: SeRestorePrivilege	5920	msiexec.exe
Token: SeTakeOwnershipPrivilege	5920	msiexec.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 4160	2796	msedge.exe	83
PID 2796 wrote to memory of 1316	2796	msedge.exe	84
PID 2796 wrote to memory of 1068	2796	msedge.exe	85
PID 2796 wrote to memory of 1068	2796	msedge.exe	85
PID 2796 wrote to memory of 1068	2796	msedge.exe	85
PID 2796 wrote to memory of 2116	2796	msedge.exe	86
PID 2796 wrote to memory of 2116	2796	msedge.exe	86
PID 2796 wrote to memory of 4304	2796	msedge.exe	87
PID 2796 wrote to memory of 4304	2796	msedge.exe	87
PID 2796 wrote to memory of 4304	2796	msedge.exe	87
PID 2796 wrote to memory of 2396	2796	msedge.exe	88
PID 2796 wrote to memory of 2396	2796	msedge.exe	88
PID 2796 wrote to memory of 2396	2796	msedge.exe	88
PID 2796 wrote to memory of 1588	2796	msedge.exe	90
PID 2796 wrote to memory of 1588	2796	msedge.exe	90
PID 2796 wrote to memory of 1588	2796	msedge.exe	90
PID 2796 wrote to memory of 2400	2796	msedge.exe	91
PID 2796 wrote to memory of 2400	2796	msedge.exe	91
PID 2796 wrote to memory of 2400	2796	msedge.exe	91
PID 2796 wrote to memory of 4932	2796	msedge.exe	97
PID 2796 wrote to memory of 4932	2796	msedge.exe	97
PID 2796 wrote to memory of 2012	2796	msedge.exe	98
PID 2796 wrote to memory of 2012	2796	msedge.exe	98
PID 2796 wrote to memory of 3212	2796	msedge.exe	100
PID 2796 wrote to memory of 4108	2796	msedge.exe	104
PID 2796 wrote to memory of 4108	2796	msedge.exe	104
PID 2796 wrote to memory of 4140	2796	msedge.exe	107
PID 2796 wrote to memory of 4140	2796	msedge.exe	107
PID 2796 wrote to memory of 4140	2796	msedge.exe	107
PID 2796 wrote to memory of 1728	2796	msedge.exe	108
PID 2796 wrote to memory of 1728	2796	msedge.exe	108
PID 2796 wrote to memory of 1728	2796	msedge.exe	108
PID 2796 wrote to memory of 2984	2796	msedge.exe	109
PID 2796 wrote to memory of 2984	2796	msedge.exe	109
PID 2796 wrote to memory of 2984	2796	msedge.exe	109
PID 2796 wrote to memory of 3360	2796	msedge.exe	110
PID 2796 wrote to memory of 3360	2796	msedge.exe	110
PID 2796 wrote to memory of 3360	2796	msedge.exe	110
PID 2796 wrote to memory of 2648	2796	msedge.exe	112
PID 2796 wrote to memory of 4744	2796	msedge.exe	113
PID 2796 wrote to memory of 212	2796	msedge.exe	114
PID 2796 wrote to memory of 1092	2796	msedge.exe	116
PID 2796 wrote to memory of 992	2796	msedge.exe	117
PID 2796 wrote to memory of 1092	2796	msedge.exe	116
PID 2796 wrote to memory of 992	2796	msedge.exe	117
PID 2796 wrote to memory of 992	2796	msedge.exe	117
PID 2796 wrote to memory of 4604	2796	msedge.exe	118
PID 2568 wrote to memory of 2744	2568	Roblox Account Manager.exe	123
PID 2796 wrote to memory of 2336	2796	msedge.exe	124
PID 2796 wrote to memory of 2336	2796	msedge.exe	124
PID 2796 wrote to memory of 1544	2796	msedge.exe	126
PID 2796 wrote to memory of 1544	2796	msedge.exe	126
PID 2744 wrote to memory of 4612	2744	Roblox Account Manager.exe	127
PID 4612 wrote to memory of 4036	4612	vcredist.tmp	128
PID 4036 wrote to memory of 5384	4036	vcredist.tmp	129
PID 6068 wrote to memory of 2652	6068	VC_redist.x86.exe	139
PID 2652 wrote to memory of 5136	2652	VC_redist.x86.exe	140
PID 5384 wrote to memory of 5704	5384	VC_redist.x86.exe	141
PID 5704 wrote to memory of 4124	5704	VC_redist.x86.exe	142
PID 4124 wrote to memory of 5236	4124	VC_redist.x86.exe	143
PID 5136 wrote to memory of 5360	5136	VC_redist.x86.exe	144
PID 2796 wrote to memory of 5276	2796	msedge.exe	146

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ff97300c188,0x7ff97300c194,0x7ff97300c1a0
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,11628428960338724155,2533130052293023576,524288 --field-trial-handle=2160,i,11484969302803175261,6316251920541330098,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,5518434516588411828,3311530352776028588,262144 --field-trial-handle=2160,i,11484969302803175261,6316251920541330098,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,634808805531265674,17262753659925407883,524288 --field-trial-handle=2160,i,11484969302803175261,6316251920541330098,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,13282250347090780602,10344010999228392994,2097152 --field-trial-handle=2160,i,11484969302803175261,6316251920541330098,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,710860195154698687,15176684034609160252,2097152 --field-trial-handle=2160,i,11484969302803175261,6316251920541330098,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,14500584124328014114,6490200534729831440,2097152 --field-trial-handle=2160,i,11484969302803175261,6316251920541330098,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,12912216648477844454,5481676164209523252,2097152 --field-trial-handle=2160,i,11484969302803175261,6316251920541330098,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:2
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,8403042429960072142,10193238945990941765,524288 --field-trial-handle=2160,i,11484969302803175261,6316251920541330098,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,9941939906451026802,17195977437719965462,524288 --field-trial-handle=2160,i,11484969302803175261,6316251920541330098,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,9285713579639561328,1095311350937567261,524288 --field-trial-handle=2160,i,11484969302803175261,6316251920541330098,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,9285713579639561328,1095311350937567261,524288 --field-trial-handle=2160,i,11484969302803175261,6316251920541330098,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,46104057803654123,11165345662348036665,524288 --field-trial-handle=2160,i,11484969302803175261,6316251920541330098,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6248,i,1736316655411206352,11588033316335617925,2097152 --field-trial-handle=2160,i,11484969302803175261,6316251920541330098,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4476,i,15524390819180764688,9414916557480190648,2097152 --field-trial-handle=2160,i,11484969302803175261,6316251920541330098,262144 --variations-seed-version --mojo-platform-channel-handle=1620 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6592,i,8429794277972097609,5560586600302044001,2097152 --field-trial-handle=2160,i,11484969302803175261,6316251920541330098,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6588,i,3849694331484569542,1069586743883183545,2097152 --field-trial-handle=2160,i,11484969302803175261,6316251920541330098,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6972,i,9155375521458066567,11470843079441848139,524288 --field-trial-handle=2160,i,11484969302803175261,6316251920541330098,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:8
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6904,i,2329592984062361129,13325686598805949228,524288 --field-trial-handle=2160,i,11484969302803175261,6316251920541330098,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:8
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6908,i,6065496384548086026,17459197468669889138,524288 --field-trial-handle=2160,i,11484969302803175261,6316251920541330098,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:8
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,14484474477903288915,5743549377652812332,524288 --field-trial-handle=2160,i,11484969302803175261,6316251920541330098,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:8
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5872,i,5375631520722901179,16606592049222661979,2097152 --field-trial-handle=2160,i,11484969302803175261,6316251920541330098,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,9921190807559656529,8628580731022082680,524288 --field-trial-handle=2160,i,11484969302803175261,6316251920541330098,262144 --variations-seed-version --mojo-platform-channel-handle=7264 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7452,i,9142976843595878864,5065935476845504164,524288 --field-trial-handle=2160,i,11484969302803175261,6316251920541330098,262144 --variations-seed-version --mojo-platform-channel-handle=7464 /prefetch:8
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7404,i,12110368483803427856,14644267780419974475,524288 --field-trial-handle=2160,i,11484969302803175261,6316251920541330098,262144 --variations-seed-version --mojo-platform-channel-handle=7628 /prefetch:8
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6840,i,11098309076893513879,16137669540307616301,262144 --field-trial-handle=2160,i,11484969302803175261,6316251920541330098,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5276

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1680

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3348

C:\Users\Admin\Downloads\Roblox.Account.Manager.3.7.2\Roblox Account Manager.exe
"C:\Users\Admin\Downloads\Roblox.Account.Manager.3.7.2\Roblox Account Manager.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Users\Admin\Downloads\Roblox.Account.Manager.3.7.2\Roblox Account Manager.exe
  "C:\Users\Admin\Downloads\Roblox.Account.Manager.3.7.2\Roblox Account Manager.exe" -restart
  2⤵
  - Downloads MZ/PE file
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Users\Admin\AppData\Local\Temp\vcredist.tmp
    "C:\Users\Admin\AppData\Local\Temp\vcredist.tmp" /q /norestart
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4612
  - - C:\Windows\Temp\{8815BC67-FFDF-44B5-AB24-FD40CE268D5E}\.cr\vcredist.tmp
      "C:\Windows\Temp\{8815BC67-FFDF-44B5-AB24-FD40CE268D5E}\.cr\vcredist.tmp" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\vcredist.tmp" -burn.filehandle.attached=728 -burn.filehandle.self=732 /q /norestart
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4036
    - - C:\Windows\Temp\{B25FE2EF-9D65-4BA2-B512-8EE39A417E7D}\.be\VC_redist.x86.exe
        
        "C:\Windows\Temp\{B25FE2EF-9D65-4BA2-B512-8EE39A417E7D}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{F55E011F-094D-4CE0-AB5F-D5C272A73B17} {13D4F02F-D0E9-4192-A3FD-5D226D651567} 4036
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5384
      - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={0b5169e3-39da-4313-808e-1f9c0407f3bf} -burn.filehandle.self=980 -burn.embedded BurnPipe.{8231352A-F3F3-4496-A53D-B124171FD2F3} {890F9D06-D579-45A9-8AF0-3FFCF5C8F359} 5384
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5704
        
        C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=544 -burn.filehandle.self=564 -uninstall -quiet -burn.related.upgrade -burn.ancestors={0b5169e3-39da-4313-808e-1f9c0407f3bf} -burn.filehandle.self=980 -burn.embedded BurnPipe.{8231352A-F3F3-4496-A53D-B124171FD2F3} {890F9D06-D579-45A9-8AF0-3FFCF5C8F359} 5384
        7⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4124
        
        C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{0257C106-BA23-4573-8D3B-C47F9C0AB412} {B8221D61-92AF-471E-B384-D7BB27AA6DAC} 4124
        8⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5236

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5604

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:5832

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5920

C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
"C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6068
- C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
  "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102020636.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
    "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102020636.log"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5136
  - - C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
      "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{D0F19BAA-0807-4F94-9A7A-1F1A673271C3} {8129B6B7-D10D-4695-93D9-7B28C1733B43} 5136
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:5360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a40b9.rbs

Path C:\Config.Msi\e5a40b9.rbs
Size 16KB
SHA256 16d11df15e3d7790e82ce74daecc93888d546dbaecb17a72b45b901deef84516
MD5 dc5b80cfb5afa04a39c6ab6f883f0e7c
SHA1 3478ed769c033086287ef2d3ccdcac80ffef0546
SHA512 73ebce33d99595ef40552fb1bc40847b4cb4db3203c0e8653b6af490444cad981e62bf70c8d40b427da3442cd9e724c4c2730065c21d8ce20c162cce4067d670
SSDEEP 96:WeRp55RpSNaWT8REeDd11xQo8RdeDd11Cjtknz0yWcW/Rp0Q2RpVdzRp9OXw3Tjk:WERr1GRA1Hn4Xyin5f7U+nh18vTZpy
TLSH
T15572FE42A94096C3E8662B70DD571B7037B7D7E5A344839B40EC92349F877D22F9E28E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a40be.rbs

Path C:\Config.Msi\e5a40be.rbs
Size 18KB
SHA256 24a77a9cffdafcc464b71424640af79173ef042a3b7488d576773b520c60532e
MD5 d7954bcc0955276a6b2e53022377cba5
SHA1 b9f0a34074d65ad49cec13f061b159dcf4d430cf
SHA512 7369fd2e115859f77d24f4b3257eed2bf749201d076cfc88f3507b7935dde2f2ad03b48af33e155c7466bb76f1f7dda46a2c1b0a6e62fcddf7addca77e25aba9
SSDEEP 192:L8Bm7YOfVqXmwtnNloorHdmF0e9mJrbIvdJrbNowjn5Ev/bcP3pL:L89br9iwJrKdJrzuc5
TLSH
T13A922D826A00D1D3D8666B70DC472B293BF7D3EA93A4475F02DCC1348F977D62E8958A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a40cb.rbs

Path C:\Config.Msi\e5a40cb.rbs
Size 20KB
SHA256 feba2003d5755c5c1830df297a68591c889e4a7cb068460e29dbf46091bcad2d
MD5 b98766be60d7514ca1d3272b3010e0bd
SHA1 862dc3b5b700704ffbff8b746e46c00dd0779794
SHA512 1bb96d7299a9478def9714f250bb81ac9f733fc70dc5c4a0c96523a5f2fbb59b8b5ecc1b53a0c2c3f9bec72c42119b1c19056356d035614427dfa4b8413c0472
SSDEEP 384:LNR5glRBgFfXMawmn28I1S9HXVZFb3Qs+EO/GwPoUh4f24qljft:LD5gBifXMawmn28IA9HXVZFbgs+E+GwR
TLSH
T1D5A2FF03A64495D3E8B62B70EC671BA4BB32DBE59361434B40DC95384F933C23ED968E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a40da.rbs

Path C:\Config.Msi\e5a40da.rbs
Size 19KB
SHA256 aafd8c7b3c95659adef504c80248eabb90dfa81aa1fff17607571f7989076d3a
MD5 736664506933280f3a60cff5e9b6febc
SHA1 fce58ded8e5e1938bb95637bebebd4cf9e46b620
SHA512 4d96435d4ace559ee2f494e102b705ff543c8fa7f6a98fa4b917e8c700081d39de1597c234db008532c8591463edfbd45e509ab532f952b3af793d8ef9ebb30f
SSDEEP 384:0UJqQk0Ve2SD4QsUh+FagOJgVJgTcMQFSUWF:0UoQk0Ve2SD4QsUh+ot6YcLFTe
TLSH
T14892ED42A940DA92D4BBAB70CE971B347736D3E9D791531B40CCD1304E937C62F9EA8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\state.rsm
Size 914B
SHA256 74d8b860d1c83f3f8bd8475909411851ab97f21f923c5a936af422a91ece5999
MD5 ed3a865a6424343a3a4fc36e6c06cf6d
SHA1 674452bed71e9f215a81d0ed3498469e571cdf8e
SHA512 ec8e6b74a68af66676a751a10b6a4608edbc677b5ab2992f4c3a9b06c694cd586b59a696560b747581f6689f806eccfaab59e357d66617bbe98d4b44c4655059
TLSH
T1E3119661AFF65119F3FBBB7179F5161459BFB8110D31902D0181708A9F32B90DD24B66
MD5 SHA1 SHA512 TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\state.rsm
Size 894B
SHA256 787c0d278d8e9be9f8fa0b1bc286262a70fd444bf7c2b031b737459463cbe67e
MD5 bf104eed8d7126afd1bb76d4466d33a2
SHA1 eb15e8b7407c2db45d4d09141e6af0c1e6ac3524
SHA512 27234252d01cb93919ff5019ceb7e0d10ec294df4a8754759ae030d449e99c9991326161ce57a771de0add71d5774c0f9fd4bfcdcb59531661d100990a83fa99
TLSH
T168119661AFF65119F3FBBB7179F5161459BFB8110D31902D0181708A9F32B90DD24B66
MD5 SHA1 SHA512 TLSH

Submit Download

vc_runtimeMinimum_x86.msi

Path C:\ProgramData\Package Cache\{922480B5-CAEB-4B1B-AAA4-9716EFDCE26B}v14.44.35211\packages\vcRuntimeMinimum_x86\vc_runtimeMinimum_x86.msi
Size 200KB
SHA256 c5ff4d6cd4be9f4965f93af273dd364948fbe44d40b123f34f82bcbcf64c8df4
MD5 cce22015775c209fbab4050261fba590
SHA1 27998ee42531b9d41f3d71c9dc2ead8d95ed8863
SHA512 61886caec75d195d43fafcaa8d1a8b50c4fb65c39103f62d54a704d713035cc2717c04b1c1cd4794d218364b05c27bf62b13d3aef66e5665f148961ac009b45d
SSDEEP 3072:0I9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriTg3:ZlaZeKFxCnBheIdlu
TLSH
T1F414AF12B5808032DAFE19351178DB715F3D7E608F5489AB2364B6AD1E717C08F3AAB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Roblox Account Manager.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Roblox Account Manager.exe.log
Size 1KB
SHA256 7fada0f81b63e1ecb265e9620ace8f5f0d40773626081849f5d98e668bc4e594
MD5 a02e8a8a790f0e0861e3b6b0dbe56062
SHA1 a3e65805e5c78641cafebc1052906d7350da9d2e
SHA512 108a81f818aa027834d621c771e427ee3f300c59d9dc10d853b94b1e8d635cf6bc06338dce31da30b08660c6fb06a39f9069c983bb585049f5fe9f50b753eb42
TLSH
T15E119B303322B5D88D023F530C596A8513FF4759B664EE2C7959225ED92A0176B322E3
MD5 SHA1 SHA512 TLSH

Submit Download

0ddd5e01-4bdd-435d-89e3-56896b5fa63c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0ddd5e01-4bdd-435d-89e3-56896b5fa63c.tmp
Size 18KB
SHA256 804d25858ca41f0f421a51e976d54d4e8983a04c21147eb1ea4cdd3eb07da898
MD5 97ad77253dea7e9b3d2bc1ea79825b96
SHA1 7870ffb6e27bfd334ca39212f3d5b37af926fb96
SHA512 86467037598b78dd274ec0541af2a9774bcc617cecfb30d3dd296cad06b26d28475045387d7efec45ffba257f6cb84eed4387cc36fd38555cd34a76841c1d152
SSDEEP 384:6QkUSv0sNV/VelKwp5u8ipaiNaggH7vBEQMIIlU:i08qkpUggH75EQML2
TLSH
T129827D3668A46C7B59A39621F14A3A13DFB4816BE7C82FC4D9DD972C01DE5DC2307E22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4e755920-768f-4a65-a90d-1ac1fd32289c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4e755920-768f-4a65-a90d-1ac1fd32289c.tmp
Size 8KB
SHA256 b8061efb90a8d32a03eacb443055d49b4593601d815efa8a8ebe4e82b9ff8aa5
MD5 ec3c6478d3599e03abf79abb7647c667
SHA1 5f257420e24e8802be578bf44550372ba27badce
SHA512 90a022b25b1e7771cba910ef9a410fafc8e1c526447b011db188463d6d36035229124bc9019b6a5f866f59cccbb4d57e506b8ebb5468ee2d2ec27426045eed7e
SSDEEP 192:SONH6iDCQmiUyCYHq5u88PpPCPSqZicU6:SONH6/8Hq5u8ipaNhU6
TLSH
T1AA02F7396C783CBB9DE3AD15B58B7B139FE5116FE6942B84DAE8161C00DB68C1303532
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

56a1fa23-b274-412e-9ba5-c11d224fa0ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\56a1fa23-b274-412e-9ba5-c11d224fa0ac.tmp
Size 392B
SHA256 d2a048978edf6aa52f0de36d30e59ef24d6b6664d56f182616c1f967ecd31d1f
MD5 c2656426bd3a16302231cd7acb28bb8e
SHA1 8e9406603ed0594d9c1b71dd8edbfafd86bf74c5
SHA512 394c81fcbc839e652672261832a0d6585734d0b03cd924e8027f41474b113861cf015bde119c703c2b17dbf654464bc6f1019389d7d36e68ded540e850491fec
TLSH
T12BE00244D200013BC02D4B3544871F243EB1911007E202050330016C2C393003631E80
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 61a97be736e0441d45644d31b38bd9bef6c1bd260fa1ecbb5d099fa493fee6b4
MD5 99bbd8400adc948f85ebd87cb24b3fcb
SHA1 c8fb9564ede7ecb06cef446bdb527025127a796e
SHA512 75b3ee70eca487cbbfb3d5b4b25bae158ff99188ab36d55f391e9f80c51ce9fa433897d79a0ae37ad64698bc3eb5aa9a10a49116fb8f7f35ed0a6e98aa8321b7
TLSH
T109D022C8F2A0300CE00C3233A02BCE022B88CEA8F0032BCA000E8C80E8800C80CF2C8E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 87a6b56b3a47cfd9f58f49b21d0040033c8cfd80b50e49b434794cefa7e29583
MD5 74ef2da89fa243ea7d0030317efca192
SHA1 ceb38f6fe8b62f80d617114db8b4617467417ae3
SHA512 285847f78095225db6f446ab877593c3e8e9c642b3beec1b15e7b1eec59d6b2f61ada0e2fb96cf36a3046dbd5102c274473cea5f978ee83b010039a4dc00d05d
TLSH
T10DD024C471D0340CD40C31335015CD011744CD54F00317C7000D4C40C4400C40CF1C4D
MD5 SHA1 SHA512 TLSH

Submit Download

08e5e53a-2767-4eaf-9412-90c91a0b079e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\08e5e53a-2767-4eaf-9412-90c91a0b079e.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5f13248f-ecec-4d94-ae6b-0ee404263ef0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5f13248f-ecec-4d94-ae6b-0ee404263ef0.tmp
Size 27KB
SHA256 3a3b9dfaca616b714fa85c31409023a3d4dc8b5661c776fba83ba653f107a5ec
MD5 16e0a8a4e49693363268fa9b81d70870
SHA1 a90c7e9635687a67714009c929b2e188813ea6e1
SHA512 be7d2ae3cbb3bd3796cff3d6fb875533e8f7b54426639019e9cd37e3ae391f9fab24b89cee8431026aed8191d4bbf398a6576c162370b5c1dcc5db9ff1481011
SSDEEP 768:ROyQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3SroqZCM:ROyQRbrWvvlpZu1jaXKLf33JqZCM
TLSH
T187C2E92B640CCB7E5FC01E9DDC6A6F977EA802C766588D4047FA984C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

88ff3f36-1515-4a86-8204-ddfde6519cd2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\88ff3f36-1515-4a86-8204-ddfde6519cd2.tmp
Size 12KB
SHA256 3837002dde3dbf175a82a8e6267f56f43a714d04da497ad3f999f2a9c87d45ab
MD5 22b5d3472691f2faad7f3ce982ed970b
SHA1 8dd10d0c90747a392ca4eadb559041e1ce6168a4
SHA512 933af327b3b8c2f31a3df90a487ead953b0ab56e10bcd455a81457f4927028ac874e4fbe75c1701d18a56d54f1613c940829ae5ead4adefa155ed6322c2ec043
SSDEEP 192:sxZsyROucBzr/fFs2Q8dpT3OB6HW6+WNiYH/Ya5AZgIg5fPQccwatDb7:sxZ9nmzr/fFs2QMPHb9/7xQccVz
TLSH
T10C42A6526A24E9778CCBD50DBE747F12E7F9143299911E8CAAFCC52C04AB6ED120781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

92dd2329-717b-43b2-a49e-20a0e6000ff4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\92dd2329-717b-43b2-a49e-20a0e6000ff4.tmp
Size 9KB
SHA256 bb42d269e7c6766b0ab6bcb65f4277d4f0abe6a4a37a5016f8596858a45cd8bf
MD5 0f18f4ae6240cccf24987eacb1eb06af
SHA1 cfa376148e2ad25beeb238747ff748e9162021ec
SHA512 9169919edd2da50c1df7fec0a1960504fcd98eb510c5cadc2a21fd8db0da1ad32c75a2fe133b3634f8d9c43757b7a8f4e761ec7d85aa25f7af6383caf629888f
SSDEEP 192:sxZsyROWr/fFsZbOIdpdTHW6+WNGYaJAZgIgrJ:sxZ97r/fFsZbfRHbG79
TLSH
T15512C7516E28A93B8CC7E20DBB65BF13D6F9103251D11E88EAFC961C04EBACD124780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9c668d2e-b06d-44f1-8b91-ef1dcf64d648.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9c668d2e-b06d-44f1-8b91-ef1dcf64d648.tmp
Size 13KB
SHA256 e61f201691fdb4f4eaea252312fb4521d535d4b17d2c02431bad8310e209a61c
MD5 062efe49b9f67acd0d22bbab1773d28a
SHA1 b156b2a22f090188b34c0f781f010007d279e735
SHA512 af3b547109c41adcd04438029642f6764bd7a9a462aadc2b2fcb6d709da00143ca3fcddca7d901053fea4f3e0e8edaf667681658faeacaa5a10ec464b589d77e
SSDEEP 192:sxZsjROucBWr/fFsqP8dp9P3OB6HW6+WNiDHXYa6hZgIg5fPQccwatDb7:sxZMnmWr/fFsqPMVHb6X5xQccVz
TLSH
T1D752C7526924EC7B8CC7D51DBA757F12E7F9103299911E8CAAFCC52C00AB6ED134781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b
Size 60KB
SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
MD5 b90c0e06b88c09158b13db21c7fc9ef7
SHA1 a4b968f5abcd2addd2d8f2d3e6fc01f4127c95a3
SHA512 430aadb5315738f414c2d4ca0d9e2be42f5242a3b28765993602aed4b34e334d854a88a051e6519877b7ffd8a5bf4ee7276885d6daec541826dba878f8c07f2e
SSDEEP 1536:iw916VqIkIFHzR32SF2Sjm+KW3IS7uchJEsZP8:nngaGzR32ceS7uchJ1ZP8
TLSH
T18C530227CA3085D2572D05004B9EF35A1A6079FDEA09CD7E920157F772ACAACFE20E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c
Size 68KB
SHA256 9a184f33ae7f406bc55bb497748336469980585b53ccc41f863c96306dbf238a
MD5 0e776a9829f2513dc6b150e6e74178aa
SHA1 60fcee40a3ce00c80e125cad5c0a55fa02d15f2e
SHA512 39f0ccd6a44b69d59611679d725ad12187393d9628d977f9848796d5855fb145f3bfe2a3998bd2bbf8b5240c33cd6ecd9d49ed09f4d0270d5ae40558cf7acb54
SSDEEP 1536:H51miTVgrQ7JaUf76Z+AGYguWv0KxwhGPkMxOIdzz/SIWT27zQMPvp+elQDQ:ZYMR78X9GjuW8KxwhGPkKB5JWTMzz5+e
TLSH
T1026302329668F371BDE5B98DFECAD32F58485C204207CA11167E3DF3852549954D8C7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007d
Size 19KB
SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
MD5 2e86a72f4e82614cd4842950d2e0a716
SHA1 d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA512 7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
SSDEEP 384:eV4Eqc1qgk/XDVGi8m7JEM9TUKPqivdjfommfP974oNF38:eV9qlxhVEM9UKPpMV74kFM
TLSH
T1D692D043765579E9AF1280C82397E6A4EAAD9A88D6C0FD0950F56CBECF708D32261825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007e
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007f
Size 45KB
SHA256 44c44c5e9cca81e4e3a8b88e6c45ef531d9ec84d198955739a4e3ca82e76f0f3
MD5 afc7d5b0c3d21def3418a9fc43858f83
SHA1 bf9c629cc33dd8475f36005870ea625624acc7b0
SHA512 04cd55b52af530e7c411b4cddb385a34304cdcaeb84b8b2e9e912f7089a125c61cb52b7966707d9fe74c986034fa6f53b1626eb0caf1f163d6ec9044462fb3f2
SSDEEP 768:zAr5A78yAtyYOzjMPHwIVoveCDn4mSE1NNJi8AlLaTmPXrnr/WPY165c3KfHJqma:8FAZAjOzjMoOy5T13Ji8EaSPjrcMgfW
TLSH
T16123E1975618B5E2D5A97B351AC3718F5F9BC0D884EB22CA258B604BE0D0CF791860EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 7KB
SHA256 12a72ef1268accd5a1fd85cc6aaba3fca48c2d3e8b9602ac0388524d4d81ff50
MD5 cee0f3b242a8f5f50bc00764a04c4929
SHA1 6362d47cc53a4c52dfc1e3f34af7f32b697919d3
SHA512 747ea55b06ff1068aca8623ba47b3e16d06aeb41474ab7cd24d8799c9e0d611b036fea7a8cc068213153440f6fbe814fa8dc7b0e3810550f19e2362bbbb24e2e
SSDEEP 96:p/nhzxznKS5kaJ9w7Yr5TJoB2r566VdebKjmBpsjFN+:Vh9ziy9wkr5uBM5KbKYK+
TLSH
T112E1B8C2D297C5E8FB6B60B053D3FDDE3A36905E40432E3BC4B4C6352457757AA68066
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 aeac7550d097bd83d04f35043fc742ee000c717765dc6294e5abfacf4838530d
MD5 6b36bddfddbbc09fa66834fcbe2c248b
SHA1 144b6b2c7e8ebb96a04c265ad529f68c275e9a5a
SHA512 4c1d34719e29dadcae53cf0a87b034b7a89fe2b3873caf9d9246dd6ae50cb6d1c1d197224dc0820159be103d71322913f2e606bd25faa023c714a3dcf53d8a67
TLSH
T1C4615E83D34342E9F7AA65B095E29DDB3A34909784433F3EC8C8CA75A407726DA1D077
MD5 SHA1 SHA512 TLSH

Submit Download

010af6c1-8509-488c-aeec-d913d861d606.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\010af6c1-8509-488c-aeec-d913d861d606.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

97075458-e008-4165-a908-f116adeb48d9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\97075458-e008-4165-a908-f116adeb48d9.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

ad4710c9-c872-42a3-a8c2-f35d7d5aa67d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ad4710c9-c872-42a3-a8c2-f35d7d5aa67d.tmp
Size 4KB
SHA256 0df621453a4eccb87c275f230aa68ef3093f3ac118f50ddd78b2bf60f6ce11d8
MD5 4488ef76d43fff60343816cb323fe084
SHA1 4704e8e7e78acba311d677a966c48598349ddb34
SHA512 748797300a3a763e8a61a88919b3ddaee56e14067d3c135d79e9b77d226cd1d88ea56885c6554b1031572318be3e131c9a8402abbc779e300805fe157e8a507c
SSDEEP 96:DJ8OUhEsmtLzZ5RQCiiEdvmrmxmnBwEimDmt0mO+mH:DJ3UhLmtLl5RQhiEvmrmxmB9imDmt0mY
TLSH
T137A1CEF7C7E5862DDA1115F0EA18AE1FCE2C0555831C3C6688E4EE5BA3F2471E14169F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b6394bbb-b901-4e77-a729-db84541a6b3e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b6394bbb-b901-4e77-a729-db84541a6b3e.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d2e57ab0-a9a6-4ec8-a398-0d69f5237ccf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d2e57ab0-a9a6-4ec8-a398-0d69f5237ccf.tmp
Size 210B
SHA256 448d8b330a16970efb7393102a4dc804d35f8d0015ca06a47b7e2daff7c1c251
MD5 28351fbcc6ea305cbeb3473f96c38942
SHA1 7a4538ee9632bb1f68f1f084b3cfd3e30a2f4834
SHA512 8002f1918ee5d5aabd03d5fc99793eed551d602b3c2bc95a7600eeba1720e1f6501f785f147119a5e13b9844d8e4ec9b5a88025bc3118d1e6b30627e650d409e
TLSH
T1ACD022A72100B271C21D2EB91029AC4AEB7611A61813E2D690E9DA582AF5D3E080B0C4
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8f2b60ef87411cfe79b2e8875eea8c603694caceaa4cf99fbaed0401a3bb970b
MD5 fbe88fef11fb4e253094cb50f7a2ef75
SHA1 b872b81fe6b60d9f464adecec4d4536f2f30db5b
SHA512 030454f98edf4bc94bad148b3f43456eb7a01d2f8a247a8ff1b2394df9260b9a6fd27e92c76ebc9d05796efb1191bbb35503dce2424608079da4e54b1cdb5e49
SSDEEP 192:sxZsjROucBzr/fFsqP8dp9P3OB6HW6+WNiYH/YaFAZgIg5fPQccwatDb7:sxZMnmzr/fFsqPMVHb9/zxQccVz
TLSH
T18A52C7526E24EC778CC7D51DBA757F12E7F9003299911E8CAAFCC52C00AB6ED124781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

ccc2878a-2a02-4f5b-9e66-36a9d4e41639.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ccc2878a-2a02-4f5b-9e66-36a9d4e41639.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d3fb9e163702bee6b83b0f4cb96cb7bb5b4e6a0975cfa8234d73b868617e5bed
MD5 34345d0d97b53e402b55412f73d47f13
SHA1 eaae12a0a53484aa6eb20d0055b38e54417c1b20
SHA512 825b56fe40ab6955eaac318f0376879446450dbf0060860058cb715d35a33b64b851f1f53da7da04fc54461cedfe02d76b5dc29a28ba793346680844000e4337
MD5 SHA1 SHA512

Submit Download

a1dfd577-7fd4-4155-b763-0a57060b8531.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a1dfd577-7fd4-4155-b763-0a57060b8531.tmp
Size 18KB
SHA256 68707bcadd1cf5a3f407eaf421c56450897ce2bf257f5012163a77568a5e62cc
MD5 ff24cbc45fae43ff57c3daa1d79cded2
SHA1 243c1e45f784803d22e2744231934a2ba8dcee83
SHA512 5bbef8c6fbc35cabd16d29875b7cd6cb138013082858976ce2e14bf0e99ca185ad018401d14673da478ff7afb7e4b5c7b6752a1db51b0e73c85973ab742b7af5
SSDEEP 384:UQkUSvXsNVCVeP8h2p5u8ipaiNaggH7vBEQMIIlU:EXVhkkpUggH75EQML2
TLSH
T1C3826C7668A46C7B59A39521F14A3A23DFB4816BE7C85FC0D9DD972C01CE5DC2307D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b803c912-de8a-4e32-8934-158d645f49be.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b803c912-de8a-4e32-8934-158d645f49be.tmp
Size 26KB
SHA256 c1d1306e6bb83ceef3745abea0430ecd4e7783fc869f86d21acfdbdde1670b78
MD5 e1763b40566abf07cd9c704cfba772ba
SHA1 336eea9d3401dfb9067645aaa80d70d88ba1cc7e
SHA512 73f9685255ca54c9ffd4379470d125ffe9ae960124b2fef8f9d65d1b7cd5cebae875d128fabc4907defed09ecb86fcfe8110b88e45196c1c6b4e1d4188dc3df2
SSDEEP 384:WiFeQkUSv+4sNv8TUNTUlIlCVeP+h2p5u8ipaiNaTgH7vBEQMIIlU:9FO9ywgYhkkpUTgH75EQML2
TLSH
T1F1C207F258D7983AD9AE4B13A33D3E129E7CC06BF6845A80B7C9551CCC8A1BFD306911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b9bb5a50-d185-4d86-be46-49808a1a67bb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b9bb5a50-d185-4d86-be46-49808a1a67bb.tmp
Size 18KB
SHA256 9e834a58147b19fcad5ecd6c3e3d9b7a8cee05278673156bf7c8454272abc671
MD5 25e30c1b60b0a316afc2e53cda9786b2
SHA1 865644258ecd3f5db18fe2eff35266e0880db9ac
SHA512 71badbbe4b8c3a0968cfcac090843ee46594c1073b5f4cc788f866d38d61f652bfe92f53c6099d72cd44387743d5f726bd497d364e8b9725f23af52e3fac8b7f
SSDEEP 384:hQkUSv0sNV+VeP8h2p5u8ipaiNaggH7vBEQMIIlU:T0FhkkpUggH75EQML2
TLSH
T135827C3268A46C7B59E39521F14A3A13DEB4816BE7C86FC0D9DD972C01DE5DC2307E22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eca12741-aa12-44bc-98df-947008314c4b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\eca12741-aa12-44bc-98df-947008314c4b.tmp
Size 8KB
SHA256 39784ffefba62e760e3ebf6202dad7644236e2aaa0ebde64d3561878303622d2
MD5 7a74e7efdc999657cfe0deaad40b5fe0
SHA1 fa7c0af32cd959a0631bd632fbcba28068728cc8
SHA512 32a4720312659d460044f2f769b94ad8ec23928aefcd99a8b9e36e2bea3ee3be4a029849c1fc30bf31891a9777339c6e679c113d2ebdf70f0b5e6a4394c42d39
SSDEEP 192:NONA6iD4QmiUycYwq5u88PpPCi3daduZrq3U6:NONA6ZQwq5u8ipaiNakgU6
TLSH
T1AF121A3678A8AC7B6DD3A961F48736139EA4426BE7887FC4D9DC162C01EF59C1307923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a008ee5-2474-4264-b59a-ac80c951cba4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5a008ee5-2474-4264-b59a-ac80c951cba4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7ba19565aee65d1bb627afebec39b7de1157a8755921a4741452a9b14e9afd67
MD5 ac571f6d63046b3dceccd75ca6f1f746
SHA1 2448a10c74ec9fbf1828db3bb6968897d3563bbb
SHA512 f0d26e592b548ff297af641b245f0dd930e3de751a41b1c7d0016d3458792256c0b8b8d0d26c615e3d1d96bd0b54b863762754d1d37c03de88981a5e6cda36b5
TLSH
T1CD41085CA6E90118B3B76E1A9BF7A97E487B79773F06D55D00110E4F0A22A40D9B1733
MD5 SHA1 SHA512 TLSH

Submit Download

ABOUT

Path C:\Users\Admin\AppData\Local\PuppeteerSharp\ChromeHeadlessShell\Win64-124.0.6367.201\chrome-headless-shell-win64\ABOUT
Size 257B
SHA256 0df1f768cd389a034a9711368dced694b5fde5ac8996561bf7e0b52517cd298a
MD5 88a0f3fe060109e910fb0feda8976572
SHA1 c2c574ab7601110a9d68f211187bef3065cff143
SHA512 f414ba249589d681d633383df65e962a81c937467568db285e439cbf4098ab614e284c67d3cfee5a417d04bc956f2518bf74e8e9cd78e0aa22bcde1c3e26ee3e
TLSH
T1F3D09547F007611C7634D9E77715D003FD021320DC2B2172FB464054638FC311251388
MD5 SHA1 SHA512 TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\PuppeteerSharp\ChromeHeadlessShell\Win64-124.0.6367.201\chrome-headless-shell-win64\icudtl.dat
Size 10.2MB
SHA256 7bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9
MD5 74bded81ce10a426df54da39cfa132ff
SHA1 eb26bcc7d24be42bd8cfbded53bd62d605989bbf
SHA512 bd7b7b52d31803b2d4b1fd8cb76481931ed8abb98d779b893d3965231177bdd33386461e1a820b384712013904da094e3cd15ee24a679ddc766132677a8be54a
SSDEEP 196608:WgPBhORiuQwCliXUxbblHa93Whli6Z26wO+:W8wkDliXUxbblHa93Whli6ZUF
TLSH
T19AB63803A2FB4EC2F9F76F31D8F452679527BD496E32805A11042F3B5C336908A65BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\PuppeteerSharp\ChromeHeadlessShell\Win64-124.0.6367.201\chrome-headless-shell-win64\libEGL.dll
Size 460KB
SHA256 89c3cf5576b06b8114450f55f16f5fa0c2197db45a7ef0e57bc0eda872dcd6f5
MD5 06ed270c198a3d563ee931ac6f825683
SHA1 3c34e2bcf9099413a176085a3e1cade95035d3d2
SHA512 e865bae51bc2c2687049919a5581339a70f66beb9eb62488830be06ec1892f8bb11bc5728f9c7665469dae7333bfa110312696d954f19d0c86aad8277453a713
SSDEEP 6144:BcK5vHiyNft5P7jq7VYR4XLju5gMZ/xyaZLBqqe9qg:Bc2iy9t5P7jeNXe5gMZ/xyaZLBq
TLSH
T16DA47C0177E448A9E02BC178CA534643DA76B8960F65F6DF02A4D27D2F77BE45B3A320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\PuppeteerSharp\ChromeHeadlessShell\Win64-124.0.6367.201\chrome-headless-shell-win64\libGLESv2.dll
Size 7.6MB
SHA256 6cebea494ff17a5ec8c54b7fd5e13834eae556178ac42e7eab545263646aa080
MD5 acd281e2a183ef45f130663118d20897
SHA1 dcab723cc20477a40d99a62e6bbfb75fa470c47f
SHA512 a59c491002224e86b4598104927b4c10107bf964ea7ad192f9ac6dca8a9a5b39d0e37c888c6d2e36234eb0b48c60a55da36852d377f4a506ca41274f834703ee
SSDEEP 49152:Vr53jXUA2w3hyywOFJOaCOjQFv0HhS7kSLGo9Z+O3BiYDfekJg5UwxC+XevArJoi:jNindtv3pykS5e+RhsCXNCsorXm3e
TLSH
T16D868D03F69680D9D00DD1B89B5B9233F635B8890734B2DF2694571A2F7BBE0AB39714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\PuppeteerSharp\ChromeHeadlessShell\Win64-124.0.6367.201\chrome-headless-shell-win64\v8_context_snapshot.bin
Size 641KB
SHA256 ddd3a5acffc4e8d6b9211c84733debdf394c3cb12d702598e1a5e56b13c89c61
MD5 0753b1e35ebc257c8511b6f219fac1ec
SHA1 7acd65cbcc253130b0127a0a189601671e9fc1d1
SHA512 b9dfac660d834aacb30e6e1e272c4f0669659514f48aadc8b5542dd42ca1bd5aca4bbd00941c2ccacccc9ca068f133623dedc9994f5ccbbf1ac36bbdef99aee2
SSDEEP 6144:RPGX3u/nfW2vGgwqIZIHni9GWHQ/3DBTi3aZ3d40q4qVF+OZcZrMg2jwouoDcu:VtfVvpHOGWHhamSqVF+OVRjwouo1
TLSH
T14CD474E3BB49DB02E7E96AB2DCFAF55A7734B0C89E09512F3246136D212D7B05E0815C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\PuppeteerSharp\ChromeHeadlessShell\Win64-124.0.6367.201\chrome-headless-shell-win64\vk_swiftshader.dll
Size 5.0MB
SHA256 b1bdf61233010357f8bf5d5837719229b527581ac2ebcd5c9662f04471f2cc9e
MD5 50b6baa8afafbf849557eef9a6c600af
SHA1 8f050d6b8a89be5d27209ae26c90874757a8eb5f
SHA512 60866cc0fd0aa65febdf1da751701bcaf3cd90edf3cca3a8b3058c1aed26b56ba74332be697d22b30214446234477030a86605cc71b85940ea8adc6c169e7f35
SSDEEP 49152:v1ByexupM11LWnnpTqcGTmCXx3hfyGPsBq8Mx+Yedbv/zi+RBXph16m0X1KWcrpW:v2MupMUc5Sx+flW3On
TLSH
T12F362713B2858099F04DD179475FA633F232B8851B76B6DF52A41F092E7BBE02B39B05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\PuppeteerSharp\ChromeHeadlessShell\Win64-124.0.6367.201\chrome-headless-shell-win64\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\PuppeteerSharp\ChromeHeadlessShell\Win64-124.0.6367.201\chrome-headless-shell-win64\vulkan-1.dll
Size 925KB
SHA256 d8e0d487912f248f867ac88d3b0754cb106b73a4fc4c8a1e4db1dec6c4180f84
MD5 7dce8909b8823cbdbf143728bf1f2bf0
SHA1 7f93a6d801cf2eb5c53e7bad257e3351fa0fc87c
SHA512 ae2f8e7b0b8557bdce8c6edb5c1312ed8097c84f56247eab9cabbe3b0a8478a1238910d6bc1ce8e4ddc9423076f61abaa0758dc6b1153581a4477cc7a78cc2f2
SSDEEP 24576:8hn0GjuAhKHBEwjUrHyu6Z5W1DYsHq6g3P0zAk74fJQp:8hdMHBEqkHj6Z5W1DYsHq6g3P0zAk7I
TLSH
T1DF155D139A94896AD4769034CCC28A07CAB178915726B9CF03685708BF6FFF47B3DB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_x86_20261102020636_000_vcRuntimeMinimum_x86.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102020636_000_vcRuntimeMinimum_x86.log
Size 2KB
SHA256 013b6522629dd05b667541ed2ddadfa39c80c43c1cdb48d70607dd6bd3690280
MD5 55bfe92586c0606e13a7166b78071ed4
SHA1 809a4453c38e87dac12cf8ca1edbec86dd4dea68
SHA512 289356e945445bbe58a966a7a7d24ab87514e4d600cbd4fddbfde7e5e16fa17fc0475198fe70043e1c6c47dc0660d0bb80ac904262a2e48affc0892835faeac3
TLSH
T1CC41E8291AE6080DB1B2D647DBF7C2535A73FECA5974CB0C2289471A4667C016CBC776
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_x86_20261102020636_001_vcRuntimeAdditional_x86.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102020636_001_vcRuntimeAdditional_x86.log
Size 2KB
SHA256 f44bbf3a572ba0ba312cfca69149694d043887a992ee069274635086432becf0
MD5 973ef0313429d837677aed42016cd654
SHA1 15c990321bba44d79420f43244b23fc3e18ef15a
SHA512 6335d0be87ea60028ce5bf1a4211bf817be997cd086f1c05ccd4c3dc774dff69709311cb2a82f6d462d76b1412067cf362b3530aa90d5d9edff61d2fd0d88a87
TLSH
T1354129241AE50849B2B25B47DFF3C1535A73FDDE5434DB0C2289431A46A7D0958A877B
MD5 SHA1 SHA512 TLSH

Submit Download

vcredist.tmp

Path C:\Users\Admin\AppData\Local\Temp\vcredist.tmp
Size 13.3MB
SHA256 0c09f2611660441084ce0df425c51c11e147e6447963c3690f97e0b25c55ed64
MD5 99f52708b06b9c695a8d64a44740bf08
SHA1 c2743ffc36d2af40ade0e370be52d6b202874114
SHA512 d0a609f6b2f05939ab82aa5fde1bb0595206653a2ab2ce859a750f71596c4491a8074bb825484e365a4fbcdb820d5de0346e7209ea22214b090b4fe853098dce
SSDEEP 196608:fLZBJflpQcIIS/Rj7BWl+aV8t8z72BxBwBgO4L6f6psSD5YM4565kIgoOgP2edk:lHlptVYmfr7yBG/4L6f6pXc65kngP1
TLSH
T1A8E63332E494413BFFB604336A65E9203E7DA628274149F6E3C8FD4D3A7219267F7612
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

76aad442-03de-43e6-85b2-d0e78c496a74.tmp

Path C:\Users\Admin\Downloads\76aad442-03de-43e6-85b2-d0e78c496a74.tmp
Size 12KB
SHA256 49c63d471720b35d5074469239792e58046e9e8a4cbd3855e0823147fd8760c6
MD5 64e10b8e015e8c33519d83ad6270a81d
SHA1 00306d5948896d2547e8c63490f05d57cd5eb7a9
SHA512 c8e7883badb473af1158a722e5daa98aeb694597fa145653dc67a69c52bbb3fd6ff49c9f472dc707f19303cc856686ca77fbf0f2750c422cbcf0d639cb3a361a
SSDEEP 192:fJ7GQsroOZioc0M7kwLODvvIAnwxDwOTHHwLhY+TyESZjtcg0V0rsHoeq0YV2u:fJ7GQqc0M7kOObSdHQLhTCpcgVsIau
TLSH
T13852C0D1DE71CE4B52BCA815E9CBC139A2B8948D3BC8CBB5455EF395834FA0B901302D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Roblox.Account.Manager.3.7.2.zip.crdownload

Path C:\Users\Admin\Downloads\Roblox.Account.Manager.3.7.2.zip.crdownload
Size 4.2MB
SHA256 49b2c015da0851a2ed43820799a7bcda08e1bc5f315e107598f87f4b1bd36dac
MD5 d58b79cb3d3635ba963427362f75d075
SHA1 0e33eeff9b625fceb2d2d0195e6f32523d57db79
SHA512 176de76618d0dc43f17e2971787666b737d7308a67f40bd2bb82ab4f0d3276f877fbeb7cc987f797e6572ec736c29d8568f441194a45cb5ba8d751bf139ab79a
SSDEEP 98304:gYRAasq6wh5OiduKi0yAlWNYrsmekq13pgOtleGlci1D7VaMV:7y5haDbyAMNY4mekmCOtQi1laa
TLSH
T199163355FFF3828EC2A1A1755041ED3AFB994ACABB30DDED4A60E7E29C08D511C0679C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RAMTheme.ini

Path C:\Users\Admin\Downloads\Roblox.Account.Manager.3.7.2\RAMTheme.ini
Size 314B
SHA256 563eb35fd613f4298cd4dceff67652a13ba516a6244d9407c5709323c4ca4bb1
MD5 f18fa783f4d27e35e54e54417334bfb4
SHA1 94511cdf37213bebdaf42a6140c9fe5be8eb07ba
SHA512 602f6a68562bc89a4b3c3a71c2477377f161470bf8ae8e6925bf35691367115abfa9809925bd09c35596c6a3e5a7e9d090e5198e6a885a6658049c8732a05071
TLSH
T189E0C2EC6748160CEC30B7F63093643ABC46443B330338344A831131E080828B52E29F
MD5 SHA1 SHA512 TLSH

Submit Download

Roblox Account Manager.exe.config

Path C:\Users\Admin\Downloads\Roblox.Account.Manager.3.7.2\Roblox Account Manager.exe.config
Size 6KB
SHA256 2b6d99db8369b0ff6372737d89d1c9e4101815b4168a3852c7b513f2897e7f3d
MD5 0a86fa27d09e26491dbbb4fe27f4b410
SHA1 63e4b5afb8bdb67fc1d6f8dddeb40be20939289e
SHA512 fbebc4dc0925d5d67271cac04c1ed324091442ef4c9f6243d2c1c523c9aa6b338c6a594e4987fc142dd3b2a023338a267c8a3454e47fbf0b3e0dbd7b3b65cc0d
SSDEEP 96:UrT/VOP9NWtw/bPiR3GvUiKS4YpyMrsJ+J4YqJyM+:UrTK/2WbKS/pvrsJ+J/qJv+
TLSH
T1B6D16F11B5C8BFE00B7109A27E5FA818CB7D03A72D4D054E71EE6A8B8F7695A4347077
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log4.config

Path C:\Users\Admin\Downloads\Roblox.Account.Manager.3.7.2\log4.config
Size 936B
SHA256 e4b10630d9ec2af508de31752fbbc6816c7426c40a3e57f0a085ce7f42c77bd5
MD5 e4659ac08af3582a23f38bf6c562f841
SHA1 19cb4f014ba96285fa1798f008deabce632c7e76
SHA512 5bfa1e021cc7ee5e7a00da865d68684202b3b92d3d369b85b80c591fffa67725d434398325dc1e37c659eab62c0a4118b3e279ac0096b95790d252ceb6254249
TLSH
T179112B12DEECDD1242320D47A5620929DE7962E7052414CDB0DD639F2F3A95408A735E
MD5 SHA1 SHA512 TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\Temp\{5EBC92CC-D67F-433A-A7F1-591B40A86371}\.ba\BootstrapperApplicationData.xml
Size 12KB
SHA256 ea38da67f3785623f4c70335b51a11df7bb27528170c39ad8cbc6b15a8902744
MD5 8f5477a582ad5a7896c3067257e70d54
SHA1 444d2a5be037de61caec8f1c2e077ff0130bba6c
SHA512 52fea6d0492ad47e7a49095e4955cf174475e7f0e24bf2d065f490a474c9f66596867b7cc87506a09ec4a2bec6a5fb5983c8404a87762ea8e5aa0770bfc166a8
SSDEEP 192:X0svIhnH5zHqQHG0Hd8Hz7HE06HA0rH3F7FGxLondzLa0LiPnvBx7z8NkzzkvQWI:X0sGdLbmnoN6UZ1QpotPoZ
TLSH
T14142B7142AFD0158F1F34F88EAB955566B76FC962E38C85C01611E0E48B3E81D972FBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{72C3EB83-9B7D-4B8C-ADF3-0A7C06AC85D4}\.ba\license.rtf
Size 9KB
SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
MD5 04b33f0a9081c10e85d0e495a1294f83
SHA1 1efe2fb2d014a731b752672745f9ffecdd716412
SHA512 d1dbed00df921169dd61501e2a3e95e6d7807348b188be9dd8fc63423501e4d848ece19ac466c3cacfccc6084e0eb2f457dc957990f6f511df10fd426e432685
SSDEEP 192:H8kZ1UVDWkiWZTIsp/4hghFF1Qf4lCfnEtHixEGx736wHqItfSpOtJ32:cM1RWZMi/zzlOnjt5HLoa2
TLSH
T13F12A7A8234783D103D213D7055294C1B71F0BF6AE7AF95C34E4D53826E2E6CB6B91E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{72C3EB83-9B7D-4B8C-ADF3-0A7C06AC85D4}\.ba\thm.wxl
Size 2KB
SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
MD5 fbfcbc4dacc566a3c426f43ce10907b6
SHA1 63c45f9a771161740e100faf710f30eed017d723
SHA512 063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e
TLSH
T11F519B6778CF639028335125EAD2966A6920C5DC923F2DF1FC4A914B838D522A373F57
MD5 SHA1 SHA512 TLSH

Submit Download

thm.xml

Path C:\Windows\Temp\{72C3EB83-9B7D-4B8C-ADF3-0A7C06AC85D4}\.ba\thm.xml
Size 8KB
SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
MD5 f62729c6d2540015e072514226c121c7
SHA1 c1e189d693f41ac2eafcc363f7890fc0fea6979c
SHA512 cbbfbfa7e013a2b85b78d71d32fdf65323534816978e7544ca6cea5286a0f6e8e7e5ffc4c538200211f11b94373d5658732d5d8aa1d01f9ccfdbf20f154f1471
SSDEEP 96:8L2HdQG+3VzHfz96zYFGaPSWXdhRAmImlqFQKFBiUxn7Ke5A82rkO/pWk3nswP:ZHAzZ/3
TLSH
T1D30259B546DDB801D232FB1166E231D27F126971C0C46E59F90C2AFB5FE1140A8B72BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{72C3EB83-9B7D-4B8C-ADF3-0A7C06AC85D4}\.ba\wixstdba.dll
Size 191KB
SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
MD5 eab9caf4277829abdf6223ec1efa0edd
SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
SSDEEP 3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53EfcUzN0m6I+WxBlnKzeZuqt:OXoQNb++gDrSJdr8BHkPh3wIgnK/IU1a
TLSH
T103149E11B5D0907AE7FB1A385938B5216D7FBA201B60C99E17589D6F2DF02C0AF35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist.tmp

Path C:\Windows\Temp\{8815BC67-FFDF-44B5-AB24-FD40CE268D5E}\.cr\vcredist.tmp
Size 669KB
SHA256 4a6e1044ff0f49d2e3b12f7c40352c7e573e0c58f3b3cc0b55b63c95ede87828
MD5 f216f5ee89b18a28a3936fab57c16179
SHA1 3d2995962598774a8e2dc1d038c76495466f3a72
SHA512 9350de18d452927efef3be3dd4c49361ec6b29f22e969781374508b167b4e697dcea05ee6b43b47b850d4edd0591b960628ee9cbc59deee62937a40a8e5a6573
SSDEEP 12288:n3mgqnIZuYfCYqFet4CovkM7y+1nEn0/6OaFUuT80iP:n3WnIZuMCxezot7Dh+0/9ayn0i
TLSH
T18CE49D32A5614033FBF10573B928A6303E7CE7282751C8A9D7D4AD1D7EA58C2A7F7216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{B25FE2EF-9D65-4BA2-B512-8EE39A417E7D}\.ba\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{B25FE2EF-9D65-4BA2-B512-8EE39A417E7D}\.ba\wixstdba.dll
Size 215KB
SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
MD5 f68f43f809840328f4e993a54b0d5e62
SHA1 01da48ce6c81df4835b4c2eca7e1d447be893d39
SHA512 a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1
SSDEEP 6144:K6EZdi6e93SuDeTKZxQfsRy26BqbUHYJe:K62i6eNSYeuZ2sRDK
TLSH
T15E24AF12B5D0907AEBFB19305939E5216DBDBA210FA0C9CE5348AD2B2E705C1DB36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab54A5CABBE7274D8A22EB58060AAB7623

Path C:\Windows\Temp\{B25FE2EF-9D65-4BA2-B512-8EE39A417E7D}\cab54A5CABBE7274D8A22EB58060AAB7623
Size 838KB
SHA256 c9935322c0af2fe00ebb018f8b0b908018576048fa4d3c0376a30ebf0eb2cf50
MD5 d8b6763546bb89d2d9cf3c45908b1e4b
SHA1 a1d28457d45a80bcf29618ebbdd9c50808acae5d
SHA512 194d06552d8a3b107851de79f7e9b17f4b143f62886abc71928c899e808c9d0a35417fb1813bfb918ced5f2058bfa58dfd34f837be0833d4b2ea9b143ba42081
SSDEEP 24576:P+EPvFdDKnDzR8ezJwqgq3anXt/WNsJsI96p+L2TI0X:PH9oXzdgUq+NAsXo2T3
TLSH
T1C70523DA72D3A60BED4C2DC008BDE5631D37BAFE9412D38A6174807A39CB7D456342AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cabB3E1576D1FEFBB979E13B1A5379E0B16

Path C:\Windows\Temp\{B25FE2EF-9D65-4BA2-B512-8EE39A417E7D}\cabB3E1576D1FEFBB979E13B1A5379E0B16
Size 4.9MB
SHA256 01b11076177c8a5ee37eba745142cd6bbc4ac1ebfc4ebe48c85bd285a73ebf60
MD5 1d033900fb3774d9025fa656f175d39e
SHA1 9cbc362c97c37aa5236c49e7b974e4a62bbd9d21
SHA512 b96914b5e8c4951dc4f6b08b96e548c7328424a78d9b1394f1c2ab2ebf2f870b5c3e6f685c656cc1d6dccc396ece88ae6f23918cfa1c9ade22828972a0468f75
SSDEEP 98304:zExLOQyFMLkrdAyYPk9Lqy5dPFpDoNRAKHSEPFVzyJUkeOwnxRj8oFFZY:saQyKLksPk461fDo3PFVzyJ7eVnFo
TLSH
T172363318C4712B0ABC1E482455E3DE84FDC5B9DAAA863BD7F264B74C29437957B30C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcRuntimeAdditional_x86

Path C:\Windows\Temp\{B25FE2EF-9D65-4BA2-B512-8EE39A417E7D}\vcRuntimeAdditional_x86
Size 200KB
SHA256 3e4a528fe5263a5dc44455d0ab2717f0c02acdc120c918cf43730ce9f36ccbb5
MD5 e4c2fa6814ad5061be3d081e5102eb1d
SHA1 89bee5a8cbd82937bd2222cc6e97b3648e8e491f
SHA512 5ebe95053ed100758711fa2a5d4bc12f3c976b8b2a27b8a88d6d10f666b6c5170698939b03c30ccb06acebd5d703d90045eb236cc4cfe55d1c92c31e8de87575
SSDEEP 3072:x9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriThXC:DlaZeKFxCnBheIdluA
TLSH
T17014AE12B5808033DAFE1A351178DB615F3DBE608F54499B2364B6AD1E717C08F3AAB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2568-605-0x0000000000D60000-0x00000000012CC000-memory.dmp

Download

memory/2568-607-0x0000000005C90000-0x0000000005CD6000-memory.dmp

Download

memory/2568-606-0x00000000061D0000-0x0000000006774000-memory.dmp

Download

memory/2568-609-0x0000000005CE0000-0x0000000005D06000-memory.dmp

Download

memory/2568-608-0x0000000005D80000-0x0000000005E12000-memory.dmp

Download

memory/2744-714-0x000000000D4B0000-0x000000000D804000-memory.dmp

Download

memory/2744-646-0x000000000E410000-0x000000000E4C2000-memory.dmp

Download

memory/2744-742-0x000000000D8A0000-0x000000000D8B2000-memory.dmp

Download

memory/2744-634-0x0000000007AF0000-0x0000000007AFA000-memory.dmp

Download

memory/2744-633-0x000000000AE90000-0x000000000AECA000-memory.dmp

Download

memory/2744-619-0x0000000005E90000-0x0000000005E9A000-memory.dmp

Download

memory/2744-635-0x000000000BBA0000-0x000000000BC40000-memory.dmp

Download

memory/2744-712-0x000000000D460000-0x000000000D4B0000-memory.dmp

Download

memory/2744-618-0x0000000005DD0000-0x0000000005E44000-memory.dmp

Download

memory/2744-713-0x000000000B1F0000-0x000000000B1F8000-memory.dmp

Download

memory/2744-643-0x00000000077D0000-0x0000000007828000-memory.dmp

Download

memory/2744-741-0x000000000D870000-0x000000000D87A000-memory.dmp

Download

memory/2744-647-0x000000000E4C0000-0x000000000E4E2000-memory.dmp

Download

memory/2744-649-0x000000000E5E0000-0x000000000E5FA000-memory.dmp

Download

memory/2744-650-0x000000000C0F0000-0x000000000C0F8000-memory.dmp

Download

memory/2744-1173-0x000000000B090000-0x000000000B0CE000-memory.dmp

Download

memory/2744-648-0x000000000E4F0000-0x000000000E5E4000-memory.dmp

Download

memory/4124-1165-0x0000000000AA0000-0x0000000000B17000-memory.dmp

Download

memory/5236-1163-0x0000000000AA0000-0x0000000000B17000-memory.dmp

Download

memory/5704-1166-0x0000000000AA0000-0x0000000000B17000-memory.dmp

Download

memory/5920-1172-0x00000231D35F0000-0x00000231D40B1000-memory.dmp

Download