hxxps://github[.]com/ic3w0lf22/Roblox-Account-Manager/releases/tag/3[.]6[.]1

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/08/2024, 19:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/ic3w0lf22/Roblox-Account-Manager/releases/tag/3.6.1

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	vcredist.tmp

Executes dropped EXE 3 IoCs

pid	Process
2952	vcredist.tmp
2852	vcredist.tmp
2536	VC_redist.x86.exe

Loads dropped DLL 5 IoCs

pid	Process
4036	Roblox Account Manager.exe
2852	vcredist.tmp
4928	VC_redist.x86.exe
3220	Roblox Account Manager.exe
3220	Roblox Account Manager.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{47109d57-d746-4f8b-9618-ed6a17cc922b} = "\"C:\\ProgramData\\Package Cache\\{47109d57-d746-4f8b-9618-ed6a17cc922b}\\VC_redist.x86.exe\" /burn.runonce"	VC_redist.x86.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
78	raw.githubusercontent.com
79	raw.githubusercontent.com
102	raw.githubusercontent.com

Drops file in System32 directory 49 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140cht.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140chs.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140rus.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfcm140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140fra.dll	msiexec.exe
File created	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140kor.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140chs.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140enu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140ita.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140cht.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcamp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140ita.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140enu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140deu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcomp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcomp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcruntime140_threads.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140.dll	msiexec.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI571F.tmp	msiexec.exe
File created	C:\Windows\Installer\e5951f1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI68B5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6AAA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5B17.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{5EA6C998-D5AC-4ED9-89C3-9F25B17CCD3D}	msiexec.exe
File opened for modification	C:\Windows\Installer\e5951df.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0C3457A0-3DCE-4A33-BEF0-9B528C557771}	msiexec.exe
File created	C:\Windows\Installer\e5951f0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5951f1.msi	msiexec.exe
File created	C:\Windows\Installer\e5951df.msi	msiexec.exe
File created	C:\Windows\Installer\e595206.msi	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Roblox Account Manager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Roblox Account Manager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Roblox Account Manager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000c9aa8484b1ca68e90000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000c9aa84840000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900c9aa8484000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dc9aa8484000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000c9aa848400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Internet Explorer\TypedURLs	Roblox Account Manager.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Internet Explorer\TypedURLs	Roblox Account Manager.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\Version = "14.40.33810"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\899C6AE5CA5D9DE4983CF9521BC7DCD3\SourceList\PackageName = "vc_runtimeAdditional_x86.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0A7543C0ECD333A4EB0FB925C8557717\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A7543C0ECD333A4EB0FB925C8557717\PackageCode = "829638B4928B2094C8872CEC8D04BB92"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A7543C0ECD333A4EB0FB925C8557717\DeploymentFlags = "3"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A7543C0ECD333A4EB0FB925C8557717\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\899C6AE5CA5D9DE4983CF9521BC7DCD3\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.40,bundle\Dependents\{47109d57-d746-4f8b-9618-ed6a17cc922b}	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.40,bundle\Version = "14.40.33810.0"	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\DisplayName = "Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.40.33810"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A7543C0ECD333A4EB0FB925C8557717\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{0C3457A0-3DCE-4A33-BEF0-9B528C557771}v14.40.33810\\packages\\vcRuntimeMinimum_x86\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\Dependents\{47109d57-d746-4f8b-9618-ed6a17cc922b}	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\899C6AE5CA5D9DE4983CF9521BC7DCD3\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\899C6AE5CA5D9DE4983CF9521BC7DCD3\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.40,bundle\Dependents	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A7543C0ECD333A4EB0FB925C8557717\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{0C3457A0-3DCE-4A33-BEF0-9B528C557771}v14.40.33810\\packages\\vcRuntimeMinimum_x86\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\899C6AE5CA5D9DE4983CF9521BC7DCD3\VC_Runtime_Additional	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\899C6AE5CA5D9DE4983CF9521BC7DCD3	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\899C6AE5CA5D9DE4983CF9521BC7DCD3\PackageCode = "56C1F3EFF13FBC94887129B2E83EB575"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0A7543C0ECD333A4EB0FB925C8557717	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A7543C0ECD333A4EB0FB925C8557717\AdvertiseFlags = "388"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A7543C0ECD333A4EB0FB925C8557717\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A7543C0ECD333A4EB0FB925C8557717\SourceList\PackageName = "vc_runtimeMinimum_x86.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\ = "{5EA6C998-D5AC-4ED9-89C3-9F25B17CCD3D}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\899C6AE5CA5D9DE4983CF9521BC7DCD3\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\VC,redist.x86,x86,14.40,bundle	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.40,bundle\ = "{47109d57-d746-4f8b-9618-ed6a17cc922b}"	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0A7543C0ECD333A4EB0FB925C8557717\VC_Runtime_Minimum	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_X86,V14\DEPENDENTS\{4D8DCF8C-A72A-43E1-9833-C12724DB736E}	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5040806F8AF9AAC49928419ED5A1D3CA	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\Version = "14.40.33810"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\899C6AE5CA5D9DE4983CF9521BC7DCD3\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{5EA6C998-D5AC-4ED9-89C3-9F25B17CCD3D}v14.40.33810\\packages\\vcRuntimeAdditional_x86\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\899C6AE5CA5D9DE4983CF9521BC7DCD3\Version = "237536274"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\899C6AE5CA5D9DE4983CF9521BC7DCD3\InstanceType = "0"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.30,bundle\Dependents	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A7543C0ECD333A4EB0FB925C8557717	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A7543C0ECD333A4EB0FB925C8557717\Version = "237536274"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E8B87C56C0E773581D82F286F95E50	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E8B87C56C0E773581D82F286F95E50\899C6AE5CA5D9DE4983CF9521BC7DCD3	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\DisplayName = "Microsoft Visual C++ 2022 X86 Additional Runtime - 14.40.33810"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E8B87C56C0E773581D82F286F95E50	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\899C6AE5CA5D9DE4983CF9521BC7DCD3\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\899C6AE5CA5D9DE4983CF9521BC7DCD3\Servicing_Key	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\899C6AE5CA5D9DE4983CF9521BC7DCD3\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\899C6AE5CA5D9DE4983CF9521BC7DCD3\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.40,bundle\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.40.33810"	VC_redist.x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A7543C0ECD333A4EB0FB925C8557717\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A7543C0ECD333A4EB0FB925C8557717\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\679E80FBE29B63345BF612177149674C	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_X86,V14\DEPENDENTS\{4D8DCF8C-A72A-43E1-9833-C12724DB736E}	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A7543C0ECD333A4EB0FB925C8557717\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A7543C0ECD333A4EB0FB925C8557717\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\ = "{0C3457A0-3DCE-4A33-BEF0-9B528C557771}"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
2916	msedge.exe
2916	msedge.exe
4420	msedge.exe
4420	msedge.exe
3752	identity_helper.exe
3752	identity_helper.exe
4504	msedge.exe
4504	msedge.exe
3932	msiexec.exe
3932	msiexec.exe
3932	msiexec.exe
3932	msiexec.exe
3932	msiexec.exe
3932	msiexec.exe
2536	VC_redist.x86.exe
2536	VC_redist.x86.exe
2536	VC_redist.x86.exe
2536	VC_redist.x86.exe
2536	VC_redist.x86.exe
2536	VC_redist.x86.exe
3932	msiexec.exe
3932	msiexec.exe
3932	msiexec.exe
3932	msiexec.exe
3932	msiexec.exe
3932	msiexec.exe
3932	msiexec.exe
3932	msiexec.exe
3932	msiexec.exe
3932	msiexec.exe
3932	msiexec.exe
3932	msiexec.exe
3932	msiexec.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4036	Roblox Account Manager.exe
3220	Roblox Account Manager.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4036	Roblox Account Manager.exe
Token: SeBackupPrivilege	4252	vssvc.exe
Token: SeRestorePrivilege	4252	vssvc.exe
Token: SeAuditPrivilege	4252	vssvc.exe
Token: SeShutdownPrivilege	2536	VC_redist.x86.exe
Token: SeIncreaseQuotaPrivilege	2536	VC_redist.x86.exe
Token: SeSecurityPrivilege	3932	msiexec.exe
Token: SeCreateTokenPrivilege	2536	VC_redist.x86.exe
Token: SeAssignPrimaryTokenPrivilege	2536	VC_redist.x86.exe
Token: SeLockMemoryPrivilege	2536	VC_redist.x86.exe
Token: SeIncreaseQuotaPrivilege	2536	VC_redist.x86.exe
Token: SeMachineAccountPrivilege	2536	VC_redist.x86.exe
Token: SeTcbPrivilege	2536	VC_redist.x86.exe
Token: SeSecurityPrivilege	2536	VC_redist.x86.exe
Token: SeTakeOwnershipPrivilege	2536	VC_redist.x86.exe
Token: SeLoadDriverPrivilege	2536	VC_redist.x86.exe
Token: SeSystemProfilePrivilege	2536	VC_redist.x86.exe
Token: SeSystemtimePrivilege	2536	VC_redist.x86.exe
Token: SeProfSingleProcessPrivilege	2536	VC_redist.x86.exe
Token: SeIncBasePriorityPrivilege	2536	VC_redist.x86.exe
Token: SeCreatePagefilePrivilege	2536	VC_redist.x86.exe
Token: SeCreatePermanentPrivilege	2536	VC_redist.x86.exe
Token: SeBackupPrivilege	2536	VC_redist.x86.exe
Token: SeRestorePrivilege	2536	VC_redist.x86.exe
Token: SeShutdownPrivilege	2536	VC_redist.x86.exe
Token: SeDebugPrivilege	2536	VC_redist.x86.exe
Token: SeAuditPrivilege	2536	VC_redist.x86.exe
Token: SeSystemEnvironmentPrivilege	2536	VC_redist.x86.exe
Token: SeChangeNotifyPrivilege	2536	VC_redist.x86.exe
Token: SeRemoteShutdownPrivilege	2536	VC_redist.x86.exe
Token: SeUndockPrivilege	2536	VC_redist.x86.exe
Token: SeSyncAgentPrivilege	2536	VC_redist.x86.exe
Token: SeEnableDelegationPrivilege	2536	VC_redist.x86.exe
Token: SeManageVolumePrivilege	2536	VC_redist.x86.exe
Token: SeImpersonatePrivilege	2536	VC_redist.x86.exe
Token: SeCreateGlobalPrivilege	2536	VC_redist.x86.exe
Token: SeRestorePrivilege	3932	msiexec.exe
Token: SeTakeOwnershipPrivilege	3932	msiexec.exe
Token: SeRestorePrivilege	3932	msiexec.exe
Token: SeTakeOwnershipPrivilege	3932	msiexec.exe
Token: SeRestorePrivilege	3932	msiexec.exe
Token: SeTakeOwnershipPrivilege	3932	msiexec.exe
Token: SeRestorePrivilege	3932	msiexec.exe
Token: SeTakeOwnershipPrivilege	3932	msiexec.exe
Token: SeRestorePrivilege	3932	msiexec.exe
Token: SeTakeOwnershipPrivilege	3932	msiexec.exe
Token: SeRestorePrivilege	3932	msiexec.exe
Token: SeTakeOwnershipPrivilege	3932	msiexec.exe
Token: SeRestorePrivilege	3932	msiexec.exe
Token: SeTakeOwnershipPrivilege	3932	msiexec.exe
Token: SeRestorePrivilege	3932	msiexec.exe
Token: SeTakeOwnershipPrivilege	3932	msiexec.exe
Token: SeRestorePrivilege	3932	msiexec.exe
Token: SeTakeOwnershipPrivilege	3932	msiexec.exe
Token: SeRestorePrivilege	3932	msiexec.exe
Token: SeTakeOwnershipPrivilege	3932	msiexec.exe
Token: SeRestorePrivilege	3932	msiexec.exe
Token: SeTakeOwnershipPrivilege	3932	msiexec.exe
Token: SeRestorePrivilege	3932	msiexec.exe
Token: SeTakeOwnershipPrivilege	3932	msiexec.exe
Token: SeRestorePrivilege	3932	msiexec.exe
Token: SeTakeOwnershipPrivilege	3932	msiexec.exe
Token: SeRestorePrivilege	3932	msiexec.exe
Token: SeTakeOwnershipPrivilege	3932	msiexec.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 4048	4420	msedge.exe	83
PID 4420 wrote to memory of 4048	4420	msedge.exe	83
PID 4420 wrote to memory of 1360	4420	msedge.exe	84
PID 4420 wrote to memory of 1360	4420	msedge.exe	84
PID 4420 wrote to memory of 1360	4420	msedge.exe	84
PID 4420 wrote to memory of 1360	4420	msedge.exe	84
PID 4420 wrote to memory of 1360	4420	msedge.exe	84
PID 4420 wrote to memory of 1360	4420	msedge.exe	84
PID 4420 wrote to memory of 1360	4420	msedge.exe	84
PID 4420 wrote to memory of 1360	4420	msedge.exe	84
PID 4420 wrote to memory of 1360	4420	msedge.exe	84
PID 4420 wrote to memory of 1360	4420	msedge.exe	84
PID 4420 wrote to memory of 1360	4420	msedge.exe	84
PID 4420 wrote to memory of 1360	4420	msedge.exe	84
PID 4420 wrote to memory of 1360	4420	msedge.exe	84
PID 4420 wrote to memory of 1360	4420	msedge.exe	84
PID 4420 wrote to memory of 1360	4420	msedge.exe	84
PID 4420 wrote to memory of 1360	4420	msedge.exe	84
PID 4420 wrote to memory of 1360	4420	msedge.exe	84
PID 4420 wrote to memory of 1360	4420	msedge.exe	84
PID 4420 wrote to memory of 1360	4420	msedge.exe	84
PID 4420 wrote to memory of 1360	4420	msedge.exe	84
PID 4420 wrote to memory of 1360	4420	msedge.exe	84
PID 4420 wrote to memory of 1360	4420	msedge.exe	84
PID 4420 wrote to memory of 1360	4420	msedge.exe	84
PID 4420 wrote to memory of 1360	4420	msedge.exe	84
PID 4420 wrote to memory of 1360	4420	msedge.exe	84
PID 4420 wrote to memory of 1360	4420	msedge.exe	84
PID 4420 wrote to memory of 1360	4420	msedge.exe	84
PID 4420 wrote to memory of 1360	4420	msedge.exe	84
PID 4420 wrote to memory of 1360	4420	msedge.exe	84
PID 4420 wrote to memory of 1360	4420	msedge.exe	84
PID 4420 wrote to memory of 1360	4420	msedge.exe	84
PID 4420 wrote to memory of 1360	4420	msedge.exe	84
PID 4420 wrote to memory of 1360	4420	msedge.exe	84
PID 4420 wrote to memory of 1360	4420	msedge.exe	84
PID 4420 wrote to memory of 1360	4420	msedge.exe	84
PID 4420 wrote to memory of 1360	4420	msedge.exe	84
PID 4420 wrote to memory of 1360	4420	msedge.exe	84
PID 4420 wrote to memory of 1360	4420	msedge.exe	84
PID 4420 wrote to memory of 1360	4420	msedge.exe	84
PID 4420 wrote to memory of 1360	4420	msedge.exe	84
PID 4420 wrote to memory of 2916	4420	msedge.exe	85
PID 4420 wrote to memory of 2916	4420	msedge.exe	85
PID 4420 wrote to memory of 3048	4420	msedge.exe	86
PID 4420 wrote to memory of 3048	4420	msedge.exe	86
PID 4420 wrote to memory of 3048	4420	msedge.exe	86
PID 4420 wrote to memory of 3048	4420	msedge.exe	86
PID 4420 wrote to memory of 3048	4420	msedge.exe	86
PID 4420 wrote to memory of 3048	4420	msedge.exe	86
PID 4420 wrote to memory of 3048	4420	msedge.exe	86
PID 4420 wrote to memory of 3048	4420	msedge.exe	86
PID 4420 wrote to memory of 3048	4420	msedge.exe	86
PID 4420 wrote to memory of 3048	4420	msedge.exe	86
PID 4420 wrote to memory of 3048	4420	msedge.exe	86
PID 4420 wrote to memory of 3048	4420	msedge.exe	86
PID 4420 wrote to memory of 3048	4420	msedge.exe	86
PID 4420 wrote to memory of 3048	4420	msedge.exe	86
PID 4420 wrote to memory of 3048	4420	msedge.exe	86
PID 4420 wrote to memory of 3048	4420	msedge.exe	86
PID 4420 wrote to memory of 3048	4420	msedge.exe	86
PID 4420 wrote to memory of 3048	4420	msedge.exe	86
PID 4420 wrote to memory of 3048	4420	msedge.exe	86
PID 4420 wrote to memory of 3048	4420	msedge.exe	86

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/ic3w0lf22/Roblox-Account-Manager/releases/tag/3.6.1
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe8dff46f8,0x7ffe8dff4708,0x7ffe8dff4718
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,16361759525573824029,10108368742319149691,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,16361759525573824029,10108368742319149691,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,16361759525573824029,10108368742319149691,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16361759525573824029,10108368742319149691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16361759525573824029,10108368742319149691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,16361759525573824029,10108368742319149691,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,16361759525573824029,10108368742319149691,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16361759525573824029,10108368742319149691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16361759525573824029,10108368742319149691,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16361759525573824029,10108368742319149691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16361759525573824029,10108368742319149691,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,16361759525573824029,10108368742319149691,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16361759525573824029,10108368742319149691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,16361759525573824029,10108368742319149691,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,16361759525573824029,10108368742319149691,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4860 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3512

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3392

C:\Users\Admin\Desktop\Roblox Account Manager\Roblox Account Manager.exe
"C:\Users\Admin\Desktop\Roblox Account Manager\Roblox Account Manager.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2204
- C:\Users\Admin\Desktop\Roblox Account Manager\Roblox Account Manager.exe
  "C:\Users\Admin\Desktop\Roblox Account Manager\Roblox Account Manager.exe" -restart
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:4036
- - C:\Users\Admin\AppData\Local\Temp\vcredist.tmp
    "C:\Users\Admin\AppData\Local\Temp\vcredist.tmp" /q /norestart
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2952
  - - C:\Windows\Temp\{3ECD2CBA-541F-4743-A4FB-FE76937F70E8}\.cr\vcredist.tmp
      "C:\Windows\Temp\{3ECD2CBA-541F-4743-A4FB-FE76937F70E8}\.cr\vcredist.tmp" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\vcredist.tmp" -burn.filehandle.attached=564 -burn.filehandle.self=572 /q /norestart
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2852
    - - C:\Windows\Temp\{02B4AEB0-7EAC-4F8F-AD46-3F6684B9A622}\.be\VC_redist.x86.exe
        
        "C:\Windows\Temp\{02B4AEB0-7EAC-4F8F-AD46-3F6684B9A622}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{A413C2F3-41E8-4B59-B70F-862DD6D6E5CE} {48C8CF63-D01E-4E21-B566-C73028D76F44} 2852
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2536
      - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={47109d57-d746-4f8b-9618-ed6a17cc922b} -burn.filehandle.self=1052 -burn.embedded BurnPipe.{02164A1E-D5D5-41CE-A977-4EC5CA137F7C} {93C38640-387A-4297-B3A0-CD29225E3FEC} 2536
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3276
        
        C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=544 -burn.filehandle.self=564 -uninstall -quiet -burn.related.upgrade -burn.ancestors={47109d57-d746-4f8b-9618-ed6a17cc922b} -burn.filehandle.self=1052 -burn.embedded BurnPipe.{02164A1E-D5D5-41CE-A977-4EC5CA137F7C} {93C38640-387A-4297-B3A0-CD29225E3FEC} 2536
        7⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4928
        
        C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{3729794D-D1FC-4173-AD1F-FE5A5DDDFBD0} {BB7B50F2-6041-45F4-AC85-DC21BFC61E9F} 4928
        8⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3348

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4252

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:4364

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3932

C:\Users\Admin\Desktop\Roblox Account Manager\Roblox Account Manager.exe
"C:\Users\Admin\Desktop\Roblox Account Manager\Roblox Account Manager.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
PID:3220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5951e4.rbs

Filesize
16KB

MD5
9228e4dcf1e9bdca16bc6317e9cd82d3

SHA1
3e1a57c6f74c955a2941642dc294ef7b70655816

SHA256
0002d43f14342394701e539436dd74789a27f8ac0828214ac7b28541ad625c8e

SHA512
7f1beaaa4b03bab19aca7e3433bd6d5f34776923027032b921586c3501d3d144bfdefd009c8822c0c404c519aed315b743e22bf3c1984ff671ca72f554d6e6a6

Download Submit
C:\Config.Msi\e5951e9.rbs

Filesize
18KB

MD5
531ec98dd088602afef34217562d6980

SHA1
5d3388cfe8a6dccccf6382068d29634b87c8f61d

SHA256
50f040721bbc599447fb839e5b7f1c0261f98dfc87e4e2de3fda79086836baa9

SHA512
2438797c7a303073bcee1d642339505017f7f4f01cd14a89e174623f9a14f7b671f66dc2fcbfe8281f4055f1450b4ae512011662f99459ec6faeb22d0de94b33

Download Submit
C:\Config.Msi\e5951f6.rbs

Filesize
20KB

MD5
e8de79a57880c22985e15113f8eb120b

SHA1
3df1d28336928b6324933ba5b824cd77b6589425

SHA256
5705472ee2f74030e5fa5ed4656e4e7905c7dca21d76e4581731477df60ace31

SHA512
f70dbfd53a6bf01e88ce79fe0075682d6c3e47a5298f86aaed07ed31aa1201cf01382e18da0ea04bb8585d90824dabde78cc67b3fad7e9cfc9a93debb9945b0f

Download Submit
C:\Config.Msi\e595205.rbs

Filesize
19KB

MD5
33b2e6c5d8a6906c1ad31c93d9870627

SHA1
db1b4fd486f9a5fa0bc2601822f7ce658e1f362a

SHA256
995cbfc4bb4dd89e770db8324e0cee3c368d6ea800b0526c3644b21eaf830695

SHA512
02183b8dd02ba34656ff051104454f8f9138b2ac5f83fbf000ca5f3b361749812f055952bf63afdbabef2436e99f1c7b37b30c6f50d9e5dd59f77b87ae4838f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Roblox Account Manager.exe.log

Filesize
1KB

MD5
a02e8a8a790f0e0861e3b6b0dbe56062

SHA1
a3e65805e5c78641cafebc1052906d7350da9d2e

SHA256
7fada0f81b63e1ecb265e9620ace8f5f0d40773626081849f5d98e668bc4e594

SHA512
108a81f818aa027834d621c771e427ee3f300c59d9dc10d853b94b1e8d635cf6bc06338dce31da30b08660c6fb06a39f9069c983bb585049f5fe9f50b753eb42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\91f93e11-2de8-4a60-b511-5b15a225f31f.tmp

Filesize
11KB

MD5
e2893fca2565783a36cb9f2ffc2e6b84

SHA1
557741fbfa2a7e4583bb9bad31639f3c8bd792ce

SHA256
a3c1b66c3148275d163a0072d248ae566add13ec9f4879cdb05ceb512d4106eb

SHA512
ad7b7602a33bfdb4289703d83552fc9395c7192c7a26b9b440f0b5b098982602f7071e8fc23349227f1a398aa2ed8d4105195b2d47c27c016ce4a5c6ded3bace

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ab4c7e4dbb6abf2b66d2fa61e449b2f6

SHA1
42c1b513664d8c8f28fcfce89b9e93817fe9d21d

SHA256
12f5718860ab56b9b3ea8e0452309e2974974dd275cffde27be5b44cc7191233

SHA512
bd06fba8621441dba795db119ddf3406d6e00ea9429b22f74524a04669d1cbb80833473a6b6dfb3a244563cc6cf6e63c4103e0c6fcc5993ffdbb8141f1c63504

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
486f305a90a456ee245f58c283ed7075

SHA1
ffb22f995cbc936b3a8ad34ff3e0ac0d94b02d51

SHA256
94157b6388a91a38407aad2ffe09238b41eede735416fd6c208bc0af6d1a8b03

SHA512
65146c487ab665d5a3b588b414d51d75977eb72dbf268bffbfa1bed4ef5d47e7219b8b4cfebaf721eb9aafb15fcccf2811e9bb4d9e206fc59b7592fe03dfb8d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ffa50de781bae253e4cf8edc170a46e0

SHA1
f78e78d86a4b37a119102eef26827f97a4519595

SHA256
0aa40a2a56fadc33070dcf6dec9f6df29814a686af86c547718f947fd1ce658e

SHA512
f545eefc96e469d4d6689051e5d42ff93364264a68e67a95977fd21a69c1982056dee2414ae1ffb0a1203cc2d0e539ced0bf5e90b1b08e0eead6dfe8aa26f2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
65b6564844f7ab95544e92506f292cc7

SHA1
0f1f2fec401c4f4c041d08e2c08de59941c3b8fd

SHA256
87aef1c5851b2248fa31813d690c3516a69f413a7ba5bbcb5af8c77c583552f8

SHA512
85a0e7503db1407d2d28afcd4b66478ab2ca9e228c8c0c5de67140966f6196644282f6a656e7606b8e5aa210702fc1302612376ac4b06d112cfc27a4cb6ba753

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3e3ed5d544ea1c511959a3dadf983958

SHA1
9df519e7f2f5aff1a58edf6e259c05971749023d

SHA256
ca3d17674dd7b697c15e77c559df5cb2dcd8401cc938518d4ca0e0c30d2b8c02

SHA512
e49b62587d10bd5e10d12bad04fc8f598ca686b15c2715cd7cbb9015180201a65afed45005f0b982796db9ab153baa30a3c260c78789fa9a4bd2d9ba46166fbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bffe7013a323e37421fc7ab3bce652a1

SHA1
c5c6349aa6dd8c46ea2193da28ea406527a88e68

SHA256
a01e9217f61d627260979d8c2d6301aff88cdc31fde9c61be5b635e693d3c4aa

SHA512
bd92e5cd33283f66eac8bee8125cba8a26051079be742a980dcdac554d146c5dfd1d83004a0fa211a983d4853d180373810892a7c7f7011e8989beb1470f8362

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
91ef662d5bfedf97d706dd30833c68c3

SHA1
ea63db9ad44e63af5bcf409e68bc7198f7002634

SHA256
72a9bae304040cc5c58faf1f25580661589f3177b6dbb12499d8f85dc354f218

SHA512
dd14d5f5bd9645217d4e49e65e061795d17653033c58f058d376b520d5bd208fab1dfa56ca2e96e0526604441b2f46e28486b67e9b0fafacee653ff3fc6bd542

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
866B

MD5
b41fc1948f3dcc2940e67c666a02d091

SHA1
ab3a22057342af23427c483e45f9cdbbc87f175d

SHA256
615a82f0f37878c46df51372f0ac1684107c13b7a3fcbdf5e924073cbcb9caf1

SHA512
ba58651cdfc253bef7f098e60f61c6da32dad916a6007458542e85432b4d09846c9a5ff63ad4020e896514710d25ca2ed4f814bded6cf7e6e5d7513f0e2c12fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
866B

MD5
e370756584d916a9c46d708c3587f945

SHA1
de83a092e614da14773de527b761202bee92624c

SHA256
ee59b17f5c862d48c56bf862e0ba15701b2169e4397113221abf6e9b11366cd7

SHA512
c33232209593d1cc7c964c421bb151f870232459ed3e679a4cea26bea3dc1d704bb326a23b166bed2537a30b1c4021875528349c6747b25648b4669823c0c7a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
866B

MD5
62b707ebadc793f3bae5756ea4ac7d73

SHA1
27cc48e0a2df9d0f6175d5ac6f660b96d7688277

SHA256
60c8f272bb93dd0bff0837f527fd9476bd5f31284628524d3e4727b0f91a4aef

SHA512
1531770b48d853b3b0acdf657c82af527d5c22bb849f5e738b0688f6c9ae2039dd5f9a769e4b5c39d9fb49b969f80f136c5fbbdf700873da4501a168a1de4955

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58073e.TMP

Filesize
866B

MD5
0a39399911f7c56d155fc8b35aad7621

SHA1
65b636d008dfec2138bda379e53587b63c1bea95

SHA256
211c05aeefa2293651ff2f1598d8648b913f050075464828bd68ef3979871e37

SHA512
9c95ba421df3e2a04283c963e6023bea68f24bfa527102379b0871346069358e86b4129a6f73173ec2d87faa868928821f7d611c8033b7965b45b97074bef07a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
981e6ede31d079f8e56fbd2e1d14ea66

SHA1
7e7fd55c7c79330ae818454157a5593c2f23affd

SHA256
17d6711cbd7c465bd5d84cfcb368691a5319c2d105032008752a434684b79bb6

SHA512
0d1e415f3ecd13746e15b82d98d283ccec8c4d0c530a07c7db73d621efb2079a4ba69e9e37ff9f1b6afb5b3e9bda3fa757ecb87d04badb2bdb681fc1015b806d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1dc4dbd93770a34e445ccb3e44460ed5

SHA1
151aa1ee43a1bc65527b9e584451551753e397cb

SHA256
ea67f25f96e511b6ab34a5d12721ffc2b3381a0cb6bc4270e6258d9895e027e2

SHA512
d99dca427185dbe4e426758baad6c71af925f51f13b21eb9032b66c944ef857b777bb569601fa126dd72a8ab26f088cb8ef4f22c584c042962adc5daf4fafa3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ffce7883a510304f802d87ce7323a896

SHA1
9743f4d8e082a59e3de0c502d589c37462d9ef66

SHA256
7986caf07738bb8d4826905ab504fba9281ca5d4e6a9c68a5fff1fe363e95132

SHA512
4d6e607b2d9dc01817c43145999fbc3a5ac2767d664dd1ba7d1245e46217aeb30525cbee52bc437f71a9060ac08d2f49033a6b15a66de7ac18d3eb61142c1725

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20240807190245_000_vcRuntimeMinimum_x86.log

Filesize
2KB

MD5
9e02c107a77c205a89e7ce5af5a43da1

SHA1
12818d0a5b33e0fd67c6c8150c8d5e22ff2d4ea9

SHA256
c4261d1dcaba79eb947509f62b1acc47a1d1d3f972a42cf6d365fd1e0986bd96

SHA512
27c85a2af5f50077d5e64019d89ccd74a46a9e0c29d26c74e03e83b3f5174c582ce4744eb364509df7d5c110883189178e387cfdc399c7832c106584f049df1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20240807190245_001_vcRuntimeAdditional_x86.log

Filesize
2KB

MD5
91abc3d140c496b82d1e7e053a542cb3

SHA1
348a48981cb2dbfe3a12c520f2665198baf45218

SHA256
7678192c3abd8a1fb5a7f8643071a28e465e3fc7b9a07e200b93dab84ec47784

SHA512
93899d6aa92b1b5814045c3b2de4b7225a8688faed7275a3209c6080ea43d25ec39b1217c173e3c6f151b7d72a23b28d49bd0ae5409fb484023768fa8e256d5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\vcredist.tmp

Filesize
13.2MB

MD5
8457542fd4be74cb2c3a92b3386ae8e9

SHA1
198722b4f5fc62721910569d9d926dce22730c22

SHA256
a32dd41eaab0c5e1eaa78be3c0bb73b48593de8d97a7510b97de3fd993538600

SHA512
91a6283f774f9e2338b65aa835156854e9e76aed32f821b13cfd070dd6c87e1542ce2d5845beb5e4af1ddb102314bb6e0ad6214d896bb3e387590a01eae0c182

Download Submit
C:\Users\Admin\Desktop\Roblox Account Manager\RAMSettings.ini

Filesize
1KB

MD5
5369e83203a8972ee844ac973efd985a

SHA1
d91909ad9be3a67f66687a5cc58258fe2b715986

SHA256
fbbf21c6c6a3594b126ad1e48a06e315478022b6fa54ab0dc54b9ddaf30089ee

SHA512
af7fbb21b3ff7a32b34c72a303f380edda527a0f4273237f3c9a9f8804e83eb2bbbc1300135d094f64888227d72fdd832616dc2e18797398ad3df6db0d6b16f6

Download Submit
C:\Users\Admin\Desktop\Roblox Account Manager\RAMSettings.ini

Filesize
1KB

MD5
d0b643bc1d10187decc0909019b7fd47

SHA1
7945d8b84b03d9848ca59779361587703fd87f73

SHA256
333629be579721280a6b7a830786b10ce09d80b2058cb6a9b8f73af6e6f9bfa1

SHA512
9b37530cd08285bc7b3200acbe8fe03262b540696993f2f9a16cb2a6cd3a29f0ae25ef7903c960fe530d665a6b706b60ec4db3cfdaeaa32e4466ae2332297e41

Download Submit
C:\Users\Admin\Desktop\Roblox Account Manager\RAMSettings.ini

Filesize
979B

MD5
f41a2fa3cfb89a581f54a9f9e99f5a9b

SHA1
13f5d16e2051877701eb94400a4b835f43cf7f92

SHA256
af8994f26fa5f8f48910b4156d755509c30254b0324ff07d31c1ff868d08398a

SHA512
af0020a5b03f532d3d57d35a4dc8f6dec40b468a76bf730e73b03e2d01d7ca3b73f33cfb0c14cc3d32dc9eb7b42d4bc1f43b8b40849387d976dcd0726f54bc54

Download Submit
C:\Users\Admin\Desktop\Roblox Account Manager\RAMTheme.ini

Filesize
314B

MD5
f18fa783f4d27e35e54e54417334bfb4

SHA1
94511cdf37213bebdaf42a6140c9fe5be8eb07ba

SHA256
563eb35fd613f4298cd4dceff67652a13ba516a6244d9407c5709323c4ca4bb1

SHA512
602f6a68562bc89a4b3c3a71c2477377f161470bf8ae8e6925bf35691367115abfa9809925bd09c35596c6a3e5a7e9d090e5198e6a885a6658049c8732a05071

Download Submit
C:\Users\Admin\Desktop\Roblox Account Manager\Roblox Account Manager.exe.config

Filesize
5KB

MD5
7e067afe7c779870c370c40240e2ce1f

SHA1
71d59901ee26810c2b2cfdeca176cec9a54fdb48

SHA256
5e0ba1895cf088e6d6907b8abbd8cd41c86f39cc642351a9ab0bf458bf1f5b31

SHA512
7ae4e81cd7a06aca5c363e1009d898aa8b42236d6796c38a8ba07adb52eae45f69cd446d008a0e1d12c60c02a43bee1c813231d58884c6dd69a2967e243c9cc6

Download Submit
C:\Users\Admin\Desktop\Roblox Account Manager\libsodium.dll

Filesize
477KB

MD5
4f6426e3626d5d46fb19c13043cb84de

SHA1
9dfa32f957c19c843a568b57d555d6d5cbc61579

SHA256
7a960129f6d3f8d44b4c6be27f587c29aa8bafb9c4d3c85bb84a5f5d8fa6e2ba

SHA512
7a83adf2b36973ceb52bfc95591bc91d4ac778a4e11d11723f6d8bf208811b8fa7d072851cfed73407c9413455de717e9a42f8e6bb1a133cb2b1981c66bb5832

Download Submit
C:\Users\Admin\Desktop\Roblox Account Manager\log.txt

Filesize
142B

MD5
ce1f03dd9a8ecca90847146ef0345875

SHA1
482221357b9a781a7f9d9d15e32d0db7a3f6f37e

SHA256
af45db2a6727fab0d0c0d54699fe2b8dddf584c673a6a644646b36a72f39ecb7

SHA512
627ad8856540e3c3759b3666d67f1292dc7e9bfbde0ea4ed3abf5de72d1a4580d80358647b87786ec2400d49be0ffc20db294e24283fd2deccd4c237b2b6798c

Download Submit
C:\Users\Admin\Desktop\Roblox Account Manager\log4.config

Filesize
936B

MD5
e4659ac08af3582a23f38bf6c562f841

SHA1
19cb4f014ba96285fa1798f008deabce632c7e76

SHA256
e4b10630d9ec2af508de31752fbbc6816c7426c40a3e57f0a085ce7f42c77bd5

SHA512
5bfa1e021cc7ee5e7a00da865d68684202b3b92d3d369b85b80c591fffa67725d434398325dc1e37c659eab62c0a4118b3e279ac0096b95790d252ceb6254249

Download Submit
C:\Users\Admin\Downloads\Roblox.Account.Manager.3.6.1.zip

Filesize
4.0MB

MD5
acc4818f58f1a1d2d2844a05f1aece19

SHA1
e3038c4501bb62415c18bfacca92167ebc4d623b

SHA256
1b94210a7a05ce8379db7b8c11d41f84bc868cbdcd0685733754728678bb5fa2

SHA512
1ca986d1ea6c8c87c590d891b3f29d5123e565e8ba2031728aa2c4b96892a18f00b478b6589ea73f056ec04ff0d07830fa5393c366eb849e80515971d6089207

Download Submit
C:\Windows\SysWOW64\vcruntime140.dll

Filesize
88KB

MD5
9248c36666a2fec5e2a8913d6edabf80

SHA1
b7bd53b97974d5f4ff3a3935a104fc85367c105b

SHA256
c8e6089e6efe9573af55cf011c4e41b21235b2531f6c395faad53f410f22acaa

SHA512
eb7c878f3d4ebfb175579cdbfde8d589c71d2dcfbc02455caf132b5ea6964835cbce52f9479c0f6e4e58624629d4e13091a97477c914bc71d2ea4cfc9da404e8

Download Submit
C:\Windows\Temp\{02B4AEB0-7EAC-4F8F-AD46-3F6684B9A622}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Temp\{02B4AEB0-7EAC-4F8F-AD46-3F6684B9A622}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
C:\Windows\Temp\{02B4AEB0-7EAC-4F8F-AD46-3F6684B9A622}\cab54A5CABBE7274D8A22EB58060AAB7623

Filesize
822KB

MD5
25bd21af44d3968a692e9b8a85f5c11d

SHA1
d805d1624553199529a82151f23a1330ac596888

SHA256
f4576ef2e843c282d2a932f7c55d71cc3fcbb35b0a17a0a640eb5f21731cc809

SHA512
ed3660183bf4e0d39e4f43a643007afc143b1d4ec0b45f0fdce28d8e896f646ec24a2a7a5429e8b10f4379cb4ffd1572adba10fc426990d05c0cafefdd87a4fb

Download Submit
C:\Windows\Temp\{02B4AEB0-7EAC-4F8F-AD46-3F6684B9A622}\cabB3E1576D1FEFBB979E13B1A5379E0B16

Filesize
4.9MB

MD5
3a7979fbe74502ddc0a9087ee9ca0bdf

SHA1
3c63238363807c2f254163769d0a582528e115af

SHA256
7327d37634cc8e966342f478168b8850bea36a126d002c38c7438a7bd557c4ca

SHA512
6435db0f210ad317f4cd00bb3300eb41fb86649f7a0e3a05e0f64f8d0163ab53dbdb3c98f99a15102ce09fcd437a148347bab7bfd4afe4c90ff2ea05bb4febff

Download Submit
C:\Windows\Temp\{02B4AEB0-7EAC-4F8F-AD46-3F6684B9A622}\vcRuntimeAdditional_x86

Filesize
180KB

MD5
2ba51e907b5ee6b2aef6dfe5914ae3e3

SHA1
6cc2c49734bf9965fe0f3977705a417ed8548718

SHA256
be137dc2b1ec7e85ae7a003a09537d3706605e34059361404ea3110874895e3a

SHA512
e3ba5aa8f366e3b1a92d8258daa74f327248fb21f168b7472b035f8d38f549f5f556eb9093eb8483ca51b78e9a77ee6e5b6e52378381cce50918d81e8e982d47

Download Submit
C:\Windows\Temp\{02B4AEB0-7EAC-4F8F-AD46-3F6684B9A622}\vcRuntimeMinimum_x86

Filesize
180KB

MD5
828f217e9513cfff708ffe62d238cfc5

SHA1
9fb65d4edb892bf940399d5fd6ae3a4b15c2e4ba

SHA256
a2ad58d741be5d40af708e15bf0dd5e488187bf28f0b699d391a9ef96f899886

SHA512
ffc72b92f1431bbd07889e28b55d14ea11f8401e2d0b180e43a898914209893941affacc0a4ea34eeefc9b0ca4bc84a3045591cd98aae6bdb11ae831dc6bb121

Download Submit
C:\Windows\Temp\{3ECD2CBA-541F-4743-A4FB-FE76937F70E8}\.cr\vcredist.tmp

Filesize
634KB

MD5
337b547d2771fdad56de13ac94e6b528

SHA1
3aeecc5933e7d8977e7a3623e8e44d4c3d0b4286

SHA256
81873c2f6c8bc4acaad66423a1b4d90e70214e59710ea7f11c8aeb069acd4cd0

SHA512
0d0102fafb7f471a6836708d81952f2c90c2b126ad1b575f2e2e996540c99f7275ebd1f570cafcc945d26700debb1e86b19b090ae5cdec2326dd0a6a918b7a36

Download Submit
memory/2204-284-0x0000000005F80000-0x0000000006524000-memory.dmp

Filesize
5.6MB

Download
memory/2204-283-0x0000000000AA0000-0x0000000000FDE000-memory.dmp

Filesize
5.2MB

Download
memory/2204-285-0x00000000059D0000-0x0000000005A16000-memory.dmp

Filesize
280KB

Download
memory/2204-286-0x0000000005AC0000-0x0000000005B52000-memory.dmp

Filesize
584KB

Download
memory/2204-287-0x0000000005A20000-0x0000000005A46000-memory.dmp

Filesize
152KB

Download
memory/3220-633-0x000000000BAE0000-0x000000000BAF2000-memory.dmp

Filesize
72KB

Download
memory/3220-814-0x000000000D050000-0x000000000D3A4000-memory.dmp

Filesize
3.3MB

Download
memory/3276-576-0x00000000006E0000-0x0000000000757000-memory.dmp

Filesize
476KB

Download
memory/3348-538-0x00000000006E0000-0x0000000000757000-memory.dmp

Filesize
476KB

Download
memory/3932-624-0x0000018855D70000-0x0000018856831000-memory.dmp

Filesize
10.8MB

Download
memory/4036-310-0x000000000CF80000-0x000000000D03E000-memory.dmp

Filesize
760KB

Download
memory/4036-447-0x000000006FA10000-0x000000006FA25000-memory.dmp

Filesize
84KB

Download
memory/4036-308-0x000000000CD90000-0x000000000CE42000-memory.dmp

Filesize
712KB

Download
memory/4036-306-0x000000000B970000-0x000000000B9C8000-memory.dmp

Filesize
352KB

Download
memory/4036-388-0x000000000DC30000-0x000000000DC46000-memory.dmp

Filesize
88KB

Download
memory/4036-301-0x000000000B4A0000-0x000000000B4AA000-memory.dmp

Filesize
40KB

Download
memory/4036-402-0x000000000F520000-0x000000000F874000-memory.dmp

Filesize
3.3MB

Download
memory/4036-300-0x000000000B410000-0x000000000B4A2000-memory.dmp

Filesize
584KB

Download
memory/4036-299-0x000000000AD50000-0x000000000AD84000-memory.dmp

Filesize
208KB

Download
memory/4036-297-0x00000000058D0000-0x00000000058DA000-memory.dmp

Filesize
40KB

Download
memory/4036-296-0x0000000006190000-0x0000000006204000-memory.dmp

Filesize
464KB

Download
memory/4036-389-0x000000000DC70000-0x000000000DC7A000-memory.dmp

Filesize
40KB

Download
memory/4036-387-0x000000000DC10000-0x000000000DC1A000-memory.dmp

Filesize
40KB

Download
memory/4036-386-0x000000000FA50000-0x000000000FF7C000-memory.dmp

Filesize
5.2MB

Download
memory/4036-309-0x000000000CF50000-0x000000000CF72000-memory.dmp

Filesize
136KB

Download
memory/4036-313-0x000000000D060000-0x000000000D068000-memory.dmp

Filesize
32KB

Download
memory/4036-311-0x000000000D040000-0x000000000D05A000-memory.dmp

Filesize
104KB

Download
memory/4036-314-0x000000000D1B0000-0x000000000D1CE000-memory.dmp

Filesize
120KB

Download
memory/4036-312-0x000000000D070000-0x000000000D078000-memory.dmp

Filesize
32KB

Download
memory/4036-318-0x000000000DB30000-0x000000000DB38000-memory.dmp

Filesize
32KB

Download
memory/4036-317-0x000000000DB70000-0x000000000DBC0000-memory.dmp

Filesize
320KB

Download
memory/4036-316-0x000000000DB10000-0x000000000DB24000-memory.dmp

Filesize
80KB

Download
memory/4036-315-0x000000000D3A0000-0x000000000D3AA000-memory.dmp

Filesize
40KB

Download
memory/4928-575-0x00000000006E0000-0x0000000000757000-memory.dmp

Filesize
476KB

Download