cdb0a360cca7a5099c2d2357be1a833e032ffdeb3f467a6fac845f6bb77031c9

Analysis

max time kernel
48s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 13:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Roblox Account Manager.exe
Size

5.2MB
MD5

a057fae0c8c97ee6cf2c12fb7bcf034d
SHA1

64fe0eb242b5c3f9c42f4f2c1685e4a36708e4f6
SHA256

cdb0a360cca7a5099c2d2357be1a833e032ffdeb3f467a6fac845f6bb77031c9
SHA512

447cf69cf39ef19d098f4ab223d6ad9d760efb1eabb1bb0dac27fd2e55ac14c5a6502f2edd00b199d2db702e38551065bcc087c8df931360e769443908a4d200
SSDEEP

98304:b2bT1Qm7d9GP4i7q0LTWgtUmWzmSyZs9S8Z/LywnrSkqXf0Fb7WnhNMYkj7:4Qm59q/tUhzmS9zZ/mY+kSIb7ahNMYk

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Roblox Account Manager.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	vcredist.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Roblox Account Manager.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Roblox Account Manager.exe

Deletes itself 1 IoCs

pid	Process
4484	Auto Update.exe

Executes dropped EXE 6 IoCs

pid	Process
3320	vcredist.tmp
2428	vcredist.tmp
2112	VC_redist.x86.exe
4484	Auto Update.exe
4808	Roblox Account Manager.exe
4240	Roblox Account Manager.exe

Loads dropped DLL 2 IoCs

pid	Process
2428	vcredist.tmp
1608	VC_redist.x86.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{e7802eac-3305-4da0-9378-e55d1ed05518} = "\"C:\\ProgramData\\Package Cache\\{e7802eac-3305-4da0-9378-e55d1ed05518}\\VC_redist.x86.exe\" /burn.runonce"	VC_redist.x86.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
33	raw.githubusercontent.com
39	raw.githubusercontent.com
72	raw.githubusercontent.com

Drops file in System32 directory 49 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140ita.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140enu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140rus.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcomp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140kor.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140esn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140cht.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140fra.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcamp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140fra.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140ita.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140enu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcruntime140_threads.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140deu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140rus.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140.dll	msiexec.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI410D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI42C4.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C2BB95AA-90F3-4891-81C1-A7E565BB836C}	msiexec.exe
File created	C:\Windows\Installer\e5831ea.msi	msiexec.exe
File created	C:\Windows\Installer\e5831eb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5831eb.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{84E3E712-6343-484B-8B6C-9F145F019A70}	msiexec.exe
File created	C:\Windows\Installer\e5831d9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3B6F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3841.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e583200.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5831d9.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Auto Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Roblox Account Manager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Roblox Account Manager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Roblox Account Manager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Roblox Account Manager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist.tmp

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f914d34881601a250000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f914d3480000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900f914d348000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1df914d348000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000f914d34800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\TypedURLs	Roblox Account Manager.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\TypedURLs	Roblox Account Manager.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AA59BB2C3F091984181C7A5E56BB38C6\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\Dependents\{e7802eac-3305-4da0-9378-e55d1ed05518}	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\217E3E483436B484B8C6F941F510A907\ProductName = "Microsoft Visual C++ 2022 X86 Additional Runtime - 14.42.34433"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\217E3E483436B484B8C6F941F510A907\Language = "1033"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5040806F8AF9AAC49928419ED5A1D3CA	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\AA59BB2C3F091984181C7A5E56BB38C6\Servicing_Key	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AA59BB2C3F091984181C7A5E56BB38C6\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\217E3E483436B484B8C6F941F510A907\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.42,bundle\Dependents	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\679E80FBE29B63345BF612177149674C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\217E3E483436B484B8C6F941F510A907\Servicing_Key	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\217E3E483436B484B8C6F941F510A907\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\AA59BB2C3F091984181C7A5E56BB38C6	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E8B87C56C0E773581D82F286F95E50	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\217E3E483436B484B8C6F941F510A907\Version = "237667969"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AA59BB2C3F091984181C7A5E56BB38C6	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AA59BB2C3F091984181C7A5E56BB38C6\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\217E3E483436B484B8C6F941F510A907	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\217E3E483436B484B8C6F941F510A907\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\217E3E483436B484B8C6F941F510A907\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\217E3E483436B484B8C6F941F510A907\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{84E3E712-6343-484B-8B6C-9F145F019A70}v14.42.34433\\packages\\vcRuntimeAdditional_x86\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\Dependents\{e7802eac-3305-4da0-9378-e55d1ed05518}	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_X86,V14\DEPENDENTS\{4D8DCF8C-A72A-43E1-9833-C12724DB736E}	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\ = "{C2BB95AA-90F3-4891-81C1-A7E565BB836C}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\217E3E483436B484B8C6F941F510A907\VC_Runtime_Additional	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\217E3E483436B484B8C6F941F510A907\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E8B87C56C0E773581D82F286F95E50	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\217E3E483436B484B8C6F941F510A907\DeploymentFlags = "3"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\VC,REDIST.X86,X86,14.30,BUNDLE\DEPENDENTS\{4D8DCF8C-A72A-43E1-9833-C12724DB736E}	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\Version = "14.42.34433"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AA59BB2C3F091984181C7A5E56BB38C6\SourceList\PackageName = "vc_runtimeMinimum_x86.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AA59BB2C3F091984181C7A5E56BB38C6\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\217E3E483436B484B8C6F941F510A907\PackageCode = "1D9C529D8C7ACCB44AEB146B378F1D12"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\DisplayName = "Microsoft Visual C++ 2022 X86 Additional Runtime - 14.42.34433"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\VC,redist.x86,x86,14.42,bundle	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\AA59BB2C3F091984181C7A5E56BB38C6\VC_Runtime_Minimum	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AA59BB2C3F091984181C7A5E56BB38C6\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{C2BB95AA-90F3-4891-81C1-A7E565BB836C}v14.42.34433\\packages\\vcRuntimeMinimum_x86\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\60DB5E5629367203C8625813703DFCA1\AA59BB2C3F091984181C7A5E56BB38C6	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AA59BB2C3F091984181C7A5E56BB38C6\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\217E3E483436B484B8C6F941F510A907	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\60DB5E5629367203C8625813703DFCA1	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AA59BB2C3F091984181C7A5E56BB38C6\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AA59BB2C3F091984181C7A5E56BB38C6\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\217E3E483436B484B8C6F941F510A907\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\217E3E483436B484B8C6F941F510A907\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AA59BB2C3F091984181C7A5E56BB38C6\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\217E3E483436B484B8C6F941F510A907\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E8B87C56C0E773581D82F286F95E50\217E3E483436B484B8C6F941F510A907	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\217E3E483436B484B8C6F941F510A907\SourceList\PackageName = "vc_runtimeAdditional_x86.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\60DB5E5629367203C8625813703DFCA1	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\217E3E483436B484B8C6F941F510A907\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\DisplayName = "Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.42.34433"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AA59BB2C3F091984181C7A5E56BB38C6\DeploymentFlags = "3"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_X86,V14\DEPENDENTS\{4D8DCF8C-A72A-43E1-9833-C12724DB736E}	VC_redist.x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AA59BB2C3F091984181C7A5E56BB38C6\InstanceType = "0"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4484	Auto Update.exe
4484	Auto Update.exe
4356	msiexec.exe
4356	msiexec.exe
4356	msiexec.exe
4356	msiexec.exe
4356	msiexec.exe
4356	msiexec.exe
4356	msiexec.exe
4356	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2132	Roblox Account Manager.exe
Token: SeBackupPrivilege	468	vssvc.exe
Token: SeRestorePrivilege	468	vssvc.exe
Token: SeAuditPrivilege	468	vssvc.exe
Token: SeDebugPrivilege	4484	Auto Update.exe
Token: SeShutdownPrivilege	2112	VC_redist.x86.exe
Token: SeIncreaseQuotaPrivilege	2112	VC_redist.x86.exe
Token: SeSecurityPrivilege	4356	msiexec.exe
Token: SeCreateTokenPrivilege	2112	VC_redist.x86.exe
Token: SeAssignPrimaryTokenPrivilege	2112	VC_redist.x86.exe
Token: SeLockMemoryPrivilege	2112	VC_redist.x86.exe
Token: SeIncreaseQuotaPrivilege	2112	VC_redist.x86.exe
Token: SeMachineAccountPrivilege	2112	VC_redist.x86.exe
Token: SeTcbPrivilege	2112	VC_redist.x86.exe
Token: SeSecurityPrivilege	2112	VC_redist.x86.exe
Token: SeTakeOwnershipPrivilege	2112	VC_redist.x86.exe
Token: SeLoadDriverPrivilege	2112	VC_redist.x86.exe
Token: SeSystemProfilePrivilege	2112	VC_redist.x86.exe
Token: SeSystemtimePrivilege	2112	VC_redist.x86.exe
Token: SeProfSingleProcessPrivilege	2112	VC_redist.x86.exe
Token: SeIncBasePriorityPrivilege	2112	VC_redist.x86.exe
Token: SeCreatePagefilePrivilege	2112	VC_redist.x86.exe
Token: SeCreatePermanentPrivilege	2112	VC_redist.x86.exe
Token: SeBackupPrivilege	2112	VC_redist.x86.exe
Token: SeRestorePrivilege	2112	VC_redist.x86.exe
Token: SeShutdownPrivilege	2112	VC_redist.x86.exe
Token: SeDebugPrivilege	2112	VC_redist.x86.exe
Token: SeAuditPrivilege	2112	VC_redist.x86.exe
Token: SeSystemEnvironmentPrivilege	2112	VC_redist.x86.exe
Token: SeChangeNotifyPrivilege	2112	VC_redist.x86.exe
Token: SeRemoteShutdownPrivilege	2112	VC_redist.x86.exe
Token: SeUndockPrivilege	2112	VC_redist.x86.exe
Token: SeSyncAgentPrivilege	2112	VC_redist.x86.exe
Token: SeEnableDelegationPrivilege	2112	VC_redist.x86.exe
Token: SeManageVolumePrivilege	2112	VC_redist.x86.exe
Token: SeImpersonatePrivilege	2112	VC_redist.x86.exe
Token: SeCreateGlobalPrivilege	2112	VC_redist.x86.exe
Token: SeRestorePrivilege	4356	msiexec.exe
Token: SeTakeOwnershipPrivilege	4356	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4484	Auto Update.exe
Token: SeRestorePrivilege	4356	msiexec.exe
Token: SeTakeOwnershipPrivilege	4356	msiexec.exe
Token: SeRestorePrivilege	4356	msiexec.exe
Token: SeTakeOwnershipPrivilege	4356	msiexec.exe
Token: SeRestorePrivilege	4356	msiexec.exe
Token: SeTakeOwnershipPrivilege	4356	msiexec.exe
Token: SeRestorePrivilege	4356	msiexec.exe
Token: SeTakeOwnershipPrivilege	4356	msiexec.exe
Token: SeRestorePrivilege	4356	msiexec.exe
Token: SeTakeOwnershipPrivilege	4356	msiexec.exe
Token: SeRestorePrivilege	4356	msiexec.exe
Token: SeTakeOwnershipPrivilege	4356	msiexec.exe
Token: SeRestorePrivilege	4356	msiexec.exe
Token: SeTakeOwnershipPrivilege	4356	msiexec.exe
Token: SeRestorePrivilege	4356	msiexec.exe
Token: SeTakeOwnershipPrivilege	4356	msiexec.exe
Token: SeRestorePrivilege	4356	msiexec.exe
Token: SeTakeOwnershipPrivilege	4356	msiexec.exe
Token: SeRestorePrivilege	4356	msiexec.exe
Token: SeTakeOwnershipPrivilege	4356	msiexec.exe
Token: SeRestorePrivilege	4356	msiexec.exe
Token: SeTakeOwnershipPrivilege	4356	msiexec.exe
Token: SeRestorePrivilege	4356	msiexec.exe
Token: SeTakeOwnershipPrivilege	4356	msiexec.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 2132	4484	Roblox Account Manager.exe	91
PID 4484 wrote to memory of 2132	4484	Roblox Account Manager.exe	91
PID 4484 wrote to memory of 2132	4484	Roblox Account Manager.exe	91
PID 2132 wrote to memory of 3320	2132	Roblox Account Manager.exe	99
PID 2132 wrote to memory of 3320	2132	Roblox Account Manager.exe	99
PID 2132 wrote to memory of 3320	2132	Roblox Account Manager.exe	99
PID 3320 wrote to memory of 2428	3320	vcredist.tmp	101
PID 3320 wrote to memory of 2428	3320	vcredist.tmp	101
PID 3320 wrote to memory of 2428	3320	vcredist.tmp	101
PID 2428 wrote to memory of 2112	2428	vcredist.tmp	102
PID 2428 wrote to memory of 2112	2428	vcredist.tmp	102
PID 2428 wrote to memory of 2112	2428	vcredist.tmp	102
PID 2132 wrote to memory of 4484	2132	Roblox Account Manager.exe	107
PID 2132 wrote to memory of 4484	2132	Roblox Account Manager.exe	107
PID 2132 wrote to memory of 4484	2132	Roblox Account Manager.exe	107
PID 4808 wrote to memory of 4240	4808	Roblox Account Manager.exe	122
PID 4808 wrote to memory of 4240	4808	Roblox Account Manager.exe	122
PID 4808 wrote to memory of 4240	4808	Roblox Account Manager.exe	122
PID 2112 wrote to memory of 2192	2112	VC_redist.x86.exe	125
PID 2112 wrote to memory of 2192	2112	VC_redist.x86.exe	125
PID 2112 wrote to memory of 2192	2112	VC_redist.x86.exe	125
PID 2192 wrote to memory of 1608	2192	VC_redist.x86.exe	126
PID 2192 wrote to memory of 1608	2192	VC_redist.x86.exe	126
PID 2192 wrote to memory of 1608	2192	VC_redist.x86.exe	126
PID 1608 wrote to memory of 2792	1608	VC_redist.x86.exe	127
PID 1608 wrote to memory of 2792	1608	VC_redist.x86.exe	127
PID 1608 wrote to memory of 2792	1608	VC_redist.x86.exe	127

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe
"C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe
  "C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe" -restart
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Users\Admin\AppData\Local\Temp\vcredist.tmp
    "C:\Users\Admin\AppData\Local\Temp\vcredist.tmp" /q /norestart
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3320
  - - C:\Windows\Temp\{9CDC13E5-F9AD-42B6-81C1-D9E9C5B3EAD1}\.cr\vcredist.tmp
      "C:\Windows\Temp\{9CDC13E5-F9AD-42B6-81C1-D9E9C5B3EAD1}\.cr\vcredist.tmp" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\vcredist.tmp" -burn.filehandle.attached=692 -burn.filehandle.self=696 /q /norestart
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2428
    - - C:\Windows\Temp\{2CDBA1B2-6E1B-47B8-A8A5-01FE69E12DDA}\.be\VC_redist.x86.exe
        
        "C:\Windows\Temp\{2CDBA1B2-6E1B-47B8-A8A5-01FE69E12DDA}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{8497DDD9-B51E-4DD6-903E-3ED16C1C0281} {3EAD68F6-8023-4C25-9589-94D8DCF5BC05} 2428
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2112
      - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={e7802eac-3305-4da0-9378-e55d1ed05518} -burn.filehandle.self=952 -burn.embedded BurnPipe.{CAF80705-2C36-4981-A71C-D95EB7E6B84C} {6FFBF40C-327D-43DF-8643-E0B30D1014E5} 2112
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2192
        
        C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={e7802eac-3305-4da0-9378-e55d1ed05518} -burn.filehandle.self=952 -burn.embedded BurnPipe.{CAF80705-2C36-4981-A71C-D95EB7E6B84C} {6FFBF40C-327D-43DF-8643-E0B30D1014E5} 2112
        7⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1608
        
        C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{475F3376-84C6-416E-B7C1-C848C815B4C1} {0214296B-F976-4C99-A5A0-E44D18B6080D} 1608
        8⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2792
- - C:\Users\Admin\AppData\Local\Temp\Auto Update.exe
    "C:\Users\Admin\AppData\Local\Temp\Auto Update.exe" -update
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4484
  - - C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe
      "C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe" -restart
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:4240

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:468

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:1584

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5831de.rbs

Filesize
16KB

MD5
06e982edb8dc411d25074730012c60d1

SHA1
9313f6f61a83647d56c8cf4edb1b0268fa515120

SHA256
c1f303caee0c09d9eac041a50915dc6f1900b7a17799797e32c72346a0640b9d

SHA512
a0525f3eaa2d8f979e5e061242f05113ee972f591508ad00605eca64a2080f1dfaabb21a1b717ffd45a65b2f33f1b420269876671b61ee1ec87f5a00a49d48e1

Download Submit
C:\Config.Msi\e5831e3.rbs

Filesize
18KB

MD5
c3aad8755179e59e7c977aff422395a8

SHA1
5a9ca41c574be8e32dafed767a5351d632e1101d

SHA256
d2ca047f4e06a63b525bc8b99c949c4f28e9400668128b3ef714d81b766fbf91

SHA512
7ff626827fc2bb93550a493fb6a7dc0d7b094b5dd123882ae809b668be61e0e140987ad42acffcd3516db7cebc4a8df6dfc2ebc877fec1a762c9a8e52b25c83b

Download Submit
C:\Config.Msi\e5831f0.rbs

Filesize
20KB

MD5
2f1078488138c7184c3326edbe5b2ed2

SHA1
33017c4d834a67b1c38d02a2d6b0636c436390b9

SHA256
bc811d58f337840ade17a7f59a05005d54d2f339f95797c78355d2d7f4c8c9f2

SHA512
462f1ec9852f6f483106f3b361f6c482b232055e2e0477398b60f3f8feb918b3fc289efbf3597f37fc8c1e3f3fa9e147168e7ba4e04f0800ce07b18a22c46d1d

Download Submit
C:\Config.Msi\e5831ff.rbs

Filesize
19KB

MD5
397ba4b44357814bb5c64e533f5c0dde

SHA1
f30f2ddfa6c181bd0315b26ca7764597c655f823

SHA256
5eaebd2123c7bfd7c623181af998a162c9e161a01396362c1961a501d2e0a5ef

SHA512
4b4ae6f74a70cfdec84c1458f1c9814e12f63005aaeaa6d6da995fcbe718044c5ab338b293b1aa280bd7d06f050c3815c11e44270491306d9cfac87900790c54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Roblox Account Manager.exe.log

Filesize
1KB

MD5
a02e8a8a790f0e0861e3b6b0dbe56062

SHA1
a3e65805e5c78641cafebc1052906d7350da9d2e

SHA256
7fada0f81b63e1ecb265e9620ace8f5f0d40773626081849f5d98e668bc4e594

SHA512
108a81f818aa027834d621c771e427ee3f300c59d9dc10d853b94b1e8d635cf6bc06338dce31da30b08660c6fb06a39f9069c983bb585049f5fe9f50b753eb42

Download Submit
C:\Users\Admin\AppData\Local\Temp\Auto Update.exe

Filesize
5.2MB

MD5
a057fae0c8c97ee6cf2c12fb7bcf034d

SHA1
64fe0eb242b5c3f9c42f4f2c1685e4a36708e4f6

SHA256
cdb0a360cca7a5099c2d2357be1a833e032ffdeb3f467a6fac845f6bb77031c9

SHA512
447cf69cf39ef19d098f4ab223d6ad9d760efb1eabb1bb0dac27fd2e55ac14c5a6502f2edd00b199d2db702e38551065bcc087c8df931360e769443908a4d200

Download Submit
C:\Users\Admin\AppData\Local\Temp\RAMSettings.ini

Filesize
1KB

MD5
8ab2e345d4a5ecf0d9b4e56d73d5bf04

SHA1
484eeaef985040da4bb91d422edce0c03d3e777e

SHA256
cde3d0037c00996ff60a66d924e634aacffd54440b97fd848f4d131d0eb60087

SHA512
feecb7bb022265f0feb9df4b252b811cb0c50fd2b09811cfa675e97b92e1c66784ac26affb8ec6a3fd7956dd0b638034fc5e850d4674711636fa3bb420c8c57a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RAMSettings.ini

Filesize
1KB

MD5
a022672905a8989b6e092508f822bd86

SHA1
3b99c4ca34a6cdebe6dce8ba25c0709bd35d55db

SHA256
d6de96a10276a42a8c84276877e0ae68787686fed31e0d966b6ce4068df524c2

SHA512
ba7a963907e14a74a0cb9481aff71a4c3b210457700cd052eccf63c90673185ae95738338d343be4624d2675595356b9fb0b2253b9b96fe359e19e51454e9eed

Download Submit
C:\Users\Admin\AppData\Local\Temp\RAMTheme.ini

Filesize
314B

MD5
f18fa783f4d27e35e54e54417334bfb4

SHA1
94511cdf37213bebdaf42a6140c9fe5be8eb07ba

SHA256
563eb35fd613f4298cd4dceff67652a13ba516a6244d9407c5709323c4ca4bb1

SHA512
602f6a68562bc89a4b3c3a71c2477377f161470bf8ae8e6925bf35691367115abfa9809925bd09c35596c6a3e5a7e9d090e5198e6a885a6658049c8732a05071

Download Submit
C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe

Filesize
5.4MB

MD5
334728f32a1144c893fdffc579a7709b

SHA1
97d2eb634d45841c1453749acb911ce1303196c0

SHA256
be9ddcdedf8c36c64e6b0a32d2686b74a112913c54217ccaa46675bfd1dc82f1

SHA512
5df9d63136098d23918eba652b44a87e979430b2ce3e78a3eb8faef3dd4bd9599d6c31980f9eaf2bd6a071e966421bc6cec950c28b3b917f90130e8a582c2a1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe.config

Filesize
5KB

MD5
7e067afe7c779870c370c40240e2ce1f

SHA1
71d59901ee26810c2b2cfdeca176cec9a54fdb48

SHA256
5e0ba1895cf088e6d6907b8abbd8cd41c86f39cc642351a9ab0bf458bf1f5b31

SHA512
7ae4e81cd7a06aca5c363e1009d898aa8b42236d6796c38a8ba07adb52eae45f69cd446d008a0e1d12c60c02a43bee1c813231d58884c6dd69a2967e243c9cc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe.config

Filesize
6KB

MD5
0a86fa27d09e26491dbbb4fe27f4b410

SHA1
63e4b5afb8bdb67fc1d6f8dddeb40be20939289e

SHA256
2b6d99db8369b0ff6372737d89d1c9e4101815b4168a3852c7b513f2897e7f3d

SHA512
fbebc4dc0925d5d67271cac04c1ed324091442ef4c9f6243d2c1c523c9aa6b338c6a594e4987fc142dd3b2a023338a267c8a3454e47fbf0b3e0dbd7b3b65cc0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20241119135827_000_vcRuntimeMinimum_x86.log

Filesize
2KB

MD5
27863ef2626bec0ef95b08cdfd3df2f9

SHA1
ceb4566656d01129c0fcdb3bae716f03865ce281

SHA256
c1998e7b31d85d4c8712a506da0bb27d64fbee3d4fbe799c86635c00c70e1312

SHA512
431f0bb5f8e4ea8b46008e5162db5033110d647e70a999799d82a032250f9c0a4bb695710197f82fdcc0ab2ef0e7db84fca7ff9e24fa1322807757d51489685e

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20241119135827_001_vcRuntimeAdditional_x86.log

Filesize
2KB

MD5
cc625208b22eca996b6a7e9441c9846c

SHA1
cdaf7dc42cef4d0e06687a57454cd102cbe568b4

SHA256
9db2dc9832d6240527a807a0c8167c8f7030ea7b43a3be3e15cc5e65a5f7c54c

SHA512
92fa423c2a664df7ee9e2c19432d2119360dfd80b4f9136b25205b64758d506dbe5019f3f68aadc73f28537be982273d13a96625843adfb933d7cea0c2a7fdb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\log.txt

Filesize
142B

MD5
d5cf45cffc66b13eddf860d5f8d9c1f7

SHA1
760952ee4783a83efab085896438a52f5902ef55

SHA256
d6dc81855bea1d95a55a039aab162c348cc8a93da33fae7e80b38ff53632837a

SHA512
e992229fc7917ce20330a54fc11daca54f6e398ed7e8e9535dd97e3578677be8b81da52eabd2f10a41569030d6349bac4102e55e9169df5729e282e690958230

Download Submit
C:\Users\Admin\AppData\Local\Temp\log.txt

Filesize
569B

MD5
c273c2417b222538e1bdf1df8ab167be

SHA1
fea9b5b154e9e71132610fd5301f3a82d4ae74b9

SHA256
5b63a948ff008740ccfa7aa5cfa95140e9ef40569cfa447fca3c56a73333b8ea

SHA512
0343d6c2d057ed80a8a398b4518e20b5746bc86bf51d76d8ba2ddd866936bfecb1027d57cbe1a5bc2de205eb6daa94e23cc0fd4b06a74d0c509043faa6be500c

Download Submit
C:\Users\Admin\AppData\Local\Temp\log4.config

Filesize
936B

MD5
e4659ac08af3582a23f38bf6c562f841

SHA1
19cb4f014ba96285fa1798f008deabce632c7e76

SHA256
e4b10630d9ec2af508de31752fbbc6816c7426c40a3e57f0a085ce7f42c77bd5

SHA512
5bfa1e021cc7ee5e7a00da865d68684202b3b92d3d369b85b80c591fffa67725d434398325dc1e37c659eab62c0a4118b3e279ac0096b95790d252ceb6254249

Download Submit
C:\Users\Admin\AppData\Local\Temp\vcredist.tmp

Filesize
13.3MB

MD5
8a6f4f3282236325360a9ac4413b7bc3

SHA1
cb617803813e969be73f2e0e175a67620e53aa59

SHA256
dd1a8be03398367745a87a5e35bebdab00fdad080cf42af0c3f20802d08c25d4

SHA512
2c1facb8567a052b4fa65d173b0bda64fa5fded2cddb9073b7c28507ed95414c17d2839d06d5e961617c754cda54d6134964b1aff5c9e9cdfbace71f1de2ac3a

Download Submit
C:\Windows\Temp\{2CDBA1B2-6E1B-47B8-A8A5-01FE69E12DDA}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Temp\{2CDBA1B2-6E1B-47B8-A8A5-01FE69E12DDA}\.ba\wixstdba.dll

Filesize
215KB

MD5
f68f43f809840328f4e993a54b0d5e62

SHA1
01da48ce6c81df4835b4c2eca7e1d447be893d39

SHA256
e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e

SHA512
a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1

Download Submit
C:\Windows\Temp\{2CDBA1B2-6E1B-47B8-A8A5-01FE69E12DDA}\cab54A5CABBE7274D8A22EB58060AAB7623

Filesize
842KB

MD5
a04f3e3bd8684cf660619e0f6af4d751

SHA1
2b5b1a39de1faa20d9a5774ec7b27dee5f6fc065

SHA256
b31b87a09f3aa2df573050949e87a68eeda01cb80dc974714d0603cea2c0708b

SHA512
fb3c081ad9f23661ed6f167ca878469d702f5cb60c15bb6d04c21331b43f8b88d98a680ad74ff5855e4c286260452be9e25b49b5b245d14fa30297cc8add5828

Download Submit
C:\Windows\Temp\{2CDBA1B2-6E1B-47B8-A8A5-01FE69E12DDA}\cabB3E1576D1FEFBB979E13B1A5379E0B16

Filesize
4.9MB

MD5
654f67c3c99d57a0008427141bd1cfc6

SHA1
60887d57c8910a5034379ddc7a0ad5e2c2bfcde6

SHA256
d87d9b997b91f9e375bf3cf994b67882ce21c0fbd4d0c4611dd6f593d4a8f3be

SHA512
0f3182a9c923a51f9ffed2e8639f9bcb72ace859c6253aa860a95c2c67c6b9d80d7945042460a7f73e357614b149c9d906c101f800724825279f07902571a064

Download Submit
C:\Windows\Temp\{2CDBA1B2-6E1B-47B8-A8A5-01FE69E12DDA}\vcRuntimeAdditional_x86

Filesize
200KB

MD5
95715c58dd2864b361dbd9e651b2f5ad

SHA1
c8b19282b7950e7b8e106b5bbccad4fc7b3aa661

SHA256
a6447de0d0d5b56b50988ae350432d68e9d83fbb566e2fcaa3f758a2b2574fea

SHA512
10eb258d1c1ab690e03fd782316133305530a7a50769263176765862a754dcf5ec258ca5805d2be447a53b29b3557b519a6cec812208d88982201c86ea8d5fb3

Download Submit
C:\Windows\Temp\{2CDBA1B2-6E1B-47B8-A8A5-01FE69E12DDA}\vcRuntimeMinimum_x86

Filesize
200KB

MD5
975e07089d93c2540f0e91da7e1e0142

SHA1
e65a155b9f88cabf6fc34111751051f8872f1dc2

SHA256
16547c99e9dc8602603beda79bb9099d06b2f0e06273660aaffd3193d82e8bf5

SHA512
047ca9eaf996b5b89cedf0f9e9d7544cb8700bba02e10aa90fbd283fdebb2e1ec98295569f145e0dc9bbf3dbd44f64e4d02429cbcdff7e149f2804c135ee2595

Download Submit
C:\Windows\Temp\{9CDC13E5-F9AD-42B6-81C1-D9E9C5B3EAD1}\.cr\vcredist.tmp

Filesize
669KB

MD5
f7aca1ef43beaa02107214482e6b51d6

SHA1
fb5cec36519b148119dec501cec92d894eb3b60a

SHA256
169b8f7025b301ffce5402c98c07f9e01bbadce52a2961175b777279f92624a7

SHA512
82cf5ebaa0a16e229b82e2dd550d7ab76409c89b4cfb7f163d1cce6d156db737ec5a09a3aa832b4076039665a6044aaeca3a6d311f8264492707ae281bbe7443

Download Submit
C:\Windows\Temp\{FFA43D25-5719-45F5-8649-1D1C694AEF33}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
memory/1608-332-0x00000000009C0000-0x0000000000A37000-memory.dmp

Filesize
476KB

Download
memory/2132-22-0x0000000074B40000-0x00000000752F0000-memory.dmp

Filesize
7.7MB

Download
memory/2132-119-0x0000000074B40000-0x00000000752F0000-memory.dmp

Filesize
7.7MB

Download
memory/2132-39-0x000000000D740000-0x000000000D74A000-memory.dmp

Filesize
40KB

Download
memory/2132-37-0x000000000D5B0000-0x000000000D5B8000-memory.dmp

Filesize
32KB

Download
memory/2132-36-0x000000000D570000-0x000000000D58A000-memory.dmp

Filesize
104KB

Download
memory/2132-35-0x000000000D4B0000-0x000000000D56E000-memory.dmp

Filesize
760KB

Download
memory/2132-34-0x000000000C190000-0x000000000C1B2000-memory.dmp

Filesize
136KB

Download
memory/2132-102-0x0000000074B40000-0x00000000752F0000-memory.dmp

Filesize
7.7MB

Download
memory/2132-105-0x0000000074B40000-0x00000000752F0000-memory.dmp

Filesize
7.7MB

Download
memory/2132-33-0x000000000BE10000-0x000000000BEC2000-memory.dmp

Filesize
712KB

Download
memory/2132-117-0x0000000074B40000-0x00000000752F0000-memory.dmp

Filesize
7.7MB

Download
memory/2132-20-0x0000000006250000-0x000000000625A000-memory.dmp

Filesize
40KB

Download
memory/2132-19-0x00000000060C0000-0x0000000006134000-memory.dmp

Filesize
464KB

Download
memory/2132-16-0x0000000074B40000-0x00000000752F0000-memory.dmp

Filesize
7.7MB

Download
memory/2132-31-0x000000000BD80000-0x000000000BDD8000-memory.dmp

Filesize
352KB

Download
memory/2132-26-0x000000000B560000-0x000000000B56A000-memory.dmp

Filesize
40KB

Download
memory/2132-25-0x000000000B4D0000-0x000000000B562000-memory.dmp

Filesize
584KB

Download
memory/2132-24-0x0000000074B40000-0x00000000752F0000-memory.dmp

Filesize
7.7MB

Download
memory/2132-23-0x000000000AC30000-0x000000000AC64000-memory.dmp

Filesize
208KB

Download
memory/2132-38-0x000000000D5A0000-0x000000000D5A8000-memory.dmp

Filesize
32KB

Download
memory/2132-15-0x0000000074B40000-0x00000000752F0000-memory.dmp

Filesize
7.7MB

Download
memory/2192-333-0x00000000009C0000-0x0000000000A37000-memory.dmp

Filesize
476KB

Download
memory/2792-295-0x00000000009C0000-0x0000000000A37000-memory.dmp

Filesize
476KB

Download
memory/4240-201-0x000000000B640000-0x000000000B6E0000-memory.dmp

Filesize
640KB

Download
memory/4240-233-0x000000000C700000-0x000000000C7F4000-memory.dmp

Filesize
976KB

Download
memory/4240-375-0x000000000CD50000-0x000000000D0A4000-memory.dmp

Filesize
3.3MB

Download
memory/4240-374-0x00000000076A0000-0x00000000076A8000-memory.dmp

Filesize
32KB

Download
memory/4240-373-0x00000000076D0000-0x0000000007720000-memory.dmp

Filesize
320KB

Download
memory/4240-190-0x000000000B520000-0x000000000B55A000-memory.dmp

Filesize
232KB

Download
memory/4484-5-0x0000000005250000-0x00000000052E2000-memory.dmp

Filesize
584KB

Download
memory/4484-2-0x0000000005760000-0x0000000005D04000-memory.dmp

Filesize
5.6MB

Download
memory/4484-142-0x000000000B870000-0x000000000B88E000-memory.dmp

Filesize
120KB

Download
memory/4484-0-0x0000000074B4E000-0x0000000074B4F000-memory.dmp

Filesize
4KB

Download
memory/4484-7-0x00000000051B0000-0x00000000051CE000-memory.dmp

Filesize
120KB

Download
memory/4484-4-0x0000000074B40000-0x00000000752F0000-memory.dmp

Filesize
7.7MB

Download
memory/4484-3-0x00000000050C0000-0x0000000005106000-memory.dmp

Filesize
280KB

Download
memory/4484-6-0x0000000005150000-0x0000000005176000-memory.dmp

Filesize
152KB

Download
memory/4484-122-0x000000000A000000-0x000000000A076000-memory.dmp

Filesize
472KB

Download
memory/4484-1-0x0000000000200000-0x000000000073E000-memory.dmp

Filesize
5.2MB

Download
memory/4484-121-0x0000000009F60000-0x0000000009F72000-memory.dmp

Filesize
72KB

Download
memory/4484-14-0x0000000074B40000-0x00000000752F0000-memory.dmp

Filesize
7.7MB

Download
memory/4808-152-0x00000000051C0000-0x0000000005206000-memory.dmp

Filesize
280KB

Download
memory/4808-151-0x0000000000490000-0x00000000009FC000-memory.dmp

Filesize
5.4MB

Download