be9ddcdedf8c36c64e6b0a32d2686b74a112913c54217ccaa46675bfd1dc82f1

Analysis

user interaction
yes
max time kernel
149s
max time network
147s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/05/2026, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Roblox Account Manager.exe
Size 5.4MB
Sample260527-sem12saz91
SHA256 be9ddcdedf8c36c64e6b0a32d2686b74a112913c54217ccaa46675bfd1dc82f1
MD5 334728f32a1144c893fdffc579a7709b
SHA1 97d2eb634d45841c1453749acb911ce1303196c0
SHA512 5df9d63136098d23918eba652b44a87e979430b2ce3e78a3eb8faef3dd4bd9599d6c31980f9eaf2bd6a071e966421bc6cec950c28b3b917f90130e8a582c2a1f
SSDEEP 98304:42bT1Qm7d9G4/Ml61KO9bjRxMLywnrmYa0kqXf0FJ7WLhrBzcgPgL6b:/Qm59RMowO9bjRmmYiYa0kSIJ7zgPE
TLSH
T12246E02A72A04335E5AB45344468C1B496FE7E3A6A68E29EE7C0BD5F3DF5BD09430313
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery persistence ransomware spyware

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
2364	vcredist.tmp
1732	vcredist.tmp
1588	VC_redist.x86.exe
2616	VC_redist.x86.exe
2228	VC_redist.x86.exe
3420	VC_redist.x86.exe
4732	VC_redist.x86.exe

Loads dropped DLL 3 IoCs

pid	Process
1732	vcredist.tmp
3748	VC_redist.x86.exe
3420	VC_redist.x86.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{0b5169e3-39da-4313-808e-1f9c0407f3bf} = "\"C:\\ProgramData\\Package Cache\\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\\VC_redist.x86.exe\" /burn.runonce"	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{0b5169e3-39da-4313-808e-1f9c0407f3bf} = "\"C:\\ProgramData\\Package Cache\\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\\VC_redist.x86.exe\" /burn.runonce"	VC_redist.x86.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
9	1644	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Drops file in System32 directory 49 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140fra.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140cht.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcamp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcamp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcruntime140_threads.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140deu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140chs.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140rus.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140ita.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140kor.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140rus.dll	msiexec.exe
File created	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140ita.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140deu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140enu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140esn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140fra.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcomp140.dll	msiexec.exe

Drops file in Windows directory 23 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA7B6.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF26098BD8B0ECB901.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4B1CA269725109F5.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAE4F.tmp	msiexec.exe
File created	C:\Windows\Installer\e58a1f0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58a1c9.msi	msiexec.exe
File created	C:\Windows\Installer\e58a1da.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE5F9A26B89F3FD90.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e58a1db.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF1C2424696FEB152.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA61E.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{922480B5-CAEB-4B1B-AAA4-9716EFDCE26B}	msiexec.exe
File created	C:\Windows\Installer\e58a1db.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA2F48084D22C5A3C.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1B38333E6979A357.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFB3FD71CAEF24281.TMP	msiexec.exe
File created	C:\Windows\Installer\e58a1c9.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF0ACED0446D8067A.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIACB8.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C18FB403-1E88-43C8-AD8A-CED50F23DE8B}	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Roblox Account Manager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Roblox Account Manager.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ae741e68cfe5c5110000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ae741e680000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900ae741e68000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aae741e68000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dae741e68000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Internet Explorer\TypedURLs	Roblox Account Manager.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_X86,V14\DEPENDENTS\{4D8DCF8C-A72A-43E1-9833-C12724DB736E}	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\DisplayName = "Microsoft Visual C++ 2022 X86 Additional Runtime - 14.44.35211"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{922480B5-CAEB-4B1B-AAA4-9716EFDCE26B}v14.44.35211\\packages\\vcRuntimeMinimum_x86\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\PackageCode = "73B56A9D9529BEC48BFF28F2B2D368B6"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.44,bundle\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.44.35211"	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.44,bundle\ = "{0b5169e3-39da-4313-808e-1f9c0407f3bf}"	VC_redist.x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\60DB5E5629367203C8625813703DFCA1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\ProductName = "Microsoft Visual C++ 2022 X86 Additional Runtime - 14.44.35211"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E8B87C56C0E773581D82F286F95E50\304BF81C88E18C34DAA8EC5DF032EDB8	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\SourceList\PackageName = "vc_runtimeMinimum_x86.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.30,bundle\Dependents	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B084229BEACB1B4AA4A7961FECD2EB6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\SourceList\Media\1 = ";"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.44,bundle\Dependents\{0b5169e3-39da-4313-808e-1f9c0407f3bf}	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\Version = "14.44.35211"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{C18FB403-1E88-43C8-AD8A-CED50F23DE8B}v14.44.35211\\packages\\vcRuntimeAdditional_x86\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\VC,redist.x86,x86,14.44,bundle	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\60DB5E5629367203C8625813703DFCA1	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\304BF81C88E18C34DAA8EC5DF032EDB8	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\304BF81C88E18C34DAA8EC5DF032EDB8\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\Dependents\{0b5169e3-39da-4313-808e-1f9c0407f3bf}	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.44,bundle\Version = "14.44.35211.0"	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\ProductName = "Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.44.35211"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\PackageCode = "932B68F08575786459F58CF6C8748C4B"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\Version = "237799819"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E8B87C56C0E773581D82F286F95E50	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E8B87C56C0E773581D82F286F95E50	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5040806F8AF9AAC49928419ED5A1D3CA	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\ = "{922480B5-CAEB-4B1B-AAA4-9716EFDCE26B}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\DisplayName = "Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.44.35211"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\Assignment = "1"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\VC,REDIST.X86,X86,14.30,BUNDLE\DEPENDENTS\{4D8DCF8C-A72A-43E1-9833-C12724DB736E}	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\Dependents\{0b5169e3-39da-4313-808e-1f9c0407f3bf}	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\304BF81C88E18C34DAA8EC5DF032EDB8\VC_Runtime_Additional	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\SourceList\PackageName = "vc_runtimeAdditional_x86.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\Dependents\{0b5169e3-39da-4313-808e-1f9c0407f3bf}	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.30,bundle	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA	msiexec.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1644	msiexec.exe
1644	msiexec.exe
1644	msiexec.exe
1644	msiexec.exe
1644	msiexec.exe
1644	msiexec.exe
1644	msiexec.exe
1644	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2904	Roblox Account Manager.exe
Token: SeBackupPrivilege	2692	vssvc.exe
Token: SeRestorePrivilege	2692	vssvc.exe
Token: SeAuditPrivilege	2692	vssvc.exe
Token: SeShutdownPrivilege	1588	VC_redist.x86.exe
Token: SeIncreaseQuotaPrivilege	1588	VC_redist.x86.exe
Token: SeSecurityPrivilege	1644	msiexec.exe
Token: SeCreateTokenPrivilege	1588	VC_redist.x86.exe
Token: SeAssignPrimaryTokenPrivilege	1588	VC_redist.x86.exe
Token: SeLockMemoryPrivilege	1588	VC_redist.x86.exe
Token: SeIncreaseQuotaPrivilege	1588	VC_redist.x86.exe
Token: SeMachineAccountPrivilege	1588	VC_redist.x86.exe
Token: SeTcbPrivilege	1588	VC_redist.x86.exe
Token: SeSecurityPrivilege	1588	VC_redist.x86.exe
Token: SeTakeOwnershipPrivilege	1588	VC_redist.x86.exe
Token: SeLoadDriverPrivilege	1588	VC_redist.x86.exe
Token: SeSystemProfilePrivilege	1588	VC_redist.x86.exe
Token: SeSystemtimePrivilege	1588	VC_redist.x86.exe
Token: SeProfSingleProcessPrivilege	1588	VC_redist.x86.exe
Token: SeIncBasePriorityPrivilege	1588	VC_redist.x86.exe
Token: SeCreatePagefilePrivilege	1588	VC_redist.x86.exe
Token: SeCreatePermanentPrivilege	1588	VC_redist.x86.exe
Token: SeBackupPrivilege	1588	VC_redist.x86.exe
Token: SeRestorePrivilege	1588	VC_redist.x86.exe
Token: SeShutdownPrivilege	1588	VC_redist.x86.exe
Token: SeDebugPrivilege	1588	VC_redist.x86.exe
Token: SeAuditPrivilege	1588	VC_redist.x86.exe
Token: SeSystemEnvironmentPrivilege	1588	VC_redist.x86.exe
Token: SeChangeNotifyPrivilege	1588	VC_redist.x86.exe
Token: SeRemoteShutdownPrivilege	1588	VC_redist.x86.exe
Token: SeUndockPrivilege	1588	VC_redist.x86.exe
Token: SeSyncAgentPrivilege	1588	VC_redist.x86.exe
Token: SeEnableDelegationPrivilege	1588	VC_redist.x86.exe
Token: SeManageVolumePrivilege	1588	VC_redist.x86.exe
Token: SeImpersonatePrivilege	1588	VC_redist.x86.exe
Token: SeCreateGlobalPrivilege	1588	VC_redist.x86.exe
Token: SeRestorePrivilege	1644	msiexec.exe
Token: SeTakeOwnershipPrivilege	1644	msiexec.exe
Token: SeRestorePrivilege	1644	msiexec.exe
Token: SeTakeOwnershipPrivilege	1644	msiexec.exe
Token: SeRestorePrivilege	1644	msiexec.exe
Token: SeTakeOwnershipPrivilege	1644	msiexec.exe
Token: SeRestorePrivilege	1644	msiexec.exe
Token: SeTakeOwnershipPrivilege	1644	msiexec.exe
Token: SeRestorePrivilege	1644	msiexec.exe
Token: SeTakeOwnershipPrivilege	1644	msiexec.exe
Token: SeRestorePrivilege	1644	msiexec.exe
Token: SeTakeOwnershipPrivilege	1644	msiexec.exe
Token: SeRestorePrivilege	1644	msiexec.exe
Token: SeTakeOwnershipPrivilege	1644	msiexec.exe
Token: SeRestorePrivilege	1644	msiexec.exe
Token: SeTakeOwnershipPrivilege	1644	msiexec.exe
Token: SeRestorePrivilege	1644	msiexec.exe
Token: SeTakeOwnershipPrivilege	1644	msiexec.exe
Token: SeRestorePrivilege	1644	msiexec.exe
Token: SeTakeOwnershipPrivilege	1644	msiexec.exe
Token: SeRestorePrivilege	1644	msiexec.exe
Token: SeTakeOwnershipPrivilege	1644	msiexec.exe
Token: SeRestorePrivilege	1644	msiexec.exe
Token: SeTakeOwnershipPrivilege	1644	msiexec.exe
Token: SeRestorePrivilege	1644	msiexec.exe
Token: SeTakeOwnershipPrivilege	1644	msiexec.exe
Token: SeRestorePrivilege	1644	msiexec.exe
Token: SeTakeOwnershipPrivilege	1644	msiexec.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2904	3056	Roblox Account Manager.exe	81
PID 2904 wrote to memory of 2364	2904	Roblox Account Manager.exe	82
PID 2364 wrote to memory of 1732	2364	vcredist.tmp	83
PID 1732 wrote to memory of 1588	1732	vcredist.tmp	84
PID 2616 wrote to memory of 2228	2616	VC_redist.x86.exe	94
PID 2228 wrote to memory of 3420	2228	VC_redist.x86.exe	95
PID 1588 wrote to memory of 3244	1588	VC_redist.x86.exe	96
PID 3244 wrote to memory of 3748	3244	VC_redist.x86.exe	97
PID 3748 wrote to memory of 2804	3748	VC_redist.x86.exe	98
PID 3420 wrote to memory of 4732	3420	VC_redist.x86.exe	99

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe
"C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe
  "C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe" -restart
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\Users\Admin\AppData\Local\Temp\vcredist.tmp
    "C:\Users\Admin\AppData\Local\Temp\vcredist.tmp" /q /norestart
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2364
  - - C:\Windows\Temp\{F2A11677-6362-4791-B513-715DABD665F1}\.cr\vcredist.tmp
      "C:\Windows\Temp\{F2A11677-6362-4791-B513-715DABD665F1}\.cr\vcredist.tmp" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\vcredist.tmp" -burn.filehandle.attached=728 -burn.filehandle.self=732 /q /norestart
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1732
    - - C:\Windows\Temp\{596E5957-4A9C-46E9-9726-855DB532AFA6}\.be\VC_redist.x86.exe
        
        "C:\Windows\Temp\{596E5957-4A9C-46E9-9726-855DB532AFA6}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{9168E65B-B819-4A6D-A158-C59335A8382A} {6BDD6084-730C-48D8-9756-C6B541FE96F6} 1732
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1588
      - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={0b5169e3-39da-4313-808e-1f9c0407f3bf} -burn.filehandle.self=1140 -burn.embedded BurnPipe.{609B1ED3-747D-416E-987E-0B4E9C5757BD} {D02814DC-6F6B-4F68-9EFC-853E6A7B5922} 1588
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3244
        
        C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=544 -burn.filehandle.self=560 -uninstall -quiet -burn.related.upgrade -burn.ancestors={0b5169e3-39da-4313-808e-1f9c0407f3bf} -burn.filehandle.self=1140 -burn.embedded BurnPipe.{609B1ED3-747D-416E-987E-0B4E9C5757BD} {D02814DC-6F6B-4F68-9EFC-853E6A7B5922} 1588
        7⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3748
        
        C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{457B65E7-7968-4F08-AC90-90F833323641} {7B2125C5-DB94-4E2C-82D7-67A159963348} 3748
        8⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2804

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2692

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:1856

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1644

C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
"C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2616
- C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
  "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260527160244.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
    "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -burn.filehandle.attached=548 -burn.filehandle.self=564 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260527160244.log"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3420
  - - C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
      "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{F7D0510E-E3F6-4A3B-A00E-963C741984B7} {4B27F17A-5789-40C4-AFDC-664F4D4D6C6F} 3420
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:4732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58a1ce.rbs

Path C:\Config.Msi\e58a1ce.rbs
Size 16KB
SHA256 0b59a897ddf147486c0a03acdbfceac5b9a918d35bc41daccb8f6044adfb8c7c
MD5 bef5e9c4522941d871c077e60e69fe4c
SHA1 6d499a13282d6cbedd8b4fdb40651d80bba4d55f
SHA512 5c4c9005939cb3e4bc6ad0a21e6e4f4b7fbf2e926ed6d1307e28777191b9c197421198f4be7f8bf166d9e8e42c09c5f5c775bf2c659964204b852e1ac460eec3
SSDEEP 96:HeRp55Rp/NNQWT8RcBeDd11xQo8RjeDd11Cjtknz0yWcW/Rp0Q2RpVdzRp9OXw3+:H1RV1GRO1Hn4Xyin5f7e+nh18XT9y
TLSH
T1C672FD42A94096C3E8662B70DD571B7037B7D7E5A344839B40EC92349F877D22F9E28E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58a1d3.rbs

Path C:\Config.Msi\e58a1d3.rbs
Size 18KB
SHA256 b9a17fbc8ef6834ea82c634773dfe119404bae3368d7e5a82e12f2f476bd38fb
MD5 62741c1c9bcbf12dcc9c25a9166f29c6
SHA1 ca7e2ab53706bb054099f1e21ea8ae6f97b4c3a9
SHA512 8427c887a1d1cf44af4ee50ba97d683e45625144813c2abfeb9325d2bd126f77244b0ad3885a91334bdb4bdd553e32a225f29fcadea2175d81227e77b176c8eb
SSDEEP 192:H8Cm7YOfVqXmwtnNloyjvdmF1C+mJvbIvdJvbNwwjn5Ev/bcP3pL:H8YbjVioJvKdJvzuc5
TLSH
T1F6922D427A0091D3E8A66B70DC472B153BF7D3EA93A4475F02DCC1348F937D62E8958A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58a1e0.rbs

Path C:\Config.Msi\e58a1e0.rbs
Size 20KB
SHA256 87caf0b214dd2fc95fdc3e5c39ccb3c67624fc925fa3e8620067b9e89a76e0f9
MD5 a68a5b91784c6278025730019e65ee77
SHA1 a8fa255f3d6b6cce57509f4353f2356ab9c024ad
SHA512 911045176cbcd4385e9a27f818b37785becbf5b08a445b699759bba42f39c3d100b6d4011aafe895b229748a475f03cf70ab037dca670384b3efd5fc4f9a8e8a
SSDEEP 384:kzR4glRDgFfXMawmn28I1S9HXVZFbLQPO0uOZgqtmmfgXeNLft:k94gDifXMawmn28IA9HXVZFbkPO0uEgi
TLSH
T1A7A2EF03A644A5D3E8B62B70ED670BA57B72CBE59361434B40DC95348F933C23ED968E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58a1ef.rbs

Path C:\Config.Msi\e58a1ef.rbs
Size 19KB
SHA256 ab44d046aaf6b7c8e9204955cfd81755fb12e743ac92e6f09e989c9c6af9ce3b
MD5 11fba410b7e0fb43869833fde4e8f2af
SHA1 d8b7475af877563a4e336f4f40653865d45f9a34
SHA512 5eec7bc17535bb19d821180719310b90b1d888b642073fca7dfdd56db1fcb5b6887c8a51e8f9b1cb6c7cbff9039ef88746525b233c7610ff6ad08c1a06e076dd
SSDEEP 384:k/Jq2k0Ve2SD4QsUh+9aglJcVJcTccQFSUWF:k/o2k0Ve2SD4QsUh+QMGMcbFTe
TLSH
T12B92FD42A940DA92D4BBAB70CE971B347736C3E9D791531B40CCD1304E937C62F9EA8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\state.rsm
Size 914B
SHA256 74d8b860d1c83f3f8bd8475909411851ab97f21f923c5a936af422a91ece5999
MD5 ed3a865a6424343a3a4fc36e6c06cf6d
SHA1 674452bed71e9f215a81d0ed3498469e571cdf8e
SHA512 ec8e6b74a68af66676a751a10b6a4608edbc677b5ab2992f4c3a9b06c694cd586b59a696560b747581f6689f806eccfaab59e357d66617bbe98d4b44c4655059
TLSH
T1E3119661AFF65119F3FBBB7179F5161459BFB8110D31902D0181708A9F32B90DD24B66
MD5 SHA1 SHA512 TLSH

Submit Download

Roblox Account Manager.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Roblox Account Manager.exe.log
Size 1KB
SHA256 180f825c19263ae06fc891efcde51f993b720a27bd6e563742a110b40cb3fe41
MD5 72c442c0ee7dde7b3455bb315289bcf2
SHA1 d33367411ce01348f531e098495885b9d2ea110b
SHA512 b66e975424f17e3b4dce2d2746d78b8a05001ee17a7208c1f5f81ed8530aa2e3d4b10f4c64b33ba7c05a5e9e2afc548abf6bdfaffd6015c2cb7d624a688dc018
TLSH
T1421138702231B5D84D522F5308596A8516FF0745BAA8EE2C7599325EDD2A0076F222E3
MD5 SHA1 SHA512 TLSH

Submit Download

RAMSettings.ini

Path C:\Users\Admin\AppData\Local\Temp\RAMSettings.ini
Size 1014B
SHA256 787fa9af1c32b7e198119469c0e2c02c06b34ec7c990b62b9f4fb9bc8cedaa5f
MD5 1d917eaf5dcc8e06dd032c33f3a3d36a
SHA1 1eacb4eced22393fd5140910d30070f2e054e2fe
SHA512 3cf5bc6160262ad454477cc0fab401696a7e5dff9e6fae1cdcfa0579ded640ea8c383dfcea6194f55c914927058e2355fd661d1fa83f87c10aeffa6a91cb9fcd
TLSH
T1AD112581290970FD2861D2B43D53E6A37764E900228F8571F4E0156B37DAC127BA447F
MD5 SHA1 SHA512 TLSH

Submit Download

RAMTheme.ini

Path C:\Users\Admin\AppData\Local\Temp\RAMTheme.ini
Size 314B
SHA256 563eb35fd613f4298cd4dceff67652a13ba516a6244d9407c5709323c4ca4bb1
MD5 f18fa783f4d27e35e54e54417334bfb4
SHA1 94511cdf37213bebdaf42a6140c9fe5be8eb07ba
SHA512 602f6a68562bc89a4b3c3a71c2477377f161470bf8ae8e6925bf35691367115abfa9809925bd09c35596c6a3e5a7e9d090e5198e6a885a6658049c8732a05071
TLSH
T189E0C2EC6748160CEC30B7F63093643ABC46443B330338344A831131E080828B52E29F
MD5 SHA1 SHA512 TLSH

Submit Download

Roblox Account Manager.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe.config
Size 6KB
SHA256 2b6d99db8369b0ff6372737d89d1c9e4101815b4168a3852c7b513f2897e7f3d
MD5 0a86fa27d09e26491dbbb4fe27f4b410
SHA1 63e4b5afb8bdb67fc1d6f8dddeb40be20939289e
SHA512 fbebc4dc0925d5d67271cac04c1ed324091442ef4c9f6243d2c1c523c9aa6b338c6a594e4987fc142dd3b2a023338a267c8a3454e47fbf0b3e0dbd7b3b65cc0d
SSDEEP 96:UrT/VOP9NWtw/bPiR3GvUiKS4YpyMrsJ+J4YqJyM+:UrTK/2WbKS/pvrsJ+J/qJv+
TLSH
T1B6D16F11B5C8BFE00B7109A27E5FA818CB7D03A72D4D054E71EE6A8B8F7695A4347077
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_x86_20260527160244.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260527160244.log
Size 17KB
SHA256 7f948dc1b479aa4c69d787d018c0400ba822ad7fba7d14f210e59bcd5d56eb57
MD5 5a97b876d65860df413dd0741f389467
SHA1 0b20d947823f9cc0157cd5f54b2c05b21092a9b0
SHA512 e3c886d531866e4effa8bf2edf007b1be4cd74be4d300842779defa0f0ce1627e74bdccbec89a4e7a164b8c0a316fe86f94463f3920bae106f5f4987a30ab787
SSDEEP 192:UCzdwIn81y1I1X1v10161h1dCcCaClCNJIYc32LuZBO6B/CtC8CgY2CxCKCF:UCzdZCCcCaClCii8CtC8CgBCxCKCF
TLSH
T1C682637A56FBF29718D0CAD5E1612FB38A5DF1047F8014B467DE866CA44EC38DBC9288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_x86_20260527160244_000_vcRuntimeMinimum_x86.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260527160244_000_vcRuntimeMinimum_x86.log
Size 2KB
SHA256 f03b86adaf18c19d931fc77d3f3da9572cae4d9b4a429c1a5364435b194a0b25
MD5 059394f555c78127f1926daad1746a4a
SHA1 024f6bdd9cd36261ba4a4c9779ddcba9dd15d4fa
SHA512 0193f48b2016861a9a80286ba7e35d1524772c402c7cd74e26bb21daaa8159e51031835183ea3d12335453795b5b8ac557b5c95ebce161848b7133f61df9704e
TLSH
T14A41D46E1AD50D0AF2F6A747DAF3C1515A33BCC6A934CB4C23D5421A426BD0278AC77A
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_x86_20260527160244_001_vcRuntimeAdditional_x86.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260527160244_001_vcRuntimeAdditional_x86.log
Size 2KB
SHA256 ad01b8c5ab263b1570e37ce56bfac8e763109012648510cd3537a3da871e8fba
MD5 16dbb075e1afaecdaa8108756aa54381
SHA1 8597661f1f7e2cebadfca40d15ccf50f98d95217
SHA512 5017e942c7488c5c5c4f652dd6d593e68b177f3a50eea77caa3b6aebc10b2efa60cdf81938a3b2b0dc5edecb000aee05416ae81b76e6aaf9dd2737cee9e1d588
TLSH
T1A441D4641BF90905F1B21647DAF3C0535A33FCC6A834CF5C2389831E467BE029878B6A
MD5 SHA1 SHA512 TLSH

Submit Download

log4.config

Path C:\Users\Admin\AppData\Local\Temp\log4.config
Size 936B
SHA256 e4b10630d9ec2af508de31752fbbc6816c7426c40a3e57f0a085ce7f42c77bd5
MD5 e4659ac08af3582a23f38bf6c562f841
SHA1 19cb4f014ba96285fa1798f008deabce632c7e76
SHA512 5bfa1e021cc7ee5e7a00da865d68684202b3b92d3d369b85b80c591fffa67725d434398325dc1e37c659eab62c0a4118b3e279ac0096b95790d252ceb6254249
TLSH
T179112B12DEECDD1242320D47A5620929DE7962E7052414CDB0DD639F2F3A95408A735E
MD5 SHA1 SHA512 TLSH

Submit Download

vcredist.tmp

Path C:\Users\Admin\AppData\Local\Temp\vcredist.tmp
Size 13.3MB
SHA256 0c09f2611660441084ce0df425c51c11e147e6447963c3690f97e0b25c55ed64
MD5 99f52708b06b9c695a8d64a44740bf08
SHA1 c2743ffc36d2af40ade0e370be52d6b202874114
SHA512 d0a609f6b2f05939ab82aa5fde1bb0595206653a2ab2ce859a750f71596c4491a8074bb825484e365a4fbcdb820d5de0346e7209ea22214b090b4fe853098dce
SSDEEP 196608:fLZBJflpQcIIS/Rj7BWl+aV8t8z72BxBwBgO4L6f6psSD5YM4565kIgoOgP2edk:lHlptVYmfr7yBG/4L6f6pXc65kngP1
TLSH
T1A8E63332E494413BFFB604336A65E9203E7DA628274149F6E3C8FD4D3A7219267F7612
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{596E5957-4A9C-46E9-9726-855DB532AFA6}\.ba\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{596E5957-4A9C-46E9-9726-855DB532AFA6}\.ba\wixstdba.dll
Size 215KB
SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
MD5 f68f43f809840328f4e993a54b0d5e62
SHA1 01da48ce6c81df4835b4c2eca7e1d447be893d39
SHA512 a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1
SSDEEP 6144:K6EZdi6e93SuDeTKZxQfsRy26BqbUHYJe:K62i6eNSYeuZ2sRDK
TLSH
T15E24AF12B5D0907AEBFB19305939E5216DBDBA210FA0C9CE5348AD2B2E705C1DB36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab54A5CABBE7274D8A22EB58060AAB7623

Path C:\Windows\Temp\{596E5957-4A9C-46E9-9726-855DB532AFA6}\cab54A5CABBE7274D8A22EB58060AAB7623
Size 838KB
SHA256 c9935322c0af2fe00ebb018f8b0b908018576048fa4d3c0376a30ebf0eb2cf50
MD5 d8b6763546bb89d2d9cf3c45908b1e4b
SHA1 a1d28457d45a80bcf29618ebbdd9c50808acae5d
SHA512 194d06552d8a3b107851de79f7e9b17f4b143f62886abc71928c899e808c9d0a35417fb1813bfb918ced5f2058bfa58dfd34f837be0833d4b2ea9b143ba42081
SSDEEP 24576:P+EPvFdDKnDzR8ezJwqgq3anXt/WNsJsI96p+L2TI0X:PH9oXzdgUq+NAsXo2T3
TLSH
T1C70523DA72D3A60BED4C2DC008BDE5631D37BAFE9412D38A6174807A39CB7D456342AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cabB3E1576D1FEFBB979E13B1A5379E0B16

Path C:\Windows\Temp\{596E5957-4A9C-46E9-9726-855DB532AFA6}\cabB3E1576D1FEFBB979E13B1A5379E0B16
Size 4.9MB
SHA256 01b11076177c8a5ee37eba745142cd6bbc4ac1ebfc4ebe48c85bd285a73ebf60
MD5 1d033900fb3774d9025fa656f175d39e
SHA1 9cbc362c97c37aa5236c49e7b974e4a62bbd9d21
SHA512 b96914b5e8c4951dc4f6b08b96e548c7328424a78d9b1394f1c2ab2ebf2f870b5c3e6f685c656cc1d6dccc396ece88ae6f23918cfa1c9ade22828972a0468f75
SSDEEP 98304:zExLOQyFMLkrdAyYPk9Lqy5dPFpDoNRAKHSEPFVzyJUkeOwnxRj8oFFZY:saQyKLksPk461fDo3PFVzyJ7eVnFo
TLSH
T172363318C4712B0ABC1E482455E3DE84FDC5B9DAAA863BD7F264B74C29437957B30C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcRuntimeAdditional_x86

Path C:\Windows\Temp\{596E5957-4A9C-46E9-9726-855DB532AFA6}\vcRuntimeAdditional_x86
Size 200KB
SHA256 3e4a528fe5263a5dc44455d0ab2717f0c02acdc120c918cf43730ce9f36ccbb5
MD5 e4c2fa6814ad5061be3d081e5102eb1d
SHA1 89bee5a8cbd82937bd2222cc6e97b3648e8e491f
SHA512 5ebe95053ed100758711fa2a5d4bc12f3c976b8b2a27b8a88d6d10f666b6c5170698939b03c30ccb06acebd5d703d90045eb236cc4cfe55d1c92c31e8de87575
SSDEEP 3072:x9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriThXC:DlaZeKFxCnBheIdluA
TLSH
T17014AE12B5808033DAFE1A351178DB615F3DBE608F54499B2364B6AD1E717C08F3AAB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcRuntimeMinimum_x86

Path C:\Windows\Temp\{596E5957-4A9C-46E9-9726-855DB532AFA6}\vcRuntimeMinimum_x86
Size 200KB
SHA256 c5ff4d6cd4be9f4965f93af273dd364948fbe44d40b123f34f82bcbcf64c8df4
MD5 cce22015775c209fbab4050261fba590
SHA1 27998ee42531b9d41f3d71c9dc2ead8d95ed8863
SHA512 61886caec75d195d43fafcaa8d1a8b50c4fb65c39103f62d54a704d713035cc2717c04b1c1cd4794d218364b05c27bf62b13d3aef66e5665f148961ac009b45d
SSDEEP 3072:0I9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriTg3:ZlaZeKFxCnBheIdlu
TLSH
T1F414AF12B5808032DAFE19351178DB715F3D7E608F5489AB2364B6AD1E717C08F3AAB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{5DF84388-33F5-4B66-ACDE-EFFFFC9F5018}\.ba\license.rtf
Size 9KB
SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
MD5 04b33f0a9081c10e85d0e495a1294f83
SHA1 1efe2fb2d014a731b752672745f9ffecdd716412
SHA512 d1dbed00df921169dd61501e2a3e95e6d7807348b188be9dd8fc63423501e4d848ece19ac466c3cacfccc6084e0eb2f457dc957990f6f511df10fd426e432685
SSDEEP 192:H8kZ1UVDWkiWZTIsp/4hghFF1Qf4lCfnEtHixEGx736wHqItfSpOtJ32:cM1RWZMi/zzlOnjt5HLoa2
TLSH
T13F12A7A8234783D103D213D7055294C1B71F0BF6AE7AF95C34E4D53826E2E6CB6B91E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{5DF84388-33F5-4B66-ACDE-EFFFFC9F5018}\.ba\thm.wxl
Size 2KB
SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
MD5 fbfcbc4dacc566a3c426f43ce10907b6
SHA1 63c45f9a771161740e100faf710f30eed017d723
SHA512 063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e
TLSH
T11F519B6778CF639028335125EAD2966A6920C5DC923F2DF1FC4A914B838D522A373F57
MD5 SHA1 SHA512 TLSH

Submit Download

thm.xml

Path C:\Windows\Temp\{5DF84388-33F5-4B66-ACDE-EFFFFC9F5018}\.ba\thm.xml
Size 8KB
SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
MD5 f62729c6d2540015e072514226c121c7
SHA1 c1e189d693f41ac2eafcc363f7890fc0fea6979c
SHA512 cbbfbfa7e013a2b85b78d71d32fdf65323534816978e7544ca6cea5286a0f6e8e7e5ffc4c538200211f11b94373d5658732d5d8aa1d01f9ccfdbf20f154f1471
SSDEEP 96:8L2HdQG+3VzHfz96zYFGaPSWXdhRAmImlqFQKFBiUxn7Ke5A82rkO/pWk3nswP:ZHAzZ/3
TLSH
T1D30259B546DDB801D232FB1166E231D27F126971C0C46E59F90C2AFB5FE1140A8B72BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{5DF84388-33F5-4B66-ACDE-EFFFFC9F5018}\.ba\wixstdba.dll
Size 191KB
SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
MD5 eab9caf4277829abdf6223ec1efa0edd
SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
SSDEEP 3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53EfcUzN0m6I+WxBlnKzeZuqt:OXoQNb++gDrSJdr8BHkPh3wIgnK/IU1a
TLSH
T103149E11B5D0907AE7FB1A385938B5216D7FBA201B60C99E17589D6F2DF02C0AF35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist.tmp

Path C:\Windows\Temp\{F2A11677-6362-4791-B513-715DABD665F1}\.cr\vcredist.tmp
Size 669KB
SHA256 4a6e1044ff0f49d2e3b12f7c40352c7e573e0c58f3b3cc0b55b63c95ede87828
MD5 f216f5ee89b18a28a3936fab57c16179
SHA1 3d2995962598774a8e2dc1d038c76495466f3a72
SHA512 9350de18d452927efef3be3dd4c49361ec6b29f22e969781374508b167b4e697dcea05ee6b43b47b850d4edd0591b960628ee9cbc59deee62937a40a8e5a6573
SSDEEP 12288:n3mgqnIZuYfCYqFet4CovkM7y+1nEn0/6OaFUuT80iP:n3WnIZuMCxezot7Dh+0/9ayn0i
TLSH
T18CE49D32A5614033FBF10573B928A6303E7CE7282751C8A9D7D4AD1D7EA58C2A7F7216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2804-264-0x0000000000CD0000-0x0000000000D47000-memory.dmp

Download

memory/2904-17-0x0000000006860000-0x000000000686A000-memory.dmp

Download

memory/2904-20-0x0000000005B30000-0x0000000005B40000-memory.dmp

Download

memory/2904-71-0x000000000F7A0000-0x000000000F7BA000-memory.dmp

Download

memory/2904-74-0x000000000F7D0000-0x000000000F7D8000-memory.dmp

Download

memory/2904-97-0x0000000005B30000-0x0000000005B40000-memory.dmp

Download

memory/2904-98-0x0000000005B30000-0x0000000005B40000-memory.dmp

Download

memory/2904-99-0x0000000005B30000-0x0000000005B40000-memory.dmp

Download

memory/2904-53-0x000000000E090000-0x000000000E0B2000-memory.dmp

Download

memory/2904-36-0x00000000052D0000-0x0000000005328000-memory.dmp

Download

memory/2904-38-0x000000000DEA0000-0x000000000DF52000-memory.dmp

Download

memory/2904-23-0x000000000C180000-0x000000000C220000-memory.dmp

Download

memory/2904-22-0x000000000C160000-0x000000000C16A000-memory.dmp

Download

memory/2904-21-0x000000000BA00000-0x000000000BA3A000-memory.dmp

Download

memory/2904-70-0x000000000F6B0000-0x000000000F7A4000-memory.dmp

Download

memory/2904-19-0x0000000005B30000-0x0000000005B40000-memory.dmp

Download

memory/2904-13-0x0000000005B30000-0x0000000005B40000-memory.dmp

Download

memory/2904-16-0x00000000067A0000-0x0000000006814000-memory.dmp

Download

memory/3056-0-0x0000000000D70000-0x00000000012DC000-memory.dmp

Download

memory/3056-6-0x0000000005E40000-0x0000000005E5E000-memory.dmp

Download

memory/3056-5-0x0000000005E00000-0x0000000005E26000-memory.dmp

Download

memory/3056-4-0x0000000005EA0000-0x0000000005F32000-memory.dmp

Download

memory/3056-3-0x0000000005D60000-0x0000000005DA6000-memory.dmp

Download

memory/3056-2-0x0000000005DF0000-0x0000000005E00000-memory.dmp

Download

memory/3056-1-0x00000000063B0000-0x0000000006956000-memory.dmp

Download

memory/3244-267-0x0000000000CD0000-0x0000000000D47000-memory.dmp

Download

memory/3748-266-0x0000000000CD0000-0x0000000000D47000-memory.dmp

Download