5c7d96455bbb045cb3cb3726d7b4fff2d0810a21d7fdb34ad134696aa7f47d5e

Analysis

user interaction
yes
max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/04/2026, 02:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Roblox Account Manager.exe
Size 5.5MB
Sample260427-chldmady2k
SHA256 5c7d96455bbb045cb3cb3726d7b4fff2d0810a21d7fdb34ad134696aa7f47d5e
MD5 eb54116db322c49ec2faca86f725931e
SHA1 c703685ac6221d7de624039d7351886b21ca53fc
SHA512 ef6ea52df848bf8c7c77831ee5ca64cf337a92edbb0e8d0d38844e204157545aa3c397eeea12d05f276ce4984f519a1a05cf21bc04514fbb35beebf86d7f8e78
SSDEEP 98304:8H6+2bT1Qm7d9G3s2tIfKLUXk8zdywnr5a0kqXf0Fb7WnZhP+MQuPN5Ppauz+l:5Qm59siyLU0lY9a0kSIb7aZhP+MQuPNw
TLSH
T11746E02A72A04335E5AB453405A9C1B496FE7E396A68E19EE7C0BD4F3EF57D09830313
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence ransomware spyware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
19	6000	Roblox Account Manager.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	vcredist.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	VC_redist.x86.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	Roblox Account Manager.exe

Executes dropped EXE 7 IoCs

pid	Process
1572	vcredist.tmp
1696	vcredist.tmp
2104	VC_redist.x86.exe
4912	VC_redist.x86.exe
4612	VC_redist.x86.exe
1776	VC_redist.x86.exe
220	VC_redist.x86.exe

Loads dropped DLL 3 IoCs

pid	Process
1696	vcredist.tmp
5732	VC_redist.x86.exe
1776	VC_redist.x86.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{0b5169e3-39da-4313-808e-1f9c0407f3bf} = "\"C:\\ProgramData\\Package Cache\\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\\VC_redist.x86.exe\" /burn.runonce"	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{0b5169e3-39da-4313-808e-1f9c0407f3bf} = "\"C:\\ProgramData\\Package Cache\\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\\VC_redist.x86.exe\" /burn.runonce"	VC_redist.x86.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
28	raw.githubusercontent.com
30	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in System32 directory 49 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\mfcm140u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140enu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcamp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140fra.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140ita.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140esn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140chs.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcomp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcruntime140_threads.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140rus.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140cht.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140deu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140enu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcamp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140rus.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfcm140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfcm140u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm140.dll	msiexec.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e5857c0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5857c0.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5A8F.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{922480B5-CAEB-4B1B-AAA4-9716EFDCE26B}	msiexec.exe
File created	C:\Windows\Installer\e5857d1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5F82.tmp	msiexec.exe
File created	C:\Windows\Installer\e5857e7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5C35.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C18FB403-1E88-43C8-AD8A-CED50F23DE8B}	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e5857d2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6119.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5857d2.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Roblox Account Manager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Roblox Account Manager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000047d808843682dbf50000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000047d808840000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090047d80884000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a47d80884000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d47d80884000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Software\Microsoft\Internet Explorer\TypedURLs	Roblox Account Manager.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\Version = "14.44.35211"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\ = "{C18FB403-1E88-43C8-AD8A-CED50F23DE8B}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\Dependents\{0b5169e3-39da-4313-808e-1f9c0407f3bf}	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B084229BEACB1B4AA4A7961FECD2EB6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\DisplayName = "Microsoft Visual C++ 2022 X86 Additional Runtime - 14.44.35211"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_X86,V14\DEPENDENTS\{4D8DCF8C-A72A-43E1-9833-C12724DB736E}	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B084229BEACB1B4AA4A7961FECD2EB6\VC_Runtime_Minimum	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\60DB5E5629367203C8625813703DFCA1\5B084229BEACB1B4AA4A7961FECD2EB6	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E8B87C56C0E773581D82F286F95E50\304BF81C88E18C34DAA8EC5DF032EDB8	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{C18FB403-1E88-43C8-AD8A-CED50F23DE8B}v14.44.35211\\packages\\vcRuntimeAdditional_x86\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\VC,redist.x86,x86,14.44,bundle	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\SourceList\PackageName = "vc_runtimeMinimum_x86.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\SourceList\PackageName = "vc_runtimeAdditional_x86.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\Dependents\{0b5169e3-39da-4313-808e-1f9c0407f3bf}	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5040806F8AF9AAC49928419ED5A1D3CA	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E8B87C56C0E773581D82F286F95E50	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.44,bundle\Dependents\{0b5169e3-39da-4313-808e-1f9c0407f3bf}	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{922480B5-CAEB-4B1B-AAA4-9716EFDCE26B}v14.44.35211\\packages\\vcRuntimeMinimum_x86\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.44,bundle\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.44.35211"	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.44,bundle\Version = "14.44.35211.0"	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.44,bundle\Dependents	VC_redist.x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\AdvertiseFlags = "388"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14	VC_redist.x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\Version = "237799819"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\304BF81C88E18C34DAA8EC5DF032EDB8	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\DeploymentFlags = "3"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\VC,REDIST.X86,X86,14.30,BUNDLE\DEPENDENTS\{4D8DCF8C-A72A-43E1-9833-C12724DB736E}	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_X86,V14\DEPENDENTS\{4D8DCF8C-A72A-43E1-9833-C12724DB736E}	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.30,bundle	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\ = "{922480B5-CAEB-4B1B-AAA4-9716EFDCE26B}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\ProductName = "Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.44.35211"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\PackageCode = "932B68F08575786459F58CF6C8748C4B"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B084229BEACB1B4AA4A7961FECD2EB6\Servicing_Key	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\Assignment = "1"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\Clients = 3a0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\ProductName = "Microsoft Visual C++ 2022 X86 Additional Runtime - 14.44.35211"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\Version = "237799819"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.30,bundle\Dependents	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C	msiexec.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4744	msiexec.exe
4744	msiexec.exe
4744	msiexec.exe
4744	msiexec.exe
4744	msiexec.exe
4744	msiexec.exe
4744	msiexec.exe
4744	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6000	Roblox Account Manager.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6000	Roblox Account Manager.exe
Token: SeBackupPrivilege	2404	vssvc.exe
Token: SeRestorePrivilege	2404	vssvc.exe
Token: SeAuditPrivilege	2404	vssvc.exe
Token: SeShutdownPrivilege	2104	VC_redist.x86.exe
Token: SeIncreaseQuotaPrivilege	2104	VC_redist.x86.exe
Token: SeSecurityPrivilege	4744	msiexec.exe
Token: SeCreateTokenPrivilege	2104	VC_redist.x86.exe
Token: SeAssignPrimaryTokenPrivilege	2104	VC_redist.x86.exe
Token: SeLockMemoryPrivilege	2104	VC_redist.x86.exe
Token: SeIncreaseQuotaPrivilege	2104	VC_redist.x86.exe
Token: SeMachineAccountPrivilege	2104	VC_redist.x86.exe
Token: SeTcbPrivilege	2104	VC_redist.x86.exe
Token: SeSecurityPrivilege	2104	VC_redist.x86.exe
Token: SeTakeOwnershipPrivilege	2104	VC_redist.x86.exe
Token: SeLoadDriverPrivilege	2104	VC_redist.x86.exe
Token: SeSystemProfilePrivilege	2104	VC_redist.x86.exe
Token: SeSystemtimePrivilege	2104	VC_redist.x86.exe
Token: SeProfSingleProcessPrivilege	2104	VC_redist.x86.exe
Token: SeIncBasePriorityPrivilege	2104	VC_redist.x86.exe
Token: SeCreatePagefilePrivilege	2104	VC_redist.x86.exe
Token: SeCreatePermanentPrivilege	2104	VC_redist.x86.exe
Token: SeBackupPrivilege	2104	VC_redist.x86.exe
Token: SeRestorePrivilege	2104	VC_redist.x86.exe
Token: SeShutdownPrivilege	2104	VC_redist.x86.exe
Token: SeDebugPrivilege	2104	VC_redist.x86.exe
Token: SeAuditPrivilege	2104	VC_redist.x86.exe
Token: SeSystemEnvironmentPrivilege	2104	VC_redist.x86.exe
Token: SeChangeNotifyPrivilege	2104	VC_redist.x86.exe
Token: SeRemoteShutdownPrivilege	2104	VC_redist.x86.exe
Token: SeUndockPrivilege	2104	VC_redist.x86.exe
Token: SeSyncAgentPrivilege	2104	VC_redist.x86.exe
Token: SeEnableDelegationPrivilege	2104	VC_redist.x86.exe
Token: SeManageVolumePrivilege	2104	VC_redist.x86.exe
Token: SeImpersonatePrivilege	2104	VC_redist.x86.exe
Token: SeCreateGlobalPrivilege	2104	VC_redist.x86.exe
Token: SeRestorePrivilege	4744	msiexec.exe
Token: SeTakeOwnershipPrivilege	4744	msiexec.exe
Token: SeRestorePrivilege	4744	msiexec.exe
Token: SeTakeOwnershipPrivilege	4744	msiexec.exe
Token: SeRestorePrivilege	4744	msiexec.exe
Token: SeTakeOwnershipPrivilege	4744	msiexec.exe
Token: SeRestorePrivilege	4744	msiexec.exe
Token: SeTakeOwnershipPrivilege	4744	msiexec.exe
Token: SeRestorePrivilege	4744	msiexec.exe
Token: SeTakeOwnershipPrivilege	4744	msiexec.exe
Token: SeRestorePrivilege	4744	msiexec.exe
Token: SeTakeOwnershipPrivilege	4744	msiexec.exe
Token: SeRestorePrivilege	4744	msiexec.exe
Token: SeTakeOwnershipPrivilege	4744	msiexec.exe
Token: SeRestorePrivilege	4744	msiexec.exe
Token: SeTakeOwnershipPrivilege	4744	msiexec.exe
Token: SeRestorePrivilege	4744	msiexec.exe
Token: SeTakeOwnershipPrivilege	4744	msiexec.exe
Token: SeRestorePrivilege	4744	msiexec.exe
Token: SeTakeOwnershipPrivilege	4744	msiexec.exe
Token: SeRestorePrivilege	4744	msiexec.exe
Token: SeTakeOwnershipPrivilege	4744	msiexec.exe
Token: SeRestorePrivilege	4744	msiexec.exe
Token: SeTakeOwnershipPrivilege	4744	msiexec.exe
Token: SeRestorePrivilege	4744	msiexec.exe
Token: SeTakeOwnershipPrivilege	4744	msiexec.exe
Token: SeRestorePrivilege	4744	msiexec.exe
Token: SeTakeOwnershipPrivilege	4744	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6000	Roblox Account Manager.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5376 wrote to memory of 6000	5376	Roblox Account Manager.exe	91
PID 6000 wrote to memory of 1572	6000	Roblox Account Manager.exe	93
PID 1572 wrote to memory of 1696	1572	vcredist.tmp	94
PID 1696 wrote to memory of 2104	1696	vcredist.tmp	95
PID 4912 wrote to memory of 4612	4912	VC_redist.x86.exe	107
PID 4612 wrote to memory of 1776	4612	VC_redist.x86.exe	108
PID 2104 wrote to memory of 6136	2104	VC_redist.x86.exe	111
PID 6136 wrote to memory of 5732	6136	VC_redist.x86.exe	112
PID 5732 wrote to memory of 1480	5732	VC_redist.x86.exe	113
PID 1776 wrote to memory of 220	1776	VC_redist.x86.exe	115

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe
"C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5376
- C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe
  "C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe" -restart
  2⤵
  - Downloads MZ/PE file
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6000
- - C:\Users\Admin\AppData\Local\Temp\vcredist.tmp
    "C:\Users\Admin\AppData\Local\Temp\vcredist.tmp" /q /norestart
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1572
  - - C:\Windows\Temp\{A89588FA-86D1-497C-A804-3775EF91B027}\.cr\vcredist.tmp
      "C:\Windows\Temp\{A89588FA-86D1-497C-A804-3775EF91B027}\.cr\vcredist.tmp" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\vcredist.tmp" -burn.filehandle.attached=692 -burn.filehandle.self=696 /q /norestart
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1696
    - - C:\Windows\Temp\{536499DA-02C3-4FEF-837F-A11B86D49723}\.be\VC_redist.x86.exe
        
        "C:\Windows\Temp\{536499DA-02C3-4FEF-837F-A11B86D49723}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{5BD95D21-1E4C-40C3-88C5-9037679400EB} {BF0E7A6C-EC7B-4917-8020-B14F99F42E7B} 1696
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2104
      - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={0b5169e3-39da-4313-808e-1f9c0407f3bf} -burn.filehandle.self=1084 -burn.embedded BurnPipe.{92814978-0F4C-40DF-A0D4-20BF7EC23714} {DCA60F0E-03B4-4ADA-8C32-94503A84267E} 2104
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6136
        
        C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={0b5169e3-39da-4313-808e-1f9c0407f3bf} -burn.filehandle.self=1084 -burn.embedded BurnPipe.{92814978-0F4C-40DF-A0D4-20BF7EC23714} {DCA60F0E-03B4-4ADA-8C32-94503A84267E} 2104
        7⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5732
        
        C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{04872774-3954-4735-8AA3-999FDE457605} {FCE5EDB5-D536-4443-A48E-E88AF78EBE25} 5732
        8⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1480

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2404

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:3040

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4744

C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
"C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4912
- C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
  "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260427030456.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
    "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -burn.filehandle.attached=528 -burn.filehandle.self=548 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260427030456.log"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1776
  - - C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
      "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{2BF71A4C-34A0-4944-80AF-C30DB31232AD} {B307BC3E-A213-433C-BCAA-564C69908686} 1776
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5857c5.rbs

Path C:\Config.Msi\e5857c5.rbs
Size 16KB
SHA256 d1f28889e9d4eed2cc1f8e429f875410459b31e6b5c399e64fe9ecff80618612
MD5 a7071786a38bb71f9ed4c73f7212718d
SHA1 975bb2ccadd8b0b9ab6862155c91b75350e02a39
SHA512 a90fdb30f3810f9549f2e10523faec42d697e732781c4be22c05a4899020d5b10a3bb742f998791a77331fd6aaf6aab94e2aa0533fd51098a1fd43c2db8621e2
SSDEEP 96:neRp55RpSN9WT8RMeDd11xQo8R6eDd11Cjtknz0yWcW/Rp0Q2RpVdzRp9OXw3Tj8:nxRT1GRp1Hn4Xyin5f7U+nh18vTZxy
TLSH
T1A572FD42A94096C3E8662B70DD571B6037B7D7E5E344839B40EC92349F877D22F9E28E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5857ca.rbs

Path C:\Config.Msi\e5857ca.rbs
Size 18KB
SHA256 7035622e9db40c91033a7bcede4e29c88fb56454fd74e5a4e1813a46431faf6c
MD5 cd03253c4f1370c300d23b0597b833a9
SHA1 fd836d0dcd3d6124b4186ffe5cff2a04204c1a71
SHA512 b7fd484d62492909554307ebed9f6ae407468ca73edff126fa24e94254cd2ec42b2b1b4d61ce2f757a4d0384474375b5e1c04771aa3c3a49b410fc8e8c94e613
SSDEEP 192:n8Bm7YOfVqXmwtnNloo7SgHdmF0eNmJCbIvdJCbNowjn5Ev/bcP3pL:n89bn9ioJCKdJCzuc5
TLSH
T16A922C426A40D1D3D8A66B70CC472B263BF7D3EA93A4471F02DCC5348F977D62E8958A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5857d7.rbs

Path C:\Config.Msi\e5857d7.rbs
Size 20KB
SHA256 44d9bf7eb97536ab72cac1f6f64de402fca602ba8a2d088f52508c526ecf15b2
MD5 bead4babe8ee444f15e34f79256590d2
SHA1 bb56ea60752e57d0010d669ce1bc86b282b80fb0
SHA512 76cd9f71e9fbf26272299d0bf99470119b388b2c9c905e10eac7cc5de7bd268b5c7e26f3840b564822bad4c3124f947801f666aab0dc9b076a09350b6ec9424f
SSDEEP 384:kERvglRcgFfXMawmn28I1S9HXVZFb3QsgyO3CAPkENUD+Yepbft:k4vgcifXMawmn28IA9HXVZFbgsgymCAl
TLSH
T1A1A2FE03A644A9D3D8B62B70DD671BA47B72CBE59361034B40EC94384F933C63ED968E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5857e6.rbs

Path C:\Config.Msi\e5857e6.rbs
Size 19KB
SHA256 d61b436d3d99609b3a6fc33665f1db6fb53087d11a052749ea6d3b4bb298e679
MD5 a08ae8b8417cca0c2969422ca043fa7f
SHA1 2d807ed4775bdacc314596f2fd97b3796d098f32
SHA512 bc705aa81408e0a57f3e22c195d6ec6051dd6e2d6f89d243073c13930f444094303f4655766dbcef178c72168bd7d62a5cd630363a96f33fd899a1e5c1373847
SSDEEP 384:kUJqQk0Ve2SD4QsUh+FagLJlVJlTcMQFSUWF:kUoQk0Ve2SD4QsUh+o4BNcLFTe
TLSH
T1EB92ED42A940D692D8BBAB70CE971B347736C3E9D791531B40CCD1304E937C62F9EA8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\state.rsm
Size 914B
SHA256 74d8b860d1c83f3f8bd8475909411851ab97f21f923c5a936af422a91ece5999
MD5 ed3a865a6424343a3a4fc36e6c06cf6d
SHA1 674452bed71e9f215a81d0ed3498469e571cdf8e
SHA512 ec8e6b74a68af66676a751a10b6a4608edbc677b5ab2992f4c3a9b06c694cd586b59a696560b747581f6689f806eccfaab59e357d66617bbe98d4b44c4655059
TLSH
T1E3119661AFF65119F3FBBB7179F5161459BFB8110D31902D0181708A9F32B90DD24B66
MD5 SHA1 SHA512 TLSH

Submit Download

Roblox Account Manager.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Roblox Account Manager.exe.log
Size 1KB
SHA256 7fada0f81b63e1ecb265e9620ace8f5f0d40773626081849f5d98e668bc4e594
MD5 a02e8a8a790f0e0861e3b6b0dbe56062
SHA1 a3e65805e5c78641cafebc1052906d7350da9d2e
SHA512 108a81f818aa027834d621c771e427ee3f300c59d9dc10d853b94b1e8d635cf6bc06338dce31da30b08660c6fb06a39f9069c983bb585049f5fe9f50b753eb42
TLSH
T15E119B303322B5D88D023F530C596A8513FF4759B664EE2C7959225ED92A0176B322E3
MD5 SHA1 SHA512 TLSH

Submit Download

RAMTheme.ini

Path C:\Users\Admin\AppData\Local\Temp\RAMTheme.ini
Size 314B
SHA256 563eb35fd613f4298cd4dceff67652a13ba516a6244d9407c5709323c4ca4bb1
MD5 f18fa783f4d27e35e54e54417334bfb4
SHA1 94511cdf37213bebdaf42a6140c9fe5be8eb07ba
SHA512 602f6a68562bc89a4b3c3a71c2477377f161470bf8ae8e6925bf35691367115abfa9809925bd09c35596c6a3e5a7e9d090e5198e6a885a6658049c8732a05071
TLSH
T189E0C2EC6748160CEC30B7F63093643ABC46443B330338344A831131E080828B52E29F
MD5 SHA1 SHA512 TLSH

Submit Download

Roblox Account Manager.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe.config
Size 6KB
SHA256 d726d47b772a70fabc777c8ed46655fe5200e672f01f11dd95c5f4994e0a71e0
MD5 d5e4966de947333592289d70916257a9
SHA1 5907df0fd07df6c33926906e94f4ed08d40be017
SHA512 c618054766bee664f0605a037f065c196c35495ee993b305f0bece4738ec9f7bd632dc8fb541bcf9d156f12e115455f31dd8db2a8cceb9d7d2f0d05d501831e9
SSDEEP 96:Ura/VOP9NWtw/bPiR3GvUiKS4YpyMrsJ+J4YqJyM+:Uraq/2WbKS/pvrsJ+J/qJv+
TLSH
T142D16F11B5C8BFE00B7109A27E5FA818CB7D03A72D4D054E71EE6A8B8F7695A4347077
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_x86_20260427030456.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260427030456.log
Size 17KB
SHA256 779e85639064edefbfa0562101b3f6c723ecd93f2970d798569c245db933854b
MD5 da18f2c0d6b7a358b55f2fdcfca8fea9
SHA1 176fb08d1e2486b31e2e56be0e6df1ee34d846fa
SHA512 5d08e445eb19ad52258608bb87b9942b51c29f986f1dd389840be7ed1b7d9d99a9205f4e7cc15612e5aebd86a35649a3bfde2486eb382e9c9d722a90603b69c7
SSDEEP 192:rjOdDwns1i1Y1H1/1k1K1R1bPPQcFtV9MMbBWg537sE12BuYs6a9D6hP0CGn:POdUibBWKt6S6hPJGn
TLSH
T18282532165F9BDD039C8EBC6D55207F6A71A72243F8000F5F7B5C38CA624A25A7DE88D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_x86_20260427030456_000_vcRuntimeMinimum_x86.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260427030456_000_vcRuntimeMinimum_x86.log
Size 2KB
SHA256 b845c4b108c621b5efb935799f52cf7c48ff775687bdbb2eb53d045b46993784
MD5 c4f0fe2d3296119a7397e074e3eca891
SHA1 e07d0228f998e659ae4b376364a392e9ac20d888
SHA512 86e6013035a2742c4a79ae42e0858f0b76a657ab028eebac9757e8274db6c29bd139ebffcd4b75686fb695630600bad05c183914065f8e66da30abb4372dd9dd
TLSH
T1F74118181FE50806F2F256479EF3C1225A73FCC3A874DF0D2285431A427BD056958B7A
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_x86_20260427030456_001_vcRuntimeAdditional_x86.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260427030456_001_vcRuntimeAdditional_x86.log
Size 2KB
SHA256 f1e9436770e63903f03789ececff56eaf5f991ffd39d2fbd5c7801cd85bdaa74
MD5 5eef320971f514aea166e8286a7cd256
SHA1 2a67666f47a5d11bba94994add1f5f2393f83bd7
SHA512 52ef555154d32aa6e6a0c58c6ff4f3312cb1e4364eca25ac0891ea04e3affa1e9e9e66d3cadfcc3d6333d94ba186358fe3ded7a4be681ac3d4b000a9d0d3a669
TLSH
T10141F6651BE50805F2F39A47EEF3C0529A73FCC7A938DF0C2345421906ABD065958B6E
MD5 SHA1 SHA512 TLSH

Submit Download

log4.config

Path C:\Users\Admin\AppData\Local\Temp\log4.config
Size 936B
SHA256 e4b10630d9ec2af508de31752fbbc6816c7426c40a3e57f0a085ce7f42c77bd5
MD5 e4659ac08af3582a23f38bf6c562f841
SHA1 19cb4f014ba96285fa1798f008deabce632c7e76
SHA512 5bfa1e021cc7ee5e7a00da865d68684202b3b92d3d369b85b80c591fffa67725d434398325dc1e37c659eab62c0a4118b3e279ac0096b95790d252ceb6254249
TLSH
T179112B12DEECDD1242320D47A5620929DE7962E7052414CDB0DD639F2F3A95408A735E
MD5 SHA1 SHA512 TLSH

Submit Download

vcredist.tmp

Path C:\Users\Admin\AppData\Local\Temp\vcredist.tmp
Size 13.3MB
SHA256 0c09f2611660441084ce0df425c51c11e147e6447963c3690f97e0b25c55ed64
MD5 99f52708b06b9c695a8d64a44740bf08
SHA1 c2743ffc36d2af40ade0e370be52d6b202874114
SHA512 d0a609f6b2f05939ab82aa5fde1bb0595206653a2ab2ce859a750f71596c4491a8074bb825484e365a4fbcdb820d5de0346e7209ea22214b090b4fe853098dce
SSDEEP 196608:fLZBJflpQcIIS/Rj7BWl+aV8t8z72BxBwBgO4L6f6psSD5YM4565kIgoOgP2edk:lHlptVYmfr7yBG/4L6f6pXc65kngP1
TLSH
T1A8E63332E494413BFFB604336A65E9203E7DA628274149F6E3C8FD4D3A7219267F7612
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{536499DA-02C3-4FEF-837F-A11B86D49723}\.ba\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{536499DA-02C3-4FEF-837F-A11B86D49723}\.ba\wixstdba.dll
Size 215KB
SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
MD5 f68f43f809840328f4e993a54b0d5e62
SHA1 01da48ce6c81df4835b4c2eca7e1d447be893d39
SHA512 a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1
SSDEEP 6144:K6EZdi6e93SuDeTKZxQfsRy26BqbUHYJe:K62i6eNSYeuZ2sRDK
TLSH
T15E24AF12B5D0907AEBFB19305939E5216DBDBA210FA0C9CE5348AD2B2E705C1DB36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab54A5CABBE7274D8A22EB58060AAB7623

Path C:\Windows\Temp\{536499DA-02C3-4FEF-837F-A11B86D49723}\cab54A5CABBE7274D8A22EB58060AAB7623
Size 838KB
SHA256 c9935322c0af2fe00ebb018f8b0b908018576048fa4d3c0376a30ebf0eb2cf50
MD5 d8b6763546bb89d2d9cf3c45908b1e4b
SHA1 a1d28457d45a80bcf29618ebbdd9c50808acae5d
SHA512 194d06552d8a3b107851de79f7e9b17f4b143f62886abc71928c899e808c9d0a35417fb1813bfb918ced5f2058bfa58dfd34f837be0833d4b2ea9b143ba42081
SSDEEP 24576:P+EPvFdDKnDzR8ezJwqgq3anXt/WNsJsI96p+L2TI0X:PH9oXzdgUq+NAsXo2T3
TLSH
T1C70523DA72D3A60BED4C2DC008BDE5631D37BAFE9412D38A6174807A39CB7D456342AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cabB3E1576D1FEFBB979E13B1A5379E0B16

Path C:\Windows\Temp\{536499DA-02C3-4FEF-837F-A11B86D49723}\cabB3E1576D1FEFBB979E13B1A5379E0B16
Size 4.9MB
SHA256 01b11076177c8a5ee37eba745142cd6bbc4ac1ebfc4ebe48c85bd285a73ebf60
MD5 1d033900fb3774d9025fa656f175d39e
SHA1 9cbc362c97c37aa5236c49e7b974e4a62bbd9d21
SHA512 b96914b5e8c4951dc4f6b08b96e548c7328424a78d9b1394f1c2ab2ebf2f870b5c3e6f685c656cc1d6dccc396ece88ae6f23918cfa1c9ade22828972a0468f75
SSDEEP 98304:zExLOQyFMLkrdAyYPk9Lqy5dPFpDoNRAKHSEPFVzyJUkeOwnxRj8oFFZY:saQyKLksPk461fDo3PFVzyJ7eVnFo
TLSH
T172363318C4712B0ABC1E482455E3DE84FDC5B9DAAA863BD7F264B74C29437957B30C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcRuntimeAdditional_x86

Path C:\Windows\Temp\{536499DA-02C3-4FEF-837F-A11B86D49723}\vcRuntimeAdditional_x86
Size 200KB
SHA256 3e4a528fe5263a5dc44455d0ab2717f0c02acdc120c918cf43730ce9f36ccbb5
MD5 e4c2fa6814ad5061be3d081e5102eb1d
SHA1 89bee5a8cbd82937bd2222cc6e97b3648e8e491f
SHA512 5ebe95053ed100758711fa2a5d4bc12f3c976b8b2a27b8a88d6d10f666b6c5170698939b03c30ccb06acebd5d703d90045eb236cc4cfe55d1c92c31e8de87575
SSDEEP 3072:x9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriThXC:DlaZeKFxCnBheIdluA
TLSH
T17014AE12B5808033DAFE1A351178DB615F3DBE608F54499B2364B6AD1E717C08F3AAB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcRuntimeMinimum_x86

Path C:\Windows\Temp\{536499DA-02C3-4FEF-837F-A11B86D49723}\vcRuntimeMinimum_x86
Size 200KB
SHA256 c5ff4d6cd4be9f4965f93af273dd364948fbe44d40b123f34f82bcbcf64c8df4
MD5 cce22015775c209fbab4050261fba590
SHA1 27998ee42531b9d41f3d71c9dc2ead8d95ed8863
SHA512 61886caec75d195d43fafcaa8d1a8b50c4fb65c39103f62d54a704d713035cc2717c04b1c1cd4794d218364b05c27bf62b13d3aef66e5665f148961ac009b45d
SSDEEP 3072:0I9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriTg3:ZlaZeKFxCnBheIdlu
TLSH
T1F414AF12B5808032DAFE19351178DB715F3D7E608F5489AB2364B6AD1E717C08F3AAB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist.tmp

Path C:\Windows\Temp\{A89588FA-86D1-497C-A804-3775EF91B027}\.cr\vcredist.tmp
Size 669KB
SHA256 4a6e1044ff0f49d2e3b12f7c40352c7e573e0c58f3b3cc0b55b63c95ede87828
MD5 f216f5ee89b18a28a3936fab57c16179
SHA1 3d2995962598774a8e2dc1d038c76495466f3a72
SHA512 9350de18d452927efef3be3dd4c49361ec6b29f22e969781374508b167b4e697dcea05ee6b43b47b850d4edd0591b960628ee9cbc59deee62937a40a8e5a6573
SSDEEP 12288:n3mgqnIZuYfCYqFet4CovkM7y+1nEn0/6OaFUuT80iP:n3WnIZuMCxezot7Dh+0/9ayn0i
TLSH
T18CE49D32A5614033FBF10573B928A6303E7CE7282751C8A9D7D4AD1D7EA58C2A7F7216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{EE1D8691-5CEE-4D87-BCEC-8E1A30FB33B1}\.ba\license.rtf
Size 9KB
SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
MD5 04b33f0a9081c10e85d0e495a1294f83
SHA1 1efe2fb2d014a731b752672745f9ffecdd716412
SHA512 d1dbed00df921169dd61501e2a3e95e6d7807348b188be9dd8fc63423501e4d848ece19ac466c3cacfccc6084e0eb2f457dc957990f6f511df10fd426e432685
SSDEEP 192:H8kZ1UVDWkiWZTIsp/4hghFF1Qf4lCfnEtHixEGx736wHqItfSpOtJ32:cM1RWZMi/zzlOnjt5HLoa2
TLSH
T13F12A7A8234783D103D213D7055294C1B71F0BF6AE7AF95C34E4D53826E2E6CB6B91E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{EE1D8691-5CEE-4D87-BCEC-8E1A30FB33B1}\.ba\thm.wxl
Size 2KB
SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
MD5 fbfcbc4dacc566a3c426f43ce10907b6
SHA1 63c45f9a771161740e100faf710f30eed017d723
SHA512 063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e
TLSH
T11F519B6778CF639028335125EAD2966A6920C5DC923F2DF1FC4A914B838D522A373F57
MD5 SHA1 SHA512 TLSH

Submit Download

thm.xml

Path C:\Windows\Temp\{EE1D8691-5CEE-4D87-BCEC-8E1A30FB33B1}\.ba\thm.xml
Size 8KB
SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
MD5 f62729c6d2540015e072514226c121c7
SHA1 c1e189d693f41ac2eafcc363f7890fc0fea6979c
SHA512 cbbfbfa7e013a2b85b78d71d32fdf65323534816978e7544ca6cea5286a0f6e8e7e5ffc4c538200211f11b94373d5658732d5d8aa1d01f9ccfdbf20f154f1471
SSDEEP 96:8L2HdQG+3VzHfz96zYFGaPSWXdhRAmImlqFQKFBiUxn7Ke5A82rkO/pWk3nswP:ZHAzZ/3
TLSH
T1D30259B546DDB801D232FB1166E231D27F126971C0C46E59F90C2AFB5FE1140A8B72BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{EE1D8691-5CEE-4D87-BCEC-8E1A30FB33B1}\.ba\wixstdba.dll
Size 191KB
SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
MD5 eab9caf4277829abdf6223ec1efa0edd
SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
SSDEEP 3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53EfcUzN0m6I+WxBlnKzeZuqt:OXoQNb++gDrSJdr8BHkPh3wIgnK/IU1a
TLSH
T103149E11B5D0907AE7FB1A385938B5216D7FBA201B60C99E17589D6F2DF02C0AF35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/220-480-0x0000000000B20000-0x0000000000B9B000-memory.dmp

Download

memory/1480-451-0x0000000000460000-0x00000000004D7000-memory.dmp

Download

memory/1480-452-0x0000000000FF0000-0x000000000106B000-memory.dmp

Download

memory/1572-102-0x0000000000730000-0x00000000007AB000-memory.dmp

Download

memory/1572-462-0x0000000000730000-0x00000000007AB000-memory.dmp

Download

memory/1696-461-0x0000000000D40000-0x0000000000DBB000-memory.dmp

Download

memory/1696-103-0x0000000000D40000-0x0000000000DBB000-memory.dmp

Download

memory/1776-484-0x00000000014E0000-0x000000000155B000-memory.dmp

Download

memory/2104-459-0x0000000001670000-0x00000000016EB000-memory.dmp

Download

memory/2104-121-0x0000000001670000-0x00000000016EB000-memory.dmp

Download

memory/4612-485-0x0000000000EE0000-0x0000000000F5B000-memory.dmp

Download

memory/4744-486-0x000002AC03E50000-0x000002AC03E5C000-memory.dmp

Download

memory/4912-303-0x00000000007C0000-0x000000000083B000-memory.dmp

Download

memory/5376-0-0x0000000000280000-0x00000000007FA000-memory.dmp

Download

memory/5376-14-0x00000000012D0000-0x000000000134B000-memory.dmp

Download

memory/5376-13-0x00000000010B0000-0x000000000118C000-memory.dmp

Download

memory/5376-6-0x00000000053A0000-0x00000000053BE000-memory.dmp

Download

memory/5376-5-0x0000000005360000-0x0000000005386000-memory.dmp

Download

memory/5376-4-0x0000000005450000-0x00000000054E2000-memory.dmp

Download

memory/5376-3-0x0000000005300000-0x0000000005346000-memory.dmp

Download

memory/5376-2-0x0000000005440000-0x0000000005450000-memory.dmp

Download

memory/5376-1-0x0000000005A00000-0x0000000005FA4000-memory.dmp

Download

memory/5732-455-0x0000000001430000-0x00000000014AB000-memory.dmp

Download

memory/5732-454-0x0000000000460000-0x00000000004D7000-memory.dmp

Download

memory/6000-24-0x000000000C7B0000-0x000000000C850000-memory.dmp

Download

memory/6000-22-0x0000000005DF0000-0x0000000005E00000-memory.dmp

Download

memory/6000-280-0x000000000D390000-0x000000000D6E4000-memory.dmp

Download

memory/6000-279-0x0000000003510000-0x0000000003518000-memory.dmp

Download

memory/6000-278-0x0000000006090000-0x00000000060E0000-memory.dmp

Download

memory/6000-122-0x0000000005DF0000-0x0000000005E00000-memory.dmp

Download

memory/6000-106-0x0000000008100000-0x000000000810A000-memory.dmp

Download

memory/6000-107-0x000000000D370000-0x000000000D382000-memory.dmp

Download

memory/6000-104-0x0000000005DF0000-0x0000000005E00000-memory.dmp

Download

memory/6000-99-0x0000000001BE0000-0x0000000001C5B000-memory.dmp

Download

memory/6000-100-0x00000000035E0000-0x0000000003669000-memory.dmp

Download

memory/6000-101-0x0000000005C30000-0x0000000005C3A000-memory.dmp

Download

memory/6000-33-0x000000000E610000-0x000000000E632000-memory.dmp

Download

memory/6000-35-0x000000000E710000-0x000000000E72A000-memory.dmp

Download

memory/6000-531-0x00000000035E0000-0x0000000003669000-memory.dmp

Download

memory/6000-489-0x00000000035E0000-0x0000000003669000-memory.dmp

Download

memory/6000-36-0x000000000E730000-0x000000000E738000-memory.dmp

Download

memory/6000-34-0x000000000E640000-0x000000000E716000-memory.dmp

Download

memory/6000-32-0x000000000E410000-0x000000000E4C2000-memory.dmp

Download

memory/6000-30-0x000000000D070000-0x000000000D0C8000-memory.dmp

Download

memory/6000-25-0x000000000C850000-0x000000000C85A000-memory.dmp

Download

memory/6000-23-0x000000000BF90000-0x000000000BFC4000-memory.dmp

Download

memory/6000-296-0x00000000035E0000-0x0000000003669000-memory.dmp

Download

memory/6000-21-0x0000000005DF0000-0x0000000005E00000-memory.dmp

Download

memory/6000-19-0x0000000006CD0000-0x0000000006CDA000-memory.dmp

Download

memory/6000-482-0x00000000035E0000-0x0000000003669000-memory.dmp

Download

memory/6000-18-0x0000000006C60000-0x0000000006CD4000-memory.dmp

Download

memory/6000-15-0x0000000005DF0000-0x0000000005E00000-memory.dmp

Download

memory/6136-456-0x0000000000460000-0x00000000004D7000-memory.dmp

Download

memory/6136-457-0x0000000000980000-0x00000000009FB000-memory.dmp

Download