5c7d96455bbb045cb3cb3726d7b4fff2d0810a21d7fdb34ad134696aa7f47d5e

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/04/2026, 02:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Roblox Account Manager.exe
Size 5.5MB
Sample260427-chldmady2k
SHA256 5c7d96455bbb045cb3cb3726d7b4fff2d0810a21d7fdb34ad134696aa7f47d5e
MD5 eb54116db322c49ec2faca86f725931e
SHA1 c703685ac6221d7de624039d7351886b21ca53fc
SHA512 ef6ea52df848bf8c7c77831ee5ca64cf337a92edbb0e8d0d38844e204157545aa3c397eeea12d05f276ce4984f519a1a05cf21bc04514fbb35beebf86d7f8e78
SSDEEP 98304:8H6+2bT1Qm7d9G3s2tIfKLUXk8zdywnr5a0kqXf0Fb7WnZhP+MQuPN5Ppauz+l:5Qm59siyLU0lY9a0kSIb7aZhP+MQuPNw
TLSH
T11746E02A72A04335E5AB453405A9C1B496FE7E396A68E19EE7C0BD4F3EF57D09830313
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery persistence ransomware spyware

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
1660	vcredist.tmp
2896	vcredist.tmp
3884	VC_redist.x86.exe
5072	VC_redist.x86.exe
4920	VC_redist.x86.exe
4908	VC_redist.x86.exe
700	VC_redist.x86.exe

Loads dropped DLL 3 IoCs

pid	Process
2896	vcredist.tmp
5096	VC_redist.x86.exe
4908	VC_redist.x86.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{0b5169e3-39da-4313-808e-1f9c0407f3bf} = "\"C:\\ProgramData\\Package Cache\\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\\VC_redist.x86.exe\" /burn.runonce"	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{0b5169e3-39da-4313-808e-1f9c0407f3bf} = "\"C:\\ProgramData\\Package Cache\\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\\VC_redist.x86.exe\" /burn.runonce"	VC_redist.x86.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
11	1664	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
10	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe

Drops file in System32 directory 49 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mfc140fra.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140kor.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140kor.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcomp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140esn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcamp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140cht.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcamp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140rus.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140chs.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140deu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140cht.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140enu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfcm140u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcruntime140_threads.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140chs.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140esn.dll	msiexec.exe

Drops file in Windows directory 23 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI93D0.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3455F1ABF3FB3FBF.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI970D.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2EE7CE729983A851.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8F2A1657BFCCE2BA.TMP	msiexec.exe
File created	C:\Windows\Installer\e588fb9.msi	msiexec.exe
File created	C:\Windows\Installer\e588fcf.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF72CA35416116AFD1.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF10BD9487F74E06E0.TMP	msiexec.exe
File created	C:\Windows\Installer\e588fba.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e588fba.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e588fa8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI92A6.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{922480B5-CAEB-4B1B-AAA4-9716EFDCE26B}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF17B70589DB3298BC.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF903AB1375F33F872.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C18FB403-1E88-43C8-AD8A-CED50F23DE8B}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF81C33D301D7BD07C.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI98A4.tmp	msiexec.exe
File created	C:\Windows\Installer\e588fa8.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Roblox Account Manager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Roblox Account Manager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000005f9272311ec871480000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800005f9272310000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809005f927231000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a5f927231000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d5f927231000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Internet Explorer\TypedURLs	Roblox Account Manager.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\DisplayName = "Microsoft Visual C++ 2022 X86 Additional Runtime - 14.44.35211"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\PackageCode = "73B56A9D9529BEC48BFF28F2B2D368B6"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{C18FB403-1E88-43C8-AD8A-CED50F23DE8B}v14.44.35211\\packages\\vcRuntimeAdditional_x86\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_X86,V14\DEPENDENTS\{4D8DCF8C-A72A-43E1-9833-C12724DB736E}	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\SourceList\PackageName = "vc_runtimeMinimum_x86.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\VC,redist.x86,x86,14.44,bundle	VC_redist.x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\AdvertiseFlags = "388"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E8B87C56C0E773581D82F286F95E50	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.44,bundle\Version = "14.44.35211.0"	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\60DB5E5629367203C8625813703DFCA1\5B084229BEACB1B4AA4A7961FECD2EB6	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\Dependents\{0b5169e3-39da-4313-808e-1f9c0407f3bf}	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\304BF81C88E18C34DAA8EC5DF032EDB8\Servicing_Key	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\Version = "237799819"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E8B87C56C0E773581D82F286F95E50	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\Version = "14.44.35211"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{922480B5-CAEB-4B1B-AAA4-9716EFDCE26B}v14.44.35211\\packages\\vcRuntimeMinimum_x86\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.30,bundle	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\304BF81C88E18C34DAA8EC5DF032EDB8\Provider	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\Version = "14.44.35211"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B084229BEACB1B4AA4A7961FECD2EB6\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\304BF81C88E18C34DAA8EC5DF032EDB8	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\60DB5E5629367203C8625813703DFCA1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\SourceList\Media\1 = ";"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\VC,REDIST.X86,X86,14.30,BUNDLE\DEPENDENTS\{4D8DCF8C-A72A-43E1-9833-C12724DB736E}	VC_redist.x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B084229BEACB1B4AA4A7961FECD2EB6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B084229BEACB1B4AA4A7961FECD2EB6\VC_Runtime_Minimum	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.44,bundle\ = "{0b5169e3-39da-4313-808e-1f9c0407f3bf}"	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{C18FB403-1E88-43C8-AD8A-CED50F23DE8B}v14.44.35211\\packages\\vcRuntimeAdditional_x86\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\Dependents\{0b5169e3-39da-4313-808e-1f9c0407f3bf}	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\304BF81C88E18C34DAA8EC5DF032EDB8\VC_Runtime_Additional	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\ProductName = "Microsoft Visual C++ 2022 X86 Additional Runtime - 14.44.35211"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E8B87C56C0E773581D82F286F95E50\304BF81C88E18C34DAA8EC5DF032EDB8	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.30,bundle\Dependents	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\Dependents\{0b5169e3-39da-4313-808e-1f9c0407f3bf}	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\Dependents\{0b5169e3-39da-4313-808e-1f9c0407f3bf}	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{922480B5-CAEB-4B1B-AAA4-9716EFDCE26B}v14.44.35211\\packages\\vcRuntimeMinimum_x86\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_X86,V14\DEPENDENTS\{4D8DCF8C-A72A-43E1-9833-C12724DB736E}	VC_redist.x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\InstanceType = "0"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA	msiexec.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1664	msiexec.exe
1664	msiexec.exe
1664	msiexec.exe
1664	msiexec.exe
1664	msiexec.exe
1664	msiexec.exe
1664	msiexec.exe
1664	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
796	Roblox Account Manager.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	796	Roblox Account Manager.exe
Token: SeBackupPrivilege	3684	vssvc.exe
Token: SeRestorePrivilege	3684	vssvc.exe
Token: SeAuditPrivilege	3684	vssvc.exe
Token: SeShutdownPrivilege	3884	VC_redist.x86.exe
Token: SeIncreaseQuotaPrivilege	3884	VC_redist.x86.exe
Token: SeSecurityPrivilege	1664	msiexec.exe
Token: SeCreateTokenPrivilege	3884	VC_redist.x86.exe
Token: SeAssignPrimaryTokenPrivilege	3884	VC_redist.x86.exe
Token: SeLockMemoryPrivilege	3884	VC_redist.x86.exe
Token: SeIncreaseQuotaPrivilege	3884	VC_redist.x86.exe
Token: SeMachineAccountPrivilege	3884	VC_redist.x86.exe
Token: SeTcbPrivilege	3884	VC_redist.x86.exe
Token: SeSecurityPrivilege	3884	VC_redist.x86.exe
Token: SeTakeOwnershipPrivilege	3884	VC_redist.x86.exe
Token: SeLoadDriverPrivilege	3884	VC_redist.x86.exe
Token: SeSystemProfilePrivilege	3884	VC_redist.x86.exe
Token: SeSystemtimePrivilege	3884	VC_redist.x86.exe
Token: SeProfSingleProcessPrivilege	3884	VC_redist.x86.exe
Token: SeIncBasePriorityPrivilege	3884	VC_redist.x86.exe
Token: SeCreatePagefilePrivilege	3884	VC_redist.x86.exe
Token: SeCreatePermanentPrivilege	3884	VC_redist.x86.exe
Token: SeBackupPrivilege	3884	VC_redist.x86.exe
Token: SeRestorePrivilege	3884	VC_redist.x86.exe
Token: SeShutdownPrivilege	3884	VC_redist.x86.exe
Token: SeDebugPrivilege	3884	VC_redist.x86.exe
Token: SeAuditPrivilege	3884	VC_redist.x86.exe
Token: SeSystemEnvironmentPrivilege	3884	VC_redist.x86.exe
Token: SeChangeNotifyPrivilege	3884	VC_redist.x86.exe
Token: SeRemoteShutdownPrivilege	3884	VC_redist.x86.exe
Token: SeUndockPrivilege	3884	VC_redist.x86.exe
Token: SeSyncAgentPrivilege	3884	VC_redist.x86.exe
Token: SeEnableDelegationPrivilege	3884	VC_redist.x86.exe
Token: SeManageVolumePrivilege	3884	VC_redist.x86.exe
Token: SeImpersonatePrivilege	3884	VC_redist.x86.exe
Token: SeCreateGlobalPrivilege	3884	VC_redist.x86.exe
Token: SeRestorePrivilege	1664	msiexec.exe
Token: SeTakeOwnershipPrivilege	1664	msiexec.exe
Token: SeBackupPrivilege	3332	srtasks.exe
Token: SeRestorePrivilege	3332	srtasks.exe
Token: SeSecurityPrivilege	3332	srtasks.exe
Token: SeTakeOwnershipPrivilege	3332	srtasks.exe
Token: SeRestorePrivilege	1664	msiexec.exe
Token: SeTakeOwnershipPrivilege	1664	msiexec.exe
Token: SeRestorePrivilege	1664	msiexec.exe
Token: SeTakeOwnershipPrivilege	1664	msiexec.exe
Token: SeRestorePrivilege	1664	msiexec.exe
Token: SeTakeOwnershipPrivilege	1664	msiexec.exe
Token: SeRestorePrivilege	1664	msiexec.exe
Token: SeTakeOwnershipPrivilege	1664	msiexec.exe
Token: SeRestorePrivilege	1664	msiexec.exe
Token: SeTakeOwnershipPrivilege	1664	msiexec.exe
Token: SeRestorePrivilege	1664	msiexec.exe
Token: SeTakeOwnershipPrivilege	1664	msiexec.exe
Token: SeRestorePrivilege	1664	msiexec.exe
Token: SeTakeOwnershipPrivilege	1664	msiexec.exe
Token: SeRestorePrivilege	1664	msiexec.exe
Token: SeTakeOwnershipPrivilege	1664	msiexec.exe
Token: SeRestorePrivilege	1664	msiexec.exe
Token: SeTakeOwnershipPrivilege	1664	msiexec.exe
Token: SeRestorePrivilege	1664	msiexec.exe
Token: SeTakeOwnershipPrivilege	1664	msiexec.exe
Token: SeRestorePrivilege	1664	msiexec.exe
Token: SeTakeOwnershipPrivilege	1664	msiexec.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 796	1544	Roblox Account Manager.exe	80
PID 796 wrote to memory of 1660	796	Roblox Account Manager.exe	81
PID 1660 wrote to memory of 2896	1660	vcredist.tmp	82
PID 2896 wrote to memory of 3884	2896	vcredist.tmp	83
PID 5072 wrote to memory of 4920	5072	VC_redist.x86.exe	93
PID 4920 wrote to memory of 4908	4920	VC_redist.x86.exe	94
PID 3884 wrote to memory of 1780	3884	VC_redist.x86.exe	95
PID 1780 wrote to memory of 5096	1780	VC_redist.x86.exe	96
PID 5096 wrote to memory of 760	5096	VC_redist.x86.exe	97
PID 4908 wrote to memory of 700	4908	VC_redist.x86.exe	98

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe
"C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe
  "C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe" -restart
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:796
- - C:\Users\Admin\AppData\Local\Temp\vcredist.tmp
    "C:\Users\Admin\AppData\Local\Temp\vcredist.tmp" /q /norestart
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1660
  - - C:\Windows\Temp\{1FFD4F6A-664A-4A0D-BD12-172E14712CE3}\.cr\vcredist.tmp
      "C:\Windows\Temp\{1FFD4F6A-664A-4A0D-BD12-172E14712CE3}\.cr\vcredist.tmp" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\vcredist.tmp" -burn.filehandle.attached=728 -burn.filehandle.self=732 /q /norestart
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2896
    - - C:\Windows\Temp\{CF3CA679-96DA-44E8-B117-7BACDE453F1D}\.be\VC_redist.x86.exe
        
        "C:\Windows\Temp\{CF3CA679-96DA-44E8-B117-7BACDE453F1D}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{3C3017DC-2040-46A3-9785-8D31216E6751} {62C08C9E-2C53-4E17-BD39-CD43FC1B0790} 2896
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3884
      - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={0b5169e3-39da-4313-808e-1f9c0407f3bf} -burn.filehandle.self=1072 -burn.embedded BurnPipe.{25738E2C-1FA7-499F-B469-0BD74212E04D} {1B985D32-8902-4B19-89EE-4E6F7BE680CC} 3884
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1780
        
        C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=548 -burn.filehandle.self=564 -uninstall -quiet -burn.related.upgrade -burn.ancestors={0b5169e3-39da-4313-808e-1f9c0407f3bf} -burn.filehandle.self=1072 -burn.embedded BurnPipe.{25738E2C-1FA7-499F-B469-0BD74212E04D} {1B985D32-8902-4B19-89EE-4E6F7BE680CC} 3884
        7⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5096
        
        C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{859E2623-846D-49D3-9E5B-BC19647162E2} {21E697C7-E7BF-4512-9333-C091847EC630} 5096
        8⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:760

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3684

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3332

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1664

C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
"C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5072
- C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
  "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260427030458.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
    "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -burn.filehandle.attached=548 -burn.filehandle.self=564 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260427030458.log"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4908
  - - C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
      "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{65FFF431-5B91-477A-94FC-F10568DD4C3A} {D556BA6D-DD5D-406A-BD72-27953ACC0428} 4908
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e588fad.rbs

Path C:\Config.Msi\e588fad.rbs
Size 16KB
SHA256 d55242a2399035fe6d5986a48d98296b5408690fb960e3b2eceb3781f1c12c89
MD5 b8d660fe5ce11a231bad6cddd200dbd4
SHA1 80d3e91fa1abd7345e612591a09e9de97d7f9208
SHA512 3aeb38f5751186f2c2b50c29bfbb329bc6ec6977ec78bfa68527a83576c644f959e4e733fad4500d08ffee669b56c2cebae14d6b81bca288d16ae371f4e3acb5
SSDEEP 96:1eRp55Rp/NmWT8R9eDd11xQo8R6eDd11Cjtknz0yWcW/Rp0Q2RpVdzRp9OXw3TjG:1FRg1GRp1Hn4Xyin5f7e+nh18XTty
TLSH
T113720E42A94096C3E8662B70DD571B7037B7D7E5A344839B40DC92349F87BD22F9D28E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e588fb2.rbs

Path C:\Config.Msi\e588fb2.rbs
Size 18KB
SHA256 ed3982c159eb43d99c9c616003a3eb596f2fe04d507c1b7e1071de0764fcf46f
MD5 a85cdb77bcf1f64aa5658acdee88d5f4
SHA1 419c2101919a083f1f125b55379580b4c2cf7c03
SHA512 edd719738280a1aa382a3aac685af511f1d3438e4d2401ca6137571dc04ed1567e53f8668ac466a81663ab075f544276c451e1e6b4fc65fee4ca726ac6056f7b
SSDEEP 192:18Cm7YOfVqXmwtnNloyPvdmF1CYmJCbIvdJCbNwwjn5Ev/bcP3pL:18YbPViqJCKdJCzuc5
TLSH
T1F2922D826A40D1D3D8A66B70CC472B253BF7D3EA93A4471F02DCC5348F977D62E8958A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e588fbf.rbs

Path C:\Config.Msi\e588fbf.rbs
Size 20KB
SHA256 0779fb94c264e4f229ea6aff0ae9e4686f543e4534b6f5860ddd9ce8244138c9
MD5 3df4eed5089b609eb867e475c429c60b
SHA1 d615b804340abe118a6966633f86a3415ff416f1
SHA512 8850317eab7ead1e1c0bd935bf1f5be03938941a17935a4f9a7d05394014ccd17c86b62bdc03b6d355b95e0adbc6ea5066384c11aa671d90368d813602a7a61f
SSDEEP 384:ycRmglRcgFfXMawmn28I1S9HXVZFbLQPOqsO3SQPUAhQJ03Vft:ygmgcifXMawmn28IA9HXVZFbkPOqsOSo
TLSH
T118A2FE03A64499D3D8B62B70DD671BA57B32CBE99361434B40DC95384F933C23ED968E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e588fce.rbs

Path C:\Config.Msi\e588fce.rbs
Size 19KB
SHA256 46f560b792def0b139c4cfab350a352da60de3e8d059aed7f468b1419060938c
MD5 9c1589e491fe78b83a641f730009ff76
SHA1 73efa4379b198bc0ad5137f1675f55fb8dfdb0fb
SHA512 6e609c9f7ca912c681ccf05ed16ec92004d88937c42e9093454db3ff755b5422f2c56b3aa5412a84ee1d81d391a20b522b71ed7eb24fd66560c1102320cc9f23
SSDEEP 384:y/Jq2k0Ve2SD4QsUh+9agGJlVJlTccQFSUWF:y/o2k0Ve2SD4QsUh+QvBNcbFTe
TLSH
T16392ED42A940DA92D4BBAB70CE971B357736C3E9D791531B40CCD1304E937C62F9EA8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\state.rsm
Size 914B
SHA256 74d8b860d1c83f3f8bd8475909411851ab97f21f923c5a936af422a91ece5999
MD5 ed3a865a6424343a3a4fc36e6c06cf6d
SHA1 674452bed71e9f215a81d0ed3498469e571cdf8e
SHA512 ec8e6b74a68af66676a751a10b6a4608edbc677b5ab2992f4c3a9b06c694cd586b59a696560b747581f6689f806eccfaab59e357d66617bbe98d4b44c4655059
TLSH
T1E3119661AFF65119F3FBBB7179F5161459BFB8110D31902D0181708A9F32B90DD24B66
MD5 SHA1 SHA512 TLSH

Submit Download

Roblox Account Manager.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Roblox Account Manager.exe.log
Size 1KB
SHA256 180f825c19263ae06fc891efcde51f993b720a27bd6e563742a110b40cb3fe41
MD5 72c442c0ee7dde7b3455bb315289bcf2
SHA1 d33367411ce01348f531e098495885b9d2ea110b
SHA512 b66e975424f17e3b4dce2d2746d78b8a05001ee17a7208c1f5f81ed8530aa2e3d4b10f4c64b33ba7c05a5e9e2afc548abf6bdfaffd6015c2cb7d624a688dc018
TLSH
T1421138702231B5D84D522F5308596A8516FF0745BAA8EE2C7599325EDD2A0076F222E3
MD5 SHA1 SHA512 TLSH

Submit Download

RAMSettings.ini

Path C:\Users\Admin\AppData\Local\Temp\RAMSettings.ini
Size 1014B
SHA256 787fa9af1c32b7e198119469c0e2c02c06b34ec7c990b62b9f4fb9bc8cedaa5f
MD5 1d917eaf5dcc8e06dd032c33f3a3d36a
SHA1 1eacb4eced22393fd5140910d30070f2e054e2fe
SHA512 3cf5bc6160262ad454477cc0fab401696a7e5dff9e6fae1cdcfa0579ded640ea8c383dfcea6194f55c914927058e2355fd661d1fa83f87c10aeffa6a91cb9fcd
TLSH
T1AD112581290970FD2861D2B43D53E6A37764E900228F8571F4E0156B37DAC127BA447F
MD5 SHA1 SHA512 TLSH

Submit Download

RAMTheme.ini

Path C:\Users\Admin\AppData\Local\Temp\RAMTheme.ini
Size 314B
SHA256 563eb35fd613f4298cd4dceff67652a13ba516a6244d9407c5709323c4ca4bb1
MD5 f18fa783f4d27e35e54e54417334bfb4
SHA1 94511cdf37213bebdaf42a6140c9fe5be8eb07ba
SHA512 602f6a68562bc89a4b3c3a71c2477377f161470bf8ae8e6925bf35691367115abfa9809925bd09c35596c6a3e5a7e9d090e5198e6a885a6658049c8732a05071
TLSH
T189E0C2EC6748160CEC30B7F63093643ABC46443B330338344A831131E080828B52E29F
MD5 SHA1 SHA512 TLSH

Submit Download

Roblox Account Manager.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe.config
Size 6KB
SHA256 d726d47b772a70fabc777c8ed46655fe5200e672f01f11dd95c5f4994e0a71e0
MD5 d5e4966de947333592289d70916257a9
SHA1 5907df0fd07df6c33926906e94f4ed08d40be017
SHA512 c618054766bee664f0605a037f065c196c35495ee993b305f0bece4738ec9f7bd632dc8fb541bcf9d156f12e115455f31dd8db2a8cceb9d7d2f0d05d501831e9
SSDEEP 96:Ura/VOP9NWtw/bPiR3GvUiKS4YpyMrsJ+J4YqJyM+:Uraq/2WbKS/pvrsJ+J/qJv+
TLSH
T142D16F11B5C8BFE00B7109A27E5FA818CB7D03A72D4D054E71EE6A8B8F7695A4347077
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_x86_20260427030458.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260427030458.log
Size 17KB
SHA256 8c9b6462c95c9eb01e303c4ed7da09785a65178387fae07a57e06d697de61238
MD5 5abcbf81f6a813d7800dcf3122e380da
SHA1 c906d9152c4cecbece96b9e15fe3618729c9d49f
SHA512 1d76b39f21a10c9f0a30c1fa0b951b19cdcffd463c6a09e408807f3435ccf2de709da081534aa6ad0735826c8becf6e2cd93477fda03bbe11428eb7651fc1c96
SSDEEP 192:wdlRdC9nU1J131c1Q1/19161RKCh52FCK2CyyoTOYIVUjfT3FU:WlRd6bKChFSbVUjr3FU
TLSH
T1538243026AFAED952891DBE6F67A9BE69F557238374010BCF774834C0414929E7CF9C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_x86_20260427030458_000_vcRuntimeMinimum_x86.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260427030458_000_vcRuntimeMinimum_x86.log
Size 4KB
SHA256 6b3b5bd88cba12462941284197a1f1041656802b00d654f16d6fa8ea39a7a5bf
MD5 e63856b2cc2ad4b34f412e3b88e2e246
SHA1 2097486bece5ca153f6819db2bc2f2643054e794
SHA512 74f5eccf3b0039b4b3b3a8bd9da8392bc5e1cea0bea8ebf0d47ab47bffd76c14b80c242d5c9120fae4717121e26a329be95e56a3233bf927e22fa9517c48be34
SSDEEP 96:YsT+OC95qOdRfOi5SG/Cvt5rCRgu+KFMF1:xTDOdm2iXMJ+KFu1
TLSH
T1E681E9252AD90C09F2F35A479DF7C0135A73FDD399749B1C2385931A426BC0A986CB7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_x86_20260427030458_001_vcRuntimeAdditional_x86.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260427030458_001_vcRuntimeAdditional_x86.log
Size 2KB
SHA256 9cab0497a2dbad20222632eb3ca47f0078ea2e0adfa2dcb79f16217b9e8f27d3
MD5 706a5e0724da3d9db9ae9b27697128ef
SHA1 84eadf0e7ee46ec55936f4739a90a9250d7cef3f
SHA512 4d66ce52f5d08c2716816be552e16b25c534af5602eb05b760f4298b6c51ed7ae1b535a2eb256f7dc06927bd0d449a9a9f8eaf756651d7920c2a15fe1b5fdb53
TLSH
T13941066A1BF80804F2F2DA879EF3C0135A33FCD669759B0C23C45319066BD0169697BB
MD5 SHA1 SHA512 TLSH

Submit Download

log4.config

Path C:\Users\Admin\AppData\Local\Temp\log4.config
Size 936B
SHA256 e4b10630d9ec2af508de31752fbbc6816c7426c40a3e57f0a085ce7f42c77bd5
MD5 e4659ac08af3582a23f38bf6c562f841
SHA1 19cb4f014ba96285fa1798f008deabce632c7e76
SHA512 5bfa1e021cc7ee5e7a00da865d68684202b3b92d3d369b85b80c591fffa67725d434398325dc1e37c659eab62c0a4118b3e279ac0096b95790d252ceb6254249
TLSH
T179112B12DEECDD1242320D47A5620929DE7962E7052414CDB0DD639F2F3A95408A735E
MD5 SHA1 SHA512 TLSH

Submit Download

vcredist.tmp

Path C:\Users\Admin\AppData\Local\Temp\vcredist.tmp
Size 13.3MB
SHA256 0c09f2611660441084ce0df425c51c11e147e6447963c3690f97e0b25c55ed64
MD5 99f52708b06b9c695a8d64a44740bf08
SHA1 c2743ffc36d2af40ade0e370be52d6b202874114
SHA512 d0a609f6b2f05939ab82aa5fde1bb0595206653a2ab2ce859a750f71596c4491a8074bb825484e365a4fbcdb820d5de0346e7209ea22214b090b4fe853098dce
SSDEEP 196608:fLZBJflpQcIIS/Rj7BWl+aV8t8z72BxBwBgO4L6f6psSD5YM4565kIgoOgP2edk:lHlptVYmfr7yBG/4L6f6pXc65kngP1
TLSH
T1A8E63332E494413BFFB604336A65E9203E7DA628274149F6E3C8FD4D3A7219267F7612
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist.tmp

Path C:\Windows\Temp\{1FFD4F6A-664A-4A0D-BD12-172E14712CE3}\.cr\vcredist.tmp
Size 669KB
SHA256 4a6e1044ff0f49d2e3b12f7c40352c7e573e0c58f3b3cc0b55b63c95ede87828
MD5 f216f5ee89b18a28a3936fab57c16179
SHA1 3d2995962598774a8e2dc1d038c76495466f3a72
SHA512 9350de18d452927efef3be3dd4c49361ec6b29f22e969781374508b167b4e697dcea05ee6b43b47b850d4edd0591b960628ee9cbc59deee62937a40a8e5a6573
SSDEEP 12288:n3mgqnIZuYfCYqFet4CovkM7y+1nEn0/6OaFUuT80iP:n3WnIZuMCxezot7Dh+0/9ayn0i
TLSH
T18CE49D32A5614033FBF10573B928A6303E7CE7282751C8A9D7D4AD1D7EA58C2A7F7216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{4FC694C7-1F6F-4B83-9079-4E01352BF1FB}\.ba\license.rtf
Size 9KB
SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
MD5 04b33f0a9081c10e85d0e495a1294f83
SHA1 1efe2fb2d014a731b752672745f9ffecdd716412
SHA512 d1dbed00df921169dd61501e2a3e95e6d7807348b188be9dd8fc63423501e4d848ece19ac466c3cacfccc6084e0eb2f457dc957990f6f511df10fd426e432685
SSDEEP 192:H8kZ1UVDWkiWZTIsp/4hghFF1Qf4lCfnEtHixEGx736wHqItfSpOtJ32:cM1RWZMi/zzlOnjt5HLoa2
TLSH
T13F12A7A8234783D103D213D7055294C1B71F0BF6AE7AF95C34E4D53826E2E6CB6B91E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{4FC694C7-1F6F-4B83-9079-4E01352BF1FB}\.ba\thm.wxl
Size 2KB
SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
MD5 fbfcbc4dacc566a3c426f43ce10907b6
SHA1 63c45f9a771161740e100faf710f30eed017d723
SHA512 063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e
TLSH
T11F519B6778CF639028335125EAD2966A6920C5DC923F2DF1FC4A914B838D522A373F57
MD5 SHA1 SHA512 TLSH

Submit Download

thm.xml

Path C:\Windows\Temp\{4FC694C7-1F6F-4B83-9079-4E01352BF1FB}\.ba\thm.xml
Size 8KB
SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
MD5 f62729c6d2540015e072514226c121c7
SHA1 c1e189d693f41ac2eafcc363f7890fc0fea6979c
SHA512 cbbfbfa7e013a2b85b78d71d32fdf65323534816978e7544ca6cea5286a0f6e8e7e5ffc4c538200211f11b94373d5658732d5d8aa1d01f9ccfdbf20f154f1471
SSDEEP 96:8L2HdQG+3VzHfz96zYFGaPSWXdhRAmImlqFQKFBiUxn7Ke5A82rkO/pWk3nswP:ZHAzZ/3
TLSH
T1D30259B546DDB801D232FB1166E231D27F126971C0C46E59F90C2AFB5FE1140A8B72BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{4FC694C7-1F6F-4B83-9079-4E01352BF1FB}\.ba\wixstdba.dll
Size 191KB
SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
MD5 eab9caf4277829abdf6223ec1efa0edd
SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
SSDEEP 3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53EfcUzN0m6I+WxBlnKzeZuqt:OXoQNb++gDrSJdr8BHkPh3wIgnK/IU1a
TLSH
T103149E11B5D0907AE7FB1A385938B5216D7FBA201B60C99E17589D6F2DF02C0AF35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{CF3CA679-96DA-44E8-B117-7BACDE453F1D}\.ba\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{CF3CA679-96DA-44E8-B117-7BACDE453F1D}\.ba\wixstdba.dll
Size 215KB
SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
MD5 f68f43f809840328f4e993a54b0d5e62
SHA1 01da48ce6c81df4835b4c2eca7e1d447be893d39
SHA512 a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1
SSDEEP 6144:K6EZdi6e93SuDeTKZxQfsRy26BqbUHYJe:K62i6eNSYeuZ2sRDK
TLSH
T15E24AF12B5D0907AEBFB19305939E5216DBDBA210FA0C9CE5348AD2B2E705C1DB36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab54A5CABBE7274D8A22EB58060AAB7623

Path C:\Windows\Temp\{CF3CA679-96DA-44E8-B117-7BACDE453F1D}\cab54A5CABBE7274D8A22EB58060AAB7623
Size 838KB
SHA256 c9935322c0af2fe00ebb018f8b0b908018576048fa4d3c0376a30ebf0eb2cf50
MD5 d8b6763546bb89d2d9cf3c45908b1e4b
SHA1 a1d28457d45a80bcf29618ebbdd9c50808acae5d
SHA512 194d06552d8a3b107851de79f7e9b17f4b143f62886abc71928c899e808c9d0a35417fb1813bfb918ced5f2058bfa58dfd34f837be0833d4b2ea9b143ba42081
SSDEEP 24576:P+EPvFdDKnDzR8ezJwqgq3anXt/WNsJsI96p+L2TI0X:PH9oXzdgUq+NAsXo2T3
TLSH
T1C70523DA72D3A60BED4C2DC008BDE5631D37BAFE9412D38A6174807A39CB7D456342AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cabB3E1576D1FEFBB979E13B1A5379E0B16

Path C:\Windows\Temp\{CF3CA679-96DA-44E8-B117-7BACDE453F1D}\cabB3E1576D1FEFBB979E13B1A5379E0B16
Size 4.9MB
SHA256 01b11076177c8a5ee37eba745142cd6bbc4ac1ebfc4ebe48c85bd285a73ebf60
MD5 1d033900fb3774d9025fa656f175d39e
SHA1 9cbc362c97c37aa5236c49e7b974e4a62bbd9d21
SHA512 b96914b5e8c4951dc4f6b08b96e548c7328424a78d9b1394f1c2ab2ebf2f870b5c3e6f685c656cc1d6dccc396ece88ae6f23918cfa1c9ade22828972a0468f75
SSDEEP 98304:zExLOQyFMLkrdAyYPk9Lqy5dPFpDoNRAKHSEPFVzyJUkeOwnxRj8oFFZY:saQyKLksPk461fDo3PFVzyJ7eVnFo
TLSH
T172363318C4712B0ABC1E482455E3DE84FDC5B9DAAA863BD7F264B74C29437957B30C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcRuntimeAdditional_x86

Path C:\Windows\Temp\{CF3CA679-96DA-44E8-B117-7BACDE453F1D}\vcRuntimeAdditional_x86
Size 200KB
SHA256 3e4a528fe5263a5dc44455d0ab2717f0c02acdc120c918cf43730ce9f36ccbb5
MD5 e4c2fa6814ad5061be3d081e5102eb1d
SHA1 89bee5a8cbd82937bd2222cc6e97b3648e8e491f
SHA512 5ebe95053ed100758711fa2a5d4bc12f3c976b8b2a27b8a88d6d10f666b6c5170698939b03c30ccb06acebd5d703d90045eb236cc4cfe55d1c92c31e8de87575
SSDEEP 3072:x9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriThXC:DlaZeKFxCnBheIdluA
TLSH
T17014AE12B5808033DAFE1A351178DB615F3DBE608F54499B2364B6AD1E717C08F3AAB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcRuntimeMinimum_x86

Path C:\Windows\Temp\{CF3CA679-96DA-44E8-B117-7BACDE453F1D}\vcRuntimeMinimum_x86
Size 200KB
SHA256 c5ff4d6cd4be9f4965f93af273dd364948fbe44d40b123f34f82bcbcf64c8df4
MD5 cce22015775c209fbab4050261fba590
SHA1 27998ee42531b9d41f3d71c9dc2ead8d95ed8863
SHA512 61886caec75d195d43fafcaa8d1a8b50c4fb65c39103f62d54a704d713035cc2717c04b1c1cd4794d218364b05c27bf62b13d3aef66e5665f148961ac009b45d
SSDEEP 3072:0I9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriTg3:ZlaZeKFxCnBheIdlu
TLSH
T1F414AF12B5808032DAFE19351178DB715F3D7E608F5489AB2364B6AD1E717C08F3AAB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/760-442-0x0000000000BF0000-0x0000000000C67000-memory.dmp

Download

memory/796-23-0x000000000BB00000-0x000000000BBA0000-memory.dmp

Download

memory/796-499-0x000000000B440000-0x000000000B4A4000-memory.dmp

Download

memory/796-39-0x000000000F120000-0x000000000F128000-memory.dmp

Download

memory/796-38-0x000000000F0F0000-0x000000000F10A000-memory.dmp

Download

memory/796-36-0x000000000DA40000-0x000000000DA62000-memory.dmp

Download

memory/796-101-0x0000000005940000-0x0000000005950000-memory.dmp

Download

memory/796-100-0x000000000B440000-0x000000000B4A4000-memory.dmp

Download

memory/796-99-0x0000000005910000-0x000000000591B000-memory.dmp

Download

memory/796-98-0x0000000005800000-0x000000000588A000-memory.dmp

Download

memory/796-102-0x0000000005940000-0x0000000005950000-memory.dmp

Download

memory/796-103-0x0000000005940000-0x0000000005950000-memory.dmp

Download

memory/796-106-0x000000000DA70000-0x000000000DA82000-memory.dmp

Download

memory/796-105-0x0000000007810000-0x000000000781A000-memory.dmp

Download

memory/796-276-0x000000000B440000-0x000000000B4A4000-memory.dmp

Download

memory/796-274-0x0000000005800000-0x000000000588A000-memory.dmp

Download

memory/796-31-0x000000000D840000-0x000000000D8F2000-memory.dmp

Download

memory/796-29-0x000000000C4C0000-0x000000000C518000-memory.dmp

Download

memory/796-24-0x000000000B430000-0x000000000B43A000-memory.dmp

Download

memory/796-484-0x0000000005800000-0x000000000588A000-memory.dmp

Download

memory/796-22-0x000000000B2E0000-0x000000000B314000-memory.dmp

Download

memory/796-18-0x0000000006940000-0x000000000694A000-memory.dmp

Download

memory/796-21-0x0000000005940000-0x0000000005950000-memory.dmp

Download

memory/796-20-0x0000000005940000-0x0000000005950000-memory.dmp

Download

memory/796-524-0x000000000B440000-0x000000000B4A4000-memory.dmp

Download

memory/796-17-0x0000000006880000-0x00000000068F4000-memory.dmp

Download

memory/796-14-0x0000000005940000-0x0000000005950000-memory.dmp

Download

memory/796-480-0x000000000E390000-0x000000000E6E7000-memory.dmp

Download

memory/796-479-0x0000000005C90000-0x0000000005C98000-memory.dmp

Download

memory/796-478-0x0000000007640000-0x0000000007690000-memory.dmp

Download

memory/796-473-0x000000000B440000-0x000000000B4A4000-memory.dmp

Download

memory/796-471-0x0000000005800000-0x000000000588A000-memory.dmp

Download

memory/796-512-0x000000000B440000-0x000000000B4A4000-memory.dmp

Download

memory/796-37-0x000000000F020000-0x000000000F0F6000-memory.dmp

Download

memory/1544-2-0x0000000005FE0000-0x0000000005FF0000-memory.dmp

Download

memory/1544-1-0x00000000065A0000-0x0000000006B46000-memory.dmp

Download

memory/1544-3-0x0000000005F80000-0x0000000005FC6000-memory.dmp

Download

memory/1544-4-0x00000000060C0000-0x0000000006152000-memory.dmp

Download

memory/1544-5-0x0000000006020000-0x0000000006046000-memory.dmp

Download

memory/1544-6-0x0000000006060000-0x000000000607E000-memory.dmp

Download

memory/1544-12-0x0000000001D50000-0x0000000001EFC000-memory.dmp

Download

memory/1544-0-0x0000000000DD0000-0x000000000134A000-memory.dmp

Download

memory/1664-469-0x0000021DF0FA0000-0x0000021DF0FA9000-memory.dmp

Download

memory/1664-468-0x0000021DF05A0000-0x0000021DF073A000-memory.dmp

Download

memory/1780-445-0x0000000000BF0000-0x0000000000C67000-memory.dmp

Download

memory/3332-449-0x000001964B090000-0x000001964B22A000-memory.dmp

Download

memory/3684-363-0x0000027161890000-0x0000027161A2A000-memory.dmp

Download

memory/5096-444-0x0000000000BF0000-0x0000000000C67000-memory.dmp

Download