44caliber | 72ec0572620cb474a46ee2a6092f3d080c25b66b07d76fd2dd72d3f2388f04a0

Analysis

max time kernel
115s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20-02-2024 18:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fly vw.exe
Size

3.0MB
MD5

e9741cbf19fc1947d6c586564585f53f
SHA1

6580de244f3f2f77548376aabf1671a2b76e0b4e
SHA256

72ec0572620cb474a46ee2a6092f3d080c25b66b07d76fd2dd72d3f2388f04a0
SHA512

4560eb4fb3706967e24a0cbcf34387564ab1b0e340a910ed7b925ec5dc80661c7b39a46650586c3991badfd343f3ad3cf67506f5afda4af859784629988b047a
SSDEEP

49152:tM3r1CyUBpXb9OZxkjBJrlrCZ9eZHtFs6SC5bAPLERCpydSECwKWvtY0:qJC1pb9OZ+9dlKwZHtFg8czE0pydSECW

Score

10^/10

44caliber spyware stealer

Malware Config

Extracted

Family

44caliber

https://discordapp.com/api/webhooks/1192569430484463717/I6Kwe8DzntI6vhtlBS66UU8vV05EYfDX3mK1x5PPRmeEfRH9iurdtdMxHmv2ZZuW3Ev5

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber

Executes dropped EXE 1 IoCs

pid	Process
2588	FreeRobux.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	freegeoip.app
5	freegeoip.app

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2588	FreeRobux.exe
2588	FreeRobux.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	FreeRobux.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	FreeRobux.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	fly vw.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2588	FreeRobux.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2588	FreeRobux.exe
2588	FreeRobux.exe
2588	FreeRobux.exe
2588	FreeRobux.exe
2588	FreeRobux.exe
2792	chrome.exe
2792	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2588	FreeRobux.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2936	fly vw.exe
2936	fly vw.exe
2588	FreeRobux.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2748	2936	fly vw.exe	28
PID 2936 wrote to memory of 2748	2936	fly vw.exe	28
PID 2936 wrote to memory of 2748	2936	fly vw.exe	28
PID 2936 wrote to memory of 2748	2936	fly vw.exe	28
PID 2936 wrote to memory of 2748	2936	fly vw.exe	28
PID 2748 wrote to memory of 2588	2748	cmd.exe	30
PID 2748 wrote to memory of 2588	2748	cmd.exe	30
PID 2748 wrote to memory of 2588	2748	cmd.exe	30
PID 2748 wrote to memory of 2588	2748	cmd.exe	30
PID 2792 wrote to memory of 1176	2792	chrome.exe	35
PID 2792 wrote to memory of 1176	2792	chrome.exe	35
PID 2792 wrote to memory of 1176	2792	chrome.exe	35
PID 2792 wrote to memory of 1944	2792	chrome.exe	36
PID 2792 wrote to memory of 1944	2792	chrome.exe	36
PID 2792 wrote to memory of 1944	2792	chrome.exe	36
PID 2792 wrote to memory of 1944	2792	chrome.exe	36
PID 2792 wrote to memory of 1944	2792	chrome.exe	36
PID 2792 wrote to memory of 1944	2792	chrome.exe	36
PID 2792 wrote to memory of 1944	2792	chrome.exe	36
PID 2792 wrote to memory of 1944	2792	chrome.exe	36
PID 2792 wrote to memory of 1944	2792	chrome.exe	36
PID 2792 wrote to memory of 1944	2792	chrome.exe	36
PID 2792 wrote to memory of 1944	2792	chrome.exe	36
PID 2792 wrote to memory of 1944	2792	chrome.exe	36
PID 2792 wrote to memory of 1944	2792	chrome.exe	36
PID 2792 wrote to memory of 1944	2792	chrome.exe	36
PID 2792 wrote to memory of 1944	2792	chrome.exe	36
PID 2792 wrote to memory of 1944	2792	chrome.exe	36
PID 2792 wrote to memory of 1944	2792	chrome.exe	36
PID 2792 wrote to memory of 1944	2792	chrome.exe	36
PID 2792 wrote to memory of 1944	2792	chrome.exe	36
PID 2792 wrote to memory of 1944	2792	chrome.exe	36
PID 2792 wrote to memory of 1944	2792	chrome.exe	36
PID 2792 wrote to memory of 1944	2792	chrome.exe	36
PID 2792 wrote to memory of 1944	2792	chrome.exe	36
PID 2792 wrote to memory of 1944	2792	chrome.exe	36
PID 2792 wrote to memory of 1944	2792	chrome.exe	36
PID 2792 wrote to memory of 1944	2792	chrome.exe	36
PID 2792 wrote to memory of 1944	2792	chrome.exe	36
PID 2792 wrote to memory of 1944	2792	chrome.exe	36
PID 2792 wrote to memory of 1944	2792	chrome.exe	36
PID 2792 wrote to memory of 1944	2792	chrome.exe	36
PID 2792 wrote to memory of 1944	2792	chrome.exe	36
PID 2792 wrote to memory of 1944	2792	chrome.exe	36
PID 2792 wrote to memory of 1944	2792	chrome.exe	36
PID 2792 wrote to memory of 1944	2792	chrome.exe	36
PID 2792 wrote to memory of 1944	2792	chrome.exe	36
PID 2792 wrote to memory of 1944	2792	chrome.exe	36
PID 2792 wrote to memory of 1944	2792	chrome.exe	36
PID 2792 wrote to memory of 1944	2792	chrome.exe	36
PID 2792 wrote to memory of 1944	2792	chrome.exe	36
PID 2792 wrote to memory of 1544	2792	chrome.exe	37
PID 2792 wrote to memory of 1544	2792	chrome.exe	37
PID 2792 wrote to memory of 1544	2792	chrome.exe	37
PID 2792 wrote to memory of 2088	2792	chrome.exe	38
PID 2792 wrote to memory of 2088	2792	chrome.exe	38
PID 2792 wrote to memory of 2088	2792	chrome.exe	38
PID 2792 wrote to memory of 2088	2792	chrome.exe	38
PID 2792 wrote to memory of 2088	2792	chrome.exe	38
PID 2792 wrote to memory of 2088	2792	chrome.exe	38
PID 2792 wrote to memory of 2088	2792	chrome.exe	38
PID 2792 wrote to memory of 2088	2792	chrome.exe	38
PID 2792 wrote to memory of 2088	2792	chrome.exe	38
PID 2792 wrote to memory of 2088	2792	chrome.exe	38

C:\Users\Admin\AppData\Local\Temp\fly vw.exe
"C:\Users\Admin\AppData\Local\Temp\fly vw.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Roaming\Setup.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Users\Admin\AppData\Roaming\FreeRobux.exe
    FreeRobux.exe -p111 -dC:\Users\Admin\AppData\Roaming
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Checks processor information in registry
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2588

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef63c9758,0x7fef63c9768,0x7fef63c9778
  2⤵
  PID:1176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1100 --field-trial-handle=1308,i,1825909939938514391,6954039230042745107,131072 /prefetch:2
  2⤵
  PID:1944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1504 --field-trial-handle=1308,i,1825909939938514391,6954039230042745107,131072 /prefetch:8
  2⤵
  PID:1544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1608 --field-trial-handle=1308,i,1825909939938514391,6954039230042745107,131072 /prefetch:8
  2⤵
  PID:2088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2248 --field-trial-handle=1308,i,1825909939938514391,6954039230042745107,131072 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2256 --field-trial-handle=1308,i,1825909939938514391,6954039230042745107,131072 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1340 --field-trial-handle=1308,i,1825909939938514391,6954039230042745107,131072 /prefetch:2
  2⤵
  PID:1600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3192 --field-trial-handle=1308,i,1825909939938514391,6954039230042745107,131072 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3660 --field-trial-handle=1308,i,1825909939938514391,6954039230042745107,131072 /prefetch:8
  2⤵
  PID:2576

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\44\Browsers\Firefox\Bookmarks.txt

Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
9d59baf780bbc579b6788c0198a078f7

SHA1
ff46d594e4b9e68342e400e87a37ab78ea21af64

SHA256
0f1e463289d303970bfb02872cbbb139b2e8fa71851d7c4da5e4e3022358a6d9

SHA512
ed164518716ba3d3c6d39494bad89ddee55d03c6e1473fd861fb01a40adee9e559fd2b3fb1db389dd7e63efac2cc723d3cf487c2e30421c8313f5d01443ec21c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
8aaae9db985f186f8f1be48dfd7ff32b

SHA1
c28599646814b2be06054a2621e7603f6390d8d4

SHA256
a71b4687236dbc452684448bb0bb2a13d233fdb9aee71d09b906bd3195107563

SHA512
9c8d799de5a8bdbfe7568829fd1ab08b485382e0ce61a90402d3e8a91bf6c40c0abc830e5a927dc7134b9b5dffe856fc43c8edc8d304bc06d53c6bbdf8dd191a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Roaming\FreeRobux.exe

Filesize
1.2MB

MD5
3c0a10912d34140b0dcbbb6ddd982f56

SHA1
9c07774e8ce009629dbddb43fa73cb3f5dafe39b

SHA256
d3e166dfd64f0f5e63ef46ccf340937393242433a872d77d8d6afc974a8e6cfd

SHA512
c95140ef1abe995c210a620727db4e0627f2fda20d248a29c9216e96992f23096435ee248f3d2d69b71e4e9c4215e7ecf6048cc983142f67b371d7c35b15bb4b

Download Submit
C:\Users\Admin\AppData\Roaming\FreeRobux.exe

Filesize
1.1MB

MD5
7255aa1ce978c7c031246ab25ec8bd22

SHA1
a34c4c7507b413d5d2231aea00cb7e049099fc02

SHA256
30a26205dd9d7f7ebc353a3936057d65fba6e67d67b678a4d0567faa62777887

SHA512
d4233b50f3c92642d3f71ea5cc92c128e29673e30895fe685484c85a714a725333bf955cf3055247c6004c4609fd9a1694a4dd712a3101d0a9a80c846a8de76b

Download Submit
C:\Users\Admin\AppData\Roaming\Setup.bat

Filesize
31B

MD5
7a1224f5b93470ba772698dba9bbc8dc

SHA1
5cbabe8cb347a350f75108efb101f7aa29f1ac6f

SHA256
5ea7797532c3ed291e4a9b5f40f07140ac073737bc280de5bc5fc1bf7dc90e99

SHA512
f6071c4edb7e7cc013cc8791c96b048672ca7eb71b0098ce5fa565309d8f9767e470b35b9172bfbaa6d42f91cb7792789828195c4f041e81066cbd8b45f61c05

Download Submit
memory/2588-35-0x0000000005820000-0x0000000005860000-memory.dmp

Filesize
256KB

Download
memory/2588-89-0x00000000749C0000-0x00000000750AE000-memory.dmp

Filesize
6.9MB

Download
memory/2588-88-0x0000000000340000-0x00000000006EE000-memory.dmp

Filesize
3.7MB

Download
memory/2588-34-0x00000000749C0000-0x00000000750AE000-memory.dmp

Filesize
6.9MB

Download
memory/2588-33-0x0000000000340000-0x00000000006EE000-memory.dmp

Filesize
3.7MB

Download
memory/2588-32-0x0000000000340000-0x00000000006EE000-memory.dmp

Filesize
3.7MB

Download