Analysis

  • max time kernel
    77s
  • max time network
    78s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-10-2024 02:56

General

  • Target

    https://github.com/ic3w0lf22/Roblox-Account-Manager/releases/download/3.7.1/Roblox.Account.Manager.3.7.1.zip

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Drops file in System32 directory 49 IoCs
  • Drops file in Windows directory 15 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies data under HKEY_USERS 11 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 35 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/ic3w0lf22/Roblox-Account-Manager/releases/download/3.7.1/Roblox.Account.Manager.3.7.1.zip
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4008
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe4855cc40,0x7ffe4855cc4c,0x7ffe4855cc58
      2⤵
        PID:1680
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1860,i,10933780519558145855,17180748148889248428,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1852 /prefetch:2
        2⤵
          PID:4772
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2132,i,10933780519558145855,17180748148889248428,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2140 /prefetch:3
          2⤵
            PID:852
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2216,i,10933780519558145855,17180748148889248428,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2392 /prefetch:8
            2⤵
              PID:4488
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3116,i,10933780519558145855,17180748148889248428,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3152 /prefetch:1
              2⤵
                PID:2052
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3132,i,10933780519558145855,17180748148889248428,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3308 /prefetch:1
                2⤵
                  PID:1000
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4568,i,10933780519558145855,17180748148889248428,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4816 /prefetch:8
                  2⤵
                    PID:768
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4612,i,10933780519558145855,17180748148889248428,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4844 /prefetch:8
                    2⤵
                      PID:4576
                  • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                    1⤵
                      PID:1096
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                      1⤵
                        PID:1588
                      • C:\Windows\System32\rundll32.exe
                        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                        1⤵
                          PID:2056
                        • C:\Users\Admin\Desktop\Roblox Account Manager.exe
                          "C:\Users\Admin\Desktop\Roblox Account Manager.exe"
                          1⤵
                          • System Location Discovery: System Language Discovery
                          PID:3784
                          • C:\Users\Admin\Desktop\Roblox Account Manager.exe
                            "C:\Users\Admin\Desktop\Roblox Account Manager.exe" -restart
                            2⤵
                            • System Location Discovery: System Language Discovery
                            • Modifies Internet Explorer settings
                            • Suspicious behavior: GetForegroundWindowSpam
                            • Suspicious use of AdjustPrivilegeToken
                            PID:388
                            • C:\Users\Admin\AppData\Local\Temp\vcredist.tmp
                              "C:\Users\Admin\AppData\Local\Temp\vcredist.tmp" /q /norestart
                              3⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              PID:2416
                              • C:\Windows\Temp\{4E54CFC3-3FCB-427F-A232-0A58072C2FB0}\.cr\vcredist.tmp
                                "C:\Windows\Temp\{4E54CFC3-3FCB-427F-A232-0A58072C2FB0}\.cr\vcredist.tmp" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\vcredist.tmp" -burn.filehandle.attached=724 -burn.filehandle.self=728 /q /norestart
                                4⤵
                                • Checks computer location settings
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • System Location Discovery: System Language Discovery
                                PID:1900
                                • C:\Windows\Temp\{718BED17-050D-4260-AC1A-DCB9989DDC04}\.be\VC_redist.x86.exe
                                  "C:\Windows\Temp\{718BED17-050D-4260-AC1A-DCB9989DDC04}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{60798FCE-55A0-4BDC-8157-EAAD45992E18} {69BA9AD0-6C89-4ED1-A6CC-E6C3A61014C2} 1900
                                  5⤵
                                  • Executes dropped EXE
                                  • Adds Run key to start application
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry class
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2608
                                  • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                                    "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={4373d0b5-4457-4a80-bad9-029de8df097b} -burn.filehandle.self=976 -burn.embedded BurnPipe.{5D9D1C76-8C91-4913-A118-F57B0FB1CE98} {76EA7A68-D4F1-4D59-9F93-653CFF7527D9} 2608
                                    6⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:2256
                                    • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                                      "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=544 -burn.filehandle.self=564 -uninstall -quiet -burn.related.upgrade -burn.ancestors={4373d0b5-4457-4a80-bad9-029de8df097b} -burn.filehandle.self=976 -burn.embedded BurnPipe.{5D9D1C76-8C91-4913-A118-F57B0FB1CE98} {76EA7A68-D4F1-4D59-9F93-653CFF7527D9} 2608
                                      7⤵
                                      • Loads dropped DLL
                                      • System Location Discovery: System Language Discovery
                                      PID:2500
                                      • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                                        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{A757B420-1F0F-439E-BA7D-BC9714DC28FA} {5CBEF837-71B2-4625-AB96-5974CEB9B021} 2500
                                        8⤵
                                        • System Location Discovery: System Language Discovery
                                        • Modifies registry class
                                        PID:4964
                        • C:\Windows\system32\vssvc.exe
                          C:\Windows\system32\vssvc.exe
                          1⤵
                          • Checks SCSI registry key(s)
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2496
                        • C:\Windows\system32\srtasks.exe
                          C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                          1⤵
                            PID:2924
                          • C:\Windows\system32\msiexec.exe
                            C:\Windows\system32\msiexec.exe /V
                            1⤵
                            • Enumerates connected drives
                            • Drops file in System32 directory
                            • Drops file in Windows directory
                            • Modifies data under HKEY_USERS
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4916

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Config.Msi\e589ea1.rbs

                            Filesize

                            16KB

                            MD5

                            0f87d8b8397e5ffa225602a309b20345

                            SHA1

                            90f5f3e0c038701dbdfacb4147feeb942b253e39

                            SHA256

                            bb6ef45cc8c10342e719266d03bd3744b3174c1aa93cfaf56f6d8947455987ed

                            SHA512

                            2fa136235b40e3542fa0877fa9258f892320ec8b1223f19f2fa40c6f85b76682b8c78501896551d243dbc8b738f6ac36828c6e7255f2d32309757caa02d8aa28

                          • C:\Config.Msi\e589ea6.rbs

                            Filesize

                            18KB

                            MD5

                            dd6645ba521bbacfe31741b5e471d47d

                            SHA1

                            f7be38ad2f6110524a07a786e26ece528ca0cee2

                            SHA256

                            a83eb91f382702bb3740b349b72acbbe5477a93d3c1d96cb6f0824881456150b

                            SHA512

                            aa7b25517769c1b07d2531ede080aa9a27f7e1b931492deefb3b8354f5cdbcf078543344216e9f8afbfd58ae2def7025a37d7a64dd38c81c6e86c3245351aae7

                          • C:\Config.Msi\e589eb3.rbs

                            Filesize

                            20KB

                            MD5

                            e10418398e9c984547205d968661bc17

                            SHA1

                            1970f3ce0a45d65e2afb9c30a26c31f29b225f4c

                            SHA256

                            50501db6eaa1e79654c2b25306bd950c084b23f24aa339ce37670e7ab8d1dc39

                            SHA512

                            2802e52ca462876bf0021138d8bf8fe20f95975181f4608df4fc519f0a78d50806bfb62196330b7660790a7b98ac735d5e4fbf75accb2ba1176a743b922d5e46

                          • C:\Config.Msi\e589ec2.rbs

                            Filesize

                            19KB

                            MD5

                            dddecfc0c580fd922505c391088a7007

                            SHA1

                            bc8be35a38baa87e8f080ad439f4f54ce8288643

                            SHA256

                            67666eed8df133e32e806d4e37c8b7ef30a19dd93a20f8a9a914c10bd62b52a6

                            SHA512

                            59ed37af8b6c3fe06abc68cd34aa6e0710d72b3d26abf949409a405e7fee496e0c1fae368bdbcb7762b8fe7b7606107863386769685b64c91ef84c784d4b18e5

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            2KB

                            MD5

                            ec560eb94ef3fb57af28cebbbbf75bb7

                            SHA1

                            8b8e19ee8422ee5edf2348a89b441bba3f65a607

                            SHA256

                            528ae5ae29d2059a15d5eddb88204d978614d1d5eba8ae64e57b0cb436b2c2fa

                            SHA512

                            e34800325b8f7f70b2f500ecb256e6f338283dd8807ca6adcab8098bc3873f2225319e8d4b8cdd0c726858894f85c02f5de6a6bba39e0184c4dadc6be4aa4631

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                            Filesize

                            2B

                            MD5

                            d751713988987e9331980363e24189ce

                            SHA1

                            97d170e1550eee4afc0af065b78cda302a97674c

                            SHA256

                            4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                            SHA512

                            b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            523B

                            MD5

                            ca84214924fef45f0f682e968785c614

                            SHA1

                            5a468b474c04d4f8e533db1201b45438d6ad2f6d

                            SHA256

                            7e421c90702b17a29b97cfcf73da0bf9868be6aa4c5e4844ee8efc24420594cc

                            SHA512

                            b8d4263839a622d6bfc95b904eb94bd6ca005c891bc3af930d7d6d8a7ecfc60099fe32492a6d54e04ffb8eb087493aa454fb5d555ba79daacfe8a8f50601c8d0

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            8KB

                            MD5

                            fa061e5c4649fd6034da742573bd403f

                            SHA1

                            1c00becc2c29321615012de6b76584adce9010d4

                            SHA256

                            98dcbfaf10f80759060f5750c03ca53c60b2d78d6a33c3b6b454add4ac17dd54

                            SHA512

                            2fb5a8967c0db402221b52d14ea8e758fc1646d6dcd0876ce3824275367e3c3010e3d4523ee7ef35792176283c2675f6c6c0178f95bf470a334fbd5d88348934

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_1

                            Filesize

                            264KB

                            MD5

                            f50f89a0a91564d0b8a211f8921aa7de

                            SHA1

                            112403a17dd69d5b9018b8cede023cb3b54eab7d

                            SHA256

                            b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                            SHA512

                            bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            116KB

                            MD5

                            05fee561f5d5d05836e940d616b144a5

                            SHA1

                            5f322c8dbfe74ae84adf142c7f9ee120355c3cef

                            SHA256

                            3358d0420003fdb501f2a171117c70c3652ab5153f47798336d0e8601c6f420c

                            SHA512

                            c1e5bd578773ed2a4efd56c585bb3369167a3c3e00a03ca44ece6779bb0007db29301c42f0b943f2f3b8fa868638fb9b70a5e49dcef29f3ddbf8c9f185b54487

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            116KB

                            MD5

                            a3e60837466c09a0c1bcf5c21f3b58bc

                            SHA1

                            eefb7c8cb98a8031859587ba9c77dcef224cb318

                            SHA256

                            62b69f7ef9d5c44a638a7a8e6bedd34f5e884d32b82827bbbb97bddec05a9741

                            SHA512

                            53fcf9422cb041cdce12c5e7c9ef8a00ea27446e1f608b2296b0b4ddf8b93b540fd6dccd1bd71d5ce5560f0c6beebbd78560ffb56d675d16b24d84b7cf89e3e3

                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Roblox Account Manager.exe.log

                            Filesize

                            1KB

                            MD5

                            a02e8a8a790f0e0861e3b6b0dbe56062

                            SHA1

                            a3e65805e5c78641cafebc1052906d7350da9d2e

                            SHA256

                            7fada0f81b63e1ecb265e9620ace8f5f0d40773626081849f5d98e668bc4e594

                            SHA512

                            108a81f818aa027834d621c771e427ee3f300c59d9dc10d853b94b1e8d635cf6bc06338dce31da30b08660c6fb06a39f9069c983bb585049f5fe9f50b753eb42

                          • C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20241013025810_000_vcRuntimeMinimum_x86.log

                            Filesize

                            2KB

                            MD5

                            55aabfbe6e26dfb37b485a471fd9115e

                            SHA1

                            360afa444f6e9a2379ec4534e869fe6ec58db4b1

                            SHA256

                            14629c35e4d987b6e75ba8933dd80bf173e2d84341009f6212b16f127deb8b2c

                            SHA512

                            a8656059125a956d40824bf9fd1e163875cd1ae6b78ad367ca4fdb9b4dc16b7170dbd61870bdd330c733f9a01cc010dce4ef436a1d7782229193ae79b583e8d5

                          • C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20241013025810_001_vcRuntimeAdditional_x86.log

                            Filesize

                            2KB

                            MD5

                            955427b38554df5321e20a6e1eb6cf8f

                            SHA1

                            a778626d2782fa4f211ea0a3d5bc203cf687d3c8

                            SHA256

                            80242a443e0e250c3d02ff8526a64b233df7743b494bead7e7b78465d8b10ece

                            SHA512

                            85c05dac19b136431562311192fb73f90d2d5918b9df47a7679c25fd85093d15d671670fdb026d6ee8e2a4f958275d71d1f9a8dd271735678d0b50b28d056119

                          • C:\Users\Admin\AppData\Local\Temp\vcredist.tmp

                            Filesize

                            13.3MB

                            MD5

                            d38126688b5647bf209606d07a90c2e6

                            SHA1

                            467bb2c862def52f2858e5158c96f7ac6d6dcab2

                            SHA256

                            ed1967c2ac27d806806d121601b526f84e497ae1b99ed139c0c4c6b50147df4a

                            SHA512

                            8a0991b993d5206450228454b4f83251cc311cc2b0dd105494928e03bf2e865de8ccf9676c8e7453164bb1805929a3a9616ea020524b77dbc0a6bbca0d222daf

                          • C:\Users\Admin\Desktop\RAMSettings.ini

                            Filesize

                            1014B

                            MD5

                            1d917eaf5dcc8e06dd032c33f3a3d36a

                            SHA1

                            1eacb4eced22393fd5140910d30070f2e054e2fe

                            SHA256

                            787fa9af1c32b7e198119469c0e2c02c06b34ec7c990b62b9f4fb9bc8cedaa5f

                            SHA512

                            3cf5bc6160262ad454477cc0fab401696a7e5dff9e6fae1cdcfa0579ded640ea8c383dfcea6194f55c914927058e2355fd661d1fa83f87c10aeffa6a91cb9fcd

                          • C:\Users\Admin\Desktop\RAMTheme.ini

                            Filesize

                            314B

                            MD5

                            f18fa783f4d27e35e54e54417334bfb4

                            SHA1

                            94511cdf37213bebdaf42a6140c9fe5be8eb07ba

                            SHA256

                            563eb35fd613f4298cd4dceff67652a13ba516a6244d9407c5709323c4ca4bb1

                            SHA512

                            602f6a68562bc89a4b3c3a71c2477377f161470bf8ae8e6925bf35691367115abfa9809925bd09c35596c6a3e5a7e9d090e5198e6a885a6658049c8732a05071

                          • C:\Users\Admin\Desktop\Roblox Account Manager.exe.config

                            Filesize

                            6KB

                            MD5

                            d5e4966de947333592289d70916257a9

                            SHA1

                            5907df0fd07df6c33926906e94f4ed08d40be017

                            SHA256

                            d726d47b772a70fabc777c8ed46655fe5200e672f01f11dd95c5f4994e0a71e0

                            SHA512

                            c618054766bee664f0605a037f065c196c35495ee993b305f0bece4738ec9f7bd632dc8fb541bcf9d156f12e115455f31dd8db2a8cceb9d7d2f0d05d501831e9

                          • C:\Users\Admin\Desktop\log4.config

                            Filesize

                            936B

                            MD5

                            e4659ac08af3582a23f38bf6c562f841

                            SHA1

                            19cb4f014ba96285fa1798f008deabce632c7e76

                            SHA256

                            e4b10630d9ec2af508de31752fbbc6816c7426c40a3e57f0a085ce7f42c77bd5

                            SHA512

                            5bfa1e021cc7ee5e7a00da865d68684202b3b92d3d369b85b80c591fffa67725d434398325dc1e37c659eab62c0a4118b3e279ac0096b95790d252ceb6254249

                          • C:\Users\Admin\Downloads\Roblox.Account.Manager.3.7.1.zip.crdownload

                            Filesize

                            4.2MB

                            MD5

                            5d4e071c9a20061978be79d7c7213068

                            SHA1

                            c388cb6e43646845d2366bcfe275cfabe7707518

                            SHA256

                            c260b8bfacd5be41c48c74e53de2a8fa389c3ec293846ddc7255abd9ff02261b

                            SHA512

                            def6415512e5ed67a588c4d3b4c574c22a2431faf1df92cb080913e7bd6c2ecf73cd16371dc12500221d4aa43e9bbfdac3b78f5da6a1a1d5a5d156bed2ff7f32

                          • C:\Windows\Temp\{1CFBB38E-4603-43C3-A5A5-26F7820C723B}\.ba\wixstdba.dll

                            Filesize

                            191KB

                            MD5

                            eab9caf4277829abdf6223ec1efa0edd

                            SHA1

                            74862ecf349a9bedd32699f2a7a4e00b4727543d

                            SHA256

                            a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

                            SHA512

                            45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

                          • C:\Windows\Temp\{4E54CFC3-3FCB-427F-A232-0A58072C2FB0}\.cr\vcredist.tmp

                            Filesize

                            669KB

                            MD5

                            38b9328b53a786141dc7d54992aa03bc

                            SHA1

                            b3de0981128c8170b70e977a21c6c7e3e8437d8f

                            SHA256

                            32e2651799071c5e6c51bdaf0df7823526b25b2f34c01f9472bb159044d62c11

                            SHA512

                            b5ac7f0675feea295be0553520fd5341e5122ea1e33d2eaffa5d9f9170f5c97b30ea5db25774c00a69ecc48f018412bb1795e357aafc7565e242e5e4025527e2

                          • C:\Windows\Temp\{718BED17-050D-4260-AC1A-DCB9989DDC04}\.ba\logo.png

                            Filesize

                            1KB

                            MD5

                            d6bd210f227442b3362493d046cea233

                            SHA1

                            ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

                            SHA256

                            335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

                            SHA512

                            464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

                          • C:\Windows\Temp\{718BED17-050D-4260-AC1A-DCB9989DDC04}\.ba\wixstdba.dll

                            Filesize

                            215KB

                            MD5

                            f68f43f809840328f4e993a54b0d5e62

                            SHA1

                            01da48ce6c81df4835b4c2eca7e1d447be893d39

                            SHA256

                            e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e

                            SHA512

                            a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1

                          • C:\Windows\Temp\{718BED17-050D-4260-AC1A-DCB9989DDC04}\cab54A5CABBE7274D8A22EB58060AAB7623

                            Filesize

                            828KB

                            MD5

                            c15278501772ebaf95ab908b94a552f2

                            SHA1

                            cf9c8ae523d9a6ed2797be072c9f659b9ed5dadb

                            SHA256

                            17d7bcb6c05f6c422f1bfbf5db923fc7d1427ec578968b75403830e759853b07

                            SHA512

                            f109a3af129b0025bd6dfb141d27e3d336145bc70c1fde590e44e4402d479680ca91ac0bc8cf8cd854e05a74c649719822218b2a1f58f75cbbaa9f03c9aeaf93

                          • C:\Windows\Temp\{718BED17-050D-4260-AC1A-DCB9989DDC04}\cabB3E1576D1FEFBB979E13B1A5379E0B16

                            Filesize

                            5.0MB

                            MD5

                            512cc3e31ba72999bd0be1ff2faf59df

                            SHA1

                            56210834f64afa1800def2bc26d421e78c056639

                            SHA256

                            55b0b98e9222a6f43c644bbf6f642267535d08270dce52c09e0f31b98385ffb0

                            SHA512

                            3c912488fdbd9b6f01e87a189f825b77c186d018df9ed27fe554644eb0b40fdeac8903f7ee99a77c740c75b27056fd7977e47810144714052539308d16a7df67

                          • C:\Windows\Temp\{718BED17-050D-4260-AC1A-DCB9989DDC04}\vcRuntimeAdditional_x86

                            Filesize

                            200KB

                            MD5

                            4879fe953ed435ca08589645b8eec144

                            SHA1

                            bc58d6f3ed69be01690d97c59dafda612cbc5f2b

                            SHA256

                            0ddc3f10282fdb663ac92ce5930e46cf996a4b42b592b9911b4001d12d4178bc

                            SHA512

                            222cb3f93b5d759c87077716f9cc95f152997e6c95a13aae8a4e789c274836ba41a03b6e08926135efdc8cd8413b47f02f34ddd4f6c7622ea98458b6e06d24ce

                          • C:\Windows\Temp\{718BED17-050D-4260-AC1A-DCB9989DDC04}\vcRuntimeMinimum_x86

                            Filesize

                            200KB

                            MD5

                            aebc9db05b27963bdd7dc5f3c7eca0a9

                            SHA1

                            31d6f6cabd5fbfb7c2899d481f18e18930dbfdfd

                            SHA256

                            d9598b33dc795da4cbd520b790c45507cbce3976576e0e506b388c5f7ac3290c

                            SHA512

                            564d945821d80e27fdffcfdafd79c72d498018067a74e85fd6ee595a6a09453ae0fb1df41b430f656001bafc1b0b89c5433bd5aae48c179daa7a8a8732090c63

                          • memory/388-231-0x000000000C740000-0x000000000C74A000-memory.dmp

                            Filesize

                            40KB

                          • memory/388-232-0x000000000C770000-0x000000000C782000-memory.dmp

                            Filesize

                            72KB

                          • memory/388-160-0x000000000D6B0000-0x000000000D786000-memory.dmp

                            Filesize

                            856KB

                          • memory/388-161-0x0000000007570000-0x000000000758A000-memory.dmp

                            Filesize

                            104KB

                          • memory/388-162-0x0000000007590000-0x0000000007598000-memory.dmp

                            Filesize

                            32KB

                          • memory/388-158-0x0000000007440000-0x00000000074F2000-memory.dmp

                            Filesize

                            712KB

                          • memory/388-156-0x0000000007360000-0x00000000073B8000-memory.dmp

                            Filesize

                            352KB

                          • memory/388-151-0x000000000B850000-0x000000000B85A000-memory.dmp

                            Filesize

                            40KB

                          • memory/388-150-0x000000000BEC0000-0x000000000BF60000-memory.dmp

                            Filesize

                            640KB

                          • memory/388-227-0x000000000C2D0000-0x000000000C2D8000-memory.dmp

                            Filesize

                            32KB

                          • memory/388-226-0x000000000C310000-0x000000000C360000-memory.dmp

                            Filesize

                            320KB

                          • memory/388-228-0x000000000C360000-0x000000000C6B4000-memory.dmp

                            Filesize

                            3.3MB

                          • memory/388-149-0x000000000B2B0000-0x000000000B2E4000-memory.dmp

                            Filesize

                            208KB

                          • memory/388-159-0x0000000007540000-0x0000000007562000-memory.dmp

                            Filesize

                            136KB

                          • memory/388-147-0x0000000006610000-0x000000000661A000-memory.dmp

                            Filesize

                            40KB

                          • memory/388-146-0x0000000006590000-0x0000000006604000-memory.dmp

                            Filesize

                            464KB

                          • memory/2256-580-0x0000000000D90000-0x0000000000E07000-memory.dmp

                            Filesize

                            476KB

                          • memory/2500-579-0x0000000000D90000-0x0000000000E07000-memory.dmp

                            Filesize

                            476KB

                          • memory/3784-143-0x0000000075210000-0x00000000759C0000-memory.dmp

                            Filesize

                            7.7MB

                          • memory/3784-136-0x0000000075210000-0x00000000759C0000-memory.dmp

                            Filesize

                            7.7MB

                          • memory/3784-135-0x0000000005F30000-0x0000000005F4E000-memory.dmp

                            Filesize

                            120KB

                          • memory/3784-134-0x0000000005ED0000-0x0000000005EF6000-memory.dmp

                            Filesize

                            152KB

                          • memory/3784-133-0x0000000005FD0000-0x0000000006062000-memory.dmp

                            Filesize

                            584KB

                          • memory/3784-132-0x0000000005DC0000-0x0000000005E06000-memory.dmp

                            Filesize

                            280KB

                          • memory/3784-131-0x00000000064E0000-0x0000000006A84000-memory.dmp

                            Filesize

                            5.6MB

                          • memory/3784-130-0x0000000000F40000-0x00000000014BA000-memory.dmp

                            Filesize

                            5.5MB

                          • memory/3784-129-0x000000007521E000-0x000000007521F000-memory.dmp

                            Filesize

                            4KB

                          • memory/4964-542-0x0000000000D90000-0x0000000000E07000-memory.dmp

                            Filesize

                            476KB