f3412d68fb65d951b94a826b5a9e9e3b1500afc69186df250e59e92a3d9ecf75

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 14:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
roblox-account-manager.exe
Size 21.6MB
Sample260823-rn3mesae39
SHA256 f3412d68fb65d951b94a826b5a9e9e3b1500afc69186df250e59e92a3d9ecf75
MD5 c29458f1dbb41366b91c5556398897e9
SHA1 6976fa75e06b9bd45f9ef453397565a913ad1576
SHA512 cdacd4e3be0ae54b2e5ac8c0e96ae26ab498d74707169b4171a6559f1f2dbb063a7a442d358fa0f803fbf762e4e29c27125ce66b92a4d0776d4b0377e6ef3120
SSDEEP 196608:JhurinCFew5TyHRvo2UNvmb4ljskN0LWYL/VG9gWhPCknkvpT:HurinCFew5TyHRvo/nskKWYrw9gWhPw
TLSH
T18F37F8617B5A9968D09BC47483474AB24E3130DF0B39B9FF448896392F79AF46F38358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	roblox-account-manager.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
15	raw.githubusercontent.com
19	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-af.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_2056382001\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-be.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-or.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_136981771\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_2056382001\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_2056382001\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_136981771\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_136981771\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_136981771\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-et.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-it.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-la.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-el.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-te.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_2056382001\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_136981771\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_2056382001\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_136981771\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-as.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-bn.hyb	msedgewebview2.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	roblox-account-manager.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	roblox-account-manager.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	roblox-account-manager.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5804	msedgewebview2.exe
5804	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4660	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4112	roblox-account-manager.exe
4112	roblox-account-manager.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4112	roblox-account-manager.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 4660	4112	roblox-account-manager.exe	89
PID 4660 wrote to memory of 1448	4660	msedgewebview2.exe	90
PID 4660 wrote to memory of 668	4660	msedgewebview2.exe	91
PID 4660 wrote to memory of 668	4660	msedgewebview2.exe	91
PID 4660 wrote to memory of 668	4660	msedgewebview2.exe	91
PID 4660 wrote to memory of 668	4660	msedgewebview2.exe	91
PID 4660 wrote to memory of 420	4660	msedgewebview2.exe	92
PID 4660 wrote to memory of 548	4660	msedgewebview2.exe	93
PID 4660 wrote to memory of 548	4660	msedgewebview2.exe	93
PID 4660 wrote to memory of 548	4660	msedgewebview2.exe	93
PID 4660 wrote to memory of 4460	4660	msedgewebview2.exe	94
PID 4660 wrote to memory of 4460	4660	msedgewebview2.exe	94
PID 4660 wrote to memory of 4460	4660	msedgewebview2.exe	94
PID 4660 wrote to memory of 4460	4660	msedgewebview2.exe	94
PID 4660 wrote to memory of 4460	4660	msedgewebview2.exe	94
PID 4660 wrote to memory of 2344	4660	msedgewebview2.exe	98
PID 4660 wrote to memory of 2344	4660	msedgewebview2.exe	98
PID 4660 wrote to memory of 2344	4660	msedgewebview2.exe	98
PID 4660 wrote to memory of 5444	4660	msedgewebview2.exe	99
PID 4660 wrote to memory of 5444	4660	msedgewebview2.exe	99
PID 4660 wrote to memory of 5444	4660	msedgewebview2.exe	99
PID 4660 wrote to memory of 5804	4660	msedgewebview2.exe	100
PID 4660 wrote to memory of 1552	4660	msedgewebview2.exe	101
PID 4660 wrote to memory of 1552	4660	msedgewebview2.exe	101
PID 4660 wrote to memory of 1552	4660	msedgewebview2.exe	101

C:\Users\Admin\AppData\Local\Temp\roblox-account-manager.exe
"C:\Users\Admin\AppData\Local\Temp\roblox-account-manager.exe"
1⤵
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=roblox-account-manager.exe --webview-exe-version=4.7.12 --user-data-dir="C:\Users\Admin\AppData\Local\com.niccdevs.roblox-account-manager\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection,CalculateNativeWinOcclusion --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4112.6020.2614388436342613445 /pfhostedapp:71f778796cddd8e018d50698e55935bef6178bb3
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.niccdevs.roblox-account-manager\EBWebView /prefetch:4 /pfhostedapp:71f778796cddd8e018d50698e55935bef6178bb3 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.niccdevs.roblox-account-manager\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x50,0x194,0x7fff8d145fd8,0x7fff8d145fe4,0x7fff8d145ff0
    3⤵
    PID:1448
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.niccdevs.roblox-account-manager\EBWebView" --webview-exe-name=roblox-account-manager.exe --webview-exe-version=4.7.12 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1784 --field-trial-handle=1788,i,9236214467543360408,5081050987568072174,262144 --enable-features=MojoIpcz --disable-features=CalculateNativeWinOcclusion,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:71f778796cddd8e018d50698e55935bef6178bb3
    3⤵
    PID:668
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.niccdevs.roblox-account-manager\EBWebView" --webview-exe-name=roblox-account-manager.exe --webview-exe-version=4.7.12 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2240 --field-trial-handle=1788,i,9236214467543360408,5081050987568072174,262144 --enable-features=MojoIpcz --disable-features=CalculateNativeWinOcclusion,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:71f778796cddd8e018d50698e55935bef6178bb3
    3⤵
    PID:420
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.niccdevs.roblox-account-manager\EBWebView" --webview-exe-name=roblox-account-manager.exe --webview-exe-version=4.7.12 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2296 --field-trial-handle=1788,i,9236214467543360408,5081050987568072174,262144 --enable-features=MojoIpcz --disable-features=CalculateNativeWinOcclusion,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:71f778796cddd8e018d50698e55935bef6178bb3
    3⤵
    PID:548
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.niccdevs.roblox-account-manager\EBWebView" --webview-exe-name=roblox-account-manager.exe --webview-exe-version=4.7.12 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3320 --field-trial-handle=1788,i,9236214467543360408,5081050987568072174,262144 --enable-features=MojoIpcz --disable-features=CalculateNativeWinOcclusion,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:71f778796cddd8e018d50698e55935bef6178bb3 /prefetch:1
    3⤵
    PID:4460
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.niccdevs.roblox-account-manager\EBWebView" --webview-exe-name=roblox-account-manager.exe --webview-exe-version=4.7.12 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4392 --field-trial-handle=1788,i,9236214467543360408,5081050987568072174,262144 --enable-features=MojoIpcz --disable-features=CalculateNativeWinOcclusion,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:71f778796cddd8e018d50698e55935bef6178bb3
    3⤵
    PID:2344
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.niccdevs.roblox-account-manager\EBWebView" --webview-exe-name=roblox-account-manager.exe --webview-exe-version=4.7.12 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4580 --field-trial-handle=1788,i,9236214467543360408,5081050987568072174,262144 --enable-features=MojoIpcz --disable-features=CalculateNativeWinOcclusion,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:71f778796cddd8e018d50698e55935bef6178bb3
    3⤵
    PID:5444
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.niccdevs.roblox-account-manager\EBWebView" --webview-exe-name=roblox-account-manager.exe --webview-exe-version=4.7.12 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2068 --field-trial-handle=1788,i,9236214467543360408,5081050987568072174,262144 --enable-features=MojoIpcz --disable-features=CalculateNativeWinOcclusion,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:71f778796cddd8e018d50698e55935bef6178bb3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5804
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.niccdevs.roblox-account-manager\EBWebView" --webview-exe-name=roblox-account-manager.exe --webview-exe-version=4.7.12 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4568 --field-trial-handle=1788,i,9236214467543360408,5081050987568072174,262144 --enable-features=MojoIpcz --disable-features=CalculateNativeWinOcclusion,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:71f778796cddd8e018d50698e55935bef6178bb3
    3⤵
    PID:1552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\com.niccdevs.roblox-account-manager\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 8d9637d26cb34b691b71fff47adc3df364dc34de397a2c2b61ed66aa390ddaee
MD5 c4cf06425bc45b4312e399874c6a0e62
SHA1 aa54a8068bcd9db5a557dc03d5799027a753a534
SHA512 5bd7eed7bfe3af7973e8a222c3efd0602d4d3868afed442d42179bdda4da973fefccc292cf1df863b3bc6524f3037ded746b00b96a6745d45d7031ffcced9590
TLSH
T103D01216BA820178C01034331142B10C1840C10F800580049438C56E3E280541912881
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.niccdevs.roblox-account-manager\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ac4bb73063a6456e3804583a7952ad1c01e4d88cde5cab2e6b78ee8947bd3e2d
MD5 a7f3542688dee7e12ef8cf617aba8968
SHA1 db569286060530a03b806a405d3b2e59393d1cb5
SHA512 9686137bf1b2dad7bdabd234145dd99b951c1a6fd6f5924d73e79fdc06a0158bc0e0921a8895ab9a39114d11f64dfbea9e89595e0cac1f55a41fee2cc61389ed
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.niccdevs.roblox-account-manager\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

612871cc-983a-41b4-b7bd-4c289d78399a.tmp

Path C:\Users\Admin\AppData\Local\com.niccdevs.roblox-account-manager\EBWebView\Default\612871cc-983a-41b4-b7bd-4c289d78399a.tmp
Size 6KB
SHA256 e5019aa1bd0c12eccdb67b3f7c5678240e3783351112a32a096aa433e9db0259
MD5 6035b6b98589ca727c2177a7053b2b6e
SHA1 a60792c9b4a980a8f3313bb6510a1786d58a97a4
SHA512 9d2160d89998ccf1f988e59b2eec07380c5df02c3f0a370bc2940e541a3289d16d8e4db6bb5bc3cfe36591dca4d9dbb7e160fc839738b9785e35e2bcda49175f
SSDEEP 96:stY/dFMDqb92k8o5h16Z0Es7/x+6MhmuecJ4y91ejeTK+gF28XM1C7K:st8rsfonEsV+Fd4y9QjFnG6K
TLSH
T154D173015E24797B4CC7F109BA29BB16E2F9A07275D51E5CEBF8952C08DA6CC230BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.niccdevs.roblox-account-manager\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 f34e44c56b76d6cfd4830f66d85130ba7f34838a0c836235b360fdb5219052d9
MD5 a158cbaa21466de6a520d283133a6e2a
SHA1 70b910cb84fe1337b6b356e9cfc6c27704f2b78b
SHA512 8b866ee4c64bec1c9b26bb6327a1602d03f7211a97c95b1f6b80ff19b4161e6caab812f56589e299e6b69211ec57e139f2faa5d27a97c4a2899a6aa7df405ba0
TLSH
T10CA002544A45D246C52807F124C185CC32706C5487030B12C9974979CD95FD45E55514
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59353f.TMP

Path C:\Users\Admin\AppData\Local\com.niccdevs.roblox-account-manager\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59353f.TMP
Size 48B
SHA256 795d069211f8d9859fbe141b7e400e7e79fa41cf20b9733f56bdc68e769bc405
MD5 0c3b39fff58e65d3ea9e603ed4dfaf0f
SHA1 734115c2b9790f5e64e43a1d3f920e537bdc1134
SHA512 3a655714aa5404000d89eaf70fb694eb81030433ca8a25cb4cc410c96fcd9bc5fce0bf5c41c0f2da0ef84266c55d719d0d7247c2a9042a8997d9422df0b113e5
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.niccdevs.roblox-account-manager\EBWebView\Default\Network\Network Persistent State
Size 821B
SHA256 3a9c347aab6ea5a252c9d9b48dd33928b8840f4c32d56e892c3570adf9ff90e8
MD5 3f89734e2555860013fd3d265ce50881
SHA1 ce0684eac15c533d286d00c06c64d6554b4f4409
SHA512 8da9c04f3e656c295440c071e4a1cda14553d0899aacd40d47e1a6998e1310f1e96814fcee743be23f4b23ee6f882ba166c3fd5203b44688dcae9376d4180dab
TLSH
T1B1018EA6C3E4C67D8A8156E427347C13CD3E051992283E27CDE9FBEA97E2475D21050F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59f94a.TMP

Path C:\Users\Admin\AppData\Local\com.niccdevs.roblox-account-manager\EBWebView\Default\Network\Network Persistent State~RFe59f94a.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.niccdevs.roblox-account-manager\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.niccdevs.roblox-account-manager\EBWebView\Default\Preferences
Size 6KB
SHA256 28618ff8c32ca831bbcfe3bada7f3182db6f3c9d9ad7f455444126d8843b69a6
MD5 d421e405f4d7d69048908d1a6682679d
SHA1 060dc34fdbe5d91a270f5fc024ef807d8b7079f9
SHA512 57a6df908542e24e32efd9d91cb5f6f020501278203ee68e49abd5470318eb5c17752119ea968ad4e04fc26f176d68e8ee6417579495283552b55558421be222
SSDEEP 96:stY/dFMiGqb92k8o5h16Z0Es7/x+6MhmuecJ4y91ejeTK+gg28XM1C7K:st8rifonEsV+Fd4y9QjFaG6K
TLSH
T1EAD173025E24697B4CC7E119BA29BB16D2F9A072B5D51E5CEBF8552C08DA6CC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.niccdevs.roblox-account-manager\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.niccdevs.roblox-account-manager\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.niccdevs.roblox-account-manager\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.niccdevs.roblox-account-manager\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.niccdevs.roblox-account-manager\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.niccdevs.roblox-account-manager\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.niccdevs.roblox-account-manager\EBWebView\Local State
Size 3KB
SHA256 8ab1b36c71a022cbcb5a0f6a317f2ac8d2776a325e7525c4df026b1a7e637b3c
MD5 de76c5e1371fc14c0717558b57ba33e0
SHA1 b9dd5866ad19ad9e2b0682bebd70eafb84b2ef2e
SHA512 1f1ddf0161e4e33cd60d9939b459423afa295beb78b199a22231f9a7f650418d44948d606524531a74060c4352901fc693f070c22d51f494eef8b32a4e0b794f
TLSH
T1FE6164376D65EA3B5DE39A08B8863B12ABA59037E9953F58DAEC0F1C01D73881341C23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.niccdevs.roblox-account-manager\EBWebView\Local State
Size 15KB
SHA256 1fdd407fdc52feac587e0ce7853fe96f9830e625b99274b67bdfb653a7abcb0c
MD5 61085f8f1e48df1549b33654a5028315
SHA1 dea01cf278925dcbd6df0068163ef9c58cdf3b44
SHA512 0f9079dd0fde73dcd91aef87a68c94a036cf2fc22e2d5008749192cc5bab676dd90089d987fc6923046f83ea74116cc188920c3108d657892f11ccf5f08fbac4
SSDEEP 384:d+aQikB+z/xvxjg/qhEwNBSCBy3V5SVAVdpwqX9zv:o/UxvxjgC+68uVUwqXFv
TLSH
T1DF729E2B59697E23A5F3EA097D4D5B8BCFF4C4B294C12EA84EAD5F0D06C72D80302C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.niccdevs.roblox-account-manager\EBWebView\Local State
Size 2KB
SHA256 1f52b50103eb0adcad81d0adc48c2db874a9359d8e9aecc44f3fda695c4b95dc
MD5 2417247ca7fcbce32c544f956ed3fc5f
SHA1 f25b0d0c793dc3ec56c562adaf89c1069b18a4e6
SHA512 b25f7c2320a9441b6da7b782a3fe971ca8495ed3de2bb523e814d5c54949f75a149b472322fa886c662d7b32bbed6351aa6f704fb76297de25ee3a34eade80e5
TLSH
T102515033AD15EB3799A3964C794B3E238E7590B5EE522F14AEDD0B1840D769C2305C33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58e412.TMP

Path C:\Users\Admin\AppData\Local\com.niccdevs.roblox-account-manager\EBWebView\Local State~RFe58e412.TMP
Size 1KB
SHA256 7aa2d7a172bee67e8e6dba35df0eca84cc7633ddcc264ee36327314223aa2104
MD5 943725a47af159b6697c2d174ba0959e
SHA1 b4001360f8e069ab21a78526661ee3621d8d1652
SHA512 8fa1f8ee84a3b0f6fbf934587201931f4fe282334d2c5d5ea90875fe8cc68e37b9f8ae21c2ad130804ff4902294700e31a3f9796945d4993c5bbb43c7208a8fe
TLSH
T1662162B3A9A4AB33AC82614D35477E435E7050BAD6514E04BEEE4B2805A76CC5719C33
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_92911744\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/668-27-0x00007FFFAE3F0000-0x00007FFFAE3F1000-memory.dmp

Download

memory/2344-263-0x00007FFFAEF00000-0x00007FFFAEF01000-memory.dmp

Download

memory/2344-262-0x00007FFFAD7A0000-0x00007FFFAD7A1000-memory.dmp

Download

memory/4460-89-0x00007FFFAE3F0000-0x00007FFFAE3F1000-memory.dmp

Download

memory/4460-206-0x000001C5E4C00000-0x000001C5E4C74000-memory.dmp

Download

memory/5804-344-0x00000195CF050000-0x00000195CF051000-memory.dmp

Download

memory/5804-345-0x00000195CF050000-0x00000195CF051000-memory.dmp

Download

memory/5804-343-0x00000195CF050000-0x00000195CF051000-memory.dmp

Download

memory/5804-342-0x00000195CF050000-0x00000195CF051000-memory.dmp

Download

memory/5804-346-0x00000195CF050000-0x00000195CF051000-memory.dmp

Download

memory/5804-347-0x00000195CF050000-0x00000195CF051000-memory.dmp

Download

memory/5804-338-0x00000195CF050000-0x00000195CF051000-memory.dmp

Download

memory/5804-336-0x00000195CF050000-0x00000195CF051000-memory.dmp

Download