File name: | Roblox Account Manager.exe |
Full analysis: | https://app.any.run/tasks/a821a8f5-493c-4ece-8dab-f5ddd76141bd |
Verdict: | Malicious activity |
Analysis date: | January 01, 2024, 22:18:31 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows |
MD5: | A057FAE0C8C97EE6CF2C12FB7BCF034D |
SHA1: | 64FE0EB242B5C3F9C42F4F2C1685E4A36708E4F6 |
SHA256: | CDB0A360CCA7A5099C2D2357BE1A833E032FFDEB3F467A6FAC845F6BB77031C9 |
SSDEEP: | 98304:b2bT1Qm7d9GP4i7q0LTWgtUmWzmSyZs9S8Z/LywnrSkqXf0Fb7WnhNMYkj7z:4Qm59q/tUhzmS9zZ/mY+kSIb7ahNMYkX |
.exe | | | Generic CIL Executable (.NET, Mono, etc.) (56.7) |
---|---|---|
.exe | | | Win64 Executable (generic) (21.3) |
.scr | | | Windows screen saver (10.1) |
.dll | | | Win32 Dynamic Link Library (generic) (5) |
.exe | | | Win32 Executable (generic) (3.4) |
MachineType: | Intel 386 or later, and compatibles |
---|---|
TimeStamp: | 2047:11:22 09:58:55+01:00 |
ImageFileCharacteristics: | Executable, Large address aware, 32-bit |
PEType: | PE32 |
LinkerVersion: | 48 |
CodeSize: | 5446656 |
InitializedDataSize: | 31232 |
UninitializedDataSize: | - |
EntryPoint: | 0x533a7e |
OSVersion: | 4 |
ImageVersion: | - |
SubsystemVersion: | 6 |
Subsystem: | Windows GUI |
FileVersionNumber: | 3.6.1.0 |
ProductVersionNumber: | 3.6.1.0 |
FileFlagsMask: | 0x003f |
FileFlags: | (none) |
FileOS: | Win32 |
ObjectFileType: | Executable application |
FileSubtype: | - |
LanguageCode: | Neutral |
CharacterSet: | Unicode |
Comments: | Created by ic3w0lf |
CompanyName: | ic3 |
FileDescription: | Roblox Account Manager |
FileVersion: | 3.6.1.0 |
InternalName: | Roblox Account Manager.exe |
LegalCopyright: | Copyright © ic3 2023 |
LegalTrademarks: | - |
OriginalFileName: | Roblox Account Manager.exe |
ProductName: | Roblox Account Manager |
ProductVersion: | 3.6.1.0 |
AssemblyVersion: | 1.0.0.0 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
128 | "C:\Users\admin\AppData\Local\Temp\Roblox Account Manager.exe" | C:\Users\admin\AppData\Local\Temp\Roblox Account Manager.exe | — | explorer.exe | |||||||||||
User: admin Company: ic3 Integrity Level: MEDIUM Description: Roblox Account Manager Exit code: 0 Version: 3.6.1.0 Modules
| |||||||||||||||
392 | "C:\Users\admin\AppData\Local\Temp\Roblox Account Manager.exe" -restart | C:\Users\admin\AppData\Local\Temp\Roblox Account Manager.exe | Roblox Account Manager.exe | ||||||||||||
User: admin Company: ic3 Integrity Level: MEDIUM Description: Roblox Account Manager Exit code: 0 Version: 3.6.1.0 Modules
| |||||||||||||||
924 | "C:\Users\admin\AppData\Local\Temp\x86\CefSharp.BrowserSubprocess.exe" --type=gpu-process --no-sandbox --lang=en-US --user-data-dir="C:\Users\admin\AppData\Local\CEF\User Data" --cefsharpexitsub --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --log-file="C:\Users\admin\AppData\Local\Temp\debug.log" --mojo-platform-channel-handle=3216 --field-trial-handle=2604,i,16750660838742707571,8925980623851839888,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2 --host-process-id=392 | C:\Users\admin\AppData\Local\Temp\x86\CefSharp.BrowserSubprocess.exe | — | Roblox Account Manager.exe | |||||||||||
User: admin Company: The CefSharp Authors Integrity Level: MEDIUM Description: CefSharp.BrowserSubprocess Exit code: 0 Version: 109.1.110.0 Modules
| |||||||||||||||
1112 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=109.0.5414.149 "--annotation=exe=C:\Program Files\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win32 "--annotation=prod=Microsoft Edge" --annotation=ver=109.0.1518.115 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd8,0x6d6df598,0x6d6df5a8,0x6d6df5b4 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
1172 | "C:\Users\admin\AppData\Local\Temp\x86\CefSharp.BrowserSubprocess.exe" --type=renderer --user-data-dir="C:\Users\admin\AppData\Local\CEF\User Data" --cefsharpexitsub --no-sandbox --log-file="C:\Users\admin\AppData\Local\Temp\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=4004 --field-trial-handle=2604,i,16750660838742707571,8925980623851839888,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker --host-process-id=392 /prefetch:1 | C:\Users\admin\AppData\Local\Temp\x86\CefSharp.BrowserSubprocess.exe | — | Roblox Account Manager.exe | |||||||||||
User: admin Company: The CefSharp Authors Integrity Level: MEDIUM Description: CefSharp.BrowserSubprocess Exit code: 0 Version: 109.1.110.0 Modules
| |||||||||||||||
1772 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\admin\AppData\Local\Temp\manual install instructions.html | C:\Program Files\Microsoft\Edge\Application\msedge.exe | Roblox Account Manager.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
1840 | "C:\Windows\System32\cmd.exe" /c mkdir "C:\Users\admin\AppData\Local\Temp" | C:\Windows\System32\cmd.exe | — | Roblox Account Manager.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
1900 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1660 --field-trial-handle=1372,i,18076276220924257981,25625740866318803,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
2296 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1480 --field-trial-handle=1372,i,18076276220924257981,25625740866318803,131072 /prefetch:3 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | msedge.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
2348 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1320 --field-trial-handle=1372,i,18076276220924257981,25625740866318803,131072 /prefetch:2 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
|
(PID) Process: | (128) Roblox Account Manager.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (128) Roblox Account Manager.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (128) Roblox Account Manager.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
(PID) Process: | (128) Roblox Account Manager.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 0 | |||
(PID) Process: | (392) Roblox Account Manager.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (392) Roblox Account Manager.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (392) Roblox Account Manager.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (392) Roblox Account Manager.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
(PID) Process: | (392) Roblox Account Manager.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 0 | |||
(PID) Process: | (1772) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon |
Operation: | write | Name: | failed_count |
Value: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
1772 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RFe8c5d.TMP | — | |
MD5:— | SHA256:— | |||
1772 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old | — | |
MD5:— | SHA256:— | |||
392 | Roblox Account Manager.exe | C:\Users\admin\AppData\Local\Temp\AccountData.json | binary | |
MD5:EBA6184CB7F5D7C151BE2DE9FA815133 | SHA256:EAFD75E8B1CEE9BCE173F7698DF4BA940E3FB49E997875FB6321697A1A95904D | |||
1772 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RFe8c8c.TMP | — | |
MD5:— | SHA256:— | |||
1772 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old | — | |
MD5:— | SHA256:— | |||
1772 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RFe8c9c.TMP | — | |
MD5:— | SHA256:— | |||
392 | Roblox Account Manager.exe | C:\Users\admin\AppData\Local\Temp\RAMSettings.ini | text | |
MD5:8EC667B649FC01D48534D916EB92743C | SHA256:A90DFE16AD4261034717B4B97982A84694A15607964A1750144C4F140E3D2D9F | |||
1772 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old~RFe8d76.TMP | — | |
MD5:— | SHA256:— | |||
1772 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old | — | |
MD5:— | SHA256:— | |||
392 | Roblox Account Manager.exe | C:\Users\admin\AppData\Local\Temp\manual install instructions.html | html | |
MD5:9568274D63E97CBACC86FB088BD5B678 | SHA256:71D1587D606412C174A7EB43E99969EC4EA3F9DB90EA4723E71CA89AD717A1E5 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
856 | svchost.exe | HEAD | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3 | unknown | — | — | — |
856 | svchost.exe | GET | 206 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3 | unknown | binary | 10.1 Kb | — |
856 | svchost.exe | GET | 206 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3 | unknown | binary | 10.1 Kb | — |
856 | svchost.exe | GET | 206 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3 | unknown | binary | 5.58 Kb | — |
856 | svchost.exe | GET | 206 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3 | unknown | binary | 9.94 Kb | — |
856 | svchost.exe | GET | 206 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3 | unknown | binary | 31.9 Kb | — |
856 | svchost.exe | GET | 206 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3 | unknown | binary | 20.7 Kb | — |
856 | svchost.exe | GET | 206 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3 | unknown | binary | 79.3 Kb | — |
856 | svchost.exe | GET | 206 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3 | unknown | binary | 162 Kb | — |
856 | svchost.exe | GET | 206 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3 | unknown | binary | 342 Kb | — |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | unknown |
4 | System | 192.168.100.255:137 | — | — | — | unknown |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
392 | Roblox Account Manager.exe | 23.35.230.74:443 | aka.ms | AKAMAI-AS | DE | unknown |
392 | Roblox Account Manager.exe | 140.82.121.5:443 | api.github.com | GITHUB | US | unknown |
392 | Roblox Account Manager.exe | 140.82.121.4:443 | github.com | GITHUB | US | unknown |
392 | Roblox Account Manager.exe | 128.116.122.4:443 | clientsettings.roblox.com | ROBLOX-PRODUCTION | US | unknown |
392 | Roblox Account Manager.exe | 185.199.109.133:443 | raw.githubusercontent.com | FASTLY | US | unknown |
1772 | msedge.exe | 239.255.255.250:1900 | — | — | — | unknown |
2296 | msedge.exe | 13.107.42.16:443 | config.edge.skype.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | unknown |
Domain | IP | Reputation |
---|---|---|
aka.ms |
| unknown |
api.github.com |
| unknown |
github.com |
| unknown |
clientsettings.roblox.com |
| unknown |
raw.githubusercontent.com |
| unknown |
objects.githubusercontent.com |
| unknown |
config.edge.skype.com |
| unknown |
edge.microsoft.com |
| unknown |
cdnjs.cloudflare.com |
| unknown |
www.youtube.com |
| unknown |
Process | Message |
---|---|
CefSharp.BrowserSubprocess.exe | [0101/222103.295:ERROR:gl_display.cc(932)] eglInitialize D3D11 failed with error EGL_NOT_INITIALIZED, trying next display type
|
CefSharp.BrowserSubprocess.exe | [0101/222103.295:ERROR:gl_display.cc(508)] EGL Driver message (Critical) eglInitialize: No available renderers.
|
CefSharp.BrowserSubprocess.exe | [0101/222104.415:ERROR:gl_display.cc(932)] eglInitialize D3D9 failed with error EGL_NOT_INITIALIZED
|
CefSharp.BrowserSubprocess.exe | [0101/222104.415:ERROR:gl_display.cc(508)] EGL Driver message (Critical) eglInitialize: No available renderers.
|
CefSharp.BrowserSubprocess.exe | [0101/222104.415:ERROR:gl_initializer_win.cc(133)] GLDisplayEGL::Initialize failed.
|
CefSharp.BrowserSubprocess.exe | [0101/222104.415:ERROR:viz_main_impl.cc(186)] Exiting GPU process due to errors during initialization
|
CefSharp.BrowserSubprocess.exe | [0101/222104.634:ERROR:command_buffer_proxy_impl.cc(128)] ContextResult::kTransientFailure: Failed to send GpuControl.CreateCommandBuffer.
|
Roblox Account Manager.exe | [0101/222105.426:INFO:CONSOLE(16)] "WARNING: Tried to load AngularJS more than once.", source: https://js.rbxcdn.com/edc66704bd1974195d8c60f4a163441bec82f1bcb11c492e7df07c43f45a4d49.js (16)
|
Roblox Account Manager.exe | [0101/222105.610:INFO:CONSOLE(16)] "The namespace Purchasing.PurchaseDialog was not found", source: https://js.rbxcdn.com/edc66704bd1974195d8c60f4a163441bec82f1bcb11c492e7df07c43f45a4d49.js (16)
|
Roblox Account Manager.exe | [0101/222105.661:INFO:CONSOLE(16)] "
_______ _________ _____ ______ _
/ _____ \ |____ ____| / ___ \ | ____ \ | |
/ / \_\ | | / / \ \ | | \ \ | |
| | | | / / \ \ | | | | | |
\ \______ | | | | | | | |___/ / | |
\______ \ | | | | | | | ____/ | |
\ \ | | | | | | | | | |
_ | | | | \ \ / / | | |_|
\ \_____/ / | | \ \___/ / | | _
\_______/ |_| \_____/ |_| |_|
Keep your account safe! Do not send any information from
here to anyone or paste any text here.
If someone is asking you to copy or paste text here then
you're giving someone access to your account, your gear,
and your Robux.
To learn more about keeping your account safe you can go to
https://www.roblox.com/info/account-safety", source: https://js.rbxcdn.com/edc66704bd1974195d8c60f4a163441bec82f1bcb11c492e7df07c43f45a4d49.js (16)
|