File scan report
Verdict Suspicious
Is Roblox.
The archive has substantial risk indicators: 27 of the 67 antivirus engines that checked it detected it, including four major antivirus engines, and evidence from the test run…
Read the whole reasonShow less
Why Suspicious? 27 antivirus engines flag it and it created a file that is flagged as harmful.
Moderate evidence · More than one sign points to a problem, but nothing confirms it is harmful.
If it came from a link, an attachment or a stranger, delete it.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't open or extract it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already opened or extracted it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
27 of 67 flagged
- Flagged 27
- No detection 40
- No result 8
- Code signing Not applicable
- Test run Completed
- First seen 2y ago
Chapter 02
Why we think so
5 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The archive has substantial risk indicators: 27 of the 67 antivirus engines that checked it detected it, including four major antivirus engines, and evidence from the test run mapped to process injection, defense evasion, destructive activity, and targeting of the Windows password store. Labels do not converge on a named family, and no sandbox verdict or file it created result independently confirmed malware, so the evidence remains mixed but strongly concerning.
Twenty-seven of the 67 antivirus engines that checked it flagged the archive, with four independent major detections from DrWeb, Fortinet, Sophos, and Symantec. Detection names range from GameHack and unwanted program to generic trojan labels, and only DrWeb names Siggen31, so there is no strong family consensus. One completed sandbox recorded T1055, T1485, and T1562.001, plus evidence associated with access to the Windows password store, which is difficult to reconcile with an ordinary account-management utility. No sandbox supplied a malicious verdict, and none of the ten inspected children was confirmed malicious, although one child drew 30 of 75 detections. Five IP addresses were contacted, but no complete host-reputation result is available because that cross-check was not saved.
What We Detected
27 of the 67 antivirus engines that checked it flagged this ZIP archive. Four major antivirus engines—DrWeb, Fortinet, Sophos, and Symantec—contributed detections, but their labels vary between generic trojan, possible threat, unwanted program, and Siggen31. That disagreement supports a serious risk assessment without identifying a reliable named family.
Threat Behavior
The sample contacted five IP addresses directly, but the host-reputation cross-check was not completed or saved. No complete contacted-host reputation result was available. Ten files it created were inspected; none was confirmed malicious, although one was suspicious and had 30 of 75 engine detections.
What To Do Now
Do not open or extract this archive on a normal system. Quarantine or remove it while keeping security software enabled; if it already ran, disconnect the affected device from sensitive accounts, scan it fully, and change Roblox and other reused credentials from a separate trusted device.
Where this verdict could be wrong3 caveats
- No dropped file is known to be malicious; only one of 10 inspected children was rated suspicious.
- The file is established rather than with prevalence showing 3,717 sources and 34,985 submissions.
- No community YARA rule matched and the hash is not in the known-software reference database, but absent intelligence hits may reflect coverage gaps.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No strong major family consensus
- 13 of 17 major antivirus engines did not detect the file
- No malicious sandbox verdict was recorded
- No inspected child was confirmed malicious
- The archive is widely submitted and more than two years old
- 27/67 antivirus detections
- Four independent major detections
- defense-evasion evidence
- destructive-activity mapping
- One file it created had 30/67 detections
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 20sandbox rule tags
- 7spawned processes
- 5network contacts
- 33filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Ran commands or a script on the test computer.
Moderate concern: Checked whether it was running on a test computer.
Moderate concern: Hid files or windows on the test computer.
Note: Deleted files or logs during the test run (installers often clean up after themselves).
Note: Talked to servers over the internet during the test run.
Note: Read basic details of the test computer, such as its Windows version.
Note: Loaded extra code modules while running.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: A sandbox rule tagged this run as recording keystrokes; no keylogging was confirmed.
Not confirmed: A sandbox rule tagged this run as weakening security settings; no setting change was recorded.
Not confirmed: A sandbox rule tagged this run as changing how Windows loads code; nothing confirms it.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 7: FileSeen in the test run
Roblox.Account.Manager.3.7.2.zip
49b2c015da0851a2ed43820799a7bcda08e1bc5f315e107598f87f4b1bd36dac
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 7: ProcessSeen in the test run
Roblox Account Manager.exe
"C:\Users\<USER>\AppData\Local\Temp\Roblox Account Manager.exe"
Test run - Evidence 3 of 7: ProcessSeen in the test run
Roblox Account Manager.exe
"C:\Users\<USER>\AppData\Local\Temp\Roblox Account Manager.exe" -restart
Test run - +1 more recorded observation
- 2
Files
Created or changed
- Evidence 4 of 7: Dropped fileWorked out from other results
be9ddcdedf8c36c64e6b0a32d2686b74a112913c54217ccaa46675bfd1dc82f1
A file it created, rated suspicious.
Files it created - Evidence 5 of 7: Written fileSeen in the test run
0.ram
C:\Users\<USER>\AppData\Local\Temp\0.ram
Test run - +1 more recorded observation
- 2
Network
Hosts contacted
- Evidence 6 of 7: Contacted hostSeen in the test run
96.7.157.221
Contacted during the test run.
Test run - Evidence 7 of 7: Contacted hostSeen in the test run
140.82.116.5
Contacted during the test run.
Test run - +1 more recorded observation
7 facts from the test run. See the full activity list.
Includes 20 mapped techniques, every process, file, registry and network entry and 10 dropped files.
Show the technical evidenceChapter 04
Technical details
27 of the 67 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 27
- DrWeb (major engine)Trojan.Siggen31.53765
- Fortinet (major engine)PossibleThreat
- Sophos (major engine)Generic Reputation PUA (PUA)
- Symantec (major engine)Trojan.Gen.NPE
- TrellixENS (major engine)Artemis!334728F32A11
- AhnLab-V3Unwanted/Win.GameHack.C5799402
- alibabacloudTrojan:Unknow/Vigua.A
- Antiy-AVLGrayWare[AdWare]/Win32.Gamehack
File fingerprint
- Last analyzed
- Sep 9, 2026, 8:12 PM UTC
- SHA-256
49b2c015da0851a2ed43820799a7bcda08e1bc5f315e107598f87f4b1bd36dac- SHA-1
0e33eeff9b625fceb2d2d0195e6f32523d57db79- MD5
d58b79cb3d3635ba963427362f75d075
About this file
Roblox.Account.Manager.3.7.2.zip is a ZIP file of 4.4 MB.
- Type and size
- ZIP · 4.4 MB
- Signer
- Not applicable
- First seen
- Jul 18, 2024On VirusTotal.
- Submitted by
- 3,717 distinct sources
First scanned
Includes every engine result (75), 1 matched signature rule and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Roblox.Account.Manager.3.7.2.zip safe, or is it malware?
What is Roblox.Account.Manager.3.7.2.zip?
How many antivirus engines detected Roblox.Account.Manager.3.7.2.zip?
What should I do if I already opened or extracted Roblox.Account.Manager.3.7.2.zip?
What is the SHA-256 hash of Roblox.Account.Manager.3.7.2.zip?
How up to date is this analysis of Roblox.Account.Manager.3.7.2.zip?
Community
Member reviews and reports for this exact file hash.