File name:

zapret-roblox_1.9.0b.rar

Full analysis: https://app.any.run/tasks/0818c59b-4704-4782-be93-45c7f1dfabaa
Verdict: Malicious activity
Analysis date: December 10, 2025, 13:51:21
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
arch-doc
windivert-sys
mal-driver
github
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

1243A6143E8996A7BB58A67D9256CC7C

SHA1:

DFADCB33931CBB779766F05787C5A0BD321320D8

SHA256:

1F7229BE0BF5A29F6990A8EF1D6B14D4203F76FB7D0A278500298F578B3C3053

SSDEEP:

49152:sb4FMyNCQMf5udb/DNj7Ze9rm45sDC69wDe1fwTCFvppsBS9VWIwQtkcTSHWdvpo:sb4utV58b/Jj789rv5D6uDefjFvppr9a

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Malicious driver has been detected

      • WinRAR.exe (PID: 7556)

    • Detects Cygwin installation

      • WinRAR.exe (PID: 7556)

  • SUSPICIOUS

    • Drops a system driver (possible attempt to evade defenses)

      • WinRAR.exe (PID: 7556)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 2360)
      • cmd.exe (PID: 7388)
      • cmd.exe (PID: 4768)
      • cmd.exe (PID: 7724)

    • Starts application with an unusual extension

      • cmd.exe (PID: 7388)
      • cmd.exe (PID: 412)
      • cmd.exe (PID: 7976)
      • cmd.exe (PID: 4768)

    • Suspicious use of NETSH.EXE

      • cmd.exe (PID: 7388)
      • cmd.exe (PID: 4768)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 7388)
      • cmd.exe (PID: 412)
      • cmd.exe (PID: 4768)
      • cmd.exe (PID: 7976)

    • Windows service management via SC.EXE

      • sc.exe (PID: 4508)
      • sc.exe (PID: 7960)

    • Application launched itself

      • cmd.exe (PID: 7388)
      • cmd.exe (PID: 4768)
      • cmd.exe (PID: 412)
      • cmd.exe (PID: 7976)

    • Hides command output

      • cmd.exe (PID: 3168)
      • cmd.exe (PID: 7896)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 2360)
      • cmd.exe (PID: 7724)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 3168)
      • cmd.exe (PID: 7896)

  • INFO

    • The sample compiled with english language support

      • WinRAR.exe (PID: 7556)

    • Changes the display of characters in the console

      • cmd.exe (PID: 7388)
      • cmd.exe (PID: 412)
      • cmd.exe (PID: 7976)
      • cmd.exe (PID: 4768)

    • Disables trace logs

      • netsh.exe (PID: 7328)
      • netsh.exe (PID: 2428)
      • powershell.exe (PID: 6296)
      • powershell.exe (PID: 7876)
      • netsh.exe (PID: 5016)
      • netsh.exe (PID: 8064)

    • Checks supported languages

      • chcp.com (PID: 1368)
      • chcp.com (PID: 5156)
      • chcp.com (PID: 5984)
      • winws.exe (PID: 3568)
      • chcp.com (PID: 7720)
      • chcp.com (PID: 8036)
      • winws.exe (PID: 2628)
      • chcp.com (PID: 7888)
      • winws.exe (PID: 680)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7556)

    • Manual execution by a user

      • cmd.exe (PID: 7388)
      • cmd.exe (PID: 4768)
      • winws.exe (PID: 2288)
      • winws.exe (PID: 680)

    • Reads the computer name

      • winws.exe (PID: 3568)
      • winws.exe (PID: 2628)
      • winws.exe (PID: 680)

    • Checks proxy server information

      • powershell.exe (PID: 6296)
      • powershell.exe (PID: 7876)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion: RAR v5
CompressedSize: 972491
UncompressedSize: 2954293
OperatingSystem: Win32
ArchivedFileName: zapret-roblox/bin/cygwin1.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
184
Monitored processes
42
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start THREAT winrar.exe cmd.exe no specs conhost.exe no specs chcp.com no specs cmd.exe no specs sc.exe no specs findstr.exe no specs netsh.exe no specs findstr.exe no specs findstr.exe no specs netsh.exe no specs cmd.exe no specs chcp.com no specs chcp.com no specs winws.exe no specs cmd.exe no specs powershell.exe winws.exe no specs winws.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs cmd.exe no specs sc.exe no specs findstr.exe no specs netsh.exe no specs findstr.exe no specs findstr.exe no specs netsh.exe no specs cmd.exe no specs chcp.com no specs chcp.com no specs winws.exe no specs cmd.exe no specs powershell.exe winws.exe no specs winws.exe conhost.exe no specs winws.exe no specs winws.exe conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
412C:\WINDOWS\system32\cmd.exe /K service check_updates softC:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
680"C:\Users\admin\Desktop\zapret-roblox\bin\winws.exe" C:\Users\admin\Desktop\zapret-roblox\bin\winws.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\desktop\zapret-roblox\bin\winws.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\users\admin\desktop\zapret-roblox\bin\cygwin1.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1176findstr /i "enabled" C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1368chcp 437 C:\Windows\System32\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Change CodePage Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
2016"C:\Users\admin\Desktop\zapret-roblox\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,1024-65535 --wf-udp=443,19294-19344,50000-50100,1024-65535 --filter-udp=443 --hostlist="C:\Users\admin\Desktop\zapret-roblox\lists\list-general.txt" --hostlist-exclude="C:\Users\admin\Desktop\zapret-roblox\lists\list-exclude.txt" --ipset-exclude="C:\Users\admin\Desktop\zapret-roblox\lists\ipset-exclude.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\admin\Desktop\zapret-roblox\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=multisplit --dpi-desync-split-seqovl=568 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\admin\Desktop\zapret-roblox\bin\tls_clienthello_4pda_to.bin" --new --filter-tcp=443 --hostlist="C:\Users\admin\Desktop\zapret-roblox\lists\list-google.txt" --ip-id=zero --dpi-desync=multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\admin\Desktop\zapret-roblox\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\admin\Desktop\zapret-roblox\lists\list-general.txt" --hostlist-exclude="C:\Users\admin\Desktop\zapret-roblox\lists\list-exclude.txt" --ipset-exclude="C:\Users\admin\Desktop\zapret-roblox\lists\ipset-exclude.txt" --dpi-desync=multisplit --dpi-desync-split-seqovl=568 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\admin\Desktop\zapret-roblox\bin\tls_clienthello_4pda_to.bin" --new --filter-udp=443 --ipset="C:\Users\admin\Desktop\zapret-roblox\lists\ipset-all.txt" --hostlist-exclude="C:\Users\admin\Desktop\zapret-roblox\lists\list-exclude.txt" --ipset-exclude="C:\Users\admin\Desktop\zapret-roblox\lists\ipset-exclude.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\admin\Desktop\zapret-roblox\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,1024-65535 --ipset="C:\Users\admin\Desktop\zapret-roblox\lists\ipset-all.txt" --hostlist-exclude="C:\Users\admin\Desktop\zapret-roblox\lists\list-exclude.txt" --ipset-exclude="C:\Users\admin\Desktop\zapret-roblox\lists\ipset-exclude.txt" --dpi-desync=multisplit --dpi-desync-split-seqovl=568 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\admin\Desktop\zapret-roblox\bin\tls_clienthello_4pda_to.bin" --new --filter-udp=1024-65535 --ipset="C:\Users\admin\Desktop\zapret-roblox\lists\ipset-all.txt" --ipset-exclude="C:\Users\admin\Desktop\zapret-roblox\lists\ipset-exclude.txt" --dpi-desync=fake --dpi-desync-autottl=2 --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\admin\Desktop\zapret-roblox\bin\quic_initial_www_google_com.bin" --dpi-desync-cutoff=n2C:\Users\admin\Desktop\zapret-roblox\bin\winws.exe—cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\zapret-roblox\bin\winws.exe
c:\windows\system32\ntdll.dll
2288findstr /i "STATE"C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2288"C:\Users\admin\Desktop\zapret-roblox\bin\winws.exe" C:\Users\admin\Desktop\zapret-roblox\bin\winws.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\zapret-roblox\bin\winws.exe
c:\windows\system32\ntdll.dll
2360C:\WINDOWS\system32\cmd.exe /c sc query "zapret" | findstr /i "STATE"C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
2428netsh interface tcp set global timestamps=enabled C:\Windows\System32\netsh.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2628"C:\Users\admin\Desktop\zapret-roblox\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,1024-65535 --wf-udp=443,19294-19344,50000-50100,1024-65535 --filter-udp=443 --hostlist="C:\Users\admin\Desktop\zapret-roblox\lists\list-general.txt" --hostlist-exclude="C:\Users\admin\Desktop\zapret-roblox\lists\list-exclude.txt" --ipset-exclude="C:\Users\admin\Desktop\zapret-roblox\lists\ipset-exclude.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\admin\Desktop\zapret-roblox\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake --dpi-desync-fake-tls-mod=none --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --new --filter-tcp=443 --hostlist="C:\Users\admin\Desktop\zapret-roblox\lists\list-google.txt" --ip-id=zero --dpi-desync=fake --dpi-desync-fake-tls-mod=none --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --new --filter-tcp=80,443 --hostlist="C:\Users\admin\Desktop\zapret-roblox\lists\list-general.txt" --hostlist-exclude="C:\Users\admin\Desktop\zapret-roblox\lists\list-exclude.txt" --ipset-exclude="C:\Users\admin\Desktop\zapret-roblox\lists\ipset-exclude.txt" --dpi-desync=fake --dpi-desync-fake-tls-mod=none --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --new --filter-udp=443 --ipset="C:\Users\admin\Desktop\zapret-roblox\lists\ipset-all.txt" --hostlist-exclude="C:\Users\admin\Desktop\zapret-roblox\lists\list-exclude.txt" --ipset-exclude="C:\Users\admin\Desktop\zapret-roblox\lists\ipset-exclude.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\admin\Desktop\zapret-roblox\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,1024-65535 --ipset="C:\Users\admin\Desktop\zapret-roblox\lists\ipset-all.txt" --hostlist-exclude="C:\Users\admin\Desktop\zapret-roblox\lists\list-exclude.txt" --ipset-exclude="C:\Users\admin\Desktop\zapret-roblox\lists\ipset-exclude.txt" --dpi-desync=fake --dpi-desync-fake-tls-mod=none --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --new --filter-udp=1024-65535 --ipset="C:\Users\admin\Desktop\zapret-roblox\lists\ipset-all.txt" --ipset-exclude="C:\Users\admin\Desktop\zapret-roblox\lists\ipset-exclude.txt" --dpi-desync=fake --dpi-desync-autottl=2 --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\admin\Desktop\zapret-roblox\bin\quic_initial_www_google_com.bin" --dpi-desync-cutoff=n2C:\Users\admin\Desktop\zapret-roblox\bin\winws.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\desktop\zapret-roblox\bin\winws.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\users\admin\desktop\zapret-roblox\bin\cygwin1.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
13 299
Read events
13 276
Write events
23
Delete events
0

Modification events

(PID) Process:(7556) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7556) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7556) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7556) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\zapret-roblox_1.9.0b.rar
(PID) Process:(7556) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7556) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7556) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7556) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7556) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
(PID) Process:(7556) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
Executable files
4
Suspicious files
4
Text files
29
Unknown types
0

Dropped files

PID
Process
Filename
Type
7556WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7556.33367\zapret-roblox\bin\game_filter.enabledtext
MD5:9E57D6BDA4BEC067FF636FE400AF6EA5
SHA256:02FA0E83883800772EC3462347E9A9F623FA3E13BE7D4DE7E0B2CB7E425AB212
7556WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7556.33367\zapret-roblox\bin\quic_initial_www_google_com.binbinary
MD5:312526D39958D89B1F8AB67789AB985F
SHA256:F4589C57749F956BB30538197A521D7005F8B0A8723B4707E72405E51DDAC50A
7556WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7556.33367\zapret-roblox\bin\tls_clienthello_4pda_to.binbinary
MD5:E6D649DE132C3C10CB62531EF74F5B73
SHA256:EEFEAF09DDE8D69B1F176212541F63C68B314A33A335ECED99A8A29F17254DA8
7556WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7556.33367\zapret-roblox\bin\winws.exeexecutable
MD5:F94C4B0110FECCD6AECA48C93B278D8B
SHA256:31D68A175ABEBAB19F7F39BF6D0845EC5C18AB653EEEEA6EE830B22D799B7E55
7556WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7556.33367\zapret-roblox\bin\WinDivert64.sysexecutable
MD5:89ED5BE7EA83C01D0DE33D3519944AA5
SHA256:8DA085332782708D8767BCACE5327A6EC7283C17CFB85E40B03CD2323A90DDC2
7556WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7556.33367\zapret-roblox\bin\WinDivert.dllexecutable
MD5:B2014D33EE645112D5DC16FE9D9FCBFF
SHA256:C1E060EE19444A259B2162F8AF0F3FE8C4428A1C6F694DCE20DE194AC8D7D9A2
7556WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7556.33367\zapret-roblox\general (ALT).battext
MD5:A5DE0FB5BEF76003C74034271B70BCC6
SHA256:BDFA28F0F299672EB074026780FDB19A52ED1732810E674E80F4C1890F8AEDC1
7556WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7556.33367\zapret-roblox\general (ALT4).battext
MD5:AEEE5054DB95EF77E520B3455FE47FA9
SHA256:46409E3C9239057702E03EB6896277B8904CA529D842D72A938A34B0C2B18CBC
7556WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7556.33367\zapret-roblox\general (ALT6).battext
MD5:40A8A46561C45B0D0D7465D69D0712AD
SHA256:1D61E089D24979779EBB14756FF1FFD1936782E6A45EDFF9B6E4FA6051C34C7F
7556WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7556.33367\zapret-roblox\general (ALT10).battext
MD5:666394850863BC1DCE5FA24A49A9D3EA
SHA256:652207A70A993EBCF02FD2463F5E9593AC593FFB75D84EC4B8871CF8D84033C1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
27
DNS requests
17
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
224
svchost.exe
GET
200
23.52.181.212:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
224
svchost.exe
GET
200
23.216.77.33:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4140
svchost.exe
GET
200
172.66.2.5:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7772
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7772
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.3.crl
unknown
—
—
whitelisted
7772
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7772
SIHClient.exe
GET
200
23.216.77.34:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
7772
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.3.crl
unknown
—
—
whitelisted
7772
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl
unknown
—
—
whitelisted
7772
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
224
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6768
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1136
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
92.123.104.49:443
www.bing.com
AKAMAI-ASN1
NL
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
4140
svchost.exe
20.190.159.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4140
svchost.exe
172.66.2.5:80
ocsp.digicert.com
CLOUDFLARENET
US
whitelisted
224
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
224
svchost.exe
23.216.77.33:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
  • 40.127.240.158
whitelisted
www.bing.com
  • 92.123.104.49
  • 92.123.104.63
  • 92.123.104.47
  • 92.123.104.59
  • 92.123.104.58
  • 92.123.104.56
  • 92.123.104.50
  • 92.123.104.62
  • 92.123.104.45
whitelisted
google.com
  • 142.250.185.142
whitelisted
login.live.com
  • 20.190.159.0
  • 20.190.159.129
  • 40.126.31.71
  • 40.126.31.1
  • 40.126.31.128
  • 20.190.159.64
  • 20.190.159.73
  • 40.126.31.3
whitelisted
ocsp.digicert.com
  • 172.66.2.5
  • 162.159.142.9
whitelisted
crl.microsoft.com
  • 23.216.77.33
  • 23.216.77.25
  • 23.216.77.30
  • 23.216.77.34
  • 23.216.77.18
  • 23.216.77.23
  • 23.216.77.20
  • 23.216.77.28
  • 23.216.77.26
  • 23.216.77.35
  • 23.216.77.22
  • 23.216.77.38
whitelisted
www.microsoft.com
  • 23.52.181.212
  • 88.221.169.152
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
raw.githubusercontent.com
  • 185.199.108.133
  • 185.199.111.133
  • 185.199.109.133
  • 185.199.110.133
whitelisted
slscr.update.microsoft.com
  • 74.179.77.204
whitelisted

Threats

PID
Process
Class
Message
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
2292
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
zapret-roblox_1.9.0b.rar