File name:

49b2c015da0851a2ed43820799a7bcda08e1bc5f315e107598f87f4b1bd36dacRoblox.Account.Manager.3.7.2.zip

Full analysis: https://app.any.run/tasks/0b6cae12-a96b-40a4-831c-f5727b75d95e
Verdict: Malicious activity
Analysis date: June 21, 2025, 18:55:29
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
github
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

D58B79CB3D3635BA963427362F75D075

SHA1:

0E33EEFF9B625FCEB2D2D0195E6F32523D57DB79

SHA256:

49B2C015DA0851A2ED43820799A7BCDA08E1BC5F315E107598F87F4B1BD36DAC

SSDEEP:

98304:lEQBRQV3BdUKmD4I3UV5AaONlAUntE4vA0j1Yfyb/plXAWyz7N9j/SfH1e7zWIQ7:XcGtpl

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 1668)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Roblox Account Manager.exe (PID: 416)
      • Roblox Account Manager.exe (PID: 4012)
      • WinRAR.exe (PID: 1668)

    • Application launched itself

      • Roblox Account Manager.exe (PID: 416)

    • The process creates files with name similar to system file names

      • Roblox Account Manager.exe (PID: 4012)

    • Starts CMD.EXE for commands execution

      • WinRAR.exe (PID: 1668)

    • Executing commands from a ".bat" file

      • WinRAR.exe (PID: 1668)

    • Executable content was dropped or overwritten

      • Roblox Account Manager.exe (PID: 4012)

    • Process drops legitimate windows executable

      • Roblox Account Manager.exe (PID: 4012)

  • INFO

    • Reads the computer name

      • Roblox Account Manager.exe (PID: 416)
      • Roblox Account Manager.exe (PID: 4012)
      • MpCmdRun.exe (PID: 1200)

    • Manual execution by a user

      • Roblox Account Manager.exe (PID: 416)

    • Reads the machine GUID from the registry

      • Roblox Account Manager.exe (PID: 416)
      • Roblox Account Manager.exe (PID: 4012)

    • Creates files in the program directory

      • Roblox Account Manager.exe (PID: 416)
      • Roblox Account Manager.exe (PID: 4012)

    • Checks supported languages

      • Roblox Account Manager.exe (PID: 416)
      • Roblox Account Manager.exe (PID: 4012)
      • MpCmdRun.exe (PID: 1200)

    • Process checks computer location settings

      • Roblox Account Manager.exe (PID: 416)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1668)

    • Checks proxy server information

      • slui.exe (PID: 3720)
      • Roblox Account Manager.exe (PID: 4012)

    • Reads the software policy settings

      • slui.exe (PID: 3720)
      • Roblox Account Manager.exe (PID: 4012)

    • Create files in a temporary directory

      • MpCmdRun.exe (PID: 1200)

    • Disables trace logs

      • Roblox Account Manager.exe (PID: 4012)

    • Creates files or folders in the user directory

      • Roblox Account Manager.exe (PID: 4012)

    • The sample compiled with english language support

      • Roblox Account Manager.exe (PID: 4012)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2024:07:17 19:37:00
ZipCRC: 0x5c1cc2bb
ZipCompressedSize: 4372774
ZipUncompressedSize: 5664768
ZipFileName: Roblox Account Manager.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
7
Malicious processes
0
Suspicious processes
3

Behavior graph

Click at the process to see the details
start winrar.exe roblox account manager.exe no specs roblox account manager.exe slui.exe cmd.exe no specs conhost.exe no specs mpcmdrun.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
416"C:\Users\admin\Desktop\Roblox Account Manager.exe" C:\Users\admin\Desktop\Roblox Account Manager.exe—explorer.exe
User:
admin
Company:
ic3
Integrity Level:
MEDIUM
Description:
Roblox Account Manager
Exit code:
0
Version:
3.7.2.0
Modules
Images
c:\users\admin\desktop\roblox account manager.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
1200"C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\admin\AppData\Local\Temp\Rar$VR1668.7344"C:\Program Files\Windows Defender\MpCmdRun.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Malware Protection Command Line Utility
Exit code:
2
Version:
4.18.1909.6 (WinBuild.160101.0800)
Modules
Images
c:\program files\windows defender\mpcmdrun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
1668"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\49b2c015da0851a2ed43820799a7bcda08e1bc5f315e107598f87f4b1bd36dacRoblox.Account.Manager.3.7.2.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2348C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Rar$VR1668.7344\Rar$Scan125358.bat" "C:\Windows\System32\cmd.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
3720C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4012"C:\Users\admin\Desktop\Roblox Account Manager.exe" -restartC:\Users\admin\Desktop\Roblox Account Manager.exe
Roblox Account Manager.exe
User:
admin
Company:
ic3
Integrity Level:
MEDIUM
Description:
Roblox Account Manager
Version:
3.7.2.0
Modules
Images
c:\users\admin\desktop\roblox account manager.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6828\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
9 315
Read events
9 291
Write events
24
Delete events
0

Modification events

(PID) Process:(1668) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(1668) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(1668) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(1668) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\49b2c015da0851a2ed43820799a7bcda08e1bc5f315e107598f87f4b1bd36dacRoblox.Account.Manager.3.7.2.zip
(PID) Process:(1668) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1668) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1668) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1668) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4012) Roblox Account Manager.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Roblox Account Manager_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4012) Roblox Account Manager.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Roblox Account Manager_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
Executable files
22
Suspicious files
66
Text files
9
Unknown types
0

Dropped files

PID
Process
Filename
Type
4012Roblox Account Manager.exeC:\Users\admin\AppData\Local\PuppeteerSharp\chrome-win64.zip —
MD5:—
SHA256:—
4012Roblox Account Manager.exeC:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.dll —
MD5:—
SHA256:—
416Roblox Account Manager.exeC:\Users\admin\Desktop\log4.configxml
MD5:E4659AC08AF3582A23F38BF6C562F841
SHA256:E4B10630D9EC2AF508DE31752FBBC6816C7426C40A3E57F0A085CE7F42C77BD5
4012Roblox Account Manager.exeC:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\124.0.6367.201.manifesttext
MD5:3694B450A908FD582AE3DAADBA743203
SHA256:B345D13EC777E4AEE396A6D49C5EE8D463E1AB93647B97FE3EAEF9CFC1116C46
4012Roblox Account Manager.exeC:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\icudtl.dat —
MD5:—
SHA256:—
4012Roblox Account Manager.exeC:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\First Runtext
MD5:5206EB9697BF5F2978F399F4869CBF18
SHA256:839ADBAACA1C43DD4575C502ADA96EBB4651F1A69B6FC5E42679BEB47584181E
416Roblox Account Manager.exeC:\Users\admin\Desktop\RAMTheme.initext
MD5:F18FA783F4D27E35E54E54417334BFB4
SHA256:563EB35FD613F4298CD4DCEFF67652A13BA516A6244D9407C5709323C4CA4BB1
4012Roblox Account Manager.exeC:\Users\admin\Desktop\libsodium.dllexecutable
MD5:4F6426E3626D5D46FB19C13043CB84DE
SHA256:7A960129F6D3F8D44B4C6BE27F587C29AA8BAFB9C4D3C85BB84A5F5D8FA6E2BA
4012Roblox Account Manager.exeC:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exeexecutable
MD5:F26DFCE9583F0D7D41B31EE11E56BE43
SHA256:613536F294DE53D1E9BB53A31269300FEF4427F5E461FF6C7A1DE3FA88C7667C
416Roblox Account Manager.exeC:\Users\admin\Desktop\Roblox Account Manager.exe.configxml
MD5:0A86FA27D09E26491DBBB4FE27F4B410
SHA256:2B6D99DB8369B0FF6372737D89D1C9E4101815B4168A3852C7B513F2897E7F3D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
25
DNS requests
13
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5944
MoUsoCoreWorker.exe
GET
200
184.24.77.38:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4456
RUXIMICS.exe
GET
200
184.24.77.38:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
184.24.77.38:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4456
RUXIMICS.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
302
140.82.121.4:443
https://github.com/ic3w0lf22/Roblox-Account-Manager/raw/master/RBX%20Alt%20Manager/Resources/WatcherRegexMatches.txt
unknown
—
—
—
—
—
GET
200
142.250.184.251:443
https://storage.googleapis.com/chrome-for-testing-public/124.0.6367.201/win64/chrome-win64.zip
unknown
compressed
143 Mb
whitelisted
—
—
GET
200
140.82.121.6:443
https://api.github.com/repos/ic3w0lf22/Roblox-Account-Manager/releases/latest
unknown
binary
4.02 Kb
whitelisted
—
—
GET
200
140.82.121.4:443
https://raw.githubusercontent.com/ic3w0lf22/Roblox-Account-Manager/master/RBX%20Alt%20Manager/Resources/WatcherRegexMatches.txt
unknown
text
712 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4456
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
184.24.77.38:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
184.24.77.38:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4456
RUXIMICS.exe
184.24.77.38:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5944
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
1268
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
whitelisted
google.com
  • 142.250.186.46
whitelisted
crl.microsoft.com
  • 184.24.77.38
  • 184.24.77.33
  • 184.24.77.24
  • 184.24.77.39
  • 184.24.77.36
  • 184.24.77.29
  • 184.24.77.34
  • 184.24.77.22
  • 184.24.77.27
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
clientsettings.roblox.com
  • 128.116.5.3
whitelisted
api.github.com
  • 140.82.121.5
whitelisted
github.com
  • 140.82.121.4
whitelisted
storage.googleapis.com
  • 216.58.206.59
  • 142.250.186.59
  • 142.250.184.219
  • 142.250.74.219
  • 142.250.181.251
  • 216.58.212.155
  • 216.58.206.91
  • 142.250.185.91
  • 172.217.16.219
  • 142.250.184.251
  • 142.250.186.187
  • 142.250.185.123
  • 142.250.186.155
  • 172.217.18.27
  • 142.250.186.91
  • 142.250.186.123
whitelisted
raw.githubusercontent.com
  • 185.199.108.133
  • 185.199.111.133
  • 185.199.109.133
  • 185.199.110.133
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
2200
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
—
—
Potentially Bad Traffic
ET HUNTING Terse Request for Zip File (GET)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
49b2c015da0851a2ed43820799a7bcda08e1bc5f315e107598f87f4b1bd36dacRoblox.Account.Manager.3.7.2.zip