File name:

49b2c015da0851a2ed43820799a7bcda08e1bc5f315e107598f87f4b1bd36dacRoblox.Account.Manager.3.7.2.zip

Full analysis: https://app.any.run/tasks/0b6cae12-a96b-40a4-831c-f5727b75d95e
Verdict: Malicious activity
Analysis date: June 21, 2025, 18:55:29
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
github
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

D58B79CB3D3635BA963427362F75D075

SHA1:

0E33EEFF9B625FCEB2D2D0195E6F32523D57DB79

SHA256:

49B2C015DA0851A2ED43820799A7BCDA08E1BC5F315E107598F87F4B1BD36DAC

SSDEEP:

98304:lEQBRQV3BdUKmD4I3UV5AaONlAUntE4vA0j1Yfyb/plXAWyz7N9j/SfH1e7zWIQ7:XcGtpl

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 1668)

  • SUSPICIOUS

    • Application launched itself

      • Roblox Account Manager.exe (PID: 416)

    • Reads security settings of Internet Explorer

      • Roblox Account Manager.exe (PID: 416)
      • Roblox Account Manager.exe (PID: 4012)
      • WinRAR.exe (PID: 1668)

    • Executable content was dropped or overwritten

      • Roblox Account Manager.exe (PID: 4012)

    • Process drops legitimate windows executable

      • Roblox Account Manager.exe (PID: 4012)

    • The process creates files with name similar to system file names

      • Roblox Account Manager.exe (PID: 4012)

    • Starts CMD.EXE for commands execution

      • WinRAR.exe (PID: 1668)

    • Executing commands from a ".bat" file

      • WinRAR.exe (PID: 1668)

  • INFO

    • Checks supported languages

      • Roblox Account Manager.exe (PID: 416)
      • Roblox Account Manager.exe (PID: 4012)
      • MpCmdRun.exe (PID: 1200)

    • Manual execution by a user

      • Roblox Account Manager.exe (PID: 416)

    • Reads the computer name

      • Roblox Account Manager.exe (PID: 416)
      • Roblox Account Manager.exe (PID: 4012)
      • MpCmdRun.exe (PID: 1200)

    • Reads the machine GUID from the registry

      • Roblox Account Manager.exe (PID: 416)
      • Roblox Account Manager.exe (PID: 4012)

    • Creates files in the program directory

      • Roblox Account Manager.exe (PID: 416)
      • Roblox Account Manager.exe (PID: 4012)

    • Process checks computer location settings

      • Roblox Account Manager.exe (PID: 416)

    • Disables trace logs

      • Roblox Account Manager.exe (PID: 4012)

    • Checks proxy server information

      • Roblox Account Manager.exe (PID: 4012)
      • slui.exe (PID: 3720)

    • Reads the software policy settings

      • Roblox Account Manager.exe (PID: 4012)
      • slui.exe (PID: 3720)

    • Creates files or folders in the user directory

      • Roblox Account Manager.exe (PID: 4012)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1668)

    • Create files in a temporary directory

      • MpCmdRun.exe (PID: 1200)

    • The sample compiled with english language support

      • Roblox Account Manager.exe (PID: 4012)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2024:07:17 19:37:00
ZipCRC: 0x5c1cc2bb
ZipCompressedSize: 4372774
ZipUncompressedSize: 5664768
ZipFileName: Roblox Account Manager.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
7
Malicious processes
0
Suspicious processes
3

Behavior graph

Click at the process to see the details
start winrar.exe roblox account manager.exe no specs roblox account manager.exe slui.exe cmd.exe no specs conhost.exe no specs mpcmdrun.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
416"C:\Users\admin\Desktop\Roblox Account Manager.exe" C:\Users\admin\Desktop\Roblox Account Manager.exe—explorer.exe
User:
admin
Company:
ic3
Integrity Level:
MEDIUM
Description:
Roblox Account Manager
Exit code:
0
Version:
3.7.2.0
Modules
Images
c:\users\admin\desktop\roblox account manager.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
1200"C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\admin\AppData\Local\Temp\Rar$VR1668.7344"C:\Program Files\Windows Defender\MpCmdRun.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Malware Protection Command Line Utility
Exit code:
2
Version:
4.18.1909.6 (WinBuild.160101.0800)
Modules
Images
c:\program files\windows defender\mpcmdrun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
1668"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\49b2c015da0851a2ed43820799a7bcda08e1bc5f315e107598f87f4b1bd36dacRoblox.Account.Manager.3.7.2.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2348C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Rar$VR1668.7344\Rar$Scan125358.bat" "C:\Windows\System32\cmd.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
3720C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4012"C:\Users\admin\Desktop\Roblox Account Manager.exe" -restartC:\Users\admin\Desktop\Roblox Account Manager.exe
Roblox Account Manager.exe
User:
admin
Company:
ic3
Integrity Level:
MEDIUM
Description:
Roblox Account Manager
Version:
3.7.2.0
Modules
Images
c:\users\admin\desktop\roblox account manager.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6828\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
9 315
Read events
9 291
Write events
24
Delete events
0

Modification events

(PID) Process:(1668) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(1668) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(1668) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(1668) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\49b2c015da0851a2ed43820799a7bcda08e1bc5f315e107598f87f4b1bd36dacRoblox.Account.Manager.3.7.2.zip
(PID) Process:(1668) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1668) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1668) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1668) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4012) Roblox Account Manager.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Roblox Account Manager_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4012) Roblox Account Manager.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Roblox Account Manager_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
Executable files
22
Suspicious files
66
Text files
9
Unknown types
0

Dropped files

PID
Process
Filename
Type
4012Roblox Account Manager.exeC:\Users\admin\AppData\Local\PuppeteerSharp\chrome-win64.zip —
MD5:—
SHA256:—
4012Roblox Account Manager.exeC:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.dll —
MD5:—
SHA256:—
4012Roblox Account Manager.exeC:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\D3DCompiler_47.dllexecutable
MD5:A7B7470C347F84365FFE1B2072B4F95C
SHA256:AF7B99BE1B8770C0E4D18E43B04E81D11BDEB667FA6B07ADE7A88F4C5676BF9A
4012Roblox Account Manager.exeC:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\MEIPreload\manifest.jsonbinary
MD5:442699C95B20A60470421C6A4D29960F
SHA256:44844CF3DDE6E80087AE0E6BF0D9326D7EF7D23326D24AC83AF0850BE26923D2
4012Roblox Account Manager.exeC:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\icudtl.dat —
MD5:—
SHA256:—
416Roblox Account Manager.exeC:\Users\admin\Desktop\Roblox Account Manager.exe.configxml
MD5:0A86FA27D09E26491DBBB4FE27F4B410
SHA256:2B6D99DB8369B0FF6372737D89D1C9E4101815B4168A3852C7B513F2897E7F3D
4012Roblox Account Manager.exeC:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\ABOUTtext
MD5:88A0F3FE060109E910FB0FEDA8976572
SHA256:0DF1F768CD389A034A9711368DCED694B5FDE5AC8996561BF7E0B52517CD298A
4012Roblox Account Manager.exeC:\Users\admin\Desktop\RAMSettings.initext
MD5:2770C51BDC8469129A258AC8C2DA4693
SHA256:593050CBC8F30C794FD710328FAD3A51156B5648A43F2EC686A6F55F0177DABC
4012Roblox Account Manager.exeC:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\First Runtext
MD5:5206EB9697BF5F2978F399F4869CBF18
SHA256:839ADBAACA1C43DD4575C502ADA96EBB4651F1A69B6FC5E42679BEB47584181E
4012Roblox Account Manager.exeC:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome_proxy.exeexecutable
MD5:51A7EBA6D5B2EF521C18BB2CFF62E388
SHA256:3734FA4DD9E21B43B5513082802D8103C8B7A0E450E447258C933FADDB9484C4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
25
DNS requests
13
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5944
MoUsoCoreWorker.exe
GET
200
184.24.77.38:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
184.24.77.38:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4456
RUXIMICS.exe
GET
200
184.24.77.38:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4456
RUXIMICS.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
142.250.184.251:443
https://storage.googleapis.com/chrome-for-testing-public/124.0.6367.201/win64/chrome-win64.zip
unknown
compressed
143 Mb
whitelisted
—
—
GET
302
140.82.121.4:443
https://github.com/ic3w0lf22/Roblox-Account-Manager/raw/master/RBX%20Alt%20Manager/Resources/WatcherRegexMatches.txt
unknown
—
—
unknown
—
—
GET
200
140.82.121.4:443
https://raw.githubusercontent.com/ic3w0lf22/Roblox-Account-Manager/master/RBX%20Alt%20Manager/Resources/WatcherRegexMatches.txt
unknown
text
712 b
whitelisted
—
—
GET
200
140.82.121.6:443
https://api.github.com/repos/ic3w0lf22/Roblox-Account-Manager/releases/latest
unknown
binary
4.02 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4456
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
184.24.77.38:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
184.24.77.38:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4456
RUXIMICS.exe
184.24.77.38:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5944
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
1268
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
whitelisted
google.com
  • 142.250.186.46
whitelisted
crl.microsoft.com
  • 184.24.77.38
  • 184.24.77.33
  • 184.24.77.24
  • 184.24.77.39
  • 184.24.77.36
  • 184.24.77.29
  • 184.24.77.34
  • 184.24.77.22
  • 184.24.77.27
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
clientsettings.roblox.com
  • 128.116.5.3
whitelisted
api.github.com
  • 140.82.121.5
whitelisted
github.com
  • 140.82.121.4
whitelisted
storage.googleapis.com
  • 216.58.206.59
  • 142.250.186.59
  • 142.250.184.219
  • 142.250.74.219
  • 142.250.181.251
  • 216.58.212.155
  • 216.58.206.91
  • 142.250.185.91
  • 172.217.16.219
  • 142.250.184.251
  • 142.250.186.187
  • 142.250.185.123
  • 142.250.186.155
  • 172.217.18.27
  • 142.250.186.91
  • 142.250.186.123
whitelisted
raw.githubusercontent.com
  • 185.199.108.133
  • 185.199.111.133
  • 185.199.109.133
  • 185.199.110.133
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
2200
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
—
—
Potentially Bad Traffic
ET HUNTING Terse Request for Zip File (GET)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
49b2c015da0851a2ed43820799a7bcda08e1bc5f315e107598f87f4b1bd36dacRoblox.Account.Manager.3.7.2.zip