File name:

Roblox.Account.Manager.3.7.2.zip

Full analysis: https://app.any.run/tasks/b5f5c874-64fb-4ed4-840a-0c8679647998
Verdict: Malicious activity
Analysis date: November 18, 2024, 17:49:52
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
github
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

D58B79CB3D3635BA963427362F75D075

SHA1:

0E33EEFF9B625FCEB2D2D0195E6F32523D57DB79

SHA256:

49B2C015DA0851A2ED43820799A7BCDA08E1BC5F315E107598F87F4B1BD36DAC

SSDEEP:

98304:lEQBRQV3BdUKmD4I3UV5AaONlAUntE4vA0j1Yfyb/plXAWyz7N9j/SfH1e7zWIQ7:XcGtpl

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 5240)

  • SUSPICIOUS

    • Application launched itself

      • Roblox Account Manager.exe (PID: 3580)
      • chrome.exe (PID: 6244)

    • Process drops legitimate windows executable

      • Roblox Account Manager.exe (PID: 3028)

    • Executable content was dropped or overwritten

      • Roblox Account Manager.exe (PID: 3028)

  • INFO

    • Manual execution by a user

      • Roblox Account Manager.exe (PID: 3580)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 5240)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2024:07:17 19:37:00
ZipCRC: 0x5c1cc2bb
ZipCompressedSize: 4372774
ZipUncompressedSize: 5664768
ZipFileName: Roblox Account Manager.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
151
Monitored processes
18
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe roblox account manager.exe no specs roblox account manager.exe no specs roblox account manager.exe no specs roblox account manager.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
540"C:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\admin\AppData\Local\Temp\heujukph.mgn" --no-appcompat-clear --field-trial-handle=4964,i,6270512021439508892,16207427469282738368,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:8C:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome for Testing
Exit code:
0
Version:
124.0.6367.201
Modules
Images
c:\users\admin\appdata\local\puppeteersharp\chrome\win64-124.0.6367.201\chrome-win64\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\puppeteersharp\chrome\win64-124.0.6367.201\chrome-win64\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
1168"C:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=gpu-process --disable-breakpad --user-data-dir="C:\Users\admin\AppData\Local\Temp\heujukph.mgn" --no-appcompat-clear --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1984,i,6270512021439508892,16207427469282738368,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=1976 /prefetch:2C:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome for Testing
Version:
124.0.6367.201
Modules
Images
c:\users\admin\appdata\local\puppeteersharp\chrome\win64-124.0.6367.201\chrome-win64\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\puppeteersharp\chrome\win64-124.0.6367.201\chrome-win64\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
1588"C:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=renderer --user-data-dir="C:\Users\admin\AppData\Local\Temp\heujukph.mgn" --no-appcompat-clear --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --allow-pre-commit-input --enable-blink-features=IdleDetection --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3100,i,6270512021439508892,16207427469282738368,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:1C:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome for Testing
Exit code:
0
Version:
124.0.6367.201
Modules
Images
c:\users\admin\appdata\local\puppeteersharp\chrome\win64-124.0.6367.201\chrome-win64\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\puppeteersharp\chrome\win64-124.0.6367.201\chrome-win64\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1700"C:\Users\admin\AppData\Local\Temp\Rar$EXa5240.2871\Roblox Account Manager.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa5240.2871\Roblox Account Manager.exe—WinRAR.exe
User:
admin
Company:
ic3
Integrity Level:
MEDIUM
Description:
Roblox Account Manager
Exit code:
1337
Version:
3.7.2.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa5240.2871\roblox account manager.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
1764"C:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=renderer --user-data-dir="C:\Users\admin\AppData\Local\Temp\heujukph.mgn" --no-appcompat-clear --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --allow-pre-commit-input --enable-blink-features=IdleDetection --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3084,i,6270512021439508892,16207427469282738368,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:1C:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome for Testing
Version:
124.0.6367.201
Modules
Images
c:\users\admin\appdata\local\puppeteersharp\chrome\win64-124.0.6367.201\chrome-win64\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\puppeteersharp\chrome\win64-124.0.6367.201\chrome-win64\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
2724"C:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\admin\AppData\Local\Temp\heujukph.mgn" --no-appcompat-clear --field-trial-handle=2400,i,6270512021439508892,16207427469282738368,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:8C:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome for Testing
Version:
124.0.6367.201
Modules
Images
c:\users\admin\appdata\local\puppeteersharp\chrome\win64-124.0.6367.201\chrome-win64\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\puppeteersharp\chrome\win64-124.0.6367.201\chrome-win64\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
3004"C:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\admin\AppData\Local\Temp\heujukph.mgn" --no-appcompat-clear --start-stack-profiler --field-trial-handle=2164,i,6270512021439508892,16207427469282738368,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:3C:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome for Testing
Version:
124.0.6367.201
Modules
Images
c:\users\admin\appdata\local\puppeteersharp\chrome\win64-124.0.6367.201\chrome-win64\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\puppeteersharp\chrome\win64-124.0.6367.201\chrome-win64\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
3028"C:\Users\admin\Desktop\Roblox Account Manager.exe" -restartC:\Users\admin\Desktop\Roblox Account Manager.exe
Roblox Account Manager.exe
User:
admin
Company:
ic3
Integrity Level:
MEDIUM
Description:
Roblox Account Manager
Version:
3.7.2.0
Modules
Images
c:\users\admin\desktop\roblox account manager.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
3580"C:\Users\admin\Desktop\Roblox Account Manager.exe" C:\Users\admin\Desktop\Roblox Account Manager.exe—explorer.exe
User:
admin
Company:
ic3
Integrity Level:
MEDIUM
Description:
Roblox Account Manager
Exit code:
0
Version:
3.7.2.0
Modules
Images
c:\users\admin\desktop\roblox account manager.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5184"C:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=renderer --user-data-dir="C:\Users\admin\AppData\Local\Temp\heujukph.mgn" --no-appcompat-clear --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --allow-pre-commit-input --disable-gpu-compositing --enable-blink-features=IdleDetection --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5336,i,6270512021439508892,16207427469282738368,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:1C:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome for Testing
Version:
124.0.6367.201
Modules
Images
c:\users\admin\appdata\local\puppeteersharp\chrome\win64-124.0.6367.201\chrome-win64\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\puppeteersharp\chrome\win64-124.0.6367.201\chrome-win64\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
Total events
5 871
Read events
5 803
Write events
49
Delete events
19

Modification events

(PID) Process:(5240) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(5240) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Roblox.Account.Manager.3.7.2.zip
(PID) Process:(5240) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5240) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5240) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5240) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3028) Roblox Account Manager.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Roblox Account Manager_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3028) Roblox Account Manager.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Roblox Account Manager_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(3028) Roblox Account Manager.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Roblox Account Manager_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3028) Roblox Account Manager.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Roblox Account Manager_RASAPI32
Operation:writeName:FileTracingMask
Value:
Executable files
24
Suspicious files
309
Text files
47
Unknown types
27

Dropped files

PID
Process
Filename
Type
3028Roblox Account Manager.exeC:\Users\admin\AppData\Local\PuppeteerSharp\chrome-win64.zip —
MD5:—
SHA256:—
3028Roblox Account Manager.exeC:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.dll —
MD5:—
SHA256:—
5240WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa5240.2871\Roblox Account Manager.exeexecutable
MD5:334728F32A1144C893FDFFC579A7709B
SHA256:BE9DDCDEDF8C36C64E6B0A32D2686B74A112913C54217CCAA46675BFD1DC82F1
5240WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5240.5535\Roblox Account Manager.exeexecutable
MD5:334728F32A1144C893FDFFC579A7709B
SHA256:BE9DDCDEDF8C36C64E6B0A32D2686B74A112913C54217CCAA46675BFD1DC82F1
3028Roblox Account Manager.exeC:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome_200_percent.pakbinary
MD5:E7F0C4A2F06AA4C40206CDC1BFB9166E
SHA256:3CD793C813D79579E5DAFB3B63204E2CCB525F6B27A6DC25525C9FAFABCE4D29
3028Roblox Account Manager.exeC:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome_elf.dllexecutable
MD5:561916711C707FE011411FD3D2CF71A8
SHA256:0D2CCF801CEABBA978A77238E1B79AFC9A66983A11C07E011F876C063A71FFDB
5240WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa5240.3404\Roblox Account Manager.exeexecutable
MD5:334728F32A1144C893FDFFC579A7709B
SHA256:BE9DDCDEDF8C36C64E6B0A32D2686B74A112913C54217CCAA46675BFD1DC82F1
3028Roblox Account Manager.exeC:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exeexecutable
MD5:F26DFCE9583F0D7D41B31EE11E56BE43
SHA256:613536F294DE53D1E9BB53A31269300FEF4427F5E461FF6C7A1DE3FA88C7667C
3028Roblox Account Manager.exeC:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\icudtl.dat —
MD5:—
SHA256:—
3580Roblox Account Manager.exeC:\Users\admin\Desktop\RAMTheme.initext
MD5:F18FA783F4D27E35E54E54417334BFB4
SHA256:563EB35FD613F4298CD4DCEFF67652A13BA516A6244D9407C5709323C4CA4BB1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
75
DNS requests
73
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.218.209.163:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4360
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5100
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2776
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5100
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5976
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.159:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
6944
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5488
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.48.23.159:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.218.209.163:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4360
SearchApp.exe
104.126.37.155:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4360
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2776
svchost.exe
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
  • 20.73.194.208
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.48.23.159
  • 23.48.23.169
  • 23.48.23.164
  • 23.48.23.158
  • 23.48.23.166
  • 23.48.23.177
  • 23.48.23.145
  • 23.48.23.161
  • 23.48.23.183
whitelisted
www.microsoft.com
  • 23.218.209.163
  • 88.221.169.152
whitelisted
google.com
  • 142.250.185.174
whitelisted
www.bing.com
  • 104.126.37.155
  • 104.126.37.186
  • 104.126.37.163
  • 104.126.37.153
  • 104.126.37.168
  • 104.126.37.179
  • 104.126.37.170
  • 104.126.37.161
  • 104.126.37.171
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.159.75
  • 20.190.159.23
  • 40.126.31.73
  • 40.126.31.71
  • 40.126.31.69
  • 20.190.159.2
  • 20.190.159.64
  • 40.126.31.67
whitelisted
th.bing.com
  • 2.23.209.177
  • 2.23.209.182
  • 2.23.209.176
  • 2.23.209.179
  • 2.23.209.185
  • 2.23.209.189
  • 2.23.209.187
  • 2.23.209.158
  • 2.23.209.130
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted

Threats

PID
Process
Class
Message
2172
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
Process
Message
chrome.exe
RecursiveDirectoryCreate( C:\Users\admin\AppData\Local\Temp\heujukph.mgn directory exists )
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Roblox.Account.Manager.3.7.2.zip