File name:

Roblox.Account.Manager.3.7.2.zip

Full analysis: https://app.any.run/tasks/b5f5c874-64fb-4ed4-840a-0c8679647998
Verdict: Malicious activity
Analysis date: November 18, 2024, 17:49:52
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
github
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

D58B79CB3D3635BA963427362F75D075

SHA1:

0E33EEFF9B625FCEB2D2D0195E6F32523D57DB79

SHA256:

49B2C015DA0851A2ED43820799A7BCDA08E1BC5F315E107598F87F4B1BD36DAC

SSDEEP:

98304:lEQBRQV3BdUKmD4I3UV5AaONlAUntE4vA0j1Yfyb/plXAWyz7N9j/SfH1e7zWIQ7:XcGtpl

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 5240)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • Roblox Account Manager.exe (PID: 3028)

    • Application launched itself

      • Roblox Account Manager.exe (PID: 3580)
      • chrome.exe (PID: 6244)

    • Executable content was dropped or overwritten

      • Roblox Account Manager.exe (PID: 3028)

  • INFO

    • Manual execution by a user

      • Roblox Account Manager.exe (PID: 3580)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 5240)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2024:07:17 19:37:00
ZipCRC: 0x5c1cc2bb
ZipCompressedSize: 4372774
ZipUncompressedSize: 5664768
ZipFileName: Roblox Account Manager.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
151
Monitored processes
18
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe roblox account manager.exe no specs roblox account manager.exe no specs roblox account manager.exe no specs roblox account manager.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
540"C:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\admin\AppData\Local\Temp\heujukph.mgn" --no-appcompat-clear --field-trial-handle=4964,i,6270512021439508892,16207427469282738368,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:8C:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome for Testing
Exit code:
0
Version:
124.0.6367.201
Modules
Images
c:\users\admin\appdata\local\puppeteersharp\chrome\win64-124.0.6367.201\chrome-win64\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\puppeteersharp\chrome\win64-124.0.6367.201\chrome-win64\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
1168"C:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=gpu-process --disable-breakpad --user-data-dir="C:\Users\admin\AppData\Local\Temp\heujukph.mgn" --no-appcompat-clear --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1984,i,6270512021439508892,16207427469282738368,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=1976 /prefetch:2C:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome for Testing
Version:
124.0.6367.201
Modules
Images
c:\users\admin\appdata\local\puppeteersharp\chrome\win64-124.0.6367.201\chrome-win64\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\puppeteersharp\chrome\win64-124.0.6367.201\chrome-win64\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
1588"C:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=renderer --user-data-dir="C:\Users\admin\AppData\Local\Temp\heujukph.mgn" --no-appcompat-clear --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --allow-pre-commit-input --enable-blink-features=IdleDetection --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3100,i,6270512021439508892,16207427469282738368,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:1C:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome for Testing
Exit code:
0
Version:
124.0.6367.201
Modules
Images
c:\users\admin\appdata\local\puppeteersharp\chrome\win64-124.0.6367.201\chrome-win64\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\puppeteersharp\chrome\win64-124.0.6367.201\chrome-win64\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1700"C:\Users\admin\AppData\Local\Temp\Rar$EXa5240.2871\Roblox Account Manager.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa5240.2871\Roblox Account Manager.exe—WinRAR.exe
User:
admin
Company:
ic3
Integrity Level:
MEDIUM
Description:
Roblox Account Manager
Exit code:
1337
Version:
3.7.2.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa5240.2871\roblox account manager.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
1764"C:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=renderer --user-data-dir="C:\Users\admin\AppData\Local\Temp\heujukph.mgn" --no-appcompat-clear --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --allow-pre-commit-input --enable-blink-features=IdleDetection --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3084,i,6270512021439508892,16207427469282738368,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:1C:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome for Testing
Version:
124.0.6367.201
Modules
Images
c:\users\admin\appdata\local\puppeteersharp\chrome\win64-124.0.6367.201\chrome-win64\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\puppeteersharp\chrome\win64-124.0.6367.201\chrome-win64\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
2724"C:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\admin\AppData\Local\Temp\heujukph.mgn" --no-appcompat-clear --field-trial-handle=2400,i,6270512021439508892,16207427469282738368,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:8C:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome for Testing
Version:
124.0.6367.201
Modules
Images
c:\users\admin\appdata\local\puppeteersharp\chrome\win64-124.0.6367.201\chrome-win64\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\puppeteersharp\chrome\win64-124.0.6367.201\chrome-win64\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
3004"C:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\admin\AppData\Local\Temp\heujukph.mgn" --no-appcompat-clear --start-stack-profiler --field-trial-handle=2164,i,6270512021439508892,16207427469282738368,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:3C:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome for Testing
Version:
124.0.6367.201
Modules
Images
c:\users\admin\appdata\local\puppeteersharp\chrome\win64-124.0.6367.201\chrome-win64\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\puppeteersharp\chrome\win64-124.0.6367.201\chrome-win64\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
3028"C:\Users\admin\Desktop\Roblox Account Manager.exe" -restartC:\Users\admin\Desktop\Roblox Account Manager.exe
Roblox Account Manager.exe
User:
admin
Company:
ic3
Integrity Level:
MEDIUM
Description:
Roblox Account Manager
Version:
3.7.2.0
Modules
Images
c:\users\admin\desktop\roblox account manager.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
3580"C:\Users\admin\Desktop\Roblox Account Manager.exe" C:\Users\admin\Desktop\Roblox Account Manager.exe—explorer.exe
User:
admin
Company:
ic3
Integrity Level:
MEDIUM
Description:
Roblox Account Manager
Exit code:
0
Version:
3.7.2.0
Modules
Images
c:\users\admin\desktop\roblox account manager.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5184"C:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=renderer --user-data-dir="C:\Users\admin\AppData\Local\Temp\heujukph.mgn" --no-appcompat-clear --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --allow-pre-commit-input --disable-gpu-compositing --enable-blink-features=IdleDetection --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5336,i,6270512021439508892,16207427469282738368,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:1C:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome for Testing
Version:
124.0.6367.201
Modules
Images
c:\users\admin\appdata\local\puppeteersharp\chrome\win64-124.0.6367.201\chrome-win64\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\puppeteersharp\chrome\win64-124.0.6367.201\chrome-win64\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
Total events
5 871
Read events
5 803
Write events
49
Delete events
19

Modification events

(PID) Process:(5240) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(5240) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Roblox.Account.Manager.3.7.2.zip
(PID) Process:(5240) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5240) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5240) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5240) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3028) Roblox Account Manager.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Roblox Account Manager_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3028) Roblox Account Manager.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Roblox Account Manager_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(3028) Roblox Account Manager.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Roblox Account Manager_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3028) Roblox Account Manager.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Roblox Account Manager_RASAPI32
Operation:writeName:FileTracingMask
Value:
Executable files
24
Suspicious files
309
Text files
47
Unknown types
27

Dropped files

PID
Process
Filename
Type
3028Roblox Account Manager.exeC:\Users\admin\AppData\Local\PuppeteerSharp\chrome-win64.zip —
MD5:—
SHA256:—
3028Roblox Account Manager.exeC:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.dll —
MD5:—
SHA256:—
3028Roblox Account Manager.exeC:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\ABOUTtext
MD5:88A0F3FE060109E910FB0FEDA8976572
SHA256:0DF1F768CD389A034A9711368DCED694B5FDE5AC8996561BF7E0B52517CD298A
3028Roblox Account Manager.exeC:\Users\admin\Desktop\RAMSettings.initext
MD5:2770C51BDC8469129A258AC8C2DA4693
SHA256:593050CBC8F30C794FD710328FAD3A51156B5648A43F2EC686A6F55F0177DABC
3028Roblox Account Manager.exeC:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\124.0.6367.201.manifesttext
MD5:3694B450A908FD582AE3DAADBA743203
SHA256:B345D13EC777E4AEE396A6D49C5EE8D463E1AB93647B97FE3EAEF9CFC1116C46
5240WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa5240.3404\Roblox Account Manager.exeexecutable
MD5:334728F32A1144C893FDFFC579A7709B
SHA256:BE9DDCDEDF8C36C64E6B0A32D2686B74A112913C54217CCAA46675BFD1DC82F1
3580Roblox Account Manager.exeC:\Users\admin\Desktop\Roblox Account Manager.exe.configxml
MD5:0A86FA27D09E26491DBBB4FE27F4B410
SHA256:2B6D99DB8369B0FF6372737D89D1C9E4101815B4168A3852C7B513F2897E7F3D
5240WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5240.5535\Roblox Account Manager.exeexecutable
MD5:334728F32A1144C893FDFFC579A7709B
SHA256:BE9DDCDEDF8C36C64E6B0A32D2686B74A112913C54217CCAA46675BFD1DC82F1
3028Roblox Account Manager.exeC:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\icudtl.dat —
MD5:—
SHA256:—
3028Roblox Account Manager.exeC:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\First Runtext
MD5:5206EB9697BF5F2978F399F4869CBF18
SHA256:839ADBAACA1C43DD4575C502ADA96EBB4651F1A69B6FC5E42679BEB47584181E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
75
DNS requests
73
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.218.209.163:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.159:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5100
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2776
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5100
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4360
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5976
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
6944
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5488
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.48.23.159:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.218.209.163:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4360
SearchApp.exe
104.126.37.155:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4360
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2776
svchost.exe
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
  • 20.73.194.208
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.48.23.159
  • 23.48.23.169
  • 23.48.23.164
  • 23.48.23.158
  • 23.48.23.166
  • 23.48.23.177
  • 23.48.23.145
  • 23.48.23.161
  • 23.48.23.183
whitelisted
www.microsoft.com
  • 23.218.209.163
  • 88.221.169.152
whitelisted
google.com
  • 142.250.185.174
whitelisted
www.bing.com
  • 104.126.37.155
  • 104.126.37.186
  • 104.126.37.163
  • 104.126.37.153
  • 104.126.37.168
  • 104.126.37.179
  • 104.126.37.170
  • 104.126.37.161
  • 104.126.37.171
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.159.75
  • 20.190.159.23
  • 40.126.31.73
  • 40.126.31.71
  • 40.126.31.69
  • 20.190.159.2
  • 20.190.159.64
  • 40.126.31.67
whitelisted
th.bing.com
  • 2.23.209.177
  • 2.23.209.182
  • 2.23.209.176
  • 2.23.209.179
  • 2.23.209.185
  • 2.23.209.189
  • 2.23.209.187
  • 2.23.209.158
  • 2.23.209.130
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted

Threats

PID
Process
Class
Message
2172
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
Process
Message
chrome.exe
RecursiveDirectoryCreate( C:\Users\admin\AppData\Local\Temp\heujukph.mgn directory exists )
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Roblox.Account.Manager.3.7.2.zip