File name:

Roblox Account Manager.exe

Full analysis: https://app.any.run/tasks/1a4d2aa5-09db-4979-9472-79f68268ebfe
Verdict: Malicious activity
Analysis date: February 18, 2026, 13:31:51
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
github
evasion
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

F86F0BE80B48D2FB34BA9390E590B3AD

SHA1:

DFFA9C4BF7B847A487DE59B921DF66AF5AD284E2

SHA256:

B1AB047E778DCB81EF6DBE9485527800E7C371CCE5647BB5BF0E65C5E55A6463

SSDEEP:

98304:7RZqYR01rGcYA+XwP9jgMI6ZdVGbk1Jo/fEJX17kHQw/LgejE4K2nXUItxvvFt4B:Ul5BQ8a

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Application launched itself

      • Roblox Account Manager.exe (PID: 3112)
      • chrome.exe (PID: 6392)
      • chrome.exe (PID: 3092)

    • Executable content was dropped or overwritten

      • Roblox Account Manager.exe (PID: 8508)

    • Process drops legitimate windows executable

      • Roblox Account Manager.exe (PID: 8508)

    • The process creates files with name similar to system file names

      • Roblox Account Manager.exe (PID: 8508)

    • Browser web security disabling

      • chrome.exe (PID: 3092)

    • Checks for external IP

      • svchost.exe (PID: 2292)

  • INFO

    • Reads the computer name

      • Roblox Account Manager.exe (PID: 3112)
      • Roblox Account Manager.exe (PID: 8508)
      • chrome.exe (PID: 3092)
      • chrome.exe (PID: 6392)
      • chrome.exe (PID: 6692)
      • chrome.exe (PID: 4200)
      • chrome.exe (PID: 4796)
      • chrome.exe (PID: 6360)
      • chrome.exe (PID: 7532)
      • chrome.exe (PID: 524)
      • chrome.exe (PID: 7340)

    • Reads the machine GUID from the registry

      • Roblox Account Manager.exe (PID: 3112)
      • Roblox Account Manager.exe (PID: 8508)
      • chrome.exe (PID: 3092)

    • Process checks computer location settings

      • Roblox Account Manager.exe (PID: 3112)
      • chrome.exe (PID: 3092)
      • chrome.exe (PID: 3536)
      • chrome.exe (PID: 8952)
      • chrome.exe (PID: 7988)

    • Checks supported languages

      • Roblox Account Manager.exe (PID: 3112)
      • Roblox Account Manager.exe (PID: 8508)
      • chrome.exe (PID: 3092)
      • chrome.exe (PID: 6392)
      • chrome.exe (PID: 7076)
      • chrome.exe (PID: 6692)
      • chrome.exe (PID: 8952)
      • chrome.exe (PID: 7988)
      • chrome.exe (PID: 4200)
      • chrome.exe (PID: 792)
      • chrome.exe (PID: 3536)
      • chrome.exe (PID: 7532)
      • chrome.exe (PID: 6360)
      • chrome.exe (PID: 4796)
      • chrome.exe (PID: 7340)
      • chrome.exe (PID: 524)

    • Create files in a temporary directory

      • Roblox Account Manager.exe (PID: 3112)
      • Roblox Account Manager.exe (PID: 8508)
      • chrome.exe (PID: 3092)
      • chrome.exe (PID: 6692)

    • Creates files in the program directory

      • Roblox Account Manager.exe (PID: 3112)
      • Roblox Account Manager.exe (PID: 8508)

    • Reads security settings of Internet Explorer

      • Roblox Account Manager.exe (PID: 3112)
      • Roblox Account Manager.exe (PID: 8508)

    • Disables trace logs

      • Roblox Account Manager.exe (PID: 8508)

    • The sample compiled with english language support

      • Roblox Account Manager.exe (PID: 8508)

    • Creates files or folders in the user directory

      • Roblox Account Manager.exe (PID: 8508)

    • Checks proxy server information

      • Roblox Account Manager.exe (PID: 8508)
      • chrome.exe (PID: 3092)
      • slui.exe (PID: 6544)

    • There is functionality for taking screenshot (YARA)

      • chrome.exe (PID: 4200)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2054:06:07 14:14:26+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 5657088
InitializedDataSize: 31232
UninitializedDataSize: -
EntryPoint: 0x5670ee
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 3.7.2.0
ProductVersionNumber: 3.7.2.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: Created by ic3w0lf
CompanyName: ic3
FileDescription: Roblox Account Manager
FileVersion: 3.7.2.0
InternalName: Roblox Account Manager.exe
LegalCopyright: Copyright © ic3 2024
LegalTrademarks: -
OriginalFileName: Roblox Account Manager.exe
ProductName: Roblox Account Manager
ProductVersion: 3.7.2.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
172
Monitored processes
18
Malicious processes
0
Suspicious processes
3

Behavior graph

Click at the process to see the details
start roblox account manager.exe no specs roblox account manager.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs slui.exe chrome.exe no specs chrome.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
524"C:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\admin\AppData\Local\Temp\gdxyrv0y.byz" --no-appcompat-clear --field-trial-handle=4956,i,8482758140635542573,2774156770908990699,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:8C:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome for Testing
Exit code:
0
Version:
124.0.6367.201
Modules
Images
c:\users\admin\appdata\local\puppeteersharp\chrome\win64-124.0.6367.201\chrome-win64\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\puppeteersharp\chrome\win64-124.0.6367.201\chrome-win64\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
792"C:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\admin\AppData\Local\Temp\gdxyrv0y.byz" --no-appcompat-clear --field-trial-handle=2372,i,8482758140635542573,2774156770908990699,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:8C:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome for Testing
Exit code:
0
Version:
124.0.6367.201
Modules
Images
c:\users\admin\appdata\local\puppeteersharp\chrome\win64-124.0.6367.201\chrome-win64\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\puppeteersharp\chrome\win64-124.0.6367.201\chrome-win64\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
2292C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3092"C:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --allow-pre-commit-input --disable-background-networking --disable-background-timer-throttling --disable-backgrounding-occluded-windows --disable-breakpad --disable-client-side-phishing-detection --disable-component-extensions-with-background-pages --disable-component-update --disable-default-apps --disable-dev-shm-usage --disable-extensions --disable-field-trial-config --disable-hang-monitor --disable-infobars --disable-ipc-flooding-protection --disable-popup-blocking --disable-prompt-on-repost --disable-renderer-backgrounding --disable-search-engine-choice-screen --disable-sync --enable-automation --enable-blink-features=IdleDetection --export-tagged-pdf --generate-pdf-document-outline --force-color-profile=srgb --metrics-recording-only --no-first-run --password-store=basic --use-mock-keychain --disable-features=Translate,AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold --enable-features= about:blank --disable-web-security --window-size="880,740" --window-position="240,-6" --remote-debugging-port=0 --user-data-dir="C:\Users\admin\AppData\Local\Temp\gdxyrv0y.byz"C:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
Roblox Account Manager.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome for Testing
Exit code:
0
Version:
124.0.6367.201
Modules
Images
c:\users\admin\appdata\local\puppeteersharp\chrome\win64-124.0.6367.201\chrome-win64\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\puppeteersharp\chrome\win64-124.0.6367.201\chrome-win64\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\winmm.dll
3112"C:\Users\admin\AppData\Local\Temp\Roblox Account Manager.exe" C:\Users\admin\AppData\Local\Temp\Roblox Account Manager.exe—explorer.exe
User:
admin
Company:
ic3
Integrity Level:
MEDIUM
Description:
Roblox Account Manager
Exit code:
0
Version:
3.7.2.0
Modules
Images
c:\users\admin\appdata\local\temp\roblox account manager.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
3536"C:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=renderer --user-data-dir="C:\Users\admin\AppData\Local\Temp\gdxyrv0y.byz" --no-appcompat-clear --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --allow-pre-commit-input --disable-gpu-compositing --enable-blink-features=IdleDetection --lang=en-US --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4520,i,8482758140635542573,2774156770908990699,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:1C:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome for Testing
Exit code:
0
Version:
124.0.6367.201
Modules
Images
c:\users\admin\appdata\local\puppeteersharp\chrome\win64-124.0.6367.201\chrome-win64\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\puppeteersharp\chrome\win64-124.0.6367.201\chrome-win64\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
4200"C:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=gpu-process --disable-breakpad --user-data-dir="C:\Users\admin\AppData\Local\Temp\gdxyrv0y.byz" --no-appcompat-clear --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1964,i,8482758140635542573,2774156770908990699,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=1956 /prefetch:2C:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome for Testing
Exit code:
0
Version:
124.0.6367.201
Modules
Images
c:\users\admin\appdata\local\puppeteersharp\chrome\win64-124.0.6367.201\chrome-win64\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\puppeteersharp\chrome\win64-124.0.6367.201\chrome-win64\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
4796"C:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\admin\AppData\Local\Temp\gdxyrv0y.byz" --no-appcompat-clear --field-trial-handle=5180,i,8482758140635542573,2774156770908990699,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8C:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome for Testing
Exit code:
0
Version:
124.0.6367.201
Modules
Images
c:\users\admin\appdata\local\puppeteersharp\chrome\win64-124.0.6367.201\chrome-win64\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\puppeteersharp\chrome\win64-124.0.6367.201\chrome-win64\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
6360"C:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\admin\AppData\Local\Temp\gdxyrv0y.byz" --no-appcompat-clear --field-trial-handle=1712,i,8482758140635542573,2774156770908990699,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:8C:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome for Testing
Exit code:
0
Version:
124.0.6367.201
Modules
Images
c:\users\admin\appdata\local\puppeteersharp\chrome\win64-124.0.6367.201\chrome-win64\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\puppeteersharp\chrome\win64-124.0.6367.201\chrome-win64\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
6392C:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe --type=crashpad-handler --user-data-dir=C:\Users\admin\AppData\Local\Temp\gdxyrv0y.byz /prefetch:4 --monitor-self --monitor-self-argument=--type=crashpad-handler --monitor-self-argument=--user-data-dir=C:\Users\admin\AppData\Local\Temp\gdxyrv0y.byz --monitor-self-argument=/prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\admin\AppData\Local\Temp\gdxyrv0y.byz\Crashpad --annotation=plat=Win64 "--annotation=prod=Google Chrome for Testing" --annotation=ver=124.0.6367.201 --initial-client-data=0x14c,0x150,0x154,0x128,0x158,0x7ffd710fcc70,0x7ffd710fcc7c,0x7ffd710fcc88C:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome for Testing
Exit code:
0
Version:
124.0.6367.201
Modules
Images
c:\users\admin\appdata\local\puppeteersharp\chrome\win64-124.0.6367.201\chrome-win64\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\puppeteersharp\chrome\win64-124.0.6367.201\chrome-win64\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\shcore.dll
Total events
7 976
Read events
7 929
Write events
45
Delete events
2

Modification events

(PID) Process:(8508) Roblox Account Manager.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Roblox Account Manager_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(8508) Roblox Account Manager.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Roblox Account Manager_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(8508) Roblox Account Manager.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Roblox Account Manager_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(8508) Roblox Account Manager.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Roblox Account Manager_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(8508) Roblox Account Manager.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Roblox Account Manager_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(8508) Roblox Account Manager.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Roblox Account Manager_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(8508) Roblox Account Manager.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Roblox Account Manager_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(8508) Roblox Account Manager.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Roblox Account Manager_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(8508) Roblox Account Manager.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Roblox Account Manager_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(8508) Roblox Account Manager.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Roblox Account Manager_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
20
Suspicious files
312
Text files
112
Unknown types
7

Dropped files

PID
Process
Filename
Type
8508Roblox Account Manager.exeC:\Users\admin\AppData\Local\PuppeteerSharp\chrome-win64.zip —
MD5:—
SHA256:—
8508Roblox Account Manager.exeC:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.dll —
MD5:—
SHA256:—
3112Roblox Account Manager.exeC:\Users\admin\AppData\Local\Temp\RAMTheme.initext
MD5:F18FA783F4D27E35E54E54417334BFB4
SHA256:563EB35FD613F4298CD4DCEFF67652A13BA516A6244D9407C5709323C4CA4BB1
3112Roblox Account Manager.exeC:\Users\admin\AppData\Local\Temp\Roblox Account Manager.exe.configxml
MD5:0A86FA27D09E26491DBBB4FE27F4B410
SHA256:2B6D99DB8369B0FF6372737D89D1C9E4101815B4168A3852C7B513F2897E7F3D
3112Roblox Account Manager.exeC:\Users\admin\AppData\Local\Temp\log4.configxml
MD5:E4659AC08AF3582A23F38BF6C562F841
SHA256:E4B10630D9EC2AF508DE31752FBBC6816C7426C40A3E57F0A085CE7F42C77BD5
8508Roblox Account Manager.exeC:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\icudtl.dat —
MD5:—
SHA256:—
8508Roblox Account Manager.exeC:\Users\admin\AppData\Local\Temp\RAMSettings.initext
MD5:2770C51BDC8469129A258AC8C2DA4693
SHA256:593050CBC8F30C794FD710328FAD3A51156B5648A43F2EC686A6F55F0177DABC
8508Roblox Account Manager.exeC:\Users\admin\AppData\Local\Temp\AccountData.jsonbinary
MD5:60FE50ED5051707F96E102552B6630EB
SHA256:DC4A38CF8DF84ABC228227B84844629BCFEF7A0B47CDE24C44C3014AC3216FB9
8508Roblox Account Manager.exeC:\Users\admin\AppData\Local\Temp\libsodium.dllexecutable
MD5:4F6426E3626D5D46FB19C13043CB84DE
SHA256:7A960129F6D3F8D44B4C6BE27F587C29AA8BAFB9C4D3C85BB84A5F5D8FA6E2BA
8508Roblox Account Manager.exeC:\Users\admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\124.0.6367.201.manifesttext
MD5:3694B450A908FD582AE3DAADBA743203
SHA256:B345D13EC777E4AEE396A6D49C5EE8D463E1AB93647B97FE3EAEF9CFC1116C46
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
46
TCP/UDP connections
84
DNS requests
92
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
8508
Roblox Account Manager.exe
GET
302
140.82.121.4:443
https://github.com/ic3w0lf22/Roblox-Account-Manager/raw/master/RBX%20Alt%20Manager/Resources/WatcherRegexMatches.txt
US
—
—
unknown
8508
Roblox Account Manager.exe
GET
—
142.251.141.155:443
https://storage.googleapis.com/chrome-for-testing-public/124.0.6367.201/win64/chrome-win64.zip
US
—
—
whitelisted
6768
MoUsoCoreWorker.exe
GET
304
20.73.194.208:443
https://settings-win.data.microsoft.com/settings/v3.0/OneSettings/Client?OSVersionFull=10.0.19045.4046.amd64fre.vb_release.191206-1406&LocalDeviceID=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&FlightRing=Retail&AttrDataVer=186&OSUILocale=en-US&OSSkuId=48&App=WOSC&AppVer=&IsFlightingEnabled=0&TelemetryLevel=1&DeviceFamily=Windows.Desktop
US
—
—
whitelisted
492
svchost.exe
GET
304
20.73.194.208:443
https://settings-win.data.microsoft.com/settings/v3.0/WSD/UpdateHealthTools?os=Windows&osVer=10.0.19041.1.amd64fre.vb_release.191206-&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=s:BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&sampleId=s:95271487&appVer=10.0.19041.3626&FlightRing=Retail&TelemetryLevel=1&HidOverGattReg=C%3A%5CWINDOWS%5CSystem32%5CDriverStore%5CFileRepository%5Chidbthle.inf_amd64_9610b4821fdf82a5%5CMicrosoft.Bluetooth.Profiles.HidOverGatt.dll&AppVer=&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&OEMModel=DELL&UpdateOfferedDays=4294967295&ProcessorManufacturer=AuthenticAMD&InstallDate=1661339444&OEMModelBaseBoard=&BranchReadinessLevel=CB&OEMSubModel=J5CR&IsCloudDomainJoined=0&DeferFeatureUpdatePeriodInDays=30&IsDeviceRetailDemo=0&FlightingBranchName=&OSUILocale=en-US&DeviceFamily=Windows.Desktop&WuClientVer=10.0.19041.3996&UninstallActive=1&IsFlightingEnabled=0&OSSkuId=48&ProcessorClockSpeed=3094&TotalPhysicalRAM=6144&SecureBootCapable=0&App=SedimentPack&ProcessorCores=6&CurrentBranch=vb_release&InstallLanguage=en-US&DeferQualityUpdatePeriodInDays=0&OEMName_Uncleaned=DELL&TPMVersion=0&PrimaryDiskTotalCapacity=262144&InstallationType=Client&AttrDataVer=186&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&IsEdgeWithChromiumInstalled=1&OSVersion=10.0.19045.4046&IsMDMEnrolled=0&ActivationChannel=Retail&FirmwareVersion=A.40&TrendInstalledKey=1&OSArchitecture=AMD64&DefaultUserRegion=244&UpdateManagementGroup=2
US
—
—
whitelisted
8508
Roblox Account Manager.exe
GET
—
142.251.141.155:443
https://storage.googleapis.com/chrome-for-testing-public/124.0.6367.201/win64/chrome-headless-shell-win64.zip
US
—
—
whitelisted
4472
SIHClient.exe
GET
304
20.165.94.63:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
whitelisted
4472
SIHClient.exe
GET
200
74.179.77.164:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
US
—
—
whitelisted
4472
SIHClient.exe
GET
200
20.165.94.63:443
https://slscr.update.microsoft.com/sls/ping
US
—
—
whitelisted
4472
SIHClient.exe
GET
304
20.165.94.63:443
https://slscr.update.microsoft.com/SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
whitelisted
356
svchost.exe
GET
200
23.63.118.230:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D
US
binary
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
7428
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
6768
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5568
SearchApp.exe
2.16.204.151:443
th.bing.com
AKAMAI-ASN1
NL
whitelisted
5568
SearchApp.exe
2.16.204.138:443
www.bing.com
AKAMAI-ASN1
NL
whitelisted
5568
SearchApp.exe
23.63.118.230:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
—
—
204.79.197.203:80
oneocsp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
492
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
3412
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.16.174
whitelisted
th.bing.com
  • 2.16.204.151
  • 2.16.204.157
  • 2.16.204.156
  • 2.16.204.160
  • 2.16.204.155
  • 2.16.204.152
  • 2.16.204.153
  • 2.16.204.159
  • 2.16.204.158
whitelisted
www.bing.com
  • 2.16.204.138
  • 2.16.204.135
  • 2.16.204.142
  • 2.16.204.139
  • 2.16.204.160
  • 2.16.204.137
  • 2.16.204.136
  • 2.16.204.161
  • 2.16.204.141
whitelisted
ocsp.digicert.com
  • 23.63.118.230
  • 184.30.131.245
whitelisted
oneocsp.microsoft.com
  • 204.79.197.203
whitelisted
self.events.data.microsoft.com
  • 52.178.17.232
  • 40.74.98.192
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
clientsettings.roblox.com
  • 128.116.5.3
whitelisted
github.com
  • 140.82.121.4
whitelisted
api.github.com
  • 140.82.121.6
whitelisted

Threats

PID
Process
Class
Message
2292
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
2292
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
2292
svchost.exe
Misc activity
INFO [ANY.RUN] External IP Check (ip-api .com)
Process
Message
chrome.exe
RecursiveDirectoryCreate( C:\Users\admin\AppData\Local\Temp\gdxyrv0y.byz directory exists )
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Roblox Account Manager.exe