File name:

RobloxPlayerLauncher.exe

Full analysis: https://app.any.run/tasks/cee2faa7-31cd-46b6-989b-4bda93a81361
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: April 05, 2018, 16:56:46
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

937E8D9C62990393A267B6078EBC213C

SHA1:

F33ED1265D801263B87B80DD6F29DBE66E5E6061

SHA256:

06B11B8ED8174E6E7247AB9236090C104A31CDFAB1D1808D28B04C5E8ADD8CCC

SSDEEP:

12288:AJmSri3v8vLwTNMFYVfauYL4g3kpz6ieLa9w4oSUJKOqTF4y5XLXGM9EB6Hote:AJmSri3k6guYUei6ubozhqTn5bXV9EBq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • RBX-06453795.tmp (PID: 3132)
      • RobloxPlayerLauncher.exe (PID: 2876)
      • RobloxStudioLauncherBeta.exe (PID: 2980)
      • RobloxStudioBeta.exe (PID: 2820)

    • Application loaded dropped or rewritten executable

      • RobloxStudioBeta.exe (PID: 2820)

  • SUSPICIOUS

    • Starts application with an unusual extension

      • RobloxPlayerLauncher.exe (PID: 2256)

    • Creates files in the user directory

      • RBX-06453795.tmp (PID: 3132)
      • RobloxStudioLauncherBeta.exe (PID: 2980)

    • Modifies the open verb of a shell class

      • RobloxStudioLauncherBeta.exe (PID: 2980)
      • RBX-06453795.tmp (PID: 3132)

    • Creates a software uninstall entry

      • RBX-06453795.tmp (PID: 3132)
      • RobloxStudioLauncherBeta.exe (PID: 2980)

    • Starts Internet Explorer

      • RobloxPlayerLauncher.exe (PID: 2876)

  • INFO

    • Dropped object may contain URL's

      • RobloxPlayerLauncher.exe (PID: 2256)
      • chrome.exe (PID: 916)
      • RobloxPlayerLauncher.exe (PID: 2876)
      • iexplore.exe (PID: 2944)
      • RBX-06453795.tmp (PID: 3132)
      • RobloxStudioBeta.exe (PID: 2820)
      • RobloxStudioLauncherBeta.exe (PID: 2980)

    • Dropped object may contain Bitcoin addresses

      • RBX-06453795.tmp (PID: 3132)
      • RobloxStudioLauncherBeta.exe (PID: 2980)

    • Reads settings of System Certificates

      • chrome.exe (PID: 916)

    • Application launched itself

      • chrome.exe (PID: 916)

    • Changes internet zones settings

      • iexplore.exe (PID: 1832)

    • Creates files in the user directory

      • iexplore.exe (PID: 2944)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2944)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:03:03 01:26:26+01:00
PEType: PE32
LinkerVersion: 14
CodeSize: 466944
InitializedDataSize: 686592
UninitializedDataSize: -
EntryPoint: 0x49e43
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 1.6.3.55119
ProductVersionNumber: 1.6.3.0
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Roblox Corporation
FileDescription: Roblox
FileVersion: 1, 6, 3, 186191
LegalCopyright: (C) 2012 Roblox Corporation. All rights reserved.
OriginalFileName: Roblox.exe
ProductName: Roblox Bootstrapper
ProductVersion: 1, 6, 3, 0

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 03-Mar-2018 00:26:26
Detected languages:
  • English - United States
TLS Callbacks: 1 callback(s) detected.
Debug artifacts:
  • C:\teamcity-agent\work\Trunk2017\build.msvc\Win32\Installer-Release\BootstrapperClient\RobloxPlayerLauncher.pdb
CompanyName: Roblox Corporation
FileDescription: Roblox
FileVersion: 1, 6, 3, 186191
LegalCopyright: (C) 2012 Roblox Corporation. All rights reserved.
OriginalFilename: Roblox.exe
ProductName: Roblox Bootstrapper
ProductVersion: 1, 6, 3, 0

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000128

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 7
Time date stamp: 03-Mar-2018 00:26:26
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00071E37
0x00072000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.67238
.rdata
0x00073000
0x0002AB5E
0x0002AC00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.52267
.data
0x0009E000
0x00054EDC
0x00003800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.60533
.gfids
0x000F3000
0x00000150
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
2.92399
.tls
0x000F4000
0x00000009
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.0203931
.rsrc
0x000F5000
0x0001FE08
0x00020000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.73679
.reloc
0x00115000
0x000078F4
0x00007A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.62645

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.07176
640
UNKNOWN
English - United States
RT_MANIFEST
2
2.79069
90
UNKNOWN
English - United States
RT_GROUP_ICON
3
3.19587
4264
UNKNOWN
English - United States
RT_ICON
4
3.02768
9640
UNKNOWN
English - United States
RT_ICON
5
2.69822
67624
UNKNOWN
English - United States
RT_ICON
6
7.90744
7216
UNKNOWN
English - United States
RT_ICON
7
3.44591
446
UNKNOWN
English - United States
RT_STRING
130
3.12907
254
UNKNOWN
English - United States
RT_DIALOG
131
2
8
UNKNOWN
English - United States
RT_ACCELERATOR
157
7.30906
665
UNKNOWN
English - United States
PNG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
IPHLPAPI.DLL
KERNEL32.dll
OLEAUT32.dll
PSAPI.DLL
SHELL32.dll
SHLWAPI.dll
SensApi.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
51
Monitored processes
12
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start robloxplayerlauncher.exe rbx-06453795.tmp chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs robloxplayerlauncher.exe no specs iexplore.exe no specs iexplore.exe no specs robloxstudiolauncherbeta.exe robloxstudiobeta.exe

Process information

PID
CMD
Path
Indicators
Parent process
688"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,9391185367470600672,10708217599337876664,131072 --service-pipe-token=C0733AF9C56D262AB1B56C54AB8A7DCA --lang=en-US --disable-client-side-phishing-detection --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --disable-accelerated-video-decode --disable-gpu-compositing --enable-gpu-async-worker-context --service-request-channel-token=C0733AF9C56D262AB1B56C54AB8A7DCA --renderer-client-id=4 --mojo-platform-channel-handle=1616 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
61.0.3163.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\61.0.3163.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
916"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe—explorer.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
61.0.3163.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\61.0.3163.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1520"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=3396 --on-initialized-event-handle=296 --parent-handle=300 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
61.0.3163.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\61.0.3163.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1832"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe—RobloxPlayerLauncher.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1916"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=61.0.3163.100 --initial-client-data=0x78,0x7c,0x80,0x74,0x84,0x6f547d7c,0x6f547da4,0x6f547d8cC:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
61.0.3163.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\61.0.3163.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2256"C:\Users\admin\AppData\Local\Temp\RobloxPlayerLauncher.exe" C:\Users\admin\AppData\Local\Temp\RobloxPlayerLauncher.exe
explorer.exe
User:
admin
Company:
Roblox Corporation
Integrity Level:
MEDIUM
Description:
Roblox
Exit code:
0
Version:
1, 6, 3, 186191
Modules
Images
c:\users\admin\appdata\local\temp\robloxplayerlauncher.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2820"C:\Users\admin\AppData\Local\Roblox\Versions\version-be9418b47a454443\RobloxStudioBeta.exe" -startEvent www.roblox.com/robloxQTStudioStartedEvent C:\Users\admin\AppData\Local\Roblox\Versions\version-be9418b47a454443\RobloxStudioBeta.exe
RobloxStudioLauncherBeta.exe
User:
admin
Company:
Roblox Corporation
Integrity Level:
MEDIUM
Description:
RobloxStudio
Exit code:
1
Version:
0, 332, 0, 192405
Modules
Images
c:\users\admin\appdata\local\roblox\versions\version-be9418b47a454443\robloxstudiobeta.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\roblox\versions\version-be9418b47a454443\qt5gui.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2876"C:\Users\admin\AppData\Local\Roblox\Versions\version-12cdfcefc081488c\RobloxPlayerLauncher.exe" -browserC:\Users\admin\AppData\Local\Roblox\Versions\version-12cdfcefc081488c\RobloxPlayerLauncher.exe—explorer.exe
User:
admin
Company:
Roblox Corporation
Integrity Level:
MEDIUM
Description:
Roblox
Exit code:
0
Version:
1, 6, 3, 192405
Modules
Images
c:\users\admin\appdata\local\roblox\versions\version-12cdfcefc081488c\robloxplayerlauncher.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2944"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1832 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2980"C:\Users\admin\AppData\Local\Roblox\Versions\RobloxStudioLauncherBeta.exe" -ideC:\Users\admin\AppData\Local\Roblox\Versions\RobloxStudioLauncherBeta.exe
explorer.exe
User:
admin
Company:
Roblox Corporation
Integrity Level:
MEDIUM
Description:
Roblox
Exit code:
0
Version:
1, 6, 3, 192405
Modules
Images
c:\users\admin\appdata\local\roblox\versions\robloxstudiolauncherbeta.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
1 847
Read events
1 551
Write events
282
Delete events
14

Modification events

(PID) Process:(2256) RobloxPlayerLauncher.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RobloxPlayerLauncher_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2256) RobloxPlayerLauncher.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RobloxPlayerLauncher_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2256) RobloxPlayerLauncher.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RobloxPlayerLauncher_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(2256) RobloxPlayerLauncher.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RobloxPlayerLauncher_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(2256) RobloxPlayerLauncher.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RobloxPlayerLauncher_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(2256) RobloxPlayerLauncher.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RobloxPlayerLauncher_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(2256) RobloxPlayerLauncher.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RobloxPlayerLauncher_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2256) RobloxPlayerLauncher.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RobloxPlayerLauncher_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2256) RobloxPlayerLauncher.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RobloxPlayerLauncher_RASMANCS
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(2256) RobloxPlayerLauncher.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RobloxPlayerLauncher_RASMANCS
Operation:writeName:ConsoleTracingMask
Value:
4294901760
Executable files
85
Suspicious files
159
Text files
2 142
Unknown types
265

Dropped files

PID
Process
Filename
Type
2256RobloxPlayerLauncher.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QVXW39X5\GetCurrentClientVersionUpload[1] —
MD5:—
SHA256:—
3132RBX-06453795.tmpC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JZR4RKAB\GetCurrentClientVersionUpload[1] —
MD5:—
SHA256:—
3132RBX-06453795.tmpC:\Users\admin\AppData\Local\Temp\RBX-16BDA781.tmp —
MD5:—
SHA256:—
3132RBX-06453795.tmpC:\Users\admin\AppData\Local\Temp\RBX-6DC68AA6.tmp —
MD5:—
SHA256:—
3132RBX-06453795.tmpC:\Users\admin\AppData\Local\Temp\RBX-8FAFEE6F.tmp —
MD5:—
SHA256:—
3132RBX-06453795.tmpC:\Users\admin\AppData\Local\Temp\RBX-DD6D2B47.tmp —
MD5:—
SHA256:—
3132RBX-06453795.tmpC:\Users\admin\AppData\Local\Temp\RBX-F1F87A73.tmpexecutable
MD5:—
SHA256:—
3132RBX-06453795.tmpC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QVXW39X5\WindowsBootstrapperSettings[1]text
MD5:—
SHA256:—
3132RBX-06453795.tmpC:\Users\admin\Desktop\Roblox Studio.lnklnk
MD5:—
SHA256:—
2256RobloxPlayerLauncher.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JZR4RKAB\WindowsBootstrapperSettings[1]text
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
101
TCP/UDP connections
80
DNS requests
27
Threats
1 410

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
8.42.96.25:80
http://www.roblox.com/Game/JoinRate.ashx?c=ClientBootstrapperUpdateSelf&r=Success&d=4953&platform=Win32
US
—
—
whitelisted
—
—
POST
200
8.42.96.25:80
http://www.roblox.com/game/report-stats?name=ClientBootstrapperUpdateSelf_Duration&value=4953
US
—
—
whitelisted
—
—
GET
200
8.42.96.25:80
http://www.roblox.com/Game/JoinRate.ashx?c=ClientBootstrapperDetailed&r=Success&d=5703&platform=Win32
US
—
—
whitelisted
—
—
POST
200
8.42.96.25:80
http://www.roblox.com/game/report-stats?name=ClientBootstrapperDetailed_Duration&value=5703
US
—
—
whitelisted
—
—
GET
200
8.42.96.47:80
http://clientsettings.api.roblox.com/Setting/QuietGet/WindowsBootstrapperSettings/?apiKey=76E5A40C-3AE1-4028-9F10-7C62520BD94F
US
text
2.80 Kb
malicious
—
—
GET
200
209.206.41.35:80
http://versioncompatibility.api.roblox.com/GetCurrentClientVersionUpload/?apiKey=76e5a40c-3ae1-4028-9f10-7c62520bd94f&binaryType=WindowsPlayer
US
text
26 b
whitelisted
—
—
GET
200
8.42.96.47:80
http://clientsettings.api.roblox.com/Setting/QuietGet/WindowsBootstrapperSettings/?apiKey=76E5A40C-3AE1-4028-9F10-7C62520BD94F
US
text
2.80 Kb
malicious
—
—
GET
200
8.42.96.25:80
http://www.roblox.com/install/GetInstallerCdns.ashx
US
text
54 b
whitelisted
—
—
POST
200
8.42.96.168:80
http://ephemeralcounters.api.roblox.com/v1.0/MultiIncrement/?apiKey=76E5A40C-3AE1-4028-9F10-7C62520BD94F
US
—
—
whitelisted
—
—
GET
200
205.234.175.102:80
http://setup.rbxcdn.com/version-12cdfcefc081488c-RobloxPlayerLauncher.exe
US
executable
818 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
8.42.96.47:80
clientsettings.api.roblox.com
Roblox
US
unknown
—
—
209.206.41.35:80
versioncompatibility.api.roblox.com
Roblox
US
unknown
—
—
205.234.175.102:80
setup.rbxcdn.com
CacheNetworks, Inc.
US
suspicious
—
—
52.216.162.221:80
s3.amazonaws.com
Amazon.com, Inc.
US
shared
—
—
8.42.96.30:80
www.roblox.com
Roblox
US
unknown
—
—
54.165.151.168:8092
ec2-54-165-151-168.compute-1.amazonaws.com
Amazon.com, Inc.
US
unknown
—
—
172.217.18.14:80
www.google-analytics.com
Google Inc.
US
whitelisted
—
—
172.217.18.3:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
—
—
8.42.96.136:80
www.roblox.com
Roblox
US
unknown
—
—
216.58.208.35:443
ssl.gstatic.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
clientsettings.api.roblox.com
  • 8.42.96.47
malicious
ephemeralcounters.api.roblox.com
  • 8.42.96.168
whitelisted
versioncompatibility.api.roblox.com
  • 209.206.41.35
whitelisted
setup.roblox.com
  • 52.216.22.37
shared
www.roblox.com
  • 8.42.96.25
  • 8.42.96.30
  • 8.42.96.136
  • 8.42.96.42
whitelisted
setup.rbxcdn.com
  • 205.234.175.102
whitelisted
s3.amazonaws.com
  • 52.216.22.37
  • 52.216.162.221
  • 52.216.0.91
  • 52.216.101.61
shared
setup-cxs.rbxcdn.com
  • 205.234.175.102
malicious
www.google-analytics.com
  • 172.217.18.14
whitelisted
ec2-54-165-151-168.compute-1.amazonaws.com
  • 54.165.151.168
unknown

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
—
—
Misc activity
ET INFO EXE - Served Inline HTTP
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
—
—
Misc activity
ET INFO EXE - Served Inline HTTP
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
—
—
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
—
—
Misc activity
ET INFO EXE - Served Attached HTTP
—
—
A Network Trojan was detected
ET CNC Feodo Tracker Reported CnC Server group 22
—
—
Potentially Bad Traffic
ET INFO GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1
—
—
A Network Trojan was detected
ET CNC Feodo Tracker Reported CnC Server group 9
Process
Message
RobloxStudioBeta.exe
RobloxStudioBeta.exe
RobloxStudioBeta.exe
1522947502.09221,0734,6 WatcherThread Started
RobloxStudioBeta.exe
RobloxStudioBeta.exe
RobloxStudioBeta.exe
RobloxStudioBeta.exe
1522947502.09685,0ed8,6 Info: RobloxMainWindow::RobloxMainWindow - start
RobloxStudioBeta.exe
RobloxStudioBeta.exe
RobloxStudioBeta.exe
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
RobloxPlayerLauncher.exe