File name:

RobloxStudioLauncherBeta.exe

Full analysis: https://app.any.run/tasks/a6901277-115a-4928-a04c-57d27267150d
Verdict: Malicious activity
Analysis date: April 23, 2025, 17:54:47
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

281BA523ED563C4A9129C79C66B08E89

SHA1:

74302B54E3EE848431D46664AB3B14EA35189481

SHA256:

3363D739713653227E4EA197EFD2D1BD019ADFE7B07C24FE81CBBD552A74CF66

SSDEEP:

6144:v4jamv+nPbibnGqJNM/jMWzFbzpF8zHdfSnUbOLxi/bI:rZnPHqQ/jnpF0wUuH

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Detected use of alternative data streams (AltDS)

      • RobloxStudioLauncherBeta.exe (PID: 2140)

    • Reads security settings of Internet Explorer

      • RobloxStudioLauncherBeta.exe (PID: 2140)

    • Executable content was dropped or overwritten

      • RobloxStudioLauncherBeta.exe (PID: 2140)

    • Process drops legitimate windows executable

      • RobloxStudioLauncherBeta.exe (PID: 2140)

    • The process drops C-runtime libraries

      • RobloxStudioLauncherBeta.exe (PID: 2140)

    • Creates a software uninstall entry

      • RobloxStudioLauncherBeta.exe (PID: 2140)

  • INFO

    • Reads the computer name

      • RobloxStudioLauncherBeta.exe (PID: 2140)

    • Checks supported languages

      • RobloxStudioLauncherBeta.exe (PID: 2140)
      • RobloxStudioBeta.exe (PID: 920)

    • The sample compiled with english language support

      • RobloxStudioLauncherBeta.exe (PID: 2140)

    • Checks proxy server information

      • RobloxStudioLauncherBeta.exe (PID: 2140)
      • slui.exe (PID: 5260)

    • Reads the software policy settings

      • RobloxStudioLauncherBeta.exe (PID: 2140)
      • slui.exe (PID: 5260)
      • slui.exe (PID: 6240)

    • Reads the machine GUID from the registry

      • RobloxStudioLauncherBeta.exe (PID: 2140)

    • Create files in a temporary directory

      • RobloxStudioLauncherBeta.exe (PID: 2140)

    • Process checks computer location settings

      • RobloxStudioLauncherBeta.exe (PID: 2140)

    • Creates files or folders in the user directory

      • RobloxStudioLauncherBeta.exe (PID: 2140)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:08:23 09:37:22+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 271872
InitializedDataSize: 481280
UninitializedDataSize: -
EntryPoint: 0x3b434
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 5.0.0.4
ProductVersionNumber: 1.6.0.0
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Roblox Corporation
FileDescription: ECS:R Bootstrapper
FileVersion: 5, 0, 0, 004
LegalCopyright: (C) 2012 Roblox Corporation. All rights reserved.
OriginalFileName: Roblox.exe
ProductName: ECS:R Bootstrapper
ProductVersion: 1, 6, 0, 0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
149
Monitored processes
9
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start robloxstudiolauncherbeta.exe sppextcomobj.exe no specs slui.exe robloxstudiobeta.exe no specs slui.exe ucpdmgr.exe no specs conhost.exe no specs ucpdmgr.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
516"C:\WINDOWS\system32\UCPDMgr.exe"C:\Windows\System32\UCPDMgr.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
User Choice Protection Manager
Exit code:
0
Version:
1.0.0.414301
Modules
Images
c:\windows\system32\ucpdmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
920"C:\Users\admin\AppData\Local\ECSR\Versions\ECSRStudio230824\RobloxStudioBeta.exe" -browser -startEvent www.roblox.com/robloxQTStudioStartedEvent C:\Users\admin\AppData\Local\ECSR\Versions\ECSRStudio230824\RobloxStudioBeta.exe—RobloxStudioLauncherBeta.exe
User:
admin
Company:
Roblox Corporation
Integrity Level:
MEDIUM
Description:
RobloxStudio
Exit code:
3221225781
Version:
0,75,0,691
Modules
Images
c:\users\admin\appdata\local\ecsr\versions\ecsrstudio230824\robloxstudiobeta.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2140"C:\Users\admin\AppData\Local\Temp\RobloxStudioLauncherBeta.exe" C:\Users\admin\AppData\Local\Temp\RobloxStudioLauncherBeta.exe
explorer.exe
User:
admin
Company:
Roblox Corporation
Integrity Level:
MEDIUM
Description:
ECS:R Bootstrapper
Exit code:
0
Version:
5, 0, 0, 004
Modules
Images
c:\users\admin\appdata\local\temp\robloxstudiolauncherbeta.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
3300\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—UCPDMgr.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5112C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
5260C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5864\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—UCPDMgr.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6036"C:\WINDOWS\system32\UCPDMgr.exe"C:\Windows\System32\UCPDMgr.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
User Choice Protection Manager
Exit code:
0
Version:
1.0.0.414301
Modules
Images
c:\windows\system32\ucpdmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6240"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
1 941
Read events
1 895
Write events
44
Delete events
2

Modification events

(PID) Process:(2140) RobloxStudioLauncherBeta.exeKey:HKEY_CURRENT_USER\SOFTWARE\StudioQTRobloxReg
Operation:writeName:install host
Value:
ecsr.io
(PID) Process:(2140) RobloxStudioLauncherBeta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3BD126E9-97F0-48F2-BF3E-3D96137E7801}
Operation:writeName:AppName
Value:
RobloxStudioLauncherBeta.exe
(PID) Process:(2140) RobloxStudioLauncherBeta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3BD126E9-97F0-48F2-BF3E-3D96137E7801}
Operation:writeName:Policy
Value:
3
(PID) Process:(2140) RobloxStudioLauncherBeta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3BD126E9-97F0-48F2-BF3E-3D96137E7801}
Operation:writeName:AppPath
Value:
C:\Users\admin\AppData\Local\ECSR\Versions\ECSRStudio230824\
(PID) Process:(2140) RobloxStudioLauncherBeta.exeKey:HKEY_CURRENT_USER\SOFTWARE\ROBLOX Corporation\Roblox
Operation:writeName:CPath
Value:
C:\Users\admin\AppData\LocalLow\rbxcsettings.rbx
(PID) Process:(2140) RobloxStudioLauncherBeta.exeKey:HKEY_CURRENT_USER\SOFTWARE\ROBLOX Corporation\Roblox
Operation:delete valueName:curStudioVer
Value:
(PID) Process:(2140) RobloxStudioLauncherBeta.exeKey:HKEY_CURRENT_USER\SOFTWARE\ROBLOX Corporation\Roblox
Operation:delete valueName:curStudioUrl
Value:
(PID) Process:(2140) RobloxStudioLauncherBeta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2140) RobloxStudioLauncherBeta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2140) RobloxStudioLauncherBeta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
29
Suspicious files
419
Text files
513
Unknown types
0

Dropped files

PID
Process
Filename
Type
2140RobloxStudioLauncherBeta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:00AD475AEE4CDB4E96F9619CE1E171E4
SHA256:085FB77D99DABD5E09B94DE31B9F273BBA767EBF9B16A768E5BD994DD5E2AE74
2140RobloxStudioLauncherBeta.exeC:\Users\admin\AppData\Local\Temp\RBX-47D56D51.tmpcompressed
MD5:2368B7F3D6B3A3FABC30A4B6B7A55B4D
SHA256:54CB92D9A86E2ADB9E21A1508A8F35EEA4C4379DF26DE15F65BA1893EB3155DD
2140RobloxStudioLauncherBeta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:4A90329071AE30B759D279CCA342B0A6
SHA256:4F544379EDA8E2653F71472AB968AEFD6B5D1F4B3CE28A5EDB14196184ED3B60
2140RobloxStudioLauncherBeta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\GetCurrentClientVersionUpload[1].txttext
MD5:1187BCC46013440BEE8AD0CD7159F4DE
SHA256:C6D44902505369127C00273F25F38202D309571358D0EC1EAEE548F29208E44C
2140RobloxStudioLauncherBeta.exeC:\Users\admin\AppData\Local\Temp\RBX-729EF641.tmpcompressed
MD5:14E6564D6DE4251A2CE10193C624B04A
SHA256:2031CE108498EEE6BF02921F6B89641845350375AE83781E51E80A0C0E4746B7
2140RobloxStudioLauncherBeta.exeC:\Users\admin\AppData\Local\ECSR\Versions\ECSRStudio230824\RobloxStudioLauncherBeta.exeexecutable
MD5:281BA523ED563C4A9129C79C66B08E89
SHA256:3363D739713653227E4EA197EFD2D1BD019ADFE7B07C24FE81CBBD552A74CF66
2140RobloxStudioLauncherBeta.exeC:\Users\admin\AppData\Local\ECSR\Downloads\1dbb249eb7375b6compressed
MD5:E22DDD66B8CB8DFD9956A5D06651A930
SHA256:E8EC7E17E14509B6D5B56BCACCEC6F0B2931D29360DDAFD791C9DA8243B2AA72
2140RobloxStudioLauncherBeta.exeC:\Users\admin\AppData\Local\Temp\RBX-7CEF0298.tmpcompressed
MD5:E22DDD66B8CB8DFD9956A5D06651A930
SHA256:E8EC7E17E14509B6D5B56BCACCEC6F0B2931D29360DDAFD791C9DA8243B2AA72
2140RobloxStudioLauncherBeta.exeC:\Users\admin\AppData\Local\Temp\RBX-7E9F0F4A.tmpcompressed
MD5:41EE1F6B9A0B1C93F35A4DA2B22E071A
SHA256:DEDA4C6DAA3B0285A7FA3327853477CEF0591900E458E47AA9F07DA8162CB85A
2140RobloxStudioLauncherBeta.exeC:\Users\admin\AppData\Local\Temp\RBX-D7BD1587.tmpcompressed
MD5:D056E0F75769DE701496E7D13CB51349
SHA256:397625143E63D242BD2D5690785D7171B4F0BFC7785AC13DFDE669288F59FBAA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
24
TCP/UDP connections
59
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.19.11.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2140
RobloxStudioLauncherBeta.exe
GET
200
142.250.185.131:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
2140
RobloxStudioLauncherBeta.exe
GET
200
104.21.16.1:80
http://ecsr.io/BootstrapperDeployment/ECSRBootstrapper-BootstrapperQTStudioVersion.txt
unknown
—
—
unknown
2140
RobloxStudioLauncherBeta.exe
GET
200
104.21.16.1:80
http://ecsr.io/BootstrapperDeployment/ECSRStudio230824-Libraries.zip
unknown
—
—
unknown
2140
RobloxStudioLauncherBeta.exe
GET
200
142.250.185.131:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
2140
RobloxStudioLauncherBeta.exe
GET
200
104.21.16.1:80
http://ecsr.io/BootstrapperDeployment/ECSRStudio230824-RobloxStudio.zip
unknown
—
—
unknown
2140
RobloxStudioLauncherBeta.exe
GET
200
104.21.16.1:80
http://ecsr.io/BootstrapperDeployment/ECSRStudio230824-redist.zip
unknown
—
—
unknown
2140
RobloxStudioLauncherBeta.exe
GET
200
104.21.16.1:80
http://ecsr.io/BootstrapperDeployment/ECSRStudio230824-content-terrain.zip
unknown
—
—
unknown
2140
RobloxStudioLauncherBeta.exe
GET
200
104.21.16.1:80
http://ecsr.io/BootstrapperDeployment/ECSRStudio230824-imageformats.zip
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
2.19.11.120:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
5496
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
2104
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2140
RobloxStudioLauncherBeta.exe
104.21.16.1:443
ecsr.io
CLOUDFLARENET
—
unknown
2140
RobloxStudioLauncherBeta.exe
142.250.185.131:80
c.pki.goog
GOOGLE
US
whitelisted
2140
RobloxStudioLauncherBeta.exe
104.21.16.1:80
ecsr.io
CLOUDFLARENET
—
unknown
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.78
whitelisted
crl.microsoft.com
  • 2.19.11.120
  • 2.19.11.105
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 184.30.21.171
whitelisted
ecsr.io
  • 104.21.16.1
  • 104.21.112.1
  • 104.21.96.1
  • 104.21.64.1
  • 104.21.32.1
  • 104.21.80.1
  • 104.21.48.1
unknown
c.pki.goog
  • 142.250.185.131
whitelisted
client.wns.windows.com
  • 172.211.123.250
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.159.4
  • 20.190.159.71
  • 20.190.159.75
  • 40.126.31.69
  • 40.126.31.128
  • 20.190.159.64
  • 20.190.159.0
  • 40.126.31.129
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
RobloxStudioLauncherBeta.exe