| File name: | RobloxPlayerLauncher.exe |
| Full analysis: | https://app.any.run/tasks/b7b2123a-ed17-4cb6-a52d-90238a24116f |
| Verdict: | Malicious activity |
| Analysis date: | April 11, 2020, 17:39:56 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | 78D5CBFAC273157D5B64EBCBC61D591E |
| SHA1: | 1E8064ED627E42678DF6D732A809829682439BFC |
| SHA256: | 45E62286244137F00188A982364D841210049C328062241C62BAACF513D8496B |
| SSDEEP: | 24576:31Tj6RDNyjT11gXhrHbngU5RbYnjo+/+rn08+zZge35TSPpa0p5TYfgAnWK3HLM+:38RcTRU5qs+X8+zZg0TSRa0p5TGgAnWM |
MALICIOUS
No malicious indicators.SUSPICIOUS
Application launched itself
- RobloxPlayerLauncher.exe (PID: 1024)
- RobloxPlayerLauncher.exe (PID: 3460)
- RobloxPlayerLauncher.exe (PID: 2128)
Reads Internet Cache Settings
- RobloxPlayerLauncher.exe (PID: 1024)
- RobloxPlayerLauncher.exe (PID: 3128)
- RobloxPlayerLauncher.exe (PID: 3460)
- RobloxPlayerLauncher.exe (PID: 2904)
- RobloxPlayerLauncher.exe (PID: 2128)
- RobloxPlayerLauncher.exe (PID: 3640)
Executable content was dropped or overwritten
- RobloxPlayerLauncher.exe (PID: 1024)
Creates a software uninstall entry
- RobloxPlayerLauncher.exe (PID: 1024)
Creates files in the user directory
- RobloxPlayerLauncher.exe (PID: 1024)
Modifies the open verb of a shell class
- RobloxPlayerLauncher.exe (PID: 1024)
Starts Internet Explorer
- RobloxPlayerLauncher.exe (PID: 3460)
Executed via COM
- FlashUtil32_26_0_0_131_ActiveX.exe (PID: 3136)
INFO
Dropped object may contain Bitcoin addresses
- RobloxPlayerLauncher.exe (PID: 1024)
Manual execution by user
- RobloxPlayerLauncher.exe (PID: 3460)
- taskmgr.exe (PID: 2756)
Changes internet zones settings
- iexplore.exe (PID: 2392)
Reads Internet Cache Settings
- iexplore.exe (PID: 2392)
- iexplore.exe (PID: 3844)
Reads internet explorer settings
- iexplore.exe (PID: 3844)
Creates files in the user directory
- iexplore.exe (PID: 3844)
- FlashUtil32_26_0_0_131_ActiveX.exe (PID: 3136)
- iexplore.exe (PID: 2392)
Reads settings of System Certificates
- RobloxPlayerBeta.exe (PID: 1916)
- iexplore.exe (PID: 2392)
Changes settings of System certificates
- iexplore.exe (PID: 2392)
Adds / modifies Windows certificates
- iexplore.exe (PID: 2392)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win64 Executable (generic) (76.4) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (12.4) |
| .exe | | | Generic Win/DOS Executable (5.5) |
| .exe | | | DOS Executable Generic (5.5) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2020:04:03 23:38:07+02:00 |
| PEType: | PE32 |
| LinkerVersion: | 14.16 |
| CodeSize: | 1060864 |
| InitializedDataSize: | 479232 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xbb001 |
| OSVersion: | 5.1 |
| ImageVersion: | - |
| SubsystemVersion: | 5.1 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.6.0.6041 |
| ProductVersionNumber: | 1.6.0.6041 |
| FileFlagsMask: | 0x0017 |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Unicode |
| CompanyName: | Roblox Corporation |
| FileDescription: | Roblox |
| FileVersion: | 1, 6, 0, 399257 |
| LegalCopyright: | Copyright © 2020 Roblox Corporation. All rights reserved. |
| OriginalFileName: | Roblox.exe |
| ProductName: | Roblox Bootstrapper |
| ProductVersion: | 1, 6, 0, 399257 |
Summary
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 03-Apr-2020 21:38:07 |
| Detected languages: |
|
| TLS Callbacks: | 1 callback(s) detected. |
| Debug artifacts: |
|
| CompanyName: | Roblox Corporation |
| FileDescription: | Roblox |
| FileVersion: | 1, 6, 0, 399257 |
| LegalCopyright: | Copyright © 2020 Roblox Corporation. All rights reserved. |
| OriginalFilename: | Roblox.exe |
| ProductName: | Roblox Bootstrapper |
| ProductVersion: | 1, 6, 0, 399257 |
DOS Header
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x0090 |
| Pages in file: | 0x0003 |
| Relocations: | 0x0000 |
| Size of header: | 0x0004 |
| Min extra paragraphs: | 0x0000 |
| Max extra paragraphs: | 0xFFFF |
| Initial SS value: | 0x0000 |
| Initial SP value: | 0x00B8 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x0000 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x0000 |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x00000128 |
PE Headers
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| Number of sections: | 6 |
| Time date stamp: | 03-Apr-2020 21:38:07 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00E0 |
| Characteristics: |
|
Sections
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
.text | 0x00001000 | 0x00102EFC | 0x00103000 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.55062 |
.rdata | 0x00104000 | 0x0004751A | 0x00047600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.69372 |
.data | 0x0014C000 | 0x000575D8 | 0x00005C00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.76755 |
CPADinfo( | 0x001A4000 | 0x00000028 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0.122276 |
.rsrc | 0x001A5000 | 0x0001AEE0 | 0x0001B000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 6.92271 |
.reloc | 0x001C0000 | 0x0000CB10 | 0x0000CC00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 6.63544 |
Resources
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 5.28732 | 1010 | Latin 1 / Western European | English - United States | RT_MANIFEST |
2 | 2.78815 | 76 | Latin 1 / Western European | Process Default Language | RT_GROUP_ICON |
3 | 4.77404 | 4264 | Latin 1 / Western European | Process Default Language | RT_ICON |
4 | 4.46883 | 16672 | Latin 1 / Western European | Process Default Language | RT_ICON |
5 | 4.5291 | 9640 | Latin 1 / Western European | Process Default Language | RT_ICON |
7 | 3.38178 | 488 | Latin 1 / Western European | Portuguese - Brazil | RT_STRING |
8 | 3.37397 | 942 | Latin 1 / Western European | Portuguese - Brazil | RT_STRING |
9 | 3.0813 | 666 | Latin 1 / Western European | Portuguese - Brazil | RT_STRING |
11 | 1.10136 | 46 | Latin 1 / Western European | English - United States | RT_STRING |
130 | 3.12907 | 254 | Latin 1 / Western European | Process Default Language | RT_DIALOG |
Imports
ADVAPI32.dll |
COMCTL32.dll |
GDI32.dll |
KERNEL32.dll |
OLEAUT32.dll |
POWRPROF.dll |
SHELL32.dll |
SHLWAPI.dll |
SensApi.dll |
USER32.dll |
Total processes
53
Monitored processes
11
Malicious processes
1
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1024 | "C:\Users\admin\AppData\Local\Temp\RobloxPlayerLauncher.exe" | C:\Users\admin\AppData\Local\Temp\RobloxPlayerLauncher.exe | explorer.exe | ||||||||||||
User: admin Company: Roblox Corporation Integrity Level: MEDIUM Description: Roblox Exit code: 0 Version: 1, 6, 0, 399257 Modules
| |||||||||||||||
| 1916 | "C:\Users\admin\AppData\Local\Roblox\Versions\version-76da16af95e2466c\RobloxPlayerBeta.exe" --play -a https://www.roblox.com/Login/Negotiate.ashx -t 67C3F559B4A2C8DDA11670F7562B16198DB1F2B7D579DE5345EECCB2B91FF8CD6E07991BD5F04BC89DFB23DCA60A8FB5762CE315C9A2A5B324FA055472E0D0AF71CDDC59402D04801BD8A08459BD7BB59DC9D1FE39F55092618E2B2D0B2DB6CCC4F670A30E51EEAE679A5A3BD7C962E284E7E798744E0F82FEB0E0E2A0F013474666D9FB67D058BA07F4C2B1193805FFD01A4B9FE6CFBF2A4A3D7101D6D1C8EA28BCEEFD -j https://assetgame.roblox.com/game/PlaceLauncher.ashx?request=RequestGame&browserTrackerId=50058393964&placeId=192800&isPlayTogetherGame=false -b 50058393964 --launchtime=1586626972885 --rloc en_us --gloc en_us | C:\Users\admin\AppData\Local\Roblox\Versions\version-76da16af95e2466c\RobloxPlayerBeta.exe | RobloxPlayerLauncher.exe | ||||||||||||
User: admin Company: Roblox Corporation Integrity Level: LOW Description: Roblox Game Client Exit code: 1 Version: 0, 427, 0, 399257 Modules
| |||||||||||||||
| 2128 | "C:\Users\admin\AppData\Local\Roblox\Versions\version-76da16af95e2466c\RobloxPlayerLauncher.exe" roblox-player:1+launchmode:play+gameinfo:67C3F559B4A2C8DDA11670F7562B16198DB1F2B7D579DE5345EECCB2B91FF8CD6E07991BD5F04BC89DFB23DCA60A8FB5762CE315C9A2A5B324FA055472E0D0AF71CDDC59402D04801BD8A08459BD7BB59DC9D1FE39F55092618E2B2D0B2DB6CCC4F670A30E51EEAE679A5A3BD7C962E284E7E798744E0F82FEB0E0E2A0F013474666D9FB67D058BA07F4C2B1193805FFD01A4B9FE6CFBF2A4A3D7101D6D1C8EA28BCEEFD+launchtime:1586626972885+placelauncherurl:https://assetgame.roblox.com/game/PlaceLauncher.ashx?request=RequestGame&browserTrackerId=50058393964&placeId=192800&isPlayTogetherGame=false+browsertrackerid:50058393964+robloxLocale:en_us+gameLocale:en_us | C:\Users\admin\AppData\Local\Roblox\Versions\version-76da16af95e2466c\RobloxPlayerLauncher.exe | iexplore.exe | ||||||||||||
User: admin Company: Roblox Corporation Integrity Level: LOW Description: Roblox Exit code: 0 Version: 1, 6, 0, 399257 Modules
| |||||||||||||||
| 2392 | "C:\Program Files\Internet Explorer\iexplore.exe" http://www.roblox.com/games/?referrer=roblox-player | C:\Program Files\Internet Explorer\iexplore.exe | RobloxPlayerLauncher.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1073807364 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
| 2756 | "C:\Windows\system32\taskmgr.exe" | C:\Windows\system32\taskmgr.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Task Manager Exit code: 1073807364 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2904 | C:\Users\admin\AppData\Local\Roblox\Versions\version-76da16af95e2466c\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x4e4,0x4e8,0x4ec,0x4e0,0x4f4,0x2923a4,0x2923b4,0x2923c4 | C:\Users\admin\AppData\Local\Roblox\Versions\version-76da16af95e2466c\RobloxPlayerLauncher.exe | RobloxPlayerLauncher.exe | ||||||||||||
User: admin Company: Roblox Corporation Integrity Level: MEDIUM Description: Roblox Exit code: 0 Version: 1, 6, 0, 399257 Modules
| |||||||||||||||
| 3128 | C:\Users\admin\AppData\Local\Temp\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x518,0x51c,0x520,0x50c,0x528,0xad23a4,0xad23b4,0xad23c4 | C:\Users\admin\AppData\Local\Temp\RobloxPlayerLauncher.exe | RobloxPlayerLauncher.exe | ||||||||||||
User: admin Company: Roblox Corporation Integrity Level: MEDIUM Description: Roblox Exit code: 0 Version: 1, 6, 0, 399257 Modules
| |||||||||||||||
| 3136 | C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -Embedding | C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe | — | svchost.exe | |||||||||||
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe® Flash® Player Installer/Uninstaller 26.0 r0 Exit code: 1073807364 Version: 26,0,0,131 Modules
| |||||||||||||||
| 3460 | "C:\Users\admin\AppData\Local\Roblox\Versions\version-76da16af95e2466c\RobloxPlayerLauncher.exe" -browser | C:\Users\admin\AppData\Local\Roblox\Versions\version-76da16af95e2466c\RobloxPlayerLauncher.exe | explorer.exe | ||||||||||||
User: admin Company: Roblox Corporation Integrity Level: MEDIUM Description: Roblox Exit code: 0 Version: 1, 6, 0, 399257 Modules
| |||||||||||||||
| 3640 | C:\Users\admin\AppData\Local\Roblox\Versions\version-76da16af95e2466c\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\admin\AppData\Local\Temp\Low\crashpad_roblox --metrics-dir=C:\Users\admin\AppData\Local\Temp\Low\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x4e4,0x4ec,0x4f0,0x4e8,0x4f8,0x15423a4,0x15423b4,0x15423c4 | C:\Users\admin\AppData\Local\Roblox\Versions\version-76da16af95e2466c\RobloxPlayerLauncher.exe | RobloxPlayerLauncher.exe | ||||||||||||
User: admin Company: Roblox Corporation Integrity Level: LOW Description: Roblox Exit code: 0 Version: 1, 6, 0, 399257 Modules
| |||||||||||||||
Total events
7 786
Read events
1 632
Write events
4 437
Delete events
1 717
Modification events
| (PID) Process: | (1024) RobloxPlayerLauncher.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (1024) RobloxPlayerLauncher.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (1024) RobloxPlayerLauncher.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (1024) RobloxPlayerLauncher.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
| (PID) Process: | (1024) RobloxPlayerLauncher.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections |
| Operation: | write | Name: | SavedLegacySettings |
Value: 46000000A1000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000 | |||
| (PID) Process: | (1024) RobloxPlayerLauncher.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (1024) RobloxPlayerLauncher.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
| (PID) Process: | (1024) RobloxPlayerLauncher.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (3128) RobloxPlayerLauncher.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (3128) RobloxPlayerLauncher.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
Executable files
4
Suspicious files
108
Text files
551
Unknown types
47
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1024 | RobloxPlayerLauncher.exe | C:\Users\admin\AppData\Local\Temp\CabE4AB.tmp | — | |
MD5:— | SHA256:— | |||
| 1024 | RobloxPlayerLauncher.exe | C:\Users\admin\AppData\Local\Temp\TarE4AC.tmp | — | |
MD5:— | SHA256:— | |||
| 3128 | RobloxPlayerLauncher.exe | C:\Users\admin\AppData\Local\Temp\CabE69F.tmp | — | |
MD5:— | SHA256:— | |||
| 3128 | RobloxPlayerLauncher.exe | C:\Users\admin\AppData\Local\Temp\TarE6A0.tmp | — | |
MD5:— | SHA256:— | |||
| 1024 | RobloxPlayerLauncher.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\XN9OGQKD.txt | — | |
MD5:— | SHA256:— | |||
| 1024 | RobloxPlayerLauncher.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\GetInstallerCdns[1].json | — | |
MD5:— | SHA256:— | |||
| 1024 | RobloxPlayerLauncher.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6 | binary | |
MD5:— | SHA256:— | |||
| 1024 | RobloxPlayerLauncher.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6 | der | |
MD5:— | SHA256:— | |||
| 1024 | RobloxPlayerLauncher.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\application[1].json | text | |
MD5:— | SHA256:— | |||
| 1024 | RobloxPlayerLauncher.exe | C:\Users\admin\AppData\Local\Temp\crashpad_roblox\settings.dat | binary | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
34
TCP/UDP connections
227
DNS requests
96
Threats
2
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3844 | iexplore.exe | GET | 200 | 52.222.168.155:80 | http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D | US | der | 1.51 Kb | whitelisted |
3844 | iexplore.exe | GET | 200 | 52.222.168.140:80 | http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D | US | der | 1.70 Kb | whitelisted |
3844 | iexplore.exe | GET | 200 | 52.222.168.155:80 | http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D | US | der | 1.51 Kb | whitelisted |
3844 | iexplore.exe | GET | 200 | 172.217.23.99:80 | http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D | US | der | 468 b | whitelisted |
3844 | iexplore.exe | GET | 301 | 128.116.123.3:80 | http://www.roblox.com/games/?referrer=roblox-player | US | html | 173 b | whitelisted |
3844 | iexplore.exe | GET | 200 | 172.217.23.99:80 | http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D | US | der | 468 b | whitelisted |
3844 | iexplore.exe | GET | 200 | 52.222.168.37:80 | http://ocsp.sca1b.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQz9arGHWbnBV0DFzpNHz4YcTiFDQQUWaRmBlKge5WSPKOUByeWdFv5PdACEAjFXZ%2BySKi9zdwyF3iOyfQ%3D | US | der | 471 b | whitelisted |
1024 | RobloxPlayerLauncher.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D | US | der | 471 b | whitelisted |
3844 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D | US | der | 471 b | whitelisted |
3844 | iexplore.exe | GET | 200 | 172.217.23.99:80 | http://ocsp.pki.goog/gts1o1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEH5AOqyo%2BE9TAgAAAABfl14%3D | US | der | 471 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
1024 | RobloxPlayerLauncher.exe | 104.111.227.55:443 | clientsettingscdn.roblox.com | Akamai International B.V. | NL | unknown |
1024 | RobloxPlayerLauncher.exe | 128.116.112.44:443 | ephemeralcounters.api.roblox.com | University Corporation for Atmospheric Research | US | malicious |
1024 | RobloxPlayerLauncher.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
3128 | RobloxPlayerLauncher.exe | 104.111.227.55:443 | clientsettingscdn.roblox.com | Akamai International B.V. | NL | unknown |
1024 | RobloxPlayerLauncher.exe | 205.234.175.102:443 | setup.rbxcdn.com | CacheNetworks, Inc. | US | suspicious |
1024 | RobloxPlayerLauncher.exe | 192.124.249.23:80 | ocsp.godaddy.com | Sucuri | US | suspicious |
1024 | RobloxPlayerLauncher.exe | 128.116.123.3:443 | www.roblox.com | University Corporation for Atmospheric Research | US | suspicious |
1024 | RobloxPlayerLauncher.exe | 104.18.21.226:80 | ocsp2.globalsign.com | Cloudflare Inc | US | shared |
1024 | RobloxPlayerLauncher.exe | 104.18.20.226:80 | ocsp2.globalsign.com | Cloudflare Inc | US | shared |
1024 | RobloxPlayerLauncher.exe | 54.165.151.168:8092 | ec2-54-165-151-168.compute-1.amazonaws.com | Amazon.com, Inc. | US | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
clientsettingscdn.roblox.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
ephemeralcounters.api.roblox.com |
| whitelisted |
ocsp.godaddy.com |
| whitelisted |
setup.rbxcdn.qq.com |
| suspicious |
clientsettingscdn.roblox.qq.com |
| unknown |
setup.rbxcdn.com |
| whitelisted |
setup-ak.rbxcdn.com |
| whitelisted |
setup-ll.rbxcdn.com |
| whitelisted |
setup-cfly.rbxcdn.com |
| suspicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
3844 | iexplore.exe | Generic Protocol Command Decode | SURICATA HTTP unable to match response to request |
1 ETPRO signatures available at the full report