File name:

RobloxPlayerInstaller.exe

Full analysis: https://app.any.run/tasks/a32e2f03-9e4a-4f10-bc9e-6dfd027118fa
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: July 31, 2024, 20:49:00
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
pastebin
stealer
qrcode
crypto-regex
github
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

94740510822524D579F869A81E02F5EA

SHA1:

0E87D714E9EEC2EEE7C3AF028E8E66E7478A107F

SHA256:

AD927962330C2D2CF2BF7C33C1A5395DF5CCD4CEABFB10C72DB240041D773DDA

SSDEEP:

98304:bgs0N1XDZEjTJt9y872uxBqWMJuHTNC2P+Ahlex3otgKkfz3wzMdmNezBJQAUEuo:cMjGRGgWQ3Ck

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • RobloxPlayerInstaller.exe (PID: 6464)
      • msiexec.exe (PID: 252)
      • MicrosoftEdgeWebview2Setup.exe (PID: 5988)
      • MicrosoftEdgeUpdate.exe (PID: 4040)
      • Bootstrapper.exe (PID: 8172)
      • MicrosoftEdge_X64_126.0.2592.113.exe (PID: 6340)

    • Actions looks like stealing of personal data

      • RobloxPlayerInstaller.exe (PID: 6464)

    • Changes the autorun value in the registry

      • MicrosoftEdgeUpdate.exe (PID: 4040)

  • SUSPICIOUS

    • Changes default file association

      • RobloxPlayerInstaller.exe (PID: 6464)

    • Executable content was dropped or overwritten

      • RobloxPlayerInstaller.exe (PID: 6464)
      • MicrosoftEdgeWebview2Setup.exe (PID: 5988)
      • MicrosoftEdgeUpdate.exe (PID: 4040)
      • Bootstrapper.exe (PID: 8172)
      • MicrosoftEdge_X64_126.0.2592.113.exe (PID: 6340)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 252)
      • MicrosoftEdgeUpdate.exe (PID: 6368)

    • Process drops legitimate windows executable

      • RobloxPlayerInstaller.exe (PID: 6464)
      • MicrosoftEdgeWebview2Setup.exe (PID: 5988)
      • MicrosoftEdgeUpdate.exe (PID: 4040)
      • svchost.exe (PID: 4936)
      • Bootstrapper.exe (PID: 8172)
      • MicrosoftEdge_X64_126.0.2592.113.exe (PID: 6340)

    • Reads security settings of Internet Explorer

      • Bootstrapper.exe (PID: 6416)
      • msiexec.exe (PID: 5956)
      • MicrosoftEdgeUpdate.exe (PID: 4040)
      • msiexec.exe (PID: 7496)
      • Bootstrapper.exe (PID: 8172)
      • msiexec.exe (PID: 7936)
      • MicrosoftEdgeUpdate.exe (PID: 6368)
      • Bootstrapper.exe (PID: 3360)
      • Solara.exe (PID: 7248)

    • Reads the date of Windows installation

      • Bootstrapper.exe (PID: 6416)
      • MicrosoftEdgeUpdate.exe (PID: 4040)
      • Bootstrapper.exe (PID: 8172)
      • Bootstrapper.exe (PID: 3360)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 252)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeUpdate.exe (PID: 4040)

    • Starts itself from another location

      • MicrosoftEdgeUpdate.exe (PID: 4040)

    • Creates/Modifies COM task schedule object

      • MicrosoftEdgeUpdate.exe (PID: 1360)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 2424)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 3256)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 3356)

    • Potential Corporate Privacy Violation

      • svchost.exe (PID: 4936)

    • Uses WEVTUTIL.EXE to install publishers and event logs from the manifest

      • msiexec.exe (PID: 7496)
      • wevtutil.exe (PID: 1608)

    • The process drops C-runtime libraries

      • Bootstrapper.exe (PID: 8172)

    • Application launched itself

      • setup.exe (PID: 6964)

  • INFO

    • Checks supported languages

      • RobloxPlayerInstaller.exe (PID: 6464)
      • msiexec.exe (PID: 252)
      • Bootstrapper.exe (PID: 6416)
      • msiexec.exe (PID: 872)
      • msiexec.exe (PID: 5956)
      • MicrosoftEdgeWebview2Setup.exe (PID: 5988)
      • MicrosoftEdgeUpdate.exe (PID: 4040)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 2424)
      • MicrosoftEdgeUpdate.exe (PID: 1360)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 3256)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 3356)
      • MicrosoftEdgeUpdate.exe (PID: 300)
      • MicrosoftEdgeUpdate.exe (PID: 2768)
      • MicrosoftEdgeUpdate.exe (PID: 6368)
      • TextInputHost.exe (PID: 1356)
      • Bootstrapper.exe (PID: 6868)
      • Bootstrapper.exe (PID: 8172)
      • msiexec.exe (PID: 7496)
      • msiexec.exe (PID: 7684)
      • msiexec.exe (PID: 7936)
      • msiexec.exe (PID: 8112)
      • setup.exe (PID: 6964)
      • setup.exe (PID: 6508)
      • Bootstrapper.exe (PID: 3360)
      • node.exe (PID: 2080)
      • MicrosoftEdge_X64_126.0.2592.113.exe (PID: 6340)
      • Solara.exe (PID: 7248)

    • Creates files or folders in the user directory

      • RobloxPlayerInstaller.exe (PID: 6464)
      • msiexec.exe (PID: 252)
      • MicrosoftEdgeUpdate.exe (PID: 4040)
      • MicrosoftEdgeUpdate.exe (PID: 6368)
      • MicrosoftEdge_X64_126.0.2592.113.exe (PID: 6340)
      • setup.exe (PID: 6508)
      • setup.exe (PID: 6964)

    • Reads the machine GUID from the registry

      • RobloxPlayerInstaller.exe (PID: 6464)
      • msiexec.exe (PID: 252)
      • Bootstrapper.exe (PID: 6416)
      • Bootstrapper.exe (PID: 6868)
      • Bootstrapper.exe (PID: 8172)
      • MicrosoftEdgeUpdate.exe (PID: 6368)
      • Bootstrapper.exe (PID: 3360)
      • Solara.exe (PID: 7248)

    • Reads the computer name

      • RobloxPlayerInstaller.exe (PID: 6464)
      • Bootstrapper.exe (PID: 6416)
      • msiexec.exe (PID: 252)
      • msiexec.exe (PID: 5956)
      • MicrosoftEdgeUpdate.exe (PID: 4040)
      • msiexec.exe (PID: 872)
      • MicrosoftEdgeUpdate.exe (PID: 1360)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 2424)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 3256)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 3356)
      • MicrosoftEdgeUpdate.exe (PID: 300)
      • MicrosoftEdgeUpdate.exe (PID: 2768)
      • MicrosoftEdgeUpdate.exe (PID: 6368)
      • TextInputHost.exe (PID: 1356)
      • Bootstrapper.exe (PID: 6868)
      • Bootstrapper.exe (PID: 8172)
      • msiexec.exe (PID: 7496)
      • msiexec.exe (PID: 7684)
      • msiexec.exe (PID: 7936)
      • msiexec.exe (PID: 8112)
      • MicrosoftEdge_X64_126.0.2592.113.exe (PID: 6340)
      • setup.exe (PID: 6964)
      • Bootstrapper.exe (PID: 3360)
      • Solara.exe (PID: 7248)

    • Process checks whether UAC notifications are on

      • RobloxPlayerInstaller.exe (PID: 6464)

    • Manual execution by a user

      • Bootstrapper.exe (PID: 6416)
      • Bootstrapper.exe (PID: 964)
      • firefox.exe (PID: 6872)
      • Bootstrapper.exe (PID: 8124)
      • Bootstrapper.exe (PID: 7144)
      • Bootstrapper.exe (PID: 6868)
      • Bootstrapper.exe (PID: 8172)
      • Bootstrapper.exe (PID: 812)
      • Bootstrapper.exe (PID: 3360)

    • Create files in a temporary directory

      • RobloxPlayerInstaller.exe (PID: 6464)
      • Bootstrapper.exe (PID: 6416)
      • MicrosoftEdgeWebview2Setup.exe (PID: 5988)
      • MicrosoftEdgeUpdate.exe (PID: 4040)
      • svchost.exe (PID: 4936)
      • Bootstrapper.exe (PID: 6868)
      • Bootstrapper.exe (PID: 8172)

    • Process checks computer location settings

      • Bootstrapper.exe (PID: 6416)
      • MicrosoftEdgeUpdate.exe (PID: 4040)
      • Bootstrapper.exe (PID: 8172)
      • Bootstrapper.exe (PID: 3360)

    • Reads the software policy settings

      • msiexec.exe (PID: 252)
      • Bootstrapper.exe (PID: 6416)
      • MicrosoftEdgeUpdate.exe (PID: 300)
      • MicrosoftEdgeUpdate.exe (PID: 6368)
      • Bootstrapper.exe (PID: 6868)
      • Bootstrapper.exe (PID: 8172)
      • Bootstrapper.exe (PID: 3360)
      • Solara.exe (PID: 7248)

    • Disables trace logs

      • Bootstrapper.exe (PID: 6416)
      • Bootstrapper.exe (PID: 6868)
      • Bootstrapper.exe (PID: 8172)
      • Bootstrapper.exe (PID: 3360)
      • Solara.exe (PID: 7248)

    • Checks proxy server information

      • Bootstrapper.exe (PID: 6416)
      • MicrosoftEdgeUpdate.exe (PID: 300)
      • MicrosoftEdgeUpdate.exe (PID: 6368)
      • Bootstrapper.exe (PID: 6868)
      • Bootstrapper.exe (PID: 8172)
      • Bootstrapper.exe (PID: 3360)
      • Solara.exe (PID: 7248)

    • Reads Environment values

      • Bootstrapper.exe (PID: 6416)
      • MicrosoftEdgeUpdate.exe (PID: 300)
      • Bootstrapper.exe (PID: 6868)
      • Bootstrapper.exe (PID: 8172)
      • Bootstrapper.exe (PID: 3360)
      • Solara.exe (PID: 7248)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 252)

    • Application launched itself

      • msiexec.exe (PID: 252)
      • firefox.exe (PID: 6872)
      • firefox.exe (PID: 6836)

    • Reads Microsoft Office registry keys

      • firefox.exe (PID: 6836)

    • Drops the executable file immediately after the start

      • svchost.exe (PID: 4936)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 252)

    • Creates files in the program directory

      • Bootstrapper.exe (PID: 8172)

    • Dropped object may contain TOR URL's

      • Bootstrapper.exe (PID: 8172)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1976:05:08 17:55:59+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14.29
CodeSize: 3435008
InitializedDataSize: 15253504
UninitializedDataSize: -
EntryPoint: 0x2f3100
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.6.1.19016
ProductVersionNumber: 1.6.1.19016
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Roblox Corporation
FileDescription: Roblox
FileVersion: 1, 6, 1, 6310472
LegalCopyright: Copyright © 2020 Roblox Corporation. All rights reserved.
OriginalFileName: Roblox.exe
ProductName: Roblox Bootstrapper
ProductVersion: 1, 6, 1, 6310472
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
196
Monitored processes
57
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start robloxplayerinstaller.exe rundll32.exe no specs bootstrapper.exe no specs bootstrapper.exe conhost.exe no specs msiexec.exe no specs msiexec.exe msiexec.exe no specs msiexec.exe no specs microsoftedgewebview2setup.exe microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdate.exe svchost.exe bootstrapper.exe no specs bootstrapper.exe conhost.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs textinputhost.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs bootstrapper.exe no specs bootstrapper.exe conhost.exe no specs msiexec.exe no specs wevtutil.exe no specs conhost.exe no specs wevtutil.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs microsoftedge_x64_126.0.2592.113.exe setup.exe no specs bootstrapper.exe no specs setup.exe no specs bootstrapper.exe conhost.exe no specs node.exe no specs conhost.exe no specs solara.exe

Process information

PID
CMD
Path
Indicators
Parent process
252C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
300"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMCIgc2Vzc2lvbmlkPSJ7QThFMTE2MzAtRDQzMS00QUIwLThFNUItNzk2QTM1MDAwMTBBfSIgdXNlcmlkPSJ7OUQ1MDIxRTEtNkUxQi00MjQ5LTg1OUYtREQ4QjAwNDkzMEQ3fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntGMjM0MkNDQi1EM0NGLTRFNDMtOTYxQS03QjE3RkU2Mzg2NTV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iNCIgcGh5c21lbW9yeT0iNCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQ1LjQwNDYiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREVMTCIgcHJvZHVjdF9uYW1lPSJERUxMIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjE3MS4zOSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTA1ODQxMDk1MzkiIGluc3RhbGxfdGltZV9tcz0iNzEyIi8-PC9hcHA-PC9yZXF1ZXN0PgC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.171.39
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
812"C:\Users\admin\Downloads\Bootstrapper.exe" C:\Users\admin\Downloads\Bootstrapper.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
SolaraBootstrapper
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\users\admin\downloads\bootstrapper.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
872C:\Windows\System32\MsiExec.exe -Embedding A4BAAA423940E91368482BACCC106A8AC:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
964"C:\Users\admin\Downloads\Bootstrapper.exe" C:\Users\admin\Downloads\Bootstrapper.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
SolaraBootstrapper
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\users\admin\downloads\bootstrapper.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1356"C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mcaC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Version:
123.26505.0.0
Modules
Images
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\textinputhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\vcruntime140_app.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
1360"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserverC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.171.39
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
1608"wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man"C:\Windows\SysWOW64\wevtutil.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Eventing Command Line Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wevtutil.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcp_win.dll
c:\windows\syswow64\ucrtbase.dll
2044"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\node-v18.16.0-x64.msi" /qnC:\Windows\SysWOW64\msiexec.exe—Bootstrapper.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2080"node" -vC:\Program Files\nodejs\node.exe—Bootstrapper.exe
User:
admin
Company:
Node.js
Integrity Level:
HIGH
Description:
Node.js JavaScript Runtime
Exit code:
0
Version:
18.16.0
Modules
Images
c:\program files\nodejs\node.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\psapi.dll
c:\windows\system32\ucrtbase.dll
Total events
66 623
Read events
58 452
Write events
8 103
Delete events
68

Modification events

(PID) Process:(6464) RobloxPlayerInstaller.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio
Operation:writeName:WarnOnOpen
Value:
0
(PID) Process:(6464) RobloxPlayerInstaller.exeKey:HKEY_CLASSES_ROOT\roblox-studio
Operation:writeName:URL Protocol
Value:
(PID) Process:(6464) RobloxPlayerInstaller.exeKey:HKEY_CLASSES_ROOT\roblox-studio\shell\open\command
Operation:writeName:version
Value:
version-258fa44b42074cfc
(PID) Process:(6416) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6416) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6416) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6416) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6416) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6416) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6416) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
Executable files
247
Suspicious files
1 073
Text files
1 659
Unknown types
26

Dropped files

PID
Process
Filename
Type
6464RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\Downloads\roblox-player\f949676e1ec6c01304b83905bc3ed3adexecutable
MD5:F949676E1EC6C01304B83905BC3ED3AD
SHA256:04AAAA5FA79AC43CCE16B69FF06E1E361C9FB404E391ACB835EB20C141EA5ACB
6464RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\Downloads\roblox-player\cd77e0e77d698260809f8ae8b3993740compressed
MD5:CD77E0E77D698260809F8AE8B3993740
SHA256:C21C2EF75EDEF71EA53DD1FED5470CFA3D513D22F8CDFDF2431E43FE8FF4C95A
6464RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\Downloads\roblox-player\58e86f42c37021ac88a95f8693dac67acompressed
MD5:58E86F42C37021AC88A95F8693DAC67A
SHA256:522FECDDF6931B79F6A8AE159C1465404F8F1E6E61673F791D730DC20F3E8A3D
6464RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\Downloads\roblox-player\909f4b9d7bc03a926d35e84d0c99ffbfcompressed
MD5:909F4B9D7BC03A926D35E84D0C99FFBF
SHA256:C139AD55ACEBF739689CC1E29F84BA7731DC7FFC03F70BBBBD16929E3D439EC0
6464RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Temp\Roblox\http\RBX8341A928BB8948F5B0E156A63F448899binary
MD5:2754606CD426F100DB35CFF6B4E14D76
SHA256:BFFC3F767CFE07193107EC69C24D42CC7F00D30C54A93A98DF11F107319A45A5
6464RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\Downloads\roblox-player\b4b75c21ce05378163042dc45cec5834compressed
MD5:B4B75C21CE05378163042DC45CEC5834
SHA256:4D6FE68C8B4941CE335CE5597EBBC1F27AB02646E9AF98AF8A76875AD0FD191F
6464RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\logs\cacert.pemtext
MD5:0194EB945475F93844C0FAE769C0FA0B
SHA256:A6BC06B8255E4AFE2EEFF34684605D04DF9EC246FC201BF5E44137987189A0D3
6464RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\Versions\RobloxStudioInstaller.exeexecutable
MD5:1F4625F45C657A894F95B7B368EEC8DC
SHA256:B6508FFFB726C8D69276EFFE9FB4AC272D4613C661ABCE65FADD7290A07324A6
6464RobloxPlayerInstaller.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Roblox\Roblox Studio.lnkbinary
MD5:D7D22561A11B75C2BC785887F315F54B
SHA256:B86CE3E2FF91385F3584CAE54DC3C1D3A8CF715D3D91690FC9CE74416D712B7A
6464RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Temp\Roblox\http\RBX6F16387B9E5743CF9558E41DC19CE489binary
MD5:2754606CD426F100DB35CFF6B4E14D76
SHA256:BFFC3F767CFE07193107EC69C24D42CC7F00D30C54A93A98DF11F107319A45A5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
40
TCP/UDP connections
249
DNS requests
297
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1344
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6852
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6896
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
252
msiexec.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D
unknown
—
—
whitelisted
4936
svchost.exe
HEAD
200
23.50.131.24:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/01a02d0e-9d8d-47a3-8c36-9bf38dabe21a?P1=1723063867&P2=404&P3=2&P4=jDD2IxlMDsmvcsIMExzdanTtXxEPS4%2bNEif2o6VMimMPgYEEiJd48cxYhpAW%2bxIWPeLIjclyxYGet6NhkjWolw%3d%3d
unknown
—
—
whitelisted
252
msiexec.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAOO2y%2FG5AVzGnYPFRYUTIU%3D
unknown
—
—
whitelisted
6836
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
—
—
whitelisted
4936
svchost.exe
GET
200
23.50.131.24:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/01a02d0e-9d8d-47a3-8c36-9bf38dabe21a?P1=1723063867&P2=404&P3=2&P4=jDD2IxlMDsmvcsIMExzdanTtXxEPS4%2bNEif2o6VMimMPgYEEiJd48cxYhpAW%2bxIWPeLIjclyxYGet6NhkjWolw%3d%3d
unknown
—
—
whitelisted
6836
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5492
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2120
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4100
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6464
RobloxPlayerInstaller.exe
128.116.123.3:443
client-telemetry.roblox.com
ROBLOX-PRODUCTION
US
malicious
6464
RobloxPlayerInstaller.exe
128.116.123.4:443
ecsv2.roblox.com
ROBLOX-PRODUCTION
US
unknown
6464
RobloxPlayerInstaller.exe
99.86.4.20:443
clientsettingscdn.roblox.com
AMAZON-02
US
unknown
6464
RobloxPlayerInstaller.exe
2.16.241.7:443
setup.rbxcdn.com
Akamai International B.V.
DE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.184.206
whitelisted
client-telemetry.roblox.com
  • 128.116.123.3
whitelisted
ecsv2.roblox.com
  • 128.116.123.4
  • 128.116.123.3
whitelisted
clientsettingscdn.roblox.com
  • 99.86.4.20
  • 99.86.4.8
  • 99.86.4.125
  • 99.86.4.62
whitelisted
setup.rbxcdn.com
  • 2.16.241.7
  • 2.16.241.19
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
www.bing.com
  • 2.23.209.182
  • 2.23.209.140
  • 2.23.209.189
  • 2.23.209.149
  • 2.23.209.133
  • 2.23.209.179
  • 2.23.209.130
  • 2.23.209.187
  • 184.86.251.19
  • 184.86.251.23
  • 184.86.251.17
  • 184.86.251.28
  • 184.86.251.9
  • 184.86.251.11
  • 184.86.251.21
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 40.126.32.76
  • 40.126.32.140
  • 20.190.160.17
  • 20.190.160.14
  • 40.126.32.72
  • 40.126.32.68
  • 40.126.32.136
  • 20.190.160.20
whitelisted

Threats

PID
Process
Class
Message
2256
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Online Pastebin Text Storage
4936
svchost.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2256
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
2256
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Online Pastebin Text Storage
Process
Message
RobloxPlayerInstaller.exe
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
RobloxPlayerInstaller.exe