File name:

RobloxPlayerLauncher.exe

Full analysis: https://app.any.run/tasks/44db5552-58fc-41a2-a9a3-d695d6ad5997
Verdict: Malicious activity
Analysis date: November 07, 2021, 11:11:46
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

92325B955E041B47099760B7A19AC40A

SHA1:

34EF62B7B34C562D519EE6248C2BAC0CBCB0B2E0

SHA256:

BE3602699A99D51A1B552C4ECCB04CCE4BE1624C2C4845C55A2122AFB61E9FA5

SSDEEP:

49152:HXb6YEtL/zpAQ/utGzmauZ6795N8TraYFlJcT/hMQPMQNdAnYTwToVP:3b6/BFFaauZ679go

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads the computer name

      • RobloxPlayerLauncher.exe (PID: 892)
      • RobloxPlayerLauncher.exe (PID: 2308)
      • RobloxPlayerLauncher.exe (PID: 3932)
      • RobloxPlayerLauncher.exe (PID: 3188)

    • Checks supported languages

      • RobloxPlayerLauncher.exe (PID: 892)
      • RobloxPlayerLauncher.exe (PID: 2308)
      • RobloxPlayerLauncher.exe (PID: 3932)
      • RobloxPlayerLauncher.exe (PID: 3188)

    • Application launched itself

      • RobloxPlayerLauncher.exe (PID: 892)
      • RobloxPlayerLauncher.exe (PID: 3932)

    • Executable content was dropped or overwritten

      • RobloxPlayerLauncher.exe (PID: 892)

    • Drops a file with too old compile date

      • RobloxPlayerLauncher.exe (PID: 892)

    • Changes default file association

      • RobloxPlayerLauncher.exe (PID: 892)

    • Creates files in the user directory

      • RobloxPlayerLauncher.exe (PID: 892)

    • Creates a software uninstall entry

      • RobloxPlayerLauncher.exe (PID: 892)

    • Drops a file that was compiled in debug mode

      • RobloxPlayerLauncher.exe (PID: 892)

    • Starts Internet Explorer

      • RobloxPlayerLauncher.exe (PID: 3932)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 2036)

  • INFO

    • Reads settings of System Certificates

      • RobloxPlayerLauncher.exe (PID: 892)
      • RobloxPlayerLauncher.exe (PID: 2308)
      • RobloxPlayerLauncher.exe (PID: 3932)
      • RobloxPlayerLauncher.exe (PID: 3188)
      • iexplore.exe (PID: 2036)
      • iexplore.exe (PID: 2620)

    • Checks Windows Trust Settings

      • RobloxPlayerLauncher.exe (PID: 2308)
      • RobloxPlayerLauncher.exe (PID: 892)
      • RobloxPlayerLauncher.exe (PID: 3932)
      • iexplore.exe (PID: 2036)
      • RobloxPlayerLauncher.exe (PID: 3188)
      • iexplore.exe (PID: 2620)

    • Manual execution by user

      • RobloxPlayerLauncher.exe (PID: 3932)

    • Reads the computer name

      • iexplore.exe (PID: 2620)
      • iexplore.exe (PID: 2036)

    • Changes internet zones settings

      • iexplore.exe (PID: 2620)

    • Checks supported languages

      • iexplore.exe (PID: 2620)
      • iexplore.exe (PID: 2036)

    • Application launched itself

      • iexplore.exe (PID: 2620)

    • Creates files in the user directory

      • iexplore.exe (PID: 2036)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2036)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2000:02:19 10:33:55+01:00
PEType: PE32
LinkerVersion: 14.16
CodeSize: 1143296
InitializedDataSize: 510464
UninitializedDataSize: -
EntryPoint: 0xcd621
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 1.6.0.39626
ProductVersionNumber: 1.6.0.39626
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Roblox Corporation
FileDescription: Roblox
FileVersion: 1, 6, 0, 5020362
LegalCopyright: Copyright © 2020 Roblox Corporation. All rights reserved.
OriginalFileName: Roblox.exe
ProductName: Roblox Bootstrapper
ProductVersion: 1, 6, 0, 5020362

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 19-Feb-2000 09:33:55
Detected languages:
  • Chinese - Taiwan
  • English - United States
  • Italian - Italy
  • Japanese - Japan
  • Korean - Korea
  • Portuguese - Brazil
  • Process Default Language
TLS Callbacks: 1 callback(s) detected.
Debug artifacts:
  • C:\teamcity-agent\work\ci_deploy_nbsninja_boot-x86_git\build.ninja\common\vs2017\x86\release\Installer\BootstrapperClient\BootstrapperClient.pdb
CompanyName: Roblox Corporation
FileDescription: Roblox
FileVersion: 1, 6, 0, 5020362
LegalCopyright: Copyright © 2020 Roblox Corporation. All rights reserved.
OriginalFilename: Roblox.exe
ProductName: Roblox Bootstrapper
ProductVersion: 1, 6, 0, 5020362

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000110

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 6
Time date stamp: 19-Feb-2000 09:33:55
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0011707C
0x00117200
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.55041
.rdata
0x00119000
0x0004AB36
0x0004AC00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.70502
.data
0x00164000
0x0006C378
0x00006200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.73873
CPADinfo(
0x001D1000
0x00000028
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.122276
.rsrc
0x001D2000
0x0001DB88
0x0001DC00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.94424
.reloc
0x001F0000
0x0000DCBC
0x0000DE00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.63362

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.28732
1010
Latin 1 / Western European
English - United States
RT_MANIFEST
2
2.78815
76
Latin 1 / Western European
Process Default Language
RT_GROUP_ICON
3
4.77404
4264
Latin 1 / Western European
Process Default Language
RT_ICON
4
4.46883
16672
Latin 1 / Western European
Process Default Language
RT_ICON
5
4.5291
9640
Latin 1 / Western European
Process Default Language
RT_ICON
7
3.38178
488
Latin 1 / Western European
Portuguese - Brazil
RT_STRING
8
3.3442
1108
Latin 1 / Western European
Portuguese - Brazil
RT_STRING
9
3.0813
666
Latin 1 / Western European
Portuguese - Brazil
RT_STRING
11
1.10136
46
Latin 1 / Western European
English - United States
RT_STRING
12
0.38158
34
Latin 1 / Western European
English - United States
RT_STRING

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
POWRPROF.dll
SHELL32.dll
SHLWAPI.dll
SensApi.dll
USER32.dll
VERSION.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
6
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start robloxplayerlauncher.exe robloxplayerlauncher.exe robloxplayerlauncher.exe robloxplayerlauncher.exe iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
892"C:\Users\admin\AppData\Local\Temp\RobloxPlayerLauncher.exe" C:\Users\admin\AppData\Local\Temp\RobloxPlayerLauncher.exe
Explorer.EXE
User:
admin
Company:
Roblox Corporation
Integrity Level:
MEDIUM
Description:
Roblox
Exit code:
0
Version:
1, 6, 0, 5020362
Modules
Images
c:\users\admin\appdata\local\temp\robloxplayerlauncher.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\advapi32.dll
2036"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2620 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2308C:\Users\admin\AppData\Local\Temp\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=8cf5c2a7c34a51cbf83de945e0f5884fe9aa26b2 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x5c4,0x5c8,0x5cc,0x5a0,0x5d4,0xc7efb4,0xc7efc4,0xc7efd4C:\Users\admin\AppData\Local\Temp\RobloxPlayerLauncher.exe
RobloxPlayerLauncher.exe
User:
admin
Company:
Roblox Corporation
Integrity Level:
MEDIUM
Description:
Roblox
Exit code:
0
Version:
1, 6, 0, 5020362
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\temp\robloxplayerlauncher.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\advapi32.dll
2620"C:\Program Files\Internet Explorer\iexplore.exe" http://www.roblox.com/games/?referrer=roblox-playerC:\Program Files\Internet Explorer\iexplore.exe
RobloxPlayerLauncher.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3188C:\Users\admin\AppData\Local\Roblox\Versions\version-acbc8cfc2b354d72\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=8cf5c2a7c34a51cbf83de945e0f5884fe9aa26b2 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x594,0x598,0x59c,0x570,0x5a4,0x149efb4,0x149efc4,0x149efd4C:\Users\admin\AppData\Local\Roblox\Versions\version-acbc8cfc2b354d72\RobloxPlayerLauncher.exe
RobloxPlayerLauncher.exe
User:
admin
Company:
Roblox Corporation
Integrity Level:
MEDIUM
Description:
Roblox
Exit code:
0
Version:
1, 6, 0, 5020362
Modules
Images
c:\users\admin\appdata\local\roblox\versions\version-acbc8cfc2b354d72\robloxplayerlauncher.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\advapi32.dll
3932"C:\Users\admin\AppData\Local\Roblox\Versions\version-acbc8cfc2b354d72\RobloxPlayerLauncher.exe" -appC:\Users\admin\AppData\Local\Roblox\Versions\version-acbc8cfc2b354d72\RobloxPlayerLauncher.exe
Explorer.EXE
User:
admin
Company:
Roblox Corporation
Integrity Level:
MEDIUM
Description:
Roblox
Exit code:
0
Version:
1, 6, 0, 5020362
Modules
Images
c:\users\admin\appdata\local\roblox\versions\version-acbc8cfc2b354d72\robloxplayerlauncher.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\advapi32.dll
Total events
26 474
Read events
26 140
Write events
330
Delete events
4

Modification events

(PID) Process:(892) RobloxPlayerLauncher.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(892) RobloxPlayerLauncher.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(892) RobloxPlayerLauncher.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(892) RobloxPlayerLauncher.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(892) RobloxPlayerLauncher.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000003B010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A80164000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(892) RobloxPlayerLauncher.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(892) RobloxPlayerLauncher.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(892) RobloxPlayerLauncher.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(892) RobloxPlayerLauncher.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(892) RobloxPlayerLauncher.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{362E934C-743B-4588-8259-D2482DB771A8}
Operation:writeName:WpadDecisionReason
Value:
1
Executable files
4
Suspicious files
63
Text files
99
Unknown types
13

Dropped files

PID
Process
Filename
Type
892RobloxPlayerLauncher.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:—
SHA256:—
892RobloxPlayerLauncher.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\PCClientBootstrapper[1].jsontext
MD5:—
SHA256:—
892RobloxPlayerLauncher.exeC:\Users\admin\AppData\Local\Temp\crashpad_roblox\settings.datbinary
MD5:—
SHA256:—
892RobloxPlayerLauncher.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2Dbinary
MD5:—
SHA256:—
892RobloxPlayerLauncher.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2Dder
MD5:—
SHA256:—
892RobloxPlayerLauncher.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6binary
MD5:—
SHA256:—
892RobloxPlayerLauncher.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771binary
MD5:—
SHA256:—
892RobloxPlayerLauncher.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771der
MD5:—
SHA256:—
892RobloxPlayerLauncher.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6der
MD5:—
SHA256:—
2308RobloxPlayerLauncher.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\PCClientBootstrapper[1].jsontext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
56
DNS requests
38
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2620
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
892
RobloxPlayerLauncher.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D
US
der
471 b
whitelisted
892
RobloxPlayerLauncher.exe
GET
200
192.124.249.36:80
http://ocsp.godaddy.com//MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D
US
der
1.66 Kb
whitelisted
892
RobloxPlayerLauncher.exe
GET
200
192.124.249.36:80
http://ocsp.godaddy.com//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D
US
der
1.69 Kb
whitelisted
2036
iexplore.exe
GET
301
128.116.123.3:80
http://www.roblox.com/games/?referrer=roblox-player
US
html
173 b
whitelisted
892
RobloxPlayerLauncher.exe
GET
200
8.241.78.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?7ae9ccbaa817f612
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
892
RobloxPlayerLauncher.exe
104.111.232.33:443
clientsettingscdn.roblox.com
Akamai International B.V.
NL
suspicious
892
RobloxPlayerLauncher.exe
8.241.78.254:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
suspicious
892
RobloxPlayerLauncher.exe
128.116.119.3:443
ephemeralcounters.api.roblox.com
University Corporation for Atmospheric Research
US
malicious
892
RobloxPlayerLauncher.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2308
RobloxPlayerLauncher.exe
104.111.232.33:443
clientsettingscdn.roblox.com
Akamai International B.V.
NL
suspicious
892
RobloxPlayerLauncher.exe
192.124.249.36:80
ocsp.godaddy.com
Sucuri
US
suspicious
892
RobloxPlayerLauncher.exe
205.185.216.42:443
setup.rbxcdn.com
Highwinds Network Group, Inc.
US
whitelisted
2308
RobloxPlayerLauncher.exe
128.116.119.3:443
ephemeralcounters.api.roblox.com
University Corporation for Atmospheric Research
US
malicious
3932
RobloxPlayerLauncher.exe
128.116.123.3:443
ephemeralcounters.api.roblox.com
University Corporation for Atmospheric Research
US
suspicious
2036
iexplore.exe
128.116.123.3:443
ephemeralcounters.api.roblox.com
University Corporation for Atmospheric Research
US
suspicious

DNS requests

Domain
IP
Reputation
clientsettingscdn.roblox.com
  • 104.111.232.33
  • 104.92.74.113
whitelisted
ctldl.windowsupdate.com
  • 8.241.78.254
  • 67.27.235.126
  • 8.253.204.249
  • 67.27.158.254
  • 8.248.143.254
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
ephemeralcounters.api.roblox.com
  • 128.116.119.3
  • 128.116.123.3
whitelisted
ocsp.godaddy.com
  • 192.124.249.36
  • 192.124.249.23
  • 192.124.249.22
  • 192.124.249.41
  • 192.124.249.24
whitelisted
setup.rbxcdn.qq.com
  • 123.138.58.68
  • 112.65.212.228
  • 42.4.53.51
  • 125.39.223.220
  • 58.144.137.118
  • 101.206.241.75
  • 112.83.38.76
  • 116.153.45.139
  • 42.4.53.248
  • 14.205.95.189
  • 42.4.53.234
  • 116.162.6.125
  • 113.59.43.118
  • 116.153.56.60
  • 122.188.38.74
suspicious
clientsettingscdn.roblox.qq.com
  • 129.226.107.211
unknown
setup.rbxcdn.com
  • 205.185.216.42
  • 205.185.216.10
  • 178.79.242.48
  • 178.79.242.211
whitelisted
setup-ak.rbxcdn.com
  • 2.16.186.91
  • 2.16.186.82
  • 92.123.194.105
  • 92.123.194.146
whitelisted
setup-ll.rbxcdn.com
  • 178.79.242.48
  • 178.79.242.211
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
RobloxPlayerLauncher.exe