Malware analysis RobloxPlayerLauncher.exe Malicious activity

Add for printing

File name:	RobloxPlayerLauncher.exe
Full analysis:	https://app.any.run/tasks/71e918c3-f4d8-42a1-932c-4f959baa9fea
Verdict:	Malicious activity
Analysis date:	June 18, 2019, 08:49:35
OS:	Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME:	application/x-dosexec
File info:	PE32 executable (GUI) Intel 80386, for MS Windows
MD5:	791E080FD687B3608AA1467879D10E6A
SHA1:	6AFF2C0930E4F407F1E3ABE3D84606572F6D0FE0
SHA256:	FD817357BECEA1D4621EAAEB2A87DAA920B634DF9C54849FDF45AFE5D080B702
SSDEEP:	24576:lCtT7CT0eXTAsUFKXi5v0OBRRrUG4rsw/W8AMtCTZ8LxZpd3g7MBQDPKdAGM8TX2:svVGTAsqKUnBfrUG4rTPAMkTZ8LxZpdw

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 300 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: 240 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 8.0.7601.17514 undefined
Adobe Acrobat Reader DC MUI (15.023.20070)
Adobe Flash Player 26 ActiveX (26.0.0.131)
Adobe Flash Player 26 NPAPI (26.0.0.131)
Adobe Flash Player 26 PPAPI (26.0.0.131)
Adobe Refresh Manager (1.8.0)
CCleaner (5.35)
FileZilla Client 3.36.0 (3.36.0)
Google Chrome (73.0.3683.75)
Google Update Helper (1.3.33.23)
Java 8 Update 92 (8.0.920.14)
Java Auto Updater (2.8.92.14)
Microsoft .NET Framework 4.6.1 (4.6.01055)
Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Professional 2010 (14.0.6029.1000)
Microsoft Office Proof (English) 2010 (14.0.6029.1000)
Microsoft Office Proof (French) 2010 (14.0.6029.1000)
Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Single Image 2010 (14.0.6029.1000)
Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2017 Redistributable (x86) - 14.15.26706 (14.15.26706.0)
Microsoft Visual C++ 2017 x86 Additional Runtime - 14.15.26706 (14.15.26706)
Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.15.26706 (14.15.26706)
Mozilla Firefox 65.0.2 (x86 en-US) (65.0.2)
Notepad++ (32-bit x86) (7.5.1)
Opera 12.15 (12.15.1748)
Skype version 8.29 (8.29)
VLC media player (2.2.6)
WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

Client LanguagePack Package
Client Refresh LanguagePack Package
CodecPack Basic Package
Foundation Package
IE Troubleshooters Package
InternetExplorer Optional Package
KB2534111
KB2999226
KB976902
LocalPack AU Package
LocalPack CA Package
LocalPack GB Package
LocalPack US Package
LocalPack ZA Package
ProfessionalEdition
UltimateEdition

Add for printing

MALICIOUS
- Application was dropped or rewritten from another process
  - RobloxPlayerLauncher.exe (PID: 3312)
  - RobloxPlayerLauncher.exe (PID: 3108)
  - RobloxPlayerLauncher.exe (PID: 3444)
  - RobloxPlayerLauncher.exe (PID: 3400)
SUSPICIOUS
- Application launched itself
  - RobloxPlayerLauncher.exe (PID: 3088)
  - RobloxPlayerLauncher.exe (PID: 3312)
  - RobloxPlayerLauncher.exe (PID: 3444)
- Creates files in the user directory
  - RobloxPlayerLauncher.exe (PID: 3088)
  - RobloxPlayerLauncher.exe (PID: 3312)
- Executable content was dropped or overwritten
  - RobloxPlayerLauncher.exe (PID: 3088)
  - RobloxPlayerLauncher.exe (PID: 3312)
- Modifies the open verb of a shell class
  - RobloxPlayerLauncher.exe (PID: 3312)
- Creates a software uninstall entry
  - RobloxPlayerLauncher.exe (PID: 3312)
- Starts Internet Explorer
  - RobloxPlayerLauncher.exe (PID: 3444)
INFO
- Dropped object may contain Bitcoin addresses
  - RobloxPlayerLauncher.exe (PID: 3312)
- Manual execution by user
  - RobloxPlayerLauncher.exe (PID: 3444)
- Changes internet zones settings
  - iexplore.exe (PID: 3468)
- Reads Internet Cache Settings
  - iexplore.exe (PID: 2084)
- Creates files in the user directory
  - iexplore.exe (PID: 2084)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	Win32 Executable (generic) (52.9)
.exe	\|	Generic Win/DOS Executable (23.5)
.exe	\|	DOS Executable Generic (23.5)

EXIF

EXE

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2019:06:13 23:45:42+02:00
PEType:	PE32
LinkerVersion:	14
CodeSize:	848896
InitializedDataSize:	745984
UninitializedDataSize:	-
EntryPoint:	0x5b2d3
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	1.6.3.49456
ProductVersionNumber:	1.6.3.49456
FileFlagsMask:	0x0017
FileFlags:	(none)
FileOS:	Win32
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	English (U.S.)
CharacterSet:	Unicode
CompanyName:	Roblox Corporation
FileDescription:	Roblox
FileVersion:	1, 6, 3, 311600
LegalCopyright:	Copyright © 2019 Roblox Corporation. All rights reserved.
OriginalFileName:	Roblox.exe
ProductName:	Roblox Bootstrapper
ProductVersion:	1, 6, 3, 311600

Summary

Architecture:	IMAGE_FILE_MACHINE_I386
Subsystem:	IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date:	13-Jun-2019 21:45:42
Detected languages:	Chinese - Taiwan English - United States Korean - Korea Portuguese - Brazil Process Default Language
TLS Callbacks:	1 callback(s) detected.
Debug artifacts:	C:\teamcity-agent\work\Trunk2017\build.msvc\Win32\Installer-Release\BootstrapperClient\RobloxPlayerLauncher.pdb
CompanyName:	Roblox Corporation
FileDescription:	Roblox
FileVersion:	1, 6, 3, 311600
LegalCopyright:	Copyright © 2019 Roblox Corporation. All rights reserved.
OriginalFilename:	Roblox.exe
ProductName:	Roblox Bootstrapper
ProductVersion:	1, 6, 3, 311600

DOS Header

Magic number:	MZ
Bytes on last page of file:	0x0090
Pages in file:	0x0003
Relocations:	0x0000
Size of header:	0x0004
Min extra paragraphs:	0x0000
Max extra paragraphs:	0xFFFF
Initial SS value:	0x0000
Initial SP value:	0x00B8
Checksum:	0x0000
Initial IP value:	0x0000
Initial CS value:	0x0000
Overlay number:	0x0000
OEM identifier:	0x0000
OEM information:	0x0000
Address of NE header:	0x00000140

PE Headers

Signature:	PE
Machine:	IMAGE_FILE_MACHINE_I386
Number of sections:	8
Time date stamp:	13-Jun-2019 21:45:42
Pointer to Symbol Table:	0x00000000
Number of symbols:	0
Size of Optional Header:	0x00E0
Characteristics:	IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name	Virtual Address	Virtual Size	Raw Size	Charateristics	Entropy
.text	0x00001000	0x000CF37A	0x000CF400	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	6.63135
.rdata	0x000D1000	0x00043B92	0x00043C00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	5.74112
.data	0x00115000	0x000562E0	0x00004A00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	4.73221
.tls	0x0016C000	0x0000000D	0x00000200	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	0.0203931
.gfids	0x0016D000	0x00000188	0x00000200	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	3.41239
CPADinfo(	0x0016E000	0x00000028	0x00000200	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	0.122276
.rsrc	0x0016F000	0x00010B18	0x00010C00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	6.07249
.reloc	0x00180000	0x0000AF10	0x0000B000	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	6.64089

Resources

Title	Entropy	Size	Codepage	Language	Type
1	5.33374	1070	UNKNOWN	English - United States	RT_MANIFEST
2	2.59712	62	UNKNOWN	Process Default Language	RT_GROUP_ICON
3	3.02768	9640	UNKNOWN	Process Default Language	RT_ICON
4	7.90744	7216	UNKNOWN	Process Default Language	RT_ICON
7	3.38178	488	UNKNOWN	Portuguese - Brazil	RT_STRING
8	3.32834	602	UNKNOWN	Portuguese - Brazil	RT_STRING
130	3.12907	254	UNKNOWN	Process Default Language	RT_DIALOG
131	2	8	UNKNOWN	Process Default Language	RT_ACCELERATOR
157	7.30906	665	UNKNOWN	Process Default Language	PNG
158	7.56743	818	UNKNOWN	Process Default Language	PNG

Imports


ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
POWRPROF.dll
PSAPI.DLL
SHELL32.dll
SHLWAPI.dll
SensApi.dll
USER32.dll

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

2084

"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3468 CREDAT:71937

C:\Program Files\Internet Explorer\iexplore.exe

iexplore.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

LOW

Description:

Internet Explorer

Exit code:

Version:

8.00.7600.16385 (win7_rtm.090713-1255)

Modules

Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll

3088

"C:\Users\admin\AppData\Local\Temp\RobloxPlayerLauncher.exe"

C:\Users\admin\AppData\Local\Temp\RobloxPlayerLauncher.exe

explorer.exe

User:

admin

Company:

Roblox Corporation

Integrity Level:

MEDIUM

Description:

Roblox

Exit code:

Version:

1, 6, 3, 311600

Modules

Images
c:\users\admin\appdata\local\temp\robloxplayerlauncher.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll

3108

C:\Users\admin\AppData\Local\Temp\RBX-53F8FE86\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=0 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x378,0x380,0x384,0x37c,0x38c,0x115b244,0x115b254,0x115b264

C:\Users\admin\AppData\Local\Temp\RBX-53F8FE86\RobloxPlayerLauncher.exe

RobloxPlayerLauncher.exe

User:

admin

Company:

Roblox Corporation

Integrity Level:

MEDIUM

Description:

Roblox

Exit code:

Version:

1, 6, 3, 309538

Modules

Images
c:\users\admin\appdata\local\temp\rbx-53f8fe86\robloxplayerlauncher.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll

3312

"C:\Users\admin\AppData\Local\Temp\RBX-53F8FE86\RobloxPlayerLauncher.exe"

C:\Users\admin\AppData\Local\Temp\RBX-53F8FE86\RobloxPlayerLauncher.exe

RobloxPlayerLauncher.exe

User:

admin

Company:

Roblox Corporation

Integrity Level:

MEDIUM

Description:

Roblox

Exit code:

Version:

1, 6, 3, 309538

Modules

Images
c:\users\admin\appdata\local\temp\rbx-53f8fe86\robloxplayerlauncher.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll

3400

C:\Users\admin\AppData\Local\Roblox\Versions\version-7831605374754e3b\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x53c,0x540,0x544,0x538,0x54c,0x18b244,0x18b254,0x18b264

C:\Users\admin\AppData\Local\Roblox\Versions\version-7831605374754e3b\RobloxPlayerLauncher.exe

RobloxPlayerLauncher.exe

User:

admin

Company:

Roblox Corporation

Integrity Level:

MEDIUM

Description:

Roblox

Exit code:

Version:

1, 6, 3, 309538

Modules

Images
c:\users\admin\appdata\local\roblox\versions\version-7831605374754e3b\robloxplayerlauncher.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll

3444

"C:\Users\admin\AppData\Local\Roblox\Versions\version-7831605374754e3b\RobloxPlayerLauncher.exe" -browser

C:\Users\admin\AppData\Local\Roblox\Versions\version-7831605374754e3b\RobloxPlayerLauncher.exe

explorer.exe

User:

admin

Company:

Roblox Corporation

Integrity Level:

MEDIUM

Description:

Roblox

Exit code:

Version:

1, 6, 3, 309538

Modules

Images
c:\users\admin\appdata\local\roblox\versions\version-7831605374754e3b\robloxplayerlauncher.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll

3452

C:\Users\admin\AppData\Local\Temp\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x530,0x534,0x538,0x52c,0x540,0xf0b1dc,0xf0b1ec,0xf0b1fc

C:\Users\admin\AppData\Local\Temp\RobloxPlayerLauncher.exe

RobloxPlayerLauncher.exe

User:

admin

Company:

Roblox Corporation

Integrity Level:

MEDIUM

Description:

Roblox

Exit code:

Version:

1, 6, 3, 311600

Modules

Images
c:\users\admin\appdata\local\temp\robloxplayerlauncher.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll

3468

"C:\Program Files\Internet Explorer\iexplore.exe" -nohome

C:\Program Files\Internet Explorer\iexplore.exe

RobloxPlayerLauncher.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Internet Explorer

Exit code:

Version:

8.00.7600.16385 (win7_rtm.090713-1255)

Modules

Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll

Add for printing

Total events

1 067

Read events

882

Write events

184

Delete events

Modification events


(PID) Process:	(3088) RobloxPlayerLauncher.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RobloxPlayerLauncher_RASAPI32
Operation:	write	Name:	EnableFileTracing
Value: 0
(PID) Process:	(3088) RobloxPlayerLauncher.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RobloxPlayerLauncher_RASAPI32
Operation:	write	Name:	EnableConsoleTracing
Value: 0
(PID) Process:	(3088) RobloxPlayerLauncher.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RobloxPlayerLauncher_RASAPI32
Operation:	write	Name:	FileTracingMask
Value: 4294901760
(PID) Process:	(3088) RobloxPlayerLauncher.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RobloxPlayerLauncher_RASAPI32
Operation:	write	Name:	ConsoleTracingMask
Value: 4294901760
(PID) Process:	(3088) RobloxPlayerLauncher.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RobloxPlayerLauncher_RASAPI32
Operation:	write	Name:	MaxFileSize
Value: 1048576
(PID) Process:	(3088) RobloxPlayerLauncher.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RobloxPlayerLauncher_RASAPI32
Operation:	write	Name:	FileDirectory
Value: %windir%\tracing
(PID) Process:	(3088) RobloxPlayerLauncher.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RobloxPlayerLauncher_RASMANCS
Operation:	write	Name:	EnableFileTracing
Value: 0
(PID) Process:	(3088) RobloxPlayerLauncher.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RobloxPlayerLauncher_RASMANCS
Operation:	write	Name:	EnableConsoleTracing
Value: 0
(PID) Process:	(3088) RobloxPlayerLauncher.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RobloxPlayerLauncher_RASMANCS
Operation:	write	Name:	FileTracingMask
Value: 4294901760
(PID) Process:	(3088) RobloxPlayerLauncher.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RobloxPlayerLauncher_RASMANCS
Operation:	write	Name:	ConsoleTracingMask
Value: 4294901760

Add for printing

Executable files

Suspicious files

Text files

1 448

Unknown types

175

Dropped files

PID	Process	Filename		Type
3088	RobloxPlayerLauncher.exe	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@roblox[1].txt		—
		MD5:—	SHA256:—
3312	RobloxPlayerLauncher.exe	C:\Users\admin\AppData\Local\Temp\RBX-C3E30B7B.tmp		—
		MD5:—	SHA256:—
3088	RobloxPlayerLauncher.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\application[1]		text
		MD5:—	SHA256:—
3088	RobloxPlayerLauncher.exe	C:\Users\admin\AppData\Local\Temp\crashpad_roblox\settings.dat		binary
		MD5:—	SHA256:—
3088	RobloxPlayerLauncher.exe	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@roblox[2].txt		text
		MD5:—	SHA256:—
3088	RobloxPlayerLauncher.exe	C:\Users\admin\AppData\Local\Temp\RBX-53F8FE86\RobloxPlayerLauncher.exe		executable
		MD5:—	SHA256:—
3452	RobloxPlayerLauncher.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\application[1]		text
		MD5:—	SHA256:—
3088	RobloxPlayerLauncher.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\WindowsPlayer[1]		text
		MD5:—	SHA256:—
3088	RobloxPlayerLauncher.exe	C:\Users\admin\AppData\Local\Temp\RBX-FFA11024.log		text
		MD5:—	SHA256:—
3452	RobloxPlayerLauncher.exe	C:\Users\admin\AppData\Local\Temp\RBX-FA04DBA4.log		text
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
2084	iexplore.exe	GET	301	209.206.41.229:80	http://www.roblox.com/games/?referrer=roblox-player	US	html	173 b	whitelisted
3312	RobloxPlayerLauncher.exe	POST	200	209.206.41.152:80	http://ephemeralcounters.api.roblox.com/v1.0/MultiIncrement/?apiKey=76E5A40C-3AE1-4028-9F10-7C62520BD94F	US	—	—	whitelisted
3312	RobloxPlayerLauncher.exe	POST	200	209.206.41.152:80	http://ephemeralcounters.api.roblox.com/v1.0/MultiIncrement/?apiKey=76E5A40C-3AE1-4028-9F10-7C62520BD94F	US	—	—	whitelisted
3468	iexplore.exe	GET	200	204.79.197.200:80	http://www.bing.com/favicon.ico	US	image	237 b	whitelisted
3312	RobloxPlayerLauncher.exe	POST	200	209.206.41.152:80	http://ephemeralcounters.api.roblox.com/v1.0/MultiIncrement/?apiKey=76E5A40C-3AE1-4028-9F10-7C62520BD94F	US	—	—	whitelisted
3312	RobloxPlayerLauncher.exe	POST	200	209.206.41.152:80	http://ephemeralcounters.api.roblox.com/v1.0/MultiIncrement/?apiKey=76E5A40C-3AE1-4028-9F10-7C62520BD94F	US	—	—	whitelisted
3312	RobloxPlayerLauncher.exe	POST	200	209.206.41.152:80	http://ephemeralcounters.api.roblox.com/v1.0/MultiIncrement/?apiKey=76E5A40C-3AE1-4028-9F10-7C62520BD94F	US	—	—	whitelisted
3312	RobloxPlayerLauncher.exe	POST	200	209.206.41.152:80	http://ephemeralcounters.api.roblox.com/v1.0/MultiIncrement/?apiKey=76E5A40C-3AE1-4028-9F10-7C62520BD94F	US	—	—	whitelisted
3312	RobloxPlayerLauncher.exe	POST	200	209.206.41.152:80	http://ephemeralcounters.api.roblox.com/v1.0/MultiIncrement/?apiKey=76E5A40C-3AE1-4028-9F10-7C62520BD94F	US	—	—	whitelisted
3312	RobloxPlayerLauncher.exe	POST	200	209.206.41.152:80	http://ephemeralcounters.api.roblox.com/v1.0/MultiIncrement/?apiKey=76E5A40C-3AE1-4028-9F10-7C62520BD94F	US	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
3088	RobloxPlayerLauncher.exe	104.109.74.223:443	clientsettingscdn.roblox.com	Akamai International B.V.	NL	whitelisted
3452	RobloxPlayerLauncher.exe	104.109.74.223:443	clientsettingscdn.roblox.com	Akamai International B.V.	NL	whitelisted
3088	RobloxPlayerLauncher.exe	209.206.41.151:443	ephemeralcounters.api.roblox.com	Roblox	US	suspicious
3088	RobloxPlayerLauncher.exe	209.206.41.229:443	www.roblox.com	Roblox	US	suspicious
3088	RobloxPlayerLauncher.exe	2.18.233.109:443	setup.rbxcdn.com	Akamai International B.V.	—	whitelisted
3312	RobloxPlayerLauncher.exe	104.109.74.223:443	clientsettingscdn.roblox.com	Akamai International B.V.	NL	whitelisted
3108	RobloxPlayerLauncher.exe	104.109.74.223:443	clientsettingscdn.roblox.com	Akamai International B.V.	NL	whitelisted
3312	RobloxPlayerLauncher.exe	209.206.41.152:80	ephemeralcounters.api.roblox.com	Roblox	US	suspicious
3312	RobloxPlayerLauncher.exe	209.206.41.229:443	www.roblox.com	Roblox	US	suspicious
3312	RobloxPlayerLauncher.exe	2.18.233.109:443	setup.rbxcdn.com	Akamai International B.V.	—	whitelisted

DNS requests

Domain	IP	Reputation
clientsettingscdn.roblox.com	104.109.74.223	whitelisted
ephemeralcounters.api.roblox.com	209.206.41.151 209.206.41.152	whitelisted
www.roblox.com	209.206.41.229	whitelisted
setup.rbxcdn.com	2.18.233.109	whitelisted
versioncompatibility.api.roblox.com	209.206.41.21	whitelisted
s3.amazonaws.com	52.216.185.109	shared
www.bing.com	204.79.197.200 13.107.21.200	whitelisted

Threats

Found threats are available for the paid subscriptions

14 ETPRO signatures available at the full report

Add for printing

Process	Message
RobloxPlayerLauncher.exe	[3444:3432:20190618,095240.559:ERROR crashpad_client_win.cc:741] WaitForSingleObject timed out
RobloxPlayerLauncher.exe	[3400:2852:20190618,095328.887:ERROR exception_handler_server.cc:540] ConnectNamedPipe: The pipe is being closed. (232)

General Info

RobloxPlayerLauncher.exe

791E080FD687B3608AA1467879D10E6A

6AFF2C0930E4F407F1E3ABE3D84606572F6D0FE0

FD817357BECEA1D4621EAAEB2A87DAA920B634DF9C54849FDF45AFE5D080B702

24576:lCtT7CT0eXTAsUFKXi5v0OBRRrUG4rsw/W8AMtCTZ8LxZpd3g7MBQDPKdAGM8TX2:svVGTAsqKUnBfrUG4rTPAMkTZ8LxZpdw

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Application was dropped or rewritten from another process

SUSPICIOUS

Application launched itself

Creates files in the user directory

Executable content was dropped or overwritten

Modifies the open verb of a shell class

Creates a software uninstall entry

Starts Internet Explorer

INFO

Dropped object may contain Bitcoin addresses

Manual execution by user

Changes internet zones settings

Reads Internet Cache Settings

Creates files in the user directory

Malware configuration

Static information

TRiD

EXIF

EXE

Summary

DOS Header

PE Headers

Sections

Resources

Imports

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings