File name:

jjsploit_8.16.5_x64_en-US.msi

Full analysis: https://app.any.run/tasks/93bc8c0e-222f-49eb-ab04-e87dfe721b53
Verdict: Malicious activity
Analysis date: October 10, 2025, 15:12:48
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
generated-doc
roblox
arch-doc
arch-exec
arch-scr
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: jjsploit, Author: wearedevs, Keywords: Installer, Comments: This installer database contains the logic and data required to install jjsploit., Template: x64;0, Revision Number: {63191E85-3F23-4B94-9F82-B9EC200ED812}, Create Time/Date: Sun Sep 21 17:16:58 2025, Last Saved Time/Date: Sun Sep 21 17:16:58 2025, Number of Pages: 450, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
MD5:

07237A5A2BE4FA33345F471806293A4B

SHA1:

276C9B3B41FF9E1A083974FED40E879DBCB36D5B

SHA256:

0BCD32FF42EA14898B7AB09223B152D3EC41488ED8C5EB40B927F30D12021F02

SSDEEP:

98304:PqIlqJzKGM3d4bL2orZYP6bzaNYkHJQTEZeDhPGMRFiO63zYXUA8Btl/HZD75xMr:SmWoD4+ztxS1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • MicrosoftEdgeUpdate.exe (PID: 7248)
      • MicrosoftEdgeUpdate.exe (PID: 7112)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 6120)

    • The DLL Hijacking

      • msedgewebview2.exe (PID: 1212)
      • msedgewebview2.exe (PID: 5196)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • RobloxPlayerInstaller.exe (PID: 1300)
      • MicrosoftEdgeUpdate.exe (PID: 7248)
      • MicrosoftEdgeWebview2Setup.exe (PID: 2168)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1880)
      • MicrosoftEdge_X64_141.0.3537.71.exe (PID: 3096)
      • powershell.exe (PID: 6120)
      • setup.exe (PID: 6956)
      • MicrosoftEdgeUpdate.exe (PID: 7112)
      • MicrosoftEdge_X64_141.0.3537.71.exe (PID: 8960)
      • RobloxStudioInstaller.exe (PID: 4356)
      • RobloxPlayerInstaller.exe (PID: 8748)
      • RobloxStudioInstaller.exe (PID: 4284)

    • Changes default file association

      • RobloxPlayerInstaller.exe (PID: 1300)
      • RobloxPlayerInstaller.exe (PID: 8748)
      • RobloxStudioInstaller.exe (PID: 4284)

    • Process drops legitimate windows executable

      • RobloxPlayerInstaller.exe (PID: 1300)
      • MicrosoftEdgeWebview2Setup.exe (PID: 2168)
      • MicrosoftEdgeUpdate.exe (PID: 7248)
      • powershell.exe (PID: 6120)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1880)
      • MicrosoftEdge_X64_141.0.3537.71.exe (PID: 3096)
      • setup.exe (PID: 6956)
      • MicrosoftEdgeUpdate.exe (PID: 7112)
      • MicrosoftEdge_X64_141.0.3537.71.exe (PID: 8960)
      • RobloxStudioInstaller.exe (PID: 4284)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeUpdate.exe (PID: 7248)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1880)
      • MicrosoftEdgeUpdate.exe (PID: 7112)

    • Starts itself from another location

      • MicrosoftEdgeUpdate.exe (PID: 7248)
      • RobloxStudioInstaller.exe (PID: 4356)

    • Creates/Modifies COM task schedule object

      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7548)
      • MicrosoftEdgeUpdate.exe (PID: 8280)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 532)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 4476)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7548)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 4476)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 3856)
      • MicrosoftEdgeUpdate.exe (PID: 4228)

    • Reads security settings of Internet Explorer

      • MicrosoftEdgeUpdate.exe (PID: 7248)
      • MicrosoftEdgeUpdate.exe (PID: 8580)
      • MicrosoftEdgeUpdate.exe (PID: 7112)
      • msedgewebview2.exe (PID: 3516)
      • msedgewebview2.exe (PID: 8428)
      • jjsploit.exe (PID: 3536)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 2244)

    • Starts process via Powershell

      • powershell.exe (PID: 6120)

    • Manipulates environment variables

      • powershell.exe (PID: 6120)

    • Downloads file from URI via Powershell

      • powershell.exe (PID: 6120)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 6120)

    • The process bypasses the loading of PowerShell profile settings

      • msiexec.exe (PID: 2244)

    • Starts POWERSHELL.EXE for commands execution

      • msiexec.exe (PID: 2244)

    • Application launched itself

      • MicrosoftEdgeUpdate.exe (PID: 8580)
      • setup.exe (PID: 6956)
      • setup.exe (PID: 4464)
      • MicrosoftEdgeUpdate.exe (PID: 8360)
      • msedgewebview2.exe (PID: 3516)
      • msedgewebview2.exe (PID: 8428)

    • Searches for installed software

      • setup.exe (PID: 6956)
      • setup.exe (PID: 4464)

    • Executes application which crashes

      • RobloxStudioInstaller.exe (PID: 4356)

    • The process drops C-runtime libraries

      • RobloxStudioInstaller.exe (PID: 4284)

  • INFO

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 8856)
      • MicrosoftEdgeUpdate.exe (PID: 3060)
      • MicrosoftEdgeUpdate.exe (PID: 8580)
      • powershell.exe (PID: 6120)
      • slui.exe (PID: 8232)
      • MicrosoftEdgeUpdate.exe (PID: 2156)
      • MicrosoftEdgeUpdate.exe (PID: 8524)
      • MicrosoftEdgeUpdate.exe (PID: 8360)
      • MicrosoftEdgeUpdate.exe (PID: 8228)
      • msedgewebview2.exe (PID: 3516)
      • WerFault.exe (PID: 2400)
      • msedgewebview2.exe (PID: 8428)

    • Reads the computer name

      • msiexec.exe (PID: 2244)
      • RobloxPlayerInstaller.exe (PID: 1300)
      • msiexec.exe (PID: 9048)
      • MicrosoftEdgeUpdate.exe (PID: 7248)
      • MicrosoftEdgeUpdate.exe (PID: 8280)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7548)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 4476)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 532)
      • MicrosoftEdgeUpdate.exe (PID: 3060)
      • MicrosoftEdgeUpdate.exe (PID: 8460)
      • MicrosoftEdgeUpdate.exe (PID: 8580)
      • MicrosoftEdgeUpdate.exe (PID: 7112)
      • MicrosoftEdge_X64_141.0.3537.71.exe (PID: 3096)
      • setup.exe (PID: 6956)
      • MicrosoftEdgeUpdate.exe (PID: 2156)
      • MicrosoftEdgeUpdate.exe (PID: 4228)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7548)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 3856)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 4476)
      • MicrosoftEdgeUpdate.exe (PID: 8524)
      • MicrosoftEdgeUpdate.exe (PID: 8360)
      • MicrosoftEdgeUpdate.exe (PID: 8688)
      • MicrosoftEdge_X64_141.0.3537.71.exe (PID: 8960)
      • MicrosoftEdgeUpdate.exe (PID: 8228)
      • jjsploit.exe (PID: 3536)
      • setup.exe (PID: 4464)
      • msedgewebview2.exe (PID: 3516)
      • msedgewebview2.exe (PID: 1212)
      • msedgewebview2.exe (PID: 8252)
      • RobloxStudioInstaller.exe (PID: 4284)
      • RobloxStudioInstaller.exe (PID: 4356)
      • RobloxPlayerInstaller.exe (PID: 8748)
      • msedgewebview2.exe (PID: 8428)
      • RobloxStudioBeta.exe (PID: 8012)
      • msedgewebview2.exe (PID: 5196)
      • msedgewebview2.exe (PID: 6724)
      • identity_helper.exe (PID: 9428)

    • Checks supported languages

      • msiexec.exe (PID: 2244)
      • RobloxPlayerInstaller.exe (PID: 1300)
      • msiexec.exe (PID: 9048)
      • MicrosoftEdgeWebview2Setup.exe (PID: 2168)
      • MicrosoftEdgeUpdate.exe (PID: 8280)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7548)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 4476)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 532)
      • MicrosoftEdgeUpdate.exe (PID: 3060)
      • MicrosoftEdgeUpdate.exe (PID: 7248)
      • MicrosoftEdgeUpdate.exe (PID: 8460)
      • MicrosoftEdgeUpdate.exe (PID: 8580)
      • MicrosoftEdge_X64_141.0.3537.71.exe (PID: 3096)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1880)
      • MicrosoftEdgeUpdate.exe (PID: 7112)
      • setup.exe (PID: 6956)
      • MicrosoftEdgeUpdate.exe (PID: 2156)
      • setup.exe (PID: 6448)
      • MicrosoftEdgeUpdate.exe (PID: 4228)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 3856)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7548)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 4476)
      • MicrosoftEdgeUpdate.exe (PID: 8524)
      • RobloxPlayerBeta.exe (PID: 932)
      • MicrosoftEdgeUpdate.exe (PID: 8360)
      • MicrosoftEdgeUpdate.exe (PID: 8688)
      • MicrosoftEdge_X64_141.0.3537.71.exe (PID: 8960)
      • setup.exe (PID: 4464)
      • setup.exe (PID: 5848)
      • MicrosoftEdgeUpdate.exe (PID: 8228)
      • jjsploit.exe (PID: 3536)
      • msedgewebview2.exe (PID: 1212)
      • msedgewebview2.exe (PID: 8252)
      • msedgewebview2.exe (PID: 7912)
      • RobloxStudioInstaller.exe (PID: 4356)
      • msedgewebview2.exe (PID: 3516)
      • msedgewebview2.exe (PID: 1800)
      • msedgewebview2.exe (PID: 2120)
      • RobloxStudioInstaller.exe (PID: 4284)
      • RobloxPlayerInstaller.exe (PID: 8748)
      • RobloxStudioBeta.exe (PID: 8012)
      • RobloxCrashHandler.exe (PID: 4344)
      • RobloxPlayerBeta.exe (PID: 6408)
      • RobloxPlayerBeta.exe (PID: 5244)
      • msedgewebview2.exe (PID: 8428)
      • msedgewebview2.exe (PID: 5196)
      • msedgewebview2.exe (PID: 6724)
      • msedgewebview2.exe (PID: 8596)
      • msedgewebview2.exe (PID: 9064)
      • msedgewebview2.exe (PID: 2888)
      • msedgewebview2.exe (PID: 8280)
      • msedgewebview2.exe (PID: 9292)
      • identity_helper.exe (PID: 9428)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 8608)
      • BackgroundTransferHost.exe (PID: 9048)
      • BackgroundTransferHost.exe (PID: 8856)
      • BackgroundTransferHost.exe (PID: 2876)
      • BackgroundTransferHost.exe (PID: 4284)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 8856)
      • MicrosoftEdgeUpdate.exe (PID: 8580)
      • MicrosoftEdgeUpdate.exe (PID: 3060)
      • MicrosoftEdgeUpdate.exe (PID: 2156)
      • slui.exe (PID: 8232)
      • MicrosoftEdgeUpdate.exe (PID: 8524)
      • MicrosoftEdgeUpdate.exe (PID: 8360)
      • MicrosoftEdgeUpdate.exe (PID: 8228)
      • WerFault.exe (PID: 2400)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 8856)
      • RobloxPlayerInstaller.exe (PID: 1300)
      • MicrosoftEdgeUpdate.exe (PID: 7248)
      • MicrosoftEdgeUpdate.exe (PID: 8580)
      • MicrosoftEdge_X64_141.0.3537.71.exe (PID: 3096)
      • setup.exe (PID: 6956)
      • setup.exe (PID: 6448)
      • MicrosoftEdgeUpdate.exe (PID: 8360)
      • MicrosoftEdge_X64_141.0.3537.71.exe (PID: 8960)
      • setup.exe (PID: 4464)
      • msedgewebview2.exe (PID: 3516)
      • msedgewebview2.exe (PID: 1800)
      • RobloxStudioInstaller.exe (PID: 4356)
      • msedgewebview2.exe (PID: 8252)
      • RobloxStudioInstaller.exe (PID: 4284)
      • WerFault.exe (PID: 2400)
      • RobloxPlayerInstaller.exe (PID: 8748)
      • jjsploit.exe (PID: 3536)
      • RobloxCrashHandler.exe (PID: 4344)
      • RobloxStudioBeta.exe (PID: 8012)
      • msedgewebview2.exe (PID: 8428)
      • msedgewebview2.exe (PID: 8280)
      • msedgewebview2.exe (PID: 6724)

    • Manual execution by a user

      • RobloxPlayerInstaller.exe (PID: 1300)
      • RobloxStudioInstaller.exe (PID: 4356)
      • RobloxPlayerInstaller.exe (PID: 8748)
      • RobloxPlayerBeta.exe (PID: 5244)

    • ROBLOX mutex has been found

      • RobloxPlayerInstaller.exe (PID: 1300)
      • RobloxStudioInstaller.exe (PID: 4356)
      • RobloxStudioInstaller.exe (PID: 4284)
      • RobloxPlayerInstaller.exe (PID: 8748)

    • Reads the machine GUID from the registry

      • RobloxPlayerInstaller.exe (PID: 1300)
      • MicrosoftEdgeUpdate.exe (PID: 8580)
      • msedgewebview2.exe (PID: 3516)
      • RobloxStudioInstaller.exe (PID: 4284)
      • RobloxStudioInstaller.exe (PID: 4356)
      • jjsploit.exe (PID: 3536)
      • RobloxPlayerInstaller.exe (PID: 8748)
      • RobloxCrashHandler.exe (PID: 4344)
      • RobloxStudioBeta.exe (PID: 8012)
      • msedgewebview2.exe (PID: 8428)

    • Process checks whether UAC notifications are on

      • RobloxPlayerInstaller.exe (PID: 1300)
      • RobloxStudioInstaller.exe (PID: 4284)
      • RobloxPlayerInstaller.exe (PID: 8748)
      • RobloxStudioBeta.exe (PID: 8012)

    • The sample compiled with english language support

      • RobloxPlayerInstaller.exe (PID: 1300)
      • MicrosoftEdgeWebview2Setup.exe (PID: 2168)
      • MicrosoftEdgeUpdate.exe (PID: 7248)
      • powershell.exe (PID: 6120)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1880)
      • MicrosoftEdge_X64_141.0.3537.71.exe (PID: 3096)
      • setup.exe (PID: 6956)
      • MicrosoftEdgeUpdate.exe (PID: 7112)
      • MicrosoftEdge_X64_141.0.3537.71.exe (PID: 8960)
      • RobloxStudioInstaller.exe (PID: 4356)
      • RobloxStudioInstaller.exe (PID: 4284)
      • RobloxPlayerInstaller.exe (PID: 8748)

    • Create files in a temporary directory

      • MicrosoftEdgeWebview2Setup.exe (PID: 2168)
      • RobloxPlayerInstaller.exe (PID: 1300)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1880)
      • msedgewebview2.exe (PID: 3516)
      • RobloxStudioInstaller.exe (PID: 4356)
      • RobloxStudioInstaller.exe (PID: 4284)
      • RobloxStudioBeta.exe (PID: 8012)
      • msedgewebview2.exe (PID: 8428)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3160)
      • msiexec.exe (PID: 2244)

    • Reads Environment values

      • MicrosoftEdgeUpdate.exe (PID: 3060)
      • MicrosoftEdgeUpdate.exe (PID: 2156)
      • MicrosoftEdgeUpdate.exe (PID: 8524)
      • MicrosoftEdgeUpdate.exe (PID: 8228)
      • RobloxPlayerBeta.exe (PID: 932)
      • msedgewebview2.exe (PID: 3516)
      • RobloxPlayerBeta.exe (PID: 6408)
      • msedgewebview2.exe (PID: 8428)
      • identity_helper.exe (PID: 9428)

    • Process checks computer location settings

      • MicrosoftEdgeUpdate.exe (PID: 7248)
      • setup.exe (PID: 6956)
      • MicrosoftEdgeUpdate.exe (PID: 7112)
      • setup.exe (PID: 4464)
      • msedgewebview2.exe (PID: 3516)
      • msedgewebview2.exe (PID: 2120)
      • msedgewebview2.exe (PID: 2888)
      • msedgewebview2.exe (PID: 8428)
      • msedgewebview2.exe (PID: 9292)

    • Manages system restore points

      • SrTasks.exe (PID: 1260)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 2244)
      • RobloxPlayerInstaller.exe (PID: 1300)
      • setup.exe (PID: 6956)
      • setup.exe (PID: 4464)
      • RobloxPlayerInstaller.exe (PID: 8748)
      • RobloxStudioInstaller.exe (PID: 4284)

    • Disables trace logs

      • powershell.exe (PID: 6120)

    • The executable file from the user directory is run by the Powershell process

      • MicrosoftEdgeWebview2Setup.exe (PID: 1880)

    • Reads CPU info

      • msedgewebview2.exe (PID: 3516)
      • msedgewebview2.exe (PID: 8428)

    • Application launched itself

      • msedge.exe (PID: 9448)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: jjsploit
Author: wearedevs
Keywords: Installer
Comments: This installer database contains the logic and data required to install jjsploit.
Template: x64;0
RevisionNumber: {63191E85-3F23-4B94-9F82-B9EC200ED812}
CreateDate: 2025:09:21 17:16:58
ModifyDate: 2025:09:21 17:16:58
Pages: 450
Words: 2
Software: Windows Installer XML Toolset (3.14.1.8722)
Security: Read-only recommended
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
261
Monitored processes
78
Malicious processes
8
Suspicious processes
5

Behavior graph

Click at the process to see the details

Process information

PID
CMD
Path
Indicators
Parent process
532"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.195.45\MicrosoftEdgeUpdateComRegisterShell64.exe" /user C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.195.45\MicrosoftEdgeUpdateComRegisterShell64.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update COM Registration Helper
Exit code:
0
Version:
1.3.195.45
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\1.3.195.45\microsoftedgeupdatecomregistershell64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
932"C:\Users\admin\AppData\Local\Roblox\Versions\version-d34359a5577645e2\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 1300C:\Users\admin\AppData\Local\Roblox\Versions\version-d34359a5577645e2\RobloxPlayerBeta.exe—RobloxPlayerInstaller.exe
User:
admin
Company:
Roblox Corporation
Integrity Level:
MEDIUM
Description:
Roblox Game Client
Exit code:
0
Version:
0, 694, 0, 6940982
Modules
Images
c:\users\admin\appdata\local\roblox\versions\version-d34359a5577645e2\robloxplayerbeta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\roblox\versions\version-d34359a5577645e2\robloxplayerbeta.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
1212"C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\141.0.3537.71\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.16.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=1712,i,8513632858923259854,3439246511263690864,262144 --field-trial-handle=1852,i,494432795219379530,14762347234632798174,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,LocalNetworkAccessForFencedFrameNavigationsWarningOnly,LocalNetworkAccessForNavigationsWarningOnly,LocalNetworkAccessForSubframeNavigationsWarningOnly,LocalNetworkAccessForWorkersWarningOnly,RemoveRedirectionBitmap,msAggressiveCacheTrimming,msCustomDataPartition,msWebView2NoTabForScreenShare,msWindowsTaskManager --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgePasswordStrengthCheck,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSmartScreenProtection,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=1844 /prefetch:2C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\141.0.3537.71\msedgewebview2.exe—msedgewebview2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge WebView2
Version:
141.0.3537.71
Modules
Images
c:\users\admin\appdata\local\microsoft\edgewebview\application\141.0.3537.71\msedgewebview2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\microsoft\edgewebview\application\141.0.3537.71\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1260C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:14C:\Windows\System32\SrTasks.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1300"C:\Users\admin\Desktop\RobloxPlayerInstaller.exe" C:\Users\admin\Desktop\RobloxPlayerInstaller.exe
explorer.exe
User:
admin
Company:
Roblox Corporation
Integrity Level:
MEDIUM
Description:
Roblox
Exit code:
0
Version:
1, 6, 1, 6880864
Modules
Images
c:\users\admin\desktop\robloxplayerinstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
1800C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\141.0.3537.71\msedgewebview2.exe --type=crashpad-handler --user-data-dir=C:\Users\admin\AppData\Local\net.wearedevs\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\admin\AppData\Local\net.wearedevs\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=141.0.7390.66 --annotation=exe=C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\141.0.3537.71\msedgewebview2.exe --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=141.0.3537.71 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffba26aa9d8,0x7ffba26aa9e4,0x7ffba26aa9f0C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\141.0.3537.71\msedgewebview2.exe—msedgewebview2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge WebView2
Version:
141.0.3537.71
Modules
Images
c:\users\admin\appdata\local\microsoft\edgewebview\application\141.0.3537.71\msedgewebview2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\microsoft\edgewebview\application\141.0.3537.71\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1880"C:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe" /silent /install C:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update Setup
Exit code:
0
Version:
1.3.201.11
Modules
Images
c:\users\admin\appdata\local\temp\microsoftedgewebview2setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
2120"C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\141.0.3537.71\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.16.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --dma-cps-flags=0 --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--expose-gc --ms-user-locale=" --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3484,i,15218825726893258411,13444056446481568374,2097152 --field-trial-handle=1852,i,494432795219379530,14762347234632798174,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,LocalNetworkAccessForFencedFrameNavigationsWarningOnly,LocalNetworkAccessForNavigationsWarningOnly,LocalNetworkAccessForSubframeNavigationsWarningOnly,LocalNetworkAccessForWorkersWarningOnly,RemoveRedirectionBitmap,msAggressiveCacheTrimming,msCustomDataPartition,msWebView2NoTabForScreenShare,msWindowsTaskManager --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgePasswordStrengthCheck,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSmartScreenProtection,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\141.0.3537.71\msedgewebview2.exe—msedgewebview2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge WebView2
Version:
141.0.3537.71
Modules
Images
c:\users\admin\appdata\local\microsoft\edgewebview\application\141.0.3537.71\msedgewebview2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\microsoft\edgewebview\application\141.0.3537.71\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2156"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDUiIGlzbWFjaGluZT0iMCIgc2Vzc2lvbmlkPSJ7RDkyOTlBQUYtNzRCMy00ODUyLTkwOUMtRjMzNThDOEM3NTI4fSIgdXNlcmlkPSJ7NEJBRkMzRjMtN0YyQi00MUVBLUI0QjctQjFEREZDNDlEOTVGfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins3QkExM0RBMi0xQjUzLTREMzctQkU1MC00RjZGODdCRURGQUF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iNiIgcGh5c21lbW9yeT0iNiIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQ1LjQwNDYiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREVMTCIgcHJvZHVjdF9uYW1lPSJERUxMIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxNDEuMC4zNTM3LjcxIiBsYW5nPSJlbiIgYnJhbmQ9IiIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE1NzIwOTAxOTMwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTU3MjA5NzE5NTUiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNTg0NjU2Mzg2NyIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmYudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvYmVlYzE1MmMtY2ZkNy00MjkwLTkyZjUtMDVkMjk2YTUzMDBkP1AxPTE3NjA3MTQwNDYmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9SGJGQWxXd1pxd05NSW1rbHFOb2xQY3NxSEFTZDY0UzkxMVdUbEREU2dmWFpySGg5UzFTWEZWRFl3MTBueG1sRHB4WUtsQjRFbHlxaXFmMEtTcGElMmJ3QSUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE4NjY0MzUxMiIgdG90YWw9IjE4NjY0MzUxMiIgZG93bmxvYWRfdGltZV9tcz0iOTU5MCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE1ODQ2NzMzODQ3IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTU4NjUwNjI2OTYiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjE2MTc4NDEyNjM5IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMzY4IiBkb3dubG9hZF90aW1lX21zPSIxMjU3MiIgZG93bmxvYWRlZD0iMTg2NjQzNTEyIiB0b3RhbD0iMTg2NjQzNTEyIiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSIzMTMzMSIvPjwvYXBwPjwvcmVxdWVzdD4C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.195.45
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
2168MicrosoftEdgeWebview2Setup.exe /silent /installC:\Users\admin\AppData\Local\Roblox\Versions\version-d34359a5577645e2\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
RobloxPlayerInstaller.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update Setup
Exit code:
0
Version:
1.3.195.45
Modules
Images
c:\users\admin\appdata\local\roblox\versions\version-d34359a5577645e2\webview2runtimeinstaller\microsoftedgewebview2setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
34 724
Read events
32 127
Write events
2 408
Delete events
189

Modification events

(PID) Process:(8608) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(8608) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(8608) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(8856) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(8856) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(8856) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2876) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(9048) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(9048) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(9048) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
436
Suspicious files
579
Text files
127
Unknown types
4

Dropped files

PID
Process
Filename
Type
8856BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\9989f11f-9a72-434d-82bf-7eb501f967f0.down_data —
MD5:—
SHA256:—
1300RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\Downloads\roblox-player\168e2fa39f11be10646c6d53740d7465 —
MD5:—
SHA256:—
8856BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:6205DDE5844EA4621C99095F4AC916B9
SHA256:A905CA726A01A42D85B9CDBAC363E49D509A57BCD91173E3380D1A28E80FDE7F
1300RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\Downloads\roblox-player\38deb2423e06386b701540cd877ff421compressed
MD5:38DEB2423E06386B701540CD877FF421
SHA256:E2BA1C9854A21C41AB75AC708E5CEB3A503353F5D94750A8BBEB177A7C58C2DF
1300RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\Downloads\roblox-player\42bc7a50170e697bced4cfd607f1bf08compressed
MD5:42BC7A50170E697BCED4CFD607F1BF08
SHA256:3EA7E5A9EE346BE1E1A11495ACDC98A9B8B8F0C4E822DC439D976879F91831CA
1300RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\Versions\RobloxStudioInstaller.exeexecutable
MD5:778304F75C62DB6710EF5A5ACD8EC097
SHA256:008A623E53EE602476729FAFAE14B2562AD92CCEB538FCE5B2A99E4D6EA9B861
8856BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:F149F8D8C2956CBFE2CEDADB6CD127D3
SHA256:95910FF200B412822903A0D67C0227BE1093CDF2CBD80FB43410C5026D374CF3
8856BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\9989f11f-9a72-434d-82bf-7eb501f967f0.1b4fffdb-9ac9-489c-9678-d3bf4eb05267.down_metabinary
MD5:BD803E1CAEF4D501F36901A05048457F
SHA256:ACD4AD7D9D2F03A4CE89AE13D4284CBE82140A24F3E4D929F223C925D498A0C5
8856BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\1e16fbd1-6318-458c-ab07-a21f7bdab957.up_meta_securebinary
MD5:FB3901F60246DA4616101CD7FA142DA6
SHA256:FB5F69FF529D54BAA5ED85E9FC9C4CEBC9581EF4DA6A0D026AA2E0CCA476244D
8856BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\1e16fbd1-6318-458c-ab07-a21f7bdab957.1b4fffdb-9ac9-489c-9678-d3bf4eb05267.down_metabinary
MD5:BD803E1CAEF4D501F36901A05048457F
SHA256:ACD4AD7D9D2F03A4CE89AE13D4284CBE82140A24F3E4D929F223C925D498A0C5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
172
DNS requests
129
Threats
36

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2720
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
whitelisted
1444
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
US
binary
313 b
whitelisted
3440
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
US
binary
471 b
whitelisted
2176
backgroundTaskHost.exe
GET
200
162.159.142.9:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
binary
471 b
whitelisted
8856
BackgroundTransferHost.exe
GET
200
162.159.142.9:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
binary
313 b
whitelisted
9004
svchost.exe
GET
—
199.232.210.172:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/beec152c-cfd7-4290-92f5-05d296a5300d?P1=1760714046&P2=404&P3=2&P4=HbFAlWwZqwNMImklqNolPcsqHASd64S911WTlDDSgfXZrHh9S1SXFVDYw10nxmlDpxYKlB4Elyqiqf0KSpa%2bwA%3d%3d
US
—
—
whitelisted
2400
WerFault.exe
GET
200
23.216.77.21:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
DE
binary
825 b
whitelisted
2720
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
whitelisted
9004
svchost.exe
HEAD
200
199.232.210.172:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/beec152c-cfd7-4290-92f5-05d296a5300d?P1=1760714046&P2=404&P3=2&P4=HbFAlWwZqwNMImklqNolPcsqHASd64S911WTlDDSgfXZrHh9S1SXFVDYw10nxmlDpxYKlB4Elyqiqf0KSpa%2bwA%3d%3d
US
—
—
whitelisted
2400
WerFault.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
NL
binary
814 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6016
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1436
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5224
SearchApp.exe
92.123.104.51:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2720
svchost.exe
40.126.31.69:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5224
SearchApp.exe
92.123.104.50:443
www.bing.com
Akamai International B.V.
DE
whitelisted
2720
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
1444
backgroundTaskHost.exe
92.123.104.51:443
www.bing.com
Akamai International B.V.
DE
whitelisted
1444
backgroundTaskHost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
google.com
  • 142.250.184.206
whitelisted
www.bing.com
  • 92.123.104.51
  • 92.123.104.45
  • 92.123.104.49
  • 92.123.104.47
  • 92.123.104.56
  • 92.123.104.52
  • 92.123.104.53
  • 92.123.104.42
  • 92.123.104.50
  • 2.16.241.225
  • 2.16.241.204
  • 2.16.241.218
  • 2.16.241.207
  • 2.16.241.201
  • 2.16.241.216
  • 2.16.241.222
  • 2.16.241.205
  • 2.16.241.206
  • 2.16.241.200
  • 2.16.241.219
whitelisted
login.live.com
  • 40.126.31.69
  • 40.126.31.131
  • 20.190.159.4
  • 20.190.159.75
  • 40.126.31.1
  • 20.190.159.23
  • 20.190.159.0
  • 40.126.31.128
whitelisted
th.bing.com
  • 92.123.104.50
  • 92.123.104.51
  • 92.123.104.45
  • 92.123.104.49
  • 92.123.104.47
  • 92.123.104.56
  • 92.123.104.52
  • 92.123.104.53
  • 92.123.104.42
  • 2.16.241.222
  • 2.16.241.219
  • 2.16.241.206
  • 2.16.241.207
  • 2.16.241.205
  • 2.16.241.200
whitelisted
ocsp.digicert.com
  • 184.30.131.245
  • 162.159.142.9
  • 172.66.2.5
whitelisted
client.wns.windows.com
  • 172.211.123.250
  • 172.211.123.248
whitelisted
arc.msn.com
  • 20.103.156.88
  • 20.223.35.26
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted
slscr.update.microsoft.com
  • 74.178.240.61
whitelisted

Threats

PID
Process
Class
Message
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
9004
svchost.exe
Misc activity
ET INFO Packed Executable Download
—
—
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
—
—
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
—
—
Misc activity
ET INFO Request for EXE via Powershell
—
—
Misc activity
ET INFO Packed Executable Download
8252
msedgewebview2.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
8252
msedgewebview2.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
8252
msedgewebview2.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
8252
msedgewebview2.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
Process
Message
RobloxPlayerInstaller.exe
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
msedgewebview2.exe
RecursiveDirectoryCreate( C:\Users\admin\AppData\Local\net.wearedevs directory exists )
RobloxStudioBeta.exe
2025-10-10T15:16:00.201Z,0.201320,18e0,6 [FLog::Output] RobloxGitHash: 03f999df4e0c9f49b858752b175c6bb54f07f0a5
RobloxStudioBeta.exe
RobloxStudioBeta.exe
2025-10-10T15:16:00.201Z,0.201320,18e0,6 [FLog::Output] Command line: C:\Users\admin\AppData\Local\Roblox\Versions\version-89ce51d2707749ab\RobloxStudioBeta.exe -startEvent www.roblox.com/robloxQTStudioStartedEvent -firstLaunch
RobloxStudioBeta.exe
RobloxStudioBeta.exe
2025-10-10T15:16:00.201Z,0.201320,18e0,6 [FLog::Output] Creating PolicyContext(Root)
RobloxStudioBeta.exe
RobloxStudioBeta.exe
2025-10-10T15:16:00.202Z,0.202312,18e0,6 [FLog::Output] BaseUrl: https://www.roblox.com
RobloxStudioBeta.exe
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
jjsploit_8.16.5_x64_en-US.msi