File name:

RobloxPlayerInstaller-VHCJKQRHYD.exe

Full analysis: https://app.any.run/tasks/45b08960-56f0-4f1d-8d8e-fb63b6b4647c
Verdict: Malicious activity
Analysis date: April 04, 2025, 11:24:20
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
roblox
arch-doc
arch-scr
arch-exec
github
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

27408F7C4519862A0008B1C397B32A03

SHA1:

C57897769F16A681B0573A4A51C755F309E3EFA2

SHA256:

227414FF701294A24EC811E58A29C310033597CD220BF5D635067AA2E46406AC

SSDEEP:

98304:fHs0YZlIDekgMvayBtQO/sifg//F38T5W9jMFmlXuJWtqCuCnO32OMnkDFRz4nqw:lJRyRIRPGm0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • MicrosoftEdgeUpdate.exe (PID: 872)
      • reg.exe (PID: 7156)

    • Disables Windows Defender

      • reg.exe (PID: 7676)

    • Disables task manager

      • reg.exe (PID: 7804)

    • UAC/LUA settings modification

      • reg.exe (PID: 236)

    • Starts NET.EXE to view/add/change user profiles

      • cmd.exe (PID: 3992)
      • net.exe (PID: 6384)

    • Uses Task Scheduler to run other applications

      • MBRKiller.exe (PID: 6748)

  • SUSPICIOUS

    • Changes default file association

      • RobloxPlayerInstaller-VHCJKQRHYD.exe (PID: 1272)

    • Executable content was dropped or overwritten

      • RobloxPlayerInstaller-VHCJKQRHYD.exe (PID: 1272)
      • MicrosoftEdgeUpdate.exe (PID: 872)
      • MicrosoftEdgeWebview2Setup.exe (PID: 3268)
      • MicrosoftEdge_X64_135.0.3179.54.exe (PID: 8048)
      • horrorbob.exe (PID: 7464)
      • cmd.exe (PID: 3992)
      • SysKern64.exe (PID: 6588)
      • cmd.exe (PID: 6632)

    • Process drops legitimate windows executable

      • RobloxPlayerInstaller-VHCJKQRHYD.exe (PID: 1272)
      • MicrosoftEdgeWebview2Setup.exe (PID: 3268)
      • MicrosoftEdgeUpdate.exe (PID: 872)
      • MicrosoftEdge_X64_135.0.3179.54.exe (PID: 8048)

    • The process drops C-runtime libraries

      • RobloxPlayerInstaller-VHCJKQRHYD.exe (PID: 1272)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeUpdate.exe (PID: 872)

    • Starts itself from another location

      • MicrosoftEdgeUpdate.exe (PID: 872)

    • Creates/Modifies COM task schedule object

      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6136)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7620)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 744)
      • MicrosoftEdgeUpdate.exe (PID: 2084)

    • Reads security settings of Internet Explorer

      • MicrosoftEdgeUpdate.exe (PID: 872)
      • MicrosoftEdgeUpdate.exe (PID: 4336)
      • WinRAR.exe (PID: 7280)
      • horrorbob.exe (PID: 7464)
      • ShellExperienceHost.exe (PID: 5172)
      • BobLauncher.exe (PID: 6756)
      • RulesLauncher.exe (PID: 6776)

    • Application launched itself

      • setup.exe (PID: 7880)

    • The process executes VB scripts

      • cmd.exe (PID: 3992)

    • Executing commands from a ".bat" file

      • horrorbob.exe (PID: 7464)
      • SysKern64.exe (PID: 6588)
      • BobLauncher.exe (PID: 6756)
      • RulesLauncher.exe (PID: 6776)

    • Starts CMD.EXE for commands execution

      • horrorbob.exe (PID: 7464)
      • SysKern64.exe (PID: 6588)
      • RulesLauncher.exe (PID: 6776)
      • BobLauncher.exe (PID: 6756)

    • Changes the desktop background image

      • reg.exe (PID: 2244)
      • reg.exe (PID: 2596)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 3992)

    • The system shut down or reboot

      • cmd.exe (PID: 3992)

    • The process executes via Task Scheduler

      • PLUGScheduler.exe (PID: 4108)
      • MicrosoftEdgeUpdate.exe (PID: 4124)

    • The executable file from the user directory is run by the CMD process

      • RulesLauncher.exe (PID: 6776)
      • BobLauncher.exe (PID: 6756)
      • MBRKiller.exe (PID: 6748)
      • inv.exe (PID: 6548)

    • Probably fake Windows Update

      • schtasks.exe (PID: 6784)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 6632)

  • INFO

    • Checks supported languages

      • RobloxPlayerInstaller-VHCJKQRHYD.exe (PID: 1272)
      • identity_helper.exe (PID: 7720)
      • MicrosoftEdgeWebview2Setup.exe (PID: 3268)
      • MicrosoftEdgeUpdate.exe (PID: 872)
      • MicrosoftEdgeUpdate.exe (PID: 2084)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6136)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 744)
      • MicrosoftEdgeUpdate.exe (PID: 6040)
      • MicrosoftEdgeUpdate.exe (PID: 4336)
      • MicrosoftEdgeUpdate.exe (PID: 8056)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7620)
      • MicrosoftEdge_X64_135.0.3179.54.exe (PID: 8048)
      • setup.exe (PID: 7880)
      • setup.exe (PID: 7276)
      • horrorbob.exe (PID: 7464)
      • ShellExperienceHost.exe (PID: 5172)
      • PLUGScheduler.exe (PID: 4108)
      • MicrosoftEdgeUpdate.exe (PID: 4124)
      • MicrosoftEdgeUpdateCore.exe (PID: 6488)
      • MicrosoftEdgeUpdate.exe (PID: 6512)
      • RulesLauncher.exe (PID: 6776)
      • SysKern64.exe (PID: 6588)
      • BobLauncher.exe (PID: 6756)
      • sbob.exe (PID: 7076)
      • rules32.exe (PID: 7068)
      • rules32.exe (PID: 6356)
      • inv.exe (PID: 6548)
      • sbob.exe (PID: 6328)
      • vlc.exe (PID: 7120)

    • The sample compiled with english language support

      • RobloxPlayerInstaller-VHCJKQRHYD.exe (PID: 1272)
      • MicrosoftEdgeWebview2Setup.exe (PID: 3268)
      • MicrosoftEdgeUpdate.exe (PID: 872)
      • MicrosoftEdge_X64_135.0.3179.54.exe (PID: 8048)
      • WinRAR.exe (PID: 7280)
      • horrorbob.exe (PID: 7464)
      • cmd.exe (PID: 3992)

    • Creates files or folders in the user directory

      • RobloxPlayerInstaller-VHCJKQRHYD.exe (PID: 1272)
      • MicrosoftEdgeUpdate.exe (PID: 872)
      • MicrosoftEdgeUpdate.exe (PID: 4336)
      • MicrosoftEdge_X64_135.0.3179.54.exe (PID: 8048)
      • setup.exe (PID: 7880)
      • setup.exe (PID: 7276)

    • Reads the machine GUID from the registry

      • RobloxPlayerInstaller-VHCJKQRHYD.exe (PID: 1272)
      • MicrosoftEdgeUpdate.exe (PID: 4336)

    • Reads the computer name

      • RobloxPlayerInstaller-VHCJKQRHYD.exe (PID: 1272)
      • identity_helper.exe (PID: 7720)
      • MicrosoftEdgeUpdate.exe (PID: 872)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6136)
      • MicrosoftEdgeUpdate.exe (PID: 2084)
      • MicrosoftEdgeUpdate.exe (PID: 6040)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 744)
      • MicrosoftEdgeUpdate.exe (PID: 8056)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7620)
      • MicrosoftEdge_X64_135.0.3179.54.exe (PID: 8048)
      • setup.exe (PID: 7880)
      • MicrosoftEdgeUpdate.exe (PID: 4336)
      • horrorbob.exe (PID: 7464)
      • ShellExperienceHost.exe (PID: 5172)
      • MicrosoftEdgeUpdate.exe (PID: 4124)
      • PLUGScheduler.exe (PID: 4108)
      • MicrosoftEdgeUpdateCore.exe (PID: 6488)
      • MicrosoftEdgeUpdate.exe (PID: 6512)
      • SysKern64.exe (PID: 6588)
      • BobLauncher.exe (PID: 6756)
      • RulesLauncher.exe (PID: 6776)
      • rules32.exe (PID: 6356)
      • sbob.exe (PID: 6328)
      • vlc.exe (PID: 7120)
      • sbob.exe (PID: 7076)

    • ROBLOX mutex has been found

      • RobloxPlayerInstaller-VHCJKQRHYD.exe (PID: 1272)

    • Process checks whether UAC notifications are on

      • RobloxPlayerInstaller-VHCJKQRHYD.exe (PID: 1272)
      • MicrosoftEdgeUpdate.exe (PID: 4124)
      • MicrosoftEdgeUpdate.exe (PID: 6512)

    • Create files in a temporary directory

      • RobloxPlayerInstaller-VHCJKQRHYD.exe (PID: 1272)
      • MicrosoftEdgeWebview2Setup.exe (PID: 3268)
      • MicrosoftEdgeUpdate.exe (PID: 872)
      • horrorbob.exe (PID: 7464)
      • SysKern64.exe (PID: 6588)
      • BobLauncher.exe (PID: 6756)
      • RulesLauncher.exe (PID: 6776)

    • Manual execution by a user

      • msedge.exe (PID: 5892)
      • MicrosoftEdgeUpdateCore.exe (PID: 6488)
      • SysKern64.exe (PID: 6588)
      • notepad.exe (PID: 6192)

    • Reads Environment values

      • identity_helper.exe (PID: 7720)
      • MicrosoftEdgeUpdate.exe (PID: 6040)

    • Application launched itself

      • msedge.exe (PID: 5892)

    • Process checks computer location settings

      • MicrosoftEdgeUpdate.exe (PID: 872)
      • horrorbob.exe (PID: 7464)
      • SysKern64.exe (PID: 6588)
      • BobLauncher.exe (PID: 6756)
      • RulesLauncher.exe (PID: 6776)

    • Checks proxy server information

      • MicrosoftEdgeUpdate.exe (PID: 6040)
      • MicrosoftEdgeUpdate.exe (PID: 4336)

    • Reads the software policy settings

      • MicrosoftEdgeUpdate.exe (PID: 6040)
      • MicrosoftEdgeUpdate.exe (PID: 4336)
      • slui.exe (PID: 7152)

    • Autorun file from Downloads

      • msedge.exe (PID: 7996)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7280)

    • Reads security settings of Internet Explorer

      • cscript.exe (PID: 7688)
      • notepad.exe (PID: 6192)

    • Reads Microsoft Office registry keys

      • msedge.exe (PID: 5892)

    • Reads the time zone

      • net1.exe (PID: 5556)

    • Creates files in the program directory

      • PLUGScheduler.exe (PID: 4108)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2042:07:04 20:03:50+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14.29
CodeSize: 4815872
InitializedDataSize: 2918400
UninitializedDataSize: -
EntryPoint: 0x4352b5
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.6.0.11523
ProductVersionNumber: 1.6.0.11523
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Roblox Corporation
FileDescription: Roblox
FileVersion: 1, 6, 0, 6630659
LegalCopyright: Copyright © 2020 Roblox Corporation. All rights reserved.
OriginalFileName: Roblox.exe
ProductName: Roblox Bootstrapper
ProductVersion: 1, 6, 0, 6630659
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
355
Monitored processes
102
Malicious processes
9
Suspicious processes
5

Behavior graph

Click at the process to see the details
start robloxplayerinstaller-vhcjkqrhyd.exe sppextcomobj.exe no specs slui.exe msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs microsoftedgewebview2setup.exe microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdate.exe slui.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs microsoftedge_x64_135.0.3179.54.exe msedge.exe no specs setup.exe no specs setup.exe no specs winrar.exe horrorbob.exe no specs horrorbob.exe cmd.exe conhost.exe no specs cscript.exe no specs reg.exe no specs reg.exe no specs rundll32.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe net.exe no specs net1.exe no specs shellexperiencehost.exe no specs wscript.exe no specs shutdown.exe no specs plugscheduler.exe no specs microsoftedgeupdate.exe no specs notepad.exe no specs microsoftedgeupdatecore.exe no specs microsoftedgeupdate.exe no specs syskern64.exe cmd.exe conhost.exe no specs mbrkiller.exe no specs boblauncher.exe no specs ruleslauncher.exe no specs schtasks.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs rules32.exe no specs sbob.exe no specs vlc.exe no specs timeout.exe no specs inv.exe no specs timeout.exe no specs rules32.exe no specs sbob.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
236reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /fC:\Windows\SysWOW64\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
744"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe" /user C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update COM Registration Helper
Exit code:
0
Version:
1.3.171.39
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\1.3.171.39\microsoftedgeupdatecomregistershell64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
872C:\Users\admin\AppData\Local\Temp\EU784A.tmp\MicrosoftEdgeUpdate.exe /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"C:\Users\admin\AppData\Local\Temp\EU784A.tmp\MicrosoftEdgeUpdate.exe
MicrosoftEdgeWebview2Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
1073807364
Version:
1.3.171.39
Modules
Images
c:\users\admin\appdata\local\temp\eu784a.tmp\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
960"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.59 --initial-client-data=0x300,0x304,0x308,0x2f8,0x310,0x7ffc896b5fd8,0x7ffc896b5fe4,0x7ffc896b5ff0C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1052"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2408 --field-trial-handle=2168,i,8747288036532524334,14556481080739744988,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1272"C:\Users\admin\AppData\Local\Temp\RobloxPlayerInstaller-VHCJKQRHYD.exe" C:\Users\admin\AppData\Local\Temp\RobloxPlayerInstaller-VHCJKQRHYD.exe
explorer.exe
User:
admin
Company:
Roblox Corporation
Integrity Level:
MEDIUM
Description:
Roblox
Exit code:
0
Version:
1, 6, 0, 6630659
Modules
Images
c:\users\admin\appdata\local\temp\robloxplayerinstaller-vhcjkqrhyd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
2084"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserverC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.171.39
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
2244reg.exe ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop /v NoChangingWallPaper /t REG_DWORD /d 1 /fC:\Windows\SysWOW64\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2384"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5464 --field-trial-handle=2168,i,8747288036532524334,14556481080739744988,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2596reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d c:\System64\bg.bmp /fC:\Windows\SysWOW64\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
21 394
Read events
19 583
Write events
1 762
Delete events
49

Modification events

(PID) Process:(1272) RobloxPlayerInstaller-VHCJKQRHYD.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio
Operation:writeName:WarnOnOpen
Value:
0
(PID) Process:(1272) RobloxPlayerInstaller-VHCJKQRHYD.exeKey:HKEY_CLASSES_ROOT\roblox-studio
Operation:writeName:URL Protocol
Value:
(PID) Process:(1272) RobloxPlayerInstaller-VHCJKQRHYD.exeKey:HKEY_CLASSES_ROOT\roblox-studio\shell\open\command
Operation:writeName:version
Value:
version-163b500c1e564deb
(PID) Process:(5892) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(5892) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(5892) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(5892) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(5892) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
0193BF6A88902F00
(PID) Process:(5892) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
B7CDC86A88902F00
(PID) Process:(5892) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\655692
Operation:writeName:WindowTabManagerFileMappingId
Value:
{085AAF9D-0ECB-4ADB-B09E-37BFC3DBDAE3}
Executable files
267
Suspicious files
817
Text files
153
Unknown types
22

Dropped files

PID
Process
Filename
Type
1272RobloxPlayerInstaller-VHCJKQRHYD.exeC:\Users\admin\AppData\Local\Roblox\Downloads\roblox-player\5d26d3f1ca97b69805186ca7806d31d7compressed
MD5:5D26D3F1CA97B69805186CA7806D31D7
SHA256:BA2A2268EDFCDB519B7ACF0E20C82DDDC0F4DD9A60D808E8A2E16A44FE642BEA
1272RobloxPlayerInstaller-VHCJKQRHYD.exeC:\Users\admin\AppData\Local\Roblox\Downloads\roblox-player\2724029fd2f49fc0ba0eb8991a806a54compressed
MD5:2724029FD2F49FC0BA0EB8991A806A54
SHA256:11FC5C2671BF8BEE224C82EEC4DF87D5CFCAE60E524A277B3DD4E22AFAF03390
1272RobloxPlayerInstaller-VHCJKQRHYD.exeC:\Users\admin\AppData\Local\Roblox\Downloads\roblox-player\6afd47a719d26cac99abd568c21f2066compressed
MD5:6AFD47A719D26CAC99ABD568C21F2066
SHA256:F8C9F80C413BBC3A95624BCC39FA7B00100CCA26DF312C58542308A8A331D5DD
1272RobloxPlayerInstaller-VHCJKQRHYD.exeC:\Users\admin\AppData\Local\Roblox\Downloads\roblox-player\a431ecca42ac73a5714d071b5767e16bcompressed
MD5:A431ECCA42AC73A5714D071B5767E16B
SHA256:1674323F76249EC55862DFDF7B7D40519789975CB38FF34C202D45AEB804EA7A
1272RobloxPlayerInstaller-VHCJKQRHYD.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Roblox\Roblox Studio.lnkbinary
MD5:26DD19F89A6F04F8805B5CC3BC60C490
SHA256:7107519E7F3565BB2FB4D24D5A1DA10A8397BA865558C7CF992D6D79D06E0648
1272RobloxPlayerInstaller-VHCJKQRHYD.exeC:\Users\admin\AppData\Local\Roblox\Downloads\roblox-player\8bd85f4e8e0f8904501eb60e6f3bf7eecompressed
MD5:8BD85F4E8E0F8904501EB60E6F3BF7EE
SHA256:2E01FCA8EA0CDFCB1E6962AE9A8DC8FAB9241441E2568D812AAD9A11E1BFF57B
1272RobloxPlayerInstaller-VHCJKQRHYD.exeC:\Users\admin\AppData\Local\Temp\Roblox\http\RBX3115218AE4EE43A3BA4F166840FFF09Ebinary
MD5:4CE6399825CB619E271333EB02827C5A
SHA256:6D2C185C448E1CD6DB70431AF1326BF5212632C10BFC93BCF43DE1202DEF4048
1272RobloxPlayerInstaller-VHCJKQRHYD.exeC:\Users\admin\AppData\Local\Roblox\Versions\RobloxStudioInstaller.exeexecutable
MD5:C26F2F88223B100D1CAA2E254AEB3FD2
SHA256:653B5FF08C0C890E103E31F53FCF6B9CFBBF462FC4481A62FFC84CF4F0C562DD
1272RobloxPlayerInstaller-VHCJKQRHYD.exeC:\Users\admin\AppData\Local\Temp\Roblox\http\8913724486d5e3c463c493b25346ca31binary
MD5:4CE6399825CB619E271333EB02827C5A
SHA256:6D2C185C448E1CD6DB70431AF1326BF5212632C10BFC93BCF43DE1202DEF4048
1272RobloxPlayerInstaller-VHCJKQRHYD.exeC:\Users\admin\AppData\Local\Roblox\logs\cacert.pemtext
MD5:6CED45AE0FCB6620235271F2C6F41411
SHA256:AD64CF840A0FCE7924AC5F8A4F6900BFE73709A5A61031404A213AB563C286D8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
156
DNS requests
151
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7260
svchost.exe
HEAD
200
23.48.23.14:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/2d32fe70-a320-4465-a1ad-5f20197f7f9a?P1=1744370722&P2=404&P3=2&P4=L9%2febiMxt7IzhcfOg6uWVsx9r8wZq4MxlhiHuSQMdWUPms%2fJY%2fC1UqWpeJWaLpwZCabI%2bud9XE%2bjiVmYMbxiYg%3d%3d
unknown
—
—
whitelisted
7260
svchost.exe
GET
—
23.48.23.14:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/2d32fe70-a320-4465-a1ad-5f20197f7f9a?P1=1744370722&P2=404&P3=2&P4=L9%2febiMxt7IzhcfOg6uWVsx9r8wZq4MxlhiHuSQMdWUPms%2fJY%2fC1UqWpeJWaLpwZCabI%2bud9XE%2bjiVmYMbxiYg%3d%3d
unknown
—
—
whitelisted
7984
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7984
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7260
svchost.exe
HEAD
200
23.48.23.41:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9b9f8fb4-8a65-41e4-bda3-5416858f0aeb?P1=1744052654&P2=404&P3=2&P4=d4zZzCcKTCDGESwsYSaAY1utX9WsUbuIUk1w2zdKqfiz9P5Nyp6RiesMWiGk58kS4xCtf0bsJkB89F8ojK6pVQ%3d%3d
unknown
—
—
whitelisted
7260
svchost.exe
GET
206
23.48.23.41:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9b9f8fb4-8a65-41e4-bda3-5416858f0aeb?P1=1744052654&P2=404&P3=2&P4=d4zZzCcKTCDGESwsYSaAY1utX9WsUbuIUk1w2zdKqfiz9P5Nyp6RiesMWiGk58kS4xCtf0bsJkB89F8ojK6pVQ%3d%3d
unknown
—
—
whitelisted
7260
svchost.exe
GET
206
23.48.23.41:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9b9f8fb4-8a65-41e4-bda3-5416858f0aeb?P1=1744052654&P2=404&P3=2&P4=d4zZzCcKTCDGESwsYSaAY1utX9WsUbuIUk1w2zdKqfiz9P5Nyp6RiesMWiGk58kS4xCtf0bsJkB89F8ojK6pVQ%3d%3d
unknown
—
—
whitelisted
7260
svchost.exe
GET
206
23.48.23.41:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9b9f8fb4-8a65-41e4-bda3-5416858f0aeb?P1=1744052654&P2=404&P3=2&P4=d4zZzCcKTCDGESwsYSaAY1utX9WsUbuIUk1w2zdKqfiz9P5Nyp6RiesMWiGk58kS4xCtf0bsJkB89F8ojK6pVQ%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1272
RobloxPlayerInstaller-VHCJKQRHYD.exe
128.116.44.4:443
ecsv2.roblox.com
ROBLOX-PRODUCTION
US
whitelisted
1272
RobloxPlayerInstaller-VHCJKQRHYD.exe
52.222.236.86:443
clientsettingscdn.roblox.com
AMAZON-02
US
whitelisted
1272
RobloxPlayerInstaller-VHCJKQRHYD.exe
13.32.27.22:443
setup.rbxcdn.com
AMAZON-02
US
whitelisted
3216
svchost.exe
20.198.162.78:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
SG
whitelisted
6544
svchost.exe
20.190.160.14:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.142
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.147
whitelisted
ecsv2.roblox.com
  • 128.116.44.4
whitelisted
clientsettingscdn.roblox.com
  • 52.222.236.86
  • 52.222.236.43
  • 52.222.236.6
  • 52.222.236.113
whitelisted
apis.roblox.com
  • 128.116.44.4
whitelisted
setup.rbxcdn.com
  • 13.32.27.22
  • 13.32.27.39
  • 13.32.27.4
  • 13.32.27.35
whitelisted
client.wns.windows.com
  • 20.198.162.78
whitelisted
login.live.com
  • 20.190.160.14
  • 20.190.160.2
  • 40.126.32.136
  • 20.190.160.17
  • 40.126.32.72
  • 20.190.160.5
  • 40.126.32.68
  • 20.190.160.131
  • 40.126.31.3
  • 40.126.31.131
  • 20.190.159.128
  • 20.190.159.2
  • 40.126.31.130
  • 40.126.31.129
  • 40.126.31.73
  • 20.190.159.75
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted

Threats

PID
Process
Class
Message
7260
svchost.exe
Misc activity
ET INFO Packed Executable Download
5680
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
5680
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
5680
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
5680
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
RobloxPlayerInstaller-VHCJKQRHYD.exe