File name:

RobloxPlayerInstaller.exe

Full analysis: https://app.any.run/tasks/ad10b1e1-bcb1-47be-a0af-019482d79088
Verdict: Malicious activity
Analysis date: April 11, 2025, 17:20:38
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
roblox
arch-doc
arch-scr
arch-exec
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

6A43B83F9199B2B49C4379F7789BCE65

SHA1:

243B669C116D03E310F2D046DC607151EE17A39B

SHA256:

A469ADEB606F747E7834F807277B55992955C27659943A38FB97814DEE0872E0

SSDEEP:

98304:2s0XxZAeIRj+RPUDerTydJfCgwLjxAxw9WYRO0eKXY4ZkFW/BonJnS9hBTF8J/io:yLFRDRNRu+1u

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • MicrosoftEdgeUpdate.exe (PID: 7996)

  • SUSPICIOUS

    • Changes default file association

      • RobloxPlayerInstaller.exe (PID: 7324)

    • Process drops legitimate windows executable

      • RobloxPlayerInstaller.exe (PID: 7324)
      • MicrosoftEdgeWebview2Setup.exe (PID: 7972)
      • MicrosoftEdgeUpdate.exe (PID: 7996)

    • The process drops C-runtime libraries

      • RobloxPlayerInstaller.exe (PID: 7324)

    • Executable content was dropped or overwritten

      • RobloxPlayerInstaller.exe (PID: 7324)
      • MicrosoftEdgeWebview2Setup.exe (PID: 7972)
      • MicrosoftEdgeUpdate.exe (PID: 7996)

    • Creates/Modifies COM task schedule object

      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 8044)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 8072)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 8100)
      • MicrosoftEdgeUpdate.exe (PID: 8020)

    • Starts itself from another location

      • MicrosoftEdgeUpdate.exe (PID: 7996)

    • Reads security settings of Internet Explorer

      • MicrosoftEdgeUpdate.exe (PID: 7996)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeUpdate.exe (PID: 7996)

  • INFO

    • Checks supported languages

      • RobloxPlayerInstaller.exe (PID: 7324)
      • MicrosoftEdgeWebview2Setup.exe (PID: 7972)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 8072)
      • MicrosoftEdgeUpdate.exe (PID: 8020)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 8044)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 8100)
      • MicrosoftEdgeUpdate.exe (PID: 8132)
      • MicrosoftEdgeUpdate.exe (PID: 7996)
      • MicrosoftEdgeUpdate.exe (PID: 6148)
      • MicrosoftEdgeUpdate.exe (PID: 7196)

    • The sample compiled with english language support

      • RobloxPlayerInstaller.exe (PID: 7324)
      • MicrosoftEdgeUpdate.exe (PID: 7996)
      • MicrosoftEdgeWebview2Setup.exe (PID: 7972)

    • Creates files or folders in the user directory

      • RobloxPlayerInstaller.exe (PID: 7324)
      • MicrosoftEdgeUpdate.exe (PID: 7996)

    • Process checks whether UAC notifications are on

      • RobloxPlayerInstaller.exe (PID: 7324)

    • Reads the computer name

      • RobloxPlayerInstaller.exe (PID: 7324)
      • MicrosoftEdgeUpdate.exe (PID: 8020)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 8044)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 8072)
      • MicrosoftEdgeUpdate.exe (PID: 8132)
      • MicrosoftEdgeUpdate.exe (PID: 6148)
      • MicrosoftEdgeUpdate.exe (PID: 7196)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 8100)
      • MicrosoftEdgeUpdate.exe (PID: 7996)

    • ROBLOX mutex has been found

      • RobloxPlayerInstaller.exe (PID: 7324)

    • Reads the machine GUID from the registry

      • RobloxPlayerInstaller.exe (PID: 7324)

    • Create files in a temporary directory

      • RobloxPlayerInstaller.exe (PID: 7324)
      • MicrosoftEdgeWebview2Setup.exe (PID: 7972)
      • MicrosoftEdgeUpdate.exe (PID: 7996)

    • Checks proxy server information

      • MicrosoftEdgeUpdate.exe (PID: 8132)
      • MicrosoftEdgeUpdate.exe (PID: 7196)

    • Reads the software policy settings

      • MicrosoftEdgeUpdate.exe (PID: 8132)
      • MicrosoftEdgeUpdate.exe (PID: 7196)
      • slui.exe (PID: 7508)

    • Reads Environment values

      • MicrosoftEdgeUpdate.exe (PID: 8132)

    • Process checks computer location settings

      • MicrosoftEdgeUpdate.exe (PID: 7996)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2077:01:16 11:44:03+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14.29
CodeSize: 5654016
InitializedDataSize: 3155456
UninitializedDataSize: -
EntryPoint: 0x501a65
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.6.0.21577
ProductVersionNumber: 1.6.0.21577
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Roblox Corporation
FileDescription: Roblox
FileVersion: 1, 6, 0, 6640713
LegalCopyright: Copyright © 2020 Roblox Corporation. All rights reserved.
OriginalFileName: Roblox.exe
ProductName: Roblox Bootstrapper
ProductVersion: 1, 6, 0, 6640713
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
133
Monitored processes
13
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start robloxplayerinstaller.exe sppextcomobj.exe no specs slui.exe microsoftedgewebview2setup.exe microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdate.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
6148"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=false" /installsource otherinstallcmd /sessionid "{E3DD9648-2C9C-409F-804D-E50ACF36EC11}" /silentC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Version:
1.3.171.39
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
7196"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" -EmbeddingC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Version:
1.3.171.39
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
7268C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7324"C:\Users\admin\AppData\Local\Temp\RobloxPlayerInstaller.exe" C:\Users\admin\AppData\Local\Temp\RobloxPlayerInstaller.exe
explorer.exe
User:
admin
Company:
Roblox Corporation
Integrity Level:
MEDIUM
Description:
Roblox
Version:
1, 6, 0, 6640713
Modules
Images
c:\users\admin\appdata\local\temp\robloxplayerinstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
7472C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7508"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7972MicrosoftEdgeWebview2Setup.exe /silent /installC:\Users\admin\AppData\Local\Roblox\Versions\version-c2c9efad42eb44e5\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
RobloxPlayerInstaller.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update Setup
Version:
1.3.171.39
Modules
Images
c:\users\admin\appdata\local\roblox\versions\version-c2c9efad42eb44e5\webview2runtimeinstaller\microsoftedgewebview2setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7996C:\Users\admin\AppData\Local\Temp\EU8087.tmp\MicrosoftEdgeUpdate.exe /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"C:\Users\admin\AppData\Local\Temp\EU8087.tmp\MicrosoftEdgeUpdate.exe
MicrosoftEdgeWebview2Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Version:
1.3.171.39
Modules
Images
c:\users\admin\appdata\local\temp\eu8087.tmp\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
8020"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserverC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.171.39
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
8044"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe" /user C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update COM Registration Helper
Exit code:
0
Version:
1.3.171.39
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\1.3.171.39\microsoftedgeupdatecomregistershell64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
3 840
Read events
3 490
Write events
316
Delete events
34

Modification events

(PID) Process:(7324) RobloxPlayerInstaller.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio
Operation:writeName:WarnOnOpen
Value:
0
(PID) Process:(7324) RobloxPlayerInstaller.exeKey:HKEY_CLASSES_ROOT\roblox-studio
Operation:writeName:URL Protocol
Value:
(PID) Process:(7324) RobloxPlayerInstaller.exeKey:HKEY_CLASSES_ROOT\roblox-studio\shell\open\command
Operation:writeName:version
Value:
version-04a222f011414c81
(PID) Process:(7996) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate
Operation:delete valueName:eulaaccepted
Value:
(PID) Process:(7996) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate
Operation:writeName:path
Value:
C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
(PID) Process:(7996) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate
Operation:writeName:UninstallCmdLine
Value:
"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /uninstall
(PID) Process:(7996) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
Operation:writeName:pv
Value:
1.3.171.39
(PID) Process:(7996) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
Operation:writeName:name
Value:
Microsoft Edge Update
(PID) Process:(7996) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
Operation:writeName:pv
Value:
1.3.171.39
(PID) Process:(7996) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Microsoft Edge Update
Value:
"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateCore.exe"
Executable files
206
Suspicious files
30
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
7324RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\logs\cacert.pemtext
MD5:6CED45AE0FCB6620235271F2C6F41411
SHA256:AD64CF840A0FCE7924AC5F8A4F6900BFE73709A5A61031404A213AB563C286D8
7324RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\Downloads\roblox-player\f4a95efb90d2068ac69b708a25da7f00executable
MD5:F4A95EFB90D2068AC69B708A25DA7F00
SHA256:1F771539E64822C4D52F77EADF3E7088D96594B43929D86D4D8065413130FD0C
7324RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\Versions\version-c2c9efad42eb44e5\RobloxPlayerLauncher.exeexecutable
MD5:F4A95EFB90D2068AC69B708A25DA7F00
SHA256:1F771539E64822C4D52F77EADF3E7088D96594B43929D86D4D8065413130FD0C
7324RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Temp\Roblox\http\RBX07790AA0D1784C4084587108538E57ECbinary
MD5:841CA0EED49A9ED0EFAB203F63BB5540
SHA256:82BFDDAB6A84EFAEBFF46E956CF9CD0A364A7EAB3F0C1891BE641B593AD2AF08
7324RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\Downloads\roblox-player\65e8f1889ac6d2c950d094524af5e4b1compressed
MD5:65E8F1889AC6D2C950D094524AF5E4B1
SHA256:31BB0D76ACBD37045961C7435EA133BDC3FD3F6E081F0B2CF1ED3598AF887092
7324RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\Downloads\roblox-player\fb842bfa7bf9a6d90888ed9d6b38cadccompressed
MD5:FB842BFA7BF9A6D90888ED9D6B38CADC
SHA256:C90BA71324839A975812D7600CAE3F67B04309FBB23C4950CABB3FFCC7C7539B
7324RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Temp\Roblox\http\8913724486d5e3c463c493b25346ca31binary
MD5:841CA0EED49A9ED0EFAB203F63BB5540
SHA256:82BFDDAB6A84EFAEBFF46E956CF9CD0A364A7EAB3F0C1891BE641B593AD2AF08
7324RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\Downloads\roblox-player\8bd85f4e8e0f8904501eb60e6f3bf7eecompressed
MD5:8BD85F4E8E0F8904501EB60E6F3BF7EE
SHA256:2E01FCA8EA0CDFCB1E6962AE9A8DC8FAB9241441E2568D812AAD9A11E1BFF57B
7324RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\Downloads\roblox-player\b4b75c21ce05378163042dc45cec5834compressed
MD5:B4B75C21CE05378163042DC45CEC5834
SHA256:4D6FE68C8B4941CE335CE5597EBBC1F27AB02646E9AF98AF8A76875AD0FD191F
7324RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\Downloads\roblox-player\1f29f51e3d52d7f8ec6ed31e3f1fda6ecompressed
MD5:1F29F51E3D52D7F8EC6ED31E3F1FDA6E
SHA256:1CC22018EC11088DF3967F27008CB879EB92DB5AE0A5807698B84E93E039BD31
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
28
DNS requests
19
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.18.121.147:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.18.121.147:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
496
svchost.exe
GET
—
208.89.74.17:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/2d32fe70-a320-4465-a1ad-5f20197f7f9a?P1=1744996899&P2=404&P3=2&P4=aVzkT8EXw%2bsUWkNqltbh0cK8taZ4Eo%2bxLRGbntHJhl2Yo6KQDpWtSlTGOacMsrYJa6xNLinF38KE1m%2fOC8Nwqw%3d%3d
unknown
—
—
whitelisted
7800
SIHClient.exe
GET
200
104.123.41.162:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
496
svchost.exe
HEAD
200
208.89.74.17:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/2d32fe70-a320-4465-a1ad-5f20197f7f9a?P1=1744996899&P2=404&P3=2&P4=aVzkT8EXw%2bsUWkNqltbh0cK8taZ4Eo%2bxLRGbntHJhl2Yo6KQDpWtSlTGOacMsrYJa6xNLinF38KE1m%2fOC8Nwqw%3d%3d
unknown
—
—
whitelisted
7800
SIHClient.exe
GET
200
104.123.41.162:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.18.121.147:80
crl.microsoft.com
AKAMAI-AS
FR
whitelisted
5496
MoUsoCoreWorker.exe
2.18.121.147:80
crl.microsoft.com
AKAMAI-AS
FR
whitelisted
7324
RobloxPlayerInstaller.exe
128.116.5.4:443
ecsv2.roblox.com
ROBLOX-PRODUCTION
US
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
7324
RobloxPlayerInstaller.exe
18.173.187.17:443
clientsettingscdn.roblox.com
—
US
whitelisted
7324
RobloxPlayerInstaller.exe
2.18.121.137:443
setup.rbxcdn.com
AKAMAI-AS
FR
whitelisted
6544
svchost.exe
20.190.160.20:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.46
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 2.18.121.147
  • 2.18.121.139
whitelisted
ecsv2.roblox.com
  • 128.116.5.4
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
clientsettingscdn.roblox.com
  • 18.173.187.17
  • 18.173.187.5
  • 18.173.187.83
  • 18.173.187.112
whitelisted
setup.rbxcdn.com
  • 2.18.121.137
  • 2.18.121.132
whitelisted
login.live.com
  • 20.190.160.20
  • 20.190.160.66
  • 20.190.160.64
  • 20.190.160.131
  • 20.190.160.14
  • 40.126.32.72
  • 40.126.32.136
  • 40.126.32.76
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted

Threats

PID
Process
Class
Message
496
svchost.exe
Misc activity
ET INFO Packed Executable Download
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
RobloxPlayerInstaller.exe