File name:

RobloxPlayerInstaller.exe

Full analysis: https://app.any.run/tasks/8580c396-cd1c-4832-886e-66b4b1a9ffcb
Verdict: Malicious activity
Analysis date: June 24, 2025, 10:41:35
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
roblox
arch-doc
arch-exec
arch-scr
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

A0396F9BB5E0144808CC7C7FDA47E682

SHA1:

76BEF1C55C6F288CA5988D344C4E92EE8F3A6329

SHA256:

B5D35EAF2CA4BEFB5AC6DE8680609C9A86FDC257B49D21CE4C8D17EDDAA1B51A

SSDEEP:

98304:7Js0wtARkyI/lxUPyRcWAcqop1LALhBD8XGq7R4IsqGIKl6g0z9QdR52b2+xZ3n6:naTRbX5OEE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • MicrosoftEdgeUpdate.exe (PID: 7164)

  • SUSPICIOUS

    • Changes default file association

      • RobloxPlayerInstaller.exe (PID: 7048)

    • Executable content was dropped or overwritten

      • RobloxPlayerInstaller.exe (PID: 7048)
      • MicrosoftEdgeWebview2Setup.exe (PID: 4864)
      • MicrosoftEdgeUpdate.exe (PID: 7164)
      • MicrosoftEdge_X64_137.0.3296.93.exe (PID: 6764)
      • setup.exe (PID: 4844)

    • Process drops legitimate windows executable

      • RobloxPlayerInstaller.exe (PID: 7048)
      • MicrosoftEdgeWebview2Setup.exe (PID: 4864)
      • MicrosoftEdgeUpdate.exe (PID: 7164)
      • MicrosoftEdge_X64_137.0.3296.93.exe (PID: 6764)
      • setup.exe (PID: 4844)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeUpdate.exe (PID: 7164)

    • Starts itself from another location

      • MicrosoftEdgeUpdate.exe (PID: 7164)

    • Creates/Modifies COM task schedule object

      • MicrosoftEdgeUpdate.exe (PID: 1728)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 1156)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 3460)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 2800)

    • Reads security settings of Internet Explorer

      • MicrosoftEdgeUpdate.exe (PID: 7164)
      • MicrosoftEdgeUpdate.exe (PID: 1212)

    • Application launched itself

      • setup.exe (PID: 4844)

    • Creates a software uninstall entry

      • setup.exe (PID: 4844)

    • Searches for installed software

      • setup.exe (PID: 4844)

  • INFO

    • The sample compiled with english language support

      • RobloxPlayerInstaller.exe (PID: 7048)
      • MicrosoftEdgeWebview2Setup.exe (PID: 4864)
      • MicrosoftEdgeUpdate.exe (PID: 7164)
      • MicrosoftEdge_X64_137.0.3296.93.exe (PID: 6764)
      • setup.exe (PID: 4844)

    • Checks supported languages

      • RobloxPlayerInstaller.exe (PID: 7048)
      • MicrosoftEdgeWebview2Setup.exe (PID: 4864)
      • MicrosoftEdgeUpdate.exe (PID: 7164)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 1156)
      • MicrosoftEdgeUpdate.exe (PID: 1728)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 2800)
      • MicrosoftEdgeUpdate.exe (PID: 6388)
      • MicrosoftEdgeUpdate.exe (PID: 6780)
      • MicrosoftEdgeUpdate.exe (PID: 1212)
      • MicrosoftEdge_X64_137.0.3296.93.exe (PID: 6764)
      • setup.exe (PID: 4844)
      • setup.exe (PID: 1352)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 3460)

    • ROBLOX mutex has been found

      • RobloxPlayerInstaller.exe (PID: 7048)

    • Creates files or folders in the user directory

      • RobloxPlayerInstaller.exe (PID: 7048)
      • MicrosoftEdgeUpdate.exe (PID: 7164)
      • MicrosoftEdgeUpdate.exe (PID: 1212)
      • MicrosoftEdge_X64_137.0.3296.93.exe (PID: 6764)
      • setup.exe (PID: 1352)
      • setup.exe (PID: 4844)

    • Process checks whether UAC notifications are on

      • RobloxPlayerInstaller.exe (PID: 7048)

    • Reads the machine GUID from the registry

      • RobloxPlayerInstaller.exe (PID: 7048)
      • MicrosoftEdgeUpdate.exe (PID: 1212)

    • Reads the computer name

      • RobloxPlayerInstaller.exe (PID: 7048)
      • MicrosoftEdgeUpdate.exe (PID: 7164)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 1156)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 3460)
      • MicrosoftEdgeUpdate.exe (PID: 1728)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 2800)
      • MicrosoftEdgeUpdate.exe (PID: 6388)
      • MicrosoftEdgeUpdate.exe (PID: 6780)
      • MicrosoftEdge_X64_137.0.3296.93.exe (PID: 6764)
      • setup.exe (PID: 4844)
      • MicrosoftEdgeUpdate.exe (PID: 1212)

    • Launching a file from a Registry key

      • MicrosoftEdgeUpdate.exe (PID: 7164)

    • Reads Environment values

      • MicrosoftEdgeUpdate.exe (PID: 6388)

    • Process checks computer location settings

      • MicrosoftEdgeUpdate.exe (PID: 7164)
      • setup.exe (PID: 4844)

    • Checks proxy server information

      • MicrosoftEdgeUpdate.exe (PID: 6388)
      • MicrosoftEdgeUpdate.exe (PID: 1212)

    • Create files in a temporary directory

      • MicrosoftEdgeWebview2Setup.exe (PID: 4864)
      • RobloxPlayerInstaller.exe (PID: 7048)

    • Reads the software policy settings

      • MicrosoftEdgeUpdate.exe (PID: 6388)
      • MicrosoftEdgeUpdate.exe (PID: 1212)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2035:08:15 11:53:19+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14.29
CodeSize: 3388416
InitializedDataSize: 15244288
UninitializedDataSize: -
EntryPoint: 0x2e85f0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.6.0.64689
ProductVersionNumber: 1.6.0.64689
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Roblox Corporation
FileDescription: Roblox
FileVersion: 1, 6, 0, 6290609
LegalCopyright: Copyright © 2020 Roblox Corporation. All rights reserved.
OriginalFileName: Roblox.exe
ProductName: Roblox Bootstrapper
ProductVersion: 1, 6, 0, 6290609
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
151
Monitored processes
14
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start robloxplayerinstaller.exe microsoftedgewebview2setup.exe microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdate.exe microsoftedge_x64_137.0.3296.93.exe setup.exe setup.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1156"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.195.45\MicrosoftEdgeUpdateComRegisterShell64.exe" /user C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.195.45\MicrosoftEdgeUpdateComRegisterShell64.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update COM Registration Helper
Exit code:
0
Version:
1.3.195.45
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\1.3.195.45\microsoftedgeupdatecomregistershell64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1212"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" -EmbeddingC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Version:
1.3.195.45
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
1352C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{82F8C332-35FA-4E45-ADF4-F9D0F1271B6C}\EDGEMITMP_81AB6.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=137.0.7151.120 --annotation=exe=C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{82F8C332-35FA-4E45-ADF4-F9D0F1271B6C}\EDGEMITMP_81AB6.tmp\setup.exe --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=137.0.3296.93 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff60d8753f8,0x7ff60d875404,0x7ff60d875410C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{82F8C332-35FA-4E45-ADF4-F9D0F1271B6C}\EDGEMITMP_81AB6.tmp\setup.exe—setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Installer
Exit code:
0
Version:
137.0.3296.93
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\install\{82f8c332-35fa-4e45-adf4-f9d0f1271b6c}\edgemitmp_81ab6.tmp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1728"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserverC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.195.45
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
2596C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2800"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.195.45\MicrosoftEdgeUpdateComRegisterShell64.exe" /user C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.195.45\MicrosoftEdgeUpdateComRegisterShell64.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update COM Registration Helper
Exit code:
0
Version:
1.3.195.45
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\1.3.195.45\microsoftedgeupdatecomregistershell64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3460"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.195.45\MicrosoftEdgeUpdateComRegisterShell64.exe" /user C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.195.45\MicrosoftEdgeUpdateComRegisterShell64.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update COM Registration Helper
Exit code:
0
Version:
1.3.195.45
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\1.3.195.45\microsoftedgeupdatecomregistershell64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4844"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{82F8C332-35FA-4E45-ADF4-F9D0F1271B6C}\EDGEMITMP_81AB6.tmp\setup.exe" --install-archive="C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{82F8C332-35FA-4E45-ADF4-F9D0F1271B6C}\MicrosoftEdge_X64_137.0.3296.93.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --user-levelC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{82F8C332-35FA-4E45-ADF4-F9D0F1271B6C}\EDGEMITMP_81AB6.tmp\setup.exe
MicrosoftEdge_X64_137.0.3296.93.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Installer
Exit code:
0
Version:
137.0.3296.93
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\install\{82f8c332-35fa-4e45-adf4-f9d0f1271b6c}\edgemitmp_81ab6.tmp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
4864MicrosoftEdgeWebview2Setup.exe /silent /installC:\Users\admin\AppData\Local\Roblox\Versions\version-82f8ee8d17124507\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
RobloxPlayerInstaller.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update Setup
Version:
1.3.195.45
Modules
Images
c:\users\admin\appdata\local\roblox\versions\version-82f8ee8d17124507\webview2runtimeinstaller\microsoftedgewebview2setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6388"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDUiIGlzbWFjaGluZT0iMCIgc2Vzc2lvbmlkPSJ7OUMxMEE5REItM0IxMC00MTNDLUI4NjgtRkM4NzU5QjA0RTE0fSIgdXNlcmlkPSJ7QUIwODNCREMtRTNBNi00MTQ2LUFGMDktNjk1Q0UyRjg2MUJGfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins5ODA2NzE3Qy0xNzE0LTQ2NDEtOEEwRS1FNzIwNEI1QkJGNDF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iNCIgcGh5c21lbW9yeT0iNCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQ1LjQwNDYiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREVMTCIgcHJvZHVjdF9uYW1lPSJERUxMIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjE5NS40NSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTU0MDk0NzY0OTciIGluc3RhbGxfdGltZV9tcz0iNTI4Ii8-PC9hcHA-PC9yZXF1ZXN0PgC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.195.45
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
Total events
8 691
Read events
7 241
Write events
1 402
Delete events
48

Modification events

(PID) Process:(7048) RobloxPlayerInstaller.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio
Operation:writeName:WarnOnOpen
Value:
0
(PID) Process:(7048) RobloxPlayerInstaller.exeKey:HKEY_CLASSES_ROOT\roblox-studio
Operation:writeName:URL Protocol
Value:
(PID) Process:(7048) RobloxPlayerInstaller.exeKey:HKEY_CLASSES_ROOT\roblox-studio\shell\open\command
Operation:writeName:version
Value:
version-6b3313c2b086401c
(PID) Process:(7164) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate
Operation:delete valueName:eulaaccepted
Value:
(PID) Process:(7164) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate
Operation:writeName:path
Value:
C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
(PID) Process:(7164) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate
Operation:writeName:UninstallCmdLine
Value:
"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /uninstall
(PID) Process:(7164) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
Operation:writeName:pv
Value:
1.3.195.45
(PID) Process:(7164) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
Operation:writeName:name
Value:
Microsoft Edge Update
(PID) Process:(7164) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
Operation:writeName:pv
Value:
1.3.195.45
(PID) Process:(7164) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate
Operation:writeName:edgeupdate_task_name_ua
Value:
MicrosoftEdgeUpdateTaskUserS-1-5-21-1693682860-607145093-2874071422-1001UA{3BB86406-D538-4824-AEEA-C6CD2960E219}
Executable files
206
Suspicious files
28
Text files
7
Unknown types
4

Dropped files

PID
Process
Filename
Type
7048RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\Downloads\roblox-player\02d105c1f6cfdf69cf4c5b7623de5d03 —
MD5:—
SHA256:—
7048RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\Versions\RobloxStudioInstaller.exeexecutable
MD5:83741361A64E8804B0CE886FCF29F1B3
SHA256:B1FD7E4B7146CA74979EC7861571CA01FE82BBBEF5492F7822EB400704A32A66
7048RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\Downloads\roblox-player\84c456aa295f9f65b947b397e5856142compressed
MD5:84C456AA295F9F65B947B397E5856142
SHA256:433F61667421962EE8F4F199A833D9F899BCB38AEB3354BB8E6BF53954531213
7048RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\Downloads\roblox-player\ad69a48a01948752ceb600ff5c3d71b3compressed
MD5:AD69A48A01948752CEB600FF5C3D71B3
SHA256:61AE45001676C407E4078ED744FF798787451718E43B461EAC5FE50D29E51EB8
7048RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\Downloads\roblox-player\c0b029a8acb8c62034cf05e53afb1591compressed
MD5:C0B029A8ACB8C62034CF05E53AFB1591
SHA256:DEE8CDE00CB3CDC016BD0F147F05B5E1171B4B741A1F1611A90A365FEC604C05
7048RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\Downloads\roblox-player\8bd85f4e8e0f8904501eb60e6f3bf7eecompressed
MD5:8BD85F4E8E0F8904501EB60E6F3BF7EE
SHA256:2E01FCA8EA0CDFCB1E6962AE9A8DC8FAB9241441E2568D812AAD9A11E1BFF57B
7048RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\logs\cacert.pemtext
MD5:0194EB945475F93844C0FAE769C0FA0B
SHA256:A6BC06B8255E4AFE2EEFF34684605D04DF9EC246FC201BF5E44137987189A0D3
7048RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\Downloads\roblox-player\f24f1840f9052ba3706212889cc29749compressed
MD5:F24F1840F9052BA3706212889CC29749
SHA256:78D7C366F6126F2FE7EA7BD104992583484CDE740AF919811E2BB406E109356B
7048RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\Downloads\roblox-player\1d0390337d1a4a58e5514be1a9481ad6compressed
MD5:1D0390337D1A4A58E5514BE1A9481AD6
SHA256:C79F0EEB2BCA4905C585C50333DB3C6F727A554F5DB82E64948F93668FBC18AA
7048RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\Downloads\roblox-player\8f379ec2b22ff106b837d79f7fdbf0d8compressed
MD5:8F379EC2B22FF106B837D79F7FDBF0D8
SHA256:6620658A6288E6B58B8D86AAEF4E7734E10778974E9A01D364FC7AAC4D35F10B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
33
DNS requests
24
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3952
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6676
svchost.exe
GET
—
199.232.210.172:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/374fbcab-db99-484d-b624-ce059f21ef35?P1=1751366517&P2=404&P3=2&P4=djeFzpM8BL1%2b%2b3m5faPL0lfcnlKF7wNbOYiZGgNmB%2fXUsPiRqHTCPyus%2fcfKm6%2bN9zV7aNAvJ3rgV6oUXh2ueg%3d%3d
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7076
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6676
svchost.exe
HEAD
200
199.232.210.172:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/374fbcab-db99-484d-b624-ce059f21ef35?P1=1751366517&P2=404&P3=2&P4=djeFzpM8BL1%2b%2b3m5faPL0lfcnlKF7wNbOYiZGgNmB%2fXUsPiRqHTCPyus%2fcfKm6%2bN9zV7aNAvJ3rgV6oUXh2ueg%3d%3d
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
3952
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1232
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7048
RobloxPlayerInstaller.exe
128.116.5.3:443
client-telemetry.roblox.com
ROBLOX-PRODUCTION
US
whitelisted
7048
RobloxPlayerInstaller.exe
23.201.250.50:443
clientsettingscdn.roblox.com
AKAMAI-AS
CH
whitelisted
7048
RobloxPlayerInstaller.exe
2.19.11.108:443
setup.rbxcdn.com
Elisa Oyj
NL
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
  • 4.231.128.59
  • 20.73.194.208
whitelisted
google.com
  • 142.250.186.174
whitelisted
client-telemetry.roblox.com
  • 128.116.5.3
whitelisted
ecsv2.roblox.com
  • 128.116.5.3
whitelisted
clientsettingscdn.roblox.com
  • 23.201.250.50
whitelisted
setup.rbxcdn.com
  • 2.19.11.108
  • 2.19.11.100
whitelisted
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.106
  • 2.16.164.9
  • 2.16.164.72
  • 2.16.164.120
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 23.35.229.160
whitelisted
login.live.com
  • 20.190.160.64
  • 20.190.160.66
  • 20.190.160.65
  • 20.190.160.131
  • 20.190.160.20
  • 20.190.160.22
  • 40.126.32.133
  • 20.190.160.128
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted

Threats

PID
Process
Class
Message
6676
svchost.exe
Misc activity
ET INFO Packed Executable Download
Process
Message
RobloxPlayerInstaller.exe
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
RobloxPlayerInstaller.exe