File name:

RobloxPlayerInstaller.exe

Full analysis: https://app.any.run/tasks/8580c396-cd1c-4832-886e-66b4b1a9ffcb
Verdict: Malicious activity
Analysis date: June 24, 2025, 10:41:35
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
roblox
arch-doc
arch-exec
arch-scr
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

A0396F9BB5E0144808CC7C7FDA47E682

SHA1:

76BEF1C55C6F288CA5988D344C4E92EE8F3A6329

SHA256:

B5D35EAF2CA4BEFB5AC6DE8680609C9A86FDC257B49D21CE4C8D17EDDAA1B51A

SSDEEP:

98304:7Js0wtARkyI/lxUPyRcWAcqop1LALhBD8XGq7R4IsqGIKl6g0z9QdR52b2+xZ3n6:naTRbX5OEE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • MicrosoftEdgeUpdate.exe (PID: 7164)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • RobloxPlayerInstaller.exe (PID: 7048)
      • MicrosoftEdgeWebview2Setup.exe (PID: 4864)
      • MicrosoftEdgeUpdate.exe (PID: 7164)
      • MicrosoftEdge_X64_137.0.3296.93.exe (PID: 6764)
      • setup.exe (PID: 4844)

    • Process drops legitimate windows executable

      • RobloxPlayerInstaller.exe (PID: 7048)
      • MicrosoftEdgeWebview2Setup.exe (PID: 4864)
      • MicrosoftEdgeUpdate.exe (PID: 7164)
      • MicrosoftEdge_X64_137.0.3296.93.exe (PID: 6764)
      • setup.exe (PID: 4844)

    • Changes default file association

      • RobloxPlayerInstaller.exe (PID: 7048)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeUpdate.exe (PID: 7164)

    • Creates/Modifies COM task schedule object

      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 1156)
      • MicrosoftEdgeUpdate.exe (PID: 1728)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 3460)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 2800)

    • Starts itself from another location

      • MicrosoftEdgeUpdate.exe (PID: 7164)

    • Reads security settings of Internet Explorer

      • MicrosoftEdgeUpdate.exe (PID: 7164)
      • MicrosoftEdgeUpdate.exe (PID: 1212)

    • Application launched itself

      • setup.exe (PID: 4844)

    • Searches for installed software

      • setup.exe (PID: 4844)

    • Creates a software uninstall entry

      • setup.exe (PID: 4844)

  • INFO

    • Checks supported languages

      • RobloxPlayerInstaller.exe (PID: 7048)
      • MicrosoftEdgeWebview2Setup.exe (PID: 4864)
      • MicrosoftEdgeUpdate.exe (PID: 7164)
      • MicrosoftEdgeUpdate.exe (PID: 1728)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 1156)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 2800)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 3460)
      • MicrosoftEdgeUpdate.exe (PID: 6388)
      • MicrosoftEdgeUpdate.exe (PID: 6780)
      • MicrosoftEdgeUpdate.exe (PID: 1212)
      • MicrosoftEdge_X64_137.0.3296.93.exe (PID: 6764)
      • setup.exe (PID: 1352)
      • setup.exe (PID: 4844)

    • The sample compiled with english language support

      • RobloxPlayerInstaller.exe (PID: 7048)
      • MicrosoftEdgeWebview2Setup.exe (PID: 4864)
      • MicrosoftEdgeUpdate.exe (PID: 7164)
      • MicrosoftEdge_X64_137.0.3296.93.exe (PID: 6764)
      • setup.exe (PID: 4844)

    • ROBLOX mutex has been found

      • RobloxPlayerInstaller.exe (PID: 7048)

    • Creates files or folders in the user directory

      • RobloxPlayerInstaller.exe (PID: 7048)
      • MicrosoftEdgeUpdate.exe (PID: 7164)
      • MicrosoftEdgeUpdate.exe (PID: 1212)
      • MicrosoftEdge_X64_137.0.3296.93.exe (PID: 6764)
      • setup.exe (PID: 1352)
      • setup.exe (PID: 4844)

    • Reads the computer name

      • RobloxPlayerInstaller.exe (PID: 7048)
      • MicrosoftEdgeUpdate.exe (PID: 7164)
      • MicrosoftEdgeUpdate.exe (PID: 1728)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 1156)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 2800)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 3460)
      • MicrosoftEdgeUpdate.exe (PID: 6388)
      • MicrosoftEdgeUpdate.exe (PID: 6780)
      • MicrosoftEdgeUpdate.exe (PID: 1212)
      • MicrosoftEdge_X64_137.0.3296.93.exe (PID: 6764)
      • setup.exe (PID: 4844)

    • Process checks whether UAC notifications are on

      • RobloxPlayerInstaller.exe (PID: 7048)

    • Reads the machine GUID from the registry

      • RobloxPlayerInstaller.exe (PID: 7048)
      • MicrosoftEdgeUpdate.exe (PID: 1212)

    • Create files in a temporary directory

      • MicrosoftEdgeWebview2Setup.exe (PID: 4864)
      • RobloxPlayerInstaller.exe (PID: 7048)

    • Launching a file from a Registry key

      • MicrosoftEdgeUpdate.exe (PID: 7164)

    • Reads Environment values

      • MicrosoftEdgeUpdate.exe (PID: 6388)

    • Checks proxy server information

      • MicrosoftEdgeUpdate.exe (PID: 6388)
      • MicrosoftEdgeUpdate.exe (PID: 1212)

    • Reads the software policy settings

      • MicrosoftEdgeUpdate.exe (PID: 6388)
      • MicrosoftEdgeUpdate.exe (PID: 1212)

    • Process checks computer location settings

      • MicrosoftEdgeUpdate.exe (PID: 7164)
      • setup.exe (PID: 4844)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2035:08:15 11:53:19+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14.29
CodeSize: 3388416
InitializedDataSize: 15244288
UninitializedDataSize: -
EntryPoint: 0x2e85f0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.6.0.64689
ProductVersionNumber: 1.6.0.64689
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Roblox Corporation
FileDescription: Roblox
FileVersion: 1, 6, 0, 6290609
LegalCopyright: Copyright © 2020 Roblox Corporation. All rights reserved.
OriginalFileName: Roblox.exe
ProductName: Roblox Bootstrapper
ProductVersion: 1, 6, 0, 6290609
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
151
Monitored processes
14
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start robloxplayerinstaller.exe microsoftedgewebview2setup.exe microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdate.exe microsoftedge_x64_137.0.3296.93.exe setup.exe setup.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1156"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.195.45\MicrosoftEdgeUpdateComRegisterShell64.exe" /user C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.195.45\MicrosoftEdgeUpdateComRegisterShell64.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update COM Registration Helper
Exit code:
0
Version:
1.3.195.45
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\1.3.195.45\microsoftedgeupdatecomregistershell64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1212"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" -EmbeddingC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Version:
1.3.195.45
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
1352C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{82F8C332-35FA-4E45-ADF4-F9D0F1271B6C}\EDGEMITMP_81AB6.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=137.0.7151.120 --annotation=exe=C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{82F8C332-35FA-4E45-ADF4-F9D0F1271B6C}\EDGEMITMP_81AB6.tmp\setup.exe --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=137.0.3296.93 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff60d8753f8,0x7ff60d875404,0x7ff60d875410C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{82F8C332-35FA-4E45-ADF4-F9D0F1271B6C}\EDGEMITMP_81AB6.tmp\setup.exe—setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Installer
Exit code:
0
Version:
137.0.3296.93
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\install\{82f8c332-35fa-4e45-adf4-f9d0f1271b6c}\edgemitmp_81ab6.tmp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1728"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserverC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.195.45
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
2596C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2800"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.195.45\MicrosoftEdgeUpdateComRegisterShell64.exe" /user C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.195.45\MicrosoftEdgeUpdateComRegisterShell64.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update COM Registration Helper
Exit code:
0
Version:
1.3.195.45
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\1.3.195.45\microsoftedgeupdatecomregistershell64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3460"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.195.45\MicrosoftEdgeUpdateComRegisterShell64.exe" /user C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.195.45\MicrosoftEdgeUpdateComRegisterShell64.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update COM Registration Helper
Exit code:
0
Version:
1.3.195.45
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\1.3.195.45\microsoftedgeupdatecomregistershell64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4844"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{82F8C332-35FA-4E45-ADF4-F9D0F1271B6C}\EDGEMITMP_81AB6.tmp\setup.exe" --install-archive="C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{82F8C332-35FA-4E45-ADF4-F9D0F1271B6C}\MicrosoftEdge_X64_137.0.3296.93.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --user-levelC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{82F8C332-35FA-4E45-ADF4-F9D0F1271B6C}\EDGEMITMP_81AB6.tmp\setup.exe
MicrosoftEdge_X64_137.0.3296.93.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Installer
Exit code:
0
Version:
137.0.3296.93
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\install\{82f8c332-35fa-4e45-adf4-f9d0f1271b6c}\edgemitmp_81ab6.tmp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
4864MicrosoftEdgeWebview2Setup.exe /silent /installC:\Users\admin\AppData\Local\Roblox\Versions\version-82f8ee8d17124507\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
RobloxPlayerInstaller.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update Setup
Version:
1.3.195.45
Modules
Images
c:\users\admin\appdata\local\roblox\versions\version-82f8ee8d17124507\webview2runtimeinstaller\microsoftedgewebview2setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6388"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDUiIGlzbWFjaGluZT0iMCIgc2Vzc2lvbmlkPSJ7OUMxMEE5REItM0IxMC00MTNDLUI4NjgtRkM4NzU5QjA0RTE0fSIgdXNlcmlkPSJ7QUIwODNCREMtRTNBNi00MTQ2LUFGMDktNjk1Q0UyRjg2MUJGfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins5ODA2NzE3Qy0xNzE0LTQ2NDEtOEEwRS1FNzIwNEI1QkJGNDF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iNCIgcGh5c21lbW9yeT0iNCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQ1LjQwNDYiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREVMTCIgcHJvZHVjdF9uYW1lPSJERUxMIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjE5NS40NSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTU0MDk0NzY0OTciIGluc3RhbGxfdGltZV9tcz0iNTI4Ii8-PC9hcHA-PC9yZXF1ZXN0PgC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.195.45
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
Total events
8 691
Read events
7 241
Write events
1 402
Delete events
48

Modification events

(PID) Process:(7048) RobloxPlayerInstaller.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio
Operation:writeName:WarnOnOpen
Value:
0
(PID) Process:(7048) RobloxPlayerInstaller.exeKey:HKEY_CLASSES_ROOT\roblox-studio
Operation:writeName:URL Protocol
Value:
(PID) Process:(7048) RobloxPlayerInstaller.exeKey:HKEY_CLASSES_ROOT\roblox-studio\shell\open\command
Operation:writeName:version
Value:
version-6b3313c2b086401c
(PID) Process:(7164) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate
Operation:delete valueName:eulaaccepted
Value:
(PID) Process:(7164) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate
Operation:writeName:path
Value:
C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
(PID) Process:(7164) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate
Operation:writeName:UninstallCmdLine
Value:
"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /uninstall
(PID) Process:(7164) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
Operation:writeName:pv
Value:
1.3.195.45
(PID) Process:(7164) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
Operation:writeName:name
Value:
Microsoft Edge Update
(PID) Process:(7164) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
Operation:writeName:pv
Value:
1.3.195.45
(PID) Process:(7164) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate
Operation:writeName:edgeupdate_task_name_ua
Value:
MicrosoftEdgeUpdateTaskUserS-1-5-21-1693682860-607145093-2874071422-1001UA{3BB86406-D538-4824-AEEA-C6CD2960E219}
Executable files
206
Suspicious files
28
Text files
7
Unknown types
4

Dropped files

PID
Process
Filename
Type
7048RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\Downloads\roblox-player\02d105c1f6cfdf69cf4c5b7623de5d03 —
MD5:—
SHA256:—
7048RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\Downloads\roblox-player\8f379ec2b22ff106b837d79f7fdbf0d8compressed
MD5:8F379EC2B22FF106B837D79F7FDBF0D8
SHA256:6620658A6288E6B58B8D86AAEF4E7734E10778974E9A01D364FC7AAC4D35F10B
7048RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\Versions\RobloxStudioInstaller.exeexecutable
MD5:83741361A64E8804B0CE886FCF29F1B3
SHA256:B1FD7E4B7146CA74979EC7861571CA01FE82BBBEF5492F7822EB400704A32A66
7048RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\Downloads\roblox-player\f24f1840f9052ba3706212889cc29749compressed
MD5:F24F1840F9052BA3706212889CC29749
SHA256:78D7C366F6126F2FE7EA7BD104992583484CDE740AF919811E2BB406E109356B
7048RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\logs\cacert.pemtext
MD5:0194EB945475F93844C0FAE769C0FA0B
SHA256:A6BC06B8255E4AFE2EEFF34684605D04DF9EC246FC201BF5E44137987189A0D3
7048RobloxPlayerInstaller.exeC:\Users\admin\Desktop\Roblox Studio.lnklnk
MD5:2758B6F4AEA488AE16427EABC2583871
SHA256:5ADEF3B256D2564BBFC68AA9C0D75FFE90D59C4A786A3EED6FE7318ABDD797E2
7048RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\Downloads\roblox-player\51f521ecfa96c8b212ada54aa5ba689bcompressed
MD5:51F521ECFA96C8B212ADA54AA5BA689B
SHA256:7DBBA0B1020A46AB2FCC86FF5954308513C89AF22255E4DA61C49E0CE289F1FC
7048RobloxPlayerInstaller.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Roblox\Roblox Studio.lnklnk
MD5:42D1466997A12995FFDF78ADD3397C51
SHA256:9004238D19203D9250AE7D22E98717CDB52F776865512C9EC816246AF2166BE1
7048RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\Downloads\roblox-player\1d0390337d1a4a58e5514be1a9481ad6compressed
MD5:1D0390337D1A4A58E5514BE1A9481AD6
SHA256:C79F0EEB2BCA4905C585C50333DB3C6F727A554F5DB82E64948F93668FBC18AA
7048RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\Downloads\roblox-player\c0b029a8acb8c62034cf05e53afb1591compressed
MD5:C0B029A8ACB8C62034CF05E53AFB1591
SHA256:DEE8CDE00CB3CDC016BD0F147F05B5E1171B4B741A1F1611A90A365FEC604C05
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
33
DNS requests
24
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6676
svchost.exe
GET
—
199.232.210.172:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/374fbcab-db99-484d-b624-ce059f21ef35?P1=1751366517&P2=404&P3=2&P4=djeFzpM8BL1%2b%2b3m5faPL0lfcnlKF7wNbOYiZGgNmB%2fXUsPiRqHTCPyus%2fcfKm6%2bN9zV7aNAvJ3rgV6oUXh2ueg%3d%3d
unknown
—
—
whitelisted
6676
svchost.exe
HEAD
200
199.232.210.172:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/374fbcab-db99-484d-b624-ce059f21ef35?P1=1751366517&P2=404&P3=2&P4=djeFzpM8BL1%2b%2b3m5faPL0lfcnlKF7wNbOYiZGgNmB%2fXUsPiRqHTCPyus%2fcfKm6%2bN9zV7aNAvJ3rgV6oUXh2ueg%3d%3d
unknown
—
—
whitelisted
7076
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
3952
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
3952
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1232
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7048
RobloxPlayerInstaller.exe
128.116.5.3:443
client-telemetry.roblox.com
ROBLOX-PRODUCTION
US
whitelisted
7048
RobloxPlayerInstaller.exe
23.201.250.50:443
clientsettingscdn.roblox.com
AKAMAI-AS
CH
whitelisted
7048
RobloxPlayerInstaller.exe
2.19.11.108:443
setup.rbxcdn.com
Elisa Oyj
NL
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
  • 4.231.128.59
  • 20.73.194.208
whitelisted
google.com
  • 142.250.186.174
whitelisted
client-telemetry.roblox.com
  • 128.116.5.3
whitelisted
ecsv2.roblox.com
  • 128.116.5.3
whitelisted
clientsettingscdn.roblox.com
  • 23.201.250.50
whitelisted
setup.rbxcdn.com
  • 2.19.11.108
  • 2.19.11.100
whitelisted
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.106
  • 2.16.164.9
  • 2.16.164.72
  • 2.16.164.120
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 23.35.229.160
whitelisted
login.live.com
  • 20.190.160.64
  • 20.190.160.66
  • 20.190.160.65
  • 20.190.160.131
  • 20.190.160.20
  • 20.190.160.22
  • 40.126.32.133
  • 20.190.160.128
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted

Threats

PID
Process
Class
Message
6676
svchost.exe
Misc activity
ET INFO Packed Executable Download
Process
Message
RobloxPlayerInstaller.exe
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
RobloxPlayerInstaller.exe