File name:

RobloxPlayerInstaller.exe

Full analysis: https://app.any.run/tasks/83a98114-9aac-4d0f-9977-a9e7842d5574
Verdict: Malicious activity
Analysis date: March 02, 2025, 13:08:05
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
roblox
arch-scr
arch-doc
arch-exec
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

443DF84258F3CC21EFB5AD185ED2FE4F

SHA1:

22DC3B0C04FF55DCA5A93856A1FF30CEA6E5E7E8

SHA256:

B982252FEF5780CA193D07FB2754F721EF7869C2D583A09217B8D3C1E6D2EF49

SSDEEP:

98304:PZs09sCy58FuGFXB5vJ3nd4t9uRcdd1kuhY8JeJaf5YAjcWaQAjn+sRXD3R/pVEM:7R8RVRUKTxM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • MicrosoftEdgeUpdate.exe (PID: 3008)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • RobloxPlayerInstaller.exe (PID: 5544)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1040)
      • MicrosoftEdgeUpdate.exe (PID: 3008)

    • Process drops legitimate windows executable

      • RobloxPlayerInstaller.exe (PID: 5544)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1040)
      • MicrosoftEdgeUpdate.exe (PID: 3008)

    • Changes default file association

      • RobloxPlayerInstaller.exe (PID: 5544)

    • The process drops C-runtime libraries

      • RobloxPlayerInstaller.exe (PID: 5544)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeUpdate.exe (PID: 3008)

    • Starts itself from another location

      • MicrosoftEdgeUpdate.exe (PID: 3008)

    • Creates/Modifies COM task schedule object

      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 736)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 4868)
      • MicrosoftEdgeUpdate.exe (PID: 7516)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6268)

    • Reads security settings of Internet Explorer

      • MicrosoftEdgeUpdate.exe (PID: 3008)
      • ShellExperienceHost.exe (PID: 8028)

  • INFO

    • The sample compiled with english language support

      • RobloxPlayerInstaller.exe (PID: 5544)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1040)
      • MicrosoftEdgeUpdate.exe (PID: 3008)

    • ROBLOX mutex has been found

      • RobloxPlayerInstaller.exe (PID: 5544)

    • Reads the computer name

      • RobloxPlayerInstaller.exe (PID: 5544)
      • MicrosoftEdgeUpdate.exe (PID: 3008)
      • MicrosoftEdgeUpdate.exe (PID: 7516)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6268)
      • MicrosoftEdgeUpdate.exe (PID: 5576)
      • MicrosoftEdgeUpdate.exe (PID: 7616)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 4868)
      • ShellExperienceHost.exe (PID: 8028)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 736)
      • MicrosoftEdgeUpdate.exe (PID: 7448)

    • Process checks whether UAC notifications are on

      • RobloxPlayerInstaller.exe (PID: 5544)

    • Creates files or folders in the user directory

      • RobloxPlayerInstaller.exe (PID: 5544)
      • BackgroundTransferHost.exe (PID: 7668)
      • MicrosoftEdgeUpdate.exe (PID: 3008)

    • Reads the machine GUID from the registry

      • RobloxPlayerInstaller.exe (PID: 5544)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 7440)
      • BackgroundTransferHost.exe (PID: 7668)
      • BackgroundTransferHost.exe (PID: 8056)
      • BackgroundTransferHost.exe (PID: 7836)
      • BackgroundTransferHost.exe (PID: 7176)

    • Create files in a temporary directory

      • RobloxPlayerInstaller.exe (PID: 5544)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1040)
      • MicrosoftEdgeUpdate.exe (PID: 3008)

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 7668)
      • MicrosoftEdgeUpdate.exe (PID: 5576)
      • MicrosoftEdgeUpdate.exe (PID: 7448)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 7668)
      • MicrosoftEdgeUpdate.exe (PID: 5576)
      • MicrosoftEdgeUpdate.exe (PID: 7448)

    • Checks supported languages

      • RobloxPlayerInstaller.exe (PID: 5544)
      • MicrosoftEdgeUpdate.exe (PID: 3008)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 736)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1040)
      • MicrosoftEdgeUpdate.exe (PID: 7516)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6268)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 4868)
      • MicrosoftEdgeUpdate.exe (PID: 7616)
      • MicrosoftEdgeUpdate.exe (PID: 5576)
      • MicrosoftEdgeUpdate.exe (PID: 7448)
      • ShellExperienceHost.exe (PID: 8028)

    • Process checks computer location settings

      • MicrosoftEdgeUpdate.exe (PID: 3008)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1989:03:09 12:13:03+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14.29
CodeSize: 4830208
InitializedDataSize: 2926592
UninitializedDataSize: -
EntryPoint: 0x438b45
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.6.1.1404
ProductVersionNumber: 1.6.1.1404
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Roblox Corporation
FileDescription: Roblox
FileVersion: 1, 6, 1, 6620540
LegalCopyright: Copyright © 2020 Roblox Corporation. All rights reserved.
OriginalFileName: Roblox.exe
ProductName: Roblox Bootstrapper
ProductVersion: 1, 6, 1, 6620540
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
152
Monitored processes
18
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start robloxplayerinstaller.exe sppextcomobj.exe no specs slui.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs microsoftedgewebview2setup.exe microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdate.exe shellexperiencehost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
736"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe" /user C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update COM Registration Helper
Exit code:
0
Version:
1.3.171.39
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\1.3.171.39\microsoftedgeupdatecomregistershell64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
812"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1040MicrosoftEdgeWebview2Setup.exe /silent /installC:\Users\admin\AppData\Local\Roblox\Versions\version-67acd0f240534e7b\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
RobloxPlayerInstaller.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update Setup
Version:
1.3.171.39
Modules
Images
c:\users\admin\appdata\local\roblox\versions\version-67acd0f240534e7b\webview2runtimeinstaller\microsoftedgewebview2setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
3008C:\Users\admin\AppData\Local\Temp\EU686B.tmp\MicrosoftEdgeUpdate.exe /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"C:\Users\admin\AppData\Local\Temp\EU686B.tmp\MicrosoftEdgeUpdate.exe
MicrosoftEdgeWebview2Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Version:
1.3.171.39
Modules
Images
c:\users\admin\appdata\local\temp\eu686b.tmp\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
4868"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe" /user C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update COM Registration Helper
Exit code:
0
Version:
1.3.171.39
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\1.3.171.39\microsoftedgeupdatecomregistershell64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
5544"C:\Users\admin\AppData\Local\Temp\RobloxPlayerInstaller.exe" C:\Users\admin\AppData\Local\Temp\RobloxPlayerInstaller.exe
explorer.exe
User:
admin
Company:
Roblox Corporation
Integrity Level:
MEDIUM
Description:
Roblox
Version:
1, 6, 1, 6620540
Modules
Images
c:\users\admin\appdata\local\temp\robloxplayerinstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
5576"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMCIgc2Vzc2lvbmlkPSJ7ODQyRDRCRTYtQjJBMS00QTQyLUE2NzMtODlENDJGN0M1NDU3fSIgdXNlcmlkPSJ7MzE1Qjc4NTAtOUM2Ri00MTIxLUJDOTAtNDg0NDMzMDk5MEY4fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins0NDdDQTQyMy0yMzlCLTQ3NzktQTU1MS1GNTE3N0QwNzMxODF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iNCIgcGh5c21lbW9yeT0iNCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQ1LjQwNDYiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREVMTCIgcHJvZHVjdF9uYW1lPSJERUxMIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjE3MS4zOSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTAxMTg3MjA3NTkiIGluc3RhbGxfdGltZV9tcz0iNjUyIi8-PC9hcHA-PC9yZXF1ZXN0PgC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.171.39
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
6268"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe" /user C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update COM Registration Helper
Exit code:
0
Version:
1.3.171.39
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\1.3.171.39\microsoftedgeupdatecomregistershell64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
6972C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7176"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
Total events
6 326
Read events
5 867
Write events
425
Delete events
34

Modification events

(PID) Process:(5544) RobloxPlayerInstaller.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio
Operation:writeName:WarnOnOpen
Value:
0
(PID) Process:(5544) RobloxPlayerInstaller.exeKey:HKEY_CLASSES_ROOT\roblox-studio
Operation:writeName:URL Protocol
Value:
(PID) Process:(5544) RobloxPlayerInstaller.exeKey:HKEY_CLASSES_ROOT\roblox-studio\shell\open\command
Operation:writeName:version
Value:
version-788254424be94b4c
(PID) Process:(7440) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7440) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7440) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7668) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7668) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7668) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7836) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
206
Suspicious files
36
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
7668BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\64308e71-5b71-44ee-9525-d8f4a372df4a.down_data —
MD5:—
SHA256:—
5544RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\logs\cacert.pemtext
MD5:6CED45AE0FCB6620235271F2C6F41411
SHA256:AD64CF840A0FCE7924AC5F8A4F6900BFE73709A5A61031404A213AB563C286D8
5544RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\Downloads\roblox-player\da4cce5d00e5e58d2f066faced2004e9compressed
MD5:DA4CCE5D00E5E58D2F066FACED2004E9
SHA256:C88B245F455F4F92C327BE1AB1C58727744A06AF1C7F7BBFB79DE2BEE525BDC1
5544RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\Versions\version-67acd0f240534e7b\RobloxPlayerLauncher.exeexecutable
MD5:5113023B587B0781D0BFA6B0B72F34A3
SHA256:626526921BDD420FBFDA26B901B0889B21BF6DDCFDAF5F38B740F773E7D89CDD
5544RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Temp\Roblox\http\RBXEB60377A8BB948ABB6AEA1CD67CC297Fbinary
MD5:6391FFBD250EEF711B3FB57CC63A1962
SHA256:3BC217A1E46D14C6B483624924A7654B71239761D2B3E4A5CE64D52348A987E1
5544RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\Downloads\roblox-player\e36666cfbf50b0e9ad5b8a45f663e769compressed
MD5:E36666CFBF50B0E9AD5B8A45F663E769
SHA256:6BE687C093EFD6A8A756EA0BE08CD3E626DE707D71184F40B1462CCC536E745C
5544RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Temp\Roblox\http\8913724486d5e3c463c493b25346ca31binary
MD5:6391FFBD250EEF711B3FB57CC63A1962
SHA256:3BC217A1E46D14C6B483624924A7654B71239761D2B3E4A5CE64D52348A987E1
7668BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:CA6173FC5E87CAB1BEF55DAC3B19CB8F
SHA256:2784FA484E6E373A9A1451396BA9BF7E52CB1D3208E446A62EE6FC9E9D3D73D1
5544RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\Downloads\roblox-player\1d0390337d1a4a58e5514be1a9481ad6compressed
MD5:1D0390337D1A4A58E5514BE1A9481AD6
SHA256:C79F0EEB2BCA4905C585C50333DB3C6F727A554F5DB82E64948F93668FBC18AA
7668BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\64308e71-5b71-44ee-9525-d8f4a372df4a.c2030a9f-ec0d-40c7-ae95-871322f522f8.down_metabinary
MD5:F775CB57F6E0B5BFD4E6579DF463C8FF
SHA256:DECCA02B73A638EBFA4A6B1D432AD274B90B79AD777713EBA4C9D521A3D0FD3C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
30
DNS requests
19
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7668
BackgroundTransferHost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
7356
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1052
svchost.exe
HEAD
200
23.216.77.143:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fa030cdf-1071-4d66-8ab2-3568143af7b9?P1=1741525741&P2=404&P3=2&P4=a5DqU7x8NiOmRp%2bQsB15TIL66pYxkncfdCALEula6BFGSK1FV3qFpH9xtq7ggJF1jRxNcT82wmFy1BeDwyMXsQ%3d%3d
unknown
—
—
whitelisted
1052
svchost.exe
GET
—
23.216.77.143:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fa030cdf-1071-4d66-8ab2-3568143af7b9?P1=1741525741&P2=404&P3=2&P4=a5DqU7x8NiOmRp%2bQsB15TIL66pYxkncfdCALEula6BFGSK1FV3qFpH9xtq7ggJF1jRxNcT82wmFy1BeDwyMXsQ%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5544
RobloxPlayerInstaller.exe
128.116.44.4:443
ecsv2.roblox.com
ROBLOX-PRODUCTION
US
whitelisted
5544
RobloxPlayerInstaller.exe
52.222.236.86:443
clientsettingscdn.roblox.com
AMAZON-02
US
whitelisted
5544
RobloxPlayerInstaller.exe
13.32.27.35:443
setup.rbxcdn.com
AMAZON-02
US
whitelisted
6544
svchost.exe
40.126.31.130:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2112
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
whitelisted
google.com
  • 142.250.184.206
whitelisted
ecsv2.roblox.com
  • 128.116.44.4
whitelisted
clientsettingscdn.roblox.com
  • 52.222.236.86
  • 52.222.236.6
  • 52.222.236.113
  • 52.222.236.43
whitelisted
setup.rbxcdn.com
  • 13.32.27.35
  • 13.32.27.4
  • 13.32.27.39
  • 13.32.27.22
whitelisted
login.live.com
  • 40.126.31.130
  • 20.190.159.0
  • 20.190.159.68
  • 40.126.31.1
  • 20.190.159.128
  • 40.126.31.73
  • 20.190.159.131
  • 20.190.159.129
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
arc.msn.com
  • 20.31.169.57
whitelisted
www.bing.com
  • 104.126.37.128
  • 104.126.37.155
  • 104.126.37.131
  • 104.126.37.123
  • 104.126.37.161
  • 104.126.37.185
  • 104.126.37.171
  • 104.126.37.177
  • 104.126.37.184
whitelisted
ocsp.digicert.com
  • 23.54.109.203
whitelisted

Threats

PID
Process
Class
Message
1052
svchost.exe
Misc activity
ET INFO Packed Executable Download
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
RobloxPlayerInstaller.exe