URL:

https://d48ehdag0go01.cloudfront.net/P2mk/lAeoCEkXj/KhLylBl/robloxplayer-1.6.0.5520592-installer.exe

Full analysis: https://app.any.run/tasks/0d9df2f7-595d-4944-9b90-2a6793caf4d7
Verdict: Malicious activity
Analysis date: September 21, 2024, 10:53:22
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
netreactor
susp-powershell
Indicators:
MD5:

9D3189D96D171173B82493528ED05F63

SHA1:

6245DB72DA5115A359D33908033D2591BAFED99C

SHA256:

F4D163F96003543C47307C421CCACD565AFB2F91E4998444A3423B5EF585A313

SSDEEP:

3:N8JLFiIl/0u2JLtHaEM0jJgLVnwXLNn:2MTbtjsVnwXLN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • robloxplayer-1.6.0.5520592-installer_fQqpd-1.exe (PID: 3924)
      • robloxplayer-1.6.0.5520592-installer_fQqpd-1.tmp (PID: 5388)
      • 43hc2twb.exe (PID: 7548)
      • robloxplayer-1.6.0.5520592-installer.exe (PID: 3768)
      • robloxplayer-1.6.0.5520592-installer_fQqpd-1.exe (PID: 5000)
      • component0.exe (PID: 1640)
      • UnifiedStub-installer.exe (PID: 7592)
      • RobloxPlayerLauncher.exe (PID: 6008)
      • rsEngineSvc.exe (PID: 7416)
      • MicrosoftEdgeWebview2Setup.exe (PID: 3696)
      • RobloxPlayerBeta.exe (PID: 8072)

    • Process drops legitimate windows executable

      • 43hc2twb.exe (PID: 7548)
      • UnifiedStub-installer.exe (PID: 7592)
      • rsEngineSvc.exe (PID: 7416)
      • RobloxPlayerLauncher.exe (PID: 6008)
      • MicrosoftEdgeWebview2Setup.exe (PID: 3696)
      • MicrosoftEdgeUpdate.exe (PID: 6584)

    • Application launched itself

      • robloxplayer-1.6.0.5520592-installer.exe (PID: 3768)
      • RobloxPlayerLauncher.exe (PID: 6008)
      • rsAppUI.exe (PID: 7216)

    • Executes as Windows Service

      • rsSyncSvc.exe (PID: 7876)
      • rsEngineSvc.exe (PID: 7416)
      • rsWSC.exe (PID: 7636)
      • rsClientSvc.exe (PID: 7284)
      • WmiApSrv.exe (PID: 4104)
      • rsEDRSvc.exe (PID: 2016)

    • Drops 7-zip archiver for unpacking

      • UnifiedStub-installer.exe (PID: 7592)

    • Executes application which crashes

      • robloxplayer-1.6.0.5520592-installer_fQqpd-1.tmp (PID: 5388)

    • The process drops C-runtime libraries

      • UnifiedStub-installer.exe (PID: 7592)

    • Drops a system driver (possible attempt to evade defenses)

      • UnifiedStub-installer.exe (PID: 7592)

    • Uses RUNDLL32.EXE to load library

      • UnifiedStub-installer.exe (PID: 7592)

    • Uses WEVTUTIL.EXE to install publishers and event logs from the manifest

      • UnifiedStub-installer.exe (PID: 7592)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeUpdate.exe (PID: 6584)

    • There is functionality for taking screenshot (YARA)

      • rsHelper.exe (PID: 8084)

  • INFO

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 4060)
      • chrome.exe (PID: 6528)

    • The process uses the downloaded file

      • chrome.exe (PID: 7184)

    • .NET Reactor protector has been detected

      • UnifiedStub-installer.exe (PID: 7592)
      • rsWSC.exe (PID: 7636)
      • rsEDRSvc.exe (PID: 2016)
      • rsEngineSvc.exe (PID: 7416)
      • rsHelper.exe (PID: 8084)

    • Application launched itself

      • chrome.exe (PID: 4060)

    • Found Base64 encoded access to Windows Defender via PowerShell (YARA)

      • rsEngineSvc.exe (PID: 7416)

    • Found Base64 encoded text manipulation via PowerShell (YARA)

      • rsEngineSvc.exe (PID: 7416)

    • Manual execution by a user

      • RobloxPlayerBeta.exe (PID: 8072)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
219
Monitored processes
74
Malicious processes
9
Suspicious processes
2

Behavior graph

Click at the process to see the details
start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs sppextcomobj.exe no specs slui.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs robloxplayer-1.6.0.5520592-installer_fqqpd-1.exe slui.exe robloxplayer-1.6.0.5520592-installer_fqqpd-1.tmp no specs robloxplayer-1.6.0.5520592-installer_fqqpd-1.exe robloxplayer-1.6.0.5520592-installer_fqqpd-1.tmp chrome.exe no specs component0.exe 43hc2twb.exe robloxplayer-1.6.0.5520592-installer.exe THREAT unifiedstub-installer.exe robloxplayer-1.6.0.5520592-installer.exe rssyncsvc.exe no specs conhost.exe no specs rssyncsvc.exe no specs werfault.exe werfault.exe robloxplayerlauncher.exe robloxplayerlauncher.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe rundll32.exe no specs runonce.exe no specs grpconv.exe no specs wevtutil.exe no specs conhost.exe no specs fltmc.exe no specs conhost.exe no specs wevtutil.exe no specs conhost.exe no specs rswsc.exe no specs THREAT rswsc.exe no specs rsclientsvc.exe no specs conhost.exe no specs rsclientsvc.exe no specs rsenginesvc.exe no specs THREAT rsenginesvc.exe rsedrsvc.exe no specs THREAT rsedrsvc.exe no specs THREAT rshelper.exe no specs epp.exe no specs rsappui.exe no specs wmiapsrv.exe no specs rsappui.exe no specs rsappui.exe no specs rsappui.exe no specs rslitmus.a.exe no specs conhost.exe no specs chrome.exe no specs rsappui.exe no specs microsoftedgewebview2setup.exe microsoftedgeupdate.exe no specs wermgr.exe no specs robloxplayerbeta.exe robloxcrashhandler.exe no specs gamebarpresencewriter.exe no specs gamebar.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
360\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—fltMC.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
736"C:\Program Files (x86)\Roblox\Versions\version-43ad1853ad91427d\\RobloxCrashHandler.exe" --no-rate-limit --crashCounter Win-ROBLOXPlayer-Crash --baseUrl http://www.roblox.com/ --attachment=attachment_0.642.0.6420636_20240921T105813Z_Player_2AC57_last.log=C:\Users\admin\AppData\Local\Roblox\logs\0.642.0.6420636_20240921T105813Z_Player_2AC57_last.log --database=C:\Users\admin\AppData\Local\Roblox\logs\crashes --metrics-dir=C:\Users\admin\AppData\Local\Roblox\logs\crashes --url=https://upload.crashes.rbxinfra.com/post?format=minidump --annotation=AppVersion=0.642.0.6420636 --annotation=BaseUrl=http://www.roblox.com/ "--annotation=CPUMake=Intel(R) Core(TM) i5-6400 CPU @ 2.70GHz" --annotation=Format=minidump --annotation=OSPlatform=Win32 "--annotation=OSVersion=Windows 10 - PlatformId 2, Version 10.0, Build 19045" --annotation=PlatformId=2 --annotation=RobloxChannel=production --annotation=RobloxGitHash=fb5071aa25c087808982b03a639e8c461b22c7f7 --annotation=RobloxProduct=RobloxPlayer --annotation=TotalMemory=4289146880 --annotation=UniqueId=9049497548589805762 --annotation=UploadAttachmentKiloByteLimit=1000 --annotation=UseCrashpad=True --initial-client-data=0x924,0x908,0x974,0x89c,0x9d8,0x7ff619972408,0x7ff619972420,0x7ff619972438C:\Program Files (x86)\Roblox\Versions\version-43ad1853ad91427d\RobloxCrashHandler.exe—RobloxPlayerBeta.exe
User:
admin
Integrity Level:
MEDIUM
788"C:\program files\reasonlabs\epp\rsLitmus.A.exe" C:\Program Files\ReasonLabs\EPP\rsLitmus.A.exe—rsEngineSvc.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
54321
892"C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -i -bn:ReasonLabs -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -dt:10C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe—UnifiedStub-installer.exe
User:
admin
Company:
Reason Software Company Inc.
Integrity Level:
HIGH
Description:
Reason Security Synchronize Service
Exit code:
0
Version:
1.8.5.0
Modules
Images
c:\program files\reasonlabs\common\rssyncsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\version.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1108"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgABAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1980 --field-trial-handle=1984,i,558187569772804331,6309693715902873500,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1236"C:\WINDOWS\system32\wevtutil.exe" im C:\Program Files\ReasonLabs\EPP\x64\elam\evntdrv.xmlC:\Windows\System32\wevtutil.exe—UnifiedStub-installer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Eventing Command Line Utility
Exit code:
87
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wevtutil.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\combase.dll
1640"C:\Users\admin\AppData\Local\Temp\is-7A9T9.tmp\component0.exe" -ip:"dui=bb926e54-e3ca-40fd-ae90-2764341e7792&dit=20240921105446&is_silent=true&oc=ZB_RAV_Cross_Solo_Soft&p=fa70&a=100&b=&se=true" -iC:\Users\admin\AppData\Local\Temp\is-7A9T9.tmp\component0.exe
robloxplayer-1.6.0.5520592-installer_fQqpd-1.tmp
User:
admin
Company:
Reason Software Company Inc.
Integrity Level:
HIGH
Description:
rsStubActivator
Exit code:
0
Version:
1.6.1.0
Modules
Images
c:\users\admin\appdata\local\temp\is-7a9t9.tmp\component0.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1744"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=6024 --field-trial-handle=1984,i,558187569772804331,6309693715902873500,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1848C:\WINDOWS\SysWOW64\WerFault.exe -u -p 5388 -s 2324C:\Windows\SysWOW64\WerFault.exe
robloxplayer-1.6.0.5520592-installer_fQqpd-1.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2016"C:\Program Files\ReasonLabs\EDR\rsEDRSvc.exe"C:\Program Files\ReasonLabs\EDR\rsEDRSvc.exe
services.exe
User:
SYSTEM
Company:
Reason Cybersecurity Ltd.
Integrity Level:
SYSTEM
Description:
Reason EDR Service
Version:
2.2.1
Total events
33 585
Read events
33 406
Write events
127
Delete events
52

Modification events

(PID) Process:(4060) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(4060) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(4060) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(4060) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(4060) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(7184) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Operation:writeName:{2781761E-28E0-4109-99FE-B9D127C57AFE} {56FFCC30-D398-11D0-B2AE-00A0C908FA49} 0xFFFF
Value:
0100000000000000BC022181140CDB01
(PID) Process:(1640) component0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\component0_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(1640) component0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\component0_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(1640) component0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\component0_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(1640) component0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\component0_RASAPI32
Operation:writeName:FileTracingMask
Value:
Executable files
743
Suspicious files
507
Text files
93
Unknown types
17

Dropped files

PID
Process
Filename
Type
4060chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF1fbfce.TMP —
MD5:—
SHA256:—
4060chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
4060chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
4060chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old —
MD5:—
SHA256:—
4060chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
4060chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old~RF1fbffd.TMP —
MD5:—
SHA256:—
4060chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old —
MD5:—
SHA256:—
4060chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
4060chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datbinary
MD5:FC81892AC822DCBB09441D3B58B47125
SHA256:FB077C966296D02D50CCBF7F761D2A3311A206A784A7496F331C2B0D6AD205C8
4060chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RF1fbfde.TMPtext
MD5:139F545948FC1F10256A27E3C2CEF062
SHA256:9399CC6F9C335015E086DB37208B1816A7831221A005B04AC83C4F86CC04230D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
89
TCP/UDP connections
152
DNS requests
92
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3812
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2120
MoUsoCoreWorker.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
8168
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
8168
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
3880
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkihinmdlkakkaopbjbbcngflc_120.0.6050.0_all_dgzfpknn7v3zslsbhrwu6bt44e.crx3
unknown
—
—
whitelisted
3880
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkihinmdlkakkaopbjbbcngflc_120.0.6050.0_all_dgzfpknn7v3zslsbhrwu6bt44e.crx3
unknown
—
—
whitelisted
3880
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkihinmdlkakkaopbjbbcngflc_120.0.6050.0_all_dgzfpknn7v3zslsbhrwu6bt44e.crx3
unknown
—
—
whitelisted
3880
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkihinmdlkakkaopbjbbcngflc_120.0.6050.0_all_dgzfpknn7v3zslsbhrwu6bt44e.crx3
unknown
—
—
whitelisted
4060
chrome.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D
unknown
—
—
whitelisted
4060
chrome.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5900
svchost.exe
52.137.106.217:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
—
—
52.168.117.168:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
—
—
2.16.110.171:443
—
Akamai International B.V.
DE
unknown
2452
RUXIMICS.exe
52.137.106.217:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
52.137.106.217:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2120
MoUsoCoreWorker.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2120
MoUsoCoreWorker.exe
52.137.106.217:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7136
chrome.exe
18.172.111.76:443
d48ehdag0go01.cloudfront.net
—
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 52.137.106.217
  • 20.44.239.154
  • 51.104.136.2
whitelisted
google.com
  • 216.58.212.142
whitelisted
www.microsoft.com
  • 88.221.169.152
  • 23.52.120.96
  • 184.30.21.171
whitelisted
d48ehdag0go01.cloudfront.net
  • 18.172.111.76
  • 18.172.111.73
  • 18.172.111.205
  • 18.172.111.224
whitelisted
accounts.google.com
  • 64.233.184.84
whitelisted
login.live.com
  • 40.126.32.74
  • 20.190.160.14
  • 40.126.32.76
  • 40.126.32.133
  • 40.126.32.140
  • 20.190.160.17
  • 20.190.160.20
  • 20.190.160.22
  • 40.126.32.72
  • 40.126.32.68
  • 40.126.32.136
  • 40.126.32.134
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
sb-ssl.google.com
  • 216.58.206.78
whitelisted
www.google.com
  • 172.217.18.100
  • 142.250.186.68
whitelisted
browser.pipe.aria.microsoft.com
  • 20.189.173.13
  • 20.42.65.94
  • 20.189.173.17
whitelisted

Threats

No threats detected
Process
Message
RobloxPlayerLauncher.exe
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://d48ehdag0go01.cloudfront.net/P2mk/lAeoCEkXj/KhLylBl/robloxplayer-1.6.0.5520592-installer.exe