File name:

RobloxPlayerInstaller.exe

Full analysis: https://app.any.run/tasks/0bdb9a39-0380-44fe-8e8e-87e3ee8aa3b8
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: January 16, 2025, 09:17:35
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-doc
arch-exec
loader
arch-scr
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

F16AC9B02B4726B444B383D76DB1AE18

SHA1:

7388C264874447D1DED6B6ACAA35D26144D023A9

SHA256:

F59C4ACEC3CD952C3AB981D56E1E68F543AD8684A3B44C6B59B70FBABC2B5FF0

SSDEEP:

98304:+Us0iPR6U4ikLOSOurX8BG16QneRd3rGG2Irw8KvXMr1rnG1jmMk6J1F+7PNv7d1:Nv+nXn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • MicrosoftEdgeUpdate.exe (PID: 3780)

    • Scans artifacts that could help determine the target

      • msedgewebview2.exe (PID: 6600)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • RobloxPlayerInstaller.exe (PID: 6360)
      • MicrosoftEdgeWebview2Setup.exe (PID: 6288)
      • MicrosoftEdgeUpdate.exe (PID: 3780)
      • MicrosoftEdge_X64_131.0.2903.146.exe (PID: 6676)
      • RobloxStudioInstaller.exe (PID: 6016)
      • setup.exe (PID: 5112)
      • RobloxStudioInstaller.exe (PID: 3552)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1512)
      • MicrosoftEdge_X64_131.0.2903.146.exe (PID: 7052)

    • Changes default file association

      • RobloxPlayerInstaller.exe (PID: 6360)
      • RobloxStudioInstaller.exe (PID: 3552)

    • Process drops legitimate windows executable

      • RobloxPlayerInstaller.exe (PID: 6360)
      • MicrosoftEdgeWebview2Setup.exe (PID: 6288)
      • MicrosoftEdgeUpdate.exe (PID: 3780)
      • MicrosoftEdge_X64_131.0.2903.146.exe (PID: 6676)
      • RobloxStudioInstaller.exe (PID: 3552)
      • setup.exe (PID: 5112)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1512)
      • MicrosoftEdge_X64_131.0.2903.146.exe (PID: 7052)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeUpdate.exe (PID: 3780)
      • MicrosoftEdgeUpdate.exe (PID: 6324)

    • The process drops C-runtime libraries

      • RobloxPlayerInstaller.exe (PID: 6360)
      • RobloxStudioInstaller.exe (PID: 3552)

    • Creates/Modifies COM task schedule object

      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6188)
      • MicrosoftEdgeUpdate.exe (PID: 5200)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 4504)

    • Starts itself from another location

      • MicrosoftEdgeUpdate.exe (PID: 3780)
      • RobloxStudioInstaller.exe (PID: 6016)
      • MicrosoftEdgeUpdate.exe (PID: 6324)

    • Reads security settings of Internet Explorer

      • MicrosoftEdgeUpdate.exe (PID: 3780)
      • MicrosoftEdgeUpdate.exe (PID: 2396)

    • Potential Corporate Privacy Violation

      • svchost.exe (PID: 5892)

    • Checks Windows Trust Settings

      • MicrosoftEdgeUpdate.exe (PID: 2396)

    • Application launched itself

      • setup.exe (PID: 5112)
      • MicrosoftEdgeUpdate.exe (PID: 2396)
      • setup.exe (PID: 2152)
      • MicrosoftEdgeUpdate.exe (PID: 4132)
      • msedgewebview2.exe (PID: 6600)

    • Searches for installed software

      • setup.exe (PID: 2152)

    • Creates a software uninstall entry

      • setup.exe (PID: 2152)
      • RobloxStudioInstaller.exe (PID: 3552)

  • INFO

    • Reads the computer name

      • RobloxPlayerInstaller.exe (PID: 6360)
      • MicrosoftEdgeUpdate.exe (PID: 5200)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 4504)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 628)
      • MicrosoftEdgeUpdate.exe (PID: 5652)
      • MicrosoftEdge_X64_131.0.2903.146.exe (PID: 6676)
      • RobloxStudioInstaller.exe (PID: 6016)
      • setup.exe (PID: 5112)
      • MicrosoftEdgeUpdate.exe (PID: 5400)
      • setup.exe (PID: 2152)
      • identity_helper.exe (PID: 7888)

    • Process checks whether UAC notifications are on

      • RobloxPlayerInstaller.exe (PID: 6360)

    • Sends debugging messages

      • RobloxPlayerInstaller.exe (PID: 6360)
      • RobloxStudioInstaller.exe (PID: 3552)
      • RobloxStudioBeta.exe (PID: 6804)
      • msedgewebview2.exe (PID: 6600)

    • The sample compiled with english language support

      • RobloxPlayerInstaller.exe (PID: 6360)
      • MicrosoftEdgeUpdate.exe (PID: 3780)
      • MicrosoftEdgeWebview2Setup.exe (PID: 6288)
      • svchost.exe (PID: 5892)
      • RobloxStudioInstaller.exe (PID: 6016)
      • MicrosoftEdge_X64_131.0.2903.146.exe (PID: 6676)
      • setup.exe (PID: 5112)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1512)
      • RobloxStudioInstaller.exe (PID: 3552)
      • MicrosoftEdge_X64_131.0.2903.146.exe (PID: 7052)

    • Reads the machine GUID from the registry

      • RobloxPlayerInstaller.exe (PID: 6360)
      • MicrosoftEdgeUpdate.exe (PID: 2396)
      • RobloxStudioInstaller.exe (PID: 3552)
      • RobloxStudioBeta.exe (PID: 6804)
      • msedgewebview2.exe (PID: 6600)

    • Creates files or folders in the user directory

      • RobloxPlayerInstaller.exe (PID: 6360)
      • MicrosoftEdgeUpdate.exe (PID: 3780)
      • MicrosoftEdge_X64_131.0.2903.146.exe (PID: 6676)
      • MicrosoftEdgeUpdate.exe (PID: 2396)
      • RobloxStudioInstaller.exe (PID: 6016)
      • setup.exe (PID: 4684)
      • setup.exe (PID: 5112)
      • RobloxStudioInstaller.exe (PID: 3552)
      • MicrosoftEdgeUpdate.exe (PID: 4132)

    • Checks supported languages

      • RobloxPlayerInstaller.exe (PID: 6360)
      • MicrosoftEdgeWebview2Setup.exe (PID: 6288)
      • MicrosoftEdgeUpdate.exe (PID: 5200)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 628)
      • MicrosoftEdgeUpdate.exe (PID: 6236)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 4504)
      • MicrosoftEdge_X64_131.0.2903.146.exe (PID: 6676)
      • MicrosoftEdgeUpdate.exe (PID: 3780)
      • MicrosoftEdgeUpdate.exe (PID: 5652)
      • RobloxStudioInstaller.exe (PID: 6016)
      • RobloxStudioInstaller.exe (PID: 3552)
      • setup.exe (PID: 5112)
      • MicrosoftEdgeUpdate.exe (PID: 5400)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1512)
      • MicrosoftEdgeUpdate.exe (PID: 6324)
      • MicrosoftEdgeUpdate.exe (PID: 4132)
      • MicrosoftEdgeUpdate.exe (PID: 2624)
      • setup.exe (PID: 2844)
      • setup.exe (PID: 2152)
      • msedgewebview2.exe (PID: 3920)
      • msedgewebview2.exe (PID: 6864)
      • MicrosoftEdgeUpdate.exe (PID: 3828)
      • msedgewebview2.exe (PID: 1448)

    • Create files in a temporary directory

      • MicrosoftEdgeWebview2Setup.exe (PID: 6288)
      • RobloxPlayerInstaller.exe (PID: 6360)
      • svchost.exe (PID: 5892)
      • RobloxStudioInstaller.exe (PID: 6016)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1512)
      • RobloxStudioInstaller.exe (PID: 3552)

    • Reads Environment values

      • MicrosoftEdgeUpdate.exe (PID: 6236)
      • MicrosoftEdgeUpdate.exe (PID: 4228)
      • identity_helper.exe (PID: 7888)

    • Checks proxy server information

      • MicrosoftEdgeUpdate.exe (PID: 6236)
      • MicrosoftEdgeUpdate.exe (PID: 2396)
      • MicrosoftEdgeUpdate.exe (PID: 4132)
      • msedgewebview2.exe (PID: 6600)

    • Reads the software policy settings

      • MicrosoftEdgeUpdate.exe (PID: 6236)
      • MicrosoftEdgeUpdate.exe (PID: 2396)

    • Process checks computer location settings

      • MicrosoftEdgeUpdate.exe (PID: 3780)
      • setup.exe (PID: 5112)
      • MicrosoftEdgeUpdate.exe (PID: 6324)
      • msedgewebview2.exe (PID: 3920)
      • setup.exe (PID: 2152)

    • Manual execution by a user

      • RobloxStudioInstaller.exe (PID: 6016)

    • The process uses the downloaded file

      • RobloxStudioInstaller.exe (PID: 3552)

    • Application launched itself

      • msedge.exe (PID: 6796)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2032:05:07 09:46:53+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14.29
CodeSize: 3269632
InitializedDataSize: 1507840
UninitializedDataSize: -
EntryPoint: 0x2cda10
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.6.1.25686
ProductVersionNumber: 1.6.1.25686
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Roblox Corporation
FileDescription: Roblox
FileVersion: 1, 6, 1, 6120534
LegalCopyright: Copyright © 2020 Roblox Corporation. All rights reserved.
OriginalFileName: Roblox.exe
ProductName: Roblox Bootstrapper
ProductVersion: 1, 6, 1, 6120534
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
205
Monitored processes
70
Malicious processes
10
Suspicious processes
3

Behavior graph

Click at the process to see the details
start robloxplayerinstaller.exe microsoftedgewebview2setup.exe microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdate.exe svchost.exe microsoftedge_x64_131.0.2903.146.exe setup.exe setup.exe no specs robloxstudioinstaller.exe robloxstudioinstaller.exe microsoftedgeupdate.exe microsoftedgewebview2setup.exe microsoftedgeupdate.exe no specs microsoftedgeupdate.exe no specs microsoftedgeupdate.exe no specs microsoftedgeupdate.exe no specs microsoftedgeupdate.exe microsoftedge_x64_131.0.2903.146.exe setup.exe no specs setup.exe no specs microsoftedgeupdate.exe robloxstudiobeta.exe robloxcrashhandler.exe no specs gamebarpresencewriter.exe no specs gamebar.exe no specs msedgewebview2.exe no specs msedgewebview2.exe no specs msedgewebview2.exe no specs msedgewebview2.exe msedgewebview2.exe no specs msedgewebview2.exe no specs msedgewebview2.exe no specs msedgewebview2.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
628"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe" /user C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update COM Registration Helper
Exit code:
0
Version:
1.3.171.39
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\1.3.171.39\microsoftedgeupdatecomregistershell64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1448"C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\131.0.2903.146\msedgewebview2.exe" --type=gpu-process --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 656, 0, 6560679" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1796,i,10704247933059089553,2970509924507737394,262144 --variations-seed-version --mojo-platform-channel-handle=1820 /prefetch:2C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\131.0.2903.146\msedgewebview2.exe—msedgewebview2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge WebView2
Version:
131.0.2903.146
Modules
Images
c:\users\admin\appdata\local\microsoft\edgewebview\application\131.0.2903.146\msedgewebview2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\microsoft\edgewebview\application\131.0.2903.146\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1512MicrosoftEdgeWebview2Setup.exe /silent /installC:\Users\admin\AppData\Local\Roblox\Versions\version-343512800f264d5b\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
RobloxStudioInstaller.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update Setup
Exit code:
0
Version:
1.3.171.39
Modules
Images
c:\users\admin\appdata\local\roblox\versions\version-343512800f264d5b\webview2runtimeinstaller\microsoftedgewebview2setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2152"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{C258DCF2-BFED-4B2C-A5A4-57199C642432}\EDGEMITMP_21264.tmp\setup.exe" --install-archive="C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{C258DCF2-BFED-4B2C-A5A4-57199C642432}\MicrosoftEdge_X64_131.0.2903.146.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --user-levelC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{C258DCF2-BFED-4B2C-A5A4-57199C642432}\EDGEMITMP_21264.tmp\setup.exe—MicrosoftEdge_X64_131.0.2903.146.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Installer
Exit code:
0
Version:
131.0.2903.146
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\install\{c258dcf2-bfed-4b2c-a5a4-57199c642432}\edgemitmp_21264.tmp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
2212"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4356 --field-trial-handle=2348,i,10458556348499367614,9686936645105975534,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
2396"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" -EmbeddingC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.171.39
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
2548"C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\131.0.2903.146\msedgewebview2.exe" --type=renderer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 656, 0, 6560679" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3588,i,10704247933059089553,2970509924507737394,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\131.0.2903.146\msedgewebview2.exe—msedgewebview2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge WebView2
Exit code:
0
Version:
131.0.2903.146
2572"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.59 --initial-client-data=0x318,0x320,0x324,0x24c,0x32c,0x7ff81ac65fd8,0x7ff81ac65fe4,0x7ff81ac65ff0C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
2600C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\131.0.2903.146\msedgewebview2.exe --type=crashpad-handler --user-data-dir=C:\Users\admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=131.0.6778.265 --annotation=exe=C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\131.0.2903.146\msedgewebview2.exe --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=131.0.2903.146 --initial-client-data=0x1a0,0x1a4,0x1a8,0x17c,0x1b0,0x7ff81d6d6070,0x7ff81d6d607c,0x7ff81d6d6088C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\131.0.2903.146\msedgewebview2.exe—msedgewebview2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge WebView2
Version:
131.0.2903.146
Modules
Images
c:\users\admin\appdata\local\microsoft\edgewebview\application\131.0.2903.146\msedgewebview2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\microsoft\edgewebview\application\131.0.2903.146\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2624"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=false" /installsource otherinstallcmd /sessionid "{6F291189-4FF7-4BF5-BE5E-5F3A809B6B2F}" /silentC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.171.39
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
Total events
25 269
Read events
20 136
Write events
4 997
Delete events
136

Modification events

(PID) Process:(6360) RobloxPlayerInstaller.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio
Operation:writeName:WarnOnOpen
Value:
0
(PID) Process:(6360) RobloxPlayerInstaller.exeKey:HKEY_CLASSES_ROOT\roblox-studio
Operation:writeName:URL Protocol
Value:
(PID) Process:(6360) RobloxPlayerInstaller.exeKey:HKEY_CLASSES_ROOT\roblox-studio\shell\open\command
Operation:writeName:version
Value:
version-343512800f264d5b
(PID) Process:(3780) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate
Operation:delete valueName:eulaaccepted
Value:
(PID) Process:(3780) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate
Operation:writeName:path
Value:
C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
(PID) Process:(3780) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate
Operation:writeName:UninstallCmdLine
Value:
"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /uninstall
(PID) Process:(3780) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
Operation:writeName:pv
Value:
1.3.171.39
(PID) Process:(3780) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
Operation:writeName:name
Value:
Microsoft Edge Update
(PID) Process:(3780) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
Operation:writeName:pv
Value:
1.3.171.39
(PID) Process:(3780) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Microsoft Edge Update
Value:
"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateCore.exe"
Executable files
329
Suspicious files
565
Text files
76
Unknown types
2

Dropped files

PID
Process
Filename
Type
6360RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\Versions\RobloxStudioInstaller.exeexecutable
MD5:59424C76DCE707AE9BE1C22D3792615A
SHA256:56952F66488EB973DD8DD593068AE19699BD018ED67DBEFFE7A33EFEF4B0D1AA
6360RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\Downloads\roblox-player\8c4bde50e4b58a0c914b6b040d976113compressed
MD5:8C4BDE50E4B58A0C914B6B040D976113
SHA256:D7FFCF0F4579B2788080197D1E7767E73A928B2BB07B518B413110BBDCBD5497
6360RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Temp\Roblox\http\8913724486d5e3c463c493b25346ca31binary
MD5:10DF6437F81715ED338BF6DA1809A2D0
SHA256:1DCE2A92FB0AF810E141704955D642377F5925D1FA004FC4561504EFD9739ABC
6360RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\Downloads\roblox-player\1d0390337d1a4a58e5514be1a9481ad6compressed
MD5:1D0390337D1A4A58E5514BE1A9481AD6
SHA256:C79F0EEB2BCA4905C585C50333DB3C6F727A554F5DB82E64948F93668FBC18AA
6360RobloxPlayerInstaller.exeC:\Users\admin\Desktop\Roblox Studio.lnkbinary
MD5:3835BB267EC7C68DAC2448037A6692AB
SHA256:700ECDE3776037D04279C2B436FF4D39A6BF8B064682DA0BEF58155A1778F741
6360RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\Downloads\roblox-player\4f23103d6f2f80089fb6cbaf29008349compressed
MD5:4F23103D6F2F80089FB6CBAF29008349
SHA256:35F8FFADDC2F7E70317708DBDB2666D2364B348A9F01C28E69D442838168911F
6360RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\Downloads\roblox-player\32622161783a33a229827a2a0261cc16compressed
MD5:32622161783A33A229827A2A0261CC16
SHA256:631125E9AB228CCC5CA7CC723EABC683BAFA245F2E63B9FB23A55073DF017C12
6360RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\Downloads\roblox-player\671fb1a7b360b7f4281af5e52acc2c84compressed
MD5:671FB1A7B360B7F4281AF5E52ACC2C84
SHA256:B1A1E1E797E1C39277153B76DF1DAD2A8FE3EDD1419540C4FFFD3574A4485436
6360RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\Downloads\roblox-player\30c885074d0320c0932e06bfd537c915compressed
MD5:30C885074D0320C0932E06BFD537C915
SHA256:4C732976972BBEC8B2B0C579067F6AB4A143263637E6F9A6E2AA1FE7F9A68E7B
6360RobloxPlayerInstaller.exeC:\Users\admin\AppData\Local\Roblox\Downloads\roblox-player\2815d208091a89bbfc6116f4cba32216compressed
MD5:2815D208091A89BBFC6116F4CBA32216
SHA256:4D3CC9ED71D74994754043A15712042D7D961BF77CF6A0A9A4986D4D9540BC2F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
117
DNS requests
109
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
7120
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7120
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6728
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
5892
svchost.exe
HEAD
200
217.20.57.19:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/8f8ef676-acb3-4f15-a854-16344ca03e90?P1=1737623911&P2=404&P3=2&P4=DTn1ujGDPLf6omuIxG8Xc08OhFZjt5zx8MVd3qRZYajxGkl0Iz%2fgNcIsiDT5M3OK8955cJ6JeSsu8x2Ln9cgZg%3d%3d
unknown
—
—
whitelisted
5892
svchost.exe
GET
200
217.20.57.19:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/8f8ef676-acb3-4f15-a854-16344ca03e90?P1=1737623911&P2=404&P3=2&P4=DTn1ujGDPLf6omuIxG8Xc08OhFZjt5zx8MVd3qRZYajxGkl0Iz%2fgNcIsiDT5M3OK8955cJ6JeSsu8x2Ln9cgZg%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3032
RUXIMICS.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
5856
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
6360
RobloxPlayerInstaller.exe
128.116.21.3:443
client-telemetry.roblox.com
ROBLOX-PRODUCTION
US
whitelisted
6360
RobloxPlayerInstaller.exe
52.222.236.6:443
clientsettingscdn.roblox.com
AMAZON-02
US
whitelisted
6360
RobloxPlayerInstaller.exe
23.48.23.144:443
setup.rbxcdn.com
Akamai International B.V.
DE
whitelisted
5064
SearchApp.exe
2.16.110.171:443
www.bing.com
Akamai International B.V.
DE
whitelisted
5064
SearchApp.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1176
svchost.exe
40.126.32.72:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
client-telemetry.roblox.com
  • 128.116.21.3
whitelisted
ecsv2.roblox.com
  • 128.116.21.3
  • 128.116.44.3
whitelisted
clientsettingscdn.roblox.com
  • 52.222.236.6
  • 52.222.236.86
  • 52.222.236.43
  • 52.222.236.113
whitelisted
setup.rbxcdn.com
  • 23.48.23.144
  • 23.48.23.156
  • 13.32.27.4
  • 13.32.27.22
  • 13.32.27.35
  • 13.32.27.39
whitelisted
www.bing.com
  • 2.16.110.171
  • 2.16.110.121
  • 2.16.110.123
  • 104.126.37.152
  • 104.126.37.153
  • 104.126.37.154
  • 104.126.37.147
  • 104.126.37.161
  • 104.126.37.160
  • 104.126.37.146
  • 104.126.37.162
  • 104.126.37.163
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 2.23.77.188
whitelisted
login.live.com
  • 40.126.32.72
  • 40.126.32.74
  • 40.126.32.68
  • 20.190.160.20
  • 40.126.32.76
  • 40.126.32.134
  • 40.126.32.136
  • 40.126.32.138
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted

Threats

PID
Process
Class
Message
5892
svchost.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
Process
Message
RobloxPlayerInstaller.exe
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
RobloxStudioInstaller.exe
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
RobloxPlayerInstaller.exe