File name:

Roblox 2.592.586.0_74208.exe

Full analysis: https://app.any.run/tasks/0e9e94ec-7f21-4bf3-8bff-79dd1038909c
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: September 19, 2023, 20:27:24
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adware
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

231636EF3B0E6EC1A3847D24CB479875

SHA1:

14D4F515F029B932C3CE040990F67323DBFEED46

SHA256:

6EDB725DD187A89987530E502A8B17BBA1D38079E9D226FCA734D5AE9E378C71

SSDEEP:

196608:jfjFb/8YLUNrqNzpOrymQ3bKfIiaNPFHNRsiK6e:LjFbE/NrqNgryL3bIIiEHMn6e

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • setup74208.exe (PID: 2212)
      • OfferInstaller.exe (PID: 3836)

    • Application was dropped or rewritten from another process

      • setup74208.exe (PID: 2212)
      • setup74208.exe (PID: 3376)
      • OfferInstaller.exe (PID: 3836)
      • OperaGX.exe (PID: 3784)

    • Loads dropped or rewritten executable

      • setup74208.exe (PID: 3376)
      • OfferInstaller.exe (PID: 3836)
      • setup74208.exe (PID: 2212)

  • SUSPICIOUS

    • Reads the Internet Settings

      • Roblox 2.592.586.0_74208.exe (PID: 2876)
      • setup74208.exe (PID: 2212)
      • setup74208.exe (PID: 3376)
      • OfferInstaller.exe (PID: 3836)

    • Reads security settings of Internet Explorer

      • Roblox 2.592.586.0_74208.exe (PID: 2876)
      • setup74208.exe (PID: 2212)

    • Reads settings of System Certificates

      • Roblox 2.592.586.0_74208.exe (PID: 2876)
      • setup74208.exe (PID: 2212)
      • OfferInstaller.exe (PID: 3836)

    • Checks Windows Trust Settings

      • Roblox 2.592.586.0_74208.exe (PID: 2876)
      • setup74208.exe (PID: 2212)

    • Reads the Windows owner or organization settings

      • setup74208.exe (PID: 2212)
      • OfferInstaller.exe (PID: 3836)

    • Adds/modifies Windows certificates

      • Roblox 2.592.586.0_74208.exe (PID: 2876)

    • Searches for installed software

      • setup74208.exe (PID: 2212)

    • Executing commands from a ".bat" file

      • OfferInstaller.exe (PID: 3836)
      • setup74208.exe (PID: 2212)

    • Starts CMD.EXE for commands execution

      • setup74208.exe (PID: 2212)
      • OfferInstaller.exe (PID: 3836)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 3360)
      • cmd.exe (PID: 2472)

    • Get information on the list of running processes

      • cmd.exe (PID: 2472)
      • cmd.exe (PID: 3360)

    • Start notepad (likely ransomware note)

      • Roblox 2.592.586.0_74208.exe (PID: 2876)

  • INFO

    • Reads the machine GUID from the registry

      • wmpnscfg.exe (PID: 3220)
      • Roblox 2.592.586.0_74208.exe (PID: 2876)
      • setup74208.exe (PID: 2212)
      • setup74208.exe (PID: 3376)
      • OfferInstaller.exe (PID: 3836)

    • Reads the computer name

      • Roblox 2.592.586.0_74208.exe (PID: 2876)
      • setup74208.exe (PID: 2212)
      • setup74208.exe (PID: 3376)
      • OfferInstaller.exe (PID: 3836)
      • wmpnscfg.exe (PID: 3220)

    • Checks proxy server information

      • Roblox 2.592.586.0_74208.exe (PID: 2876)

    • Creates files or folders in the user directory

      • Roblox 2.592.586.0_74208.exe (PID: 2876)
      • setup74208.exe (PID: 2212)
      • OfferInstaller.exe (PID: 3836)
      • OperaGX.exe (PID: 3784)

    • Checks supported languages

      • Roblox 2.592.586.0_74208.exe (PID: 2876)
      • setup74208.exe (PID: 2212)
      • setup74208.exe (PID: 3376)
      • OfferInstaller.exe (PID: 3836)
      • wmpnscfg.exe (PID: 3220)
      • OperaGX.exe (PID: 3784)

    • Create files in a temporary directory

      • setup74208.exe (PID: 2212)
      • Roblox 2.592.586.0_74208.exe (PID: 2876)
      • setup74208.exe (PID: 3376)
      • OfferInstaller.exe (PID: 3836)
      • OperaGX.exe (PID: 3784)

    • Reads product name

      • setup74208.exe (PID: 2212)
      • OfferInstaller.exe (PID: 3836)

    • Reads Environment values

      • setup74208.exe (PID: 2212)
      • OfferInstaller.exe (PID: 3836)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

ProductVersion: 1
ProductName: Download Manager
OriginalFileName: Download Manager
LegalCopyright: Download Manager
InternalName: Download Manager
FileVersion: 1
FileDescription: Download Manager
CharacterSet: Unicode
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Unknown
FileOS: Unknown (0)
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 1.0.0.0
FileVersionNumber: 1.0.0.0
Subsystem: Windows GUI
SubsystemVersion: 6
ImageVersion: -
OSVersion: 6
EntryPoint: 0x3816aa
UninitializedDataSize: -
InitializedDataSize: 5623808
CodeSize: 4243968
LinkerVersion: 14.22
PEType: PE32
ImageFileCharacteristics: Executable, 32-bit
TimeStamp: 2023:08:28 14:54:26+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
62
Monitored processes
22
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start drop and start drop and start start drop and start roblox 2.592.586.0_74208.exe setup74208.exe setup74208.exe no specs offerinstaller.exe cmd.exe no specs tasklist.exe no specs find.exe no specs timeout.exe no specs cmd.exe no specs find.exe no specs tasklist.exe no specs timeout.exe no specs find.exe no specs tasklist.exe no specs timeout.exe no specs notepad.exe no specs find.exe no specs tasklist.exe no specs timeout.exe no specs operagx.exe no specs roblox 2.592.586.0_74208.exe no specs wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
372find /I "3836"C:\Windows\System32\find.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (grep) Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\find.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
600"C:\Users\admin\AppData\Local\Temp\Roblox 2.592.586.0_74208.exe" C:\Users\admin\AppData\Local\Temp\Roblox 2.592.586.0_74208.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Download Manager
Exit code:
3221226540
Version:
1
Modules
Images
c:\users\admin\appdata\local\temp\roblox 2.592.586.0_74208.exe
c:\windows\system32\ntdll.dll
1896tasklist /FI "PID eq 2212" /fo csv C:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Lists the current running tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\tasklist.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\netapi32.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\netutils.dll
c:\windows\system32\msvcrt.dll
2028find /I "3836"C:\Windows\System32\find.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (grep) Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\find.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\ulib.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2044tasklist /FI "PID eq 3836" /fo csv C:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Lists the current running tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2104timeout 1C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
2212C:\Users\admin\AppData\Local\setup74208.exe hhwnd=655732 hreturntoinstaller hextras=id:f4f234efa3d9a78-UA-LqMuEC:\Users\admin\AppData\Local\setup74208.exe
Roblox 2.592.586.0_74208.exe
User:
admin
Company:
DT001
Integrity Level:
HIGH
Description:
Software Installation
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\setup74208.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2448timeout 1C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\timeout.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
2472C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\H2OCleanup.bat""C:\Windows\System32\cmd.exe—OfferInstaller.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2556find /I "3836"C:\Windows\System32\find.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (grep) Utility
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\find.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
18 770
Read events
18 652
Write events
115
Delete events
3

Modification events

(PID) Process:(3220) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{938FFFB9-5A87-4AB6-9ABE-0F88D5675321}\{22CDD4C4-5CB3-4186-8FD2-D5ECEB201D3E}
Operation:delete keyName:(default)
Value:
(PID) Process:(3220) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{938FFFB9-5A87-4AB6-9ABE-0F88D5675321}
Operation:delete keyName:(default)
Value:
(PID) Process:(3220) wmpnscfg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Health\{CDA93001-5CE5-44C6-B5C9-CD6744545F42}
Operation:delete keyName:(default)
Value:
(PID) Process:(2876) Roblox 2.592.586.0_74208.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2876) Roblox 2.592.586.0_74208.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000004F010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2876) Roblox 2.592.586.0_74208.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2876) Roblox 2.592.586.0_74208.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2876) Roblox 2.592.586.0_74208.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2876) Roblox 2.592.586.0_74208.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2876) Roblox 2.592.586.0_74208.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
Executable files
27
Suspicious files
16
Text files
26
Unknown types
0

Dropped files

PID
Process
Filename
Type
2876Roblox 2.592.586.0_74208.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:2C6AC0BA9B66AD11ECB23D6B4FCFE5C0
SHA256:285E7A1DB887E11FC44BFBFA7D168135063DB82AAB1F14C0F928497EA4AE6F0D
2876Roblox 2.592.586.0_74208.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:24BE8A92460B5B7A555B1DA559296958
SHA256:77A3CFE6B7EB676AF438D5DE88C7EFCB6ABCC494E0B65DA90201969E6D79B2A3
2876Roblox 2.592.586.0_74208.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:2FB164C231CE09A224628234B365EC62
SHA256:B2F3C994892D55DF8309C502E984B87A798A7E2B0492C7BE62284E0DB9D2491E
2876Roblox 2.592.586.0_74208.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\info[1].htmtext
MD5:B0038CF80E7BC3C33FBDE0527914CFE9
SHA256:1C6C185C9A88244E5F15FD333EE29D561CD9D03E8FDB9DD4A9091899232F545A
2212setup74208.exeC:\Users\admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\ServiceHide.dllexecutable
MD5:72990C7E32EE6C811EA3D2EA64523234
SHA256:E77E0B4F2762F76A3EAAADF5A3138A35EC06ECE80EDC4B3396DE7A601F8DA1B3
2212setup74208.exeC:\Users\admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OUtilities.dllexecutable
MD5:9D2C520BFA294A6AA0C5CBC6D87CAEEC
SHA256:669C812CB8F09799083014A199B0DEEE10237C95FB49EE107376B952FEE5BD89
2212setup74208.exeC:\Users\admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\GenericSetup.dllexecutable
MD5:08112F27DCD8F1D779231A7A3E944CB1
SHA256:11C6A8470A3F2B2BE9B8CAFE5F9A0AFCE7303BFD02AB783A0F0EE09A184649FA
2212setup74208.exeC:\Users\admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\OfferSDK.dllexecutable
MD5:B199DCD6824A02522A4D29A69AB65058
SHA256:9310A58F26BE8BD453CDE5CA6AA05042942832711FBDEB5430A2840232BFA5E4
2212setup74208.exeC:\Users\admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\GenericSetup.LastScreen.dllexecutable
MD5:6E001F8D0EE4F09A6673A9E8168836B6
SHA256:6A30F9C604C4012D1D2E1BA075213C378AFB1BFCB94276DE7995ED7BBF492859
2212setup74208.exeC:\Users\admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\SciterWrapper.dllexecutable
MD5:105A9E404F7AC841C46380063CC27F50
SHA256:69FE749457218EC9A765F9AAC74CAF6D4F73084CF5175D3FD1E4F345AF8B3B8B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
21
DNS requests
14
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2876
Roblox 2.592.586.0_74208.exe
GET
200
142.250.184.131:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
der
1.41 Kb
unknown
2876
Roblox 2.592.586.0_74208.exe
POST
200
35.190.60.70:80
http://dlsft.com/callback/geo/geo.php
unknown
text
18 b
malicious
2876
Roblox 2.592.586.0_74208.exe
GET
200
142.250.184.131:80
http://ocsp.pki.goog/s/gts1d4/QHlmJI2T4Ek/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSMBFDqU0NJQdZdEGU3bkhj0FoRrQQUJeIYDrJXkZQq5dRdhpCD3lOzuJICEB27EkPvc%2FYjEoiqp%2FN%2FTxY%3D
unknown
der
471 b
unknown
2876
Roblox 2.592.586.0_74208.exe
POST
200
35.190.60.70:80
http://dlsft.com/callback/?channel=LqMuE&id=74208&action=started
unknown
compressed
128 b
unknown
2876
Roblox 2.592.586.0_74208.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?a6da91d472adcc40
unknown
compressed
61.6 Kb
unknown
2876
Roblox 2.592.586.0_74208.exe
GET
200
35.190.60.70:80
http://dlsft.com/callback/offers.php
unknown
text
17 b
malicious
2876
Roblox 2.592.586.0_74208.exe
POST
200
35.190.60.70:80
http://dlsft.com/callback/?channel=LqMuE&id=74208&action=completed
unknown
compressed
128 b
unknown
2876
Roblox 2.592.586.0_74208.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0d267db6c2f14e82
unknown
compressed
4.66 Kb
unknown
2876
Roblox 2.592.586.0_74208.exe
GET
200
35.190.60.70:80
http://dlsft.com/callback/info.php?id=74208
unknown
text
128 b
unknown
2876
Roblox 2.592.586.0_74208.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAfy81yHqHeveu%2FpR5k1Jb0%3D
unknown
der
471 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3284
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2876
Roblox 2.592.586.0_74208.exe
35.190.60.70:443
www.dlsft.com
GOOGLE
US
whitelisted
2876
Roblox 2.592.586.0_74208.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
2876
Roblox 2.592.586.0_74208.exe
142.250.184.131:80
ocsp.pki.goog
GOOGLE
US
whitelisted
2212
setup74208.exe
104.17.8.52:443
flow.lavasoft.com
CLOUDFLARENET
—
shared
2212
setup74208.exe
104.18.67.73:443
sos.adaware.com
CLOUDFLARENET
—
unknown
2876
Roblox 2.592.586.0_74208.exe
35.190.60.70:80
www.dlsft.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
www.dlsft.com
  • 35.190.60.70
unknown
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.pki.goog
  • 142.250.184.131
whitelisted
www.google.com
  • 142.250.184.132
whitelisted
flow.lavasoft.com
  • 104.17.8.52
  • 104.17.9.52
whitelisted
sos.adaware.com
  • 104.18.67.73
  • 104.18.68.73
whitelisted
dlsft.com
  • 35.190.60.70
unknown
filedm.com
  • 188.114.96.3
  • 188.114.97.3
malicious
sdl.adaware.com
  • 104.18.68.73
  • 104.18.67.73
whitelisted
x1.c.lencr.org
  • 23.56.202.135
whitelisted

Threats

PID
Process
Class
Message
2876
Roblox 2.592.586.0_74208.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] Win32/LinkPadBundle (geolocation request)
4 ETPRO signatures available at the full report
Process
Message
setup74208.exe
Error: File not found - sciterwrapper:console.tis
setup74208.exe
setup74208.exe
file:resources/tis/TranslateOfferTemplate.tis(82) : warning :'async' does not contain any 'await'
setup74208.exe
at sciter:init-script.tis
setup74208.exe
setup74208.exe
setup74208.exe
at sciter:init-script.tis
setup74208.exe
setup74208.exe
Error: File not found - sciterwrapper:console.tis
setup74208.exe
file:resources/tis/TranslateOfferTemplate.tis(82) : warning :'async' does not contain any 'await'
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Roblox 2.592.586.0_74208.exe