File name:

Roblox 2.592.586.0_74208.exe

Full analysis: https://app.any.run/tasks/0e9e94ec-7f21-4bf3-8bff-79dd1038909c
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: September 19, 2023, 20:27:24
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adware
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

231636EF3B0E6EC1A3847D24CB479875

SHA1:

14D4F515F029B932C3CE040990F67323DBFEED46

SHA256:

6EDB725DD187A89987530E502A8B17BBA1D38079E9D226FCA734D5AE9E378C71

SSDEEP:

196608:jfjFb/8YLUNrqNzpOrymQ3bKfIiaNPFHNRsiK6e:LjFbE/NrqNgryL3bIIiEHMn6e

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • setup74208.exe (PID: 2212)
      • OfferInstaller.exe (PID: 3836)

    • Application was dropped or rewritten from another process

      • setup74208.exe (PID: 2212)
      • setup74208.exe (PID: 3376)
      • OfferInstaller.exe (PID: 3836)
      • OperaGX.exe (PID: 3784)

    • Loads dropped or rewritten executable

      • setup74208.exe (PID: 3376)
      • OfferInstaller.exe (PID: 3836)
      • setup74208.exe (PID: 2212)

  • SUSPICIOUS

    • Reads the Internet Settings

      • Roblox 2.592.586.0_74208.exe (PID: 2876)
      • setup74208.exe (PID: 2212)
      • setup74208.exe (PID: 3376)
      • OfferInstaller.exe (PID: 3836)

    • Reads security settings of Internet Explorer

      • Roblox 2.592.586.0_74208.exe (PID: 2876)
      • setup74208.exe (PID: 2212)

    • Reads settings of System Certificates

      • Roblox 2.592.586.0_74208.exe (PID: 2876)
      • setup74208.exe (PID: 2212)
      • OfferInstaller.exe (PID: 3836)

    • Checks Windows Trust Settings

      • setup74208.exe (PID: 2212)
      • Roblox 2.592.586.0_74208.exe (PID: 2876)

    • Adds/modifies Windows certificates

      • Roblox 2.592.586.0_74208.exe (PID: 2876)

    • Searches for installed software

      • setup74208.exe (PID: 2212)

    • Reads the Windows owner or organization settings

      • setup74208.exe (PID: 2212)
      • OfferInstaller.exe (PID: 3836)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 3360)
      • cmd.exe (PID: 2472)

    • Starts CMD.EXE for commands execution

      • OfferInstaller.exe (PID: 3836)
      • setup74208.exe (PID: 2212)

    • Executing commands from a ".bat" file

      • OfferInstaller.exe (PID: 3836)
      • setup74208.exe (PID: 2212)

    • Start notepad (likely ransomware note)

      • Roblox 2.592.586.0_74208.exe (PID: 2876)

    • Get information on the list of running processes

      • cmd.exe (PID: 2472)
      • cmd.exe (PID: 3360)

  • INFO

    • Checks supported languages

      • Roblox 2.592.586.0_74208.exe (PID: 2876)
      • wmpnscfg.exe (PID: 3220)
      • setup74208.exe (PID: 2212)
      • OfferInstaller.exe (PID: 3836)
      • setup74208.exe (PID: 3376)
      • OperaGX.exe (PID: 3784)

    • Reads the computer name

      • wmpnscfg.exe (PID: 3220)
      • Roblox 2.592.586.0_74208.exe (PID: 2876)
      • setup74208.exe (PID: 2212)
      • setup74208.exe (PID: 3376)
      • OfferInstaller.exe (PID: 3836)

    • Reads the machine GUID from the registry

      • wmpnscfg.exe (PID: 3220)
      • Roblox 2.592.586.0_74208.exe (PID: 2876)
      • setup74208.exe (PID: 2212)
      • setup74208.exe (PID: 3376)
      • OfferInstaller.exe (PID: 3836)

    • Checks proxy server information

      • Roblox 2.592.586.0_74208.exe (PID: 2876)

    • Creates files or folders in the user directory

      • setup74208.exe (PID: 2212)
      • Roblox 2.592.586.0_74208.exe (PID: 2876)
      • OfferInstaller.exe (PID: 3836)
      • OperaGX.exe (PID: 3784)

    • Create files in a temporary directory

      • setup74208.exe (PID: 2212)
      • setup74208.exe (PID: 3376)
      • Roblox 2.592.586.0_74208.exe (PID: 2876)
      • OfferInstaller.exe (PID: 3836)
      • OperaGX.exe (PID: 3784)

    • Reads Environment values

      • setup74208.exe (PID: 2212)
      • OfferInstaller.exe (PID: 3836)

    • Reads product name

      • setup74208.exe (PID: 2212)
      • OfferInstaller.exe (PID: 3836)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

ProductVersion: 1
ProductName: Download Manager
OriginalFileName: Download Manager
LegalCopyright: Download Manager
InternalName: Download Manager
FileVersion: 1
FileDescription: Download Manager
CharacterSet: Unicode
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Unknown
FileOS: Unknown (0)
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 1.0.0.0
FileVersionNumber: 1.0.0.0
Subsystem: Windows GUI
SubsystemVersion: 6
ImageVersion: -
OSVersion: 6
EntryPoint: 0x3816aa
UninitializedDataSize: -
InitializedDataSize: 5623808
CodeSize: 4243968
LinkerVersion: 14.22
PEType: PE32
ImageFileCharacteristics: Executable, 32-bit
TimeStamp: 2023:08:28 14:54:26+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
62
Monitored processes
22
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start drop and start drop and start start drop and start roblox 2.592.586.0_74208.exe setup74208.exe setup74208.exe no specs offerinstaller.exe cmd.exe no specs tasklist.exe no specs find.exe no specs timeout.exe no specs cmd.exe no specs find.exe no specs tasklist.exe no specs timeout.exe no specs find.exe no specs tasklist.exe no specs timeout.exe no specs notepad.exe no specs find.exe no specs tasklist.exe no specs timeout.exe no specs operagx.exe no specs roblox 2.592.586.0_74208.exe no specs wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
372find /I "3836"C:\Windows\System32\find.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (grep) Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\find.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
600"C:\Users\admin\AppData\Local\Temp\Roblox 2.592.586.0_74208.exe" C:\Users\admin\AppData\Local\Temp\Roblox 2.592.586.0_74208.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Download Manager
Exit code:
3221226540
Version:
1
Modules
Images
c:\users\admin\appdata\local\temp\roblox 2.592.586.0_74208.exe
c:\windows\system32\ntdll.dll
1896tasklist /FI "PID eq 2212" /fo csv C:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Lists the current running tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\tasklist.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\netapi32.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\netutils.dll
c:\windows\system32\msvcrt.dll
2028find /I "3836"C:\Windows\System32\find.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (grep) Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\find.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\ulib.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2044tasklist /FI "PID eq 3836" /fo csv C:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Lists the current running tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2104timeout 1C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
2212C:\Users\admin\AppData\Local\setup74208.exe hhwnd=655732 hreturntoinstaller hextras=id:f4f234efa3d9a78-UA-LqMuEC:\Users\admin\AppData\Local\setup74208.exe
Roblox 2.592.586.0_74208.exe
User:
admin
Company:
DT001
Integrity Level:
HIGH
Description:
Software Installation
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\setup74208.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2448timeout 1C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\timeout.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
2472C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\H2OCleanup.bat""C:\Windows\System32\cmd.exe—OfferInstaller.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2556find /I "3836"C:\Windows\System32\find.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (grep) Utility
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\find.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
18 770
Read events
18 652
Write events
115
Delete events
3

Modification events

(PID) Process:(3220) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{938FFFB9-5A87-4AB6-9ABE-0F88D5675321}\{22CDD4C4-5CB3-4186-8FD2-D5ECEB201D3E}
Operation:delete keyName:(default)
Value:
(PID) Process:(3220) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{938FFFB9-5A87-4AB6-9ABE-0F88D5675321}
Operation:delete keyName:(default)
Value:
(PID) Process:(3220) wmpnscfg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Health\{CDA93001-5CE5-44C6-B5C9-CD6744545F42}
Operation:delete keyName:(default)
Value:
(PID) Process:(2876) Roblox 2.592.586.0_74208.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2876) Roblox 2.592.586.0_74208.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000004F010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2876) Roblox 2.592.586.0_74208.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2876) Roblox 2.592.586.0_74208.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2876) Roblox 2.592.586.0_74208.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2876) Roblox 2.592.586.0_74208.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2876) Roblox 2.592.586.0_74208.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
Executable files
27
Suspicious files
16
Text files
26
Unknown types
0

Dropped files

PID
Process
Filename
Type
2876Roblox 2.592.586.0_74208.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:24BE8A92460B5B7A555B1DA559296958
SHA256:77A3CFE6B7EB676AF438D5DE88C7EFCB6ABCC494E0B65DA90201969E6D79B2A3
2876Roblox 2.592.586.0_74208.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:2C6AC0BA9B66AD11ECB23D6B4FCFE5C0
SHA256:285E7A1DB887E11FC44BFBFA7D168135063DB82AAB1F14C0F928497EA4AE6F0D
2212setup74208.exeC:\Users\admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\SciterWrapper.dllexecutable
MD5:105A9E404F7AC841C46380063CC27F50
SHA256:69FE749457218EC9A765F9AAC74CAF6D4F73084CF5175D3FD1E4F345AF8B3B8B
2876Roblox 2.592.586.0_74208.exeC:\Users\admin\AppData\Local\setup74208.exeexecutable
MD5:29D3A70CEC060614E1691E64162A6C1E
SHA256:CC70B093A19610E9752794D757AEC9EF07CA862EA9267EC6F9CC92B2AA882C72
2212setup74208.exeC:\Users\admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OServices.dllexecutable
MD5:6DF226BDA27D26CE4523B80DBF57A9EA
SHA256:17D737175D50EEE97AC1C77DB415FE25CC3C7A3871B65B93CC3FAD63808A9ABC
2212setup74208.exeC:\Users\admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\Ninject.dllexecutable
MD5:8DB691813A26E7D0F1DB5E2F4D0D05E3
SHA256:3043A65F11AC204E65BCA142FF4166D85F1B22078B126B806F1FECB2A315C701
2876Roblox 2.592.586.0_74208.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\67AEE4151C4FF26BF17261A9538D4803_AE02B7A5257C8446CD0DB659EED812F5binary
MD5:D5FEEDBBCBB00D9A86C85E70D02CF82D
SHA256:914393AEC3B27E0DD1E48818323F7FDAE3E9B3ACB0ECF81727C6C90A08E8D835
2212setup74208.exeC:\Users\admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\GenericSetup.dllexecutable
MD5:08112F27DCD8F1D779231A7A3E944CB1
SHA256:11C6A8470A3F2B2BE9B8CAFE5F9A0AFCE7303BFD02AB783A0F0EE09A184649FA
2212setup74208.exeC:\Users\admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OModels.dllexecutable
MD5:C06AC6DCFA7780CD781FC9AF269E33C0
SHA256:B23B8310265C14D7E530B80DEFC6D39CDC638C07D07CD2668E387863C463741D
2212setup74208.exeC:\Users\admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OUtilities.dllexecutable
MD5:9D2C520BFA294A6AA0C5CBC6D87CAEEC
SHA256:669C812CB8F09799083014A199B0DEEE10237C95FB49EE107376B952FEE5BD89
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
21
DNS requests
14
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2876
Roblox 2.592.586.0_74208.exe
GET
200
35.190.60.70:80
http://dlsft.com/callback/offers.php
unknown
text
17 b
—
2876
Roblox 2.592.586.0_74208.exe
POST
200
35.190.60.70:80
http://dlsft.com/callback/?channel=LqMuE&id=74208&action=completed
unknown
compressed
128 b
—
2876
Roblox 2.592.586.0_74208.exe
GET
200
142.250.184.131:80
http://ocsp.pki.goog/s/gts1d4/QHlmJI2T4Ek/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSMBFDqU0NJQdZdEGU3bkhj0FoRrQQUJeIYDrJXkZQq5dRdhpCD3lOzuJICEB27EkPvc%2FYjEoiqp%2FN%2FTxY%3D
unknown
der
471 b
—
2876
Roblox 2.592.586.0_74208.exe
GET
200
142.250.184.131:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
der
1.41 Kb
—
2876
Roblox 2.592.586.0_74208.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0d267db6c2f14e82
unknown
compressed
4.66 Kb
—
2876
Roblox 2.592.586.0_74208.exe
POST
200
35.190.60.70:80
http://dlsft.com/callback/geo/geo.php
unknown
text
18 b
—
2876
Roblox 2.592.586.0_74208.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?a6da91d472adcc40
unknown
compressed
61.6 Kb
—
2876
Roblox 2.592.586.0_74208.exe
GET
200
35.190.60.70:80
http://dlsft.com/callback/info.php?id=74208
unknown
text
128 b
—
2876
Roblox 2.592.586.0_74208.exe
POST
200
35.190.60.70:80
http://dlsft.com/callback/?channel=LqMuE&id=74208&action=operagx-Shown
unknown
compressed
128 b
—
2876
Roblox 2.592.586.0_74208.exe
POST
200
35.190.60.70:80
http://dlsft.com/callback/?channel=LqMuE&id=74208&action=started
unknown
compressed
128 b
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
unknown
3284
svchost.exe
239.255.255.250:1900
—
—
—
unknown
2876
Roblox 2.592.586.0_74208.exe
35.190.60.70:443
www.dlsft.com
GOOGLE
US
unknown
2876
Roblox 2.592.586.0_74208.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
unknown
2876
Roblox 2.592.586.0_74208.exe
142.250.184.131:80
ocsp.pki.goog
GOOGLE
US
unknown
2212
setup74208.exe
104.17.8.52:443
flow.lavasoft.com
CLOUDFLARENET
—
unknown
2212
setup74208.exe
104.18.67.73:443
sos.adaware.com
CLOUDFLARENET
—
unknown
2876
Roblox 2.592.586.0_74208.exe
35.190.60.70:80
www.dlsft.com
GOOGLE
US
unknown

DNS requests

Domain
IP
Reputation
www.dlsft.com
  • 35.190.60.70
unknown
ctldl.windowsupdate.com
  • 93.184.221.240
unknown
ocsp.pki.goog
  • 142.250.184.131
unknown
www.google.com
  • 142.250.184.132
unknown
flow.lavasoft.com
  • 104.17.8.52
  • 104.17.9.52
unknown
sos.adaware.com
  • 104.18.67.73
  • 104.18.68.73
unknown
dlsft.com
  • 35.190.60.70
unknown
filedm.com
  • 188.114.96.3
  • 188.114.97.3
unknown
sdl.adaware.com
  • 104.18.68.73
  • 104.18.67.73
unknown
x1.c.lencr.org
  • 23.56.202.135
unknown

Threats

PID
Process
Class
Message
—
—
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] Win32/LinkPadBundle (geolocation request)
4 ETPRO signatures available at the full report
Process
Message
setup74208.exe
Error: File not found - sciterwrapper:console.tis
setup74208.exe
setup74208.exe
file:resources/tis/TranslateOfferTemplate.tis(82) : warning :'async' does not contain any 'await'
setup74208.exe
at sciter:init-script.tis
setup74208.exe
setup74208.exe
setup74208.exe
at sciter:init-script.tis
setup74208.exe
setup74208.exe
Error: File not found - sciterwrapper:console.tis
setup74208.exe
file:resources/tis/TranslateOfferTemplate.tis(82) : warning :'async' does not contain any 'await'
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Roblox 2.592.586.0_74208.exe