File name:

Roblox Evon Exploit V4 UWP_23165.exe

Full analysis: https://app.any.run/tasks/b86a9eb4-2853-44b4-b9d3-1256157087a4
Verdict: Malicious activity
Analysis date: August 10, 2023, 19:39:02
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

C17F0EABABF0977481F7067199485572

SHA1:

8D4D518C4E3975B8F0862C45CD5BD7B6C049DC3D

SHA256:

7809CC3FEE64EC6F087F6DAB5AC09F8830F79166DA639844FA439E1B6925E2F3

SSDEEP:

196608:FKQcLwTubhjhPrqNgWomQ3bKfIiaNPFHNRsiKWx1:FF+EuRdrqNloL3bIIiEHMnm1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • setup23165.exe (PID: 3572)
      • OfferInstaller.exe (PID: 3900)

    • Loads dropped or rewritten executable

      • setup23165.exe (PID: 3212)
      • setup23165.exe (PID: 3572)
      • OfferInstaller.exe (PID: 3900)

    • Application was dropped or rewritten from another process

      • setup23165.exe (PID: 3572)
      • setup23165.exe (PID: 3212)
      • OfferInstaller.exe (PID: 3900)

  • SUSPICIOUS

    • Reads the Internet Settings

      • Roblox Evon Exploit V4 UWP_23165.exe (PID: 2696)
      • setup23165.exe (PID: 3572)
      • setup23165.exe (PID: 3212)
      • OfferInstaller.exe (PID: 3900)

    • Executable content was dropped or overwritten

      • Roblox Evon Exploit V4 UWP_23165.exe (PID: 2696)
      • setup23165.exe (PID: 3572)

    • Reads the Windows owner or organization settings

      • setup23165.exe (PID: 3572)
      • OfferInstaller.exe (PID: 3900)

    • Reads security settings of Internet Explorer

      • setup23165.exe (PID: 3572)
      • Roblox Evon Exploit V4 UWP_23165.exe (PID: 2696)

    • Checks Windows Trust Settings

      • setup23165.exe (PID: 3572)
      • Roblox Evon Exploit V4 UWP_23165.exe (PID: 2696)

    • Adds/modifies Windows certificates

      • Roblox Evon Exploit V4 UWP_23165.exe (PID: 2696)

    • Reads settings of System Certificates

      • setup23165.exe (PID: 3572)
      • Roblox Evon Exploit V4 UWP_23165.exe (PID: 2696)
      • OfferInstaller.exe (PID: 3900)

    • Searches for installed software

      • setup23165.exe (PID: 3572)

    • Start notepad (likely ransomware note)

      • Roblox Evon Exploit V4 UWP_23165.exe (PID: 2696)

    • Executing commands from a ".bat" file

      • OfferInstaller.exe (PID: 3900)
      • setup23165.exe (PID: 3572)

    • Starts CMD.EXE for commands execution

      • OfferInstaller.exe (PID: 3900)
      • setup23165.exe (PID: 3572)

    • Get information on the list of running processes

      • cmd.exe (PID: 2288)
      • cmd.exe (PID: 1604)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 2288)
      • cmd.exe (PID: 1604)

  • INFO

    • Checks supported languages

      • Roblox Evon Exploit V4 UWP_23165.exe (PID: 2696)
      • setup23165.exe (PID: 3572)
      • setup23165.exe (PID: 3212)
      • OfferInstaller.exe (PID: 3900)
      • wmpnscfg.exe (PID: 1208)

    • Reads the machine GUID from the registry

      • Roblox Evon Exploit V4 UWP_23165.exe (PID: 2696)
      • setup23165.exe (PID: 3572)
      • setup23165.exe (PID: 3212)
      • OfferInstaller.exe (PID: 3900)
      • wmpnscfg.exe (PID: 1208)

    • Reads the computer name

      • Roblox Evon Exploit V4 UWP_23165.exe (PID: 2696)
      • setup23165.exe (PID: 3572)
      • setup23165.exe (PID: 3212)
      • OfferInstaller.exe (PID: 3900)
      • wmpnscfg.exe (PID: 1208)

    • Manual execution by a user

      • explorer.exe (PID: 2580)
      • iexplore.exe (PID: 3912)
      • wmpnscfg.exe (PID: 1208)

    • The process checks LSA protection

      • explorer.exe (PID: 2580)
      • Roblox Evon Exploit V4 UWP_23165.exe (PID: 2696)
      • setup23165.exe (PID: 3572)
      • setup23165.exe (PID: 3212)
      • OfferInstaller.exe (PID: 3900)
      • tasklist.exe (PID: 476)
      • tasklist.exe (PID: 3228)
      • tasklist.exe (PID: 2448)
      • tasklist.exe (PID: 2160)
      • wmpnscfg.exe (PID: 1208)

    • Checks proxy server information

      • Roblox Evon Exploit V4 UWP_23165.exe (PID: 2696)

    • Creates files or folders in the user directory

      • Roblox Evon Exploit V4 UWP_23165.exe (PID: 2696)
      • setup23165.exe (PID: 3572)
      • OfferInstaller.exe (PID: 3900)

    • Reads Environment values

      • setup23165.exe (PID: 3572)
      • OfferInstaller.exe (PID: 3900)

    • Create files in a temporary directory

      • setup23165.exe (PID: 3572)
      • setup23165.exe (PID: 3212)
      • OfferInstaller.exe (PID: 3900)
      • Roblox Evon Exploit V4 UWP_23165.exe (PID: 2696)

    • Reads product name

      • setup23165.exe (PID: 3572)
      • OfferInstaller.exe (PID: 3900)

    • Application launched itself

      • iexplore.exe (PID: 3912)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 6
ImageVersion: -
OSVersion: 6
EntryPoint: 0x3814b7
UninitializedDataSize: -
InitializedDataSize: 5623296
CodeSize: 4243968
LinkerVersion: 14.22
PEType: PE32
ImageFileCharacteristics: Executable, 32-bit
TimeStamp: 2023:08:08 07:37:13+00:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 08-Aug-2023 07:37:13
Detected languages:
  • Dutch - Netherlands
  • English - United States

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000128

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 08-Aug-2023 07:37:13
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0040C09B
0x0040C200
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.64613
.rdata
0x0040E000
0x000F9C20
0x000F9E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.51436
.data
0x00508000
0x0002A0E8
0x00023E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.82581
.rsrc
0x00533000
0x003EE488
0x003EE600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.97976
.reloc
0x00922000
0x0004A738
0x0004A800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.59023

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.04264
562
UNKNOWN
English - United States
RT_MANIFEST
2
2.73071
67624
UNKNOWN
Dutch - Netherlands
RT_ICON
3
2.77417
16936
UNKNOWN
Dutch - Netherlands
RT_ICON
4
3.65334
9640
UNKNOWN
Dutch - Netherlands
RT_ICON
5
2.82974
4264
UNKNOWN
Dutch - Netherlands
RT_ICON
6
4.49114
1128
UNKNOWN
Dutch - Netherlands
RT_ICON
101
7.99934
4018880
UNKNOWN
Dutch - Netherlands
RT_RCDATA
103
2.75463
90
UNKNOWN
Dutch - Netherlands
RT_GROUP_ICON

Imports

ADVAPI32.dll
COMCTL32.dll
COMDLG32.dll
GDI32.dll
IMM32.dll
KERNEL32.dll
OLEACC.dll
OLEAUT32.dll
SHELL32.dll
USER32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
68
Monitored processes
24
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start roblox evon exploit v4 uwp_23165.exe explorer.exe no specs setup23165.exe setup23165.exe no specs offerinstaller.exe notepad.exe no specs cmd.exe no specs tasklist.exe no specs find.exe no specs timeout.exe no specs find.exe no specs tasklist.exe no specs timeout.exe no specs tasklist.exe no specs find.exe no specs timeout.exe no specs cmd.exe no specs tasklist.exe no specs find.exe no specs timeout.exe no specs iexplore.exe iexplore.exe wmpnscfg.exe no specs roblox evon exploit v4 uwp_23165.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
476tasklist /FI "PID eq 3900" /fo csv C:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Lists the current running tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1036"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\link.txtC:\Windows\System32\notepad.exe—Roblox Evon Exploit V4 UWP_23165.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\notepad.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\rpcrt4.dll
1208"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\gdi32.dll
1556timeout 1C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
1604C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\H2OCleanup.bat""C:\Windows\System32\cmd.exe—setup23165.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2096find /I "3900"C:\Windows\System32\find.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (grep) Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\find.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\ulib.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\gdi32.dll
2160tasklist /FI "PID eq 3572" /fo csv C:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Lists the current running tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2288C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\H2OCleanup.bat""C:\Windows\System32\cmd.exe—OfferInstaller.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2368find /I "3572"C:\Windows\System32\find.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (grep) Utility
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\find.exe
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
2448tasklist /FI "PID eq 3900" /fo csv C:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Lists the current running tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\tasklist.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
Total events
21 063
Read events
20 858
Write events
202
Delete events
3

Modification events

(PID) Process:(2696) Roblox Evon Exploit V4 UWP_23165.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2696) Roblox Evon Exploit V4 UWP_23165.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000004F010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2696) Roblox Evon Exploit V4 UWP_23165.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2696) Roblox Evon Exploit V4 UWP_23165.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2696) Roblox Evon Exploit V4 UWP_23165.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2696) Roblox Evon Exploit V4 UWP_23165.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2696) Roblox Evon Exploit V4 UWP_23165.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2696) Roblox Evon Exploit V4 UWP_23165.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3572) setup23165.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager
Operation:writeName:PendingFileRenameOperations
Value:
\??\C:\Users\admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\ServiceHide.dll
(PID) Process:(3572) setup23165.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
23
Suspicious files
12
Text files
33
Unknown types
1

Dropped files

PID
Process
Filename
Type
3572setup23165.exeC:\Users\admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\ServiceHide.dllexecutable
MD5:72990C7E32EE6C811EA3D2EA64523234
SHA256:E77E0B4F2762F76A3EAAADF5A3138A35EC06ECE80EDC4B3396DE7A601F8DA1B3
2696Roblox Evon Exploit V4 UWP_23165.exeC:\Users\admin\AppData\Local\setup23165.exeexecutable
MD5:29D3A70CEC060614E1691E64162A6C1E
SHA256:CC70B093A19610E9752794D757AEC9EF07CA862EA9267EC6F9CC92B2AA882C72
3572setup23165.exeC:\Users\admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\Ninject.dllexecutable
MD5:8DB691813A26E7D0F1DB5E2F4D0D05E3
SHA256:3043A65F11AC204E65BCA142FF4166D85F1B22078B126B806F1FECB2A315C701
3572setup23165.exeC:\Users\admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OModels.dllexecutable
MD5:C06AC6DCFA7780CD781FC9AF269E33C0
SHA256:B23B8310265C14D7E530B80DEFC6D39CDC638C07D07CD2668E387863C463741D
3572setup23165.exeC:\Users\admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\SciterWrapper.dllexecutable
MD5:105A9E404F7AC841C46380063CC27F50
SHA256:69FE749457218EC9A765F9AAC74CAF6D4F73084CF5175D3FD1E4F345AF8B3B8B
3572setup23165.exeC:\Users\admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\msvcp140.dllexecutable
MD5:8FF1898897F3F4391803C7253366A87B
SHA256:51398691FEEF7AE0A876B523AEC47C4A06D9A1EE62F1A0AEE27DE6D6191C68AD
3572setup23165.exeC:\Users\admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\GenericSetup.LastScreen.dllexecutable
MD5:6E001F8D0EE4F09A6673A9E8168836B6
SHA256:6A30F9C604C4012D1D2E1BA075213C378AFB1BFCB94276DE7995ED7BBF492859
3572setup23165.exeC:\Users\admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\GenericSetup.dllexecutable
MD5:08112F27DCD8F1D779231A7A3E944CB1
SHA256:11C6A8470A3F2B2BE9B8CAFE5F9A0AFCE7303BFD02AB783A0F0EE09A184649FA
3572setup23165.exeC:\Users\admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OServices.dllexecutable
MD5:6DF226BDA27D26CE4523B80DBF57A9EA
SHA256:17D737175D50EEE97AC1C77DB415FE25CC3C7A3871B65B93CC3FAD63808A9ABC
3572setup23165.exeC:\Users\admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OUtilities.dllexecutable
MD5:9D2C520BFA294A6AA0C5CBC6D87CAEEC
SHA256:669C812CB8F09799083014A199B0DEEE10237C95FB49EE107376B952FEE5BD89
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
57
DNS requests
27
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2696
Roblox Evon Exploit V4 UWP_23165.exe
GET
200
35.190.60.70:80
http://dlsft.com/callback/info.php?id=23165
US
text
234 b
malicious
2696
Roblox Evon Exploit V4 UWP_23165.exe
POST
200
35.190.60.70:80
http://dlsft.com/callback/?channel=lLt76&id=23165&action=started
US
text
17 b
malicious
2696
Roblox Evon Exploit V4 UWP_23165.exe
POST
200
35.190.60.70:80
http://dlsft.com/callback/?channel=lLt76&id=23165&action=operagx-Shown
US
text
17 b
malicious
3912
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D
US
der
471 b
whitelisted
2696
Roblox Evon Exploit V4 UWP_23165.exe
GET
200
35.190.60.70:80
http://dlsft.com/callback/offers.php
US
text
17 b
malicious
3912
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
binary
1.47 Kb
whitelisted
2696
Roblox Evon Exploit V4 UWP_23165.exe
GET
200
67.27.159.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?99f8e90799ad9ea9
US
compressed
4.70 Kb
whitelisted
2696
Roblox Evon Exploit V4 UWP_23165.exe
GET
200
67.27.159.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?8d57730f56edc8c6
US
compressed
62.3 Kb
whitelisted
2696
Roblox Evon Exploit V4 UWP_23165.exe
GET
200
23.37.41.57:80
http://x1.c.lencr.org/
NL
binary
717 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2696
Roblox Evon Exploit V4 UWP_23165.exe
35.190.60.70:443
www.dlsft.com
GOOGLE
US
whitelisted
3572
setup23165.exe
104.18.67.73:443
sos.adaware.com
CLOUDFLARENET
—
whitelisted
3572
setup23165.exe
104.17.8.52:443
flow.lavasoft.com
CLOUDFLARENET
—
shared
2696
Roblox Evon Exploit V4 UWP_23165.exe
188.114.97.3:443
filedm.com
CLOUDFLARENET
NL
malicious
2696
Roblox Evon Exploit V4 UWP_23165.exe
35.190.60.70:80
www.dlsft.com
GOOGLE
US
whitelisted
3572
setup23165.exe
104.18.68.73:443
sos.adaware.com
CLOUDFLARENET
—
whitelisted
2696
Roblox Evon Exploit V4 UWP_23165.exe
67.27.159.126:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious
2696
Roblox Evon Exploit V4 UWP_23165.exe
104.21.12.132:443
www.biphic.com
CLOUDFLARENET
—
unknown
2696
Roblox Evon Exploit V4 UWP_23165.exe
23.201.254.55:80
x2.c.lencr.org
AKAMAI-AS
CH
unknown

DNS requests

Domain
IP
Reputation
www.dlsft.com
  • 35.190.60.70
malicious
dns.msftncsi.com
  • 131.107.255.255
shared
www.google.com
  • 172.217.18.4
malicious
flow.lavasoft.com
  • 104.17.8.52
  • 104.17.9.52
whitelisted
sos.adaware.com
  • 104.18.67.73
  • 104.18.68.73
whitelisted
dlsft.com
  • 35.190.60.70
malicious
filedm.com
  • 188.114.97.3
  • 188.114.96.3
malicious
sdl.adaware.com
  • 104.18.67.73
  • 104.18.68.73
whitelisted
www.biphic.com
  • 104.21.12.132
  • 172.67.152.108
unknown
ctldl.windowsupdate.com
  • 67.27.159.126
  • 67.27.157.254
  • 67.27.158.254
  • 8.241.123.126
  • 8.253.95.120
whitelisted

Threats

Found threats are available for the paid subscriptions
6 ETPRO signatures available at the full report
Process
Message
setup23165.exe
setup23165.exe
Error: File not found - sciterwrapper:console.tis
setup23165.exe
at sciter:init-script.tis
setup23165.exe
setup23165.exe
file:resources/tis/TranslateOfferTemplate.tis(82) : warning :'async' does not contain any 'await'
setup23165.exe
setup23165.exe
Error: File not found - sciterwrapper:console.tis
setup23165.exe
at sciter:init-script.tis
setup23165.exe
setup23165.exe
file:resources/tis/TranslateOfferTemplate.tis(82) : warning :'async' does not contain any 'await'
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Roblox Evon Exploit V4 UWP_23165.exe