home

roblox.exe

Leho

SetupSpeedy (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application roblox.exe, “Leho Setup ” by SetupSpeedy (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Sobodako   (signed by SetupSpeedy (Fried Cookie Ltd))

Product:
Leho

Description:
Leho Setup

MD5:
b04584d0a8612a6b6c55009941b4e468

SHA-1:
693cd9a2278819889fb68a688816577f0103df53

SHA-256:
966fc237aa7fe7e6535ba806d754566794caf90dbae6daa4c82364693abf07ba

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/24/2024 8:54:39 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC.Installer (M)
16.3.8.20

File size:
1011.4 KB (1,035,712 bytes)

Product version:
2.2.6

Copyright:
Web Lite

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Swedish (Sweden)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\roblox.exe

Digital Signature
Signed by:
SetupSpeedy (Fried Cookie Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 2:09:36 PM

Valid to:
6/8/2016 5:12:50 PM

Subject:
CN=SetupSpeedy (Fried Cookie Ltd), O=SetupSpeedy (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121EF8B655959B1CFE34F05FAFC8D598305

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:LxSG+tVxyzWedCCktHLrAaVTdbuvePvmU1BgPBU2B+AM0sLJ:LMfTcpk1wauePvmMBgP1BViJ

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file roblox.exe has been seen being distributed by the following 15 URLs.

http://www.bitssigncurrent.com/c?x=44Frxp8gTWhil16kVz/ZoZ8oz1S0Yh1hMN5aHjlCByc=&c=F1m0SrHv81yVnmC2ULyHPjnE NrYQuhzALhayMGYlFy2QHs2a9YF07DBPs MDV7/O47 yrLQzw7L/7h3m4SWf3qHm0FNI/64Xb/Su3pHsfIssupVaAazTJKEiyqzvdarVKGru /7E6El5fvUKX/Mn2YzeVyPUaDy 2xglWbAogU=&e=0&fallback_url=https://secure.inndl.com/.../roblox.exe

http://www.bitssigncurrent.com/c?x=CkJcoyWXpGQPf5T6pirKUcRBdcaEATNoBpJd919uPSo=&c=C3JRhT03hGK7F1iz/m TH0z8XTZlCOWJm6vdr2dolkCmnoHKytHYTjX wDeZnpac0P7oGZLjM1aGgWbvbFPGAD303JVLIQDN9LPWTw46trKQKW0I/LcY4zZOHcolZCf96aI9tQrR8fDOyUx8z1VDjQ1cPWhDjBcIVfJUAuWzdho=&e=0&fallback_url=https://secure.inndl.com/.../roblox.exe

http://www.bitssigncurrent.com/c?x=j tAuyZLOGnykZ2LIT1YIZuydN5HCXqCjaMfZSKiIoM=&c=iakvvlMbqCLCkWg1TnbaDQ6KzcwMcKwpdKtG6TOlKmYaU038az90OEMRcMb3 IUbawKdlfPYaPXda5lYRXvtDphA99NncnFXWhlWSQobdrFd32wgiMs5SrAcmkUn3iyXyvqO3hsCIwqimwOwbgMVor2NXzGpMtcFDk1RQzb4Ivw=&e=0&fallback_url=https://secure.inndl.com/.../roblox.exe

http://www.hostsendcycle.com/c?x=0xv1uHA6og0Pv Skqrl cFPqIKM1ay6UAqS/c0gxAsU=&c=sC2IaxaiSCSffxg94DkNBYrUc/Jl9J2tL/z70XLgXjxuPnQ8sT1cJsdErRb30lQoApaPG155rGVctCJIjgm8M9o5qbQkKO8WzcAllJVeJHnLftIyQf2BSCacjcsOGG5s5RVILEB5462uaAhTMmOZB3I7DGEYcOyUoB7yJn97zSs=&e=0&fallback_url=https://secure.inndl.com/.../roblox.exe

http://www.bitssigncurrent.com/c?x=vK6/Hwq4W3pMuvh8fADgYt/o/Kr8F5TFlpCrXAJPmMA=&c=V/y /th4kKsTmJvRVG 7YfqP7n5pfBdvWK0bfwCIoZT4gKF3CRDHY4UIhvshOWMtXyy6xinv7Ap9rLe5xGkENEuS3yP18q0ysn/rTx6O6s270MF4OkzaCaIVamdCAiKqEcA7LiERe2uDu70Bs/0U6Lvr4sLIZ03og4Wps5FO5XY=&e=0&fallback_url=https://secure.inndl.com/.../roblox.exe

http://www.bitssigncurrent.com/WVl6OTRQV3BSVFV3bE1rWjBSV3QxTVRJbE1rWlVNbnAwWjFabmVYbGhWSHBLV1ROdFlrZE5UMVl6YjFrME1XODFNR05KSlRORUptTTllVU52SlRKQ04zTkdSR2xXUTNOWFNURjViVnBhYzA5cU5rNURlRXBJSlRKQ2NWaE1kM0J6VEc1WmRHWTNkMHhRTXpseFZsSjBjRXczZEdrd1VFeHdVRE5KWjJoSmJWSjNibWhGTXpOcVJGVlBVV0pNYjNSeWJIaEVla2hVTUdaMlVVVnBTamRpVkU1SU0wSjNjWFpXYnlVeVFsZ3hjRlZ6V1VoTmNrUllVMmd6V1dkeFNDVXlRbGxTU1ZCNVoyODRlREJvY2pGQlREbGhSRGxNYjBFbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd2N5VXpRU1V5UmlVeVJuTmxZM1Z5WlM1cGJtNWtiQzVqYjIwbE1rWlZVeVV5Um5KdllteHZlQzVsZUdVbE0wWnpkQ1V6UkdSbVJ6WkNhRXc0WDFodllXUXdNM1JIVURGWlJrRWxNalpsSlRORU1UUTFPVFEwTkRBek5TWmtiM2R1Ykc5aFpFRnpQWEp2WW14dmVDNWxlR1U9

http://www.bitssigncurrent.com/c?x=JrrJw4Rgb/vcnY9Y1LhDiCdJKDYvvyi4yKVyPWRbF64=&c=rzA1Ws 74bEFmDLhwQltFd9gIhrMULKrivlp7k5d5U5d0hSdaQenbmzAh3fCjTLDUuNQpRsIhOIT0JufD9Va3LjH/ MFnINJT5WsCKx0wBEYkXuKWcAi8cXqDjy2 8WFNVWR9MVeQ7MczZVdLQ7czyppVFJpAgS9UCIxsKSX4Kc=&e=0&fallback_url=https://secure.inndl.com/.../roblox.exe

http://www.bitssigncurrent.com/c?x=yf/mxy2Sv64T6LvJZz9pE25GhTKFrln0lOyRT5P41p4=&c=2nZ2FyfV/8A6rf1uYQMEavWvW4mGndXhgLw hte9CUGvqa2eGSUx3lWV5evtXbfsqzauwXKbyZDO37WKhIypnXDyNCjQB749sFTt7S6AV8gvIS SH/CJXGsEvgpu0UX3isCLLw8kG7fOZIePxurMl tzos2z8esD3 9868APBNg=&e=0&fallback_url=https://secure.inndl.com/.../roblox.exe

http://www.bitssigncurrent.com/WVl6OTRQVWR4VGpGU2RsaG5lSEZGYlU5UFFWazJka2QwY2taV1NXZEpRa3BCUTNwdVJVaElUbk5oZVRONWVEUWxNMFFtWXoxSVl6TmthM2xUUzB4dlUyRm9UMVpoSlRKQ1dHeFVNblJQU0NVeVFqUjZNbmhNUlRWMldrRnpWVmxLYUdWM2RHZFRRa0pRTm5aYWVrWWxNa0pZSlRKR1ExZFFaWHBKU0RCelpUVjVibEIzYVZWbFlUQmhlVVpMVEU5V01YcFBWbkJhYkhKMkpUSkNTRU52VDFKb2RXdHhTSEpvWlVKb1dsSnFNRVI1WTNONk4yMXFNMWxtUkhjNWIweHdURkZoU3paNlpVOTRUMjVwTUV4UE1sTnJSREJSSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0hNbE0wRWxNa1lsTWtaelpXTjFjbVV1YVc1dVpHd3VZMjl0SlRKR1ZWTWxNa1p5YjJKc2IzZ3VaWGhsSlROR2MzUWxNMFJGUXpkMVFsY3hjR016WmxkaE0yVkdUMVJKVmxsbkpUSTJaU1V6UkRFME5Ua3lOelE1TVRNbVpHOTNibXh2WVdSQmN6MXliMkpzYjNndVpYaGw=

http://www.bitssigncurrent.com/c?x=P5H0xFN4hS74eeZbXMgkCOFHJtuzpb1dmASQVaBdtHk=&c=0TlIfee5HqYTb31QKavmH07FN1a0yxMdjf3TTNx /2NFwPEfsHOx6HOaMqrOuUPpruS3f U/ObsvyLm 2u0CEaat0XJc PPMhQP5wFQfsYBQpiRBghCEHNgtRf4PACPIP7P2bSkJGXgLnUxQLlShXjXr1xaIxCA8mW513qCbJS8=&e=0&fallback_url=https://secure.inndl.com/.../roblox.exe

http://www.bitssigncurrent.com/c?x=WtmWwT69JnRITacMK/tQ7nd a eAnV4OEYHjJbyjItE=&c=XKMCrWs0oujaq9u 9EUSKc9MV2z7fbUtvGLzcfkSOu xROc3 pXlC8ueoNcBTd4HYIx94YydUzEH4DyIp3zzy psNa/2 TnIx3FpkvojRXccuepD0mbP4Ue z OXTgtLQKoY /Iz9bhGIna6Q0WO8N9jugsAmuLLhqMsTdwOro0=&e=0&fallback_url=https://secure.inndl.com/.../roblox.exe

http://www.bitssigncurrent.com/c?x=mjEa5mUxfFYOt/TkRRtI0l2ZpN0JIWDomDuzftHz9JA=&c=IikSon0JmvDxQpn/rqfVGOMJyxfTUM11KbiSD6g/E0DK2ngtapZ8jJ6GokD4Ncwz8FKYSqyOnANbHDUAN9zGCQMrrYfndUG1mL4vYh l9n/YyHG81J/5n9ybC/OORGmOrE6IgMBojEly4Yp/VWfz2yEtrRdRNGNhLSYs9zKC6TI=&e=0&fallback_url=https://secure.inndl.com/.../roblox.exe

http://www.hostsendcycle.com/c?x=I5ILvbfowf 2rrANdA67gLVw7cqnUeE3znk0W8dSPUg=&c=Z14ufPo9Ejr8eeQMQItLEFHl5pnhUzYSeKyvRp2R3ccPIoqPA44dKDZHA7Dh/mTjcSRO/2zobujh6tQ342FFJ/nf9g0D9sbDr1RNn RsVsa5H/7ifAQVHewfIMry4IDN3RkDk/TGR7Cc8YLUn/3jFK0Mn92 7sb eU8Fnk2PVDU=&e=0&fallback_url=https://secure.inndl.com/.../roblox.exe

http://www.bitssigncurrent.com/WVl6OTRQVXRXT0hGTU0zTklaRmcxVmxKSVJITlBha1Y1VTNabFlraFlKVEpHYlhaMVVXYzRXV0pJTUc5dlNHZHpVU1V6UkNaalBXeGphRFUxY2pWMlpVOVNSRXRsSlRKQ2RWZG5WemhFWTBkVE9FTkRNMU5RUW5RbE1rWlpVamR0U0ZkU01DVXlSa1JDT1hCNkpUSkNNVk5tSlRKQ1VVVTJabWRPTmtSclQyRXdjVkpJVUNVeVFtMUVkVzlZVGpKM1VsZGtZMjQ0TkVaRE9IaG9ZMmxTZDB4S1dsSlljVE5tYldjeFExWkhRa1ZYYURSUVJIQjJOMVJoUzNaa1pXbzJORlpXVVhaYWFWWmlSMUZGTkd0T0pUSkdNMUIzY2xadGNIbDNKVE5FSlRORUptVTlNQ1ptWVd4c1ltRmphMTkxY213OWFIUjBjSE1sTTBFbE1rWWxNa1p6WldOMWNtVXVhVzV1Wkd3dVkyOXRKVEpHVlZNbE1rWnliMkpzYjNndVpYaGxKVE5HYzNRbE0wUXlXVjlSVFdWbk1tVmpVRzFYY2xGVExXUXhaM0pCSlRJMlpTVXpSREUwTlRnM01qUXdOVEltWkc5M2JteHZZV1JCY3oxeWIySnNiM2d1WlhobA==

http://www.bitssigncurrent.com/WVl6OTRQVWQzVmpWVWNWZFVTMDA0YzJWMFNrSkpiVWRPV0U4M1luWkxiRUpEUmpKR1lsRTBWbTFWU1RCdFRWa2xNMFFtWXoxWE1DVXlRa1UxVDNOdk5WWTJZVFZMU0dOd1RWQWxNa1pUU0haVWVEaEliREJUUVZselVXdzFTV0VsTWtKSFYzTmFXV0VsTWtJeWJXVnNiMjFHSlRKR1MwRm1WMEpYVjBJMFFXcHZVbTh3UkdWRlUydFhRVzl4U1RKdFZXSmFiVWxHUkV0d1owUnFPVlpXUVZCUFFuaEVTazVxVFNVeVFrUlhkRnBqZUU5bk1UQTViVXBqTWt4Rk4wWm9aamRHWlhKSldIbFZibTFXTUhKeFVHbGxiVU52ZEZFbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd2N5VXpRU1V5UmlVeVJuTmxZM1Z5WlM1cGJtNWtiQzVqYjIwbE1rWlZVeVV5Um5KdllteHZlQzVsZUdVbE0wWnpkQ1V6UkhaQ0xUaDBjRFZUWHpCV1JuRlNhRzUzUkVocGJsRWxNalpsSlRORU1UUTFPRGMyTnpJeE9TWmtiM2R1Ykc5aFpFRnpQWEp2WW14dmVDNWxlR1U9

Remove roblox.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.