analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

RobloxPlayerLauncher.rar

Full analysis: https://app.any.run/tasks/15c47392-f814-46fe-814f-a008b619842a
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: December 14, 2018, 11:01:15
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
miner
loader
trojan
rat
njrat
bladabindi
imminent
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

72F4F4896B1698AF86F04651B8390197

SHA1:

F74CBA99A3B8E69947072FDB4086EEFEE5AA6B7A

SHA256:

2BB52418E9EC444EFEFF78234A36836FF2F373033E4ECA860D0ED2BC86547073

SSDEEP:

98304:NVgYSenC1tMyFLKPmliOGlc8/Bkwg7OxgHjqbM1jgFVcRpj4PmIUK:NVgYSeC1tMqWP7O+dBkwgaxgDq2jgFfp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Changes the autorun value in the registry

      • emp.exe (PID: 2484)
      • EMPRESA.exe (PID: 2728)
      • cscript.exe (PID: 3192)
      • wscript.exe (PID: 3460)
      • emp.exe (PID: 2892)
    • Uses Task Scheduler to run other applications

      • RobloxPlayerLauncher.exe (PID: 3860)
      • inm.exe (PID: 3340)
      • lim.exe (PID: 2604)
      • nja.exe (PID: 3744)
      • EMPRESA.exe (PID: 2728)
      • RobloxPlayerLauncher.exe (PID: 3332)
      • service.exe (PID: 3888)
      • SystemProcess.exe (PID: 4012)
      • lim.exe (PID: 2704)
      • data.exe (PID: 3204)
      • ipconfig.exe (PID: 3008)
      • service.exe (PID: 2384)
      • CheckNetIsolation.exe (PID: 3488)
      • data.exe (PID: 3520)
      • ipconfig.exe (PID: 2336)
      • service.exe (PID: 3476)
      • CheckNetIsolation.exe (PID: 2688)
      • data.exe (PID: 3360)
      • service.exe (PID: 1384)
      • data.exe (PID: 3172)
      • CheckNetIsolation.exe (PID: 3556)
      • ipconfig.exe (PID: 2132)
      • ipconfig.exe (PID: 3824)
      • SystemProcess.exe (PID: 3232)
      • CheckNetIsolation.exe (PID: 2444)
      • service.exe (PID: 2392)
    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 3256)
      • schtasks.exe (PID: 3552)
      • schtasks.exe (PID: 2796)
      • schtasks.exe (PID: 2344)
      • schtasks.exe (PID: 3160)
      • schtasks.exe (PID: 2776)
      • schtasks.exe (PID: 2172)
      • schtasks.exe (PID: 3396)
      • schtasks.exe (PID: 2404)
      • schtasks.exe (PID: 3196)
      • schtasks.exe (PID: 2060)
      • schtasks.exe (PID: 2424)
      • schtasks.exe (PID: 3712)
      • schtasks.exe (PID: 2948)
      • schtasks.exe (PID: 3752)
      • schtasks.exe (PID: 2900)
      • schtasks.exe (PID: 3100)
      • schtasks.exe (PID: 2872)
      • schtasks.exe (PID: 3344)
      • schtasks.exe (PID: 2944)
      • schtasks.exe (PID: 2644)
      • schtasks.exe (PID: 2632)
      • schtasks.exe (PID: 3036)
      • schtasks.exe (PID: 2368)
      • schtasks.exe (PID: 3044)
      • schtasks.exe (PID: 3440)
      • schtasks.exe (PID: 2112)
      • schtasks.exe (PID: 3676)
      • schtasks.exe (PID: 3688)
    • Application was dropped or rewritten from another process

      • emp.exe (PID: 2484)
      • RobloxPlayerLauncher.exe (PID: 3860)
      • RobloxPlayerLauncher.exe (PID: 3564)
      • nja.exe (PID: 3744)
      • RobloxPlayerLauncher.exe (PID: 3748)
      • EMPRESA.exe (PID: 2728)
      • lim.exe (PID: 2604)
      • inm.exe (PID: 3340)
      • wou.exe (PID: 3124)
      • QPGYPHUVT.exe (PID: 2156)
      • data.exe (PID: 3988)
      • RobloxPlayerLauncher.exe (PID: 3332)
      • ipconfig.exe (PID: 3900)
      • RobloxPlayerLauncher.exe (PID: 3028)
      • wou.exe (PID: 2804)
      • SystemProcess.exe (PID: 4012)
      • service.exe (PID: 3888)
      • CheckNetIsolation.exe (PID: 3940)
      • RBX-0882A6A7.tmp (PID: 3220)
      • RBX-0882A6A7.tmp (PID: 2248)
      • emp.exe (PID: 2892)
      • nja.exe (PID: 2736)
      • lim.exe (PID: 2704)
      • inm.exe (PID: 3836)
      • wou.exe (PID: 2672)
      • EMPRESA.exe (PID: 2180)
      • wou.exe (PID: 3712)
      • RobloxPlayerLauncher.exe (PID: 2788)
      • wou.exe (PID: 3400)
      • wou.exe (PID: 2304)
      • wou.exe (PID: 936)
      • wou.exe (PID: 3948)
      • RobloxPlayerLauncher.exe (PID: 3696)
      • data.exe (PID: 3204)
      • wou.exe (PID: 2336)
      • RBX-9E7BD255.tmp (PID: 3656)
      • CheckNetIsolation.exe (PID: 3488)
      • RBX-9E7BD255.tmp (PID: 3444)
      • service.exe (PID: 2384)
      • CheckNetIsolation.exe (PID: 3412)
      • ipconfig.exe (PID: 3008)
      • service.exe (PID: 3476)
      • data.exe (PID: 4008)
      • CheckNetIsolation.exe (PID: 2688)
      • ipconfig.exe (PID: 2336)
      • data.exe (PID: 3520)
      • data.exe (PID: 3360)
      • CheckNetIsolation.exe (PID: 3788)
      • ipconfig.exe (PID: 2132)
      • CheckNetIsolation.exe (PID: 3556)
      • data.exe (PID: 3172)
      • data.exe (PID: 3280)
      • service.exe (PID: 1384)
      • CheckNetIsolation.exe (PID: 2800)
      • CheckNetIsolation.exe (PID: 2444)
      • SystemProcess.exe (PID: 3232)
      • service.exe (PID: 2392)
      • CheckNetIsolation.exe (PID: 2664)
      • ipconfig.exe (PID: 3824)
    • MINER was detected

      • QPGYPHUVT.exe (PID: 2156)
    • Writes to a start menu file

      • cscript.exe (PID: 3192)
      • wscript.exe (PID: 3460)
    • Connects to CnC server

      • QPGYPHUVT.exe (PID: 2156)
      • RegAsm.exe (PID: 2264)
      • RegAsm.exe (PID: 3736)
    • Downloads executable files from the Internet

      • RobloxPlayerLauncher.exe (PID: 3028)
    • Changes settings of System certificates

      • RBX-0882A6A7.tmp (PID: 2248)
    • NJRAT was detected

      • RegAsm.exe (PID: 2264)
      • RegAsm.exe (PID: 3736)
      • RegAsm.exe (PID: 2264)
    • Known privilege escalation attack

      • data.exe (PID: 3204)
      • data.exe (PID: 3360)
    • Detected Imminent RAT

      • RegSvcs.exe (PID: 3272)
  • SUSPICIOUS

    • Creates files in the user directory

      • inm.exe (PID: 3340)
      • lim.exe (PID: 2604)
      • RobloxPlayerLauncher.exe (PID: 3860)
      • nja.exe (PID: 3744)
      • cscript.exe (PID: 3192)
      • RobloxPlayerLauncher.exe (PID: 3748)
      • RBX-0882A6A7.tmp (PID: 2248)
      • lim.exe (PID: 2704)
      • RegSvcs.exe (PID: 3272)
    • Executable content was dropped or overwritten

      • RobloxPlayerLauncher.exe (PID: 3860)
      • inm.exe (PID: 3340)
      • emp.exe (PID: 2484)
      • lim.exe (PID: 2604)
      • nja.exe (PID: 3744)
      • EMPRESA.exe (PID: 2728)
      • RobloxPlayerLauncher.exe (PID: 3028)
      • RobloxPlayerLauncher.exe (PID: 3332)
      • emp.exe (PID: 2892)
      • RBX-0882A6A7.tmp (PID: 2248)
      • lim.exe (PID: 2704)
      • RobloxPlayerLauncher.exe (PID: 3696)
      • CheckNetIsolation.exe (PID: 3488)
      • CheckNetIsolation.exe (PID: 2688)
      • CheckNetIsolation.exe (PID: 3556)
      • CheckNetIsolation.exe (PID: 2444)
    • Application launched itself

      • RobloxPlayerLauncher.exe (PID: 3860)
      • wou.exe (PID: 3124)
      • RobloxPlayerLauncher.exe (PID: 3564)
      • RobloxPlayerLauncher.exe (PID: 3748)
      • RBX-0882A6A7.tmp (PID: 2248)
      • wou.exe (PID: 2672)
      • RobloxPlayerLauncher.exe (PID: 3332)
      • RBX-9E7BD255.tmp (PID: 3656)
      • CheckNetIsolation.exe (PID: 3488)
      • CheckNetIsolation.exe (PID: 2688)
      • CheckNetIsolation.exe (PID: 3556)
      • CheckNetIsolation.exe (PID: 2444)
    • Executes scripts

      • wou.exe (PID: 2804)
      • cscript.exe (PID: 3192)
    • Connects to unusual port

      • QPGYPHUVT.exe (PID: 2156)
      • RobloxPlayerLauncher.exe (PID: 3748)
      • wscript.exe (PID: 3460)
      • RegAsm.exe (PID: 3736)
      • RegAsm.exe (PID: 2264)
      • RegSvcs.exe (PID: 3272)
    • Starts application with an unusual extension

      • RobloxPlayerLauncher.exe (PID: 3028)
      • RBX-0882A6A7.tmp (PID: 2248)
      • RBX-9E7BD255.tmp (PID: 3656)
      • RobloxPlayerLauncher.exe (PID: 3696)
    • Adds / modifies Windows certificates

      • RBX-0882A6A7.tmp (PID: 2248)
    • Modifies the open verb of a shell class

      • RBX-0882A6A7.tmp (PID: 2248)
      • data.exe (PID: 3204)
      • data.exe (PID: 3360)
    • Uses NETSH.EXE for network configuration

      • RegAsm.exe (PID: 2264)
    • Creates files in the program directory

      • RBX-0882A6A7.tmp (PID: 2248)
  • INFO

    • Application was crashed

      • SystemProcess.exe (PID: 4012)
      • SystemProcess.exe (PID: 3232)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
192
Monitored processes
113
Malicious processes
22
Suspicious processes
22

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start winrar.exe no specs robloxplayerlauncher.exe schtasks.exe no specs emp.exe inm.exe lim.exe nja.exe empresa.exe wou.exe no specs robloxplayerlauncher.exe schtasks.exe no specs schtasks.exe no specs robloxplayerlauncher.exe no specs #NJRAT regasm.exe wou.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs cscript.exe #MINER qpgyphuvt.exe robloxplayerlauncher.exe wscript.exe rbx-0882a6a7.tmp robloxplayerlauncher.exe systemprocess.exe data.exe no specs ipconfig.exe no specs service.exe no specs checknetisolation.exe no specs schtasks.exe no specs schtasks.exe no specs rbx-0882a6a7.tmp no specs schtasks.exe no specs schtasks.exe no specs regasm.exe no specs emp.exe inm.exe no specs lim.exe nja.exe no specs wou.exe no specs empresa.exe no specs robloxplayerlauncher.exe robloxplayerlauncher.exe no specs schtasks.exe no specs #NJRAT regasm.exe #IMMINENT regsvcs.exe regasm.exe no specs wou.exe no specs wou.exe no specs wou.exe no specs wou.exe no specs wou.exe no specs wou.exe no specs rbx-9e7bd255.tmp rbx-9e7bd255.tmp netsh.exe no specs service.exe no specs checknetisolation.exe data.exe no specs ipconfig.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs checknetisolation.exe no specs schtasks.exe no specs regasm.exe no specs eventvwr.exe no specs taskmgr.exe no specs regsvcs.exe no specs eventvwr.exe data.exe no specs schtasks.exe no specs data.exe no specs service.exe no specs checknetisolation.exe ipconfig.exe no specs wmiapsrv.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs checknetisolation.exe no specs regasm.exe no specs regasm.exe no specs regsvcs.exe no specs data.exe no specs service.exe no specs checknetisolation.exe ipconfig.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs checknetisolation.exe no specs eventvwr.exe no specs regasm.exe no specs eventvwr.exe data.exe no specs schtasks.exe no specs regsvcs.exe no specs regasm.exe no specs data.exe no specs service.exe no specs checknetisolation.exe systemprocess.exe ipconfig.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs regasm.exe no specs checknetisolation.exe no specs wmiapsrv.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3568"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\RobloxPlayerLauncher.rar"C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3860"C:\Users\admin\Desktop\RobloxPlayerLauncher\RobloxPlayerLauncher.exe" C:\Users\admin\Desktop\RobloxPlayerLauncher\RobloxPlayerLauncher.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
3256"C:\Windows\System32\schtasks.exe" /create /tn alg /tr "C:\Users\admin\AppData\Roaming\wpnpinst\CheckNetIsolation.exe" /sc minute /mo 1 /FC:\Windows\System32\schtasks.exeRobloxPlayerLauncher.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2484"C:\Users\admin\AppData\Local\Temp\emp.exe" C:\Users\admin\AppData\Local\Temp\emp.exe
RobloxPlayerLauncher.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Win32 Cabinet Self-Extractor
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
3340"C:\Users\admin\AppData\Local\Temp\inm.exe" C:\Users\admin\AppData\Local\Temp\inm.exe
RobloxPlayerLauncher.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
2604"C:\Users\admin\AppData\Local\Temp\lim.exe" C:\Users\admin\AppData\Local\Temp\lim.exe
RobloxPlayerLauncher.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
3744"C:\Users\admin\AppData\Local\Temp\nja.exe" C:\Users\admin\AppData\Local\Temp\nja.exe
RobloxPlayerLauncher.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
2728C:\Users\admin\AppData\Local\Temp\IXP000.TMP\EMPRESA.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\EMPRESA.exe
emp.exe
User:
admin
Integrity Level:
HIGH
Description:
Version:
0.0.0.0
3124"C:\Users\admin\AppData\Local\Temp\wou.exe" C:\Users\admin\AppData\Local\Temp\wou.exeRobloxPlayerLauncher.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
3028"C:\Users\admin\AppData\Local\Temp\RobloxPlayerLauncher.exe" C:\Users\admin\AppData\Local\Temp\RobloxPlayerLauncher.exe
RobloxPlayerLauncher.exe
User:
admin
Company:
Roblox Corporation
Integrity Level:
HIGH
Description:
Roblox
Exit code:
0
Version:
1, 6, 3, 166809
Total events
4 167
Read events
3 781
Write events
0
Delete events
0

Modification events

No data
Executable files
44
Suspicious files
95
Text files
1 701
Unknown types
169

Dropped files

PID
Process
Filename
Type
3568WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3568.31054\RobloxPlayerLauncher\Bunifu_UI_v1.5.3.dll
MD5:
SHA256:
3568WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3568.31054\RobloxPlayerLauncher\Depression.exe
MD5:
SHA256:
3568WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3568.31054\RobloxPlayerLauncher\Newtonsoft.Json.dll
MD5:
SHA256:
3568WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3568.31054\RobloxPlayerLauncher\RobloxPlayerLauncher.exe
MD5:
SHA256:
3564RobloxPlayerLauncher.exeC:\Users\admin\AppData\Local\Temp\XX--XX--XX.txtbinary
MD5:80C322B088B28BE37E41AE3DF0B5D330
SHA256:8A5B122A47A861DB0971E92894DBF0DF5395C4100775437A34A181649181B1D3
2484emp.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\EMPRESA.exeexecutable
MD5:CB01817E70589CFE4F970455BB6046DF
SHA256:5AD9DD29247485A357A931E1ED63C161E8A399E132AC5A42C82412B4AFCC3FEB
2728EMPRESA.exeC:\Users\admin\AppData\Local\QNENUQBFKGYRQKU\SystemProcess.exeexecutable
MD5:CB01817E70589CFE4F970455BB6046DF
SHA256:5AD9DD29247485A357A931E1ED63C161E8A399E132AC5A42C82412B4AFCC3FEB
3028RobloxPlayerLauncher.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\WindowsBootstrapperSettings[1]text
MD5:96D4DE88A0EF567A3F30CF131A71D6D9
SHA256:57FE9734C9C4CF4448C34E1E6F93FFE98949D9D7BE507E79AC2F3B339F2EC5CE
2804wou.exeC:\Users\admin\AppData\Local\Temp\5BB.tmp\5BC.tmp\5BD.vbsbinary
MD5:43D7FB8AEEEBFAD3C79DD7A8569901C3
SHA256:B04B7ACED940CD08CA23EFB939214D7F7463CAA35C5ACC4CF21D332F0D6DAC6B
3860RobloxPlayerLauncher.exeC:\Users\admin\AppData\Local\Temp\wou.exeexecutable
MD5:EA1DA64E8AC197DC4D4C1F3C39DC9EA6
SHA256:C28F840F358219502EB3CF6FE66457760BD6780BB6027EEB3DEADDF2DEE8B6D7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
33
TCP/UDP connections
159
DNS requests
66
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3028
RobloxPlayerLauncher.exe
GET
200
209.206.41.21:80
http://versioncompatibility.api.roblox.com/GetCurrentClientVersionUpload/?apiKey=76e5a40c-3ae1-4028-9f10-7c62520bd94f&binaryType=WindowsPlayer
US
text
26 b
whitelisted
3028
RobloxPlayerLauncher.exe
POST
200
209.206.41.228:80
http://www.roblox.com/game/report-stats?name=ClientBootstrapperDetailed_Duration&value=5829
US
whitelisted
3028
RobloxPlayerLauncher.exe
GET
200
205.234.175.102:80
http://setup.rbxcdn.com/version-d38201d3e9f24c12-RobloxPlayerLauncher.exe
US
executable
1.12 Mb
whitelisted
3028
RobloxPlayerLauncher.exe
POST
200
209.206.41.152:80
http://ephemeralcounters.api.roblox.com/v1.0/MultiIncrement/?apiKey=76E5A40C-3AE1-4028-9F10-7C62520BD94F
US
whitelisted
3028
RobloxPlayerLauncher.exe
GET
200
209.206.41.146:80
http://clientsettings.api.roblox.com/Setting/QuietGet/WindowsBootstrapperSettings/?apiKey=76E5A40C-3AE1-4028-9F10-7C62520BD94F
US
text
2.10 Kb
malicious
3696
RobloxPlayerLauncher.exe
GET
200
209.206.41.146:80
http://clientsettings.api.roblox.com/Setting/QuietGet/WindowsBootstrapperSettings/?apiKey=76E5A40C-3AE1-4028-9F10-7C62520BD94F
US
text
2.10 Kb
malicious
2248
RBX-0882A6A7.tmp
GET
200
209.206.41.146:80
http://clientsettings.api.roblox.com/Setting/QuietGet/WindowsBootstrapperSettings/?apiKey=76E5A40C-3AE1-4028-9F10-7C62520BD94F
US
text
2.10 Kb
malicious
3028
RobloxPlayerLauncher.exe
GET
200
209.206.41.228:80
http://www.roblox.com/Game/JoinRate.ashx?c=ClientBootstrapperDetailed&r=Success&d=5829&platform=Win32
US
whitelisted
3028
RobloxPlayerLauncher.exe
POST
200
209.206.41.152:80
http://ephemeralcounters.api.roblox.com/v1.0/MultiIncrement/?apiKey=76E5A40C-3AE1-4028-9F10-7C62520BD94F
US
whitelisted
3028
RobloxPlayerLauncher.exe
POST
200
209.206.41.152:80
http://ephemeralcounters.api.roblox.com/v1.0/MultiIncrement/?apiKey=76E5A40C-3AE1-4028-9F10-7C62520BD94F
US
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2248
RBX-0882A6A7.tmp
209.206.41.146:80
clientsettings.api.roblox.com
Roblox
US
unknown
3028
RobloxPlayerLauncher.exe
209.206.41.228:80
www.roblox.com
Roblox
US
unknown
2248
RBX-0882A6A7.tmp
209.206.41.21:443
versioncompatibility.api.roblox.com
Roblox
US
suspicious
3028
RobloxPlayerLauncher.exe
209.206.41.21:80
versioncompatibility.api.roblox.com
Roblox
US
suspicious
3028
RobloxPlayerLauncher.exe
205.234.175.102:80
setup.rbxcdn.com
CacheNetworks, Inc.
US
suspicious
2156
QPGYPHUVT.exe
80.188.53.27:5555
xmr.bohemianpool.com
O2 Czech Republic, a.s.
CZ
suspicious
3748
RobloxPlayerLauncher.exe
88.5.62.76:1978
redloca.hopto.org
Telefonica De Espana
ES
malicious
3028
RobloxPlayerLauncher.exe
209.206.41.152:80
ephemeralcounters.api.roblox.com
Roblox
US
suspicious
3028
RobloxPlayerLauncher.exe
209.206.41.146:80
clientsettings.api.roblox.com
Roblox
US
unknown
3460
wscript.exe
88.5.62.76:1000
redloca.hopto.org
Telefonica De Espana
ES
malicious

DNS requests

Domain
IP
Reputation
clientsettings.api.roblox.com
  • 209.206.41.146
malicious
ephemeralcounters.api.roblox.com
  • 209.206.41.152
whitelisted
versioncompatibility.api.roblox.com
  • 209.206.41.21
whitelisted
xmr.bohemianpool.com
  • 80.188.53.27
suspicious
setup.roblox.com
  • 54.231.72.218
  • 52.216.21.141
shared
www.roblox.com
  • 209.206.41.228
whitelisted
setup.rbxcdn.com
  • 205.234.175.102
whitelisted
redloca.hopto.org
  • 88.5.62.76
unknown
s3.amazonaws.com
  • 52.216.138.14
  • 52.216.109.125
shared
pastebin.com
  • 104.20.209.21
  • 104.20.208.21
shared

Threats

PID
Process
Class
Message
2156
QPGYPHUVT.exe
Potential Corporate Privacy Violation
ET POLICY Cryptocurrency Miner Checkin
2156
QPGYPHUVT.exe
Misc activity
MINER [PTsecurity] CoinMiner CryptoNight XMRig JSON_RPC Client Login
2156
QPGYPHUVT.exe
Misc activity
MINER [PTsecurity] Riskware/CoinMiner JSON_RPC Response
2156
QPGYPHUVT.exe
Misc activity
MINER [PTsecurity] Risktool.W32.coinminer!c
3028
RobloxPlayerLauncher.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3028
RobloxPlayerLauncher.exe
Misc activity
ET INFO EXE - Served Inline HTTP
3696
RobloxPlayerLauncher.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3696
RobloxPlayerLauncher.exe
Misc activity
ET INFO EXE - Served Inline HTTP
2264
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] njRAT.Gen RAT outbound connection
2264
RegAsm.exe
A Network Trojan was detected
ET TROJAN Bladabindi/njRAT CnC Command (ll)
10 ETPRO signatures available at the full report
No debug info