Overview
overview
7Static
static
3Roblox_setup.exe
windows10-2004-x64
7Roblox_setup.exe
windows11-21h2-x64
4Microsoft....90.dll
windows10-2004-x64
3Microsoft....90.dll
windows11-21h2-x64
3Microsoft....90.dll
windows10-2004-x64
3Microsoft....90.dll
windows11-21h2-x64
3Microsoft....90.dll
windows10-2004-x64
3Microsoft....90.dll
windows11-21h2-x64
3Microsoft....90.dll
windows10-2004-x64
3Microsoft....90.dll
windows11-21h2-x64
3Microsoft....90.dll
windows10-2004-x64
3Microsoft....90.dll
windows11-21h2-x64
3Microsoft....90.dll
windows10-2004-x64
3Microsoft....90.dll
windows11-21h2-x64
3NPRobloxProxy.dll
windows10-2004-x64
3NPRobloxProxy.dll
windows11-21h2-x64
3OgreMain.dll
windows10-2004-x64
3OgreMain.dll
windows11-21h2-x64
3Plugin_CgP...er.dll
windows10-2004-x64
3Plugin_CgP...er.dll
windows11-21h2-x64
3Plugin_ParticleFX.dll
windows10-2004-x64
3Plugin_ParticleFX.dll
windows11-21h2-x64
3RenderSyst...D9.dll
windows10-2004-x64
3RenderSyst...D9.dll
windows11-21h2-x64
3RenderSystem_GL.dll
windows10-2004-x64
3RenderSystem_GL.dll
windows11-21h2-x64
3Roblox.exe
windows10-2004-x64
6Roblox.exe
windows11-21h2-x64
6RobloxApp.exe
windows10-2004-x64
4RobloxApp.exe
windows11-21h2-x64
4RobloxProxy.dll
windows10-2004-x64
3RobloxProxy.dll
windows11-21h2-x64
3Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/05/2026, 12:39
Behavioral task
behavioral1
Sample
Roblox_setup.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Roblox_setup.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
Microsoft.VC90.CRT/msvcm90.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
Microsoft.VC90.CRT/msvcm90.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
Microsoft.VC90.CRT/msvcp90.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
Microsoft.VC90.CRT/msvcp90.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
Microsoft.VC90.CRT/msvcr90.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
Microsoft.VC90.CRT/msvcr90.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
Microsoft.VC90.MFC/mfc90.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
Microsoft.VC90.MFC/mfc90.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
Microsoft.VC90.MFC/mfcm90.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
Microsoft.VC90.MFC/mfcm90.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
Microsoft.VC90.OPENMP/vcomp90.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
Microsoft.VC90.OPENMP/vcomp90.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
NPRobloxProxy.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
NPRobloxProxy.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
OgreMain.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
OgreMain.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
Plugin_CgProgramManager.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
Plugin_CgProgramManager.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
Plugin_ParticleFX.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
Plugin_ParticleFX.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
RenderSystem_Direct3D9.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
RenderSystem_Direct3D9.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral25
Sample
RenderSystem_GL.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
RenderSystem_GL.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral27
Sample
Roblox.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
Roblox.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral29
Sample
RobloxApp.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
RobloxApp.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral31
Sample
RobloxProxy.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
RobloxProxy.dll
Resource
win11-20260130-en
windows11-21h2-x64
General
- Target RobloxApp.exe
- Size 10.3MB
- Sample260502-pvsppafy4x
- SHA256 cf6647d8a1126f3add361a7e857d196353f4c13556fb35f1fec8a1260129febd
- MD5 a1dbbdc1985635caec4dc89495be2726
- SHA1 a7198d4dd9081580856267f75bfaf72a1bc1d30a
- SHA512 cac23e77089d0dded6866905920d473cbe755f8673b9768b4442b622bb6f63f8f577fcf62552f8995091e639cf6187ce5a41056efb05a3b4824d96ea7ef4301c
- SSDEEP 98304:JQ2fEUc5KIZnCQ1b6tBgjnzYHyXNv3snpohFyi2I+oTGL5dBFpr2dHRn+1eGg:JPw9nl1b66MSX2npohM1IZrOeGg
- TLSH T1F0B64B01F7A781F5C68621753DAE7B4E953AAD944B151BC3A26C3E0F3DB23C02CB615A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in Windows directory 6 IoCs
description ioc Process File created C:\Windows\INF\c_diskdrive.PNF RobloxApp.exe File created C:\Windows\INF\c_display.PNF RobloxApp.exe File created C:\Windows\INF\c_processor.PNF RobloxApp.exe File created C:\Windows\INF\c_monitor.PNF RobloxApp.exe File created C:\Windows\INF\c_volume.PNF RobloxApp.exe File created C:\Windows\INF\c_media.PNF RobloxApp.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RobloxApp.exe - Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 RobloxApp.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName RobloxApp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 RobloxApp.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName RobloxApp.exe - Checks processor information in registry 2 TTPs 11 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz RobloxApp.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5 RobloxApp.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6 RobloxApp.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\8 RobloxApp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString RobloxApp.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RobloxApp.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 RobloxApp.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 RobloxApp.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3 RobloxApp.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4 RobloxApp.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7 RobloxApp.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS RobloxApp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName RobloxApp.exe - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2 RobloxApp.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2\Blob = 5c0000000100000004000000000400007e0000000100000008000000000010c51e92d201620000000100000020000000e7685634efacf69ace939a6b255b7b4fabef42935b50a265acb5cb6027e44e7009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030119000000010000001000000091161b894b117ecdc257628db460cc04030000000100000014000000742c3192e607e424eb4549542be1bbc53e6174e21d000000010000001000000027b3517667331ce2c1e74002b5ff2298140000000100000014000000e27f7bd877d5df9e0a3f9eb4cb0e2ea9efdb69770b000000010000004600000056006500720069005300690067006e00200043006c006100730073002000330020005000750062006c006900630020005000720069006d00610072007900200043004100000004000000010000001000000010fc635df6263e0df325be5f79cd67670f0000000100000010000000d7c63be0837dbabf881d4fbf5f986ad853000000010000002400000030223020060a2b0601040182375e010130123010060a2b0601040182373c0101030200c07a000000010000000e000000300c060a2b0601040182375e010268000000010000000800000000003db65bd9d5012000000001000000400200003082023c308201a5021070bae41d10d92934b638ca7b03ccbabf300d06092a864886f70d0101020500305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479301e170d3936303132393030303030305a170d3238303830313233353935395a305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f7269747930819f300d06092a864886f70d010101050003818d0030818902818100c95c599ef21b8a0114b410df0440dbe357af6a45408f840c0bd133d9d911cfee02581f25f72aa84405aaec031f787f9e93b99a00aa237dd6ac85a26345c77227ccf44cc67571d239ef4f42f075df0a90c68e206f980ff8ac235f702936a4c986e7b19a20cb53a585e73dbe7d9afe244533dc7615ed0fa271644c652e816845a70203010001300d06092a864886f70d010102050003818100bb4c122bcf2c26004f1413dda6fbfc0a11848cf3281c67922f7cb6c5fadff0e895bc1d8f6c2ca851cc73d8a4c053f04ed626c076015781925e21f1d1b1ffe7d02158cd6917e3441c9c194439895cdc9c000f568d0299eda290454ce4bb10a43df032030ef1cef8e8c9518ce6629fe69fc07db7729cc9363a6b9f4ea8ff640d64 RobloxApp.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe 2352 RobloxApp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RobloxApp.exe"C:\Users\Admin\AppData\Local\Temp\RobloxApp.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2352
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\INF\c_volume.PNF
- Size 4KB
- SHA256 5744b2d174637272e8bd6be5540dbc2b0f8d94f20c3d7270a638ac3aee2c1ee5
- MD5 8391528ea7e3d5f9b86e5c36ca391e5c
- SHA1 aa97afa5eacea97fea87ba6d2eec8a9e91174c4b
- SHA512 9d4d4cc67a1337f6b71cdb73e908139edf79b24d0a0f20fe9fb95a638ac9e435b1040b88fef513b8e94458a01629c2a906235147ff87facf1f3325c9a53d54e9
- SSDEEP 48:+RBCCGz7ElZd/WyVL5KlMR7rYEEQ3IDbCRb7KVMRGGLp7tVCCHr6mv7C:2BhGzY/WyvrYKuCN7DLpxV3r6mvG
- TLSH T136915A59BBD58E24F27A9D35BDF460E746A6BC428C06DA5F3244330D0C72784E7B162B
- MD5 SHA1 SHA512 SSDEEP TLSH