home

roblox.exe

Potirod

Gotume

The application roblox.exe, “Potirod Setup ” has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer, however the file is not signed with an authenticode signature from a trusted source. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Gotume

Product:
Potirod

Description:
Potirod Setup

Version:
3.7.5.8

MD5:
de13332869e86d3ef73a1e41914ed2ff

SHA-1:
95f3f431039450b1e2a9e10387808684e45694f9

SHA-256:
d05afc05993f1be4617555e522ec6371bed4416f84d03b7439cf11a6a22dac24

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
12/25/2024 5:58:32 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.11 (M)
16.3.8.7

File size:
998.3 KB (1,022,224 bytes)

Product version:
3.0.7

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\roblox.exe

File PE Metadata
Compilation timestamp:
6/20/1992 5:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:0DTzBO0t2dJwsOVpMfULVpafySzLBgbrR8QTXFUKqiDevQwNZ:0DvVtUSkfULvafpLcR9TmKDDeIIZ

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9078

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file roblox.exe has been seen being distributed by the following 18 URLs.

http://www.bitssigncurrent.com/WVl6OTRQVzAxYlhob1pVeFRUQ1V5UmpSbU4xQnFkVTVNZDNvd01VdHJTblJhY1RaRmNTVXlRbVoxU25kU1ZYaFZia2hWSlRORUptTTlhMGR1WkdveVR6aHRZbWg2VlZGb1JIcGlOV05NZGxJMlluQXhUSFp4WkNVeVFubExORGhCTnlVeVFtSlVZemxuWTJZM1pqZFJVakVsTWtabGQwRm5WVko0TlRsNUpUSkdVM1E1YTFaMWFUbHFhV1pSTVZZellVNW5iR05UWnpsbFZtazBPRk5OZVVwbmJtaFZia000ZEdwSlVrVm1VaVV5Um1Oa01YRk9RbTlGY2tkQmVHMTZUMWdsTWtZbE1rSklUblJ5Vm5walQyOVdWMHd3Ykdzek0zQmFPRkVsTTBRbE0wUW1aVDB3Sm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3Y3lVelFTVXlSaVV5Um5ObFkzVnlaUzVwYm01a2JDNWpiMjBsTWtaVlV5VXlSbkp2WW14dmVDNWxlR1VsTTBaemRDVXpSRmc0V2kxQlZGRmFjemRJWjFKdFNqWXplVWx0ZEZFbE1qWmxKVE5FTVRRMU9UQTVPVFF5TlNaa2IzZHViRzloWkVGelBYSnZZbXh2ZUM1bGVHVT0=

http://www.bitssigncurrent.com/WVl6OTRQV0ZvVDNCR1pGbEtVbVpHZFNVeVFqRmxRbVpwZVRWMmR5VXlSbVI0VEhSNVoxZHJhWHA1U0UxWWNIQkVjWEUwSlRORUptTTlTbEF3WkZFMlZXRktkRGR2SlRKR1JXRXpjRTFQYTFCeVN6SWxNa0kxWlRCbU9GbFlTRzA0WXpjeFIzTlNWVE5zYzIxck5EZEVOVTlhT1ZKNVduVnZNVE0zWkdkbFkwaExUM2x0WWsxTGEyYzJhRlVsTWtKbVZIWkNZbmx6WTA5SlJtSnRhQ1V5UW1zd0pUSkNNV0pyZFRsb01YSTNiRzhsTWtKRFEyWWxNa1pvWTBSeGNXWk5ZVEJuVVVoWU4yOVdNMk5yZERnbE1rSklhbWRJU1RsMk1VeENSMVE0ZHlVelJDVXpSQ1psUFRBbVptRnNiR0poWTJ0ZmRYSnNQV2gwZEhCekpUTkJKVEpHSlRKR2MyVmpkWEpsTG1sdWJtUnNMbU52YlNVeVJsVlRKVEpHY205aWJHOTRMbVY0WlNVelJuTjBKVE5FU21acGVucDBOV2hWZG5oWlZEbG1kVFpJTlhOQlVTVXlObVVsTTBReE5EVTVNREF4TWpRM0ptUnZkMjVzYjJGa1FYTTljbTlpYkc5NExtVjRaUT09

http://www.hostsendcycle.com/WVl6OTRQVzVSU0UxWE5XMDRSRVJ2V0d0SGFDVXlRa1J2ZG1OV01FMTRWbFZsUmxGd1dXRmxlbTlSY1VoR1FXeERXU1V6UkNaalBVVldZVFlsTWtKemNXSm9KVEpDYTNWVE1uZG9WamhWYVZWTWMwaHNVRFE0ZGpBeGJsaDNWazFhUjNRbE1rSlhjVU5SWTNOMFpDVXlRblJ1WTJWSllqVlpkM3BTUlVwMVdWUmFOU1V5UmpKMk5sRnlabE5SV21JMlFVbHJVa1Z1ZUUxellqZEJXbmhhWTNweU5IWjJUREpOTm5FMFoxTm9TVXBWWkZJMk16VkhTVVVsTWtKak5tdHVWbEJUTWpGRVNubFlUbnBPT0hwQ09FeDNRM05QWW5SamR5VXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQnpKVE5CSlRKR0pUSkdjMlZqZFhKbExtbHVibVJzTG1OdmJTVXlSbFZUSlRKR2NtOWliRzk0TG1WNFpTVXpSbk4wSlRORVVWZE9VVTlpTm1aS2VqUjVObWRQYWxwRU4wbHhRU1V5Tm1VbE0wUXhORFU0TkRBNU1UQTRKbVJ2ZDI1c2IyRmtRWE05Y205aWJHOTRMbVY0WlE9PQ==

http://www.vaultbitscapital.com/c?x=OPZ7aQHCVdfZXLnbb1tdMiuhGr2NYhqR8cNA0zXAEp0=&c=s60FYX4KZuzpX22 fb4ji0pnwJoK3K5DEresGD6X1dUB2OHkDrNEvVxsUXT2OsA3vJksQOgx6ICdI1CerWX55zTxHuEvte4X8DfZRy2 BatGne OXe1gJTkg88XiWXKuM40mQxdsLRcDG9CosJceQtED298OqIZGNYCzMyGj9oJRd8YiJO0Wcv8/ctJ7gXhp&e=0&fallback_url=https://secure.inndl.com/.../roblox.exe

http://www.hostsendcycle.com/WVl6OTRQVGR4UTBWb2NFRkhObE55YW5oeGJrTlZiMmRtZGpGdGJtNUtibnB5WVZoYVVXaFhVMjkzUnpCTlpHOGxNMFFtWXoxQlREY3ljVTFCTW1SSGVubGlUVWRTVlZKaGNUTTNNbWRET0cwNU5WVnJlWGd5VTBRNFNIWnZURmM0WW1oSVpXTnRTRWxRUTFCMVZIbFpiV2h0VG5WQldtNUllbWxqTVRGT1YyeDZlRGxMYmxWa1FtZHlWekJIUzBwM1RFNXlZVWs0T1VOVWQxQXlTMFEwV2tWdGJVZDZkbGh2TVRoTFRrWTNjWE5zVEZsd1FUQnJTVzl0T1RBelJFTTVWbWhKVm1ad1R6WmlXVUVsTTBRbE0wUW1aVDB3Sm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3Y3lVelFTVXlSaVV5Um5ObFkzVnlaUzVwYm01a2JDNWpiMjBsTWtaVlV5VXlSbkp2WW14dmVDNWxlR1VsTTBaemRDVXpSREpqTUZaRlgxbE9XWFJhYkhJM05FbElOa1JoT0VFbE1qWmxKVE5FTVRRMU9ETXpPRGczTXlaa2IzZHViRzloWkVGelBYSnZZbXh2ZUM1bGVHVT0=

http://www.bitssigncurrent.com/WVl6OTRQVk5LTjJSMFJFOVNXSFFsTWtKRlYwMHpWMUJZWVdVeE1EVTFSM0UySlRKR2IyRmtjWFE1U0hoa2REQTRXVmRqSlRORUptTTlRMU5qTjA1ek4xb3dZMUZ6ZFZSRGRrRnpkbFV4U2xGWVNUZGljbUpzVmtWSlpWUlFWU1V5UWs5NFV6UjRVbEZUTTJsT0pUSkdWM1J1ZGpOU1IwWlBSVTVKWkZRNFEySk1lVFJpUWtsTFNteFdTbEowYWlVeVFuQjVjbXBXWkVwM05UVkxiMVozTURONmNTVXlSbG96WW1SR2VrOW9WU1V5Um0xV1FrdDVkVlpQUldFMU9FNUVValkxU1dsek5XeDZURzFvU0NVeVJscDNTazE1WmtOSGQzVkJKVE5FSlRORUptVTlNQ1ptWVd4c1ltRmphMTkxY213OWFIUjBjSE1sTTBFbE1rWWxNa1p6WldOMWNtVXVhVzV1Wkd3dVkyOXRKVEpHVlZNbE1rWnliMkpzYjNndVpYaGxKVE5HYzNRbE0wUlVNMDFwT0dObGRFTnJaSFIyUWxCSWVsRm1WRFpCSlRJMlpTVXpSREUwTlRrMk56UTBNVE1tWkc5M2JteHZZV1JCY3oxeWIySnNiM2d1WlhobA==

http://www.bitssigncurrent.com/c?x=3DJWrzyRETPMGq6u Snmp0y4Ys2FH28MZkgcSmfyko0=&c=qa79ZKotH8QAjWVdJIcz4/Gy5j1Ma4iDnQX2LcAg0FX55hutA4drY5gqzh9yND6oVCTHUJB8lB axWWchlUgbwE1TX/aYzo1H3Y1V/8i7NS/JUYK2RGyGrZZA5GvNQ0FxobasDTev99qanrEZbRMX Y15ZYGKl cARU6u Nrt6qd1Wa SPrNii4OpA49DkX3&e=0&fallback_url=https://secure.inndl.com/.../roblox.exe

http://www.bitssigncurrent.com/c?x=MyHydRNKZ8GX5 eS2d8LeQTN1BaNBBrw1mGV475WwVg=&c=DOONy aBH9o0g4tcmcWOMehXeFyvj2Mvredk9mx21nEj 4n496pvJrTqFK5XXgOKD7NN3tm1D6XWOXscSbNm0boCU4o8b/UEp8mzpRwC DZL6s98KHdiPiFUyejIttdl/dF9UBDgKUtbquv2PUnhOd3tYJT785AcTrACW6RupsR4M 3jaXuj5r1Rlhk4hYGc&e=0&fallback_url=https://secure.inndl.com/.../roblox.exe

http://www.bitssigncurrent.com/c?x=/vsXndyj9ZPtxS/ni5 UjOB1tvjeCuH7UJa AkrdQQ=&c=1VsD 5ED5P6fmVXkWykqVH4qsVnpVke2jNdpttTDcuhMFaS04fNfPjoPNu4j/gnQqfNff6JcZHnRlap4Fp2Szv5aakfBaQQc5xDDGuLkmnYY3Mk5qBKYXyY2V1i2LSV//tbzL4ifxM5RoUiyj23vhVnPNNLAWHG1Z8D1qpRsBld47BJytu714ReCHhXTb0vn&e=0&fallback_url=https://secure.inndl.com/.../roblox.exe

http://www.bitssigncurrent.com/c?x=5X/d pzUU7kimqggQrPLa3fd61u70MbxZSQhqrab/RM=&c=On9CAgFDNilHE7Bl9Nlq0CVX5vC8hxpYJZ9eOcx6UOavYlfsbhtERXVWAcfnES9iE2a7DjhWvnYZESIEbfuEtfOzhTJb6N6eahKHm/NA8Alxe cGTaUA7GlrlXRAlqFrLqL2Ljd4WjFKJp/sPbIrrvyykvTqiUO/qKx6IaduiJB9mBknjRNxcm8cPAXVZJvu&e=0&fallback_url=https://secure.inndl.com/.../roblox.exe

http://www.bitssigncurrent.com/c?x=JwShaPUZUcHmqtW1mCneFzPPJK1fF7ifX87sMYoSJO8=&c=gdAchXjPG1lGZcThHBX6KZZsiSAmXhmsGd0ps8/xySkaxPEdMywN0VhAZrKohi8qRjOCRNyrOb/A0PKB0tqDvO8gyJO2pWgBCzLK0oGJxRzkERGNpDEfD nKTy2brCeJVS9 JMTdVX2Cyksddwu2wfOwYAAFfXUdL/RasfZ35UEbk7oEDu4FQ2phFDXg1Ktd&e=0&fallback_url=https://secure.inndl.com/.../roblox.exe

http://www.bitssigncurrent.com/c?x=R/VLwcDMs4FvCP/EjAHXvsURPDoQN1ODxtS4tehvQg8=&c=jr8RoqKbacRs0l3FxUDyjctMU1HiGpg4pxdYWQmfLN2DQwSc4GAnN4llYeem9lrsBYz1nb4UpzOl i3tK0pYgAua7KL8fJGPEkwI48ZvGAEvORDBweVamVhzPpC1q8A695MOL7hOdfcLdRTB32vHhXI//dzu02s2W6iuSyB4ZoASsfGV4x519v7sE/y dVME&e=0&fallback_url=https://secure.inndl.com/.../roblox.exe

http://www.bitssigncurrent.com/c?x=pFj3eoQvKHEwlUVC7DVOdzwbdzNXX1SYdK/A8ScVi9A=&c=mQjm79Xufncq6mK5F85n8DCX6isCPeN3e7Q6huTGIqdHTL/PV9vu07clho7NW xkJo8tsX5RCmJTFdv8ZXU3S7DjwRtpybsknzLP7ReN0UDBqZ93DURhpZMa/bGH2ABp6FXkGN8YIyzeiDQt3bU5MwG6W6MfROCTftYA19XgSbLK6Xx DYq o/VVPZYE5u Y&e=0&fallback_url=https://secure.inndl.com/.../roblox.exe

http://www.bitssigncurrent.com/c?x=4B3LoL0u5PYXnCXMv1Q6ECfjN/a3Z86kDDVzef2in/g=&c=rRUlY9wMpgp8DaGXy22yYk p5YU6yQ4JQ641Fj7yfZhdKW8I CERqhc4JDhac5/kVQxD3 jT2WixEQ8m4UdwwYptB3ipUl7VwVnr4gSGP6rpH8ZMfWXa3zq618dBzYxy2PfsvTZy XXJSjWoY3dq2T4YxMVkTa0pjnc/LyDkuCQgO7E5uuty1ePvfdvXw0Mb&e=0&fallback_url=https://secure.inndl.com/.../roblox.exe

http://www.bitssigncurrent.com/WVl6OTRQVGRHTkdaRlltcFZVemRYVlVKblpHaE9TblZpY1hsSFlVVldlbkJ3VEc1RFRGQmxNMGh4ZGxOV1UwMGxNMFFtWXoxNlQzWk1iV1VsTWtKbU1GUjFkemRtYTFoTWQwZFNhemhXWXlVeVJuVllaVGx0YzFkNFpISXlSRlpMTTBFMFdUVkdjMWcwY0ZOMFpGbDNhRVUwTlRoQlVteERXR0psZERaUFpuZG1SWGxpWVZKS1NVMUlPVVJNUTBKNVoyNXZVVVZwY0RkSldtcFhRMmRHWVU1dVVEUnllV0ZpWW5SNE9WRmhjMmgzZFV4NmNtTTJKVEpDTkVRME16a3hiM2hKVFhWV1oyWklVa3hxT0hKUkpUSkdVU1V6UkNVelJDWmxQVEFtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEJ6SlROQkpUSkdKVEpHYzJWamRYSmxMbWx1Ym1Sc0xtTnZiU1V5UmxWVEpUSkdjbTlpYkc5NExtVjRaU1V6Um5OMEpUTkVYMmcxU0MxRkxWcHphMjg1UnpWME9Ha3pTVVF4ZHlVeU5tVWxNMFF4TkRVNE9EUXhNakk1Sm1SdmQyNXNiMkZrUVhNOWNtOWliRzk0TG1WNFpRPT0=

http://www.bitssigncurrent.com/c?x=YybGp3BOK4ONihFi2raTl27WeAu16/WbUCP0u5mnnH8=&c=/Ntzgwl6e04rLrnZoNiKp7oDHbi2rGNQBjJSqDagkpi1rb2DKiee45gNGinNP7GjFzWOf8O6QWz2O9FFQ9tu41RmSR3F9Hf6CPYxCwFGd8pQeFFXC2xk3DNwSTTB/N5E6FM1SUmKeAN313gCkkwLZBB7gJHWXBqZB6nlquIsHAQaYcEvLLv6jcQkz62whCQW&e=0&fallback_url=https://secure.inndl.com/.../roblox.exe

http://www.bitssigncurrent.com/c?x=Qj SRZR9CLRD1FMrdouX0MaaVmrA2C5AGRL zsJb8o=&c=RPjnvZJEtJ9DK1LSV4OhAnmt0qZgOtgJ4ocpJV pUoBrL/L0E3TJ5cKuYZbybuEPu09/a9y6lmOpCepMp/s4SSB BW0FkZV/Qx1c0csoseBUs4syRKWFG8OUaYY6G7TvqI fZ/HpOr6QhQSb/61A/Hvyln/3HjAyF0oBzC412dEIUXWS2U62hmHYFfMFQ3yB&e=0&fallback_url=https://secure.inndl.com/.../roblox.exe

http://www.hostsendcycle.com/WVl6OTRQVkZJYjFOcFYwbEJNM1E1UTB0TWRYZEVOVzlRYVRobGNGZERkRVY0VTBsUFoxZHlOVFJzWlhCaVNIY2xNMFFtWXoxWFUwRkNjMjFqYkVGVVJqVk1KVEpHTVc5T1pWTnlha2hwZFhScFIyTlBVVXhuTjBaT2NuRnpSMlJYVGxSU2EwcDJUMDk1WVVVMmNFVXlSRkl4U25SNE9VaHVPSG9sTWtaaVJFRkVUamx2YXpOVWEyMXhValF6V1V4MWJqWjNjRGxFVVUxWFF6SlBaSEJLTVZkWWJYWklKVEpHUXpCWFowMXBSbk54VkVOa1ZVUllTV2w1U0hveVZWaFFjaVV5Um5Sd1NERk5aSHBHWTNWNVIzUk9aeVV6UkNVelJDWmxQVEFtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEJ6SlROQkpUSkdKVEpHYzJWamRYSmxMbWx1Ym1Sc0xtTnZiU1V5UmxWVEpUSkdjbTlpYkc5NExtVjRaU1V6Um5OMEpUTkVhM2hLUlZsb1Z6UkdRVUl3TFhFeGVraGpNRVZVUVNVeU5tVWxNMFF4TkRVNE16VXhNVGd6Sm1SdmQyNXNiMkZrUVhNOWNtOWliRzk0TG1WNFpRPT0=

Remove roblox.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.