01fd5875b35ee565b46404c9fdf69e2d6cf20449eed999b0b1ad4896c4f976aa

Analysis

max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/05/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MultiRoblox.exe
Size 181.7MB
Sample260506-e857tsav2y
SHA256 01fd5875b35ee565b46404c9fdf69e2d6cf20449eed999b0b1ad4896c4f976aa
MD5 16e52e1b60433ee359a2c64a97255b5a
SHA1 a933bf6167a402bb1e883210859d7f5b6a764eb5
SHA512 2888196a7667e59d01b50fdb2aacf61487c21aa913c434527cc3bdd29910ccce612bc49a82619a730e172c2ab8d64f23e1db04cbb31d2360b66efc54a9f34085
SSDEEP 1572864:tNKPIpfjC6kkZAC2TjEtxhyd5j14HbD6OaFSxqVUeu9Rq29EmoH7SesWVYpap+4Z:GY65t4TV
TLSH
T1DC988C03F39A40D9E01DD1758B8B9633EAB1B8854724A2DF275407562FB7EE86B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4296	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	MultiRoblox.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	MultiRoblox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4296	powershell.exe
4296	powershell.exe
4088	MultiRoblox.exe
4088	MultiRoblox.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4812	MultiRoblox.exe
Token: SeCreatePagefilePrivilege	4812	MultiRoblox.exe
Token: SeDebugPrivilege	4296	powershell.exe
Token: SeShutdownPrivilege	4812	MultiRoblox.exe
Token: SeCreatePagefilePrivilege	4812	MultiRoblox.exe
Token: SeShutdownPrivilege	4812	MultiRoblox.exe
Token: SeCreatePagefilePrivilege	4812	MultiRoblox.exe
Token: SeShutdownPrivilege	4812	MultiRoblox.exe
Token: SeCreatePagefilePrivilege	4812	MultiRoblox.exe
Token: SeShutdownPrivilege	4812	MultiRoblox.exe
Token: SeCreatePagefilePrivilege	4812	MultiRoblox.exe
Token: SeShutdownPrivilege	4812	MultiRoblox.exe
Token: SeCreatePagefilePrivilege	4812	MultiRoblox.exe
Token: SeShutdownPrivilege	4812	MultiRoblox.exe
Token: SeCreatePagefilePrivilege	4812	MultiRoblox.exe
Token: SeShutdownPrivilege	4812	MultiRoblox.exe
Token: SeCreatePagefilePrivilege	4812	MultiRoblox.exe
Token: SeShutdownPrivilege	4812	MultiRoblox.exe
Token: SeCreatePagefilePrivilege	4812	MultiRoblox.exe
Token: SeShutdownPrivilege	4812	MultiRoblox.exe
Token: SeCreatePagefilePrivilege	4812	MultiRoblox.exe
Token: SeShutdownPrivilege	4812	MultiRoblox.exe
Token: SeCreatePagefilePrivilege	4812	MultiRoblox.exe
Token: SeShutdownPrivilege	4812	MultiRoblox.exe
Token: SeCreatePagefilePrivilege	4812	MultiRoblox.exe
Token: SeShutdownPrivilege	4812	MultiRoblox.exe
Token: SeCreatePagefilePrivilege	4812	MultiRoblox.exe
Token: SeShutdownPrivilege	4812	MultiRoblox.exe
Token: SeCreatePagefilePrivilege	4812	MultiRoblox.exe
Token: SeShutdownPrivilege	4812	MultiRoblox.exe
Token: SeCreatePagefilePrivilege	4812	MultiRoblox.exe
Token: SeShutdownPrivilege	4812	MultiRoblox.exe
Token: SeCreatePagefilePrivilege	4812	MultiRoblox.exe
Token: SeShutdownPrivilege	4812	MultiRoblox.exe
Token: SeCreatePagefilePrivilege	4812	MultiRoblox.exe
Token: SeShutdownPrivilege	4812	MultiRoblox.exe
Token: SeCreatePagefilePrivilege	4812	MultiRoblox.exe
Token: SeShutdownPrivilege	4812	MultiRoblox.exe
Token: SeCreatePagefilePrivilege	4812	MultiRoblox.exe
Token: SeShutdownPrivilege	4812	MultiRoblox.exe
Token: SeCreatePagefilePrivilege	4812	MultiRoblox.exe
Token: SeShutdownPrivilege	4812	MultiRoblox.exe
Token: SeCreatePagefilePrivilege	4812	MultiRoblox.exe
Token: SeShutdownPrivilege	4812	MultiRoblox.exe
Token: SeCreatePagefilePrivilege	4812	MultiRoblox.exe
Token: SeShutdownPrivilege	4812	MultiRoblox.exe
Token: SeCreatePagefilePrivilege	4812	MultiRoblox.exe
Token: SeShutdownPrivilege	4812	MultiRoblox.exe
Token: SeCreatePagefilePrivilege	4812	MultiRoblox.exe
Token: SeShutdownPrivilege	4812	MultiRoblox.exe
Token: SeCreatePagefilePrivilege	4812	MultiRoblox.exe
Token: SeShutdownPrivilege	4812	MultiRoblox.exe
Token: SeCreatePagefilePrivilege	4812	MultiRoblox.exe
Token: SeShutdownPrivilege	4812	MultiRoblox.exe
Token: SeCreatePagefilePrivilege	4812	MultiRoblox.exe
Token: SeShutdownPrivilege	4812	MultiRoblox.exe
Token: SeCreatePagefilePrivilege	4812	MultiRoblox.exe
Token: SeShutdownPrivilege	4812	MultiRoblox.exe
Token: SeCreatePagefilePrivilege	4812	MultiRoblox.exe
Token: SeShutdownPrivilege	4812	MultiRoblox.exe
Token: SeCreatePagefilePrivilege	4812	MultiRoblox.exe
Token: SeShutdownPrivilege	4812	MultiRoblox.exe
Token: SeCreatePagefilePrivilege	4812	MultiRoblox.exe
Token: SeShutdownPrivilege	4812	MultiRoblox.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 1292	4812	MultiRoblox.exe	84
PID 4812 wrote to memory of 1292	4812	MultiRoblox.exe	84
PID 4812 wrote to memory of 2980	4812	MultiRoblox.exe	85
PID 4812 wrote to memory of 5072	4812	MultiRoblox.exe	86
PID 4812 wrote to memory of 4296	4812	MultiRoblox.exe	87
PID 4296 wrote to memory of 2892	4296	powershell.exe	89
PID 2892 wrote to memory of 3836	2892	csc.exe	90
PID 4812 wrote to memory of 4088	4812	MultiRoblox.exe	100

C:\Users\Admin\AppData\Local\Temp\MultiRoblox.exe
"C:\Users\Admin\AppData\Local\Temp\MultiRoblox.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Users\Admin\AppData\Local\Temp\MultiRoblox.exe
  "C:\Users\Admin\AppData\Local\Temp\MultiRoblox.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\multiroblox" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1744,i,611998046897393301,713532180353629535,262144 --disable-features=IsolateOrigins,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand,site-per-process --variations-seed-version --mojo-platform-channel-handle=1736 /prefetch:2
  2⤵
  PID:1292
- C:\Users\Admin\AppData\Local\Temp\MultiRoblox.exe
  "C:\Users\Admin\AppData\Local\Temp\MultiRoblox.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\multiroblox" --field-trial-handle=2236,i,611998046897393301,713532180353629535,262144 --disable-features=IsolateOrigins,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand,site-per-process --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  PID:2980
- C:\Users\Admin\AppData\Local\Temp\MultiRoblox.exe
  "C:\Users\Admin\AppData\Local\Temp\MultiRoblox.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\multiroblox" --app-user-model-id=com.multiroblox.app --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2416,i,611998046897393301,713532180353629535,262144 --disable-features=IsolateOrigins,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand,site-per-process --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:1
  2⤵
  - Checks computer location settings
  PID:5072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\resources\mutex_holder.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\a521lnhu\a521lnhu.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2892
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9DE.tmp" "c:\Users\Admin\AppData\Local\Temp\a521lnhu\CSCF69EA9EFE5BC4CD1A62083F5CB617AAA.TMP"
      4⤵
      PID:3836
- C:\Users\Admin\AppData\Local\Temp\MultiRoblox.exe
  "C:\Users\Admin\AppData\Local\Temp\MultiRoblox.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\multiroblox" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2836,i,611998046897393301,713532180353629535,262144 --disable-features=IsolateOrigins,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand,site-per-process --variations-seed-version --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES9DE.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9DE.tmp
Size 1KB
SHA256 742cc2e8015f66bbf3b4ada2910e6a978d4af951f19b5c56c696ef5e5a8ff219
MD5 17c148bebf5dc5c179b6e717fa1e4992
SHA1 56bd7e1d5f9b6265ccc69d44ed0fba0f83a99ce5
SHA512 a0ee6964b13520e9081330104d0cce450a99491147e8d769fd8eb7ee7ca548eef64b3658a6f064901a3aa174f6ac20163563d5e58f61a6212eb6e01795749c74
TLSH
T1CC21890583EC871AF073573269F6172FA264FE95EFA2A35A854052282C40514FEA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_vy4frpgd.kmq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vy4frpgd.kmq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

a521lnhu.dll

Path C:\Users\Admin\AppData\Local\Temp\a521lnhu\a521lnhu.dll
Size 3KB
SHA256 096d2a9b71a5cd25f754dcb45ff14442121be2517c294df32c1697eca0a5615a
MD5 c65b5aa75a4a868ad162c7b32ff021ad
SHA1 c601d50072102e9cb2cdb2a276239d4ecffc5386
SHA512 e7e2b1045080d8c8275ba5620d4be4633113cd37afe30fc9ff51bdab30d8a494a91bf390e3368f1800d5bad693a67c8705701a8c297578c0a3e931a7d599a9e1
TLSH
T192710016B3EC122BE07A0B346BF6431362B6FD909F37D76F588422186C602B45D31BB0
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\multiroblox\Network\Network Persistent State
Size 665B
SHA256 a510f1922ed7191023c4e9ada8eef3baa257129fbd5b0301c5a8249f56577b17
MD5 d0e48012814f3f406f157604531863be
SHA1 d9405f372415280c46d87b28f5dcd5fffdd6c9c5
SHA512 d6264634f2a0d7b7d83da69b5d42e6adc0e669787200b337af97d19932fd566f48ba04464f42a388dc17d8a2851ee570eb7ad430198cc1cf3bf1094c1dadae03
TLSH
T1730149E6C3D845BE4A5213F12A353D33C5BE082963683C57D8E8EF8E97E18754A0059E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe591776.TMP

Path C:\Users\Admin\AppData\Roaming\multiroblox\Network\Network Persistent State~RFe591776.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

CSCF69EA9EFE5BC4CD1A62083F5CB617AAA.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\a521lnhu\CSCF69EA9EFE5BC4CD1A62083F5CB617AAA.TMP
Size 652B
SHA256 f70e08d4694738ce944c9024788d9d4f38fc41cf0afcd5b723beb26d5a21bbfd
MD5 6e779e1197b1592cf8b882efe8670258
SHA1 18ee4e6328b30086f67d3d41d11f89f69840b06c
SHA512 7b9d817281893e151d5ededda37f56f3e6bcb8b959d5c602d0d2d0f89d0feed8b23832fbce9bec44e04e1e3c2c0b4f4f3fff8c89425a5c8ebf87aa4d87739883
TLSH
T151F05E5963FC520EF0F34B31BEF6436391A9BC65DE32A3ED1480131928649209962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

a521lnhu.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\a521lnhu\a521lnhu.0.cs
Size 930B
SHA256 67c934fdf4be67b02037eb506ddaa2634df2bcd8d9974eeade0eb9a0bb85e79d
MD5 7ab96b97f587787e721ed29811785b91
SHA1 01d178c0256606d2e08432b7595c43185e618980
SHA512 26836c434dc221680316fc6f34d8ec8a31c99e25633cfdb3b0562376e1c1eba6e47931996ebd9ca575568205ebce949d3c0a7e9ad0a5c99d1dddf4da89518fd9
TLSH
T1B111BD21BEC14AB11C5320214B2A7542B566AA33269ED8A03DDFD3189F0150858588EB
MD5 SHA1 SHA512 TLSH

Submit Download

a521lnhu.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\a521lnhu\a521lnhu.cmdline
Size 369B
SHA256 6287bae63be93a91135a58630d75652c7187fd52e3c43f31205b71beeb3b8f3b
MD5 19665ca00d49a61ae8eecd06f66c6e34
SHA1 b22ff9efc82f11d0990d834557042840d1065548
SHA512 03a0d727785a7844cb5d4e3873977615eb781dcdbdfc4c57847a915c5ff1772477b195dd2dd686378eb0de3d005665f3540f238a11c48ef03c8bd5bedeca1162
TLSH
T126E0683B4246C67D02E920476169E8BD967207C339C1BF8C7070480DD02700427E2B71
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1292-102-0x000002B2C9910000-0x000002B2C99BC000-memory.dmp

Download

memory/2892-92-0x00000198A8CD0000-0x00000198A8CDC000-memory.dmp

Download

memory/2980-103-0x000002D73C710000-0x000002D73C7BC000-memory.dmp

Download

memory/3836-89-0x00000189F9570000-0x00000189F957C000-memory.dmp

Download

memory/4088-173-0x0000024990BB0000-0x0000024990BB1000-memory.dmp

Download

memory/4088-179-0x0000024990BB0000-0x0000024990BB1000-memory.dmp

Download

memory/4088-180-0x000002498BD10000-0x000002498BDBC000-memory.dmp

Download

memory/4088-174-0x0000024990BB0000-0x0000024990BB1000-memory.dmp

Download

memory/4088-176-0x0000024990BB0000-0x0000024990BB1000-memory.dmp

Download

memory/4088-167-0x0000024990BB0000-0x0000024990BB1000-memory.dmp

Download

memory/4088-168-0x0000024990BB0000-0x0000024990BB1000-memory.dmp

Download

memory/4088-169-0x0000024990BB0000-0x0000024990BB1000-memory.dmp

Download

memory/4088-177-0x0000024990BB0000-0x0000024990BB1000-memory.dmp

Download

memory/4088-175-0x0000024990BB0000-0x0000024990BB1000-memory.dmp

Download

memory/4088-178-0x0000024990BB0000-0x0000024990BB1000-memory.dmp

Download

memory/4296-73-0x000001B35E940000-0x000001B35E962000-memory.dmp

Download

memory/4296-94-0x000001B35E970000-0x000001B35E978000-memory.dmp

Download

memory/4296-107-0x000001B35E400000-0x000001B35E40C000-memory.dmp

Download

memory/4812-101-0x000001DE89DB0000-0x000001DE89E5C000-memory.dmp

Download

memory/5072-104-0x00000229D82B0000-0x00000229D835C000-memory.dmp

Download