e663bb178c801d33d159f4d681cfe9da3a3ee1043bad29e6a0e8705b8303d9bb

Analysis

user interaction
yes
max time kernel
125s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/07/2026, 10:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MultiRoblox.exe
Size 7.7MB
Sample260717-mesnmsgz8q
SHA256 e663bb178c801d33d159f4d681cfe9da3a3ee1043bad29e6a0e8705b8303d9bb
MD5 5569a4670429d3640f62a82c5511b380
SHA1 2c532f09736b46c966b0a880fde48e5fea43ca91
SHA512 2fb58698cd9382de6f3a2eba8a1d58f93098b4818428ec9b4a80100ca28700063015eeb78c1a71885e979e53078996e6c411456b58ee14a69f8bc90a111e382e
SSDEEP 98304:0ogDJoCmNpy4akZZH81Q2LKxK7tIE1rDdmp1On+0:01GCmN37Hc/Dcp10
TLSH
T13C864A03F6A281E8C0AEC474835AA733E772B8CD493472EB5BA45B212F56F506F1D749
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access defense_evasion discovery stealer trojan

Malware Config

Signatures

Uses browser remote debugging 2 TTPs 6 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
4576	chrome.exe
4704	chrome.exe
5376	chrome.exe
212	chrome.exe
4044	chrome.exe
1300	chrome.exe

Executes dropped EXE 39 IoCs

pid	Process
2752	RobloxNative.exe
212	RobloxNative.exe
2092	RobloxNative.exe
4056	RobloxNative.exe
4524	RobloxNative.exe
5032	RobloxNative.exe
4712	RobloxNative.exe
4452	RobloxNative.exe
4180	RobloxNative.exe
5432	RobloxNative.exe
3476	RobloxNative.exe
4932	RobloxNative.exe
5324	RobloxNative.exe
5972	RobloxNative.exe
5592	RobloxNative.exe
5620	RobloxNative.exe
5572	RobloxNative.exe
5272	RobloxNative.exe
1244	RobloxNative.exe
5232	RobloxNative.exe
5560	RobloxNative.exe
5916	RobloxNative.exe
3520	RobloxNative.exe
4932	RobloxNative.exe
5200	RobloxNative.exe
1992	RobloxNative.exe
5668	RobloxNative.exe
6624	RobloxNative.exe
6696	RobloxNative.exe
6760	RobloxNative.exe
6808	RobloxNative.exe
7120	RobloxNative.exe
6032	RobloxNative.exe
6084	RobloxNative.exe
4208	RobloxNative.exe
5216	RobloxNative.exe
4908	RobloxNative.exe
3536	RobloxNative.exe
6072	RobloxNative.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MultiRoblox.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
5900	tasklist.exe
4112	tasklist.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2984_821105351\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2984_821105351\protocols.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2984_821105351\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2984_2099008033\crl-set	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2984_2099008033\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2984_2099008033\manifest.fingerprint	msedgewebview2.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4776	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
420	taskkill.exe
848	taskkill.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134287575031494641"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{F5558A69-E076-48B9-A5FA-29847C38D11E}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	MultiRoblox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2752	RobloxNative.exe
2752	RobloxNative.exe
212	RobloxNative.exe
212	RobloxNative.exe
2092	RobloxNative.exe
2092	RobloxNative.exe
4056	RobloxNative.exe
4056	RobloxNative.exe
4524	RobloxNative.exe
4524	RobloxNative.exe
5032	RobloxNative.exe
5032	RobloxNative.exe
4712	RobloxNative.exe
4712	RobloxNative.exe
4452	RobloxNative.exe
4452	RobloxNative.exe
4180	RobloxNative.exe
4180	RobloxNative.exe
4044	chrome.exe
4044	chrome.exe
5432	RobloxNative.exe
5432	RobloxNative.exe
3476	RobloxNative.exe
3476	RobloxNative.exe
4932	RobloxNative.exe
4932	RobloxNative.exe
5324	RobloxNative.exe
5324	RobloxNative.exe
5972	RobloxNative.exe
5972	RobloxNative.exe
5592	RobloxNative.exe
5592	RobloxNative.exe
5620	RobloxNative.exe
5620	RobloxNative.exe
5572	RobloxNative.exe
5572	RobloxNative.exe
5272	RobloxNative.exe
5272	RobloxNative.exe
1244	RobloxNative.exe
1244	RobloxNative.exe
5232	RobloxNative.exe
5232	RobloxNative.exe
5560	RobloxNative.exe
5560	RobloxNative.exe
5916	RobloxNative.exe
5916	RobloxNative.exe
3520	RobloxNative.exe
3520	RobloxNative.exe
4932	RobloxNative.exe
4932	RobloxNative.exe
5200	RobloxNative.exe
5200	RobloxNative.exe
1992	RobloxNative.exe
1992	RobloxNative.exe
5668	RobloxNative.exe
5668	RobloxNative.exe
6624	RobloxNative.exe
6624	RobloxNative.exe
6696	RobloxNative.exe
6696	RobloxNative.exe
6760	RobloxNative.exe
6760	RobloxNative.exe
6808	RobloxNative.exe
6808	RobloxNative.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6896	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2984	msedgewebview2.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2752	RobloxNative.exe
Token: SeDebugPrivilege	212	RobloxNative.exe
Token: SeDebugPrivilege	2092	RobloxNative.exe
Token: SeDebugPrivilege	4056	RobloxNative.exe
Token: SeDebugPrivilege	4524	RobloxNative.exe
Token: SeDebugPrivilege	5032	RobloxNative.exe
Token: SeDebugPrivilege	4712	RobloxNative.exe
Token: SeDebugPrivilege	4452	RobloxNative.exe
Token: SeDebugPrivilege	4180	RobloxNative.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeDebugPrivilege	5432	RobloxNative.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeDebugPrivilege	3476	RobloxNative.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeDebugPrivilege	4932	RobloxNative.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeDebugPrivilege	5324	RobloxNative.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeDebugPrivilege	5972	RobloxNative.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeDebugPrivilege	5592	RobloxNative.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeDebugPrivilege	5620	RobloxNative.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeDebugPrivilege	5572	RobloxNative.exe
Token: SeShutdownPrivilege	4044	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2340	MultiRoblox.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6896	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2984	2340	MultiRoblox.exe	87
PID 2984 wrote to memory of 3216	2984	msedgewebview2.exe	88
PID 2984 wrote to memory of 4772	2984	msedgewebview2.exe	91
PID 2984 wrote to memory of 4772	2984	msedgewebview2.exe	91
PID 2984 wrote to memory of 4772	2984	msedgewebview2.exe	91
PID 2984 wrote to memory of 2540	2984	msedgewebview2.exe	92
PID 2984 wrote to memory of 4904	2984	msedgewebview2.exe	93
PID 2984 wrote to memory of 4904	2984	msedgewebview2.exe	93
PID 2984 wrote to memory of 3060	2984	msedgewebview2.exe	94
PID 2984 wrote to memory of 3060	2984	msedgewebview2.exe	94
PID 2984 wrote to memory of 3060	2984	msedgewebview2.exe	94
PID 2340 wrote to memory of 2752	2340	MultiRoblox.exe	95
PID 2984 wrote to memory of 440	2984	msedgewebview2.exe	99
PID 2984 wrote to memory of 440	2984	msedgewebview2.exe	99
PID 2340 wrote to memory of 212	2340	MultiRoblox.exe	100
PID 2340 wrote to memory of 2092	2340	MultiRoblox.exe	103
PID 2340 wrote to memory of 4056	2340	MultiRoblox.exe	109
PID 2340 wrote to memory of 4524	2340	MultiRoblox.exe	112
PID 2340 wrote to memory of 5032	2340	MultiRoblox.exe	117
PID 2340 wrote to memory of 4712	2340	MultiRoblox.exe	119
PID 2340 wrote to memory of 4452	2340	MultiRoblox.exe	121
PID 2340 wrote to memory of 4180	2340	MultiRoblox.exe	125
PID 2340 wrote to memory of 4044	2340	MultiRoblox.exe	127
PID 4044 wrote to memory of 5012	4044	chrome.exe	128
PID 4044 wrote to memory of 4776	4044	chrome.exe	129
PID 4044 wrote to memory of 4376	4044	chrome.exe	130
PID 4044 wrote to memory of 4376	4044	chrome.exe	130
PID 4044 wrote to memory of 3492	4044	chrome.exe	131
PID 4044 wrote to memory of 3492	4044	chrome.exe	131
PID 4044 wrote to memory of 4576	4044	chrome.exe	132
PID 4044 wrote to memory of 1300	4044	chrome.exe	133
PID 4044 wrote to memory of 4576	4044	chrome.exe	132
PID 4044 wrote to memory of 1300	4044	chrome.exe	133
PID 4044 wrote to memory of 4704	4044	chrome.exe	134
PID 4044 wrote to memory of 4704	4044	chrome.exe	134
PID 4044 wrote to memory of 5376	4044	chrome.exe	136
PID 4044 wrote to memory of 5376	4044	chrome.exe	136
PID 2340 wrote to memory of 5432	2340	MultiRoblox.exe	137
PID 2340 wrote to memory of 3476	2340	MultiRoblox.exe	140
PID 2340 wrote to memory of 4932	2340	MultiRoblox.exe	142
PID 4044 wrote to memory of 212	4044	chrome.exe	144
PID 4044 wrote to memory of 212	4044	chrome.exe	144
PID 2340 wrote to memory of 5324	2340	MultiRoblox.exe	145
PID 4044 wrote to memory of 5536	4044	chrome.exe	147
PID 2340 wrote to memory of 5972	2340	MultiRoblox.exe	149
PID 2340 wrote to memory of 5592	2340	MultiRoblox.exe	151
PID 2340 wrote to memory of 5620	2340	MultiRoblox.exe	153
PID 2340 wrote to memory of 5572	2340	MultiRoblox.exe	155
PID 2340 wrote to memory of 5272	2340	MultiRoblox.exe	157
PID 2340 wrote to memory of 1244	2340	MultiRoblox.exe	159
PID 4044 wrote to memory of 6036	4044	chrome.exe	161
PID 4044 wrote to memory of 6096	4044	chrome.exe	162
PID 4044 wrote to memory of 6104	4044	chrome.exe	163
PID 2340 wrote to memory of 5232	2340	MultiRoblox.exe	167
PID 2340 wrote to memory of 5560	2340	MultiRoblox.exe	169
PID 2340 wrote to memory of 5916	2340	MultiRoblox.exe	171
PID 2340 wrote to memory of 3520	2340	MultiRoblox.exe	173
PID 2984 wrote to memory of 1304	2984	msedgewebview2.exe	175
PID 2984 wrote to memory of 1304	2984	msedgewebview2.exe	175
PID 2340 wrote to memory of 4932	2340	MultiRoblox.exe	176
PID 2340 wrote to memory of 5200	2340	MultiRoblox.exe	178
PID 2340 wrote to memory of 1992	2340	MultiRoblox.exe	180
PID 4044 wrote to memory of 5852	4044	chrome.exe	182
PID 4044 wrote to memory of 5736	4044	chrome.exe	183

C:\Users\Admin\AppData\Local\Temp\MultiRoblox.exe
"C:\Users\Admin\AppData\Local\Temp\MultiRoblox.exe"
1⤵
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=MultiRoblox.exe --webview-exe-version=1.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=2340.3720.8696508480759773850
  2⤵
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x138,0x170,0x7fff5918b078,0x7fff5918b084,0x7fff5918b090
    3⤵
    PID:3216
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView" --webview-exe-name=MultiRoblox.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1740,i,14640925532955663214,11995440500397675972,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1736 /prefetch:2
    3⤵
    PID:4772
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView" --webview-exe-name=MultiRoblox.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2060,i,14640925532955663214,11995440500397675972,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:3
    3⤵
    PID:2540
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView" --webview-exe-name=MultiRoblox.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2388,i,14640925532955663214,11995440500397675972,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:8
    3⤵
    PID:4904
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView" --webview-exe-name=MultiRoblox.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3656,i,14640925532955663214,11995440500397675972,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
    3⤵
    PID:3060
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView" --webview-exe-name=MultiRoblox.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4528,i,14640925532955663214,11995440500397675972,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:8
    3⤵
    PID:440
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView" --webview-exe-name=MultiRoblox.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2316,i,14640925532955663214,11995440500397675972,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:8
    3⤵
    PID:1304
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView" --webview-exe-name=MultiRoblox.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=756,i,14640925532955663214,11995440500397675972,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:8
    3⤵
    PID:7016
- C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe
  "C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe" mutex
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2752
- C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe
  "C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe" pids
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:212
- C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe
  "C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe" pids
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2092
- C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe
  "C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe" pids
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4056
- C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe
  "C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe" pids
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4524
- C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe
  "C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe" pids
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5032
- C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe
  "C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe" pids
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4712
- C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe
  "C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe" pids
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4452
- C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe
  "C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe" pids
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --enable-features=NetworkService,NetworkServiceInProcess --disable-background-timer-throttling --disable-backgrounding-occluded-windows --disable-breakpad --disable-client-side-phishing-detection --disable-component-extensions-with-background-pages --disable-default-apps --disable-dev-shm-usage --disable-extensions --disable-features=TranslateUI --disable-hang-monitor --disable-ipc-flooding-protection --disable-popup-blocking --disable-prompt-on-repost --disable-renderer-backgrounding --disable-sync --force-color-profile=srgb --metrics-recording-only --no-first-run --enable-automation --password-store=basic --use-mock-keychain --enable-blink-features=IdleDetection --lang=en_US --disable-blink-features=AutomationControlled --remote-debugging-port=0 --user-data-dir=C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7 --window-size=530,700
  2⤵
  - Uses browser remote debugging
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4044
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff59a4c728,0x7fff59a4c734,0x7fff59a4c740
    3⤵
    PID:5012
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7" --force-high-res-timeticks=disabled --metrics-shmem-handle=2128,i,3545676281840494520,1511827598197278437,524288 --field-trial-handle=1996,i,10414140287949947559,6579856437648800686,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4776
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-breakpad --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,4893183040974371569,9744520637041413819,262144 --field-trial-handle=1996,i,10414140287949947559,6579856437648800686,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=1992 /prefetch:2
    3⤵
    PID:4376
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7" --force-high-res-timeticks=disabled --metrics-shmem-handle=2204,i,6305820009384522864,12600345212442371771,524288 --field-trial-handle=1996,i,10414140287949947559,6579856437648800686,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:8
    3⤵
    PID:3492
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --enable-blink-features=IdleDetection --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3324,i,298074429919624203,14556831730593286060,2097152 --field-trial-handle=1996,i,10414140287949947559,6579856437648800686,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4576
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --enable-blink-features=IdleDetection --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3328,i,16472361901071809850,2233348150463653871,2097152 --field-trial-handle=1996,i,10414140287949947559,6579856437648800686,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1300
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --disable-gpu-compositing --enable-blink-features=IdleDetection --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4364,i,12018285359472784502,1673239462886327312,2097152 --field-trial-handle=1996,i,10414140287949947559,6579856437648800686,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4704
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --disable-gpu-compositing --enable-blink-features=IdleDetection --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4736,i,14229536773842781744,11383206959987463130,2097152 --field-trial-handle=1996,i,10414140287949947559,6579856437648800686,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:5376
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --disable-gpu-compositing --enable-blink-features=IdleDetection --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5196,i,8470035087782485740,1347405449635614057,2097152 --field-trial-handle=1996,i,10414140287949947559,6579856437648800686,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:212
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7" --force-high-res-timeticks=disabled --metrics-shmem-handle=6064,i,15001425224778176422,284247312306083156,524288 --field-trial-handle=1996,i,10414140287949947559,6579856437648800686,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:8
    3⤵
    PID:5536
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7" --force-high-res-timeticks=disabled --metrics-shmem-handle=3484,i,15957144994505855794,12369567656764840913,524288 --field-trial-handle=1996,i,10414140287949947559,6579856437648800686,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:8
    3⤵
    PID:6036
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7" --force-high-res-timeticks=disabled --metrics-shmem-handle=3480,i,14906745105012564602,5411192580542707268,524288 --field-trial-handle=1996,i,10414140287949947559,6579856437648800686,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
    3⤵
    PID:6096
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7" --force-high-res-timeticks=disabled --metrics-shmem-handle=6084,i,10242736230065762219,6150511566054856066,524288 --field-trial-handle=1996,i,10414140287949947559,6579856437648800686,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:8
    3⤵
    PID:6104
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7" --force-high-res-timeticks=disabled --metrics-shmem-handle=5764,i,16302353195736876530,10824318472512149675,524288 --field-trial-handle=1996,i,10414140287949947559,6579856437648800686,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:8
    3⤵
    - Modifies registry class
    PID:5852
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7" --force-high-res-timeticks=disabled --metrics-shmem-handle=6276,i,3080483175797562886,4203795125537384958,524288 --field-trial-handle=1996,i,10414140287949947559,6579856437648800686,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
    3⤵
    PID:5736
- C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe
  "C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe" pids
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5432
- C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe
  "C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe" pids
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3476
- C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe
  "C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe" pids
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4932
- C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe
  "C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe" pids
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5324
- C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe
  "C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe" pids
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5972
- C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe
  "C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe" pids
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5592
- C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe
  "C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe" pids
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5620
- C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe
  "C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe" pids
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5572
- C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe
  "C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe" pids
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5272
- C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe
  "C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe" pids
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1244
- C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe
  "C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe" pids
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5232
- C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe
  "C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe" pids
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5560
- C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe
  "C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe" pids
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5916
- C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe
  "C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe" pids
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3520
- C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe
  "C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe" pids
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4932
- C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe
  "C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe" pids
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5200
- C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe
  "C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe" pids
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1992
- C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe
  "C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe" pids
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5668
- C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe
  "C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe" pids
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:6624
- C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe
  "C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe" pids
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:6696
- C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe
  "C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe" pids
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:6760
- C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe
  "C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe" closehandles
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:6808
- C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe
  "C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe" pids
  2⤵
  - Executes dropped EXE
  PID:7120
- C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe
  "C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe" pids
  2⤵
  - Executes dropped EXE
  PID:6032
- C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe
  "C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe" pids
  2⤵
  - Executes dropped EXE
  PID:6084
- C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe
  "C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe" pids
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe
  "C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe" pids
  2⤵
  - Executes dropped EXE
  PID:5216
- C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe
  "C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe" pids
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /F /IM RobloxPlayerBeta.exe /T & taskkill /F /IM RobloxCrashHandler.exe /T"
  2⤵
  PID:5224
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM RobloxPlayerBeta.exe /T
    3⤵
    - Kills process with taskkill
    PID:848
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM RobloxCrashHandler.exe /T
    3⤵
    - Kills process with taskkill
    PID:420
- C:\Windows\system32\cmd.exe
  "cmd" /c "tasklist /FI \"IMAGENAME eq RobloxPlayerBeta.exe\" /NH & tasklist /FI \"IMAGENAME eq RobloxCrashHandler.exe\" /NH"
  2⤵
  PID:5472
- - C:\Windows\system32\tasklist.exe
    tasklist /FI \"IMAGENAME eq RobloxPlayerBeta.exe\" /NH
    3⤵
    - Enumerates processes with tasklist
    PID:4112
- - C:\Windows\system32\tasklist.exe
    tasklist /FI \"IMAGENAME eq RobloxCrashHandler.exe\" /NH
    3⤵
    - Enumerates processes with tasklist
    PID:5900
- C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe
  "C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe" mutex
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe
  "C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe" pids
  2⤵
  - Executes dropped EXE
  PID:6072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5716

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:6896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2984_2099008033\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2984_821105351\manifest.fingerprint
Size 66B
SHA256 c236a2ac7741d48e1c56980652331cb3f1f12baf937baf0b280600fbafb143e3
MD5 c28ffa45708f10e3a35143ed2708782f
SHA1 84a03f2615333c9311dbf79d6f58f56b5c009163
SHA512 beac0eacff45a152eb2a50f4d72db2933b8f8ba97e6f0a9f6811abe866fef5c7c83068151915dbdffaccaee5d0cd335d182671f44dbab6da2222266ff8a28ff0
TLSH
T169A022F3F000F02030022F8A80203C00C8A23BA80C8020808000BEE0200322A3A0C820
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2984_821105351\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

RobloxNative.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RobloxNative.exe.log
Size 226B
SHA256 2391511d0a66ed9f84ae54254f51c09e43be01ad685db80da3201ec880abd49c
MD5 28d7fcc2b910da5e67ebb99451a5f598
SHA1 a5bf77a53eda1208f4f37d09d82da0b9915a6747
SHA512 2d8eb65cbf04ca506f4ef3b9ae13ccf05ebefab702269ba70ffd1ce9e6c615db0a3ee3ac0e81a06f546fc3250b7b76155dd51241c41b507a441b658c8e761df6
TLSH
T1C5D023603795D1C549577F54181D2A4881FF0255B1109D14749572DEDD345671F311E7
MD5 SHA1 SHA512 TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7\CrashpadMetrics-active.pma
Size 1024KB
SHA256 ae1bddb9e2cc97b0c9cd78ef3cd17553be6e5204677bd67e0b8f7fa27007f189
MD5 b0366599d64b0fc1adb2a712dcd02ee1
SHA1 b7a1c09ccd2846664cab5f76bd80b8e9f107acb0
SHA512 d7de6d48285018f8b709c81ca01688126db7893ce9f48829524ee3122aa6f2200c7f78186b5a558d0b1ecf8157ee78a20064b63b45ab89f7aa0835b8409435d0
SSDEEP 12:bHCsEXhVMMBKEKSCemJKlkQyYVhYJ0I+pPK6BsyW1inP6:biPROMMBS+MkIYWIE1BtXP
TLSH
T117252786A30815EFC54288B589AE03602374F9E55F52079B2E2DAA1F2E271D80F45164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7\Crashpad\settings.dat
Size 40B
SHA256 cdc1a07a319ab232b205c16a746e50c55fb72a196f3ed996804154b877db6548
MD5 0105a6f929970982d738af5a3f8f930f
SHA1 5e990f59a1edd363120ee753ff0a7efd5e1b7681
SHA512 34c7dffec682945ab1d91cb66c996923960c57685cb0b3c8c44b97dfb7250851e9a2df2965d441f3e9d4e7ef260182806bb98c52398bb68d6c23f09d60381dce
MD5 SHA1 SHA512

Submit Download

Account Web Data

Path C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7\Default\Account Web Data
Size 76KB
SHA256 4f3e18eea355690c25b4de99b18e90f0c81cbb088228ffca12c84a53c6dff98f
MD5 b89fd902b32528a846212c73a9bfbe73
SHA1 b2bc3a06c5bf56df8b8245e2947e7f78fb6a416d
SHA512 ae387b21b2d3801abe3543f23d1705b51982e4f076c923cfee764f3ea525ce276d8360623be00d402ed7c804f801e36ba42b68d32a5f6e856e153d6b96ea750b
SSDEEP 96:pv+kOyOFXmT7i04MDDPtg3IM8n0ys5bSAoFLoeqclNz58rx2n:pln06Ca
TLSH
T15A73224A7A342505EDE28A362CF090F75D7C722D8F01A9412DA73028CDA5897F23A4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Affiliation Database

Path C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7\Default\Affiliation Database
Size 52KB
SHA256 4cb381b1a653296a38381f16bfd94dd09b9c900c0ed24eb532d372d647bcb96e
MD5 142456354ac4a1d7e89f037c2ebda0a2
SHA1 60b5e6036da7c3c1e4e10dc04c319e55cd125152
SHA512 cad919e47513bfbc050db3a996811643f5381ecbe3224c5ed34bf7dcfdec993d7a5e0af674f36625648866b4fad55578ab7427be38c17f6d9eb74403da02960d
SSDEEP 24:TL9VAlZGUWEKdPq9XUeS0z8jNvN2HhKroyr0d8D4BmhltoVOq6Uwccm5fBGQww:TbBzdPqJZSm86Uu8baVOlU1cWB
TLSH
T18F33DF061B685434C9ADD23498D90EE279B4126FD9D1E9A42DFC1D190FE04546CFD46B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsSiteData

Path C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7\Default\BrowsingTopicsSiteData
Size 28KB
SHA256 6bd856d68d3a2de856e64d766e2b9baacbe909d793087e84880050cb36bab1e1
MD5 faa1297eb819d33082266d374c1d492d
SHA1 91a6155f8d8c05c277e8460a7268de023f8ceec5
SHA512 120a94377078e09c960d070f09a417479708753b708a3bb148c118fa48faf12d85352317712b9d95b59d15cf5c90f1c0490f703ee4524c6bcd7f1c427e499ef3
SSDEEP 12:TLiqiw5xT5SmKT5Si8wT5SislpXUUfzBW8ybwaW2b8wAs76uvsUkHZ6HFxOUwa52:TLiq5byqkiXBzlRr6hkc6UwccI5fBG
TLSH
T149D29B8A5F32E951CAE0D63BB0C0866A9B34A2198BC26D531B1110328FC3401983B47D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7\Default\BrowsingTopicsState
Size 414B
SHA256 2fc8609168e9557340bf35f9070b90a8966b21df959d93c4da7f49e7cd2b662d
MD5 79363f72b362b5703be80cdf2a9344f0
SHA1 28b6482bab6f57ef4e7554c52150f30190f073f6
SHA512 6634cd76e85edef8de53bc28d6df9a1439fba2226de138e0673a113b7c09e8a2b17886319af94523c5d857ef5ccd5e0c59f72146d5759b5dd8579e5fbd452833
TLSH
T1DDE02BAAC871AC3B18FD4718505447C6E65113572742550FBF3D82088FB177A1581C1C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 189a3515a29d3466d4cd69a227c99303ad3984279a39ce4f35e8fbd1aab0ed97
MD5 ec4ede25d44aac85494cecc41a5c6498
SHA1 f3a03d9be73bbce1108741e19d9a2d2e0a06cb43
SHA512 c0a42db6033edd5c7ec5129ea028b26d0371b4c27400c65fa3d8ee8dd1af3bfd2b48bea6d0f79ac21ac77d16badea533478b335340108e49401b47216001fe19
SSDEEP 96:sfwSl1+wHmmdeob4rJaqDsa1W1riDExIKam9+kKPGXxEtODsXz96VTvlX4/mQ7RF:U/1+wHmmdexQqg5xIU+kbxaz8xvsCA/
TLSH
T17F130ABF22125EACC2DBB0BEBE038B7D73321C6CDAEC04AB89F27565155970C194E615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 1a5497c4e147879fbfa99c06b2b7f18eaead056a840e63c87d127c11a23afe3c
MD5 5f9d81dc7c82042224d59648ff5432e1
SHA1 cba8da3f543f4ab98bbfdb7fb9c92cb8fe19a066
SHA512 8082c7b6ee72f87919b3d575abeb7036752cf757c18f5a09209acb73eaa47929f484bb953e7af3bcaa14cebaddc8a0f6572ffb3456d3fbfa2958eb71b884a76f
SSDEEP 1536:wLPYnZIiW4mL8IrxUsoffgbUiWiiIbpVM8poxxL3:RZIiW5oIKHgbUliVs
TLSH
T104444EF743059458FAA942FAD30D753DF53B043D2CD7EDD8E6A178F21820B66A2948B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 055bf76d2268ec3cf2f25fb4fac4ee878d95ad1f3938f7f8873ca1517102abc9
MD5 ec169e0fd739790718bdbde56e3c2a83
SHA1 424bcaf4b5e33cb1be3e36387d14aa7b3d5a706d
SHA512 81c06093db85a5def1b02958915bc68ad251810ff6ac23eccfe06553fe12a253c52fa65844b34991c1597fbfcb4ddbec81f866a049a6e3ec54ede38d8a9fb9e7
SSDEEP 12288:P/j1XW3DEFbIgLm4i9nVoruQOhkk73HeLxd/QjDAKkIlfKGBIv6rJahKFjjkWcDU:KExzr/R
TLSH
T19A25F8DECA681DC3EAA74EB5B0D0D8077DB42182F549C1D39901C1D89BC1786BAE91FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 f7c009d2ec70bc93bed42579b47f9dc6a5c51815fc0ea05d9f0f209ee992ecf3
MD5 d0a4c1d33eed1c5bae10a2a6ab5a03e2
SHA1 57f345e8458d441967f2ea08ab55fca9d5a66487
SHA512 5f9cca5e4a41574b0acb719b6091abacd742d8c8bfd42331d0e08230d43af7a5258e85fb0d54c33cf2af0b6d5b18d86acdae9399a5390c876410b58f4dce8b06
SSDEEP 24576:zDm7AprqhynTWtg9jmsPPZnxLnxDY1I+48AdJPBjn+Oc6jg8EZGn:+sH
TLSH
T1B916AE4B2B301441EF429E79F4C8EA673E331E78587398C16726796E4EB93E5670221F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 ddb4e41323648280cd89168113bdae4e1f4196a3d1c01e02d84a7b7049124bcc
MD5 74bcafea89ff4dd34309e4b328ad6706
SHA1 8fddecee09233e7a55b100d3c415db0db59cd22b
SHA512 21800b0ae1109119509f3888c15e51ff2967abf408d1c1bc0cf5431a46662a114f6ade1394047c3168b70062ffe39997127c1112557cfd7b9b9318cae4c399c0
TLSH
T132411E15C8C0A70FFFA682F50C267D58BA351DAA4DC31BF709CD2431A2DF8C122A2D54
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a4200451f634472ca40d3b7efcdd4024e8375599131bdabda2f50c545e414b51
MD5 75619f4d5c275322556816930499ebe3
SHA1 309111e8b0700d12e13921e392a08c5e7eecb859
SHA512 915ab161776abc83421c6f2b737e061e87a11c0b42b02ad8324a357a23729270322aa5f6742c74cb94fa7fab76b3eaf2383678418de968ab81dd34813181fc6b
TLSH
T1C061A12588D0B38EFFA942F104A53E4F7A345AAE0E920BF7058D1830A7CF6DD1852D15
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594b38.TMP

Path C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7\Default\Code Cache\js\index-dir\the-real-index~RFe594b38.TMP
Size 48B
SHA256 8fa0623857b02c206201dcd8b54f170aa820e14344cac8dcabac5bb8fd48bbb4
MD5 b7ff890775579fceadfdf9bdc574e6f3
SHA1 60d1268e122230f0cf1cd19f0d858b54f1117284
SHA512 135a223413070a611cc15b5a0122dce906924aa40f56ab19edb110d743330933e67d5c35836e7fd7e3c90a07892908cf41df7aa5b534829c6acb362cdcc65fee
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7\Default\Network\Network Persistent State
Size 4KB
SHA256 9ee8d391e4455a4ec60ae6cc1c9e8323f282f6bfa67ba15813a61f7d9ed6971f
MD5 95525fbfd0740d92c4e4bd2ab138b186
SHA1 e8cb81fb620cecad595c7686a3649284f0141709
SHA512 0eaa84818a3b30b435b74e8a3e344f29e76c99b82aebcd452788180a0d029e322f436fa7bd27b6bd26064a3c0decf2c85198aaf796c97d6d2abf493d06ab8ff7
SSDEEP 48:YALlO8lIhVuqjnqjWhVkqjVHjnseng9xUsN4syUfsCos8KseHA3spAmsnQisSHxq:DXIaSd4kHjDg97xvsYHAOAZQ0HxuGhfK
TLSH
T137A178B383E4CA6D991662F09A156E1BCE5D0924031C3C7689E4BE5B93F25B2E20179F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State~RFe599570.TMP

Path C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7\Default\Network\Network Persistent State~RFe599570.TMP
Size 59B
SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
MD5 78bfcecb05ed1904edce3b60cb5c7e62
SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
TLSH
T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7\Default\Preferences
Size 7KB
SHA256 68e60d9babaa5dc003b70f22470c14366dbdd94a3d74ca8b881728868482d5e6
MD5 5748d6a45a6ec9dda5a1b537b9f46107
SHA1 9f89c0fe4ffb39cfde28e705c19803c85a8d7537
SHA512 918fb87651d18556a3275a7db620d221a466433485d741b8b965a3660f90394b42ef2f379bdbb0f4afdd4c2bb4031e97ecc44a31cbb46227bf4b168fbd4cac48
SSDEEP 192:NRJT5Pv7gpAPRp2b1Xsb+WNnHfDyKeRlJ:NRJT5H8UXkXw//eB
TLSH
T122E1A426AD58AA379CE7D119BD347B83E5F61031A6C50E046BFCCA2C05AA7DE220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7\Default\Preferences
Size 7KB
SHA256 401ee3648c8cbd8dca6276fe7954e58f01263ac7374e7548f9a2440f650c5ddd
MD5 e64367e750d3b80ae9d084237f6bf48a
SHA1 0157d914a85a782874cc79882b9d32de17dda082
SHA512 e7f79afe54d7bb20f29b46d2833e4720f117517add5c96f44ba3b8d39ebb83ad2fbbf64b294814e852a72919ea5a8d189a4af117d279d029da547fe13e7e17ee
SSDEEP 192:NRGT5Pv7apAPRp2baXsb+WNXvHfDBAVQgFFfGo:NRGT5HWUXfXwHd4QgFJ
TLSH
T13CF1A517AD68A937ACE7D11DBD25BBD2E5F6102197C44E046BFC8E2C05AA7CE220750B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe590d25.TMP

Path C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7\Default\Preferences~RFe590d25.TMP
Size 6KB
SHA256 922b7c76da7f1d00e5fa1b21849239d0624b8a9e49d99210af3e490563e48151
MD5 e8f56a76dd7b0c6722db15503b2a6de0
SHA1 3cdcb0115616aa9b12da930892b1d2affc937797
SHA512 7fd88243b74fef7945dceb91f1775f6e8ace65ccfb1d0c32a69f85a7750a732efec74835f36a238026f1236a19048799cc94f2dffebbdd8226d98b5d9d1bc537
SSDEEP 96:u2RB3NVQcHcSUsjHv7ZtdbWhE0Ri02UWA+6uX792b+WVoMkm+TepHAS1hZ6S1AOO:NRJT5Pv71APRp2b1Xsb+WNnHfDZd2Ylq
TLSH
T1BDE19657AD68A9375CE7D11DBD347B83F5F61031A6C40E04ABFC8A2C05AA7DE220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7\Default\Secure Preferences
Size 5KB
SHA256 fabd01f219431afec28da11c0f3cc88fe5565355fed89c79720cf7979fbc84d6
MD5 ce0069550cb37f80a46ad81be43661a0
SHA1 85e8da315752e92e2e8e2a8db1d4828acb353b40
SHA512 1e2eaa2571ca937ef0e030015c51815cd9aa77894297bab9701b1a0afd72bc1ceebc3b88ee0781bde4cf02f01d97104441f8c30ef7d0f499052cf06fbb97faae
SSDEEP 96:erIyCiQ2nK+zSi/7VaTLYmuKA1bByWwLgi4Yf4ae5:ezQ4K+D5XzKwcTgZB5
TLSH
T1B6C1F896495DCBB24FA8D66CEC02ABC7DEF1092AA1E45C045AF2894C03D2BDD13575E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences~RFe5994d4.TMP

Path C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7\Default\Secure Preferences~RFe5994d4.TMP
Size 5KB
SHA256 df991fb4841a5383d87111bf04989e28d2afdf444b071bdfbeb6df86e8d170ca
MD5 8e85a26147987e5e7f09066ac33ab0bd
SHA1 900746269cff3ea02686a867c5c900eddfb4398e
SHA512 9e3ce5e5e16be3ec458c1709a31ef634cbe9b7092bd2c4ca064bbee4fff009363bd61bd3d9f2046a00da48cf2b2280c39051fddbed25119f64874afa7f47db90
SSDEEP 96:erIyCiQ2nK+zSi/7VaTLYmuK4i1bByWwLgi3Yf4aeA:ezQ4K+D5XzKTcTgiBA
TLSH
T1BCC1E896594DCBB24FA8CA6CAC02AB87DEF0092AA1E44C145AF3894C03D3BDD13575E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7\Local State
Size 3KB
SHA256 336e5d716cffac0968773fae4ace888fe0af9969e2b881d647e9f281c59e4dae
MD5 6295cb20f4cda318d792a8bd6a4adb81
SHA1 788cfc58d210e753f45798e993fc0c42b25a1d68
SHA512 0e82526b8be7e341ba4b3679e13b2454618990918bd6ea5c935bcf5e3e4124c0961f41c44173bc51067cdc226c818e0cf4522fe0716dc181b49ef2eb1d3e9fe7
TLSH
T15771E962B55CE8736972D544F4423A43DE78222BF611BE90EBEC0E1C04FB7E9130251B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7\Local State
Size 3KB
SHA256 64b168bb9dae95c8dc5e9fbc9aeaab8347b8244dcac7ca90f466fe3bed88360c
MD5 ce7987f138f3e2590f1bf4c58b7eef3b
SHA1 08c37898d9ba1ae4b58d919aad0e7c1d9e0efdff
SHA512 290fef5148b97823d94c5d1d5761ca92b1135963f62dc9d30e7f28c0ea8f7006338697b23a46945cd37c73713b4626e4ff4da740dfd1a17a3ebbc736671dce2b
TLSH
T15281E962B45CE8736972D545B4423A43DE74212BF211FE50EAED0E1C14FB7E9134251B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7\Local State
Size 3KB
SHA256 e418fde65ae1b8063e155fe7d7b4beb9ae69d27852c5e82d30c690a797dd141b
MD5 d395ffc7219ca5fa983d07b732476ec9
SHA1 3de7089ae0f364feccffc14f0ca6061b2e4354f1
SHA512 b40de20372fc0d76c10014db3484717319ad05677146fbddcafce48264e77ee17713af1c0424a3cab0ca4d9d7c1ab694a0f90c658127fd9f8cf536f1f9dce6b4
TLSH
T1D281EAA2B49CE8736972D545B4423A43DF74212BF651BE50DBEC0E1C14FB7E9130151B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7\Local State
Size 3KB
SHA256 be433e8bcaca36095333ed10d0d2790892ff0b1fea2847aa27b2ad26244bef5f
MD5 56b495a00f4f3e7fa4d9d787e84e6204
SHA1 cdd66967d7fa13394f51e0c18456512b85c7599b
SHA512 dc92f70aa8f4113a677d1880a6d635a155737fddc3fde73928dae91d2f60c231ca3e2b8df7eaca525a08f6a3bc8bcdaecf4d1df0a103ae86f8af3ca085fca320
TLSH
T18781D862B45CE87369B2D545F4423A43DE74222BE611BE50EAED0E1C14FB7E9134251B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58e4fc.TMP

Path C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7\Local State~RFe58e4fc.TMP
Size 1KB
SHA256 3784312ad9f5e19478c9660f8040a5692b3ca6eb869a2bcadbf25fb173f70c2e
MD5 37432dd60863b37af327e74e4e2607e5
SHA1 4b6933223c5cec72169e0b3bdbbd88455418f8a4
SHA512 090e2ebdc9cfa6fc602438834634cf68301d288bb2721c978a265562778cf28e83a290c2d6de4e8274e53666412b3333538ed9513dd29d60f19a5f6597fb77db
TLSH
T154117571BC6476617E50C6A9DA0277A71E2D133BC1C5ED082FCD0D05197A36C2B01C3C
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Temp\mr-login-113d46bb-cf45-4e4e-981f-9de1001e8be7\component_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\CertificateRevocation\6498.2025.9.4\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 6764843791832fcf4850aefed29aaf3eaa2ad3fc7aea291089f1123f3d3f8a14
MD5 66e9a3fb269dd8f988387478dcbafb91
SHA1 767f4861c826b47bd59924da73f8ae5c50fa3e5d
SHA512 4c22c3ed0fb623befc00b1fc803686a12f0795f2a75004f19ccde127547939b186149fe02f7b1df60c4dd0a7aeb6303a9afe08cd18de0033c1c771b63b4a4fce
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7fac29c36b29c22cabc00d4aea4ad02b346277372346aff3a0276936c84789f6
MD5 97b6ca00d722215f4c5952084f553060
SHA1 54671d128f3fb11b6a6113ec4649c004c07378c8
SHA512 3c9822864371b1c00482759d2c650b0d6dd066576c541cbcc7acdc546dcae3feaa96175005b364c18c8e8fdcbf8260db15dccd90a85e2f6a71b9c9cb5f0d0ab7
TLSH
T1E2D0121672414134C01024331042B2490D40C20B4089410064B8862E1AD40941E024C3
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 49c3561263cbcaaab1fcfc0c1f3194cb3dcf3682a6c041954e8a82086e19f9dd
MD5 28f4aade309fe345cd0c01549896c6bb
SHA1 5284204af6a8df4e38ea00103f2818b3a52f6b20
SHA512 19cbce3df11c4b194ef2c372762c22ccf44bcc942cd75d9dd664d5ac4331a19588ee70985e5b6d2eb28575ee0e860274e1a5eec5738816cf37f7c5c39da82709
TLSH
T1BAB02233808C8302C30C03B080C3B08030300F3002AB0E0080A203B0CB3BBF0A0E2008
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 dd46c9d3c2f9d5383ebb70344573bc34a787a20c577d90dfe6ca01d6f65385f7
MD5 7676f4f9ba2d36fcd4dce8f8d2911d58
SHA1 a2bd553a85813ce610951314cbb9cca79bc9afc9
SHA512 c5c0a7c189b3ae3f58404fa398c55a89c7532d1ac893ed05e59f12a7e941420669abbe72ef0de907918fc7192d9a702ebcf041008216e5e42b8f052b4beeae35
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 9e700c582894c1d578952bfa1a1bb86938a4834d2b3052d04528d75f9e32a3d5
MD5 2858edbe8e22386eb020ea5c38dfb2e9
SHA1 3b8a6b436becad218aed96d5600d8efbe6fc9894
SHA512 60d42fdda413b9fbcf90d166b682d7e036265c60b901c0a0fd9982bcadbd277a395bb0f39e700d81f059a56863374503ed4f8515e147bf1f3531029c40d6b968
SSDEEP 3:LstlNllkll/lxQal/:LsX3lEtx3l/
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Default\Network\Network Persistent State
Size 821B
SHA256 08706bfd145ccca6a23aa90c0582b9bb8fb9ce75cd4e0fec15479b989ab47ff6
MD5 cfec37670a0a837c479a673a7b13e801
SHA1 97d165ea9c3ce55ce83101fb598089985dda1f05
SHA512 dd4a464cfbd0ec540d9478f0ea5a0279adbd81da3a38068a6d8e518eb075447557c71d7b5d31b8076e3b6ac6e37fcae3f52e449d0c43d5fea28106dffaf2114e
TLSH
T156018EA2C3D4C67D8A4126E027343813CD2E041A92283D67CDE9EFDA57E1471D21064F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Default\Network\Network Persistent State
Size 948B
SHA256 b58e7ee372c1e10c427b4868c339d4eeba15a7123e9e76372827f939f9d838d6
MD5 6f2dabde7fbec868c625f4ce11bde760
SHA1 e0b11b7d800f1cf903dc4ade1a3ca26df921e1ec
SHA512 a3e372f95869b29fc36fe37d8890b3f4b09d0f6ac11d7582da124b934e61aebc3981d64a384ec4b6da411c1db69409cb5f36d310590ce8a4d81ecd35c90b0bb8
TLSH
T13F1194A283E4C57D4A4166E427343813CD3E041693283D77CDE9EFD65BE1472D11064F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe596018.TMP

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Default\Network\Network Persistent State~RFe596018.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Default\Network\TransportSecurity
Size 524B
SHA256 e3aa8d6e519aa81e0400960e6b002fef1b6b522f8754ce0f3e5379f332c76d35
MD5 a5dbbd47c311d4ce975601b05b5bd189
SHA1 a319a525d67d98d0bcb7e4d8a164f6af320edec7
SHA512 02d701e302c74d9e684f95ff18f089ff18500b9c314f1d44eb84986535349d56df9d435bbcb7e3f6dd4bfa96186a6244c62e76b5c802b98b6a1b503be0ad7e47
TLSH
T132F0C9BB00BAA82B10781B661C8478611A3AB0380125B8F0EBC318AD7085CF3AB12123
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe59c317.TMP

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Default\Network\TransportSecurity~RFe59c317.TMP
Size 356B
SHA256 9acf2c206b76b00a505283b5360faf782ebb069d58b46b390519014c7caae59c
MD5 f855901bd3b84243c38422caecbc5ea7
SHA1 8e1db2f3143e6cd80182c9b43b2556d119dde7aa
SHA512 1dbd65988df5c3101ca2855d0ea6b6dc3092849b151a3af248d05d922800e9b8e528bdc5fa195a352fbd702d6b77457599daaf5f3545da63bb22a27a58bd73a3
TLSH
T1D4E026F740BAA53F20380E2718CA7DA11E7AB530016198E8E9C348ADB081DB78A16423
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Default\Preferences
Size 7KB
SHA256 27180c0a63236167e4cd10c0102de10f48758455e7f937190cbf664e69758ac6
MD5 ccd3f239d9469873596df773113c63f1
SHA1 3c7648be720e48d47f5364b5b7143f8a397bd67e
SHA512 d2b718ad96c4b4c7d31106aa956de18bb6e3d234ac419cd075c9df8c41d538caeabb2756030dbdd4d3876eae0378009eea0091eb96ef335254ecfeaf525e2c57
SSDEEP 96:stz05kmhkb9gffqQZ8i0vhEaktom/7qx+WVHMSm+uecJY2v6YEaQj2+gT4Vu4qKC:stz0qUfxZ8pa5B/S+WiTY2CYRjSrqKC
TLSH
T135E1A5025E28697B5CD7E61DBA35BB52E2F61062A3D01E88ABFC860C04E67CD520790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Default\Preferences
Size 6KB
SHA256 d6b0cb762de8b477f6e630d6858bb0bde5aa4c941d2c972abd649014b421ecc3
MD5 ca7245c5947aa012eb4ae2cd506d77bc
SHA1 1554e591212c75f308e9f5713cc9d48711078f95
SHA512 1576e56509ce07495b3abc8b2cab864f3f565444d8a53d5fd719219eb4d7dc9521764f10f87a9afe7fb7ea017be9b6ee920c9cc52e625e902f7411065b81153b
SSDEEP 96:stz05kmhkb9gffTZ8i0vhEaktom/7qx+WVHMSm+uecJ+8MFHYEaQj2+gT4pZMOB:stz0qUfbZ8pa5B/S+WiT+8qYRjQZMC
TLSH
T104E1A7439E2C697B5CC7E2597E35BB52E2F61062A2D00E98EBFC860C05E67DC130790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58e673.TMP

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Default\Preferences~RFe58e673.TMP
Size 6KB
SHA256 d88fbf37253ff1b8d920dec560b80633cb62646db3f3fdf56c76110a3b2ea2f9
MD5 7140ea14dbeff7ac255ba0ebc7cdd0d8
SHA1 149ab01ea5500ab9aa0366eb41e4567aaaecc86b
SHA512 8a9eb40e123669e179e1adac3de8cb9e71ed14112cbd3239a2864eb3ccc0a8fd1bf8bf957d9a3d377279fd00f457ce681792a2386523d8b2ba5d170bd94fe543
SSDEEP 96:stz05kmhkb9rffTZ8i0vhEaktom/7qx+WVHMSm+uecJF+1iYEaQj2+gTmZMEB:stz0qffbZ8pa5B/S+WiTF+wYRjwZM8
TLSH
T136D186435E2869774CC7E219BE35FB56D2F61062A2D41E98EBFC861C08E67CC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Local State
Size 17KB
SHA256 c4981d2d0011b7923857dfde24a4a14b4525465a6049d3a4e88a1683f577d698
MD5 5e92eb6a1bd39d4b1a35ca72f5828897
SHA1 5a1421bf6d0cefcb5385f031ebc8756314d5abb6
SHA512 3f0dd0ed9e769ace24a9f58e828ecb4d77652bfadc5689910c7cb5c067a1df2be3b1066e0e535cd70af9595958bca501ef93507aac1d8eef0439de0db948eda6
SSDEEP 384:zlsrv+89zHqlDNP9oidUNg57Gp0/cGlikNN:Grv+4UNbdhC8cGlikNN
TLSH
T1FB829C32E828E7376DF28984B546BA977BB4519292C50BE4D9C90F8D42CB5DD2307D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Local State
Size 1KB
SHA256 e7003a35f0519e75f2236bb096512997b414ca4119db92f95226ca31f7b3bcc2
MD5 2f1cef8cb2e6804d9b7f81f5e25139fe
SHA1 46d47144a5a98f6382b5bfb2527e527eb50d32af
SHA512 f21c11f6a0dc619c84f717fa493bb7affeaa6647748d6279a9bee4344c6167c3ab9cbbd82adc80112735b47c3fe285ad6ddd0ce2a282b5a51641267a9be10ae6
TLSH
T1F3316273A8D86F767DA295C1B605BAE76E600026D2601F44A3DE4B0C11F73EC9236D32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Local State
Size 17KB
SHA256 68dde84a07388f4633282b8d4bbfe285bbe137a53bd971658aef684b3713ae94
MD5 051b455eeaa8c3d081526737cd68ea50
SHA1 3d68d4fd75b5fa7f9dda03804ec4e356aa439d7b
SHA512 c551b6541645253883a6992d164943c58753681061c5a5706c4c17c5eee103795154bba8aedb12bb8b196f732f18acc35c01a9fac9fe75cb4461cba7598895ee
SSDEEP 384:z5srv+89zHqlDNP9oidG3Ng5cap0/aEGliLNN:irv+4UNbdG0p8aEGliLNN
TLSH
T1E3829D32E828E7376DF38985B54ABA577BB8509292C50BE4D9C90F8D42DB5CE2307D13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Local State
Size 2KB
SHA256 dbda3d379c83612a29180342992e5cf23ac5e74e9f7dedf2c588ac82fc440a41
MD5 792b6e5c3ac0d0708ffc40ad7c05faf6
SHA1 4b1ab14d1f54f77200a9e3fbbf50dcba46af52cc
SHA512 b12968e95244c28bf3a68c8a66b1fd0c186425690f73f30127b46af3caf75c6771b0b12301884cf2d9261da2bcf5be2cd59f7ed442a3f1b970b4b4dfa158c8fb
TLSH
T1AA5186336C58AE7A5AF39984BD497FA3AA355061D7612F50A7DD0B0C00E76AC2312D37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Local State
Size 3KB
SHA256 004f3fee84c69dec65c6a23c06bb8343b3685dbe3e9a3922d1e4c97f2ce75810
MD5 df117e003238c23f28eb21ac482d84db
SHA1 8f5cb06ff2b9044fdf1113e2aabe9532fd22894d
SHA512 020e49fd33becd9766821537f3a870319ce047deb587731e9bff6fa69521a26bb63c28fc81857a6bab0656aec7ceb80a57b2781cee2c29952ee74fdef82f1f26
TLSH
T17D71852368A8A93B5EF3D984FD892B57B6A55023E6913F94D6EC0F0C01E73D81352D27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Local State
Size 16KB
SHA256 acedd60bc4a4ac9d9e177030693bc7cc3b69961c6665a3a87a7312da77071b7e
MD5 201adfbdf08a9621e5ad82b8c396ca5c
SHA1 20684ff232f6f89d52d672205d5911d831297e48
SHA512 21b9d45defd82608c980bbcc301e57d6abfefbc1b41a933b12b52a22bd0d211b758f209516fe96a643f577a59e658886cb6cc740f4f12c8ce0fcd56436a7d350
SSDEEP 384:zQsrv+89zHqlDNP9oidOWNb5gGpLlikNN:Hrv+4UNbd7TdlikNN
TLSH
T1AA729E33A43CA7775EB29884F88A7A573B785097D2C11BA4E6C90F4D02DE5D82317E13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Local State
Size 16KB
SHA256 2f35b6e136438d69bb9a5411fef8de8b9c09dc501a608433031253f92f4ba488
MD5 e754aafa1f66457ea03698508ef5051b
SHA1 b428b06fe4e758b83a9ac5e7175d203951be2567
SHA512 b315b7662f552306669f105b43af5ae95e45e54a026b005dec1f9051cd50d8f817969f0bac81c04736198c3d71764ab7bb9b24fabb558ad1c361c3c10eddba9a
SSDEEP 192:zaYsrSABD6KZenoX+pshLTGbdna37W6h6DWYP9E4Y53yJGPa/a7vJNb5s1ooDUhJ:zHsrv+89zHqlDNP9oidUNb5gGpLlikNN
TLSH
T10072AE33A87CA7775EB29844F44A7A573B785096D2C11BE4E6C90F4D02DE5D82313E13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5847a3.TMP

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Local State~RFe5847a3.TMP
Size 1KB
SHA256 ccb129ad3c1b8222357a1e5df0199480c7b9d2bcfba3b6e8f6083ce3a197ed64
MD5 6a134c87df61ea92683366e074b92617
SHA1 daf0a8caf80b753ae677bd79f242e2e63bed24b9
SHA512 bb6b7fa27f7a094b22ba8c4da1f594aebda5530396c57a8ced942d1295e785f38c0fca27cf55c0da27a93a3885122357f73c0b18a89ec89b21065df2221ab101
TLSH
T14C212073D8986E7579664880B505BADB2D604066D2201F08A2CE470915F76EC9276C72
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

RobloxNative.exe

Path C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe
Size 16KB
SHA256 fbb78feefdc063a7bd386097ced54bf89f25cd9f1a0d4dedd4f77588a4576161
MD5 9926bec5de4fad32673460a5a2540845
SHA1 a6e36fae48f70a5f35fdffa0fdb4d01f288b1061
SHA512 565c4080c98bbb4a050792822a62e78319309663dc4eb1a1abcc6f6e14b6a828f777481e76622dbe44009bd6916d95ec9fa47775d816ad33be0a308204c58d31
SSDEEP 384:eedw4AM1YsY9SSqjCqAXlmoR1In542ohhdK3i9V6dTYWNd:eurAM1hY9SSqxQlNRC52hYYWNd
TLSH
T100726B90B7ED8479C93F9B3D2CF246044375E9826927C7891CEDBC4A2E53B8103867B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Roaming\multiroblox\settings.json
Size 194B
SHA256 8433b056c2a651e5d1e1ef8ac8a92fb98b6186feed5b7cb105febebe69fea1e0
MD5 7cd982c626570f31aa6f5fe9b81fe8be
SHA1 f23b3377f9e73f3f6544ad5a2c5c29303acf39c6
SHA512 5adb3b4db70d9da5a01e5cb9a8f7e25efc524ec6315af34f56ee640c6e4b069b1e0bde218eab6642cec718e26932327b595c487dbe34b1069ab9cd70ea139447
TLSH
T13FC022019B1C38B22280F6439E82FC4308085C01CE8A366AF682108312BBB1B40622F4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2752-199-0x00000000006D0000-0x00000000006D8000-memory.dmp

Download

memory/3060-151-0x00007FFF73E00000-0x00007FFF73E01000-memory.dmp

Download

memory/3060-255-0x000001D578F40000-0x000001D578FEC000-memory.dmp

Download

memory/4772-254-0x000001398A620000-0x000001398A6CC000-memory.dmp

Download

memory/4772-263-0x000001398A620000-0x000001398A6CC000-memory.dmp

Download

memory/4772-25-0x00007FFF73E00000-0x00007FFF73E01000-memory.dmp

Download

memory/4904-71-0x00007FFF73A90000-0x00007FFF73A91000-memory.dmp

Download

memory/4904-68-0x00007FFF755D0000-0x00007FFF755D1000-memory.dmp

Download