cea5a951fd88df06f919c6d097c9105c13ae0cb472955626942603dd73dd0d99

Analysis

max time kernel
150s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 16:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MultiRoblox.exe
Size 7.8MB
Sample260808-t47mesvvcz
SHA256 cea5a951fd88df06f919c6d097c9105c13ae0cb472955626942603dd73dd0d99
MD5 5a7e90efb9a6f00619306ee0ace272ff
SHA1 53a3f1ab69262e4d6d9aa77693d462e246f8613b
SHA512 f3af768e4250ca7abd5f9ea9499b910f5c234dbf88514018ac900f2d9bee241bf0468d4f17094948ff6f9af65b4179898a80ae201ea90afaf44a3238e6e03ef6
SSDEEP 98304:1bCQciuxQh7M9kI8HRg3IJmklJESmyDpussGn+M:0iC9cRTrAKf
TLSH
T183865C43F69281E8C0AEC474835AA233E772B8CD0934B2BB5BD45B212F66F506F1D759
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5344	RobloxNative.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MultiRoblox.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1764_1272889566\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1764_1272889566\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1764_1272889566\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1764_1062551513\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1764_1062551513\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1764_1062551513\manifest.fingerprint	msedgewebview2.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4740	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4580	taskkill.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5344	RobloxNative.exe
5344	RobloxNative.exe
1768	msedgewebview2.exe
1768	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1764	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4580	taskkill.exe
Token: SeDebugPrivilege	5344	RobloxNative.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4640	MultiRoblox.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 1764	4640	MultiRoblox.exe	89
PID 1764 wrote to memory of 3224	1764	msedgewebview2.exe	90
PID 1764 wrote to memory of 940	1764	msedgewebview2.exe	91
PID 1764 wrote to memory of 940	1764	msedgewebview2.exe	91
PID 1764 wrote to memory of 940	1764	msedgewebview2.exe	91
PID 1764 wrote to memory of 940	1764	msedgewebview2.exe	91
PID 1764 wrote to memory of 1092	1764	msedgewebview2.exe	92
PID 1764 wrote to memory of 3296	1764	msedgewebview2.exe	93
PID 1764 wrote to memory of 3296	1764	msedgewebview2.exe	93
PID 1764 wrote to memory of 3296	1764	msedgewebview2.exe	93
PID 1764 wrote to memory of 4184	1764	msedgewebview2.exe	94
PID 1764 wrote to memory of 4184	1764	msedgewebview2.exe	94
PID 1764 wrote to memory of 4184	1764	msedgewebview2.exe	94
PID 1764 wrote to memory of 4184	1764	msedgewebview2.exe	94
PID 1764 wrote to memory of 4184	1764	msedgewebview2.exe	94
PID 4640 wrote to memory of 4740	4640	MultiRoblox.exe	95
PID 4740 wrote to memory of 4580	4740	cmd.exe	97
PID 4640 wrote to memory of 5344	4640	MultiRoblox.exe	99
PID 1764 wrote to memory of 1148	1764	msedgewebview2.exe	104
PID 1764 wrote to memory of 1148	1764	msedgewebview2.exe	104
PID 1764 wrote to memory of 1148	1764	msedgewebview2.exe	104
PID 1764 wrote to memory of 1768	1764	msedgewebview2.exe	105
PID 1764 wrote to memory of 5008	1764	msedgewebview2.exe	106
PID 1764 wrote to memory of 5008	1764	msedgewebview2.exe	106
PID 1764 wrote to memory of 5008	1764	msedgewebview2.exe	106

C:\Users\Admin\AppData\Local\Temp\MultiRoblox.exe
"C:\Users\Admin\AppData\Local\Temp\MultiRoblox.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=MultiRoblox.exe --webview-exe-version=1.2.3 --user-data-dir="C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4640.3428.4961853384188286473 /pfhostedapp:7d743c68dedddbd1184591ea35c6c840b01a3e82
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1764
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView /prefetch:4 /pfhostedapp:7d743c68dedddbd1184591ea35c6c840b01a3e82 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffb92235fd8,0x7ffb92235fe4,0x7ffb92235ff0
    3⤵
    PID:3224
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView" --webview-exe-name=MultiRoblox.exe --webview-exe-version=1.2.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1688 --field-trial-handle=1408,i,18394704552149801361,9624639324137434249,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:7d743c68dedddbd1184591ea35c6c840b01a3e82
    3⤵
    PID:940
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView" --webview-exe-name=MultiRoblox.exe --webview-exe-version=1.2.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2036 --field-trial-handle=1408,i,18394704552149801361,9624639324137434249,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:7d743c68dedddbd1184591ea35c6c840b01a3e82
    3⤵
    PID:1092
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView" --webview-exe-name=MultiRoblox.exe --webview-exe-version=1.2.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2428 --field-trial-handle=1408,i,18394704552149801361,9624639324137434249,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7d743c68dedddbd1184591ea35c6c840b01a3e82
    3⤵
    PID:3296
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView" --webview-exe-name=MultiRoblox.exe --webview-exe-version=1.2.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3540 --field-trial-handle=1408,i,18394704552149801361,9624639324137434249,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:7d743c68dedddbd1184591ea35c6c840b01a3e82 /prefetch:1
    3⤵
    PID:4184
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView" --webview-exe-name=MultiRoblox.exe --webview-exe-version=1.2.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=824 --field-trial-handle=1408,i,18394704552149801361,9624639324137434249,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7d743c68dedddbd1184591ea35c6c840b01a3e82
    3⤵
    PID:1148
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView" --webview-exe-name=MultiRoblox.exe --webview-exe-version=1.2.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4768 --field-trial-handle=1408,i,18394704552149801361,9624639324137434249,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7d743c68dedddbd1184591ea35c6c840b01a3e82
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1768
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView" --webview-exe-name=MultiRoblox.exe --webview-exe-version=1.2.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2096 --field-trial-handle=1408,i,18394704552149801361,9624639324137434249,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7d743c68dedddbd1184591ea35c6c840b01a3e82
    3⤵
    PID:5008
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /F /IM RobloxNative.exe /T"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM RobloxNative.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4580
- C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe
  "C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe" daemon
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 d935ccdfde2c756642fb87f5608b189e33c50094fd38c0466ce216f65276af3c
MD5 f1e33bf8abd0a706751d2556995f5f4a
SHA1 836253352e6e2715e8a18c6e2160de7cba8b0c12
SHA512 78da161bbaedd7c686ee5aff78060d3faa970ef537b9d7c7a03c9d3725e9c36c7f645907c1ebe287f2b3a8b98a3e976c7688878bf820897f2b3d0482cf803dce
TLSH
T148D01213B2410134D01026732013B10C0942D10F40094005682DE52E1F240500912446
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 51583f7658d4ae3d17f5e12e4447a085f79e6a5271366129ccf3dbfee0ded480
MD5 e4955c8bb95dafc9737a8f2c0c4d8bae
SHA1 a4d5088569fa2297656d84cedd65cd8cba334ce0
SHA512 b20295c0c154e4af814ab188fbc5bfb002bb8ef671b2cad6ad0311754334d28c0c71a3e45196ce09f6f595ddcc61b998cef1f0ec3a6c174518ad6254eab7dc85
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 749e58e54820cc288244172b8167e30b68590a07b814bae3d23fd6a0baadb005
MD5 8700526d7e3f325e3f06b41c35d912c9
SHA1 31941c21219c3893de4de13503f15bfd0f0461f3
SHA512 a64b727ca72bbc38a6bec9244452347254b48f5479bb267e99ff3e08fece18b1c8b4af592d577e894397a85f0d4fe2803a8dc9636aee21977bc91d298e03d152
TLSH
T1E3B0220000808003F38E03B000CBA00338308FA002CB0C02ABF30CF2C020380C3B0000
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a435.TMP

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59a435.TMP
Size 48B
SHA256 4a9bfa9bfaaadceec5e1da16928255fa7ba31eddb66e25b03aa5670e3d898068
MD5 11c49274f7b104293173e222c7fd6112
SHA1 86bab8fdf2d3459bab17b902de60c660227ea985
SHA512 6946a0bf458139caffbd7d9537fc969d1bb4925a46c6e0c6d14a2998ba0eb527fdba0d3c00bd2645958d61c4fbf818da18bb0566fd02077bee10534cd91de42c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Default\Network\Network Persistent State
Size 821B
SHA256 c21219ce753de8ba00ca80f56eb75800d52c6db96fc405446166491db82d47e1
MD5 1f813f068bf70617db8e2df9ed660384
SHA1 776cee19d9bc2936646c57fa5dd2f4fd752431d7
SHA512 096f556e2516ca1d9b3ed0bfc338b3027d6dc90cf4184172e02df178d689881d939e62817daf42fcdd4612f9614d3b12d6c04001da8a0b9ca8334db7f55aa1d9
TLSH
T121018EA2C3E4C6BE8A5116E06B347823CD2F051D92282D27DDEDEFEA97E1471D21064F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a65ff.TMP

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Default\Network\Network Persistent State~RFe5a65ff.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Default\Preferences
Size 6KB
SHA256 eaefc11b76054b86dcb16e816306a95b86f376b9a32c09c7cc3b076a273b799a
MD5 727a75e831e06619bbaa4152b60cebde
SHA1 b911333fc201a65431bd868a7eba82f133d68484
SHA512 39e9db21e4b9b4682864c31032681d3af2cdcfe3f780554d04a53007d72acdbf8f0a0052660ba441b6c1479e654923058c7cf077360daf4ee443de207daa6111
SSDEEP 96:stH/dyd2BGsPb9ckzo5h16Z0gs7/x+6MhmuecJGz1ejemK+gIy28XM1C7K:stfgb2ongsV+FdGzQjWqyG6K
TLSH
T11BD1C8025E28797B4CC7E609BA397B13E2F9503265D11E58EBFC492C18EB6DC231790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

ef5f0ad2-895c-4d21-9f33-b86da0b31a9d.tmp

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Default\ef5f0ad2-895c-4d21-9f33-b86da0b31a9d.tmp
Size 6KB
SHA256 bd0c6876f52e2f41e940f5a7f9d0f7c514a4b25c749eb731ce86f68b67dc5812
MD5 9b033e01fe9287ae73761c4ba7172bea
SHA1 93de51b9edb865dc912a64abc048fe6aaefed93d
SHA512 bc6fac66b127242e925caefec6c6cf6da0dc44672a9b2ef99f843fa46802aa694e1e1dd8abcd14716e7bb6987140979b142709729a0f7a8a1a5cc42d068c1c27
SSDEEP 96:stH/dyd2asPb9ckzo5h16Z0gs7/x+6MhmuecJGz1ejemK+gib28XM1C7K:stfgx2ongsV+FdGzQjWwbG6K
TLSH
T185D1B7025E28797B4CC7E609BA397B03E2F9503274D11E58E7F8492C18EA6DC6317D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Local State
Size 2KB
SHA256 f8bd7efe5dcdd39a1e602197264f6c683e6a246fa19d420f0144c103d324deac
MD5 6ff07822a717f7dbd296d199640fbebd
SHA1 e9393831a243401ad92b7c0f082303ad845876e4
SHA512 21952ca03ac0c62b8f08cb5631e9b8a88550f1cafbe662a97b346483c83c922cd74b50842dba3afd0283b278d6837bdcdcdf68806c74e21a6c3505691647a995
TLSH
T1025183337C659B76D9F28B88B94B3B13AE709066A5A12F6097EC0B0C11E751C2701C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Local State
Size 3KB
SHA256 3161dbd2feb2b20cc3bfe13a4275756267194e7cc04d2777de41bd053ecc8e97
MD5 7060e2227901140cc7958a0e91293ff8
SHA1 f620d6fa09f30e9fa915efbc9f0373b9b74fec2c
SHA512 570d7ec9f8ae3deb52e7bd4e0f6e8d4530b19c1b3e9eb19226fd56e2b2d880e0170868f7845673b223f405f1a07b2c9075e7ff7bf58c7f980b99ccab4b4cce0c
TLSH
T17161723369B5AA678DF29B45B8862B12BBA15027E4913FA5D7EC0F0C11E72981341C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Local State
Size 15KB
SHA256 4976717f1fe0f33c5aa455d355dfa3309f59265e786b89af925368fe73fc46c0
MD5 f0d9c3f3e4e92117a3ab0923858226c7
SHA1 2c1fe68259fa2054db2272862363305216718f8f
SHA512 dc3a36852ac2b561594a0bf67e48566adb654261c6581f9f039d0ec33c9909197777e5e6d902cc0563747beb41b8f92a7124e6a2f1a3d9dcf0c7fb045079f987
SSDEEP 384:t+aQikB+z/xvxjg/qhE/NBSAXZXVEqAVdpj79zc:4/UxvxjgC+bJOqUvFc
TLSH
T16672AF27687A7E77A5F3FA04794D074BDBB484B290C12EB84AB95F0D16D72A41342C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe594e26.TMP

Path C:\Users\Admin\AppData\Local\com.multiroblox.client\EBWebView\Local State~RFe594e26.TMP
Size 1KB
SHA256 f6cc3dc32fa252ff629dce5de6c195373de383b6c287e5030e361cb525775ab0
MD5 c64e70274d4331efe84c254db0cfec38
SHA1 0289b01025c8a72cb9aaee22b2e79c7fc8d3248d
SHA512 e8fbbcbe57cc59f86f631a8bc7b7180727552893f0adcbaf490024cdb35da7230c5856bb4b680a3ca5064d43ff8433770a6aad1101f1e58cd7f8dd6b09d31e5f
TLSH
T11F2140B2F9B59B71ECD2A79961073A133E70506BA1604E00A3ED4A0D26F205C9B1AC32
MD5 SHA1 SHA512 TLSH

Submit Download

RobloxNative.exe

Path C:\Users\Admin\AppData\Roaming\multiroblox\RobloxNative.exe
Size 24KB
SHA256 2573c84142cdaa6d282b27ea5c0e60d5a7405da5396b759f860453b7360bfd37
MD5 3daf0ed44e189cce673918768f60fb39
SHA1 c49c919d51782a6825804f5ae1f1c39250c7c9ad
SHA512 9e36d897ea67e55f9b79b901bf3b9fa6a8e5ae1382191664948f2053e17ee20c922d20bbd2d24a8685ba17f13594d014c3ed12e0cfcc3e30cba04af6f7c771a8
SSDEEP 384:tiiYCldVNwoyNOsb7/pl2UZQqFEa/ItmIe542odCT9LRCAgig216FSIJq:t35xNwo7sbrj2UeqRIHk2dCpLMSIJq
TLSH
T1E0B24A05BBE85174D6BEC7BC6CB24710A231E4C62617D78E2CDD799A0E93BC08781BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/940-26-0x00007FFBB3FE0000-0x00007FFBB3FE1000-memory.dmp

Download

memory/940-207-0x000001FA77640000-0x000001FA77756000-memory.dmp

Download

memory/940-322-0x000001FA77640000-0x000001FA77756000-memory.dmp

Download

memory/940-219-0x000001FA77640000-0x000001FA77756000-memory.dmp

Download

memory/940-191-0x000001FA77640000-0x000001FA77756000-memory.dmp

Download

memory/1148-262-0x00007FFBB3170000-0x00007FFBB3171000-memory.dmp

Download

memory/1148-261-0x00007FFBB37A0000-0x00007FFBB37A1000-memory.dmp

Download

memory/1768-285-0x00000272D10B0000-0x00000272D10B1000-memory.dmp

Download

memory/1768-287-0x00000272D10B0000-0x00000272D10B1000-memory.dmp

Download

memory/1768-291-0x00000272D10B0000-0x00000272D10B1000-memory.dmp

Download

memory/1768-296-0x00000272D10B0000-0x00000272D10B1000-memory.dmp

Download

memory/1768-295-0x00000272D10B0000-0x00000272D10B1000-memory.dmp

Download

memory/1768-294-0x00000272D10B0000-0x00000272D10B1000-memory.dmp

Download

memory/1768-293-0x00000272D10B0000-0x00000272D10B1000-memory.dmp

Download

memory/1768-292-0x00000272D10B0000-0x00000272D10B1000-memory.dmp

Download

memory/4184-192-0x00000201B7D00000-0x00000201B7E16000-memory.dmp

Download

memory/4184-112-0x00007FFBB3FE0000-0x00007FFBB3FE1000-memory.dmp

Download

memory/5344-164-0x0000000000F40000-0x0000000000F4A000-memory.dmp

Download