MultipleRobloxInstances-V2.2.zip
- SHA256 f6c10bf50b8a13930b5a2f7299cace93df1ec2a7a65f3bcae15e09fa36d3da76
Behavioral task
behavioral1
Sample
MultipleRobloxInstances-V2.2/MultipleRobloxInstances.exe
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
MultipleRobloxInstances-V2.2/MultipleRobloxInstances.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
MultipleRobloxInstances-V2.2/MultipleRobloxInstances.exe
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
MultipleRobloxInstances-V2.2/MultipleRobloxInstances.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
MultipleRobloxInstances-V2.2/runtimes/win/lib/net8.0/System.Management.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
MultipleRobloxInstances-V2.2/runtimes/win/lib/net8.0/System.Management.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target MultipleRobloxInstances-V2.2.zip
- Size 654KB
- Sample260930-ygsbfagg48
- SHA256 f6c10bf50b8a13930b5a2f7299cace93df1ec2a7a65f3bcae15e09fa36d3da76
- MD5 de5b2c9acf517b2fb2b032997297e7d4
- SHA1 cb31c7a2a3ae82cb088924b8920e639aa99381c6
- SHA512 6df40e32a162a2f884ad3fc38abab7c4ecaca102a01d270b5a1a029254865d02a3249e1a462630119b5bbfab18667b3005c603284a8fa7019e7b59f3611aa11c
- SSDEEP 12288:QtyugNPuCvEoLszZpFJbPTNJWtZub+3L3aOGpovY55LJ4+p4BupMUs:Qkugf8k4FRetwWpGpovYPJpp4+s
- TLSH T14CE423BCE3230044F27C9B3AC735258BAA8BC4F59A7B5799678051CE53E518808FECD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Costura .NET executable packer 1 IoCs
Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.
resource yara_rule static1/unpack001/MultipleRobloxInstances-V2.2/MultipleRobloxInstances.dll costura - Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/MultipleRobloxInstances-V2.2/MultipleRobloxInstances.dll unpack002/costura.dll unpack001/MultipleRobloxInstances-V2.2/MultipleRobloxInstances.exe
File Explorer
-
MultipleRobloxInstances-V2.2.zip.zip 654KB
-
MultipleRobloxInstances-V2.2/MultipleRobloxInstances.deps.json2KB
-
MultipleRobloxInstances-V2.2/MultipleRobloxInstances.dll.exe 501KB
-
costura.dll.dll 5KB
-
costura.pdb7KB
-
newtonsoft.json.dll.dll 695KB
-
system.codedom.dll.dll 179KB
-
system.management.dll.dll 71KB
-
MultipleRobloxInstances-V2.2/MultipleRobloxInstances.exe.exe 155KB
-
MultipleRobloxInstances-V2.2/MultipleRobloxInstances.pdb28KB
-
MultipleRobloxInstances-V2.2/MultipleRobloxInstances.runtimeconfig.json357B
-
MultipleRobloxInstances-V2.2/runtimes/win/lib/net8.0/System.Management.dll.dll 305KB
MultipleRobloxInstances-V2.2/MultipleRobloxInstances.deps.json
- SHA256 996b2e102bf4960655030405fac9b3c014cf22d7c3b1072c8fd32161c0d80d39
- MD5 883df4dd3b17c0bf5af2ad4fd2fc1c63
- SHA1 e972b537d2af0a1b8eef3883773e94fe6b9de8fb
- SHA512 78562fc84b2b3ebdf6eb2d00faa6608a50e0c12f0c02c963553d711feaa5a1095ca5a1b37d54836b2c4c0ee6e7925d89dd55e784e6928d43f45d4f272c5d9453
- TLSH T1E3517926CA544DA704BA6BBAA0754282F631973B9040094F7CFC709CCF77E5710A0F79
- MD5 SHA1 SHA512 TLSH
MultipleRobloxInstances-V2.2/MultipleRobloxInstances.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 05cb0d51733c227b7bd084812a2aeab38cb767047c833f56a141859bebab3222
- MD5 a53f83fe66bad080544ebe876ca9004d
- SHA1 30ede6958b8c4e544bca973e300b5b3538eb874c
- SHA512 c1ef35723bc69572ce47a4ff160b86d9e430cce09074550dcb4692afa2d80dd30f9590b83f3d9037055a0e3718beb141ead8434559f467deb541f06eb2172142
- SSDEEP 12288:zk8ZmMBkqvPuUvEOLsdZp3rD4IT4YjyBIAZeGbaf:w8ZFGs8mM3PvTEB1oGm
- TLSH T129B4126963BD4511EB7D07FF983142918738ADF3C92EDA8525DC798E26FA38304A0397
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
511278
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
E:\Development\MultipleRobloxInstances\MultipleRobloxInstances\MultipleRobloxInstances\obj\Debug\net8.0-windows7.0\MultipleRobloxInstances.pdb
mscoree
_CorExeMain
Name
.text
Size
491KB
Virtual Size
491KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
costura.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7a9e767ad824afa2c1b0aed513fe1cf2b8dac6d40f24e7c4075af32b1cf23a20
- MD5 109bd38d2107f41573c48544992ead99
- SHA1 028e9832f421f11f9497c610f1734e0f3d868037
- SHA512 459945f338679c77acca8f1192907cd3ce8e19f270589d34ce8227b8eaf0c7c8c9922e52b8310d037c4d5c0c639de42a6e3b0f7d44d493fc50644b6fcf7cd4e5
- SSDEEP 48:6gMX2nhx3BTjtRiaAVLEP4iZ6iMtTg70uElaQ40JFuUPtomCH9gWk1qyFVA2IbS:HHtRYVLEmYZEZ9ruUPqJmW/2
- TLSH T10BB1FB2867B8573BEF7B4BB65863534257B4B950CC279B1F0985B3166C223544931732
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11030
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\CI_WS\Ws\274459\Source\Costura_Fody\src\Costura\obj\Release\netstandard2.0\Costura.pdb
mscoree
_CorDllMain
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
880B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
costura.pdb
- SHA256 fbb47bfd057253e9461bc7fe661eb8ad273451782f3e227b8db8f88b54cea186
- MD5 dd3394a0ba6f7158d029e1c3a31b7a85
- SHA1 806f4c19b2d7fd9e3b836269ec07647019a29e95
- SHA512 2fbedae58d16bfe20954094e5c7541e1b25310107571e94f7bea35b2217aa634197ef147afb9ffbd9c59aa0f7e209cf2a97349c3503077758502bf7a776e2575
- SSDEEP 192:yMD/wix+PI6jMai+NLy5nj4SCBg5MRkCIFQkC8g7AHOuXk/N/8Hu04:y8YPI6jMai+NLy5nj4SCm5Mz6QkOAHO/
- TLSH T1A4F1B33F5748C463C89959720521C49CB6B343202670ED78F3DB2608EDAF69AC7B5772
- MD5 SHA1 SHA512 SSDEEP TLSH
newtonsoft.json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 22c649f75fce5be7c7ccda8880473b634ef69ecf33f5d1ab8ad892caf47d5a07
- MD5 adf3e3eecde20b7c9661e9c47106a14a
- SHA1 f3130f7fd4b414b5aec04eb87ed800eb84dd2154
- SHA512 6a644bfd4544950ed2d39190393b716c8314f551488380ec8bd35b5062aa143342dfd145e92e3b6b81e80285cac108d201b6bbd160cb768dc002c49f4c603c0b
- SSDEEP 12288:mFIM0KteTMN4Or4D3OdmZg5WHEaEDIGBBjgrIQtD+tVqDMW:6zMTMNNd+g5Wk78GBBjgrIQtDF
- TLSH T165E45A2123E99B2BE0AF2775B032491647FAF542F6B7D78F5604D8AA1C43F558D82323
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
12:a2:f8:77:6a:5b:04:46:97:f9:ac:0c:85:0b:b9:3c:9d:a2:ac:a9:a3:72:91:5b:d9:ed:db:47:d0:c2:9e:3d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Mar 8, 2023
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Subject
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Serial Number
06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 15, 2021 - Jan 14, 2046
Subject
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Serial Number
0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 15, 2021 - Jul 14, 2031
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29
Issuer
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 13, 2021 - Oct 29, 2024
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
705086
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net6.0/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
681KB
Virtual Size
681KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
system.codedom.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 763c881ee2b87c7254d6f61c303b5de3b59282fcf1448eab7c797bff4e0ea989
- MD5 315855f752b7a173d1d5ac5eedecd679
- SHA1 bc81727d8f828a673c1eea4666b5976b5190a297
- SHA512 d157af5286bb2ccaac04f7d57bccb9f845f7c8feb0109e7ff0ca1979f0f3c5fbee91a2771faa394544bad6f28d0a979091b31a91c7b01aba3d56121e1c3ccef6
- SSDEEP 3072:PMKminLBDcR+s0sK1eW0d5PIlwbrebRYSH+l8Uh1P3QoH8:zLBk0szhebCSKLTQF
- TLSH T13B042A6437FC8376D7AE6274F028092146FCE44E7283DB5A8D8955F55E23B40EE20B7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
d5:f0:c5:67:cf:bd:c9:38:78:f7:ec:ce:ae:46:21:6b:a3:14:08:c6:12:79:80:8e:31:f0:18:49:ba:0b:33:f4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 16, 2025
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:40:14:fc:0b:e8:3e:f1:24:5f:00:00:00:00:04:40
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 19, 2024 - Nov 12, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:E002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:0b:11:9d:56:29:92:f9:bf:85:00:01:00:00:02:0b
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
178622
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.CodeDom/Release/net8.0/System.CodeDom.pdb
mscoree
_CorDllMain
Name
.text
Size
166KB
Virtual Size
166KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
system.management.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 45bddc7a2aefc98d8d7c5a54b9066230cc21b39c5722af1f05e9fabc54b376e2
- MD5 3479453f64579b8783c30e1dc7542432
- SHA1 a595ded088dc161accfe066b47fa3ffa8a1dcd78
- SHA512 2d0aacfdbd06dfee942d7f9e54ac856bb060cf2298aa3565024fcff4aad46ceff5c95ddc455b05109df1faca54968481255408317a055e615492c01768296e3f
- SSDEEP 768:EV/2DXm3gh3nb3Wm/InTVExthoQDKkiSLJKdbq4Xe9zq3:O/UXmEnb3OTM2QDKxS9yO4Xazw
- TLSH T1E773A411EBE88779CBE70670B47083746F74B6C72D22DA0F291B221D197AFC04B65E66
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
68:7f:a3:d8:54:a9:17:9a:23:6b:86:30:9a:52:f9:6a:a7:3b:7e:b5:7f:86:eb:8f:6a:b7:26:fe:7d:19:be:bd
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 16, 2025
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:3f:15:d3:a3:69:9e:ef:89:cc:00:00:00:00:04:3f
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 19, 2024 - Nov 12, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8603-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:07:2c:11:39:89:cd:85:fb:c5:00:01:00:00:02:07
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
67714
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Management/Release/net8.0/System.Management.pdb
mscoree
_CorDllMain
Name
.text
Size
58KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
MultipleRobloxInstances-V2.2/MultipleRobloxInstances.exe
- IMPHASH bb3ac2c21e02c68abcad237dc3fa6d00
- SHA256 165afe5ab199c8fcc158eae432d51747024d16c936a8f5bfe2e6e5a9b3146bf4
- MD5 b3aff0ec83d8d5e3dae5667fa275e01a
- SHA1 c53aa3234453718e159dbc94370adcca9be28331
- SHA512 e8f43cfb53c8e71c08747e3ff2a67d4f589b40fc52459972568333dc8f7afe6d0dcfe5086522f183d1adad51717d1fb8c8851bd56ec3431f92bfaa156f4d3f69
- SSDEEP 3072:JqvmgiYSo4k8uIPzlSRwa/5B26mjIgaUqY:J6ok83LlMvvwIg3q
- TLSH T185F34B07A2A850BDE1B6D679CD924841FB727C1A8B71A6CF13507E761F73AD09E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
72368
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
kernel32
FreeLibrary
LoadLibraryExW
OutputDebugStringW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
GetModuleHandleW
MultiByteToWideChar
GetFileAttributesExW
LoadLibraryA
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetWindowsDirectoryW
FindResourceW
GetLastError
ActivateActCtx
FindClose
CreateActCtxW
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
_invoke_watson
__p___argc
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_errno
_initialize_onexit_table
abort
_c_exit
_register_thread_local_exe_atexit_callback
terminate
__p___wargv
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
_set_fmode
fputwc
__p__commode
fputws
_wfsopen
fflush
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
setvbuf
api-ms-win-crt-heap-l1-1-0
calloc
_set_new_mode
free
_callnewh
malloc
api-ms-win-crt-string-l1-1-0
wcsncmp
toupper
strcmp
strlen
_wcsdup
wcsnlen
strcpy_s
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-time-l1-1-0
wcsftime
_gmtime64_s
_time64
api-ms-win-crt-locale-l1-1-0
___mb_cur_max_func
_configthreadlocale
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_lock_locales
setlocale
_unlock_locales
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
89KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
824B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=35207,
count=12, id=260, version=35207,
count=87, id=261, version=35207,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33140,
count=204, id=1, productName=Unmarked objects,
count=10, id=265, version=35217,
count=1, id=258, version=35217,
MultipleRobloxInstances-V2.2/MultipleRobloxInstances.pdb
- SHA256 b839b345b55f9f34002eaee611ee3b467fa94aee3d13f9f05c00b888e10a862b
- MD5 eaaae57ee8e108a497a4b9871a14ceae
- SHA1 ec38e91f3fe62f4b8e772388ceae698a04d8d59e
- SHA512 2b33eec669324f89529ffd005ad374b45cc529dfa22b2bc78f6314d151d0270582eae085454454a13dfb8670368cccd5bbecd33a5b1c5869b2f9e80dcae310a2
- SSDEEP 384:x8DN5WajBRkkTEaIvyXQVZ4LPUYWm/GktIP6HrfEi44/ZoALW4oW1c5bGZTmFedX:xSGUlMWZiwzofGb3wcQLKFqX3SoqBBs+
- TLSH T190D2E573D3A8C651C50259728876C38C7A74C2243305DFB9F2D82A6DDCAFB549BF2264
- MD5 SHA1 SHA512 SSDEEP TLSH
MultipleRobloxInstances-V2.2/MultipleRobloxInstances.runtimeconfig.json
- SHA256 a6a31e881a564ce497254b0cc044c32ade3cf5f02c6501e43c8425e8698b2c00
- MD5 35bc322bd42045632a8cb4fce81a90d2
- SHA1 351f78a6441ac2c8a34a03d92561000889260326
- SHA512 747651399d598da800d2d0090924b682bac3578c6718adf60cd6d99fa4f89ae8c343addb97476b64597c59007b2259fdc1a49380d7c33c8cfe220a30201ee718
- TLSH T192E08C3AC9144DA315F53BBED52AC287FE3047AB0158092AB6BC441C1F725625000F88
- MD5 SHA1 SHA512 TLSH
MultipleRobloxInstances-V2.2/runtimes/win/lib/net8.0/System.Management.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 67f0621fcd09e8a65e4b2b95f94fd99aaece6cbad16b42fce0b2e6197ba98ae8
- MD5 ce972f762e802877e39bef1886293302
- SHA1 9bd523146cb707f7e480e6ba1f610b5f28370b52
- SHA512 09d3179cedadac26cc7439e96a3c3f3930154c76520e7405d4d73c5ca28485a3bd72f38d8c3c6e3b573bec7f04969cfbc6f04bbb19cb3496e577fd1caf222bb6
- SSDEEP 6144:4yj+butGieusJEYE1SF7c39iwjwmppwbHV/ZqPJko5u03SxptNKQO+v:44+butGieusJE31Shd/ksbxpCBS
- TLSH T12564162023F88A44E8BF4FB5A4706060CFB5775B2A6EDB9C4D917CED19B2740856732B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
66:45:ad:8b:9a:67:c8:be:67:ff:c8:72:26:8e:2c:a1:fe:d6:da:7e:74:c8:29:f7:12:ff:06:ab:5b:6e:ed:c3
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 16, 2025
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:40:14:fc:0b:e8:3e:f1:24:5f:00:00:00:00:04:40
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 19, 2024 - Nov 12, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9600-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:04:d8:e0:0e:07:97:32:58:98:00:01:00:00:02:04
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
306882
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Management/Release/net8.0-windows/System.Management.pdb
mscoree
_CorDllMain
Name
.text
Size
292KB
Virtual Size
291KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ