abd8cfba151826bb7bf3de57387e9653e9d7f54d61e2e107213b3add4383cf91

Analysis

max time kernel
137s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20231129-en
resource tags

arch:x64arch:x86image:win11-20231129-enlocale:en-usos:windows11-21h2-x64system
submitted
10-12-2023 21:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

index.ps1
Size

4B
MD5

d6581d542c7eaf801284f084478b5fcc
SHA1

8aa40001b9b39cb257fe646a561a80840c806c55
SHA256

abd8cfba151826bb7bf3de57387e9653e9d7f54d61e2e107213b3add4383cf91
SHA512

e793ccfb0632f46f6ae7c7f20e448277909ba5975d9c8a8893490a9f638e0523dc259238d610b2000b78e0b85cd53b33e430691b4309bb6f703ab1ace78bdd30

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3240588775-3651084335-2656120175-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4996	powershell.exe
4996	powershell.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4996	powershell.exe
Token: SeDebugPrivilege	3332	firefox.exe
Token: SeDebugPrivilege	3332	firefox.exe
Token: 33	5116	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5116	AUDIODG.EXE
Token: SeDebugPrivilege	3332	firefox.exe
Token: SeDebugPrivilege	3332	firefox.exe
Token: SeDebugPrivilege	3332	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3332	firefox.exe
3332	firefox.exe
3332	firefox.exe
3332	firefox.exe
3332	firefox.exe
3332	firefox.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
3332	firefox.exe
3332	firefox.exe
3332	firefox.exe
3332	firefox.exe
3332	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3332	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 3332	2096	firefox.exe	85
PID 2096 wrote to memory of 3332	2096	firefox.exe	85
PID 2096 wrote to memory of 3332	2096	firefox.exe	85
PID 2096 wrote to memory of 3332	2096	firefox.exe	85
PID 2096 wrote to memory of 3332	2096	firefox.exe	85
PID 2096 wrote to memory of 3332	2096	firefox.exe	85
PID 2096 wrote to memory of 3332	2096	firefox.exe	85
PID 2096 wrote to memory of 3332	2096	firefox.exe	85
PID 2096 wrote to memory of 3332	2096	firefox.exe	85
PID 2096 wrote to memory of 3332	2096	firefox.exe	85
PID 2096 wrote to memory of 3332	2096	firefox.exe	85
PID 3332 wrote to memory of 232	3332	firefox.exe	87
PID 3332 wrote to memory of 232	3332	firefox.exe	87
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 4236	3332	firefox.exe	88
PID 3332 wrote to memory of 1852	3332	firefox.exe	89
PID 3332 wrote to memory of 1852	3332	firefox.exe	89
PID 3332 wrote to memory of 1852	3332	firefox.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\index.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4996

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3332.0.1654957344\1243971602" -parentBuildID 20221007134813 -prefsHandle 1760 -prefMapHandle 1740 -prefsLen 20598 -prefMapSize 233275 -appDir "C:\Program Files\Mozilla Firefox\browser" - {214c0096-e3e7-41aa-95b8-5fa84b31b7d2} 3332 "\\.\pipe\gecko-crash-server-pipe.3332" 1840 2c2520d8858 gpu
    3⤵
    PID:232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3332.1.79187525\864663904" -parentBuildID 20221007134813 -prefsHandle 2204 -prefMapHandle 2200 -prefsLen 20634 -prefMapSize 233275 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {84358e0f-3356-413f-9a69-0d840c47b524} 3332 "\\.\pipe\gecko-crash-server-pipe.3332" 2216 2c251c41f58 socket
    3⤵
    PID:4236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3332.2.439196219\760263878" -childID 1 -isForBrowser -prefsHandle 3644 -prefMapHandle 3120 -prefsLen 20737 -prefMapSize 233275 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f3656e15-2191-45ee-9bce-ad9a65efc9c7} 3332 "\\.\pipe\gecko-crash-server-pipe.3332" 2952 2c257239258 tab
    3⤵
    PID:1852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3332.3.965548873\1087168804" -childID 2 -isForBrowser -prefsHandle 3600 -prefMapHandle 3836 -prefsLen 25909 -prefMapSize 233275 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9ae3eb3b-84b3-44af-8070-eda8265f50dd} 3332 "\\.\pipe\gecko-crash-server-pipe.3332" 3940 2c245f61958 tab
    3⤵
    PID:572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3332.4.1829331766\912399699" -childID 3 -isForBrowser -prefsHandle 4528 -prefMapHandle 4524 -prefsLen 25968 -prefMapSize 233275 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {67e675e1-172c-49b3-89a5-2457fc7b1226} 3332 "\\.\pipe\gecko-crash-server-pipe.3332" 4492 2c2589e8858 tab
    3⤵
    PID:428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3332.7.639505246\1453440047" -childID 6 -isForBrowser -prefsHandle 5512 -prefMapHandle 5508 -prefsLen 25968 -prefMapSize 233275 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {327d4ea4-0c37-4b60-837b-23e7ec873f05} 3332 "\\.\pipe\gecko-crash-server-pipe.3332" 5520 2c2597a1e58 tab
    3⤵
    PID:2104
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3332.6.768426163\460367901" -childID 5 -isForBrowser -prefsHandle 5232 -prefMapHandle 5236 -prefsLen 25968 -prefMapSize 233275 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {67fbeee1-e9c6-411e-bffa-c64d4bd4486b} 3332 "\\.\pipe\gecko-crash-server-pipe.3332" 5224 2c2597a0058 tab
    3⤵
    PID:4160
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3332.5.1848390947\1604398323" -childID 4 -isForBrowser -prefsHandle 5068 -prefMapHandle 5084 -prefsLen 25968 -prefMapSize 233275 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {64abeb5f-9c06-4c0c-afef-dbeda2597d9f} 3332 "\\.\pipe\gecko-crash-server-pipe.3332" 5072 2c25979f158 tab
    3⤵
    PID:4468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3332.8.1585841614\455627800" -childID 7 -isForBrowser -prefsHandle 5808 -prefMapHandle 5804 -prefsLen 27534 -prefMapSize 233275 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9b4c7db5-5a73-4c26-9211-bef9b2189982} 3332 "\\.\pipe\gecko-crash-server-pipe.3332" 5820 2c257277158 tab
    3⤵
    PID:1464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3332.9.748294021\1514524686" -childID 8 -isForBrowser -prefsHandle 5276 -prefMapHandle 5260 -prefsLen 27534 -prefMapSize 233275 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {837aafa5-eac9-4938-afb0-d38f75dfafd4} 3332 "\\.\pipe\gecko-crash-server-pipe.3332" 5248 2c25979fd58 tab
    3⤵
    PID:904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3332.10.1993937052\1524168699" -childID 9 -isForBrowser -prefsHandle 6180 -prefMapHandle 6176 -prefsLen 27534 -prefMapSize 233275 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {78d5f103-7a46-4a28-a163-8a3a280b7ff4} 3332 "\\.\pipe\gecko-crash-server-pipe.3332" 6188 2c25db58258 tab
    3⤵
    PID:868

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004C8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\t4xdt50x.default-release\cache2\doomed\18720

Filesize
9KB

MD5
50aa2703c80a1e1f7839a13bfab10655

SHA1
6d8c13ee2bab8deeee58de8463cf953b4e292df0

SHA256
64c60cbec9def0c25953f349dcd710bde6e2696ea9b5ba783d27b08023977a12

SHA512
07e9dce8259831367ab14369d827fd5e46c619ebba2c6419544221287795bdc544be5713bbad5a7f6b32bd4da3b07f7b9ac2e97426a51952484c74e841fe7d15

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\t4xdt50x.default-release\cache2\doomed\22020

Filesize
29KB

MD5
6d99d106416d5a272982b4f33fab226c

SHA1
3d13fd74ccc22f5ec0534157c87598b6d8d2e0ba

SHA256
96a7cba58900389407ed431a4fb823833e073081a7d2e6c57bd21287c73da4c8

SHA512
5eaaa7e7cc002b3617060efb3dc2278b7b3b0adca79f9f930fe9ff91872fad22841f60be27bf879acdadb1665a3abc68aaa37e54b6a55a68e52e82a152bffb8b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\t4xdt50x.default-release\cache2\doomed\32381

Filesize
9KB

MD5
f43e232238fdd109ca5af64fae511794

SHA1
2a186a9252cf3ffd263030ec64d398b1268f6417

SHA256
6358d4593cce2f7b0ca5dea2a126045d037d61992013c61aaa3b1ced201a1777

SHA512
5c4ef6e0a3a5192dfedda4fd065b6a0ddc105b17c0eb557c33d6bf448e05f8ccc5a72df8e335b02737817df1bcdf4447d188b879d32c24e15e8a987a52481ded

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\t4xdt50x.default-release\cache2\doomed\7159

Filesize
9KB

MD5
d181ba6dd929ced945bf9f470d77a026

SHA1
5b20f90fc419dd8da09d175951782c6c7d721af3

SHA256
16cc9adbb151dc3c3a02ea0527d44791c2ee18adbf69ddf09e8f572ac0206498

SHA512
21f4da1b3c0bbd20896e0c3d14e3231c9f96a0ef3508e13fb390a8ae500bf4d76622718926c02b30e9b94eace864c039fe77e6c2d28ff566adc78f6fc964d03f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\t4xdt50x.default-release\cache2\entries\46452CEA1D6AA2BF58B5942C88BD664FF9175EFC

Filesize
44KB

MD5
59c0024d0d464ef7313182041be2aacb

SHA1
96cd660c0affdcff952385332ce4bfeb4ee1f05b

SHA256
15dd6a54dbd68d1ed8f3f4c2a9ceef3843d72555227f4544621ac6e56d5e4974

SHA512
cb85c004fc3c3f5a30f7a5fb766ea6c895c50351a78f212211fc338030f6b68be6f28ff7e5f0557e46e966215b1da724927b8948569a71f8c456c11d5980d0b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rornc3p5.c4e.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
1005KB

MD5
6ee67d51363af14d14f190287666e1c3

SHA1
3a3aec47ddc4ebe6aebf0a82c8177ddb6a0ada1a

SHA256
5255000c302fb509887766f069ad0f018db864b705378363184763bd9e6d9ee9

SHA512
3cc306ba5cd99b28dccbb68e178546d6420e879f497b0d2fea4fd513ef8bce7abc2cbac8b8f864a411eaf3a97f3314ef5ad74ec19c5a8a5249873ff409f8782d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4xdt50x.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
217258bbc57c11e3826c26936fa510b2

SHA1
ea8cf4c861a1c67188f8a31f40476ccdf1b0534f

SHA256
e890cda0479d115b41858f79d4da4d17d11a3b0a4bcdc4b2c252ca104e2ce5ab

SHA512
49431d20509cf4eaec13429a43ffbd617cd6e57e723007b9872f58cc3b3acd973b5235c548658f414674cb5acf864983a4da1e87da9a6b603a72842e315363a6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4xdt50x.default-release\datareporting\glean\pending_pings\085b7838-b62f-47ff-b6a5-298975b9adda

Filesize
11KB

MD5
94a655fcc74b9481e48415bf1dedb368

SHA1
3b8e3471f9ee62cb59702f350c27466e04a48c1d

SHA256
e983ab901da00e4ea9702eb69daa3e548bb005bf5b464cc1c0935ef2bfc1269e

SHA512
e14abafa11737133ec5dfad5a37ab10c95f38d485872ab7471eb61b1ad75e57e1e0240cc39138ae9b575feaa7fe54486b493a3986f00df61e43836f8ba2ceae5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4xdt50x.default-release\datareporting\glean\pending_pings\ff5fbdc7-effa-47f4-a9be-ac5aeaea6e7b

Filesize
669B

MD5
3c21379248b16d4f7fc025803bd75baa

SHA1
3137a1cd912b1457b360bdefb6b66a91f5f8043d

SHA256
42c1243585a29738dbabd6950ccc0cf0f87e106ee20f87e70d8db354767a0650

SHA512
1a4a2c6cb48e59a9f4ca85e38c58330ddde504685511a2bf007979fc109c087ab61dbd64c18783ed8ffef1ad20683c40fc3709fb181ce3d40b2f87c835889b99

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4xdt50x.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4xdt50x.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4xdt50x.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4xdt50x.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4xdt50x.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
1.0MB

MD5
da56d3799a119bc3b4cf349c2a58ca9a

SHA1
4ef0da68a959244c70ee5aa42569b0e2162f050b

SHA256
732fb22e92a5d10cf23c0a710f7a6184d148c3605bfd2ec18ea3bb17b6391b78

SHA512
08ba74a77c706cb2d0879796edf53328c49eb645915e354240162a8392267fbacd8900728116308ade1083e719bd95aa6da926c357676f03153992d387c19dbb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4xdt50x.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4xdt50x.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4xdt50x.default-release\prefs-1.js

Filesize
7KB

MD5
5db73f17fb57dedba86b9f6636f8f32c

SHA1
228f901f47eb5a147dc15f30c4673fde4b01f4c7

SHA256
5fe03f47a92eee4b9ff93075c863d9cf6d34cb3ec344acc8980f757bcafd926c

SHA512
f890210aac2df2cd435f3c3d751be52aa9092baf5995dc9056d9b303bdb348f5b70fcee8e15cd103c3cf53407a6fa5ef57a321c89a4b399e291bfc6bf2681153

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4xdt50x.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
5079ebf4841c632c56560d2db83f4d90

SHA1
3cbc9d57487b26bcaea4158b2acd9368709d4ceb

SHA256
cac575d3f7a94d684757b43b37c1008bcd9d2b4fa72b9fc8629129b74045b89d

SHA512
40cdbbedb2909a5b888418f2d10cf5d08a4718d469ddf352b7cc1d3d27fa9358ad9d721665f25d1aa3700d26434daad5c94e6285443d3696db73df622afc6bb1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4xdt50x.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
18f72e760bc166952a3a609de97bd6b3

SHA1
6aa6a6156c451c1f3f1d38b4df25e39ae0ef2164

SHA256
c890a2701e3ee446813087ed8eaff9ea6e7794eccddf1bf9ab6766f71c9be554

SHA512
46d7b938f4a8e4c8ca6dffa792845e1e18a04515c90009306e902e30fb0d478ea1d1ed3381a40558557a80ef373ce794c3badd8c28269fa11360bf9f12d9336b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4xdt50x.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
a4b8e68aced5b6e7bb5dea06d291929e

SHA1
b14a0563c6addd2752aeb1614b02420e30ec9201

SHA256
ffd6671cac95880e7ee4045ac145927f816241926a56f6c87ab1625a9899351a

SHA512
16a30a94bcdf8e94cbfc70e28476bd602226edb4757fc695d387e7dbcd42950a58a9d346462b86a08b15412f6bb98fde4be6e20453e4fe3c284db41105f12140

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4xdt50x.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
ce04e78f92d11f3193eb4a9d1e079875

SHA1
1fee49afd085313a482b127c063014a33d59a07a

SHA256
110cf38ae4f8fa4e32ba690efaaf72e95473ef695e47cbc01195ac964c1e7fdb

SHA512
6d03098dc42c5486c95914da714a55120df6cc372091f14de01b6b7a6153ebf491ce089c8015db259033cb7b6a606423bef1e9e6d5bb758cb9e5097a3f21e2fc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4xdt50x.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
a5d1bbdbb91bb9b42ab05a127a8a1baa

SHA1
65d08509ff9010d673f06d53946c7161e9e024ac

SHA256
e6481f4423550006af258c1814009c925f45ed3261b1bd57f65b58b9cb000f4d

SHA512
558c57a2bda96eb92db4a458e4fbb7a598566f9b657078dee2cd38fb1cda02147ca636c0aaad56ba99484a207b69f61e0251c6402ea7345e276d24d8f90cdac2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4xdt50x.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
2f4c5526b5c2a23a64402b7f91fe64ee

SHA1
a22a30a257c4af67ee266265879906a55cb240c8

SHA256
c97022f59f60d1f462ce0a8bbfb0505c446cf1dab78f5a9889399a59cca179fc

SHA512
110a33fe3a8e4c2333e77a7825d4fd00f42c109758479c6275fb38cf02f09453c3daf6a04841493dbcf824fe4f4d179034f6368ed8ef934585e9cb6de23c157b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4xdt50x.default-release\storage\default\https+++mega.nz\cache\morgue\248\{407bf477-c2b3-4be6-ba4b-3455e5e3abf8}.final

Filesize
1KB

MD5
3efa9abd92666265dd81c4f4311a96f9

SHA1
41b6b716d67b93555e444cd453f3c6e3f8c9522c

SHA256
5066b1841e8877db31312ef3af86f9bc9234c95071119e025764f45241a4e2e7

SHA512
5961950f077501608a0f2975e7f69c483eeacc4eec4ac77fd650cc1131609501f87819f93ed23aa508a90426156abf038a859fac4112d2d4435bbb634027cd6c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4xdt50x.default-release\storage\default\https+++mega.nz\idb\3713173747_s_edmban.sqlite

Filesize
48KB

MD5
8b0e4023a3e981a670540810f172dac0

SHA1
465d89b88552aa1aa7bcd68e06adee2ffaa8c16c

SHA256
fc9d83e474657704a6f0cc8c2924f99d1c817a9da500fa19a3c60105f859b95c

SHA512
1025b93c210228e214fb0dfa8bd8878bc88f8327c4cf98d4abec048635a06dcf850a60532672ccf528ffecaa46eccc3533882bad9a631f46bd5d1fe905b03c5f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4xdt50x.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
128KB

MD5
231294175c0d2ab4e3a72e642436b99d

SHA1
99e2f55f8c9b582d5a515590704d7ff01836ee18

SHA256
2dec1b30a33dc88669813c4f5c9adebab16106db5c67f4db7e88e2bcf40c3943

SHA512
a9efd5c8323b94e7ac7ba5babc4ea8802382b08dc3fd17323a06112a5f40119c3ab3094a0298c292068f3d39879558263a0b44a9798271fe88f09fe7514cc25f

Download Submit
C:\Users\Admin\Downloads\RobloxExploitsFILE.IYvRntp1.zip.part

Filesize
753KB

MD5
7a86a5bedc4bbf0e1bc59e63d5ad8426

SHA1
829637c22545872919cce4ab3929ee444313b8d7

SHA256
0585e10e873b9145e7f1cde3fcb067d71d0ccf0ec59d184a1d29b01e5f4ca81f

SHA512
98f43c5b93cbbc46652765775d89ebc8b07e169aec3e2a834ffd150216a9840f6cfb3f7dd9ea85a460be55ffd849782f34907132dc48e3cadf273170522e9e96

Download Submit
memory/4996-11-0x000001DE4ABC0000-0x000001DE4ABD0000-memory.dmp

Filesize
64KB

Download
memory/4996-13-0x000001DE4ABC0000-0x000001DE4ABD0000-memory.dmp

Filesize
64KB

Download
memory/4996-12-0x000001DE4ABC0000-0x000001DE4ABD0000-memory.dmp

Filesize
64KB

Download
memory/4996-9-0x00007FFD6E130000-0x00007FFD6EBF2000-memory.dmp

Filesize
10.8MB

Download
memory/4996-8-0x000001DE4AB90000-0x000001DE4ABB2000-memory.dmp

Filesize
136KB

Download
memory/4996-10-0x000001DE4ABC0000-0x000001DE4ABD0000-memory.dmp

Filesize
64KB

Download
memory/4996-16-0x00007FFD6E130000-0x00007FFD6EBF2000-memory.dmp

Filesize
10.8MB

Download