Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    391s
  • max time network
    398s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/04/2024, 17:39

General

  • Target

    https://www.mediafire.com/folder/boseq9fqy60yl/ROBLOX

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://www.mediafire.com/folder/boseq9fqy60yl/ROBLOX"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2612
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://www.mediafire.com/folder/boseq9fqy60yl/ROBLOX
      2⤵
      • Checks processor information in registry
      • Modifies registry class
      • NTFS ADS
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:112
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="112.0.1559235064\2050881885" -parentBuildID 20221007134813 -prefsHandle 1896 -prefMapHandle 1868 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f86646ee-fa87-4671-9a49-6b6625257a86} 112 "\\.\pipe\gecko-crash-server-pipe.112" 1976 1ce179d7d58 gpu
        3⤵
          PID:1040
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="112.1.1243033622\1145535295" -parentBuildID 20221007134813 -prefsHandle 2388 -prefMapHandle 2384 -prefsLen 21565 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3283dd6b-a331-4452-baec-78e17967d570} 112 "\\.\pipe\gecko-crash-server-pipe.112" 2400 1ce178e9258 socket
          3⤵
          • Checks processor information in registry
          PID:2132
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="112.2.1962550790\1386093813" -childID 1 -isForBrowser -prefsHandle 3160 -prefMapHandle 3156 -prefsLen 21668 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6ddfa907-238b-43b0-9784-aff7c7e4f8da} 112 "\\.\pipe\gecko-crash-server-pipe.112" 3172 1ce17960c58 tab
          3⤵
            PID:4524
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="112.3.811895930\1660480019" -childID 2 -isForBrowser -prefsHandle 3984 -prefMapHandle 3980 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d569037e-2614-4f85-9e7b-b6a843f05249} 112 "\\.\pipe\gecko-crash-server-pipe.112" 3996 1ce1ccb7858 tab
            3⤵
              PID:3716
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="112.4.210411573\87904715" -childID 3 -isForBrowser -prefsHandle 4896 -prefMapHandle 4916 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e729d914-b928-4eac-a90d-99e1d0868efd} 112 "\\.\pipe\gecko-crash-server-pipe.112" 4920 1ce1e41b358 tab
              3⤵
                PID:4916
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="112.5.9406\51894152" -childID 4 -isForBrowser -prefsHandle 5060 -prefMapHandle 5064 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {11d1bfa9-260f-4262-9769-c53fe0f6bd80} 112 "\\.\pipe\gecko-crash-server-pipe.112" 5048 1ce1e419558 tab
                3⤵
                  PID:3524
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="112.6.144976118\254031222" -childID 5 -isForBrowser -prefsHandle 5272 -prefMapHandle 5276 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {000a3a38-97cb-4ba5-a34f-aec4cc594019} 112 "\\.\pipe\gecko-crash-server-pipe.112" 5264 1ce1e90f758 tab
                  3⤵
                    PID:1512
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="112.7.583501148\1301190581" -childID 6 -isForBrowser -prefsHandle 9276 -prefMapHandle 9292 -prefsLen 26686 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2658798d-71fe-4c86-8aad-3bc5a19fcdeb} 112 "\\.\pipe\gecko-crash-server-pipe.112" 9284 1ce204cdc58 tab
                    3⤵
                      PID:5816
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="112.8.1041980759\155576734" -childID 7 -isForBrowser -prefsHandle 9080 -prefMapHandle 9076 -prefsLen 26686 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b2897c2d-7c40-4542-993b-fbd74fc42194} 112 "\\.\pipe\gecko-crash-server-pipe.112" 9156 1ce1ca64258 tab
                      3⤵
                        PID:2488
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="112.9.1415993205\2140493197" -childID 8 -isForBrowser -prefsHandle 8904 -prefMapHandle 8900 -prefsLen 26686 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ed46d151-826e-49b3-b7d1-26940de3cf39} 112 "\\.\pipe\gecko-crash-server-pipe.112" 8884 1ce1fcc4e58 tab
                        3⤵
                          PID:5984
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="112.10.1740380018\1907994883" -childID 9 -isForBrowser -prefsHandle 8660 -prefMapHandle 8664 -prefsLen 26686 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac4e8d02-ed34-4d13-a15f-53a37aedcc22} 112 "\\.\pipe\gecko-crash-server-pipe.112" 8648 1ce20804758 tab
                          3⤵
                            PID:2676
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="112.11.272636864\312974622" -childID 10 -isForBrowser -prefsHandle 8884 -prefMapHandle 8684 -prefsLen 26686 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {90ce9664-d7ae-4af3-a7e5-7aed8567c4af} 112 "\\.\pipe\gecko-crash-server-pipe.112" 8564 1ce20806b58 tab
                            3⤵
                              PID:3064
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="112.12.116088625\34212495" -childID 11 -isForBrowser -prefsHandle 8572 -prefMapHandle 8576 -prefsLen 26686 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {30a4fae4-67d7-4586-b5fd-a7d54dcf26b7} 112 "\\.\pipe\gecko-crash-server-pipe.112" 8440 1ce20805058 tab
                              3⤵
                                PID:5308
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="112.13.283255087\1885020985" -childID 12 -isForBrowser -prefsHandle 8564 -prefMapHandle 8208 -prefsLen 26686 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b03e336e-1766-455c-bad2-b498198727f6} 112 "\\.\pipe\gecko-crash-server-pipe.112" 8884 1ce1d89f558 tab
                                3⤵
                                  PID:1128
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3712 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
                              1⤵
                                PID:5932
                              • C:\Windows\System32\rundll32.exe
                                C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
                                1⤵
                                  PID:4224
                                • C:\Windows\System32\rundll32.exe
                                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                  1⤵
                                    PID:2536
                                  • C:\Windows\helppane.exe
                                    C:\Windows\helppane.exe -Embedding
                                    1⤵
                                    • Suspicious use of FindShellTrayWindow
                                    • Suspicious use of SetWindowsHookEx
                                    PID:2672
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=528884
                                      2⤵
                                        PID:4452
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=3776 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:1
                                      1⤵
                                        PID:2064
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --mojo-platform-channel-handle=3696 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:1
                                        1⤵
                                          PID:572
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5236 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
                                          1⤵
                                            PID:2920
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=5452 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:1
                                            1⤵
                                              PID:5776

                                            Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\24267

                                              Filesize

                                              11KB

                                              MD5

                                              e05449695df53a040cc08ad5f9601c91

                                              SHA1

                                              863e4e315bc5530c957c6f41283e32ecae31f8d5

                                              SHA256

                                              360286058877889c758bfeb25f390a49bfdec4a15c25e137608dcdccb97aa776

                                              SHA512

                                              0e795e11fe9f1dd1d069dc9e39e7798eabfd5b941c59308482cefc54c7e88bb02aad8944fd6c3bd9918f36d580d908ce04df7d1a29dcf1e6417913ca73951358

                                            • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                              Filesize

                                              442KB

                                              MD5

                                              85430baed3398695717b0263807cf97c

                                              SHA1

                                              fffbee923cea216f50fce5d54219a188a5100f41

                                              SHA256

                                              a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                                              SHA512

                                              06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                                            • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                              Filesize

                                              8.0MB

                                              MD5

                                              a01c5ecd6108350ae23d2cddf0e77c17

                                              SHA1

                                              c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                                              SHA256

                                              345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                                              SHA512

                                              b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\db\data.safe.bin

                                              Filesize

                                              2KB

                                              MD5

                                              2fcd60e2d6d3bc3d8edfe9a1df1242e3

                                              SHA1

                                              cb0d6b1975e27657002760ca08368b20208197ef

                                              SHA256

                                              3c6d52ebd4a39a05b4774779f1b67849f60725c3834f6c2d5f62fd51a852a7e1

                                              SHA512

                                              6c84f0cb214c0e204f62c7def0db3f050b918632e920ebaaa172ad42f83a4ea85a17e0ee3e02cb0a6c39adcbfb014d4b3213bf0905febbbd9b15ab6b7d6d4145

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\d9367932-14c0-4f4c-a80a-e8aacd79f915

                                              Filesize

                                              10KB

                                              MD5

                                              cbc9b795d8dfeb1b87f9ef74b41cd9e2

                                              SHA1

                                              f117cbdc260854c222f160a63aaaeb4f20e03df5

                                              SHA256

                                              e2d704b51d41cad079b42da669f92b3c246ec24725d273c5f0d7269247e3e333

                                              SHA512

                                              d1ec724c5bb323fa38ce0e16cfeae70bf86447ef53834c6dcf30a3cce31d5044e2c1f1a2bbb5809a537ca9317226f2bef6f2d69a8ea930e5ea7ec4ec3e9a7cd1

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\e91b49dd-61f4-44b8-8541-89ac61597b11

                                              Filesize

                                              746B

                                              MD5

                                              a9f40a940fdda8b8d7861e19054e5db8

                                              SHA1

                                              838a4ec2551184938d5be1002cca6518c785ae9f

                                              SHA256

                                              2a805168e496e664e205fce878cca410bcf3d1b5d2220f1f15e3d0a35de74eda

                                              SHA512

                                              a5fb0bdeb76f8783eefcfff99b60fbbcc21919dc1e2476dcd798249b91ec86d3a861d0057cde4883097a8c290d300c682909445221cf247a9305db52d55ea536

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

                                              Filesize

                                              997KB

                                              MD5

                                              fe3355639648c417e8307c6d051e3e37

                                              SHA1

                                              f54602d4b4778da21bc97c7238fc66aa68c8ee34

                                              SHA256

                                              1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                                              SHA512

                                              8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

                                              Filesize

                                              116B

                                              MD5

                                              3d33cdc0b3d281e67dd52e14435dd04f

                                              SHA1

                                              4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                                              SHA256

                                              f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                                              SHA512

                                              a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

                                              Filesize

                                              479B

                                              MD5

                                              49ddb419d96dceb9069018535fb2e2fc

                                              SHA1

                                              62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                                              SHA256

                                              2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                                              SHA512

                                              48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

                                              Filesize

                                              372B

                                              MD5

                                              8be33af717bb1b67fbd61c3f4b807e9e

                                              SHA1

                                              7cf17656d174d951957ff36810e874a134dd49e0

                                              SHA256

                                              e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                                              SHA512

                                              6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

                                              Filesize

                                              2.3MB

                                              MD5

                                              03b17391e82b9260821583673132ae43

                                              SHA1

                                              fcd634265ed37c1cb7bd9b260034040c3258a0c6

                                              SHA256

                                              b09bbca427f6ad8ab73601e2a7331db2c73c68c4accd4dfea66db6dd07c06d9d

                                              SHA512

                                              290ede8ed1158c4d5730c882a0f07710d615eaec9f4e825340b9265563bbc977ee89c8e2b008233acbdd01bcd32d6357e05cc3dc7e7631c3bd2c7160aa36d913

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

                                              Filesize

                                              1KB

                                              MD5

                                              688bed3676d2104e7f17ae1cd2c59404

                                              SHA1

                                              952b2cdf783ac72fcb98338723e9afd38d47ad8e

                                              SHA256

                                              33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                                              SHA512

                                              7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

                                              Filesize

                                              1KB

                                              MD5

                                              937326fead5fd401f6cca9118bd9ade9

                                              SHA1

                                              4526a57d4ae14ed29b37632c72aef3c408189d91

                                              SHA256

                                              68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                                              SHA512

                                              b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js

                                              Filesize

                                              7KB

                                              MD5

                                              594cb58d9db79057c3e8a547e5805316

                                              SHA1

                                              a8234db038634230132427076a3f84a2b9e707a3

                                              SHA256

                                              7c0f0cff921ea1ccd98ec2d04a59475b9a2b3f0ad6f05f2640227f1efe8da369

                                              SHA512

                                              d698a28ffcb7f36fca0f5f084495ef70095ff9eed50c01fb27de2397f9443cf74f750cc375ccb46927602fda1a5bd969ab0db1fec3cbd46d652a2424c539d768

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js

                                              Filesize

                                              6KB

                                              MD5

                                              0a2a62c7e9c776427cfc33694d925e03

                                              SHA1

                                              84ff9ba1adc43e73ac642ae121dbb1334b108183

                                              SHA256

                                              e285e1174a6ddc2f7ad0ce25ab44d645fd0df07e751c08c2df2b6c8f048daac2

                                              SHA512

                                              92ef8c6104b07b1d057863b5704a5a2d54d07ac1d3cb0cf3ef012b8ad5019cab4981625adb2bfe83c32871434c42f9862266f87a499b1b47a6247a592f498778

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js

                                              Filesize

                                              6KB

                                              MD5

                                              1c37a27808988effd9425525778aa1ee

                                              SHA1

                                              861795dd2ba83d8c85ddda03c3f4f3747b69e5d5

                                              SHA256

                                              893dc4aafa925f39d672e93b3635b28ed8e17ff874d6b6c9673cfe826f0d52e3

                                              SHA512

                                              2e007fb0d09d9091502f19decb77dc476345c2745964a8450e29c325d5421099ef4a1df0a987b4cd36005d69a30831986673bd84c1daa23bf3bf74eeddbd1217

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js

                                              Filesize

                                              6KB

                                              MD5

                                              409d3a38cc91dec3783c8176e03f82e8

                                              SHA1

                                              8beb881c8d13a92425b14365710b069af5b17704

                                              SHA256

                                              2797cb9708f87edbefe8a5550bbcf155dcf2f3116c809e36d3bb21b733b95927

                                              SHA512

                                              001ab1095bf761a0d7b9999f1df9a28498b6223574efac3bb6305fab51b8b122f1cebb9273483b887d86080d6148643f392b0e11910a639aa7b403c62a91760a

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs.js

                                              Filesize

                                              6KB

                                              MD5

                                              88db53b2a517683cb963ec6487ca54b8

                                              SHA1

                                              2f71f3ac192c8836c21d177a36f8afcc55ad3a5a

                                              SHA256

                                              7aba6c79433b8539d173a52d7f0b96730c06d5d262e362502a1266f3aa4c0dc1

                                              SHA512

                                              3bcf3a9920de7e08e5e712eb5aed6057209a560f914a0c32151a723e2ee6f51a6c68d0a388020e2c22f040cdba7ae43d1d1e17415d96b8f25cb220228665fb4e

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs.js

                                              Filesize

                                              6KB

                                              MD5

                                              be791c816b7cacec8f6482ed7838a052

                                              SHA1

                                              2d213012c5180779105c0b7c88db4b826a008865

                                              SHA256

                                              f1246b02b4a9f3cfd4f7baba09056a14c22dc1e1524c9c615e9a273a290b23cd

                                              SHA512

                                              f824316350051591b38ee7723a195a3bc731b6c791ef10f1fb07a40860f56f1d5b496e9d5f4f5423773b3499f7c18d3a0c1080ff521cbe9c533a6f41ab67dfe4

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

                                              Filesize

                                              6KB

                                              MD5

                                              c7c5f970d856f31b7a1ab46b2f6291f1

                                              SHA1

                                              2d2a21fb3309ff44e1cf7bb15a4063a3cdf30aa6

                                              SHA256

                                              4dd5dfa93e398986cb8f821eefb7bc926a9243ac136674009359b59376c0f2bd

                                              SHA512

                                              7b086aaf5a2b99963ed6e5e801adbd7c7b05fc7bc90f8531fd9d7f044e1e68a472fbddd76feecbfe3f8763f4d496ed4dededf70111218863b5e5fd54ffa79acb

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

                                              Filesize

                                              6KB

                                              MD5

                                              5fe5332906d65a80f9107008501080cd

                                              SHA1

                                              909e426682ea4169089ea5258cf63b964b223638

                                              SHA256

                                              1f30af36d916690772ecbf605a164a8cbd540df82bd59bd7850cc18c2eb1aa0d

                                              SHA512

                                              38c1d9babc20dd0046c4bc62439ccdad23e9df4d0d459d0bc841df18b440cb48d480b006e9117cf212290f9358cd2d718e119ad4266273477ef35e95563e8c2d

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

                                              Filesize

                                              6KB

                                              MD5

                                              ca8edf5a3da59871db8697915e6addf5

                                              SHA1

                                              4488058a2cd49bf6454b1df532c6accea8e6855f

                                              SHA256

                                              1c00f1c54e03882f81b747a44846b8654d20bb9a6cdc8bbbeed46e817433775b

                                              SHA512

                                              f866c37d6d86185ae53c5bf57d8738b8acf59ff03717648740bcfd60ba25d3ed1f9b02881929496428cbcae25d234cb751e16a679ea6b2a242cc05416325d3e6

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

                                              Filesize

                                              6KB

                                              MD5

                                              277f29f85e952d7645bc193b61f99544

                                              SHA1

                                              b93e784fc1edb1a7a34d9c5ecbc2686b260c058d

                                              SHA256

                                              debe680d3f04b099d33eb1bf7856124f5b21f6be4d0bcce3900d4dd7f27fb09c

                                              SHA512

                                              f21c8d2f48dba7d5507deee7545f7572c88eeaf77972259310923a6a352ecc8db2b90a6b9f6d9a83e2f80f3c685273a12c3bc71bc47f09f71049f5cabaeafb5f

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

                                              Filesize

                                              6KB

                                              MD5

                                              96e6260438996a862948f232ad407290

                                              SHA1

                                              89591c31b5e1bf3d22d5fa47c95f0a97578e8db6

                                              SHA256

                                              fa01426754de5dfd4017e307ae6ea9d62f448c441b1babb7cf4e969d81e6ae5e

                                              SHA512

                                              2cc6f41164371836894273a010085f7c03c1413a39d45158eeb150fd033f4dd63d778a916d389eaade8b115e066ed3f54d190ad119d187610ba439332dc1b25d

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore.jsonlz4

                                              Filesize

                                              6KB

                                              MD5

                                              57ab591fdf4ce163049c817bd31786a4

                                              SHA1

                                              ad20580e6b8c999966e64e308552320d823fde26

                                              SHA256

                                              98d73f7b61b1d0895025e7fa5aa1b077e91f960430666d7abb2944fff0a0a291

                                              SHA512

                                              090b31ab8332ee7a097829f09d3f41fd81f682c6cb928791fd56946763601bc668db67319182a3317d025d7f30b80e4393c264d926085401461216dacf825084

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                                              Filesize

                                              184KB

                                              MD5

                                              89fb414d778d11d3a12991de60301815

                                              SHA1

                                              1d7a63ca92d9ad28930ce2feaac8c71c3f699ef7

                                              SHA256

                                              935ba660008416f0b46a028a709944f11f9c2858243a2f7bc0b57aa1d96314be

                                              SHA512

                                              49f06dc78f2e08621ba4ed19925d8c7ed040502f13edaeedc7df3d675e77417d8b7b3c0b3feaf7f4fcef989091b363f5af1fa9258de57cee5bd904e1d7a31f9b

                                            • C:\Users\Admin\Desktop\CheckpointConvert.mhtml

                                              Filesize

                                              128KB

                                              MD5

                                              2b38122da50a3c7051eb3bbe801fae89

                                              SHA1

                                              06b051e1178b92068411370dfcc722f2c87e36ee

                                              SHA256

                                              c59b7bec39091e085cc841e2a069b345c9ba36fe8d4de9d5fd30877a2aebf817

                                              SHA512

                                              af4e445ac1f9639f42cbe555b9365c72348d2c4f4b4c350a07216f9468d79b3f30e69aeabd87292e1a33f00990ea24b8a339ac66a2fccaf666f8eb9dbd132863

                                            • C:\Users\Admin\Desktop\ConfirmUnblock.nfo

                                              Filesize

                                              446KB

                                              MD5

                                              b39fe3771073720306b13731e1402315

                                              SHA1

                                              149f234df429d4f8a36cadc3e6b52589fb6d9a6d

                                              SHA256

                                              56f2da6c56159f8fba7cb9e68623f9cacfae34d1899d640c67a42299067fa16d

                                              SHA512

                                              63e829a967864c6c72307643b354e0a318b9c17cfca1e9d95b6c99951d22370dca669a3ec0b0ddb1e6a721e5d46836aeb6ff43b029798f1f2db039c353d99574

                                            • C:\Users\Admin\Desktop\ConvertFromReset.emz

                                              Filesize

                                              128KB

                                              MD5

                                              3969b99695786d2d391913e1fcdb0fe6

                                              SHA1

                                              c157880eebfde42af07c18c244198733c0a3ca7b

                                              SHA256

                                              0466b9b92a682fccbc3ce0e2cf55c664b54f5de7a4fa3a858c395fd1fceda6a5

                                              SHA512

                                              e01ff78d4f7afea1b76f82aa20e31afa5c511c5589503f71e35662c795b1bd68d4d27bae30a5bb13d1ca140d42cd90a794d77cd280b5ffd45162a65b129338cc

                                            • C:\Users\Admin\Desktop\ConvertToUnlock.ppsx

                                              Filesize

                                              421KB

                                              MD5

                                              8c2daad7cae2d60597531e63e04c2724

                                              SHA1

                                              4f9c3dd6d2d69f2c760592d70f8f949a07a52c28

                                              SHA256

                                              432c87a56d7c20dc4c0a1a30dc06abaf5d52698e4f1e73e787666d97a341d7cf

                                              SHA512

                                              7840a5764d845d675178113eafd8b2e3ed78815c3b20c94dde2a2e84332e9332bc676e92bc87ba26f29edddb4867f497cf277db09ad67c2aa8321c77c18e0ce9

                                            • C:\Users\Admin\Desktop\CopySelect.jpe

                                              Filesize

                                              498KB

                                              MD5

                                              dbb1a87aae40e9bdba9412aa04df8549

                                              SHA1

                                              f2e81cbf17d07d781a9f43eb223e215f824896eb

                                              SHA256

                                              d5e57a4c9aabb1c26873fd5c177e63c3958affd4e9792231dae4463697cde809

                                              SHA512

                                              c911a9add4bc16af0bc56be073caf71f252f3e69fbd352efbbc81836d902a0863427e36f5c8c0c8b9731fc1fdcd5343df0c6a187142c694342eb94784f78b4fa

                                            • C:\Users\Admin\Desktop\GroupJoin.pot

                                              Filesize

                                              268KB

                                              MD5

                                              de739202519ef87021d25cb9f3f7f34f

                                              SHA1

                                              3292bad669b9ad6c46bbe86967a94c50d4bf92a5

                                              SHA256

                                              897cbb7be9cdfb3d47e73655b98a3c724a33769a7a311507db27c3069b5d75a8

                                              SHA512

                                              23c97faa740d615f64a30ec72c094e500de8e775c0147da1f4a29935049c34f535d7d16915325b2664dacf2b51d80a75202db2ff658722c3787576dd567cabff

                                            • C:\Users\Admin\Desktop\MeasureGroup.odt

                                              Filesize

                                              128KB

                                              MD5

                                              14369433df9a41dfa421c1976890ccc4

                                              SHA1

                                              5d5b3c52de83bf91b4c08ed75d05676e3d5cf90f

                                              SHA256

                                              d8bf143f85d88123d8088aabfd3d73abb071b55a476b7c485ce855d5a75b6517

                                              SHA512

                                              b1752fbd9650b1eb6da6c24cb63321126beb4f3f6fd789d2dcbc4a469a6bf688169cdb77bf2b31cb44981cf147faf011e96bf79adc1f5aa10b5d148e6c2847c4

                                            • C:\Users\Admin\Desktop\MoveDisable.bat

                                              Filesize

                                              293KB

                                              MD5

                                              824eb45d4174842eade7a37def894a34

                                              SHA1

                                              4a5a4843572c81c86ffc21547506904ee9d13385

                                              SHA256

                                              bd0cc96df836bb6a3898f61e9b60b8c323ed8e549b435c6899036a4f770e408d

                                              SHA512

                                              7300f3fd65d6cdd905a2a2f597adb5ffde49582f581c820eb6dbc2f61c19e3263fbca07ce7a1f21475e666615bf566e809f468ea424c6227205149f592808073

                                            • C:\Users\Admin\Desktop\PushFind.asp

                                              Filesize

                                              472KB

                                              MD5

                                              890fa7c433bc43e6c4869d1aa2c8312a

                                              SHA1

                                              ba4b00c8e8dc3469e10cab65a96e5a7169b90e63

                                              SHA256

                                              323ed7769c59d7e48a403f92d7ea33ec0d444d2a2123786d426c2bea526ba3f9

                                              SHA512

                                              48bdefc99f4b8b7b50bddd764844b9fd05f3fd290ca70b15b9cb530db437e6920733808d7717816dfca488b5c2e3eaf3aa4d889f3e9c7f2819afcd694f9996f6

                                            • C:\Users\Admin\Desktop\ReadSet.wps

                                              Filesize

                                              128KB

                                              MD5

                                              9a1453cfd32133659f9558dc445e9fa8

                                              SHA1

                                              9d8e385d299b2ec8f52e5efda9096bd83d93b395

                                              SHA256

                                              201b19fb7c7bc62e4ca12736cb3493b3c4067daf912249fd845669128363d5fa

                                              SHA512

                                              47bc258f63f7db68d432f28cbb4c57c06b2b10b5bfe6d20e2da44946e49932b3ed718a49c43896d8445c3371726115eff5f8b1bb30465c63b5fe3a16af075688

                                            • C:\Users\Admin\Desktop\RegisterDismount.cmd

                                              Filesize

                                              128KB

                                              MD5

                                              1f5dac10edcd01f6bbc049752b38adb2

                                              SHA1

                                              5a817f25ae380cee6c952456e1e2bd7cf4861e24

                                              SHA256

                                              9df2f673803eb0fd051e4db94e0b3448082fe0696503eb326b6f99ffbad92c48

                                              SHA512

                                              8b0c40231b163eeb2bd01c5728266e0e2aad30ef925f9149fb14724340d271fdfc8e6245b1c005825aca95cbd60ac189bf809b6794e4a2e55ba20ad4247ff0bb

                                            • C:\Users\Admin\Desktop\RestartMeasure.pptm

                                              Filesize

                                              370KB

                                              MD5

                                              decb6a513aa020c204d5198e2e1efc9f

                                              SHA1

                                              e09ce34441fb7b324aa82d68b69bfd8144460518

                                              SHA256

                                              66a27c6f1a61f3d1ba4a0bd8c25b8bcce021ba5c74dd836783ea5b25de469ccc

                                              SHA512

                                              6a0c5d698a78f1df1aaac1c39078aee893c07443374a6ea0aee3a2f5acb662a4a6499235349cab40b2951129f2ee44f2b51fcf81e8ae647f486e4b30055abd52

                                            • C:\Users\Admin\Desktop\SelectConvertTo.tiff

                                              Filesize

                                              128KB

                                              MD5

                                              d1b4564cf3291bdc77083556d843d4c4

                                              SHA1

                                              7491be2bcc7948520f612ae0785b6b785800018a

                                              SHA256

                                              521d625146742d29e228d8a1012faea13518bd7a49dc31638edc5a42f34a7183

                                              SHA512

                                              6fb2b56cfd90bbfdb4d3131ce01058454a4df3418c0ac95af7a6afd5b3bd37443006768f54d81a51f93d10a87436d8811900153ba2f7e7bfcfcfbe961bcd1597

                                            • C:\Users\Admin\Desktop\SendUninstall.dotx

                                              Filesize

                                              128KB

                                              MD5

                                              d3ed7507e0c550bd1e6cc4bbeda5dd2b

                                              SHA1

                                              d86292c35464c54dd2e4ad68c76c9e2c4014d4cb

                                              SHA256

                                              3645ae0a8dedcb2dfe5fec204990644d92c928f9e1eb8be2d82fc17300314a6b

                                              SHA512

                                              98eec7ee2b15b3f5034bc58b34c46b73b94e7eed93984609966213632ffb633978ba74780f577261696a825dd3d0f94212f9481923afac776d83e3bc2b261e4c

                                            • C:\Users\Admin\Desktop\SplitConfirm.ps1

                                              Filesize

                                              128KB

                                              MD5

                                              67d4c3ee9f0448c73f2f47ac956941d4

                                              SHA1

                                              a94b6895ed417928002983c3328ece9b3e213882

                                              SHA256

                                              969ed0b705ccc27af45deda1d7d9b86c95931cf710a4de3878b1c7dd9a3a2975

                                              SHA512

                                              7676b0b851eed40c2bb868d5f62019e2861ce8c796d2bc59a832372ee9c8a2718feaba9e8cd1ef704374eda2ea08e735d7d59b17f5ebefa9466cd54a142fc7cf

                                            • C:\Users\Admin\Desktop\StartCopy.reg

                                              Filesize

                                              128KB

                                              MD5

                                              9a89c06a93bdd59ae7ffae6856c695ee

                                              SHA1

                                              aa2dfbdb7c16a2d632256d67aa53732c1e4c5e85

                                              SHA256

                                              c2898905a22715d887963f8ebd1b3c846a16466478ddfe906c38f0702bbf6f5c

                                              SHA512

                                              7ffa8fa44a1b4c9b685fe910cebdbe575aafbd119e63ee4024bfb6ad7c2f6507d354606a34116bcdda0633320e66c73bb1a09ac9a6706e82ed7510732fc3696d

                                            • C:\Users\Admin\Desktop\TestPush.txt

                                              Filesize

                                              128KB

                                              MD5

                                              5f53fc1add249e5a200ead2641510acb

                                              SHA1

                                              3f4f2ff71fa3e6420625d10e47e3e17f395a236d

                                              SHA256

                                              fb3749e97469bae033c6899f269e95cbb6cfabd5448c2d2dbca90fef7bbf0cf5

                                              SHA512

                                              ddfb4c516ae16bf0727029997420fbb71e3d2f32044bbdf9c9b10f29fed84830386890f4ab27d9f49b96cb3bdeef36eb9c6301e9c3f0a18df678492fb51ac368

                                            • C:\Users\Admin\Desktop\UnblockExport.3gp2

                                              Filesize

                                              128KB

                                              MD5

                                              9398a763a2524db7425d6984f003aa39

                                              SHA1

                                              19df1c4aace4d06845fc97acb813615f867b9ca7

                                              SHA256

                                              524badc24682a82fd1a863ed7c9d5c1f07e271074e4e5398ba9521860b386600

                                              SHA512

                                              af4f0f4451496eebb54b7e8949a01b240532429d22b8afe59ce11bbfe8250fefe1201cfaa851da24f186182bd0123515d0ad1aff1e6ca5ec500aee412718fe77

                                            • C:\Users\Admin\Desktop\UnprotectOptimize.cab

                                              Filesize

                                              128KB

                                              MD5

                                              a5e1cb712cf361d202822e016940aedc

                                              SHA1

                                              9f4fd3603b9fa890c19b5b957c3da97954c64392

                                              SHA256

                                              eda68307c42d54577c41b16e91ccd4db36fd3766359b64082e27e993e438fd0d

                                              SHA512

                                              050cd19028a5fd759e6cab4aec2e0a9408101828d47183b67dc6e38f35ed6e256f8cde76295d8ae820f3499f5a6d42758cf6429496e8d785ab327ff8dd13367c

                                            • C:\Users\Admin\Desktop\WaitUse.wmv

                                              Filesize

                                              128KB

                                              MD5

                                              5cb495e6452086f943dd0ba4bc7d7916

                                              SHA1

                                              e375a8954ae1b48d298abfd81a1f28db435de047

                                              SHA256

                                              10fa9fbb03c279db62372157ec1623820a66419278350b7044de37180d316542

                                              SHA512

                                              e73f67f49f238fa3be423a83647271ebc4a4fd676989042e95288a782455b93e3cf173e56a545f68e74f1b66e820c1cdd24eb455897c19492d00043e59afd635

                                            • C:\Users\Admin\Desktop\WatchUnblock.ico

                                              Filesize

                                              128KB

                                              MD5

                                              bf135997bbb646018dee69b108a50c7f

                                              SHA1

                                              11301a975671a0ec04e7d7a1c6ff96a81126cbda

                                              SHA256

                                              7d9979ca2a532497c4aed6fc7243686773e86ad0611cd5a360072c875b5f7461

                                              SHA512

                                              da224c1dbd4d0e184aae17d7cf8c1b0acb799f19fc726d4574a09af96393f21cf8634b468029f426610375442f2402ccfd2816dd7b2149ca748377be5696ab00

                                            • C:\Users\Admin\Downloads\ROBLOX Cheat.TUG0uMLd.zip.part

                                              Filesize

                                              16KB

                                              MD5

                                              9f707a96f844d18b64b514c42b3a6201

                                              SHA1

                                              9aaef38295f410a64e50fa100e68e58a80ddbc84

                                              SHA256

                                              e0490164fbb1c1db525c0acde5d4b28fb87e6718799ee4a46ad57f8ca326f05d

                                              SHA512

                                              cad9f9334d40a7ee851bc0ac483d63a5d4e51afb13f7dce05e742ed1810d7673a6a5eea5d48d6429bf3aa5cf5f3b3d235475c618d385ebbd8d1c6dd884178ab9