Overview

overview

10

Static

static

3

Prism Rele....5.exe

windows7-x64

10

Prism Rele....5.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    269s
  • max time network
    271s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/06/2024, 18:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Prism Release V1.5.exe
  • Size 5.1MB
  • Sample240615-w588ravaml
  • SHA256 b61ca7c42fef43547c7892c76a925ec4a846373bfcde20426c913a4390f71001
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xwormdiscoveryevasionexecutionpersistencerattrojan

Malware Config

Extracted

Family

  • xworm

C2

  • 91.92.241.69:5555

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    Windows Runtime.exe

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Using powershell.exe command.

    execution
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 36 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies registry class 32 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 30 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 27 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Prism Release V1.5.exe
    "C:\Users\Admin\AppData\Local\Temp\Prism Release V1.5.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1576
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHoAdABtACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAHEAegBnACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcALgBnAGcALwBnAGUAdABwAHIAaQBzAG0AIAAtACAAUgB1AG4AIABBAHMAIABBAGQAbQBpAG4AIABJAGYAIABJAG4AagBlAGMAdABpAG8AbgAgAEYAYQBpAGwAcwAnACwAJwAnACwAJwBPAEsAJwAsACcASQBuAGYAbwByAG0AYQB0AGkAbwBuACcAKQA8ACMAdQBzAGQAIwA+AA=="
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1020
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAdAB2ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAcQB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHYAdQBwACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGYAdwBhACMAPgA="
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3692
    • C:\Users\Admin\dllhost.exe
      "C:\Users\Admin\dllhost.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5060
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\dllhost.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2332
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'dllhost.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:400
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Windows Runtime.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2160
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows Runtime.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4052
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Windows Runtime" /tr "C:\ProgramData\Windows Runtime.exe"
        3⤵
        • Creates scheduled task(s)
        PID:3732
    • C:\Users\Admin\Prism Executor.exe
      "C:\Users\Admin\Prism Executor.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2128
      • C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\nexusloader.exe
        "C:\Users\Admin\Prism Executor.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:212
  • C:\ProgramData\Windows Runtime.exe
    "C:\ProgramData\Windows Runtime.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:4452
  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4920
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      2⤵
      • Checks processor information in registry
      • Modifies registry class
      • NTFS ADS
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3864
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3864.0.1960213076\468788330" -parentBuildID 20230214051806 -prefsHandle 1776 -prefMapHandle 1768 -prefsLen 21998 -prefMapSize 235091 -appDir "C:\Program Files\Mozilla Firefox\browser" - {45c79599-0ac2-49e0-8d0b-429d9bfde407} 3864 "\\.\pipe\gecko-crash-server-pipe.3864" 1868 2587900ea58 gpu
        3⤵
          PID:3456
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3864.1.565303086\2016431335" -parentBuildID 20230214051806 -prefsHandle 2424 -prefMapHandle 2420 -prefsLen 22034 -prefMapSize 235091 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dcc2d61d-d8f1-45ef-80a5-16ba248fe25b} 3864 "\\.\pipe\gecko-crash-server-pipe.3864" 2436 2586c38ab58 socket
          3⤵
            PID:408
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3864.2.1440840720\1146739278" -childID 1 -isForBrowser -prefsHandle 2968 -prefMapHandle 2964 -prefsLen 22137 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c7d723a0-c1fb-4fed-8c61-a743a8d8d166} 3864 "\\.\pipe\gecko-crash-server-pipe.3864" 2980 25878097858 tab
            3⤵
              PID:3524
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3864.3.32729847\651578831" -childID 2 -isForBrowser -prefsHandle 3928 -prefMapHandle 3924 -prefsLen 27538 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {78e65137-9e44-447a-976d-e35bf2c517cb} 3864 "\\.\pipe\gecko-crash-server-pipe.3864" 3940 2587da38e58 tab
              3⤵
                PID:2236
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3864.4.203035511\693439078" -childID 3 -isForBrowser -prefsHandle 4936 -prefMapHandle 4920 -prefsLen 27538 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b36b182b-17e8-40bb-98f4-5f189775204b} 3864 "\\.\pipe\gecko-crash-server-pipe.3864" 4944 2587fa59458 tab
                3⤵
                  PID:2056
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3864.5.1270519758\140264043" -childID 4 -isForBrowser -prefsHandle 5084 -prefMapHandle 5088 -prefsLen 27538 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {202a2268-7939-4793-893e-e8162f94fb67} 3864 "\\.\pipe\gecko-crash-server-pipe.3864" 4960 2587fa5af58 tab
                  3⤵
                    PID:2212
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3864.6.2131094017\465540290" -childID 5 -isForBrowser -prefsHandle 5352 -prefMapHandle 5296 -prefsLen 27538 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {764f961d-e819-4d49-b6b9-29e8ecc7e4a0} 3864 "\\.\pipe\gecko-crash-server-pipe.3864" 5392 2587ef7f458 tab
                    3⤵
                      PID:832
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3864.7.1496465417\788348149" -childID 6 -isForBrowser -prefsHandle 5944 -prefMapHandle 5832 -prefsLen 27617 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {496837de-97f1-462d-91c2-8372fe89b2c2} 3864 "\\.\pipe\gecko-crash-server-pipe.3864" 5768 258823d6558 tab
                      3⤵
                        PID:5424
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3864.8.1400345611\35167655" -parentBuildID 20230214051806 -prefsHandle 6312 -prefMapHandle 4888 -prefsLen 27617 -prefMapSize 235091 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e699127d-a842-460f-8017-2ff51d513df2} 3864 "\\.\pipe\gecko-crash-server-pipe.3864" 6348 25880c64358 rdd
                        3⤵
                          PID:5568
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3864.9.1120564190\1113279467" -parentBuildID 20230214051806 -sandboxingKind 1 -prefsHandle 6324 -prefMapHandle 6336 -prefsLen 27617 -prefMapSize 235091 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {96a926d9-cb39-4a21-9fad-226c7eb7f114} 3864 "\\.\pipe\gecko-crash-server-pipe.3864" 6372 25880c62e58 utility
                          3⤵
                            PID:5576
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3864.10.1215658891\198615931" -childID 7 -isForBrowser -prefsHandle 6108 -prefMapHandle 6536 -prefsLen 27617 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9b3a1780-8a05-4a6a-b743-56070f4de5fd} 3864 "\\.\pipe\gecko-crash-server-pipe.3864" 5944 25881843f58 tab
                            3⤵
                              PID:4444
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3864.11.271835986\61031495" -childID 8 -isForBrowser -prefsHandle 4768 -prefMapHandle 10612 -prefsLen 27882 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {75db558f-7b66-4771-929b-505f66595b2a} 3864 "\\.\pipe\gecko-crash-server-pipe.3864" 4780 25883c30b58 tab
                              3⤵
                                PID:6048
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3864.12.943568848\2020206518" -childID 9 -isForBrowser -prefsHandle 10416 -prefMapHandle 10408 -prefsLen 27882 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {252ebbdf-695c-4a52-962b-46483c67dafa} 3864 "\\.\pipe\gecko-crash-server-pipe.3864" 10464 25883ceeb58 tab
                                3⤵
                                  PID:6088
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3864.13.1143397996\1217151683" -childID 10 -isForBrowser -prefsHandle 9672 -prefMapHandle 1500 -prefsLen 28058 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f496df0c-b85d-4ca6-b422-b38b14593d81} 3864 "\\.\pipe\gecko-crash-server-pipe.3864" 9664 2587fa1a858 tab
                                  3⤵
                                    PID:6512
                                  • C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
                                    "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
                                    3⤵
                                    • Executes dropped EXE
                                    • Checks whether UAC is enabled
                                    • Drops file in Program Files directory
                                    • Enumerates system info in registry
                                    • Modifies Internet Explorer settings
                                    • Modifies registry class
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:7116
                                    • C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\RobloxPlayerBeta.exe
                                      "C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\RobloxPlayerBeta.exe" -app -isInstallerLaunch
                                      4⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Suspicious use of NtCreateThreadExHideFromDebugger
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • Suspicious use of UnmapMainImage
                                      PID:3556
                              • C:\ProgramData\Windows Runtime.exe
                                "C:\ProgramData\Windows Runtime.exe"
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:5392
                              • C:\Windows\system32\taskmgr.exe
                                "C:\Windows\system32\taskmgr.exe" /7
                                1⤵
                                • Checks SCSI registry key(s)
                                • Modifies registry class
                                • Suspicious behavior: GetForegroundWindowSpam
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of SendNotifyMessage
                                PID:3720
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.bing.com/search?q=tdb9jf.exe tdb9jf.exe"
                                1⤵
                                • Enumerates system info in registry
                                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of SendNotifyMessage
                                PID:5276
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffd75a946f8,0x7ffd75a94708,0x7ffd75a94718
                                  2⤵
                                    PID:1316
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,146519004106416975,16961568012636612716,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
                                    2⤵
                                      PID:6116
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,146519004106416975,16961568012636612716,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
                                      2⤵
                                        PID:6124
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,146519004106416975,16961568012636612716,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
                                        2⤵
                                          PID:2640
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,146519004106416975,16961568012636612716,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
                                          2⤵
                                            PID:2316
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,146519004106416975,16961568012636612716,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
                                            2⤵
                                              PID:3696
                                          • C:\Windows\System32\CompPkgSrv.exe
                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                            1⤵
                                              PID:6020
                                            • C:\Windows\System32\CompPkgSrv.exe
                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                              1⤵
                                                PID:2040
                                              • C:\Windows\System32\rundll32.exe
                                                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                1⤵
                                                  PID:6424
                                                • C:\ProgramData\Windows Runtime.exe
                                                  "C:\ProgramData\Windows Runtime.exe"
                                                  1⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:6548
                                                • C:\ProgramData\Windows Runtime.exe
                                                  "C:\ProgramData\Windows Runtime.exe"
                                                  1⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:6408
                                                • C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\RobloxPlayerBeta.exe
                                                  "C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:9MscoMRs5sG21FlAR2mIGzcsT9jlbUSUBp0x-lnVdHefiFlQucS9Ac2aQfouzA9zjrv2rCdqK_ropWWK96tSdrCKUi3UU6WArsgddv1C_dyzb7c5L5agLMbwpfYaHcD4sBznqEa7GmYGJkTxF0O58cIFQBh6dbS2I-p77JT5UjTPXxtk6C_oNUIDYUBBBeCYMqvymtJdD6b4E_zIaRCdFeykpGrrxr9R1rTMag_kp8YleXniyfvcx8wYIc-Ich4P+launchtime:1718476392043+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1718476350800015%26placeId%3D4924922222%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3D7ff82ad9-ed27-4e10-abec-6725e015a458%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1718476350800015+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
                                                  1⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • Suspicious use of NtCreateThreadExHideFromDebugger
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  • Suspicious use of UnmapMainImage
                                                  PID:5468
                                                • C:\ProgramData\Windows Runtime.exe
                                                  "C:\ProgramData\Windows Runtime.exe"
                                                  1⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:5056

                                                Network

                                                      MITRE ATT&CK Enterprise v15

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      RobloxStudioInstaller.exe
                                                      • Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
                                                      • Size 5.4MB
                                                      • SHA256 8d886a250762d21047a8a579251909225f5adab2e372a7f03e2c1c8c3d294152
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      powershell.exe.log
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                      • Size 2KB
                                                      • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      settings.dat
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                      • Size 152B
                                                      • SHA256 05e479e8ec96b7505e01e5ec757ccfe35cb73cd46b27ff4746dce90d43d9237c
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      settings.dat
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                      • Size 152B
                                                      • SHA256 8185c36aaacfc71e42f94fad8e198fe7fb2d868398ceabb89261cae94341cb22
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      the-real-index
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                      • Size 240B
                                                      • SHA256 97445afe3d0e63828bd7fa0f4e94b287f998d905921802109329a66766b50c3a
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      Network Persistent State
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                      • Size 248B
                                                      • SHA256 b654ea68d6ca7744a5aec1718f4a588e3aca3367b5ee158699ea522a44566b1b
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      Preferences
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                      • Size 6KB
                                                      • SHA256 d60a516fb12e092053756e71517893881f1cde38d532b1bcadc048046fd9cce5
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      Preferences
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                      • Size 5KB
                                                      • SHA256 b37d2357f2314a53fb6c76e2f97808cd9bfe6a344ac1d26a9c1567fac7f119c5
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      Secure Preferences
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                      • Size 24KB
                                                      • SHA256 d58162c5ae5e18fc06604c285e024c01686093d70994dc93b4ae9d85b4c3f7b9
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      Local State
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                      • Size 10KB
                                                      • SHA256 4a8a89c11ba859ea414dce831d1f12c0b3a8b326c0a08ebb2936352c79a6290b
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      StartupProfileData-NonInteractive
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                      • Size 944B
                                                      • SHA256 2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      StartupProfileData-NonInteractive
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                      • Size 944B
                                                      • SHA256 c0999b067446bc532bfdd5ceb5754fa1539dba3ac1eab33b4c6562635c5901f7
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      activity-stream.discovery_stream.json.tmp
                                                      • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0gx8chzo.default-release\activity-stream.discovery_stream.json.tmp
                                                      • Size 23KB
                                                      • SHA256 0865c04c456d892143b2a767b716c064e6b0fd209a52867de62c542d2cc1fef0
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      activity-stream.discovery_stream.json.tmp
                                                      • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0gx8chzo.default-release\activity-stream.discovery_stream.json.tmp
                                                      • Size 24KB
                                                      • SHA256 ad14dfecf7fce47454ba47c082c7d431eaa66cfd2ad9f0d306eca8bc9bcf454d
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      11664
                                                      • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0gx8chzo.default-release\cache2\doomed\11664
                                                      • Size 10KB
                                                      • SHA256 e40b587ee23d9a4b4a387ef5998bad6d4daa59d31341ec33fd94526bcc5788d6
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      12202
                                                      • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0gx8chzo.default-release\cache2\doomed\12202
                                                      • Size 10KB
                                                      • SHA256 7db1f953744a73c2978f4d2d7e7fcdc498db4ae032433e430bc7e5d45bcb90af
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      13136
                                                      • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0gx8chzo.default-release\cache2\doomed\13136
                                                      • Size 11KB
                                                      • SHA256 85a0a13518afb7dedfe2487e207c37f3e88d31e9a6d42a0bd020aeb3b93fcee7
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      15019
                                                      • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0gx8chzo.default-release\cache2\doomed\15019
                                                      • Size 10KB
                                                      • SHA256 6bbcb116bf19e74d520cf19ff41c888e288a1a4c12d87df3d9b44186e0067122
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      18625
                                                      • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0gx8chzo.default-release\cache2\doomed\18625
                                                      • Size 10KB
                                                      • SHA256 4e8f9aafd303d114115fad9edeb0ddda8b7b8d12117083f262401dba94bfbae0
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      19867
                                                      • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0gx8chzo.default-release\cache2\doomed\19867
                                                      • Size 10KB
                                                      • SHA256 b17b5b1a9c5e5906a4d532f2edba07321416e1bffe3580f66d031d124c515c36
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      20304
                                                      • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0gx8chzo.default-release\cache2\doomed\20304
                                                      • Size 11KB
                                                      • SHA256 06dc05a1881ffabc02407d653eb2886aa1ac061064ea9ba533942d8125357318
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      20316
                                                      • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0gx8chzo.default-release\cache2\doomed\20316
                                                      • Size 11KB
                                                      • SHA256 242deb6aa81ce39c43346548d995fed209988f43ead205c02ec40ceddec116d7
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      2181
                                                      • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0gx8chzo.default-release\cache2\doomed\2181
                                                      • Size 10KB
                                                      • SHA256 dff24a9f9dae1b75b02e43a2898feaa89867f7abdf3c9c416b4c0ebcff3ee9b1
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      22223
                                                      • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0gx8chzo.default-release\cache2\doomed\22223
                                                      • Size 10KB
                                                      • SHA256 11c158f1964544ed00e05fe88926e2418537a20a30888088d5fe3f57cf7fad79
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      24928
                                                      • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0gx8chzo.default-release\cache2\doomed\24928
                                                      • Size 11KB
                                                      • SHA256 64331e89797a91df662ae6ef47b996e54417ac962d9d6968264d443b3c3d7e55
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      26522
                                                      • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0gx8chzo.default-release\cache2\doomed\26522
                                                      • Size 11KB
                                                      • SHA256 298a67b7e273ef60956266a13915f4c25a53e0a65ae9836383aab0f858dc89a6
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      29528
                                                      • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0gx8chzo.default-release\cache2\doomed\29528
                                                      • Size 10KB
                                                      • SHA256 2172591e7008201193fab56c343b9d44deb454b8ecd994b8fc62874df9a5027a
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      31683
                                                      • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0gx8chzo.default-release\cache2\doomed\31683
                                                      • Size 10KB
                                                      • SHA256 dae4cf75624799c6aada4f8fd76a9fa7ad6459e476116e6f64c381e26875269e
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      31819
                                                      • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0gx8chzo.default-release\cache2\doomed\31819
                                                      • Size 10KB
                                                      • SHA256 4c5949c731c6ef97fd120f2e3a6cb139565dd372e25b37741c9137ee34343984
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      31944
                                                      • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0gx8chzo.default-release\cache2\doomed\31944
                                                      • Size 10KB
                                                      • SHA256 f29d741fca03c6d43d0524f344a24b2a48b70cab86dae5aeef8b7b66299143c8
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      4885
                                                      • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0gx8chzo.default-release\cache2\doomed\4885
                                                      • Size 11KB
                                                      • SHA256 27720138f3f686799d198858aa87dcc07710f4f96a8836932465dfe3aa2d1dd0
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      610
                                                      • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0gx8chzo.default-release\cache2\doomed\610
                                                      • Size 10KB
                                                      • SHA256 9d6f2336bfb9e752c231770d3e1c52b4887301952256b58e840d05a9c2eca52e
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      6728
                                                      • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0gx8chzo.default-release\cache2\doomed\6728
                                                      • Size 11KB
                                                      • SHA256 79d1478ebddc6791cbbad59ef146abc5fbe4f9a88e392a240aa144ae902d296d
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      8765
                                                      • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0gx8chzo.default-release\cache2\doomed\8765
                                                      • Size 9KB
                                                      • SHA256 856a0aba86dd2fc3f695715cf031c8ff3d21dfd76b076a049529669a1dd4b4f4
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      383A97A57B113BD106DE6984E6DBA5F537327263
                                                      • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0gx8chzo.default-release\cache2\entries\383A97A57B113BD106DE6984E6DBA5F537327263
                                                      • Size 13KB
                                                      • SHA256 d56db08ad83e841d65cb5c2e7d236ecc8a9f832d896ccb284291e06249fae2e9
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      6770EC485EC6D9C4EC989149B8A276B53D60695B
                                                      • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0gx8chzo.default-release\cache2\entries\6770EC485EC6D9C4EC989149B8A276B53D60695B
                                                      • Size 60KB
                                                      • SHA256 13368e028d2993a2ae7ff65a7652ed5e36e6b0dd453f34f3f465cf2297bc558a
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      97E21079D4338ED644D10F3CF8B6CCFD6F24DA5D
                                                      • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0gx8chzo.default-release\cache2\entries\97E21079D4338ED644D10F3CF8B6CCFD6F24DA5D
                                                      • Size 60KB
                                                      • SHA256 e45731325755fb248f10148e1d8a785090150f5eabcb6dda0f1ce6f6a1e7e4aa
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      CEFDDC23B82E690918E0D0A34455B852A760D9D9
                                                      • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0gx8chzo.default-release\cache2\entries\CEFDDC23B82E690918E0D0A34455B852A760D9D9
                                                      • Size 212KB
                                                      • SHA256 d385e42194dd995044321af3237ab4272fb17fb4b7ae30d9d3116ae44fd86f90
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      e602387055ae7b12c23fbeefeb417682
                                                      • Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\e602387055ae7b12c23fbeefeb417682
                                                      • Size 5.8MB
                                                      • SHA256 8df68686863894e7f47069b854d07d6eb449269f527c09433495efb130f33dde
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      __PSScriptPolicyTest_1lmdysb0.npb.ps1
                                                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1lmdysb0.npb.ps1
                                                      • Size 60B
                                                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      VCRUNTIME140.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\VCRUNTIME140.dll
                                                      • Size 94KB
                                                      • SHA256 e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      _tkinter.pyd
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\_tkinter.pyd
                                                      • Size 60KB
                                                      • SHA256 336bd5bffdc0229da4eaddbb0cfc42a9e55459a40e1322b38f7e563bda8dd190
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      nexusloader.exe
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\nexusloader.exe
                                                      • Size 3.5MB
                                                      • SHA256 6669bd79928492ab626c6cc64de35e3da76d655bbd197b5cc644584014fea5bc
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      python310.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\python310.dll
                                                      • Size 4.2MB
                                                      • SHA256 f281c2e252ed59dd96726dbb2de529a2b07b818e9cc3799d1ffa9883e3028ed8
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      tcl86t.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tcl86t.dll
                                                      • Size 1.8MB
                                                      • SHA256 224476bedbcf121c69137f1df4dd025ae81769b2f7651bd3788a870a842cfbf9
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      msgcat-1.6.1.tm
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tcl8\8.5\msgcat-1.6.1.tm
                                                      • Size 33KB
                                                      • SHA256 4fdf70fdcedef97aa8bd82a02669b066b5dfe7630c92494a130fc7c627b52b55
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      auto.tcl
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tcl\auto.tcl
                                                      • Size 20KB
                                                      • SHA256 f385515658832feb75ee4dce5bd53f7f67f2629077b7d049b86a730a49bd0840
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      cp1252.enc
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tcl\encoding\cp1252.enc
                                                      • Size 1KB
                                                      • SHA256 14df3ae30e81e7620be6bbb7a9e42083af1ae04d94cf1203565f8a3c0542ace0
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      symbol.enc
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tcl\encoding\symbol.enc
                                                      • Size 1KB
                                                      • SHA256 73fd2b5e14309d8c036d334f137b9edf1f7b32dbd45491cf93184818582d0671
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      pkgIndex.tcl
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tcl\http1.0\pkgIndex.tcl
                                                      • Size 735B
                                                      • SHA256 420c4b3088c9dacd21bc348011cac61d7cb283b9bee78ae72eed764ab094651c
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      init.tcl
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tcl\init.tcl
                                                      • Size 23KB
                                                      • SHA256 61c55633fa048deb120422daed84224f2bb12c7c94958ca6f679b219cf2fa939
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      pkgIndex.tcl
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tcl\opt0.4\pkgIndex.tcl
                                                      • Size 607B
                                                      • SHA256 eb9925a8f0fcc7c2a1113968ab0537180e10c9187b139c8371adf821c7b56718
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      package.tcl
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tcl\package.tcl
                                                      • Size 22KB
                                                      • SHA256 47b6af117199b1511f6103ec966a58e2fd41f0aba775c44692b2069f6ed10bad
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      tclIndex
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tcl\tclIndex
                                                      • Size 5KB
                                                      • SHA256 962c60eb7e050061462ff72cec9741a7f18307af4aaa68d7665174f904842d13
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      tm.tcl
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tcl\tm.tcl
                                                      • Size 11KB
                                                      • SHA256 6c02298d56e3c4c6b197afc79ec3ce1fc37ae176dc35f5d7ac48246f05f91669
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      tk86t.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tk86t.dll
                                                      • Size 1.5MB
                                                      • SHA256 bd4443b8ecc3b1f0c6fb13b264769253c80a4597af7181884bda20442038ec77
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      button.tcl
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tk\button.tcl
                                                      • Size 20KB
                                                      • SHA256 2f013b643d62f08ddaaa1dea39ff80d6607569c9e1acc19406377b64d75ccf53
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      entry.tcl
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tk\entry.tcl
                                                      • Size 17KB
                                                      • SHA256 dd351da6288cf7e9f367fd97c97cb476193ff7461b25e31667e85fe720edea04
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      icons.tcl
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tk\icons.tcl
                                                      • Size 10KB
                                                      • SHA256 a78388d68600331d06bb14a4289bc1a46295f48cec31ceff5ae783846ea4d161
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      listbox.tcl
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tk\listbox.tcl
                                                      • Size 14KB
                                                      • SHA256 b92526a55409c67473740551ca128498824d25406e3cc9bb0544e8296d3c5de4
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      menu.tcl
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tk\menu.tcl
                                                      • Size 37KB
                                                      • SHA256 588727079af7ecc44755efe33ebb7414ad2ee68390fc249ce073d38e03c78a4e
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      panedwindow.tcl
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tk\panedwindow.tcl
                                                      • Size 5KB
                                                      • SHA256 4adf738b17691489c71c4b9d9a64b12961ada8667b81856f7adbc61dffeadf29
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      pkgIndex.tcl
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tk\pkgIndex.tcl
                                                      • Size 372B
                                                      • SHA256 e0bac49b9a3f0e50be89f692273cea7b7462bfc3e054f323261ef99b708c70a3
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      scale.tcl
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tk\scale.tcl
                                                      • Size 7KB
                                                      • SHA256 58c662dd3d2c653786b05aa2c88831f4e971b9105e4869d866fb6186e83ed365
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      scrlbar.tcl
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tk\scrlbar.tcl
                                                      • Size 12KB
                                                      • SHA256 189e7ee4b67861001c714a55880db34acf7d626a816e18b04b232af9e6e33e81
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      spinbox.tcl
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tk\spinbox.tcl
                                                      • Size 15KB
                                                      • SHA256 5d6e939b44f630a29c4fcb1e2503690c453118607ff301bef3c07fa980d5075a
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      text.tcl
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tk\text.tcl
                                                      • Size 32KB
                                                      • SHA256 f26ed909a962d02bc03585a6c756f4fe992c311c7f53648137e427747120b441
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      tk.tcl
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tk\tk.tcl
                                                      • Size 23KB
                                                      • SHA256 3e998b41ab23677db31902e1e876e644b279b2e6d8896443f6c434352801cdd1
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      altTheme.tcl
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tk\ttk\altTheme.tcl
                                                      • Size 3KB
                                                      • SHA256 92b8be9d8934850b6d240b970603b0ad7c6dd4a45134545694fb52966d742861
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      button.tcl
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tk\ttk\button.tcl
                                                      • Size 2KB
                                                      • SHA256 391b6e333d16497c4b538a7bdb5b16ef11359b6e3b508d470c6e3703488e3b4d
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      clamTheme.tcl
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tk\ttk\clamTheme.tcl
                                                      • Size 4KB
                                                      • SHA256 93c29536262c582104bf1804d7b06c7565b7d621f2e3605ff8b6c981a3b4ab01
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      classicTheme.tcl
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tk\ttk\classicTheme.tcl
                                                      • Size 3KB
                                                      • SHA256 c7b1f40d77820fbaf2195f2bb3f334b38fec653fe47653f9e30a01ad4ca63ba5
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      combobox.tcl
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tk\ttk\combobox.tcl
                                                      • Size 11KB
                                                      • SHA256 057f8f447de3a753714b8f82b96054e1849a2424749f3482492eae192baacdcf
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      cursors.tcl
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tk\ttk\cursors.tcl
                                                      • Size 3KB
                                                      • SHA256 7bdffa1c2692c5d1cf67b518f9acb32fa4b4d9936ed076f4db835943bc1a00d6
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      defaults.tcl
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tk\ttk\defaults.tcl
                                                      • Size 4KB
                                                      • SHA256 d83248b535a9417ce0ca598bbe245f24252adc90e3611c1191a045d9c0a9c99f
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      entry.tcl
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tk\ttk\entry.tcl
                                                      • Size 16KB
                                                      • SHA256 fe32f8b154893218acaba93ac4b8e1170d9b3e3ab66df63df85c0a31c17592be
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      fonts.tcl
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tk\ttk\fonts.tcl
                                                      • Size 5KB
                                                      • SHA256 0eb518251fbe9cf0c9451cc1fef6bb6aee16d62da00b0050c83566da053f68d0
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      menubutton.tcl
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tk\ttk\menubutton.tcl
                                                      • Size 6KB
                                                      • SHA256 d9af20135ef1bfeb3e0fd9fdabe821474de3ed43b3745a42fe564d24a8b9fd9c
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      notebook.tcl
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tk\ttk\notebook.tcl
                                                      • Size 5KB
                                                      • SHA256 d1e5267cde3d7be408b4c94220f7e1833c9d452bb9ba3e194e12a5eb2f9adb80
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      panedwindow.tcl
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tk\ttk\panedwindow.tcl
                                                      • Size 1KB
                                                      • SHA256 ce0053d637b580170938cf552b29ae890559b98eb28038c2f0a23a265ddeb273
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      progress.tcl
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tk\ttk\progress.tcl
                                                      • Size 1KB
                                                      • SHA256 a9c34f595e547ce94ee65e27c415195d2b210653a9ffcfb39559c5e0fa9c06f8
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      scale.tcl
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tk\ttk\scale.tcl
                                                      • Size 2KB
                                                      • SHA256 25d0fe2b415292872ef7acdb2dfa12d04c080b7f9b1c61f28c81aa2236180479
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      scrollbar.tcl
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tk\ttk\scrollbar.tcl
                                                      • Size 2KB
                                                      • SHA256 b3a0e10c95b28c90cccfc373152bd30ab7da2fb4c0e96409aeeb01d453f36b4a
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      sizegrip.tcl
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tk\ttk\sizegrip.tcl
                                                      • Size 2KB
                                                      • SHA256 717d2edd71076ea059903c7144588f8bbd8b0afe69a55cbf23953149d6694d33
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      spinbox.tcl
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tk\ttk\spinbox.tcl
                                                      • Size 4KB
                                                      • SHA256 7c2ffd7308bdea852851335d5b5eb5dcca0e4d4a0cea16f786b40009ffd58b71
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      treeview.tcl
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tk\ttk\treeview.tcl
                                                      • Size 9KB
                                                      • SHA256 0e05adf29b616989cb4724e57a26f1044598781f0cc10d5eb5ac4af7d705ddca
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      ttk.tcl
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tk\ttk\ttk.tcl
                                                      • Size 4KB
                                                      • SHA256 61baa0268770f127394a006340d99ce831a1c7ad773181c0c13122f7d2c5b7f6
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      utils.tcl
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tk\ttk\utils.tcl
                                                      • Size 8KB
                                                      • SHA256 6c35cd6c7f3ac4be3fe0cc7633dbbde5123155921a441ba702b4347e6f967f34
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      vistaTheme.tcl
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tk\ttk\vistaTheme.tcl
                                                      • Size 9KB
                                                      • SHA256 ce1a53a769de9e230f586efafd2fb455980b45941e5db553bd3a2f0062b50f3e
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      winTheme.tcl
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tk\ttk\winTheme.tcl
                                                      • Size 2KB
                                                      • SHA256 05fad058280e7a8947a9f71122b442b92d7d578b4618b08bf0b71b6dac5aa22f
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      xpTheme.tcl
                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2128_133629499116023793\tk\ttk\xpTheme.tcl
                                                      • Size 2KB
                                                      • SHA256 ff421674388da5d3a0c687f342f8d1e3c7f247f3cb59d5512b31f91a54a4c318
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      tmpaddon
                                                      • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                      • Size 442KB
                                                      • SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      tmpaddon-1
                                                      • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                                                      • Size 8.0MB
                                                      • SHA256 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      gmpopenh264.dll
                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0gx8chzo.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
                                                      • Size 997KB
                                                      • SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      gmpopenh264.info
                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0gx8chzo.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
                                                      • Size 116B
                                                      • SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      LICENSE.txt
                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0gx8chzo.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
                                                      • Size 479B
                                                      • SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      manifest.json
                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0gx8chzo.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
                                                      • Size 372B
                                                      • SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      widevinecdm.dll
                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0gx8chzo.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
                                                      • Size 11.8MB
                                                      • SHA256 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      widevinecdm.dll.lib
                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0gx8chzo.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
                                                      • Size 1KB
                                                      • SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      widevinecdm.dll.sig
                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0gx8chzo.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
                                                      • Size 1KB
                                                      • SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      prefs-1.js
                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0gx8chzo.default-release\prefs-1.js
                                                      • Size 8KB
                                                      • SHA256 cb41570da52f47fee987930b42d3cff60c125c1ab505c29c96bf920f5cbe311f
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      prefs.js
                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0gx8chzo.default-release\prefs.js
                                                      • Size 7KB
                                                      • SHA256 5d09ccfb7563320d99d175177e39c3e475440f8e9c7b8297462ea03c625c5e04
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      prefs.js
                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0gx8chzo.default-release\prefs.js
                                                      • Size 6KB
                                                      • SHA256 26e90490ea295317424614ff2eb02b5fb5db803644e10dca5c9109eded81561c
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      recovery.jsonlz4
                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0gx8chzo.default-release\sessionstore-backups\recovery.jsonlz4
                                                      • Size 11KB
                                                      • SHA256 630a6218a1ae17af63f52cfb6ee6cbf811453d46e5e8f27e40b87345c2932f5b
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      recovery.jsonlz4
                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0gx8chzo.default-release\sessionstore-backups\recovery.jsonlz4
                                                      • Size 1KB
                                                      • SHA256 35f0519efb121d764b9f1c172d7a038add3401824e37afdc43bdce551264d5fd
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      recovery.jsonlz4
                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0gx8chzo.default-release\sessionstore-backups\recovery.jsonlz4
                                                      • Size 5KB
                                                      • SHA256 0482e7b4514877076175d68e2deda243c757d271d631fcede593e216ce853e8a
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      recovery.jsonlz4
                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0gx8chzo.default-release\sessionstore-backups\recovery.jsonlz4
                                                      • Size 9KB
                                                      • SHA256 7bd35f6b716cf62041b289a68622d82306386531dac49120b1c3d063b72439b2
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      recovery.jsonlz4
                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0gx8chzo.default-release\sessionstore-backups\recovery.jsonlz4
                                                      • Size 5KB
                                                      • SHA256 504d6dc267ab6321e91c1d5eab694ec7f0198ffa12dbfd0a13f2957085ef1f69
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      recovery.jsonlz4
                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0gx8chzo.default-release\sessionstore-backups\recovery.jsonlz4
                                                      • Size 9KB
                                                      • SHA256 1d1d705e5f572ef50762733797db84a69b02e66a151d633cd76191331cbbb3b7
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      recovery.jsonlz4
                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0gx8chzo.default-release\sessionstore-backups\recovery.jsonlz4
                                                      • Size 12KB
                                                      • SHA256 a3cf2ec8bca0f33dfd56704f191d709de2083c36ea69409f555143fa46093e21
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      recovery.jsonlz4
                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0gx8chzo.default-release\sessionstore-backups\recovery.jsonlz4
                                                      • Size 12KB
                                                      • SHA256 26262f21b556a7f319fd742ecc137674b3e2be4a7a25e9c6d894e316674622fb
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      3140325527hBbDa.sqlite
                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0gx8chzo.default-release\storage\default\https+++www.roblox.com\idb\3140325527hBbDa.sqlite
                                                      • Size 48KB
                                                      • SHA256 af9c503e703fa60532ef9503d9793de3f94a8b318e56a21fbb40092eb5594d52
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      usage
                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0gx8chzo.default-release\storage\default\https+++www.roblox.com\ls\usage
                                                      • Size 12B
                                                      • SHA256 07b3453e2b390a438965910155b06259238b2539983e0ceada44b44e850e6aa2
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      RobloxPlayerInstaller.exe
                                                      • Path C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
                                                      • Size 5.4MB
                                                      • SHA256 b5d35eaf2ca4befb5ac6de8680609c9a86fdc257b49d21ce4c8d17eddaa1b51a
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      Prism Executor.exe
                                                      • Path C:\Users\Admin\Prism Executor.exe
                                                      • Size 5.0MB
                                                      • SHA256 bb4fbbf322982321c56ac48cb7939ef7cb823b510a184c41e284f2cdf1bab68c
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      dllhost.exe
                                                      • Path C:\Users\Admin\dllhost.exe
                                                      • Size 78KB
                                                      • SHA256 34be6a934fd45752e788f9ba20943c8e52d91732d76e9f30a5176e98dccd956e
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      memory/1020-1070-0x0000000007D30000-0x00000000083AA000-memory.dmp
                                                      Download

                                                      memory/1020-1071-0x0000000006BA0000-0x0000000006BBA000-memory.dmp
                                                      Download

                                                      memory/1020-1073-0x0000000008960000-0x0000000008F04000-memory.dmp
                                                      Download

                                                      memory/1020-1074-0x0000000007AC0000-0x0000000007B52000-memory.dmp
                                                      Download

                                                      memory/1020-185-0x0000000003120000-0x0000000003156000-memory.dmp
                                                      Download

                                                      memory/1020-854-0x00000000060E0000-0x0000000006146000-memory.dmp
                                                      Download

                                                      memory/1020-997-0x0000000006250000-0x00000000065A4000-memory.dmp
                                                      Download

                                                      memory/2332-1081-0x0000029F34BD0000-0x0000029F34BF2000-memory.dmp
                                                      Download

                                                      memory/3556-2924-0x00007FFD96220000-0x00007FFD96230000-memory.dmp
                                                      Download

                                                      memory/3556-2913-0x00007FFD97730000-0x00007FFD97760000-memory.dmp
                                                      Download

                                                      memory/3556-2909-0x00007FFD975D0000-0x00007FFD975E0000-memory.dmp
                                                      Download

                                                      memory/3556-2910-0x00007FFD975D0000-0x00007FFD975E0000-memory.dmp
                                                      Download

                                                      memory/3556-2911-0x00007FFD976E0000-0x00007FFD976F0000-memory.dmp
                                                      Download

                                                      memory/3556-2912-0x00007FFD976E0000-0x00007FFD976F0000-memory.dmp
                                                      Download

                                                      memory/3556-2948-0x00007FFD95640000-0x00007FFD9564B000-memory.dmp
                                                      Download

                                                      memory/3556-2914-0x00007FFD97730000-0x00007FFD97760000-memory.dmp
                                                      Download

                                                      memory/3556-2915-0x00007FFD97730000-0x00007FFD97760000-memory.dmp
                                                      Download

                                                      memory/3556-2919-0x00007FFD96170000-0x00007FFD96180000-memory.dmp
                                                      Download

                                                      memory/3556-2920-0x00007FFD96170000-0x00007FFD96180000-memory.dmp
                                                      Download

                                                      memory/3556-2921-0x00007FFD96200000-0x00007FFD96210000-memory.dmp
                                                      Download

                                                      memory/3556-2922-0x00007FFD96200000-0x00007FFD96210000-memory.dmp
                                                      Download

                                                      memory/3556-2923-0x00007FFD96220000-0x00007FFD96230000-memory.dmp
                                                      Download

                                                      memory/3556-2928-0x00007FFD94DD0000-0x00007FFD94DE0000-memory.dmp
                                                      Download

                                                      memory/3556-2929-0x00007FFD94DD0000-0x00007FFD94DE0000-memory.dmp
                                                      Download

                                                      memory/3556-2930-0x00007FFD94EE0000-0x00007FFD94EF0000-memory.dmp
                                                      Download

                                                      memory/3556-2931-0x00007FFD94EE0000-0x00007FFD94EF0000-memory.dmp
                                                      Download

                                                      memory/3556-2916-0x00007FFD97730000-0x00007FFD97760000-memory.dmp
                                                      Download

                                                      memory/3556-2918-0x00007FFD977C0000-0x00007FFD977C5000-memory.dmp
                                                      Download

                                                      memory/3556-2917-0x00007FFD97730000-0x00007FFD97760000-memory.dmp
                                                      Download

                                                      memory/3556-2927-0x00007FFD96220000-0x00007FFD96230000-memory.dmp
                                                      Download

                                                      memory/3556-2926-0x00007FFD96220000-0x00007FFD96230000-memory.dmp
                                                      Download

                                                      memory/3556-2925-0x00007FFD96220000-0x00007FFD96230000-memory.dmp
                                                      Download

                                                      memory/3556-2936-0x00007FFD95050000-0x00007FFD95080000-memory.dmp
                                                      Download

                                                      memory/3556-2935-0x00007FFD95050000-0x00007FFD95080000-memory.dmp
                                                      Download

                                                      memory/3556-2943-0x00007FFD958A0000-0x00007FFD958AE000-memory.dmp
                                                      Download

                                                      memory/3556-2962-0x00007FFD95480000-0x00007FFD954A7000-memory.dmp
                                                      Download

                                                      memory/3556-2961-0x00007FFD95480000-0x00007FFD954A7000-memory.dmp
                                                      Download

                                                      memory/3556-2960-0x00007FFD95480000-0x00007FFD954A7000-memory.dmp
                                                      Download

                                                      memory/3556-2959-0x00007FFD952D0000-0x00007FFD952F6000-memory.dmp
                                                      Download

                                                      memory/3556-2958-0x00007FFD952D0000-0x00007FFD952F6000-memory.dmp
                                                      Download

                                                      memory/3556-2957-0x00007FFD952D0000-0x00007FFD952F6000-memory.dmp
                                                      Download

                                                      memory/3556-2956-0x00007FFD952D0000-0x00007FFD952F6000-memory.dmp
                                                      Download

                                                      memory/3556-2955-0x00007FFD952D0000-0x00007FFD952F6000-memory.dmp
                                                      Download

                                                      memory/3556-2954-0x00007FFD952A0000-0x00007FFD952B0000-memory.dmp
                                                      Download

                                                      memory/3556-2953-0x00007FFD952A0000-0x00007FFD952B0000-memory.dmp
                                                      Download

                                                      memory/3556-2952-0x00007FFD951A0000-0x00007FFD951B0000-memory.dmp
                                                      Download

                                                      memory/3556-2951-0x00007FFD951A0000-0x00007FFD951B0000-memory.dmp
                                                      Download

                                                      memory/3556-2950-0x00007FFD95640000-0x00007FFD9564B000-memory.dmp
                                                      Download

                                                      memory/3556-2932-0x00007FFD95050000-0x00007FFD95080000-memory.dmp
                                                      Download

                                                      memory/3556-2947-0x00007FFD95640000-0x00007FFD9564B000-memory.dmp
                                                      Download

                                                      memory/3556-2949-0x00007FFD95640000-0x00007FFD9564B000-memory.dmp
                                                      Download

                                                      memory/3556-2946-0x00007FFD95640000-0x00007FFD9564B000-memory.dmp
                                                      Download

                                                      memory/3556-2945-0x00007FFD95620000-0x00007FFD95630000-memory.dmp
                                                      Download

                                                      memory/3556-2944-0x00007FFD95620000-0x00007FFD95630000-memory.dmp
                                                      Download

                                                      memory/3556-2942-0x00007FFD958A0000-0x00007FFD958AE000-memory.dmp
                                                      Download

                                                      memory/3556-2941-0x00007FFD958A0000-0x00007FFD958AE000-memory.dmp
                                                      Download

                                                      memory/3556-2940-0x00007FFD958A0000-0x00007FFD958AE000-memory.dmp
                                                      Download

                                                      memory/3556-2939-0x00007FFD958A0000-0x00007FFD958AE000-memory.dmp
                                                      Download

                                                      memory/3556-2938-0x00007FFD957F0000-0x00007FFD95800000-memory.dmp
                                                      Download

                                                      memory/3556-2937-0x00007FFD957F0000-0x00007FFD95800000-memory.dmp
                                                      Download

                                                      memory/3556-2934-0x00007FFD95050000-0x00007FFD95080000-memory.dmp
                                                      Download

                                                      memory/3556-2933-0x00007FFD95050000-0x00007FFD95080000-memory.dmp
                                                      Download

                                                      memory/3692-1077-0x0000000007570000-0x000000000757E000-memory.dmp
                                                      Download

                                                      memory/3692-1078-0x0000000007580000-0x0000000007594000-memory.dmp
                                                      Download

                                                      memory/3692-1075-0x00000000075C0000-0x0000000007656000-memory.dmp
                                                      Download

                                                      memory/3692-1057-0x0000000006FD0000-0x0000000007002000-memory.dmp
                                                      Download

                                                      memory/3692-1068-0x00000000065D0000-0x00000000065EE000-memory.dmp
                                                      Download

                                                      memory/3692-1069-0x0000000007010000-0x00000000070B3000-memory.dmp
                                                      Download

                                                      memory/3692-1058-0x0000000074C40000-0x0000000074C8C000-memory.dmp
                                                      Download

                                                      memory/3692-443-0x00000000050D0000-0x00000000056F8000-memory.dmp
                                                      Download

                                                      memory/3692-1012-0x0000000006000000-0x000000000601E000-memory.dmp
                                                      Download

                                                      memory/3692-1076-0x0000000007530000-0x0000000007541000-memory.dmp
                                                      Download

                                                      memory/3692-1079-0x0000000007660000-0x000000000767A000-memory.dmp
                                                      Download

                                                      memory/3692-1080-0x00000000075B0000-0x00000000075B8000-memory.dmp
                                                      Download

                                                      memory/3692-741-0x0000000005700000-0x0000000005722000-memory.dmp
                                                      Download

                                                      memory/3692-1013-0x0000000006090000-0x00000000060DC000-memory.dmp
                                                      Download

                                                      memory/3692-849-0x0000000005910000-0x0000000005976000-memory.dmp
                                                      Download

                                                      memory/3692-1072-0x00000000073A0000-0x00000000073AA000-memory.dmp
                                                      Download

                                                      memory/3720-2376-0x00000289F4900000-0x00000289F4901000-memory.dmp
                                                      Download

                                                      memory/3720-2374-0x00000289F4900000-0x00000289F4901000-memory.dmp
                                                      Download

                                                      memory/3720-2378-0x00000289F4900000-0x00000289F4901000-memory.dmp
                                                      Download

                                                      memory/3720-2373-0x00000289F4900000-0x00000289F4901000-memory.dmp
                                                      Download

                                                      memory/3720-2379-0x00000289F4900000-0x00000289F4901000-memory.dmp
                                                      Download

                                                      memory/3720-2368-0x00000289F4900000-0x00000289F4901000-memory.dmp
                                                      Download

                                                      memory/3720-2367-0x00000289F4900000-0x00000289F4901000-memory.dmp
                                                      Download

                                                      memory/3720-2375-0x00000289F4900000-0x00000289F4901000-memory.dmp
                                                      Download

                                                      memory/3720-2377-0x00000289F4900000-0x00000289F4901000-memory.dmp
                                                      Download

                                                      memory/3720-2369-0x00000289F4900000-0x00000289F4901000-memory.dmp
                                                      Download

                                                      memory/5060-1135-0x00007FFD79003000-0x00007FFD79005000-memory.dmp
                                                      Download

                                                      memory/5060-29-0x00007FFD79003000-0x00007FFD79005000-memory.dmp
                                                      Download

                                                      memory/5060-33-0x0000000000360000-0x000000000037A000-memory.dmp
                                                      Download