Analysis
-
max time kernel
816s -
max time network
818s -
platform
windows11-21h2_x64 -
resource
win11-20250313-en -
resource tags
arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system -
submitted
28/03/2025, 19:54
Static task
static1
Behavioral task
behavioral1
Sample
MfW10_Fix_Repair_UWP_V2_Generic/Custom.dll
Resource
win11-20250313-en
Behavioral task
behavioral2
Sample
MfW10_Fix_Repair_UWP_V2_Generic/Launcher.exe
Resource
win11-20250313-en
Errors
General
-
Target
MfW10_Fix_Repair_UWP_V2_Generic/Custom.dll
-
Size
3.6MB
-
MD5
28c87bb3b0a5ca2c9808e83993c3da03
-
SHA1
babdb64f468b6893b7798a166d484f1926ec599a
-
SHA256
c53e2fe707e0a58286c0ca7e15988c7e07a5c6609744465d5099131d115d4a3d
-
SHA512
106dfbded22dae2f0d10655ae555e9e7fbe5f5aa28f38a01879ee898dba3e7f7ccd5658d8670f5b1f922e3cd2a2a90d6d9c557f95da239ceb7b4cfe65508999c
-
SSDEEP
98304:5tqYopU5sN4sxMFCh2+cGjeQTBTb6rJBy7ZA9p:5tqYopzeS1hF56rJBy7O
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\winnt32.exe" NoEscape.exe -
UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NoEscape.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" NoEscape.exe -
Downloads MZ/PE file 3 IoCs
flow pid Process 48 1156 firefox.exe 48 1156 firefox.exe 474 1156 firefox.exe -
Executes dropped EXE 19 IoCs
pid Process 624 RobloxPlayerInstaller-K4F9MJC8YP.exe 5116 RobloxPlayerBeta.exe 2812 RobloxPlayerBeta.exe 2308 RobloxPlayerBeta.exe 3068 RobloxPlayerInstaller-K4F9MJC8YP.exe 4876 RobloxPlayerBeta.exe 5680 RobloxPlayerBeta.exe 4460 RobloxPlayerBeta.exe 5900 RobloxPlayerBeta.exe 1160 RobloxPlayerBeta.exe 4636 RobloxPlayerBeta.exe 348 RobloxPlayerBeta.exe 3004 RobloxPlayerBeta.exe 5292 RobloxPlayerBeta.exe 792 RobloxPlayerBeta.exe 4760 RobloxPlayerBeta.exe 4636 RobloxPlayerInstaller-K4F9MJC8YP.exe 492 RobloxPlayerBeta.exe 5180 NoEscape.exe -
Loads dropped DLL 30 IoCs
pid Process 5116 RobloxPlayerBeta.exe 5116 RobloxPlayerBeta.exe 2812 RobloxPlayerBeta.exe 2812 RobloxPlayerBeta.exe 2308 RobloxPlayerBeta.exe 2308 RobloxPlayerBeta.exe 4876 RobloxPlayerBeta.exe 4876 RobloxPlayerBeta.exe 5680 RobloxPlayerBeta.exe 5680 RobloxPlayerBeta.exe 4460 RobloxPlayerBeta.exe 4460 RobloxPlayerBeta.exe 5900 RobloxPlayerBeta.exe 5900 RobloxPlayerBeta.exe 1160 RobloxPlayerBeta.exe 1160 RobloxPlayerBeta.exe 4636 RobloxPlayerBeta.exe 4636 RobloxPlayerBeta.exe 348 RobloxPlayerBeta.exe 348 RobloxPlayerBeta.exe 3004 RobloxPlayerBeta.exe 3004 RobloxPlayerBeta.exe 5292 RobloxPlayerBeta.exe 5292 RobloxPlayerBeta.exe 792 RobloxPlayerBeta.exe 792 RobloxPlayerBeta.exe 4760 RobloxPlayerBeta.exe 4760 RobloxPlayerBeta.exe 492 RobloxPlayerBeta.exe 492 RobloxPlayerBeta.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxPlayerInstaller-K4F9MJC8YP.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxPlayerInstaller-K4F9MJC8YP.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxPlayerInstaller-K4F9MJC8YP.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NoEscape.exe -
Drops desktop.ini file(s) 5 IoCs
description ioc Process File opened for modification C:\Users\Admin\Documents\desktop.ini firefox.exe File opened for modification C:\Users\Public\desktop.ini firefox.exe File opened for modification C:\Users\Public\Documents\desktop.ini firefox.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini NoEscape.exe File opened for modification C:\Users\Public\Desktop\desktop.ini NoEscape.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
flow ioc 458 raw.githubusercontent.com 466 raw.githubusercontent.com 467 raw.githubusercontent.com 474 raw.githubusercontent.com -
Modifies WinLogon 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DisableCAD = "1" NoEscape.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0" NoEscape.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoAdminLogon = "0" NoEscape.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\noescape.png" NoEscape.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 15 IoCs
pid Process 5116 RobloxPlayerBeta.exe 2812 RobloxPlayerBeta.exe 2308 RobloxPlayerBeta.exe 4876 RobloxPlayerBeta.exe 5680 RobloxPlayerBeta.exe 4460 RobloxPlayerBeta.exe 5900 RobloxPlayerBeta.exe 1160 RobloxPlayerBeta.exe 4636 RobloxPlayerBeta.exe 348 RobloxPlayerBeta.exe 3004 RobloxPlayerBeta.exe 5292 RobloxPlayerBeta.exe 792 RobloxPlayerBeta.exe 4760 RobloxPlayerBeta.exe 492 RobloxPlayerBeta.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 5116 RobloxPlayerBeta.exe 5116 RobloxPlayerBeta.exe 5116 RobloxPlayerBeta.exe 5116 RobloxPlayerBeta.exe 5116 RobloxPlayerBeta.exe 5116 RobloxPlayerBeta.exe 5116 RobloxPlayerBeta.exe 5116 RobloxPlayerBeta.exe 5116 RobloxPlayerBeta.exe 5116 RobloxPlayerBeta.exe 5116 RobloxPlayerBeta.exe 5116 RobloxPlayerBeta.exe 2812 RobloxPlayerBeta.exe 2812 RobloxPlayerBeta.exe 2812 RobloxPlayerBeta.exe 2812 RobloxPlayerBeta.exe 2812 RobloxPlayerBeta.exe 2812 RobloxPlayerBeta.exe 2812 RobloxPlayerBeta.exe 2812 RobloxPlayerBeta.exe 2812 RobloxPlayerBeta.exe 2812 RobloxPlayerBeta.exe 2812 RobloxPlayerBeta.exe 2812 RobloxPlayerBeta.exe 2308 RobloxPlayerBeta.exe 2308 RobloxPlayerBeta.exe 2308 RobloxPlayerBeta.exe 2308 RobloxPlayerBeta.exe 2308 RobloxPlayerBeta.exe 2308 RobloxPlayerBeta.exe 2308 RobloxPlayerBeta.exe 2308 RobloxPlayerBeta.exe 2308 RobloxPlayerBeta.exe 2308 RobloxPlayerBeta.exe 2308 RobloxPlayerBeta.exe 2308 RobloxPlayerBeta.exe 4876 RobloxPlayerBeta.exe 4876 RobloxPlayerBeta.exe 4876 RobloxPlayerBeta.exe 4876 RobloxPlayerBeta.exe 4876 RobloxPlayerBeta.exe 4876 RobloxPlayerBeta.exe 4876 RobloxPlayerBeta.exe 4876 RobloxPlayerBeta.exe 4876 RobloxPlayerBeta.exe 4876 RobloxPlayerBeta.exe 4876 RobloxPlayerBeta.exe 4876 RobloxPlayerBeta.exe 5680 RobloxPlayerBeta.exe 5680 RobloxPlayerBeta.exe 5680 RobloxPlayerBeta.exe 5680 RobloxPlayerBeta.exe 5680 RobloxPlayerBeta.exe 5680 RobloxPlayerBeta.exe 5680 RobloxPlayerBeta.exe 5680 RobloxPlayerBeta.exe 5680 RobloxPlayerBeta.exe 5680 RobloxPlayerBeta.exe 5680 RobloxPlayerBeta.exe 5680 RobloxPlayerBeta.exe 4460 RobloxPlayerBeta.exe 4460 RobloxPlayerBeta.exe 4460 RobloxPlayerBeta.exe 4460 RobloxPlayerBeta.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\StudioSharedUI\ScrollBarMiddle.png RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\StudioToolbox\ScrollBarBottom.png RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\Emotes\Small\SegmentedCircle.png RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\VoiceChat\SpeakerLight\[email protected] RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\ExtraContent\textures\ui\Controls\DesignSystem\DpadRight.png RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\avatar\meshes\leftleg.mesh RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\ExtraContent\places\UserSafetyTest.rbxl RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\ExtraContent\models\UniversalApp\UniversalApp.rbxm RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\FaceControlsEditor\checkbox_checked.png RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\TerrainTools\icon_terrain_big.png RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\VoiceChat\SpeakerNew\Error.png RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\InspectMenu\x.png RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\AvatarImporter\button_avatarType.png RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\DevConsole\Error.png RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\StudioToolbox\Voting\thumbs-up-dark-gray.png RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\TerrainEditor\arctic.png RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\btn_white.png RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\ButtonLeft.png RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\Controls\key_single.png RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\LegacyRbxGui\popup_warnTriangle.png RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\Controls\PlayStationController\[email protected] RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\CompositorDebugger\clear.png RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\MenuBar\icon_maximize.png RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\StudioToolbox\AssetConfig\[email protected] RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\icon_mutualfollowing-16.png RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\RobuxIcon.png RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\Controls\[email protected] RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\InspectMenu\ico_alert_tilt.png RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\VoiceChat\New\Unmuted0.png RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\StudioToolbox\AssetConfig\[email protected] RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\[email protected] RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\Controls\[email protected] RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\Controls\DesignSystem\[email protected] RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\VR\hamburger.png RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ViewSelector\face_arrow.png RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\VoiceChat\RedSpeakerDark\Unmuted20.png RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\StudioToolbox\AssetConfig\[email protected] RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\LegacyRbxGui\M1Side.png RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\Settings\MenuBarAssets\[email protected] RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\loading\loadingCircle.png RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\MaterialGenerator\Materials\Fabric.png RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\InspectMenu\[email protected] RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\Menu\[email protected] RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\VoiceChat\SpeakerLight\Unmuted100.png RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\ExtraContent\textures\ui\LuaApp\icons\[email protected] RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\TerrainTools\mtrl_rock.png RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\Emotes\Editor\Small\OrangeHighlight.png RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\VoiceChat\RedSpeakerDark\[email protected] RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\ExtraContent\textures\ui\LuaApp\graphic\profilemask_36.png RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\fonts\Guru-Regular.otf RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\LayeredClothingEditor\Add Icon.png RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\VoiceChat\[email protected] RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\LayeredClothingEditor\Icon_Pause.png RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\Controls\DesignSystem\[email protected] RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\fonts\families\FredokaOne.json RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\ExtraContent\textures\ui\InGameMenu\roblox_logo.png RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\RoactStudioWidgets\button_pressed.png RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\StudioSharedUI\pending-dark.png RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\Menu\HamburgerDown.png RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\PlayerList\[email protected] RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\Settings\Radial\TopLeft.png RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\api-ms-win-crt-stdio-l1-1-0.dll RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\fonts\Roboto-Bold.ttf RobloxPlayerInstaller-K4F9MJC8YP.exe File created C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\Debugger\Breakpoints\[email protected] RobloxPlayerInstaller-K4F9MJC8YP.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\winnt32.exe\:Zone.Identifier:$DATA NoEscape.exe File created C:\Windows\winnt32.exe NoEscape.exe File opened for modification C:\Windows\winnt32.exe NoEscape.exe -
Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 3 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File created C:\Users\Admin\Downloads\RobloxPlayerInstaller-K4F9MJC8YP.exe:Zone.Identifier firefox.exe File created C:\Users\Admin\Downloads\RobloxPlayerInstaller-CQ2VW4JH8C.exe:Zone.Identifier firefox.exe File created C:\Users\Admin\Downloads\NoEscape.exe:Zone.Identifier firefox.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RobloxPlayerInstaller-K4F9MJC8YP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RobloxPlayerInstaller-K4F9MJC8YP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RobloxPlayerInstaller-K4F9MJC8YP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NoEscape.exe -
Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Checks processor information in registry 2 TTPs 36 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS RobloxPlayerInstaller-K4F9MJC8YP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer RobloxPlayerInstaller-K4F9MJC8YP.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS RobloxPlayerInstaller-K4F9MJC8YP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer RobloxPlayerInstaller-K4F9MJC8YP.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS RobloxPlayerInstaller-K4F9MJC8YP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer RobloxPlayerInstaller-K4F9MJC8YP.exe -
Modifies Control Panel 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000\Control Panel\Desktop\AutoColorization = "1" NoEscape.exe Key created \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000\Control Panel\Mouse NoEscape.exe Set value (str) \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000\Control Panel\Mouse\SwapMouseButtons = "1" NoEscape.exe Key created \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000\Control Panel\Desktop NoEscape.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox RobloxPlayerInstaller-K4F9MJC8YP.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\PROTOCOLEXECUTE\ROBLOX RobloxPlayerInstaller-K4F9MJC8YP.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0" RobloxPlayerInstaller-K4F9MJC8YP.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\PROTOCOLEXECUTE\ROBLOX-PLAYER RobloxPlayerInstaller-K4F9MJC8YP.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player RobloxPlayerInstaller-K4F9MJC8YP.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0" RobloxPlayerInstaller-K4F9MJC8YP.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0" RobloxPlayerInstaller-K4F9MJC8YP.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0" RobloxPlayerInstaller-K4F9MJC8YP.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox RobloxPlayerInstaller-K4F9MJC8YP.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0" RobloxPlayerInstaller-K4F9MJC8YP.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\PROTOCOLEXECUTE\ROBLOX-PLAYER RobloxPlayerInstaller-K4F9MJC8YP.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio RobloxPlayerInstaller-K4F9MJC8YP.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player RobloxPlayerInstaller-K4F9MJC8YP.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0" RobloxPlayerInstaller-K4F9MJC8YP.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player RobloxPlayerInstaller-K4F9MJC8YP.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0" RobloxPlayerInstaller-K4F9MJC8YP.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\PROTOCOLEXECUTE\ROBLOX RobloxPlayerInstaller-K4F9MJC8YP.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox RobloxPlayerInstaller-K4F9MJC8YP.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "25" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-5a6b6797f4e04078" RobloxPlayerInstaller-K4F9MJC8YP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-5a6b6797f4e04078" RobloxPlayerInstaller-K4F9MJC8YP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell RobloxPlayerInstaller-K4F9MJC8YP.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\ROBLOX\DEFAULTICON RobloxPlayerInstaller-K4F9MJC8YP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol RobloxPlayerInstaller-K4F9MJC8YP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox RobloxPlayerInstaller-K4F9MJC8YP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol" RobloxPlayerInstaller-K4F9MJC8YP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command RobloxPlayerInstaller-K4F9MJC8YP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell RobloxPlayerInstaller-K4F9MJC8YP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open RobloxPlayerInstaller-K4F9MJC8YP.exe Set value (str) \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\DisplayName = "Chrome Sandbox" firefox.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command RobloxPlayerInstaller-K4F9MJC8YP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol RobloxPlayerInstaller-K4F9MJC8YP.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command RobloxPlayerInstaller-K4F9MJC8YP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command RobloxPlayerInstaller-K4F9MJC8YP.exe Set value (str) \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Moniker = "fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f" firefox.exe Key created \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Children firefox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio RobloxPlayerInstaller-K4F9MJC8YP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-5a6b6797f4e04078\\RobloxPlayerBeta.exe\" %1" RobloxPlayerInstaller-K4F9MJC8YP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-5a6b6797f4e04078" RobloxPlayerInstaller-K4F9MJC8YP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol" RobloxPlayerInstaller-K4F9MJC8YP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-5a6b6797f4e04078\\RobloxPlayerBeta.exe\" %1" RobloxPlayerInstaller-K4F9MJC8YP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command RobloxPlayerInstaller-K4F9MJC8YP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon RobloxPlayerInstaller-K4F9MJC8YP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open RobloxPlayerInstaller-K4F9MJC8YP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon RobloxPlayerInstaller-K4F9MJC8YP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command RobloxPlayerInstaller-K4F9MJC8YP.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell RobloxPlayerInstaller-K4F9MJC8YP.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open RobloxPlayerInstaller-K4F9MJC8YP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open RobloxPlayerInstaller-K4F9MJC8YP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell RobloxPlayerInstaller-K4F9MJC8YP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon RobloxPlayerInstaller-K4F9MJC8YP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-5a6b6797f4e04078\\RobloxPlayerBeta.exe" RobloxPlayerInstaller-K4F9MJC8YP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player RobloxPlayerInstaller-K4F9MJC8YP.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\roblox RobloxPlayerInstaller-K4F9MJC8YP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell RobloxPlayerInstaller-K4F9MJC8YP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open RobloxPlayerInstaller-K4F9MJC8YP.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open RobloxPlayerInstaller-K4F9MJC8YP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-5a6b6797f4e04078\\RobloxPlayerBeta.exe" RobloxPlayerInstaller-K4F9MJC8YP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command RobloxPlayerInstaller-K4F9MJC8YP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-5a6b6797f4e04078\\RobloxPlayerBeta.exe\" %1" RobloxPlayerInstaller-K4F9MJC8YP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol RobloxPlayerInstaller-K4F9MJC8YP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-5a6b6797f4e04078\\RobloxPlayerBeta.exe\" %1" RobloxPlayerInstaller-K4F9MJC8YP.exe Key created \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f\Children firefox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-361fa88592b64089" RobloxPlayerInstaller-K4F9MJC8YP.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\ROBLOX\SHELL\OPEN\COMMAND RobloxPlayerInstaller-K4F9MJC8YP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-5a6b6797f4e04078" RobloxPlayerInstaller-K4F9MJC8YP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-5a6b6797f4e04078\\RobloxPlayerBeta.exe" RobloxPlayerInstaller-K4F9MJC8YP.exe Key created \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000_Classes\Local Settings\MuiCache BackgroundTransferHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol" RobloxPlayerInstaller-K4F9MJC8YP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol RobloxPlayerInstaller-K4F9MJC8YP.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\ROBLOX-PLAYER\DEFAULTICON RobloxPlayerInstaller-K4F9MJC8YP.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\ROBLOX\SHELL\OPEN\COMMAND RobloxPlayerInstaller-K4F9MJC8YP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol" RobloxPlayerInstaller-K4F9MJC8YP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-5a6b6797f4e04078\\RobloxPlayerBeta.exe" RobloxPlayerInstaller-K4F9MJC8YP.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\roblox RobloxPlayerInstaller-K4F9MJC8YP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol RobloxPlayerInstaller-K4F9MJC8YP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon RobloxPlayerInstaller-K4F9MJC8YP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell RobloxPlayerInstaller-K4F9MJC8YP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open RobloxPlayerInstaller-K4F9MJC8YP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-5a6b6797f4e04078\\RobloxPlayerBeta.exe\" %1" RobloxPlayerInstaller-K4F9MJC8YP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-5a6b6797f4e04078\\RobloxPlayerBeta.exe\" %1" RobloxPlayerInstaller-K4F9MJC8YP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon RobloxPlayerInstaller-K4F9MJC8YP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open RobloxPlayerInstaller-K4F9MJC8YP.exe -
NTFS ADS 4 IoCs
description ioc Process File created C:\Windows\winnt32.exe\:Zone.Identifier:$DATA NoEscape.exe File created C:\Users\Admin\Downloads\RobloxPlayerInstaller-K4F9MJC8YP.exe:Zone.Identifier firefox.exe File created C:\Users\Admin\Downloads\RobloxPlayerInstaller-CQ2VW4JH8C.exe:Zone.Identifier firefox.exe File created C:\Users\Admin\Downloads\NoEscape.exe:Zone.Identifier firefox.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5116 RobloxPlayerBeta.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2812 RobloxPlayerBeta.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 2308 RobloxPlayerBeta.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 1156 firefox.exe Token: SeDebugPrivilege 1156 firefox.exe Token: SeDebugPrivilege 624 RobloxPlayerInstaller-K4F9MJC8YP.exe Token: SeDebugPrivilege 624 RobloxPlayerInstaller-K4F9MJC8YP.exe Token: SeDebugPrivilege 624 RobloxPlayerInstaller-K4F9MJC8YP.exe Token: SeDebugPrivilege 624 RobloxPlayerInstaller-K4F9MJC8YP.exe Token: SeDebugPrivilege 624 RobloxPlayerInstaller-K4F9MJC8YP.exe Token: SeDebugPrivilege 624 RobloxPlayerInstaller-K4F9MJC8YP.exe Token: SeDebugPrivilege 624 RobloxPlayerInstaller-K4F9MJC8YP.exe Token: SeDebugPrivilege 624 RobloxPlayerInstaller-K4F9MJC8YP.exe Token: SeDebugPrivilege 624 RobloxPlayerInstaller-K4F9MJC8YP.exe Token: SeDebugPrivilege 624 RobloxPlayerInstaller-K4F9MJC8YP.exe Token: SeDebugPrivilege 2572 taskmgr.exe Token: SeSystemProfilePrivilege 2572 taskmgr.exe Token: SeCreateGlobalPrivilege 2572 taskmgr.exe Token: SeDebugPrivilege 1156 firefox.exe Token: SeDebugPrivilege 1156 firefox.exe Token: SeDebugPrivilege 1156 firefox.exe Token: 33 2572 taskmgr.exe Token: SeIncBasePriorityPrivilege 2572 taskmgr.exe Token: SeDebugPrivilege 3780 taskmgr.exe Token: SeSystemProfilePrivilege 3780 taskmgr.exe Token: SeCreateGlobalPrivilege 3780 taskmgr.exe Token: 33 3780 taskmgr.exe Token: SeIncBasePriorityPrivilege 3780 taskmgr.exe Token: SeDebugPrivilege 3068 RobloxPlayerInstaller-K4F9MJC8YP.exe Token: SeDebugPrivilege 3068 RobloxPlayerInstaller-K4F9MJC8YP.exe Token: SeDebugPrivilege 3068 RobloxPlayerInstaller-K4F9MJC8YP.exe Token: SeDebugPrivilege 3068 RobloxPlayerInstaller-K4F9MJC8YP.exe Token: SeDebugPrivilege 3068 RobloxPlayerInstaller-K4F9MJC8YP.exe Token: SeDebugPrivilege 1156 firefox.exe Token: SeDebugPrivilege 4968 taskmgr.exe Token: SeSystemProfilePrivilege 4968 taskmgr.exe Token: SeCreateGlobalPrivilege 4968 taskmgr.exe Token: 33 4968 taskmgr.exe Token: SeIncBasePriorityPrivilege 4968 taskmgr.exe Token: SeDebugPrivilege 4636 RobloxPlayerInstaller-K4F9MJC8YP.exe Token: SeDebugPrivilege 4636 RobloxPlayerInstaller-K4F9MJC8YP.exe Token: SeDebugPrivilege 4636 RobloxPlayerInstaller-K4F9MJC8YP.exe Token: SeDebugPrivilege 4636 RobloxPlayerInstaller-K4F9MJC8YP.exe Token: SeDebugPrivilege 4636 RobloxPlayerInstaller-K4F9MJC8YP.exe Token: SeDebugPrivilege 1156 firefox.exe Token: SeDebugPrivilege 1156 firefox.exe Token: SeDebugPrivilege 1100 powershell.exe Token: SeDebugPrivilege 1156 firefox.exe Token: SeDebugPrivilege 1156 firefox.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 2572 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe 3780 taskmgr.exe -
Suspicious use of SetWindowsHookEx 52 IoCs
pid Process 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1904 MiniSearchHost.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 3052 WindowsTerminal.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 1156 firefox.exe 332 LogonUI.exe -
Suspicious use of UnmapMainImage 15 IoCs
pid Process 5116 RobloxPlayerBeta.exe 2812 RobloxPlayerBeta.exe 2308 RobloxPlayerBeta.exe 4876 RobloxPlayerBeta.exe 5680 RobloxPlayerBeta.exe 4460 RobloxPlayerBeta.exe 5900 RobloxPlayerBeta.exe 1160 RobloxPlayerBeta.exe 4636 RobloxPlayerBeta.exe 348 RobloxPlayerBeta.exe 3004 RobloxPlayerBeta.exe 5292 RobloxPlayerBeta.exe 792 RobloxPlayerBeta.exe 4760 RobloxPlayerBeta.exe 492 RobloxPlayerBeta.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2128 wrote to memory of 1156 2128 firefox.exe 87 PID 2128 wrote to memory of 1156 2128 firefox.exe 87 PID 2128 wrote to memory of 1156 2128 firefox.exe 87 PID 2128 wrote to memory of 1156 2128 firefox.exe 87 PID 2128 wrote to memory of 1156 2128 firefox.exe 87 PID 2128 wrote to memory of 1156 2128 firefox.exe 87 PID 2128 wrote to memory of 1156 2128 firefox.exe 87 PID 2128 wrote to memory of 1156 2128 firefox.exe 87 PID 2128 wrote to memory of 1156 2128 firefox.exe 87 PID 2128 wrote to memory of 1156 2128 firefox.exe 87 PID 2128 wrote to memory of 1156 2128 firefox.exe 87 PID 1156 wrote to memory of 5188 1156 firefox.exe 88 PID 1156 wrote to memory of 5188 1156 firefox.exe 88 PID 1156 wrote to memory of 5188 1156 firefox.exe 88 PID 1156 wrote to memory of 5188 1156 firefox.exe 88 PID 1156 wrote to memory of 5188 1156 firefox.exe 88 PID 1156 wrote to memory of 5188 1156 firefox.exe 88 PID 1156 wrote to memory of 5188 1156 firefox.exe 88 PID 1156 wrote to memory of 5188 1156 firefox.exe 88 PID 1156 wrote to memory of 5188 1156 firefox.exe 88 PID 1156 wrote to memory of 5188 1156 firefox.exe 88 PID 1156 wrote to memory of 5188 1156 firefox.exe 88 PID 1156 wrote to memory of 5188 1156 firefox.exe 88 PID 1156 wrote to memory of 5188 1156 firefox.exe 88 PID 1156 wrote to memory of 5188 1156 firefox.exe 88 PID 1156 wrote to memory of 5188 1156 firefox.exe 88 PID 1156 wrote to memory of 5188 1156 firefox.exe 88 PID 1156 wrote to memory of 5188 1156 firefox.exe 88 PID 1156 wrote to memory of 5188 1156 firefox.exe 88 PID 1156 wrote to memory of 5188 1156 firefox.exe 88 PID 1156 wrote to memory of 5188 1156 firefox.exe 88 PID 1156 wrote to memory of 5188 1156 firefox.exe 88 PID 1156 wrote to memory of 5188 1156 firefox.exe 88 PID 1156 wrote to memory of 5188 1156 firefox.exe 88 PID 1156 wrote to memory of 5188 1156 firefox.exe 88 PID 1156 wrote to memory of 5188 1156 firefox.exe 88 PID 1156 wrote to memory of 5188 1156 firefox.exe 88 PID 1156 wrote to memory of 5188 1156 firefox.exe 88 PID 1156 wrote to memory of 5188 1156 firefox.exe 88 PID 1156 wrote to memory of 5188 1156 firefox.exe 88 PID 1156 wrote to memory of 5188 1156 firefox.exe 88 PID 1156 wrote to memory of 5188 1156 firefox.exe 88 PID 1156 wrote to memory of 5188 1156 firefox.exe 88 PID 1156 wrote to memory of 5188 1156 firefox.exe 88 PID 1156 wrote to memory of 5188 1156 firefox.exe 88 PID 1156 wrote to memory of 5188 1156 firefox.exe 88 PID 1156 wrote to memory of 5188 1156 firefox.exe 88 PID 1156 wrote to memory of 5188 1156 firefox.exe 88 PID 1156 wrote to memory of 5188 1156 firefox.exe 88 PID 1156 wrote to memory of 5188 1156 firefox.exe 88 PID 1156 wrote to memory of 5188 1156 firefox.exe 88 PID 1156 wrote to memory of 5188 1156 firefox.exe 88 PID 1156 wrote to memory of 5188 1156 firefox.exe 88 PID 1156 wrote to memory of 5188 1156 firefox.exe 88 PID 1156 wrote to memory of 5188 1156 firefox.exe 88 PID 1156 wrote to memory of 5188 1156 firefox.exe 88 PID 1156 wrote to memory of 2520 1156 firefox.exe 89 PID 1156 wrote to memory of 2520 1156 firefox.exe 89 PID 1156 wrote to memory of 2520 1156 firefox.exe 89 PID 1156 wrote to memory of 2520 1156 firefox.exe 89 PID 1156 wrote to memory of 2520 1156 firefox.exe 89 PID 1156 wrote to memory of 2520 1156 firefox.exe 89 PID 1156 wrote to memory of 2520 1156 firefox.exe 89 PID 1156 wrote to memory of 2520 1156 firefox.exe 89 -
System policy modification 1 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0" NoEscape.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer NoEscape.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\UseDefaultTile = "1" NoEscape.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NoEscape.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System NoEscape.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MfW10_Fix_Repair_UWP_V2_Generic\Custom.dll,#11⤵PID:3076
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.131⤵
- Modifies registry class
PID:444
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Downloads MZ/PE file
- Drops desktop.ini file(s)
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1972 -prefsLen 27097 -prefMapHandle 1976 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {2bdc878e-4f54-4cbd-a349-f20b0609aefb} -parentPid 1156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1156" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵PID:5188
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27133 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {ce2cbf65-6437-4517-9c99-66fb662892b7} -parentPid 1156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1156" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵PID:2520
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3812 -prefsLen 27323 -prefMapHandle 3816 -prefMapSize 270279 -jsInitHandle 3820 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3828 -initialChannelId {b9c9a612-87c7-4b9d-9310-880dee226d31} -parentPid 1156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1156" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
PID:3672
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3976 -prefsLen 27323 -prefMapHandle 3980 -prefMapSize 270279 -ipcHandle 4080 -initialChannelId {c672c9b9-2b7a-4e0a-8e61-cc074df16610} -parentPid 1156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1156" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵PID:4376
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3188 -prefsLen 34822 -prefMapHandle 3192 -prefMapSize 270279 -jsInitHandle 3096 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1576 -initialChannelId {f9fdb52a-9584-4241-b420-bb5d35b03b78} -parentPid 1156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1156" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
PID:2112
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4984 -prefsLen 34822 -prefMapHandle 4988 -prefMapSize 270279 -ipcHandle 4956 -initialChannelId {a49f2b75-f353-4d2f-a2d7-3f22e0d1f610} -parentPid 1156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1156" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
PID:2220
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5728 -prefsLen 33031 -prefMapHandle 4624 -prefMapSize 270279 -jsInitHandle 5600 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1676 -initialChannelId {c8ad4250-d134-4ebd-aeac-086b8a12fd25} -parentPid 1156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1156" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
PID:4132
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5984 -prefsLen 33031 -prefMapHandle 5988 -prefMapSize 270279 -jsInitHandle 5992 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6000 -initialChannelId {d2d00d6e-86ec-4384-b14a-77a054a9535e} -parentPid 1156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1156" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
PID:3524
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6188 -prefsLen 33031 -prefMapHandle 6192 -prefMapSize 270279 -jsInitHandle 6196 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6204 -initialChannelId {227a4245-bba5-4446-9474-2abc3631dcd9} -parentPid 1156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1156" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
PID:5704
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4424 -prefsLen 33071 -prefMapHandle 5720 -prefMapSize 270279 -jsInitHandle 5992 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6448 -initialChannelId {6582f6ac-dfa4-4dee-afb4-dd1c44c1144f} -parentPid 1156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1156" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab3⤵
- Checks processor information in registry
PID:3788
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6512 -prefsLen 33071 -prefMapHandle 6852 -prefMapSize 270279 -jsInitHandle 6844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6856 -initialChannelId {3e50cb60-2eb8-452a-9091-3bb07189b57e} -parentPid 1156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1156" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab3⤵
- Checks processor information in registry
PID:3812
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 7148 -prefsLen 36837 -prefMapHandle 7152 -prefMapSize 270279 -ipcHandle 7160 -initialChannelId {6d893558-e0e4-4c3c-a3d1-797fdbd08a77} -parentPid 1156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1156" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 utility3⤵
- Checks processor information in registry
PID:4932
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 5988 -prefsLen 36837 -prefMapHandle 6640 -prefMapSize 270279 -ipcHandle 6728 -initialChannelId {b9cab75a-8c16-451d-b4f9-77a02f89a47c} -parentPid 1156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1156" -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 utility3⤵
- Checks processor information in registry
PID:4836
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7588 -prefsLen 36593 -prefMapHandle 4884 -prefMapSize 270279 -jsInitHandle 6100 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7544 -initialChannelId {79996b39-00cf-4f53-b8a7-8914c1913e92} -parentPid 1156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1156" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab3⤵
- Checks processor information in registry
PID:5544
-
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller-K4F9MJC8YP.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller-K4F9MJC8YP.exe"3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:624 -
C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\RobloxPlayerBeta.exe" -personalizedToken K4F9MJC8YP --deeplink https://www.roblox.com/games/10449761463/The-Strongest-Battlegrounds -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 6244⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:5116
-
-
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller-K4F9MJC8YP.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller-K4F9MJC8YP.exe"3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3068 -
C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 30684⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of UnmapMainImage
PID:4876
-
-
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller-K4F9MJC8YP.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller-K4F9MJC8YP.exe"3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4636 -
C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 46364⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of UnmapMainImage
PID:492
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7460 -prefsLen 37170 -prefMapHandle 5880 -prefMapSize 270279 -jsInitHandle 6152 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6848 -initialChannelId {f55299ec-098d-4010-99c6-3ecd47c192bc} -parentPid 1156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1156" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab3⤵
- Checks processor information in registry
PID:1692
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5600 -prefsLen 37170 -prefMapHandle 6400 -prefMapSize 270279 -jsInitHandle 6392 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7592 -initialChannelId {cd3a5cc2-f500-40e1-8c8c-aa02e48de7f1} -parentPid 1156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1156" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab3⤵
- Checks processor information in registry
PID:3588
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3644 -prefsLen 37170 -prefMapHandle 6464 -prefMapSize 270279 -jsInitHandle 6460 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7592 -initialChannelId {4fc7e8c7-d476-471f-896e-1834a2674bc9} -parentPid 1156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1156" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab3⤵
- Checks processor information in registry
PID:2196
-
-
C:\Users\Admin\Downloads\NoEscape.exe"C:\Users\Admin\Downloads\NoEscape.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Modifies WinLogon
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- NTFS ADS
- System policy modification
PID:5180
-
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:1904
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2572
-
C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:jubupZLGYUTPeB8TxeLHcDnK-g3FzC0y0YxjKfkxgBLFAE1-JZfUTMCq4X8o1fkkPDnJrpS7cJmXDxvTvCyuJ71NCFFxT25W5zFs42sHB0kzR3n1T0y54vymrnea2E1qTs0EqV2IBSSGMvKjdYkfrU4h_JGXKhTYozVSTbLaA7eYswyWfu-a96Bf_qVOfd0UOQP5Vvy97eBMASsQOXZ87Y_wiRQ5iPBollrk6URaqCY+launchtime:1743191870554+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1743191738109003%26placeId%3D10449761463%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3D4ac3068d-c5c7-4294-96b7-2c641e778dcb%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1743191738109003+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:2812
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:3780
-
C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:iy0lFSIgFKELW7o5uCVlMmrlGOIP46GX7xif8YLOocTYmyoJPK-01bghU8oS-Av10MWMWoj36RqDoJBnT_5p6IvmdVBNgUo7_yRK0Zd3-PEpTW2ds6-s4w5yy9ABhcJtH1Zq8Chr9xm8U4rjamV8zdfJbAeGlJ0iAscF8fPM671UNpQYzS5K2ljSxc84YNBhRlKCtEPmMxfCdjQ7l6g8rsE-ZMLCuYaV2jpp7gz5s6Q+launchtime:1743191892588+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1743191738109003%26placeId%3D10449761463%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3D54070923-4e67-4c05-aec0-0e7dab489e56%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1743191738109003+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:2308
-
C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of UnmapMainImage
PID:5680
-
C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of UnmapMainImage
PID:4460
-
C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of UnmapMainImage
PID:5900
-
C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of UnmapMainImage
PID:1160
-
C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of UnmapMainImage
PID:4636
-
C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of UnmapMainImage
PID:348
-
C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:YwuF01GL9aayTzwgRrqG1T9M-TdwDCBug7Pu9BDedGRwTnn_dMD5rAxKruenj2BAjShDf5jO8XdcCbXy8pzOBme-gjtotTaLsXPgqZ7ERYE4iUqQK6QFAuFbSgqZGSCoTkUMrSLqqz31XnaWqls2GsJGOedKDbs3TmeNrOLKw3OC8rp77X3qGeVJEnLnB7Axtk3deGJ4T2Vl29gVbG3kON7hIjsvjnHyunbhuOKJBsI+launchtime:1743191892588+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1743191738109003%26placeId%3D10449761463%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3D54070923-4e67-4c05-aec0-0e7dab489e56%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1743191738109003+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of UnmapMainImage
PID:3004
-
C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:U5zu1wodVEIwJSjTllQRpQpTK5z6seX7C0ro8oh8AggWkO-jZ4qEl2IPKbD-7YMuOIEWg34MYI52NwhQOJgewnupk9lEkjksXcGVbFIhknLxfS_Q66Jk3KedXLZkCOw0LAJqa8UVuZQB3lqqHxGQUaOZ1chHaiYcKaE8HOqaVMimmoPZr6hj-1JnbQtilDDEadhBi6VqTmIV4EEDTynPdUTWnLETdpeVvbzXmVjqwd8+launchtime:1743192006013+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1743191738109003%26placeId%3D10449761463%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3D403e523b-832d-46bc-966d-f505d351a7f2%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1743191738109003+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of UnmapMainImage
PID:5292
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:3392
-
C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:x7Tk6mNX8ay-Z0MxvDu02PlyF3vHyK19rlhf5g63gj6hDPay8aBlgnQoDMXzhGZuwEhtMvGDDAzMJM1mxkXOqIpiADoXK1X7QDkhE35_fmWPp8MFoG__PXPJGSQFkAvPawCwl7GrBiqsskOme7q6f5jnX9YMsp8XloUmh37J6h5Una4RS8_mW8Mf3bWVUPCXn_kSkPzPFJyVGSkPemU43VBlQnNlfP7lGwhrFsFDAGw+launchtime:1743192035390+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1743191738109003%26placeId%3D10449761463%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3D2fbd22e5-4c68-46f6-9ddb-5acc40f51902%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1743191738109003+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of UnmapMainImage
PID:792
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4968
-
C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:IhW5CYqOfAMAB-c1pSRq3WO5S5eSJQoODo9rsmmoh7bo__ADA5eq3Nw7kvQdRu_QnHAn4JZRVp5bOH7q5zML4drtAK-P4U6fLjrmDAIH8gWW6pRPSyB4cJDoM_0uHQWhupDPHkgQ1WpPuv1lE5z0gvjbzql8iMA_qTbFT-oo9ywOKXVO4cGzdQTM7dE27MJGMen7wpkVHwKIvGnKeVOUO8-A3v_ybrr4pDjvfay3gAo+launchtime:1743192067609+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1743191738109003%26placeId%3D10449761463%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3D6864b160-3e98-4fb2-99e4-8f3e3fdc360a%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1743191738109003+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of UnmapMainImage
PID:4760
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4452
-
C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\wt.exe"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\wt.exe"1⤵PID:5500
-
C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\WindowsTerminal.exewt.exe2⤵
- Suspicious use of SetWindowsHookEx
PID:3052 -
C:\Windows\system32\wsl.exeC:\Windows\system32\wsl.exe --list3⤵PID:2176
-
-
C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe" --headless --win32input --resizeQuirk --width 120 --height 27 --signal 0xa10 --server 0xa083⤵PID:1832
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1100
-
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3949055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:332
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Winlogon Helper DLL
2Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
6Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.7MB
MD5a679a17f732d6c4e4799f4c2a5c00b4d
SHA179778557030a4ce1f0a31f1d93878c931bc932fa
SHA2566472c6e314e51269d9455fbeddb982a6af07269420c23fbb09d2fbdbff49dcc5
SHA512ee1843c3c4be3c1b82629d45432748b2e84c3025a19cf65fb9f80b6ac214a2d1411152a4ae196d5b02fe535bf6aecf2ee2a898f475394cc23815a30d81e679db
-
Filesize
144B
MD5431a6eb20932ec1c56682a1f60d231d3
SHA140bb32db040cabade103c21ba5b6f811dfb0773e
SHA256d5de39863fe721668ce1e115e0fc55a7c733747daff6235d27dad3d160c84dbb
SHA5120969b9484bb7c661d4e0452ff1c77396796333904b39f24c56d5a92ac4ed4ebde9b8981a985c6950b4af2852e8d9599e071a51ce4f9ef21ead778a2fdc76fcec
-
Filesize
14.9MB
MD5708a873f0b36b02b8e92f738d414b918
SHA14ca5646a00859ca875b93ab0b111265684a74c74
SHA256485c0ed2fbbf74c7b18d95e4800da48f2bc90a030551ca21cb2060bf092e1679
SHA51201af8f6e0cc2586382acaab92c094bbf9b6d735c0a1a9f2bed678e700026209331bc77d3541f6db462e5daf8846dc2f5779361dd7082ed17845386d177cb6a3d
-
Filesize
154KB
MD5577f05cd683ed0577f6c970ea57129e0
SHA1aedf54a8976f0f8ff5588447c344595e3c468925
SHA2567127f20daa0a0a74e120ab7423dd1b30c45908f8ee929f0c6cd2312b41c5bddf
SHA5122d1aea243938a6a1289cf4efcd541f28ab370a85ef05ed27b7b6d81ce43cea671e06a0959994807923b1dfec3b382ee95bd6f9489b74bba59239601756082047
-
Filesize
1KB
MD51f7e786e69ee21ec6f2a93aa8e9d15f7
SHA165782be637c2962bc6b19a3576c29e630c833419
SHA256541902aa59307182fd20f5814cd0b43425cd5599c66a7210233d7a2b2a512e5f
SHA512d820fee5d7d20b89ddc9d656f8790645ade536cf987af55527f5e50d33418077fd5928ce562fd680780a2a13893821a9e6cde52d758f991b258f5aa234b88323
-
Filesize
64KB
MD59e466b4837d8431be725d6b9c1b4d9ef
SHA13f247b7c89985a41d839cad351cd0fc182fcb284
SHA2562f9a5eeb5ac8cec52a3e73621e4d392f501f5d657dfec3215ccd40eec317208d
SHA51201de0fda555d63b5c38339b0f6d38c28de2a882643439679e63cf5d75f13516b57dc90e8dfb8c638bda328fc12342e58d1e501acec8f85b92dbd5589dac06418
-
Filesize
4B
MD5f49655f856acb8884cc0ace29216f511
SHA1cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA2567852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
SHA512599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
-
Filesize
960B
MD516846df493521e84fe47cd6b6451ec8f
SHA16d99eb017c5aec08d3a7e908bbd4a051ce250c02
SHA25669f19f2ab2f3625faca623477864766ab1ef3a21712bc892d7b2b0886585b3f9
SHA512aefa5121601b8273cff6b79b7f76417c71e29e835b66faf3e1a67d0d38fb9ebe90320b75493fd5c4a2d9ea3e3c485d0a84bcdbfb78c26a8ecee3175cd8bd93cd
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\activity-stream.contile.json
Filesize4KB
MD5268bb095e9d986dd33da17c9477e0a5d
SHA1010e9bfe61d4fcc1b393f77ca0ded00ce59e930b
SHA2564355fd0dbf5a421919be9a9c277c4d8ab068714c01a063ce45baa3857d3a0ed3
SHA512faa6f542c1b613fdfa7648a207cf167662022e5c43dbdcf13a50e8eaaef8159c0786fd476371abf663380831f4001615b56041c0fcb2b987b83932f0a6c93a61
-
Filesize
55KB
MD55248ab43aea93f6dfdd57101a670561c
SHA168b2cbd5be3358e6db8747670738015e2509d622
SHA256764485b5bb6e22f435af16ecb56716b02d95b42fcf0114cf9ec02bb439531c5f
SHA5124bd621abf8292f1af1992999642a55600b96c9e1ba1c1068a7440108435764d8556b0c97fe91d2e9ce80bf90ff7599379e6c75d7d983e067b6b56e603acb5c9c
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\050DB43D78BBC79DCD9ADCBAE96500FE04597F1B
Filesize1.1MB
MD53905ecb3625f626d66db72c355be8ce9
SHA1fd14b829dd559f117ad08be93e1f03920ff60e2f
SHA256e1c93da901f36508b9a1697f0c42c61608fdcaf0d6ae84fb4b8604a1a62fff5d
SHA512cb7be2f22622eb461f0f9c98e913d92442945c2dd427204c7d0bc69e1d70877d71b54aee90f8c434ad1326194347ab273724586dc2ed6e25805ac69589844707
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\05EB7F6F7BD0BA633716511CCCAD442933622565
Filesize13KB
MD534bd07c32486b51e8f6e85468122a734
SHA13d4f62b125439bebd81b8dcc518a70dce349eb28
SHA2566c42626ee8f4fe2d7ee8873f9c0fa3d09286a2ac39c1eaeb2013a97732f01b3a
SHA51244f56f57628122155f9e3dc42dd4c30d6e7db19827d4e2f43e4469b3eccc32acf43b0e8cd85c6dcb04de052d6c0ad32a10c12631e979b871ce1faedf7ad14d26
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\08DFE0AA10A31F3830C9ED91DE55CE85B1B4F534
Filesize75KB
MD578b362dc04e075f9ece75fcf318f934e
SHA193236e47188598308f22ecc9131a679f6526724f
SHA25637849873ad9d20f79d231414eee14428dfa356ddbfb2dc1d35f442378c848f8d
SHA51252b49568b06420fb5022275d70d73c82178dd99821a9133b35d1d2b3efc1d3e0e6b87811617e641aaf7d5fde0410700318d1118f87bb848108af0c333506a82e
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\2AFDA0A488AB63F5EAC4291403307B10855E0D5D
Filesize6.3MB
MD5e7a176517735dd759d795a22af2d97e3
SHA1bf9163b9c9958e698ec06b3c3abf056faec0a79e
SHA256b2ae320e9be498f003b6fe09e332e1d641d1a77ad33b67aedcf1f34c168523c6
SHA512493c028cef7587fa3f1782f44563200923aa27ca3b3b08a580580378c9465c57ad435a681bce01f58680da841572ba1b8407d6776da91c68413ca3667149a6a4
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\2ED1E9573352FC50E5D38D033F1E7596E952DF67
Filesize16KB
MD53413ffee69fa7ab62726707758b5167c
SHA15dfb57f95935c5185abcbfc41481cec0af8b6ce7
SHA256095864381678c6cf5fbc2b12c6761c7d3ae7e07ef5f143415fecd450e68862ae
SHA512a15240378a85fefc616e363cb2611ef909bf378290beb282f0229cd1733a85e35655bb673db1b4bedba347144b94fee7b849825c8cac872dc622e6bfd62ee580
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\36BCFA23A4D04A528CE70EF12214E3995E132134
Filesize414KB
MD5786c1424e576c40c52affd90ccc9a129
SHA195e162195825690b996c6de2e15bbf82dfaae1ad
SHA256d8c641dbd7d48f27442b0f40139010ab835f84fd3392acb724e6ae163024decb
SHA51202f539ab427f65ac2db7ea06e3f739d2acbf3b159d932bb1e20d3ddc3ada9477ae06233a039df781e00f6c630b765efa9d9416a92ff1afe0e01bdf4703370ede
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\3880E07D7216EA6B15D621AA35EA5FA1D0B4B5A0
Filesize17KB
MD5e2d99f4821340687734857374da9a946
SHA1637dcc0a53b3082c668f962726efb8e1399ae4fb
SHA256a3600a20d4570e5e29bdbb1a39e12e8110a3accd59043667fdf6392126d39583
SHA512c9d1f4cee26a6d2ced71915cb93cf3b4fe777f879cc176786c72a8f94c9f9c205b3257622129ea69e492fd0db10f4714fb3a5d65472d7deb5c8f27d311dc1ef5
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\3955CD93FFC8BA5F29E3D5DA6400592EB90053B7
Filesize1.3MB
MD540c137cebf21a43c8af10d87273622fa
SHA1367e88d97265929170a28ef3103ed0e904bc6626
SHA25650be3a21e5f037647f757c01b4e5a1ec9ab356e401647d677d54ec36b7187949
SHA5120e1b55e0b420bb04cee596b8edb08aab4d19a3745e74d54547c032e7a67faa92f7c5464f42ff7db822086d8a6bf4b85f2f7ea4a97dd7a51682a90fee4ae585fd
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\3CD97724EBF47B50AE59221DC942CCA5EE96ED82
Filesize298KB
MD5a0b7369a06b9336f25ecce40dd639ccb
SHA15daaeb389e411fe569574f05323f3bfd8d0ade83
SHA2565ec13ba657948d088976e775957bcbda673de4c939a51dfd7271534032799884
SHA512bc55b322cb708d07507c85c041f0bb3b06bab1ced7e7204993e969a027a2324a4707e8dfcedd9faf8cd350c89d0699f3684735020ff2730a1b64d9c40aaa2206
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\3D0EC64A2E4A2C8683C385B2A114CD538E37BC38
Filesize743KB
MD503d6193606570f91065df2ad2b0b960f
SHA1eb7aaae55deec4c7fca68ad2cfcc1888b035d13b
SHA256fde36a6ab6b11721c7db0a87b162ca0f764f439948bce251a159a7f58501c918
SHA5125a7c67c6dc191b866c1f2f667f7fbd17cee09e56082d390c4c4d437ec4c23934710c81124d190c32c8a70bb278862563d863aafe6dc32a22607b30a62467d3c0
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\4C11E373FD9A73A5E61FCB5291518B290C3C15DF
Filesize640KB
MD5cd9c1d96dbf6c90ce1f1b012d94c2007
SHA12237398e9e30cad616d45548aea65c042196820d
SHA256a493f79cc9a920f1b35fd7ed248ba53e771ff8a7615c898bec1548641325c754
SHA512116b54f27e5bc2a5133f33b686cf222b5e38543fd213967d4acaac780d3a3fca191340bb94e85dd5c25b2b9b8a198e2615bb75954181510cff6630bf18f8efe1
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\55E5E6FB4DA0D621CA2B27FEAF7A867987DF935E
Filesize66KB
MD56039e310b54577a0d03ff3370ebd0991
SHA1d4cfc2b9c6f37a5c29f8d14f843251e7f88bab26
SHA2560b8229887d4c36b33a91bfe61fa7be21e96c0aba2a6097aa6fbf42e07a68c634
SHA5120402e22781ea02b892151d9136db0c58cfd1bf1b5b4db340bd5feaa3fcefac542d0c17c575742a647f067628747da9ea47b614f1bc90d2b1f31e3e0a08772b8a
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\5941DE137A3FE0FD226667B293BC804DB802BE9A
Filesize1.9MB
MD55ba356638616cb45a03533e33ea5c9ce
SHA14d1e60ff6cc3acd206ecb1503937d9544239eee3
SHA256a618fe5e02f5166c2b6af74b286d4169aed605119482325d0e471066dc826c8e
SHA512dd2a3412f3bc5e996b89fe4721ff841ac1edcef13ce348e13633479ba3e82ff4ef9df4fe324bb05452aff866c613a6dd69548cca32eda0e91db0c6671a2cd39f
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\65C3C1772B37E021563C6C5032EDDD50FE82D7B9
Filesize16KB
MD5848d0640aa511c6227cd820483311787
SHA156e3538ddc9a95a10b87f87cff989c2f70f52fda
SHA2564d4f54bf32f32ca7bdcfa06ea8d76d59efb7f647dc0361f5036bbb982772f7fc
SHA5122caf7b07387f6ee29118733fe96642dc5b70acb1a292fd1f0d31e9c8c56460c596d837a530be5fb0f1e9caea5a6850ab1382ee48ed4ef1d970e5bb92217cdb23
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\6BA1CF60392DDF58A49D99DD935230386F12F3C3
Filesize114KB
MD5f0af3c139b40a32910dc65c4614a2f5d
SHA114d85d7535d235b056ec694487e30156fa45a1ea
SHA256c0f4cfb1c18a29f005f52bded9d19ced995523a56ce12fe27ff74e1d57a85046
SHA51276e51af206d68bb47a04e94a853edd8d66fa44da7c0b251b9cac6864a63c6eccadd168d8d23ee64ced0c75219b164aaa41aca4173d708c40671c314ffba0c793
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\6D6AFDC94ABACF8F7A0F957550662FF266FE754B
Filesize412KB
MD53977a164bf263fc4b37de1f92fefc750
SHA17601879c08d6c3557f8cdec94b365b008d996093
SHA256aec3dd5e9a464238cf3439f9430b52f7193e9748dda58273d4b827bb4f81cb14
SHA5120be370f223e0f02dfe0e8ea712e9c6993473c3407c0500af02cb6ec67b3baed40955bce1ac359e955a69ca14ce87d1c401afce5dca47d1ca5d3941c3fe52b1ed
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\739025F062E977A263D0043D9E01EE529DEBBEB9
Filesize494KB
MD5636581a6ed8ee83271083a451fae5df9
SHA189564a419a13cffa9e0d2d81aa90b988b0cfafb0
SHA256317618a9765d434da516259100b22620277c673dc544937194e3ad963ce88f4d
SHA512a3fef11765131659e57e866e64ef9c575a50432ca1d41de0e68f97db4717f0c657eafe7a4f52d464bd4b3c6f41a7ee7567ebda0bf1d2c5401a95ae40d0458caa
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\7AC315F276833013F54207BE8156FFF7DC20AAA3
Filesize160KB
MD5dc1ecc17f9fd7c287efa78d00bfe3b22
SHA150577624314c3e8568a100dcebe4951430c6e947
SHA256ea0206f59a9d6c7569975902277e5614cc3e9d4155aa71954a4575e5e416fc1f
SHA512565ba4e4279cb9e4fa0b850b112edf764a4e15ff9079c5fb58dad2d6b4d5fd8e65eeb4ecc917e72534508271a1373f508d229f09b131c78bfff008aef855c151
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\7B28E5EC0F0AD56A4781EC493CD424AB31B5AA21
Filesize246KB
MD53c7c69b3fdde5f4941a59e4a6d8af373
SHA15986afcc43b29b23c2274d918a1009908bd5717b
SHA256dfd8a4885486bd982b3ff00e94ef31a96ed7c048257d2f9366d64454350be5f1
SHA51265f1b773d58489a7261e694514bc1072678550db3ea68475112c2c7e7d57d2bdecbe4c05ac0ef26c8ec36eec304ae75017f3210dc6e4ce596fbfa5e8ad74ccbb
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\8322CFFA30EC13E06306B28C79904BA59EFECD7C
Filesize1.5MB
MD563011dd599bc4f0d1f8c594271b92cfb
SHA19ee05d4ab5e840a3faaf62d601c9c5dc45056ca9
SHA256869d25d7d999486359bf732e8906a478fab1ccb705c2b6888211e5259d910415
SHA512e5f60c76c6781352269d93fc52b3d4d086e9a0446d24efd167869737a501184f7b8b3d09e3c60350e581cab6e7b2edc8d12d1f161909e718320427149591caf4
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\83CCE73C419635CB29FF0404A4B5279A14A61E15
Filesize319KB
MD5743eca2b831ca1093c5d1eb4f6e4c165
SHA1a5d67b7c9b4487d400d6570c6392f2609d9dbe1f
SHA25667d432f243f3c35eb1c0fd1ea02886a171fb7de493b96cf9fc1d136b65f297e2
SHA51272d341c252debe52bcb20226f4e481a6685b81e84d187e6037bed67911db76a1ef0d9e0267660d56708b8155a34da341e6f3fddfb60105da3de00f3c882c9060
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\871BFE4D58FED8E2190A3618561816E8C7770ADA
Filesize1.6MB
MD58bfe7639de966947b26b87b0968f7d4d
SHA1edb045ecbc9d12b0a417cc6cd78ec421895ba744
SHA25628b60764656fb2ea9c39a4f90e6e6be4c161bc04c166bd7c1ec707c1d37c1fc0
SHA51227df119085d22911ced86cf2227a1598f5810730cec1c6300979c0afab92018954f2c485a9e4f533a161d097e9ab54817e5d3866077c4dd991f6bb9af7cb7544
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\8DE9E3832FD01F27CFF4896D5F696D78E571EF14
Filesize122KB
MD565b2bf5c95308aa2d394b3ce9c35a44b
SHA162e99f0abf168ad0312fbc04cbe19ce1141a03ad
SHA25668b58e37dc1971d20fdb769bed3010a390d768bff388a91c05e94b121a40b853
SHA51271049de052da133758a81bc8bb7c7c71aea174753b357849cefa2c0380ffe5160814313001343353b10d132b923075ba63ba7fbb5fa30bf0906448913240f4db
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\9060E1FD48961A6BA16209BDE2BD1F93A6F56818
Filesize446KB
MD55ab732c060f7f12e4686ca102c7e4b25
SHA1e1fd12e4b26e0930ee3babc66a4ba7ef787beba0
SHA25670366662553dcc792663d419215a055f055f773194567e62adb16a31f6c4e7af
SHA512236faf3cb55e53c5f4173e274f61a55fc5147e099e8fa5ab60d38f9c5d7ef31bfba86e558b733078ad0e8c994a0bad70ac5fcb887bbfa26b438a01b55f4ddabe
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\96A0D2F1C4ECD10450EA183542E05ADB3BBB4257
Filesize129KB
MD5606f4a42cf9636b19176b039673625a1
SHA110ccc5d7d5bbf0337ddbc175f8622bf084658726
SHA256e7447c786e2a9e7f9c82e64d68fe83646bb62b78ccce240dd62efdc57aacdc5d
SHA512c7b890abfeb3cd77f24bec34f81af15fae2a21182cbdcc43ceaaa216529a1e7e7b37accc6390d5ff3aac54b960404f1bb71615aad59995d476f0709c265e6bd3
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\983C1910C445749854DE336DA64C6ED5B35B189B
Filesize1.1MB
MD563fd6835c61585daa4146d8902ceb1e5
SHA1ba69a99546738d658c816a6c8504017c53b8d1b4
SHA256fc57215d20eee684f059af00e987ee5d5116874974b5c3a24078558d49c700ba
SHA51234f0213083d4baf649ff4e0eed66e60014141c536dff681ea9376ef15a8531e45a6211296fc33bb4d735524bc0855b0d729d3ea3596f8ed473b3a20ef7a83cd6
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\A585344A45AF937E3AB7D706291A9A3ED8D581D9
Filesize13KB
MD56fbe0fe3a430854213c9f447cab2adb7
SHA134c3f6f28d5b44afc5ff472e40a470a3c00dfa93
SHA2564c7d25f985e1df64f665fa5bb2700de1a49117b6347065af3505d90f025a3671
SHA512a2a94ec0c765c7093d71f16cabe890aa18d15b8ec23bd2d763c927f9b5088d2f8184d75599da08dee8d206548ce1b7199ce8d9c580dbf33994a0a7d8012881b3
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\A62A7F331E73DC9D0055FBDA55172020F8FA618B
Filesize61KB
MD51cf1aaae4ef2ca45ce3466fe523c818e
SHA150341a27f2a4969687af966ed5ceaf4e8f75bab5
SHA256025956bc64ee6bb2094e8e9ad73596767f604f191c7d96db4cec9133906c9ee5
SHA512413440e37c98ff3bc8c81c30213494a5bbd369b07dc6e102f8b7a4a5387ba11d106695f47ff9d77efd5da9dc6b897aec976178bfaf46bb3afb23a4644975cd4f
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\AC5B4849CAB26A6FF5E0D69715FFD2D5203EA01F
Filesize789KB
MD59d6d514a60d197e96507d80b72025100
SHA133776abcd2680425fd8d28716ed29adb3d86636d
SHA2567846d565e42b0930c4ddf6212be180386fb54dc4cfe4b9c62447b235ac604b9f
SHA51217328421486fc35559c5746568c487e275cfb13dc53703897f7d035ee31f51288930fe4d0891d64cd56bbe9b53cdcc5f597633fb6017aee3d573b5def44300d3
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\B5D9B00549A67C5E8FDA11F8BBFCECEDD00925E6
Filesize13KB
MD531ab83e26a53215683b4c7b390679c43
SHA1dc52e542221dae54d9ed7a55a7d6c7e445483e44
SHA25683262855f3b3486ff159e01892bea2c15e163e96627a806d52751bf44b82da6c
SHA51255defd018c497be8c9886d9eac002a4f36b179536cd963c1b32066f86bec419fa3c771333d1d85539cb8b55636a19acdecf027f2d32733929d1338b7a6ba48bc
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\B9411EF1ECD7A0827E2F6564BC24229E26391B35
Filesize56KB
MD55383903a5e959ff086a6aacb2931ae7d
SHA10339163ac3fd89413c324d965500357636a3d661
SHA2566a52a3744df7138bf9099ab89f5dfc53ccbf7f4c7f3fee8cf464dd0be7c4ac74
SHA512c53a85ba3f05659820ca253c8536836ceb0cedecba38c4e9d5a50845a57322a4ecc577e7db28dacc7ba210a321053b2b92907b3c2e0b467ecefae895fb233bf4
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\BE2D3D60C4D6C94AEDAA7868122CCB76EF5AA608
Filesize30KB
MD57d352ce05cad4ba50634bfa6e682c9dd
SHA1ec9adb2c052949e0e387bbcc5e8c2ae216fa7d8f
SHA256ccda2c8df86751989587b690394afce3d706aa64768ba1df9237651a1f95a8d6
SHA51207bfdf220ccacc5c28ea604a60e51b0b062ba601a94614435073d65d782c1a89421cf972289226230de7013cb73660694b7f990e700ca1cb826683b89dd2adcc
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\C20E036239CAF315DF30D2CDAAC4F746820BB89D
Filesize1.2MB
MD57c22725a4112db8e5e5779e30a36bd8c
SHA1e82d76fe916dbe1e3f5f343a6696c6f7c05436f2
SHA256c7ae1e6904fc09cb93c40b790b6cae3308641f4fd53d270e7d1910d3d823da5e
SHA51251c6b531de970b9482bb06f0b15919f4134e4f56a1c146029611e6830023176808ad68b2d0d1dbe5ea31c720ec57aba7c69bde13bd7f291e00e40587d7f87fd2
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\C3D60DA79B04CF8B885EC1F8CD064FCF11318E8B
Filesize28KB
MD5053ce9c4957febf4fa0690c815f76a25
SHA1d2cfe937e357c148f53489a09e83112d994e50f2
SHA25641cfdf3be5d9e69955ababc7b2e9e8cf2fa20d8b993bdb6b346112204d29952c
SHA5128a364900b74f3c56b65c0a908aea2089498b8a63b7d21f13098674e855994d9d4f25a2111eb10a50be49a427b84c15224fbd9428ac47be993b26a325db2082de
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\CA9A8EC8285E665C920E394FA01DD7371DB40271
Filesize1.1MB
MD5520597d87f1a1cd01b94ebc426277599
SHA1e55cd1e3c562a9317968f38d40466adaa9076abb
SHA256afae7d560999ecab2a674f03a788718fd6ffdfdb2d962c3d520aa0f81a9ed77e
SHA512e35d434f7d6c1537275ef18a87b7be3aa07bf7a4a3a6e054768862e7b20640c64ffd923b9ec9b8b91a4649883814845c40f0d77c11d75e3a1e6d552966698d67
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\CBB3AF37072E075C70D6CACBE827A43A2FA5106A
Filesize54KB
MD58cb2f6b7eaccd094583c2d397da0d0ac
SHA19796eb14e223cafd3a793b8551366969a774bb25
SHA256efcbf9f4aa3c0d13dab54c5a455a8f509ed690b523d9013840d71d319049d54f
SHA512c5c182481a4b76b8a4637ac763607696b5bcf422dd433088eb6068471ab65225e8014edfa6b632486b4140f4957989f00406f04c0f60796f0c5d77d995d340e8
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\CBCE7E4F9D3729ECC939B305BA8FD0DFB8DEBA23
Filesize1.7MB
MD5fc85bcdbc1ab3e3b3a475179e8837522
SHA19a6266db90d42c565f0fad4a7c3a6125ac45fcba
SHA25630fe9ba5016f4c01e3eb2fce692dad563cab7f84ab2cf9c23a695e6a69ee36ad
SHA5125d77e7cded6da76f91c5f7a098cf5aee8140eb25ee42b8b88f86137ba39a7bba10d33feec4c4ecbc093666b7ab274dfec12c3d3c8cc7b0749e6bec2bd90d3c43
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\CFBD8C231D7FFCB5CCA354F8BB793277A96DA560
Filesize604KB
MD59ef3b347c1f71ce6907f14224f771dfb
SHA1ca41512288db3965acd95274f81c832275eceb81
SHA256b31a0cf27cf714dd89f66e88adfe5a83505f0e42a7b54aaf6bd70efab2d6fdc1
SHA5129823e0cc68f084ce95912248fda6f3eb015aa66e14ee8b641202d72d4cab53d3c8c3af890777ae97328bd361927a70de0e2ea21c97266173e38d6548d7ae1db0
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\D2AE73DD3D367B2F1FAF273E3FAFD2F256F082E7
Filesize658KB
MD5873a9b89d23b449a9680329d978f5b0b
SHA1efbe39c2be549fb894301d79362def37b9271146
SHA2561c455b21294a22275622dfaf78181378b62f264101c1e7eef1e8685379258059
SHA512ed51f18c14e187508775d9051eff89ed07cc7b6f3bd166b6e47167cea5bd2e378ae070812781bbc56d6572d37536cc660bd3f225dc02d3f83755b2f2795677db
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\DA784CCDD74E697C1B9356166222C06487BCEA54
Filesize110KB
MD5cec5897cab0e04d06ae4fad50b77f361
SHA12b4424c501003aaf67f290211d36ac37faebd5e3
SHA2560ed2e1d80eed012a460ea37a30892e8f76256e08d72759dbf69feedc783cffb4
SHA512876b23c37b5e5eb7093b4952b8d568dacca77caded3179c6e9a77be704ec3f4b341d63238c289e0efbf7948dd7fe8193fac858b12fae4b17f6dbcb8714cb9e3b
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\E6075B89D928DD7E37C2740068F16FEA513CE175
Filesize110KB
MD5a1917025951ce892ca3352ab95f2d4d7
SHA16b9cd9a26f90969b77cc76983859aa6264135e3f
SHA256ef303474496222f1f2fba862fbfb7898ee309543511028503d063813f37803e5
SHA512524159290d971b5dc9a9d5c983fed25d46340483c96c0cbc1875e4ffa692b2e743d3962d7a4527037a71a877868344de74bf46e704ae55357acf883879e691da
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\F27E0CDCD1C7E6F6CED7F2BE71ED722173C6CCAB
Filesize54KB
MD5fb38c8f265221d485cc4cabef39a34ca
SHA1565d796b145171fbe85583e2db3354c6372e8de1
SHA256d2bc98c9470e1ec2e14a3e5acd933b4b48b850acb2b9b2b1335b7e3713d3c3c7
SHA512588607bdf28a732684509bd0041b2322e8f6202d949fddcc9ae4d632c9fcf12cd80d78cf8a68407b15359ae1a288d2a51cc256b4132acbab8094559dd76bb698
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\F3CAA836DF9244F44521C9C538B2099C9F5A9015
Filesize97KB
MD5df8d328412034dce42a43888cc24f186
SHA1215b69f24fbfeb76c0d2a3aac908cfb3940d94c6
SHA256669c12ce4c4e5970beba72974749529c785f3bfa7bf4543991ed3b5dea937b02
SHA51290a9f21b9624374bb192729c99737535f4e13868b95580f42159b424577436c802902ab968b3b1483948d13dd3f7dc3950df2c83749ab7b247c7911bc6baf1ca
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\F470213440E422B49357D8269E88C8F1DCF272C6
Filesize456KB
MD52328fa4b450d94b2d1edac4d8c2c022d
SHA1c887847ad3579eedcd2d5678e372c34c689e7a34
SHA256007deb631f70e47560db80cb7cfc5c2ff63f209a6759523023792425cd8117ec
SHA5121dcdf319518f6f1bc568f2140ff5f432e9f0d9787bc19c9a990ac72592cd84b351b22eca827e4716e48f9fa96c48d2bf614345b90ba51d89f0b35ff416c7cf1e
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\F8487F74A4C651CFE6F8DC5221CA74699BC56EB5
Filesize28KB
MD571d0d54a3495a295da8b24c78977f14e
SHA10313fa15049aa631b8283c4e4450bc57dad61acf
SHA256eb5aef8ed80aa25a2a89b29f664cdd1c0372f52046fb2356342989dcdad9f62c
SHA512cfd2c2cadb2d329f22b66225e0ebd531dddf8c7272c88d379a69986199779a46023bfda0d6c9bb473b5d825177660dcd58b14239cb1d54530195559f4cabd8bd
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\F8D735D3E9DD94E31EFC0F80AD2ADC8AD211DC52
Filesize794KB
MD51ff707a7f06897f3da2c5032a52f094a
SHA1f08b8894d6381d95cf1d1aa9ca8097e36fd5438c
SHA2566a08654bd839332b9c351faf2716076b70f4daa5aff84edd8e1b8bb359ede059
SHA512d36ccfb80b0ea1d3e4970aa6f5ff8e15189884b27fa91348a70665d7d0dd90634b8fb582bac5a29cf9dae49985126727b06eebaff72fbe88ba86dd2c9e198841
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\FCB643CCA5F178A42943D6B9631DCFD223767899
Filesize537KB
MD51d1de2d68e9cc0aa65692366d67f7260
SHA1e99e306ec55bedd980f849c617c560e5e8be8c58
SHA2563723f34f304ff28dbead3a4d3a721c2deccefdf74d9924d299f1a4011eb207fa
SHA512733559f73b94d5b6992c982be059c8506e6d5798e4a15855029d1c3bc98a6ba594dc3eb5683159972b4ac98bff304e267563ee96369bc197a0ce29dfc042d48e
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\FD1D34ED88A1C3B90606730F530C7F9BE0FB0E35
Filesize114KB
MD59f62b9bf1d9801d1552634a05835bc10
SHA12a93e18caab79d7e20f4005e0f032b4238d37cce
SHA256222b58b1c6f0c6c8505ab5fdfe76a720e9c49025d4e601a3cff58ec81de340d0
SHA5128ad37f211f06590377384c09ba824d386e94d73c246d4a39e95cba281c5757dff95c07871c962d49e6cd62fcff609a313c5687a3c47b8a3a59dde3040af15889
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\cache2\entries\FE367F652B6D57B9B868FE31FF0E5CD3BA496EBB
Filesize576KB
MD52de48bfde200ad7f3065c32a55f54931
SHA19fca4d697628be74496a018fceeb82917b77079d
SHA2564563fa692252eca2e82fc5b04202b56ce8f38a81cfc62c03fa80fc21c1c0ffdb
SHA512b90b7e10972192018afb01cebbf9fd05a3a638b5c277220ea8ca481a31295d2232f5cd838157f7472b754aa342143e272d3246d7f321ca352e8a997e722596cb
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\jumpListCache\ihsp7SdFMqKh1a0kdOpPT4WhfTRAAIm6WpAe1fXV0+0=.ico
Filesize1KB
MD5b4f8f60bc7270b56ae3e6cff74b39d54
SHA130e8e3752e13a51cc26d89c0592b0bfd36934d38
SHA256bcbff095e0e5ca2f74f0c26dc788c7c7cca8e87e2ab596ec9457448f1ec5d77c
SHA512b3247daa5bdd9647e77e9303afc74f001cca6d24aa5ec81ab80cfaebf2f6fa0bdb720a74e78df8fca0c4ab3e8a79deedc989d22e695b59fd892e47482b1d20af
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\9adae2ec-abf8-4741-a943-5b1d49d40b25.down_data
Filesize555KB
MD55683c0028832cae4ef93ca39c8ac5029
SHA1248755e4e1db552e0b6f8651b04ca6d1b31a86fb
SHA256855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e
SHA512aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Filesize22KB
MD5d26fad4aa6e2466a7c5a1d9c323e4851
SHA1df7ce22d04940688496d69e76c9dda59d15432f6
SHA2567ce7b2c005279ddfc81960e0ac12c60377528639957185c65888b1f46c8f6b31
SHA512063e3c387e456be1901ff7585ef3c91aa715801fd51b992d822d50aba8cf72c842112a157b8abec4e8f02ce2154cbe1a501749a862e7b94e0f00a795fbc5940b
-
Filesize
262KB
MD500364d7b46a398b0e4b6bd52f575cfde
SHA1daecf052a35c734a0de5f255eae7b387c5be4a8a
SHA256b0cd7af5cc3129688133b4de831a743b5686742ef48354824b7607a43e54f509
SHA51292cbfaedd744612ac305f82d265c52f29fd09e447ff340c2529549c7998efe93886623c652bd6ab90e752cd3aacc15dbf22c403d9ed43f18aa032730ec073b07
-
Filesize
6.4MB
MD50c067c4d75131a999f8c98705dca38ee
SHA17bcc7f396545977f15580e138c9916e0ab0c70a6
SHA256a08ad4ed1cb0d25c976537907e3416a06a84cc4d607cdeacf66ea363b7b3fcf1
SHA512dd9514b3acf0dedac0916f409e01e28f43b0c9e4980e8ad03d2aaccb0898096cae7249bcc30f8581e95e8f7e2df58cd8e279d4f92569f618db1479a82b2eb4d4
-
Filesize
504KB
MD515bd216e6fae9ca480c21db01ce4ae3b
SHA1ab44f299978d6ce76b573347f9693e80a2bced7a
SHA256dd788f4010754d48447e50c1522b5a1e8ccf4ea457c7d80fba4f6f6b7f24633f
SHA5121af9d9ede7147b338abba275225fb37655ef1bf866ff1fec1a9c9316c423feab1e6b33079c4064ac7994b9452170fe0cc6bb8f20d76591cf9b3df10fa9512a32
-
Filesize
2.3MB
MD51d0390337d1a4a58e5514be1a9481ad6
SHA10c09b611223f335af2a42dbc371dc95ba4f18979
SHA256c79f0eeb2bca4905c585c50333db3c6f727a554f5db82e64948f93668fbc18aa
SHA512382e5d7a61398d54bf15bcd928ec7755817fe92a860840efac6f6417229678cb1fd1756c5a7c82e02754a23732f63882c4a640bc6d73d28f30110d0028ae6fb8
-
Filesize
15.9MB
MD52724029fd2f49fc0ba0eb8991a806a54
SHA1a8b18afa7047dd024338db1eff46264e5335301f
SHA25611fc5c2671bf8bee224c82eec4df87d5cfcae60e524a277b3dd4e22afaf03390
SHA512c1dd27967acd98c211d69f29e311605f4d27209334670a950681094d3ef723245c5db607ab738928939165d86f2dc7c0447e42c3881b24c8845b9f9d967e972d
-
Filesize
583KB
MD532622161783a33a229827a2a0261cc16
SHA10816cf0b1f0425e501b949dd36ba85704cc01618
SHA256631125e9ab228ccc5ca7cc723eabc683bafa245f2e63b9fb23a55073df017c12
SHA512827cc3ccaacb04df9fae9e8edc4a83ef7715bed19427fba872762f967fc918505dbc08516f3a613ce711dc443ad733bce9a30963c5e6adf08b03aa6796c680ca
-
Filesize
200KB
MD54aab0823dc7932b636b42b0fb4c73254
SHA1e67e1865f3dc4f8bbc57a2ff64e42c59ffbbf458
SHA256a53e3005b7e720458a271a1012c517b17a35c1af2a184a3f0837e7582376abc3
SHA512b8c5c1c10b027cd373d13f33db7e470136b763b7d427f00606f01c683346e122359b6b94da3f9c68fdc3904382cae776e9d5c2d6de5d270a4ae09f6a9fa90148
-
Filesize
130KB
MD54f23103d6f2f80089fb6cbaf29008349
SHA1ea48d587f8321bd1bbcd7f0ecb42c9d2fa47245f
SHA25635f8ffaddc2f7e70317708dbdb2666d2364b348a9f01c28e69d442838168911f
SHA512621fc4b03bcb4ff9f065c815a8d50515cbf82ed9273400f923d35adec96b7b9343bd51f4c19ceb314e73754a57750000b2eaa6973f113a22f6bb0d323052d89f
-
Filesize
26.9MB
MD550c6ce5ff58f61239934f9d2538ebdb5
SHA11c34b96411db15de8f79ef2fa16659ec9019932e
SHA256f4545c335d2631fac00a39332575ea19a71d9fc5065719dcc94ab3918d6015ba
SHA512d58ca0d84da00f38edfeffc760fd99e6edcd7a29fef3b800a4edb69dd61c902b9b2eb819f3a380f4702ef2a0c42d2257ff0d6de53a23891966228293d44f77d3
-
Filesize
5.5MB
MD565e8f1889ac6d2c950d094524af5e4b1
SHA197c3348e4a1b0b9c7a5682628649076744eccad3
SHA25631bb0d76acbd37045961c7435ea133bdc3fd3f6e081f0b2cf1ed3598af887092
SHA512dfeaebfe8497be388500cd463195fd5ca1b2ba3b1b85b19bd8cc9f04a65efcbd7c2375de36db66051b284afe6bb45065fae7cab0ec318f34923318498b6f6e86
-
Filesize
480KB
MD5671fb1a7b360b7f4281af5e52acc2c84
SHA18ed1a2b9c734de55eb0514785097c95718a8adce
SHA256b1a1e1e797e1c39277153b76df1dad2a8fe3edd1419540c4fffd3574a4485436
SHA51226e3cc37f83142521bfeebfd2262b127e321e949a6e4477f17db793c8ad65bb23ae7ea8b45a433d2237fecf6d8447e907b25feb4fa3a26098ff481ee502b2a06
-
Filesize
802KB
MD56afd47a719d26cac99abd568c21f2066
SHA18941ead74cbcbba3d9a45ae794f6239041dc1bdd
SHA256f8c9f80c413bbc3a95624bcc39fa7b00100cca26df312c58542308a8a331d5dd
SHA512678c6252a38fd1a709e2536b5677732a70ff82feff1a71f62f36017027d7094c09bf1280abe36103ef61f130e732842fd6b30cc95f46d2465682ccdbc4ebb239
-
Filesize
13.1MB
MD58f379ec2b22ff106b837d79f7fdbf0d8
SHA1977223c04f192d8a157603c1f18d6d6a301e88b1
SHA2566620658a6288e6b58b8d86aaef4e7734e10778974e9a01d364fc7aac4d35f10b
SHA5121aa837f64e2d9652221ed5bdbf78c353e04a0536d09a3502a230b7f2f034dd404bef0e1a4ce57a42cd03f860f64965d94c2b638aa0994a3dd41fdbc6d751458d
-
Filesize
3.5MB
MD5909f4b9d7bc03a926d35e84d0c99ffbf
SHA125b684ba69d5704b6238bde0291991aa04b8cd30
SHA256c139ad55acebf739689cc1e29f84ba7731dc7ffc03f70bbbbd16929e3d439ec0
SHA512bb494e2af43f76ced9279dd01ee73a0326b2d67ce543ac27d0b9977c26ea2d59d5ef082e326eb3dcf164b1fa19b150412e942e2d0c007a2012d68bcb76a2a896
-
Filesize
8.1MB
MD5a431ecca42ac73a5714d071b5767e16b
SHA1c6ee515c9471ef7876ac0f17d36058e671896604
SHA2561674323f76249ec55862dfdf7b7d40519789975cb38ff34c202d45aeb804ea7a
SHA512c981fd060dd74c8a9c5814a63a0140f746da00f644ac0cd1c816bb00f1c3f8cb2b2202202ee9f1fde5116a746d5c08db1dcf22b6cb45050f061eeafcf09633ef
-
Filesize
475KB
MD5a958080eda7a986967139c082782dacf
SHA1e46d0f8a1428a277e5d0c57adeeca0a1a7bbc71d
SHA2560c6356c35ae927019248836b8f3ddfbb087e01f9e45524a7f3201f83c9018089
SHA5121a1e31f2f5e4d1e4269083b3718ad699c69ae9ddffdf9bc942b5441737cf03c57064ccb8186c81b65f5bf500965c1b35a828f82e4cd92cd37c98d34c725d2d3a
-
Filesize
79KB
MD5b1b3942bf90a0029a2ff4c94bce790f5
SHA1330c44fe25dd75db39f704e53e80e65e1ae09736
SHA256b23ba4c672939746bafbcae7d91ae72ba94ed795095df96f5606791643a4beeb
SHA512159eb326dd4301b213e158e8e7064be094f46845c91add80398a6164ad3ca8dcf398530ee9ab40535108f93f8ddccb644ad544853c6fe8b63f80f8e162d04552
-
Filesize
3KB
MD5b4b75c21ce05378163042dc45cec5834
SHA10311014f74d6517ae7bcc5232e0e5e38993e4a03
SHA2564d6fe68c8b4941ce335ce5597ebbc1f27ab02646e9af98af8a76875ad0fd191f
SHA512d0a988d04601f2a1ac8ff24d136d8b82be783ae1a856a512f6cf867448175133844e041674f76564c20b1911ef47107287a8016ec61582d00dac23a1a9f72c43
-
Filesize
1.3MB
MD5c9622ecfbec2c14d30f390909c563124
SHA1e29362819705bd8c4605b587802e428f49e64385
SHA256ac39ef36dd53c77c687dba333b3c15520e07d15b6d5accdd6fd97722e5541e54
SHA5120202139174d294ff371bf1eebd23ecf6ff30ee43f771ee7f47d1ed86601c2fc727a19519facab355521ff73baa8f99589f0456dab76e160f3895c073d0c78832
-
Filesize
7.9MB
MD5d3ce7ba8150c6b4ed1ad1212fd1c021a
SHA1703ccb1beb53288f7d6da1294c5fd5a0e6e3a56a
SHA256327f6d9ac087b0614239a9234981a015b09a108bdc0dd97a2ae72bb1ce6faa5f
SHA512606d6a8bf1c51247f78b7a2ecff7027b08059814df54f40c461241cc9254d31df08d24f1f0b66570849ad84993baf7dce9c10e02f91071834ab8269e76e8ffa9
-
Filesize
10.0MB
MD5eda0e641a9e599b1e2e30863acd1cb11
SHA1b08eb726542ea92eb1e30369a9fa84528619b5ad
SHA256acd941fba075749de93a8f2ff41dbc94d215d6fe33be9bd4296bdc540d906751
SHA512a66e438fa1743192fb903384e67268fcba82a25358f5c47328f170e6971271e174f180a089f1204d8bd57fcc179c501b467d374a21270b5f99de038b57621378
-
Filesize
229KB
MD56ced45ae0fcb6620235271f2c6f41411
SHA11dda331561500204fe0d86a323c350b7a9470b52
SHA256ad64cf840a0fce7924ac5f8a4f6900bfe73709a5a61031404a213ab563c286d8
SHA512faf2565f9844b929aa1ed42e18368f9708bf41e062a40ba4dc8b5c4766e9859e011f2e1221343304547e0776a1eb976b2cb0e3e73529fd33da4da3908b501538
-
Filesize
64B
MD534bcc895585a83946459e2ef319d3679
SHA161e03acfd8058dec5e0d5f7cc525e50125e08f9c
SHA25655e4c248332ca65fd047f9b30a519a3d5d15733c1e01240b348de02ebe295399
SHA51273e327fa2ab9ed5d28c92dff37f77b0b35157b1c84f3b020ca6b68892400bdfd93342b3e8dc8b32ffb5a34693a49215e21121b3ab1facc8cd58dba4ea9a28278
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
3.7MB
MD5ded6e09286a44375b7038665fa5e2b6b
SHA10e452083449edaaaa004f15bfb438b96142eda5e
SHA2562d78b97515e1085412a72d53d9c8d156dd65f041d26a14aab9248931bfe188c8
SHA5125360cac92f799d7615396e509834f3865ae7cd4b5b3257eb72597e3d742c78497d5133133a8029a7f706bc4296f8e14c1c8a81775c88eda7d60d22a95870c565
-
Filesize
28KB
MD5583a92e3e37000f345e297ccf15e3c08
SHA176cee9bd8f27309c4af7aa52824a4d2eddb8f239
SHA25682b24606ef96c7ee458df1be3e5a1ebc8714af9edeca19ac5b359d33a833eb3c
SHA51242da33c01d3c7793ceb56f5c8a33f40a61a6ed6dfec437697e999443df5a3b6dbeaf9465bd7f18235c490c01ed87321628bb2bdf8a3eda6377488707d4ff35b6
-
Filesize
11KB
MD525e8156b7f7ca8dad999ee2b93a32b71
SHA1db587e9e9559b433cee57435cb97a83963659430
SHA256ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
SHA5121211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
-
Filesize
502KB
MD5e690f995973164fe425f76589b1be2d9
SHA1e947c4dad203aab37a003194dddc7980c74fa712
SHA25687862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
SHA51277991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
-
Filesize
14.0MB
MD5bcceccab13375513a6e8ab48e7b63496
SHA163d8a68cf562424d3fc3be1297d83f8247e24142
SHA256a6af95a209b2e652ed6766804b9b8ad6b6a68f2c610b8f14713cd40df0d62bf9
SHA512d94483deaae98bf9212699f1ab0bd913f6151a63e65ebc1ea644ab98d5e3ebd74ecaa08f70aca31e11a5d2c64d1504b723817af35bbe9d7b05c758dd6945d484
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Filesize19KB
MD5b7178d1deaf8004d23744813dd76d5f9
SHA1a1310c2e79cdff87ce32ab49be47d63abf5978dd
SHA2566403f5b9d8b6af88c6b55ec3a04adbca8197b0c7e16ecfc784085bcbc2e94e87
SHA512629277a78dd49a92f0dbfa0d32a670f1ca39b40135e2a68dffc9954b38d9ed65bb1765e33a343949cf381b9645877081625995cbee5de3e58e602feecec11a55
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Filesize19KB
MD56ecbe6c740684c6115711ab6fc1fdd99
SHA115cb5e34f61106ae83aa6fa70efa8f8862d73ba0
SHA2563ae8e20db0882c7e8d7a185553c85d1ee4139b20de9825ae12e9a2096e2785e7
SHA512c20cdbf4fa712173701f727ebcd901a3ad025c6f82f04b93c6cd1a583bbd540480a0d917161b9f8417d61bef86dc1476cccefc488cccb54c09871f438b36e848
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Filesize19KB
MD5dfd708388a581622d83096a6c87ffafc
SHA1a346e48619e44065bd0857c9d73d076a001a88dd
SHA256d7f088ae7e3a9d5dac26565038386e51718c5c00dc82e0a5dd12bf85047d3942
SHA512d9e12a59c118335155c9380bef540d2f0f233314466897da74c63419fe058dc628e15eba4b5f68f51921c7dfaa41f4055e3b03fd501b26e994d6c9eebb5f65f5
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Filesize19KB
MD576b645751d8f0327919cc776154ef1bd
SHA1a5f6627e4d425be5e9686a49d1ba72ed07caf5a5
SHA256edcba46a84b0904cb47fdc659e4d3ba0d7869919d011848b455cf6664338b566
SHA5127a9a0d62d94c67815c8093e99bf995eedc0d971c0a3908eb41bd05538a98b743622d05eecf4b862d32bd9785f189517e4a57b2a87e02de1f89fd6a5fc5ad78b9
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\AlternateServices.bin
Filesize7KB
MD58fffb703454201ef9278dc195d2320fa
SHA1d3a7988b1349525efe6aea85ec8e2b9141ea7818
SHA256a71aa4b55ef4edc2079e7abc02540ee521bbcbb65ba4d3365ce746f2b4579e08
SHA512cd32d8d94184271e8797defa33d41a6038a4c9abf99323ee6b0374a595662d478573c12ff8c50cc35ad095c16a25e4d88c27a2cf6d8e5ea0efb4ff854d8e6dc6
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\AlternateServices.bin
Filesize18KB
MD5bbdb39a95847ecf594ba33325c9e432e
SHA1634b8d966979b8b7c1cbec123ad0fdf4c97d794b
SHA25662e140016380ed0f6fbadbc7f59a6d3152e05cad70bae984b50a6ad1077aa6c6
SHA512d8e7fe6e3b07344429fe71a6ce359cdb8e1b936d88ccb34b8ba0f07bd56ea75fcffdb4e334d4c9004d59c6b5a9a204c609c13f626c63d6321df29d6c58353254
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\SiteSecurityServiceState.bin
Filesize5KB
MD51af77c3c289521766160535e3eacfe92
SHA15d49c901996e4073685358af5a0a2831abf7e43b
SHA256a5808269aa16d81fd4156dba4e0b4b70a65a174f4378f636916540852773bf9f
SHA512c2db6b8848c53aa09f75deeff3bb88bda8dc19b81af1f13f8cea090f1676b07e9102a8558830b64a1c70f92d717371f0f0c9ca5ca86d6e12e24f25b5663c40ff
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\datareporting\glean\db\data.safe.tmp
Filesize7KB
MD5fd74ee3f9ea6bb49d84b973d6691bf62
SHA13d4fd779447f111d4e564df2a85fb0d54ba438f2
SHA2560d6d9fbdce2fd0986fa5e1091ef01c6928b28913a416ed31df7c38e7c5e3a367
SHA512aea822f6300b7acb5f6a1df8eab0547d153abbc9651f007b2fbb0ed0e0aa9906cbbc6593f54d3f399ff3e75fc98fa89319bc2ed221602cd113e8efa715a8114e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\datareporting\glean\db\data.safe.tmp
Filesize6KB
MD57eb9a8f60efc4c6e57a38eb34a22575e
SHA107d70cd3e989dfdb91c82e1f0bc4f8b6c8d8fb67
SHA256158057983c4807d3be3b757f94f72a2fb0c01f23979efb9a49324ecc2ddc84a0
SHA51281ece9b084b3c309eb034936f3bb3b75fb88cba69ea93fea688b4627906064f46a0a6c4834084caa9f8b788d7354cec8bbfb84a11a646790b949700b4511336d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\datareporting\glean\db\data.safe.tmp
Filesize127KB
MD5057679489fda184da5e4b292fa74a608
SHA16277840ed693c333f099d2fcd6878cd1038fe75d
SHA25619df4e3c78ef5b73d84d03237ac16df0e2616b274edac72e50eea148df6d4923
SHA512a07bd417a00606ec1ea71d244fe168b0b6e2ce2d958c039b1c8b4522d9027f531626ac265f60205c54926a7551fd9a9c7e84fe0d67320254f209a8d110ca5deb
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\datareporting\glean\db\data.safe.tmp
Filesize135KB
MD5d09869cbf60a0cecfde522e6223b2534
SHA179de0563cbba0b0b69b714a3f8ba0102458c2375
SHA2568f5051238f62e611f853ab02989d767afb3334203ef54b46c6c23b1ab8ca880d
SHA51234410dace44ce75d07b717c1e63fd2b2c9a17249ffdbf2125650a875ce2c28f09e5a4aff213ae21a3d2e03cb56eb1193d9e707bc55572d34b5e8c4e3d3a74c09
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\datareporting\glean\events\events
Filesize1KB
MD53908e1124f60e2a878ff84f2bd8a7d91
SHA1fc463dd0592c2ce0053ad1123e843495084d3756
SHA2560da667b8407591989c35211decad8ddef6b701b0572318d482411750bfb8232a
SHA512740c1f07109f66538553c0ec6df1100e09b92d5fd307985ebb0500bd7683f6a1e87ddc75f786a3a1da7c3890084165666aeccc4f33d20bd22296d548b14d6390
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\datareporting\glean\events\events
Filesize5KB
MD5aad7c3c4eab300230d47febc7edc0e01
SHA1813b94d8d2a9a117fb793a1381a744a4e58cf5c8
SHA256c9e8c98b67433864c42165e147ff2a841ce59f9e60c88c305d45c12e7753058d
SHA5125543df20ef98754bdd281e39aeef622f921007e1b04e5584631d32e8247d9653cb9e046dd6d2a37a6f2107163b19b5ee21fdd8650f35e75d00972b6d261f6eb4
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\datareporting\glean\pending_pings\1367eee3-821d-4638-9640-e1550531f682
Filesize235B
MD5254353c708ded105a260ffceb67299d7
SHA1c265eff148057ac3f06b1d2e57ffe549c3cd2a2b
SHA2567654e6609cd4e2bf7cc89eb231d3a012112ce693d15dc98b44c72dd8f369ef87
SHA5120c1f5c416a646e64382f60b308ae409b7188168c41b49888452100cc222f4558fc6b7fa551d932b3740240529c9da476089c2584799fe6da5ea80e9528eb5730
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\datareporting\glean\pending_pings\5b62b7e1-f486-4ffd-bd1d-b19720193566
Filesize883B
MD5f5491e925729970d327c45fefaa4bf59
SHA15a8d288eb6ef0ddaa42d00e23e2d2f60c9dfeb37
SHA256ebd0ce847c6ccaba9b611d76f3b80ada5b763a05a94d60005a81f86ccb5553b6
SHA5126ec992f74481a1390f89970ed4f38797e154961a06edb21f698425bf9e7747c90ec603d1dc74b16b05dfade05c12fd356b0b8cefaa4ad4164910fb367ced6b96
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\datareporting\glean\pending_pings\6519d39b-67ef-43ed-bdef-d6c4d80d7ae6
Filesize886B
MD5b34dae24212f8b43cee91c2dd17603b4
SHA16d0cf8ba970c3ec4b61a657eab14ffafd2335749
SHA2569f2c14ea95b3d93f6ddfca2820df6c18ce1607c87e84bd562bfe87c3dccd4e60
SHA512481767e692f5bc0e71d23580de749fbc53acca00c94a5a8da079c9549d566145ed58edf7c963513885aa8977fc55ba0abaf17b44080d2bb1f27a6b6974438680
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\datareporting\glean\pending_pings\72146cf0-9ced-4e7c-8454-a5775bbff2a8
Filesize17KB
MD5fa1609ae0fddcaf6cc4f9c63820cc4c4
SHA1f2929e6ed830dfd67093ab223179c9a7e37d6ae5
SHA2564405dad6317d734ac36208dad7a95cf81659577eb1b9aaecb2f8e21d9b8b7e93
SHA512c82e77ca49ca270b631e00d0cf21db6471a8e60a8dff2eaa12a8785b6759bfebacecd1a4c03e4ec7864e2fe25ff9c0d224c727d44fd416e6add93999fc5c956f
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\datareporting\glean\pending_pings\85e404d8-fd6b-43c6-87b8-23a85ed1429c
Filesize2KB
MD56b5656d0ed41d169c51c0705daede2fc
SHA1ead7aa85bec75f57b150ca6c79029e59937e3c8e
SHA256259cef56535ac9d81f348013a03731f85a20df66eb3eb4ec20fec27e3b400010
SHA512cd13dd778ca8e2980c4c8091481e12e94430da192b90af535a7596177859bdb1e3b847d8b7f04fb3ca6618af2385b5ee2ace8886b5ebca57bf0df28dffff2791
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\datareporting\glean\pending_pings\8f7d3f02-4f63-479e-babb-ff14b4fb02d3
Filesize235B
MD55b394e67e56d2619ffcb37f0fbe2a370
SHA19e9b9bfc3a80ed21c78eed65826f6e81bad382a6
SHA256b202025dc3125c2281502f274d41feca54c8fc61ac458dbfbb1b0987469c6ae4
SHA512ebdb22e285c96eacc0ebaad385e09d6fa7151a345a32e0c6168fb7e7ea8bb707adee28b539f156ca04a8ebf98f428ad45c49880d258296301075e3ffdc9c2f12
-
Filesize
16KB
MD5148d9a6b69977b313db0cca1ca3dd3a5
SHA11d7637f608db624f9d9b63c7b79d1a424c05277a
SHA2567daff05bd11639606e569af8ea560512116348455fc83bfff7bd60b21c03f1a3
SHA5123d84b166270542501ec7ec77c98e821c37224f75dc4b134fea35fdf7c90da84a5ae417fa4b4da94890142f441d2a0ad487b27f0f0e30993825d9e90f4accbd04
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Filesize1.1MB
MD5626073e8dcf656ac4130e3283c51cbba
SHA17e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA25637c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
SHA512eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Filesize116B
MD5ae29912407dfadf0d683982d4fb57293
SHA10542053f5a6ce07dc206f69230109be4a5e25775
SHA256fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
SHA5126f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\gmp-widevinecdm\4.10.2891.0\manifest.json
Filesize1001B
MD532aeacedce82bafbcba8d1ade9e88d5a
SHA1a9b4858d2ae0b6595705634fd024f7e076426a24
SHA2564ed3c6389f6f7cd94db5cd0f870c34a296fc0de3b1e707fccf01645b455790ce
SHA51267dfe5632188714ec87f3c79dbe217a0ae4dfb784f3fac63affd20fef8b8ef1978c28b3bf7955f3daaf3004ac5316b1ffa964683b0676841bab4274c325c6e2b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\gmp-widevinecdm\4.10.2891.0\widevinecdm.dll
Filesize18.5MB
MD51b32d1ec35a7ead1671efc0782b7edf0
SHA18e3274b9f2938ff2252ed74779dd6322c601a0c8
SHA2563ed0dec36754402707c2ae4fbfa887fe3089945f6f7c1a8a3e6c1e64ad1c2648
SHA512ab452caa2a529b5bf3874c291f1ffb2a30d9ea43dae5df6a6995dde4bc3506648c749317f0d8e94c31214e62f18f855d933b6d0b6b44634b01e058d3c5fcb499
-
Filesize
5.0MB
MD5d3d6c7e4649c0dd4412621747848eeb8
SHA188fbe8e7a93d5f6cd5aa46de67a7d88569af0d94
SHA256802b302f264afa0a7ff4f36fef0c262324b0f11e3f761d7221be8f3b09b1c2d0
SHA5122e558759bde23ed13790d2663b853479956974eb19eb480cc8ff46324b8d900c2cd6766949bb392fc2b33b09399264a0cdd4f695f540a19730a0ad6acfcabb64
-
Filesize
12KB
MD5e275c3e9ef690684f63e684504cf4a87
SHA18ecdb242b6a5d0251e2f7cab0ea81f1e4c51e46e
SHA25671ef90365a77173c363abddd37d51fa0dfeba11473491ed0b41095ef70e46c1a
SHA512f500cdf37a01f03ce02fa47988be06582980997acfc33f720c1f255b2831cd8b81e6d157f753abd9a4574a91003f0db39f1333aed7fc062bc3c515baad3eec84
-
Filesize
12KB
MD5e945f23547a61acb64623ca07cedb9fa
SHA191f29758eb81dae37ff0bf4866a2a099f4cdf7c9
SHA256f7136558aab4353fef59a1de0a6abedc159e06137abd189bf647773f083ede2d
SHA5124e53e408212dc91dd1fe7cd483f71f6903d6d6b381691930cc8af72b327b75c798c615414c8c9dd358b19dc1a2372413bcf27215bf54fb6b80c3a9c605022cea
-
Filesize
12KB
MD56acbda8338f60dbc279be2d8addfc6c7
SHA139325b56fb9c0f20771d076f74c064d708ffefd7
SHA256798ce5986dbfba0a1a27e18982e61de1b7ccae10ebc471c344c785a9624aa460
SHA512468515db9969e3a15916b03cba9fd82d74d49f10d87a43b2a1fc984d5c1bfe77e12e2803ca38c424e577e7c1a0508bc2fa4acf50bb4a1b785a8d7ec15512f472
-
Filesize
8KB
MD5d19a41530cabd61046edc3a628e6668f
SHA11451001f7387f5b255d40677f21b9e43b164b590
SHA2568019baf4096f974113bedf204d57ed2bb34aacf6ec4dfcb71cdfda133ae003e2
SHA5120e8abb9e84e173b53da516bd917e7f42503a78cca695456c8cfc11d514eab588fe1ed2dedf904946f84646b5179ed2947f0c914f5f5cbdf4a615289542167b88
-
Filesize
6KB
MD506013ef6f507cb94e85551af16c45992
SHA1ebd1f5fb4533b768cd453f5943e1658c23d0af91
SHA256781cc254d99116fe594e2b27e4fca704982e95e18edb67ba279afc8560dfc6d0
SHA512842dffc7c02a865e01d59f52bbf036060748e7c55d368f70d3a778483b17bfaf65a9a2c779859378aea86aee60b98e9473656a1eb1712e25e86b674d8d83357d
-
Filesize
11KB
MD5efffbce49091219035676813608aa774
SHA14e15c0a7190b21c502c94c2d9df42937ab84447b
SHA256c31378be67806cb05f1464afb41bbcc740ba8491f442156c39fd2a79b0e134a8
SHA512cf5dbf8ecb0d105930a083086d1230bd15cc5f5bca4f69d951660ab7a22edc78101893b31d5c54da7a5cb8981189202adc9d0b484f36efaffb0a007a8b567f27
-
Filesize
6KB
MD56eca13c1d294c95cf33e842ec4600a5c
SHA1663f996774008f60931c095600730a52db68345b
SHA25649afffb70a0e1dca6321a216fb0036216ab256c2f9798ed31d2c27c37c13604b
SHA512f4ca17954c0b2266241f9e1fb2c272c39e4ebb348829cecf684ef435b216b48ee089c3dfa1ea1c3a903f416cdbc3b43a006accc81d7f6687e7f471b8de52b0c3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\sessionCheckpoints.json.tmp
Filesize259B
MD5c8dc58eff0c029d381a67f5dca34a913
SHA13576807e793473bcbd3cf7d664b83948e3ec8f2d
SHA2564c22e8a42797f14510228f9f4de8eea45c526228a869837bd43c0540092e5f17
SHA512b8f7c4150326f617b63d6bc72953160804a3749f6dec0492779f6c72b3b09c8d1bd58f47d499205c9a0e716f55fe5f1503d7676a4c85d31d1c1e456898af77b4
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\sessionstore-backups\recovery.baklz4
Filesize11KB
MD570618154e095e3325d540b731127ad45
SHA16e4c00de4a2f02d20a14e7c4badcecdac6b663de
SHA25612a1aa5945a59f81370608cb5402aba372fd19d56f8b6d82e360ade0e4e04b12
SHA5125517e7987c52f527943e405672c2b07a38c1c843ccb681220f194a7e7fc40f3c71971b2d9e15169fde62c52cf7bcfcde540d492e3e9270fbeb8f383eb2425ee2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\sessionstore-backups\recovery.baklz4
Filesize4KB
MD56f32fce6ff5780ce9a28cd34320f919b
SHA1c14ea709a377164b69c40789ae7fd3c57dd7b9e4
SHA256e993db6744bc56ba38c4f99200dad003cde76bdd04de5c85206b96af2b3380f8
SHA512c970c0be4eb9cf3f185707ff6bfeaa8c0470c8f16e59cec00c7fbe27ae231b10a7e7df94a88ce3af843d5167d958874f5f4c181119c2a065a7d8b7644325e73b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\sessionstore-backups\recovery.baklz4
Filesize6KB
MD51bb94a74b16a67c620ae505c17c74398
SHA182e1bc18a6acc1811cb7aee5351d13b063efa925
SHA256a36836b59de9c8b7971350f15fd26b858f313968f5a9c3437c125feea64e359c
SHA512c63ac9361f7bd1f461562aa379e7558623f8464f515576eefad8c8f5d3a05fcd5fe1b54689cb75517ad4721535fa446f2dd28dde75c56f6bc0caf4f7ea7074be
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\sessionstore-backups\recovery.baklz4
Filesize9KB
MD53442f4c3ffda70f101b404e3ebef5537
SHA1995541fe09b429e0717f36dde1f7177cb22e03d4
SHA25682a8b07de4fbfe07215ffdc7207cc37a3228eec46eb8120b1f7dcfabc5af7e45
SHA512fe8d658bfc5b7eaab04bfff5659fae6de364f9347ba46796627e19edf010a41952fded955025a5cd26b0dfb6d4b434dbde266647ef8be5927444769dc0541553
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\sessionstore-backups\recovery.baklz4
Filesize12KB
MD5ba13ad4757113605f67cb72851efa236
SHA1fc1054bb341f57e2e7a34877cb5294b32995c4de
SHA256012be03bfbc6b354f8713f29bd361d49afd71503600ceec5d822a3029575edce
SHA512831d5a187eddf218be0406ee2a4687374c1790604cce8d3c71d35abf0677e811d8b6c4b78d8bedf03f4a170d1ee134df283cb20cc37a0fe5654eba40c4947661
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\sessionstore-backups\recovery.baklz4
Filesize12KB
MD5c89ba8c7ce2b1bc6d4f9b9ffc6a229a8
SHA111cbad7911526f01f6dc39e3fc6cec114e11df22
SHA25649daa1dcf079e30d1d5cff0b33a8daab0e40f4db9c2309d3e818b78c3e864617
SHA512f169140dda79d036b0ea8b99657597421129b2d3e2aa66ea4e8c163f77e23fa56b42ef0dda726801523b6bbaff9527c00b48821ab9ac078c2cb9f0529306771f
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\sessionstore-backups\recovery.baklz4
Filesize13KB
MD516bba2c7fe80331e16982e331f71cbb5
SHA1030a58c4cfd6bb11ade3aad9d3c426913aa959e3
SHA2566ada26beceea2ccf0be3168ce689551dc5111238581163cced573d2a9a320956
SHA51271144d517e2a7c47b9f36281ea0eab1cf6044a325e0a7dba64710ac164f4898e36eb1f7e6eb80094d1ef51b395554a66f4ce0556cf24daa413f4debb06e370ec
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\sessionstore.jsonlz4.tmp
Filesize16KB
MD5ea4e40d8cb0808b77ca8ed3573ad7586
SHA114aa3234f1537a18f02d3812101a2dd13f09a2bf
SHA2567d718fc1293ee06245bbf8cef5c5aece3c0e1d03b9530cf7a155a0a52dd53bdf
SHA512bf6489f9f1ee97606f6f1cb4cc085946bcd3afd7499d62e7e270724f4cd38173d3f57d30fc31c36ce64096bc225bd32b2bf4c171f1c108f0fa368a00f0566397
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\storage\default\https+++www.roblox.com\idb\3140325527hBbDa.sqlite
Filesize48KB
MD57e4e744394cfa5a2d79854f983c86939
SHA1b939d6978958e4c2e85028354050d6e56b28f5a9
SHA256323064cc1bfc3a0cb0cbff8acd9a908ff8e1454c5b6bbb857ff4391418e55737
SHA5128b245ad154759499b0e5054805b95dd2e4b87a05fc218128be407ef531f75c481bdfba584d62e05817e36180591678e45d300f0f4fd424fc176d74f81381a07c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\storage\default\https+++www.roblox.com\ls\usage
Filesize12B
MD5cadf31df997eed559718f671b488b317
SHA1781fdf5c0cbe836e60b44ee8de2ab6151c502706
SHA2568723b7e3d14ce0a266f98084c0dfc0ae58fdc6de7ae5ecaa00c8235ce754def1
SHA51240ea649b3ff3b332df8e78135dca08e58b4fe82798589a487453693b1fdffed22b07eb987dbf1a17d13923f6c5dce5cbb2a67b9ee8e17504267e453b5496c2ea
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\storage\default\https+++www.roblox.com\ls\usage
Filesize12B
MD59678e188a6bd4c2ded86b157da265391
SHA1792a1834139b52036e2be96371e857472f963908
SHA256cbff1166390b2cc5ffd1ea73e125e172e78dda9f0378aa89f497b7b8794f0311
SHA5123795fa6f1292386336e696de178cdd4333f415f50bb9da62e2aebd618221becd13e836c216fb6b3f6648e6d686dc367ca87a6ceee16239282ec5e51bc8976824
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\storage\default\https+++www.roblox.com\ls\usage
Filesize12B
MD5314b1cb3a63745c8170a71eec76bfb84
SHA1a2cee774dd7cb86ac1b5514d272be1370ad1ca86
SHA256726114cd6da70f9f6345d9c1c32d3b4e47c16466c2b79fcc8053e0a096d8ac0c
SHA5128c84cd1e15b4b66f8a371bf099c4ec8074d21f70b4e2dca476bb7258d13dc28b9a3e77d544786edc8609b559a6101e9974a3f14303ab7140005860176f7aceeb
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ja7zeu9s.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize3.5MB
MD56366a99275d8ec6237cae0021ca60e99
SHA1a6cac2fcb9e8f2e9343c61ddcfc1f3e59cb798a1
SHA25617989da8d98f1915d0b84872ac77113342db38d23033baf9edd73f864b9b3cf5
SHA512aeafc500099c4959b0c6f0dcfdaffeefc3942e8aeae733f1c6ee05bf7463b03469716a8ec3e445780f068d2d6d79c7384eb38fd4e20307a513a3a7f1570edc70
-
Filesize
1KB
MD5fbf8acd5ee1349f2ee2f5f711091c1d2
SHA1da63998bc4209947f22a5358b734ca38d3cc44a4
SHA256c04118204e04174dbf842fcab519ac16d66dd2663d5d57317c1ad16de0e1f26d
SHA51270b8def3a90d72d4df6a60c40db03e3b0d96009930d72bdcdc02baf8451fe50786c522b7de37c99d33100c77130f27c5185a342042115a6c6f0c813cb282a925
-
Filesize
666KB
MD5989ae3d195203b323aa2b3adf04e9833
SHA131a45521bc672abcf64e50284ca5d4e6b3687dc8
SHA256d30d7676a3b4c91b77d403f81748ebf6b8824749db5f860e114a8a204bca5b8f
SHA512e9d4e6295869f3a456c7ea2850c246d0c22afa65c2dd5161744ee5b3e29e44d9a2d758335f98001cdb348eaa51a71cd441b4ddc12c8d72509388657126e69305
-
Filesize
50B
MD5dce5191790621b5e424478ca69c47f55
SHA1ae356a67d337afa5933e3e679e84854deeace048
SHA25686a3e68762720abe870d1396794850220935115d3ccc8bb134ffa521244e3ef8
SHA512a669e10b173fce667d5b369d230d5b1e89e366b05ba4e65919a7e67545dd0b1eca8bcb927f67b12fe47cbe22b0c54c54f1e03beed06379240b05b7b990c5a641
-
Filesize
7.8MB
MD5e7859398c10c098e678bd8fd13681f10
SHA111b731fc9b78dc9a742b2c06b79015fc911fdfb0
SHA256e756ce2935d54ce1f9a57d5518bf47659a5eb4aefef72dae5349d8b013ee7f58
SHA5127a75b55ff6ec09fb777b171e7222a2f3aa58c95d7edd6a60a2bd99010ea95542eeb7ca7e8cc52b93edb0677543d6003fd9b3d08915ee8b8f2b291668c85c4adf
-
Filesize
91B
MD5328e5614cd825515bddf454242aa108e
SHA16f3dfd7e6d830062d4f56251e0ce081eb5af8613
SHA256ccf72e30a4393d93a1236cc3b7b39df0cb6625a7c7244a5714f72ebb9bbbac65
SHA512c8297fd55e8ba81987e8e4a09e359a6f49169389b6066217a459e00564a1aec339a4bed212fcb8f330bccc9365714f21a5d359c095f03b6b3ec8bdc3936d5c39
-
Filesize
666B
MD5e49f0a8effa6380b4518a8064f6d240b
SHA1ba62ffe370e186b7f980922067ac68613521bd51
SHA2568dbd06e9585c5a16181256c9951dbc65621df66ceb22c8e3d2304477178bee13
SHA512de6281a43a97702dd749a1b24f4c65bed49a2e2963cabeeb2a309031ab601f5ec488f48059c03ec3001363d085e8d2f0f046501edf19fafe7508d27e596117d4