8a5f9b67d7dd75bc77573d21098af99fa1de9592efb8968fec656b0c114e6bdc

Analysis

user interaction
yes
max time kernel
148s
max time network
151s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
19/04/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RobloxPlayerInstaller (1).exe
Size 7.8MB
Sample260419-e5zkwacv5m
SHA256 8a5f9b67d7dd75bc77573d21098af99fa1de9592efb8968fec656b0c114e6bdc
MD5 3011d157dba6249e7fd36e540cc77d56
SHA1 22e8897225e1a0d7e6f004f1c0626ffe98039efd
SHA512 ccdea6f78c67d793e35c55e76301d0257f69648ff312af964aaaf844a256ab15cd0f25d2fe292aa30e87125927f96b48f3ab38a2ed6bb90eb8cdb9e222aa613c
SSDEEP 196608:sIaMUIwpEJ1clCwpvphCOP/3CpBGToZE:sG/feCovpUOP/3COQ
TLSH
T1B986BE22BD41C061F9D201B2A6BD6FB65D7D8934573954D3ABC40CB88A709D3363EB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery persistence spyware trojan

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3556	RobloxPlayerBeta.exe
1856	RobloxPlayerBeta.exe

Loads dropped DLL 2 IoCs

pid	Process
3556	RobloxPlayerBeta.exe
1856	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller (1).exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
3556	RobloxPlayerBeta.exe
3556	RobloxPlayerBeta.exe
3556	RobloxPlayerBeta.exe
1856	RobloxPlayerBeta.exe
1856	RobloxPlayerBeta.exe
1856	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\SelectionBox.png	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\VoiceChat\MicLight\[email protected]	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\VoiceChat\New\[email protected]	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\avatar\unification\humanoidClassicAnimateDefaultChildren.rbxm	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Input\SprintButtonPressed.png	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\TopBar\[email protected]	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\AvatarEditorImages\DarkPixel.png	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\ErrorPrompt\[email protected]	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\InspectMenu\ico_favorite_off.png	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\VoiceChat\Unmuted0.png	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\VoiceChat\RedSpeakerDark\[email protected]	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\VoiceChat\SpeakerDark\[email protected]	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_3x_10.png	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaApp\graphic\Auth\logo_white_luobu.png	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\AvatarImporter\img_window_header.png	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\DevConsole\Filter-filled.png	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\TopBar\dropshadow.png	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\VoiceChat\[email protected]	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\MotorCursor.png	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Plastic.png	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\InspectMenu\[email protected]	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\VoiceChat\RedSpeakerDark\Unmuted80.png	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\PlatformContent\pc\textures\water\normal_16.dds	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaApp\icons\GameDetails\contentRating\igrs-18.png	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaChat\icons\ic-bc.png	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaDiscussions\[email protected]	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Emotes\Editor\Small\[email protected]	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\ScreenshotHud\[email protected]	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\AvatarEditorImages\Sliders\[email protected]	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Emotes\Large\[email protected]	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaChatV2\navigation_pushRight.png	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\avatar\heads\headM.mesh	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\MaterialFramework\List.png	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\StudioSharedUI\radio_selected_enabled_dark.png	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\advCursor-openedHand.png	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\VoiceChat\Misc\[email protected]	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\StudioSharedUI\[email protected]	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\VoiceChat\SpeakerDark\[email protected]	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\avatar\defaultDynamicHead.rbxm	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\avatar\heads\headA.mesh	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\advancedMove_noJoint.png	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\[email protected]	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\LegacyRbxGui\Aluminium.png	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Settings\Radial\[email protected]	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\configs\DateTimeLocaleConfigs\zh-tw.json	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\DevConsole\Sort.png	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\InspectMenu\[email protected]	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\MenuBar\icon_emote.png	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\rotationArrow.png	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\AvatarEditorImages\Stretch\bar-empty-mid.png	RobloxPlayerInstaller (1).exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Controls\xboxmenu.png	RobloxPlayerInstaller (1).exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller (1).exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 34 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller (1).exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller (1).exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller (1).exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller (1).exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller (1).exe

Modifies registry class 31 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller (1).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller (1).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller (1).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerInstaller (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller (1).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-9d412f44a6fe4081\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller (1).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller (1).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-9d412f44a6fe4081\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller (1).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-9d412f44a6fe4081\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller (1).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-9d412f44a6fe4081\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller (1).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe"	RobloxPlayerInstaller (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller (1).exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerInstaller (1).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller (1).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller (1).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-9d412f44a6fe4081"	RobloxPlayerInstaller (1).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller (1).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-4e426689616b482d"	RobloxPlayerInstaller (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller (1).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-9d412f44a6fe4081"	RobloxPlayerInstaller (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller (1).exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3556	RobloxPlayerBeta.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
1856	RobloxPlayerBeta.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4052	taskmgr.exe
Token: SeSystemProfilePrivilege	4052	taskmgr.exe
Token: SeCreateGlobalPrivilege	4052	taskmgr.exe
Token: 33	4052	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4052	taskmgr.exe
Token: SeDebugPrivilege	3032	firefox.exe
Token: SeDebugPrivilege	3032	firefox.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
3032	firefox.exe
3032	firefox.exe
3032	firefox.exe
3032	firefox.exe
3032	firefox.exe
3032	firefox.exe
3032	firefox.exe
3032	firefox.exe
3032	firefox.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3032	firefox.exe
3032	firefox.exe
3032	firefox.exe
3032	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 3556	2412	RobloxPlayerInstaller (1).exe	91
PID 3296 wrote to memory of 3032	3296	firefox.exe	106
PID 3296 wrote to memory of 3032	3296	firefox.exe	106
PID 3032 wrote to memory of 5080	3032	firefox.exe	107
PID 3032 wrote to memory of 5080	3032	firefox.exe	107
PID 3032 wrote to memory of 5080	3032	firefox.exe	107
PID 3032 wrote to memory of 2032	3032	firefox.exe	108
PID 3032 wrote to memory of 2032	3032	firefox.exe	108
PID 3032 wrote to memory of 2032	3032	firefox.exe	108
PID 3032 wrote to memory of 2032	3032	firefox.exe	108
PID 3032 wrote to memory of 3092	3032	firefox.exe	109
PID 3032 wrote to memory of 3092	3032	firefox.exe	109
PID 3032 wrote to memory of 3092	3032	firefox.exe	109
PID 3032 wrote to memory of 3092	3032	firefox.exe	109
PID 3032 wrote to memory of 4252	3032	firefox.exe	110
PID 3032 wrote to memory of 4252	3032	firefox.exe	110
PID 3032 wrote to memory of 4252	3032	firefox.exe	110
PID 3032 wrote to memory of 3932	3032	firefox.exe	111
PID 3032 wrote to memory of 3932	3032	firefox.exe	111
PID 3032 wrote to memory of 3932	3032	firefox.exe	111
PID 3032 wrote to memory of 3932	3032	firefox.exe	111
PID 3032 wrote to memory of 5720	3032	firefox.exe	112
PID 3032 wrote to memory of 5720	3032	firefox.exe	112
PID 3032 wrote to memory of 5720	3032	firefox.exe	112
PID 3032 wrote to memory of 5720	3032	firefox.exe	112
PID 3032 wrote to memory of 5752	3032	firefox.exe	113
PID 3032 wrote to memory of 5752	3032	firefox.exe	113
PID 3032 wrote to memory of 5752	3032	firefox.exe	113
PID 3032 wrote to memory of 5752	3032	firefox.exe	113
PID 3032 wrote to memory of 5760	3032	firefox.exe	114
PID 3032 wrote to memory of 5760	3032	firefox.exe	114
PID 3032 wrote to memory of 5760	3032	firefox.exe	114
PID 3032 wrote to memory of 5760	3032	firefox.exe	114
PID 3032 wrote to memory of 5888	3032	firefox.exe	115
PID 3032 wrote to memory of 5888	3032	firefox.exe	115
PID 3032 wrote to memory of 5888	3032	firefox.exe	115
PID 3032 wrote to memory of 5888	3032	firefox.exe	115
PID 3032 wrote to memory of 5352	3032	firefox.exe	116
PID 3032 wrote to memory of 5352	3032	firefox.exe	116
PID 3032 wrote to memory of 5352	3032	firefox.exe	116
PID 3032 wrote to memory of 5352	3032	firefox.exe	116
PID 3032 wrote to memory of 824	3032	firefox.exe	117
PID 3032 wrote to memory of 824	3032	firefox.exe	117
PID 3032 wrote to memory of 824	3032	firefox.exe	117
PID 3032 wrote to memory of 824	3032	firefox.exe	117
PID 3032 wrote to memory of 5400	3032	firefox.exe	118
PID 3032 wrote to memory of 5400	3032	firefox.exe	118
PID 3032 wrote to memory of 5400	3032	firefox.exe	118
PID 3032 wrote to memory of 5400	3032	firefox.exe	118
PID 3032 wrote to memory of 5292	3032	firefox.exe	119
PID 3032 wrote to memory of 5292	3032	firefox.exe	119
PID 3032 wrote to memory of 5292	3032	firefox.exe	119
PID 3032 wrote to memory of 5292	3032	firefox.exe	119
PID 3032 wrote to memory of 5664	3032	firefox.exe	120
PID 3032 wrote to memory of 5664	3032	firefox.exe	120
PID 3032 wrote to memory of 5664	3032	firefox.exe	120
PID 3032 wrote to memory of 5664	3032	firefox.exe	120
PID 3032 wrote to memory of 2256	3032	firefox.exe	121
PID 3032 wrote to memory of 2256	3032	firefox.exe	121
PID 3032 wrote to memory of 2256	3032	firefox.exe	121
PID 3032 wrote to memory of 2256	3032	firefox.exe	121
PID 3032 wrote to memory of 3276	3032	firefox.exe	122
PID 3032 wrote to memory of 3276	3032	firefox.exe	122
PID 3032 wrote to memory of 3276	3032	firefox.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\RobloxPlayerInstaller (1).exe
"C:\Users\Admin\AppData\Local\Temp\RobloxPlayerInstaller (1).exe"
1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 2412
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:3556

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4052

C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1856

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1980 -prefsLen 27100 -prefMapHandle 1984 -prefMapSize 270279 -ipcHandle 2068 -initialChannelId {f0f63cdc-1603-46cc-8358-5ccba87b8455} -parentPid 3032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3032" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2444 -prefsLen 27136 -prefMapHandle 2448 -prefMapSize 270279 -ipcHandle 2360 -initialChannelId {977dffdb-ecb5-4b16-b44d-225a0866e73a} -parentPid 3032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:2032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3784 -prefsLen 27277 -prefMapHandle 3788 -prefMapSize 270279 -jsInitHandle 3792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3800 -initialChannelId {c9fd4294-c865-45de-bb11-fbd3c0ef03f0} -parentPid 3032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3948 -prefsLen 27277 -prefMapHandle 3952 -prefMapSize 270279 -ipcHandle 4036 -initialChannelId {da0823e4-f3a8-4104-aea3-f018103c690e} -parentPid 3032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3032" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2932 -prefsLen 34776 -prefMapHandle 2980 -prefMapSize 270279 -jsInitHandle 2640 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1608 -initialChannelId {1c8ddc90-86ed-4f2e-b677-7bd4d38e9a98} -parentPid 3032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4944 -prefsLen 35013 -prefMapHandle 4948 -prefMapSize 270279 -ipcHandle 4956 -initialChannelId {f27692be-6da8-4d9c-b546-9e48a696a201} -parentPid 3032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5720
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5200 -prefsLen 32952 -prefMapHandle 5188 -prefMapSize 270279 -jsInitHandle 5172 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5216 -initialChannelId {ff726efe-b87d-421b-90c1-fafa897219cb} -parentPid 3032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5348 -prefsLen 32952 -prefMapHandle 5352 -prefMapSize 270279 -jsInitHandle 5356 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5364 -initialChannelId {27c42821-4cbf-4533-808a-843589c3eb5b} -parentPid 3032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5556 -prefsLen 32952 -prefMapHandle 5560 -prefMapSize 270279 -jsInitHandle 5564 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5572 -initialChannelId {e6114f60-bee0-4546-9365-daab022bb9ce} -parentPid 3032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6208 -prefsLen 33071 -prefMapHandle 6212 -prefMapSize 270279 -jsInitHandle 6216 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6080 -initialChannelId {6973d894-e183-4507-b5bc-96956ddeb5b9} -parentPid 3032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4920 -prefsLen 33998 -prefMapHandle 3296 -prefMapSize 270279 -jsInitHandle 972 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6656 -initialChannelId {50a868f7-8714-4a7a-a5c0-e49a9b56356f} -parentPid 3032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6668 -prefsLen 36139 -prefMapHandle 5724 -prefMapSize 270279 -jsInitHandle 7120 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6944 -initialChannelId {5f63b17e-03df-4a09-85b6-3e51b1944ce0} -parentPid 3032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:5400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3028 -prefsLen 36758 -prefMapHandle 4836 -prefMapSize 270279 -jsInitHandle 4896 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6756 -initialChannelId {5a07c6fa-4f0f-411d-8b1d-c2a6e7464bea} -parentPid 3032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:5292
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4896 -prefsLen 36758 -prefMapHandle 6756 -prefMapSize 270279 -jsInitHandle 1272 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6588 -initialChannelId {09c794e9-35ca-4e5a-94a2-917f16e8e10d} -parentPid 3032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:5664
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7444 -prefsLen 36758 -prefMapHandle 7424 -prefMapSize 270279 -jsInitHandle 7440 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7396 -initialChannelId {b6b04114-5f92-45b3-b742-24cad44c9d14} -parentPid 3032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:2256
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7796 -prefsLen 36758 -prefMapHandle 7800 -prefMapSize 270279 -jsInitHandle 7804 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7812 -initialChannelId {07f833a3-b7fd-4622-8315-b97e6362408c} -parentPid 3032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:3276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RobloxStudioInstaller.exe

Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
Size 9.5MB
SHA256 bbf413a40c8aa3bfdf44167f12f40b12f7bf5428925ee5e628416601a4064ae4
MD5 d15b05f13cc22e65dff4ed6c0ea6a4f4
SHA1 7cb4025dbd9fa9dc229b1a327cde8a0c9ae27249
SHA512 1e82163e1603d93e9e2409432923043c329f653b36a12b284b8e1b5d6f92edad4022ace52315d85431e8d522db6e2a446cac1a8cfcde72cf0a158035d5c9ffe1
SSDEEP 196608:x4PQlojheOkR8jCp6VdGOEF6wIfE9nmRKa0BBsLQs:xwLkWGXF6VfE9nmRcBs
TLSH
T1F9A6CE12F940C031E9D202B2A6BDAFB65D7C99241B3944C767C45DBC4A705E33B3AB6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.dll
Size 15.5MB
SHA256 80e1c990de61dc21b61a9c3f978236bfe1266cd0cc09af4673f9d73d91b3d8c3
MD5 1cbd430b2924d0686d6dbbd0e3faf168
SHA1 08ea475fcdfc0463ddf3bf393c90d7081b6a1ec9
SHA512 5b8d3d1c8d8b370619b4719aa03efd17891cd647e2d595828c8e0a0830897eb72d5478641c792877973e86c2fbdc7add46167222eaae3ead55f31c6bc4e5de95
SSDEEP 98304:Kf/AG0tdGNAnLI7BPHfoR8pRLlXSyTN52m6iof2+5Q3NKGv4qyDDo7W7Pwi/qWND:Kw/WpnRLlJx+fL63Bz9i/qo
TLSH
T18CF6BE5EF4E249A8D0B24035E15F13D3EB12B0CC476C69F707AC51503AB369EAA19F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CD1C116DEEE8F4F97C1806976E10E7E2B349E486

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\b76ajegq.default-release\cache2\entries\CD1C116DEEE8F4F97C1806976E10E7E2B349E486
Size 13KB
SHA256 d950c4a8d89a443393b6b19413e55075948e16d5ded62be01853301db8dd505c
MD5 2f0a4ea657aa9eacb5c0713b82f06f67
SHA1 ef2c9d3357ab8b9633ee37f8e55b3dacc1a4c1ed
SHA512 04fb24bbc825308c2069786d237ff06a0c8b7e2f932ed7f445977940b9c4841eaed79302f4b4a4972554ad83cac77c0fcf0ebb4af52ca09a784503adc78fd1bb
SSDEEP 384:HbaFrLiO024YqFuhw+5EL1pPsac4j0lpDII+gls:7aAZYqFuK+5EB9sac4ID8Lv
TLSH
T1AE528E7E9F013CBA1B2BD294DCA99204CE04D6BBEEE2D15605143944C684379F4F54EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b76ajegq.default-release\AlternateServices.bin
Size 10KB
SHA256 3299f0986c334c1c74f567646860ad64446856d560b494e99cb435ea0bc90a74
MD5 4eb1b2dabe77fc4b32551ce2a5957f9e
SHA1 0daf5b061ec8cbcd82d50878b4ead7fae2fbe143
SHA512 13cf6e5a623711c60506bda96a4d5d4809d7faf41f311a6e1866eb182c78fa77de9da623fcdef3c1531fc62d9fb16a80972a02d0fba0bb9dc4a96d2dd56f07f0
SSDEEP 24:DuhMZX491TI9xoHUB9BEHE9VvqHP5q9F55A5BHO39lSHh9BbN:kBCWUTqmB+RI56BOcz9N
TLSH
T13F2253E76B72A4A2F052CFF0C098758CDD33132529AD9184C75880F306C9B99E13FBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b76ajegq.default-release\AlternateServices.bin
Size 16KB
SHA256 2c1c758341b349da848ff7f22382969b798cd083eb808d1472dc6e9c83d4e4b3
MD5 e97343bc76102ed3621028975d674d35
SHA1 996e5bf05bceb719a65e980b6f80fd81eb23771a
SHA512 15b68c2a808001ecef8e9b517bba8da6a41b693ca3c9b9925fb82816f7624707466758ce9916ded182ae2684980968a3e34e765d171b12f1f6d2cbab13451000
SSDEEP 96:XgvzOAfOoBrcI568Z5xxoTM/pVRtY4AFGoRGbG:ZQI/
TLSH
T1F37293F76B72A462F092CFF0C498758CDC33172524AA9194C76480E306C5BD9E13FBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b76ajegq.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 4eb2a6fda36feec583590bb7cbeaa5970756744bcda850f0cd3137cf14fcfd44
MD5 805a50727c0e6b9b975f8db1c8dc82c9
SHA1 d6c14afc8d7f093dd27c055571896f88bb40be76
SHA512 fc2f5091cf8836fd20babaec698f569826f629f3282c93a91325fca831adb8271032708c4765483684bf25d98da1395d9b282fa9ae67d70a77b5be41c3c24b79
TLSH
T18061A858F6288A3FE445413ACC966B411F343856A8AFBF2A35AC604D1E5B3CE76CD07D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b76ajegq.default-release\datareporting\glean\db\data.safe.tmp
Size 27KB
SHA256 b35b57900857415467045ff8a1f2e97990930abf02e66a3b2e525639f751b096
MD5 66676c25e08419ecbfcd7350d31dbbfe
SHA1 efba27f6f24509d3adc85d438c13d955ca52e99f
SHA512 cebc4d80d6f6621e02348aea6401188471b4b840dd2ed50a34be44dec1337ddb36df17ae9aef6bc23b8bbad993adc2c5a8bc012f631d207f978a0cc565895e34
SSDEEP 384:XboarsyjIOOCipYLwpO38qGcmhuU8OSKPHGKRbSbzD9d66Joz1zgC1jd:rA+OObHGcmhuNbKPHGKRbSbX6P/
TLSH
T12CC2F044FB2A953FC41512BBDCA547002F79B88A58196FA73A8C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b76ajegq.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 768953f7a51880d49a9adbc2e60f6afab000ac49a165e86ab3732a4b8392793a
MD5 1f5a41f3a4cc2199efa073b293a4116e
SHA1 2924419da6ff79ba07470c1e93f857963bf94c2c
SHA512 087f0deb22fc6bf955da8cab629a6576fcef450463572e509eb5847cafe476d7591508fbe280557eec9a53a39b0304fb3cb0e780d93a6dd8676ff835a0e552e1
SSDEEP 192:sOv5zbojbrsyjURb/+C1d66Joz1zgCl6mc0dz:Pbojbrsyj89d66Joz1zgC1jd
TLSH
T1C8D10064EA28863FC445133BCCA61F410F39354BA84EBF2931DC65082C5B2DE768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b76ajegq.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 36d361917b97be6dbfd3d3110522beb666932f29a0bce18e1d6d1028d0915b8c
MD5 041fe6522b4ab5d4061d73e78bf3be86
SHA1 5232afba5be72508ac7347e11469d48197a781a6
SHA512 544d901498581df30c848820d8a3e17a4e346817beb76ea07037ec01ef17ca6107d6e15e1bf9d5eee9f2ba4e9ef9fd16356f69b26e80a78153cbc5721197fa56
SSDEEP 192:vOv5zboArZrsyjgRb/+C1d66Joz1zgCl6mc0dz:AboOZrsyjI9d66Joz1zgC1jd
TLSH
T10CE10EA4EA28863FC405137BCCA61F410F39389B984EBF2935DD65182C572DE768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b76ajegq.default-release\datareporting\glean\events\events
Size 1KB
SHA256 c3eb3b16485309a40d4f36178822d125d5a3f4e3c40bad19c497838c202330c2
MD5 3fbe566c93b37ac3666f3ede4ecc70bb
SHA1 4017e7e4739f273b485eb3265ab2f2fd44e1f0d5
SHA512 9647e7129f7a87e56cc4a7c20b0ede4692788fd80b27b544ed6188119d767778d1ce7769bbd64b68e0d1205714eed762919b50fa309384bc994f6410f87732e1
TLSH
T1A1216A4C3AB94D2A68C7F26CF94102CE53554E0A14C71C430E02DF8DCD95ED9316B8B9
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b76ajegq.default-release\datareporting\glean\events\events
Size 4KB
SHA256 b2023f964ab68e7b77eadbf5bd3839d9c67cc99519dd56c7f35da1571df67d3f
MD5 94940787cfd6af975e59d44fb58a210d
SHA1 25f8ef4c97f09ca746394df90ab5ce44ceac0a46
SHA512 069ad59d1bd08e7a11885e0a5531bbc9058becf47b2fd0d8e76935f213ef85c615f84de8287392f6ab1d045c9de52deb321a9af39d4eacb931ae14314a585f31
SSDEEP 48:YEtDbYAgT//fWKQVg/i/X3mkwYCdg7o7ZaO7V4UF0ycpYradE7qIo+MXgdT8sq1o:2Q3mrdgKx4UFjedErovwdXqDsngpfyL
TLSH
T170A10D1D72A90C7E39DBD39DF84103CE46988B06A4CB19474E8BDE48CC89E99315F179
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3fb2a774-57a6-4151-af9d-954ad494a780

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b76ajegq.default-release\datareporting\glean\pending_pings\3fb2a774-57a6-4151-af9d-954ad494a780
Size 883B
SHA256 0d3ba89a5efc68f1c54e500143e9532e7e6889e9dce6c7cf85b778e22e670df0
MD5 f601e31c204c650320b1b528f2d604cd
SHA1 be9ba3c0cd1f99391f38c0c3325150880826fc7f
SHA512 00c8a2d684296494658cae3b0f0e00e6e7c53992f39da2b363845cd6d098b2fd55c3f262d830b1e18bf80c1ed0ff4eb8558f183b5c0b62643d06f124094ed08d
TLSH
T1E41100909734BDB2CD29C34BC5957B524BE8742380CAD4103EF19E18087B92EE39A207
MD5 SHA1 SHA512 TLSH

Submit Download

4b1fa075-bbe3-405d-a486-5f9803d73554

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b76ajegq.default-release\datareporting\glean\pending_pings\4b1fa075-bbe3-405d-a486-5f9803d73554
Size 235B
SHA256 5f7fc9ee41869ba50c49c6f371a3f3217ffab51ddf2d0e5a197707a5e15951be
MD5 8c2dc792f2b5eccfd6182ed01ef40be1
SHA1 1caea464742ecbe411d572e6bdc2cab2d2609837
SHA512 43b31136722b4fed709b00735231c30e07ca76ed8e2eb3c0371c7b661bb2c673daec2854f8cc9da1dc70712be078f865d570826f3dc5972a95bad6c050798a8e
TLSH
T179D097C028986BAC08040F03F0E06CC6305C4C3310A99C30966001B8ADB9AC82262C4B
MD5 SHA1 SHA512 TLSH

Submit Download

6be36525-7e93-4ef3-80f3-bb9cdafba1ad

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b76ajegq.default-release\datareporting\glean\pending_pings\6be36525-7e93-4ef3-80f3-bb9cdafba1ad
Size 2KB
SHA256 121be1e9865d28b4f81b07f8825180748547fb76bd05d142264b33c8720b44ae
MD5 6067bfc1b7dfab821ea4d0f811fdd3f1
SHA1 fe6343d05cdf8f5807ece98553c7afae3641b0fc
SHA512 cf6bcf27303e16d13b7624c5f4a5053bde7281eea6318286b95af74226be9814bf5657767a1f69896a1e67b9b1238190c8207e77346ac74f26166a0f7fe66471
TLSH
T1D641336835788CBA9CDBF19DD582334E57A4891310C65C832E91DF0C8D966DE73AA42B
MD5 SHA1 SHA512 TLSH

Submit Download

81d7d22e-91bd-4d21-9343-9b46a3374bba

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b76ajegq.default-release\datareporting\glean\pending_pings\81d7d22e-91bd-4d21-9343-9b46a3374bba
Size 886B
SHA256 a5f4fd87b50a111e7cd106fd4440810ff97b22740a1ea6c25b866b90246d4696
MD5 6176344f5a9070be887af234a23ee79a
SHA1 c02f1b1f8552a584b15f996f5cbc4b1c06deb7f4
SHA512 89c236c0db8045fdf91fdabcf1a51886dd5616bbf6332ddd41519a6ceeb2d5530f6edfd927ed05a1b9c189b11d9d249763ef423e66eb9861bbedb08eb61f3a28
TLSH
T14B1127508A3479F3CD78D287D4D577424BE8741390CAD4047DE05B180CAF52FA3AB207
MD5 SHA1 SHA512 TLSH

Submit Download

e154b020-b880-4e86-bbdb-12708345cd6b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b76ajegq.default-release\datareporting\glean\pending_pings\e154b020-b880-4e86-bbdb-12708345cd6b
Size 235B
SHA256 f264b839f5096872b5e4ade0dffdb1c1ba23ba0cf257f6774ff62777b635d7e5
MD5 ee6dc1b8342a8e9b1f4db26d507eac65
SHA1 e8bd86dffa9d69034e18668179f84ac9fd77e324
SHA512 3e22cf914fef4a4b252e12ad53c755c32d2e34439532e5ea9f1fad37d29e272d50b7adfeb900abacfefde4f86ae1071038939f88b7b1069cbbb35c5fd76df2f6
TLSH
T114D097805888A32E08140F02F4A069C670884C3324B89820CE9046B89AF9ECA825180A
MD5 SHA1 SHA512 TLSH

Submit Download

fded1ebb-4a95-40b3-911b-dc3c4bee9806

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b76ajegq.default-release\datareporting\glean\pending_pings\fded1ebb-4a95-40b3-911b-dc3c4bee9806
Size 2KB
SHA256 6d9fd148c6e1df27368809b54a034b73d07cf37e1be74be7093149526998fe50
MD5 4c826a3d2422b3683b930d50213bfcd2
SHA1 7c45dce63b4617e57762004f64d475afbcf12c36
SHA512 507045140a60c1c8169ff2aea1f6d15c3e0a9d61d1605946a66ae17c8398accb7f6a1c06a7c01abbe0d3c441615a9061051d53c01c3baa0a14dc66a1d3776221
TLSH
T1CB5194654260C87EC97DA30BD9213B828BF3140A409B184EAFE8AE0E117FD5E9399645
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b76ajegq.default-release\extensions.json
Size 16KB
SHA256 b1a4c3cbdb63313be836aa1c04740c0d4d4c963acb70fbc57e6e148e6ec7e982
MD5 2abad0da3d8234560728baa67ece1d28
SHA1 fb27e080c7413674fd64843a66d33db3183447b1
SHA512 d034c6a67dae8158883a7b8b8ab34a2b607a43b1f8c5d8f6627e8dcd34782c1ac95ddf24b8966bd7e02ef484a88579ce845a20a1a88be1db009e9705ca664f13
SSDEEP 384:/XukI4v1Umldvn8dhWU94zy96oHL4HpL4PpL4HZL4H6L4HXA4hn:fBI4dRfkX54S644h454x4o4Q4x
TLSH
T19D72431545049EB8294FA79AAA367E02C37D473B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b76ajegq.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b76ajegq.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b76ajegq.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b76ajegq.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b76ajegq.default-release\prefs-1.js
Size 8KB
SHA256 4eb68274b2036c9f61f2500bccdc03537424459e330ab5adaee81626f9598296
MD5 cd836670058a0106bfdd93a48dd2f91e
SHA1 dec496a170b73bb1cf1ce57205595e05625c4a9e
SHA512 c649bf1eb83eecd8939ff1a67db464bddea1ead38c364c8efa771d44bc5c48c955dca85d6e2bb79acb1914108d05942aa1d71f258eb9a44f6c66d6355a5640d0
SSDEEP 96:xHKtTUdqGqZtMf9gQNbzSLHFSSladv9j/Wn34WRQ9CsBw88vK8L4cnh/pGS:8NRIf9gQMSSxLRWBw88vX
TLSH
T11702EB785108CF7F74B6766CAC2889715A72023BB6BF68D610B984C4055CF3851FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b76ajegq.default-release\prefs.js
Size 7KB
SHA256 f35ea78003ab3f646a68a12032725c657221ccc3e342a2af11039b9a1012c57f
MD5 8c7d09b982553801a1250f94875468ae
SHA1 56d0763f4bf9fa208a969f55e63eb089387a7e4c
SHA512 759999620f7236ad3fc4671b80802e0675119f5c408397a273ec98ebb8810d11d5ec3386fb23aff108f67a014394a77bc27fc98761f086bf2540743c1db37af2
SSDEEP 96:xHKUTUdqGqZtMfigQNbzSLHFSSladv9j/Wn34HRCrBw88P8L4cnhQpGS:8QRIfigQMSSx+wBw88r
TLSH
T165E1207851088B7F74B6766CAC688C71AAB2413B7BBF68D710B544C4050CF3441FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b76ajegq.default-release\prefs.js
Size 6KB
SHA256 02e61e4bf46c55462e8aba63253379a3f1c7523adcedf75933072de6b3258daf
MD5 d634dcd2b626d959da18b247a0a2526c
SHA1 e64b4156fcc5b2955da3dfe4145207e2b9f0539e
SHA512 28203a4de609c570e1ff64c80f5575ae83d296a0868f60e1cec3a2f4ced80ac495228002d11ae792ceed163f79f72610a57df1a42723ed253789854847ad0b22
SSDEEP 96:xHKUTUdqGqZtMfiKjHnjX1zSGoSSladv9j6n34HRCrBw88P8L4cnhQ8:8QRIficjroSSd+wBw88E
TLSH
T15EE10F789008CB7F64B67A6C6C688D716AB2423BBBBF68D710B55484054CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b76ajegq.default-release\prefs.js
Size 6KB
SHA256 0629d8fd02103c827c397be64a63bf4c9a913ce760d31d3ec74958a773cb0add
MD5 34c4fb1ddcb308d1e94cb0ab0f2e49ab
SHA1 d62a40958b0fe0ed27646d4d783f6c1a47586209
SHA512 11c2d1ee52af6b6b9905282f06a801faaa50f11f35d2f03e50636f534b56bfa7d6eceb3c16dc6092a19c013384c791244ab978e67336a1990e783176cfced46a
SSDEEP 96:xHKUTUdqGqZtMfigQ1zSLHFSSladv9j/Wn34HRCrBw88P8L4cnhQ8:8QRIfigQASSx+wBw88E
TLSH
T138E110785108CB7F74B6766CAC688D716AB2423BBBBF68D610B554C4050CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b76ajegq.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 0ff97a3b65d7641856f6b4918ccf754f8fd774e9261249c98fe285362fa20632
MD5 439487a00b650f877bd61d8bd423340f
SHA1 20faad8657a97820e573ba0fc88d2e37bf8082cc
SHA512 eba8ed753d2cd2de53ad943516e13a3d001d8abe6b0812d2b6e6f6b773de67567282b7c1799a3af06a724063f3f6485ed5714c1dfe587501129c714ecf7e7c48
TLSH
T12321C652CD272DFA7A08923AE4CA4FE2C61A2030847740B0411E8A9261DF45EBBDB208
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b76ajegq.default-release\sessionstore-backups\recovery.baklz4
Size 9KB
SHA256 4e43c0490f5f875cd392e58404899e9ef8f05037d409436490846dda5956297f
MD5 ae99c6c025ef75c0bfa39e87a01c0447
SHA1 3a1de955c0447ccf5490e4c430c4452d6491e5f8
SHA512 6003f0e733f5e66eaecb0dc77b9e51611e5491cefc59a2025fc8d52ac9de6a30112f058f544a7704fd14075d5198348d984728ae4d168cf4d0db646a372ef4cd
SSDEEP 192:0jMndY19MG2hy15zLTM/gk+ZoeLYnrb2G9+X0cgo5:4Uw63hC5z/M4hmGIp9G0cz5
TLSH
T10A12AEAFD41EAEE21959A47400CD27FD16F31254C7F84865881A3F3A52BCB152E2C39A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b76ajegq.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 840651e10b23b8fd46a66098d22e087c902768319c6e2b6da1fbf1fe4cf9e979
MD5 03b5f7e349e0574f62339234b2ba408a
SHA1 fc475f7be6233c3134f99dc45c33025df7f66dd5
SHA512 d209fc0b30cceb2d13e43fe383a63954cb3f53dcba23c8b244a3c91318f035796684dae2f16b7dfa21fdc65bbeb405d61657ec3fe462f87875f733b8f6335517
TLSH
T1C2514CF61C1F7CB73530C1529CAF0FD1C9D3206025AA90657E199A2341DC21FE856B4F
MD5 SHA1 SHA512 TLSH

Submit Download

{f3102af8-d0ea-4178-84e1-26b7d9303e62}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b76ajegq.default-release\storage\default\https+++whatexpsare.online\cache\morgue\98\{f3102af8-d0ea-4178-84e1-26b7d9303e62}.final
Size 1KB
SHA256 1381f806163681285c620c6019db54dff21fcca99a37a1799657f1ec34c7939a
MD5 0f8b6e3c4776a87ddd025fea2290fd60
SHA1 9fe25cfbf75ad54c04e1e98c20bb27af7f2985df
SHA512 175337b232dc0753373d4c112d513d0d343153e909906f302e4fde06c29670d1c8434a62975b387619cdc58b747ce0103c4c2886becf4567da41030109f3839e
TLSH
T15B31093A4785724513D1D31E4CE27268301A158E578088DBB9F4BF66A44061FC0FBA07
MD5 SHA1 SHA512 TLSH

Submit Download

usage

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b76ajegq.default-release\storage\default\https+++whatexpsare.online\ls\usage
Size 12B
SHA256 c48667a1c4849c56e8d39a6f98eae522e8c7fea3ebffa05a5930e081fb0b6cbd
MD5 8b053a14a7203ccd4dc28caeea407359
SHA1 2003a54795c87b740cbaf0e5d4ffb005e60bb6c1
SHA512 82d2a5931e41decb2648453b1b997dd05b3607ab996c51744bcf33f59f6347b5f7c61e3556ea6e0d9e46eb2ba46267de5dc07a9d2288e3354c5c1dd943b8e86a
MD5 SHA1 SHA512

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b76ajegq.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.2MB
SHA256 679a63b725e6c315a05ef39cd2b34d9ef762d7f76065c30c355ca3bbdea6a661
MD5 3acfc29a338d815990d8b130955f80f9
SHA1 01f5ebc3f828f180749828ff468d7b0b8850d883
SHA512 e4d552c4ca9cb13c2ed134e072523c54a6068a8f3ba56b29cf7960d86ce43f30a0679d3d17e77cfd190eed82927ef5c9018bbc90ef5e3d44cc0a58b42efb35a8
SSDEEP 24576:eNdnG55MrkLIa8GUL5V+eSEhWalpsXymeiP0Da:ejJgLv8NL5V+eSEIq+Xy3iMD
TLSH
T1E7F52AF82092B357F3418033A64593EB21AFD00C6467DE044BA956F895B9CEF9E05B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b76ajegq.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.8MB
SHA256 2f680a1b2b68e2bdb648faf8f5ae795b011f2455601f24c4af3756cb6dc5e67b
MD5 9a7fc5dc77c848897a972edd216b80e5
SHA1 22daced64ec64ae40a637d084a374c0352670741
SHA512 2ebd0b9f81e3abe841c458b0b0fcd62d51ff3b42509b26e29f4878f5c13b29871a6c025947b7c50ff60c531b8b8fd0e987cd95bcc45c7af583da867c8183403b
SSDEEP 49152:HC5x+jnmWUeRQWx4NduEKcLsddmwztYGmVE8xDIaQtF66QdhVlijpXUHR8aeqeAz:i5UZUeRQbNduEPA3
TLSH
T1CF566DE420E2D252F38540B3719A53FB10EFC01C60768E44579896FAA5B8CEB8D977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b76ajegq.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.8MB
SHA256 cdc9508b427134faadb705f1bfa79030ae1afb6f1c1781d2ed13c52506b2c158
MD5 3e262b0865092847dae8278a386b4210
SHA1 df0dbdbd162947c7f3d9968f16d892e2995c97bf
SHA512 a836bb19156081f3db84a52f0d03151823433f80b7740217137d4815ab8f2cfbdcfac4b89f1b0c57661118750392147cd771eaf2d5f671bfbecc62c4f724ba1d
SSDEEP 49152:xykRRVaAIoW8zN6wlcYRwlxdW4xE7uP5kuG/VBNHyBYNp+HS2Nax+jkmiUbRQWx6:RPUEUbRQbNduESGc
TLSH
T110566DE420E2D252F38544B3719A53FB10EFC01C60768E44579896FAA9B8CEB4D877BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1856-96-0x0000026E06050000-0x0000026E0605C000-memory.dmp

Download

memory/2412-27-0x00000000089D0000-0x0000000008A0B000-memory.dmp

Download

memory/2412-93-0x00000000089D0000-0x0000000008A0B000-memory.dmp

Download

memory/3556-73-0x0000020601210000-0x000002060121C000-memory.dmp

Download

memory/4052-85-0x000001F17FF60000-0x000001F17FF61000-memory.dmp

Download

memory/4052-77-0x000001F17FF60000-0x000001F17FF61000-memory.dmp

Download

memory/4052-79-0x000001F17FF60000-0x000001F17FF61000-memory.dmp

Download

memory/4052-78-0x000001F17FF60000-0x000001F17FF61000-memory.dmp

Download

memory/4052-89-0x000001F17FF60000-0x000001F17FF61000-memory.dmp

Download

memory/4052-88-0x000001F17FF60000-0x000001F17FF61000-memory.dmp

Download

memory/4052-87-0x000001F17FF60000-0x000001F17FF61000-memory.dmp

Download

memory/4052-86-0x000001F17FF60000-0x000001F17FF61000-memory.dmp

Download

memory/4052-84-0x000001F17FF60000-0x000001F17FF61000-memory.dmp

Download

memory/4052-83-0x000001F17FF60000-0x000001F17FF61000-memory.dmp

Download