Analysis
- user interaction
yes - max time kernel
149s - max time network
156s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
16/05/2026, 14:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
RobloxPlayerBeta.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
RobloxPlayerBeta.exe
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
General
- Target RobloxPlayerBeta.exe
- Size 121.2MB
- Sample260516-r5wkfae16w
- SHA256 4f5bf65e87ced8e5bb263eeccb63606668982d9d79f0963a5c253162754462e8
- MD5 fc7a6271e31189dc2a83f2eded0217cc
- SHA1 12d7de92e9b775b276f0e1ec6742da3909661d18
- SHA512 d7ac5d0414da491ae9853aa8117e9f5a8de1d6d7d9f5cb85b16c191342a2e675c46e8c3f7063e87e92c3f0d80fe543503e1b44f4ca90c80782a39cef5cd24e51
- SSDEEP 1572864:DHEclWpJ6kHflYPOqnjuvsLNJACW4lSiXdi7yErIZgWggJyP/NXOVdjxkrfk8JYA:LEcE6k/0Oqnvz/rdvw/hsdjxsfkNA
- TLSH T1A35812B6F70199D2E40BA1389D4742406722BDB49A51238B75E8F30F5EBE2CD4F679E0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Drops desktop.ini file(s) 3 IoCs
description ioc Process File opened for modification C:\Users\Admin\Documents\desktop.ini firefox.exe File opened for modification C:\Users\Public\desktop.ini firefox.exe File opened for modification C:\Users\Public\Documents\desktop.ini firefox.exe - Checks processor information in registry 2 TTPs 18 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings firefox.exe - Suspicious behavior: LoadsDriver 6 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 680 Process not Found - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4240 firefox.exe Token: SeDebugPrivilege 4240 firefox.exe Token: SeDebugPrivilege 4240 firefox.exe Token: SeDebugPrivilege 4240 firefox.exe Token: SeDebugPrivilege 4240 firefox.exe - Suspicious use of FindShellTrayWindow 22 IoCs
pid Process 4240 firefox.exe 4240 firefox.exe 4240 firefox.exe 4240 firefox.exe 4240 firefox.exe 4240 firefox.exe 4240 firefox.exe 4240 firefox.exe 4240 firefox.exe 4240 firefox.exe 4240 firefox.exe 4240 firefox.exe 4240 firefox.exe 4240 firefox.exe 4240 firefox.exe 4240 firefox.exe 4240 firefox.exe 4240 firefox.exe 4240 firefox.exe 4240 firefox.exe 4240 firefox.exe 4240 firefox.exe - Suspicious use of SendNotifyMessage 12 IoCs
pid Process 4240 firefox.exe 4240 firefox.exe 4240 firefox.exe 4240 firefox.exe 4240 firefox.exe 4240 firefox.exe 4240 firefox.exe 4240 firefox.exe 4240 firefox.exe 4240 firefox.exe 4240 firefox.exe 4240 firefox.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 4240 firefox.exe 4240 firefox.exe 4240 firefox.exe 4240 firefox.exe 4240 firefox.exe 4240 firefox.exe 4240 firefox.exe 4240 firefox.exe 4240 firefox.exe 4240 firefox.exe - Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 1952 wrote to memory of 4240 1952 firefox.exe 86 PID 1952 wrote to memory of 4240 1952 firefox.exe 86 PID 4240 wrote to memory of 1572 4240 firefox.exe 87 PID 4240 wrote to memory of 1572 4240 firefox.exe 87 PID 4240 wrote to memory of 1572 4240 firefox.exe 87 PID 4240 wrote to memory of 3360 4240 firefox.exe 88 PID 4240 wrote to memory of 3360 4240 firefox.exe 88 PID 4240 wrote to memory of 3360 4240 firefox.exe 88 PID 4240 wrote to memory of 3360 4240 firefox.exe 88 PID 4240 wrote to memory of 476 4240 firefox.exe 89 PID 4240 wrote to memory of 476 4240 firefox.exe 89 PID 4240 wrote to memory of 476 4240 firefox.exe 89 PID 4240 wrote to memory of 476 4240 firefox.exe 89 PID 4240 wrote to memory of 2404 4240 firefox.exe 90 PID 4240 wrote to memory of 2404 4240 firefox.exe 90 PID 4240 wrote to memory of 2404 4240 firefox.exe 90 PID 4240 wrote to memory of 5080 4240 firefox.exe 91 PID 4240 wrote to memory of 5080 4240 firefox.exe 91 PID 4240 wrote to memory of 5080 4240 firefox.exe 91 PID 4240 wrote to memory of 5080 4240 firefox.exe 91 PID 4240 wrote to memory of 4236 4240 firefox.exe 92 PID 4240 wrote to memory of 4236 4240 firefox.exe 92 PID 4240 wrote to memory of 4236 4240 firefox.exe 92 PID 4240 wrote to memory of 4236 4240 firefox.exe 92 PID 4240 wrote to memory of 3692 4240 firefox.exe 93 PID 4240 wrote to memory of 3692 4240 firefox.exe 93 PID 4240 wrote to memory of 3692 4240 firefox.exe 93 PID 4240 wrote to memory of 3692 4240 firefox.exe 93 PID 4240 wrote to memory of 1440 4240 firefox.exe 94 PID 4240 wrote to memory of 1440 4240 firefox.exe 94 PID 4240 wrote to memory of 1440 4240 firefox.exe 94 PID 4240 wrote to memory of 1440 4240 firefox.exe 94 PID 4240 wrote to memory of 1980 4240 firefox.exe 95 PID 4240 wrote to memory of 1980 4240 firefox.exe 95 PID 4240 wrote to memory of 1980 4240 firefox.exe 95 PID 4240 wrote to memory of 1980 4240 firefox.exe 95 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\RobloxPlayerBeta.exe"C:\Users\Admin\AppData\Local\Temp\RobloxPlayerBeta.exe"1⤵PID:3764
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1992 -prefsLen 27100 -prefMapHandle 1996 -prefMapSize 270279 -ipcHandle 2060 -initialChannelId {9415ac28-5a8a-47b4-bd48-6c0010f34322} -parentPid 4240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4240" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵PID:1572
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27136 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2448 -initialChannelId {88c35465-f5c0-4a72-b3e0-775f0bd97bec} -parentPid 4240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵PID:3360
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4044 -prefsLen 27277 -prefMapHandle 4048 -prefMapSize 270279 -jsInitHandle 4052 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4060 -initialChannelId {2d14579c-80f4-4dee-8fdb-de525b4e73ca} -parentPid 4240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
PID:476
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4212 -prefsLen 27277 -prefMapHandle 4216 -prefMapSize 270279 -ipcHandle 4300 -initialChannelId {aeb32f8b-37c2-4792-b8f2-64255e63c900} -parentPid 4240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4240" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵PID:2404
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2632 -prefsLen 34776 -prefMapHandle 1244 -prefMapSize 270279 -jsInitHandle 3392 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4020 -initialChannelId {cf78f1d7-c01b-4bf7-be45-d5f8f6a9278e} -parentPid 4240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
PID:5080
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4888 -prefsLen 35013 -prefMapHandle 4892 -prefMapSize 270279 -ipcHandle 4900 -initialChannelId {53f631be-d4ab-4096-a235-db8fae3938b1} -parentPid 4240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
PID:4236
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5164 -prefsLen 32952 -prefMapHandle 5168 -prefMapSize 270279 -jsInitHandle 5172 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5180 -initialChannelId {5ab9c06a-9561-40a0-8193-2f18de07da47} -parentPid 4240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
PID:3692
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5200 -prefsLen 32952 -prefMapHandle 5204 -prefMapSize 270279 -jsInitHandle 5208 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5216 -initialChannelId {efc5c445-e970-4437-946b-4d450c68a072} -parentPid 4240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
PID:1440
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5612 -prefsLen 32952 -prefMapHandle 5616 -prefMapSize 270279 -jsInitHandle 5620 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5196 -initialChannelId {5463dab2-b3ce-47e3-a414-dcb72f230c07} -parentPid 4240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
PID:1980
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\F58F0605C722D0D848D03D88AC8E3E50223F57B0
- Size 13KB
- SHA256 90bd90d430eaa819d931c59cc3ff59eb0ad56f96502f51bf5c5986a51c180cc5
- MD5 f12faa20fcf66cf46850440a2e21d099
- SHA1 8a3cccf75bed664c61151a7656ae8db2ca247da4
- SHA512 587acd0b1aa3b6ff583be54957d8e8a3ec2d606dc69be4f7cdc378fe10daa32d136a2221d352bb2d6bbd3b44e0a20efc9fba5c9b19eae4273f0ee78058c04c44
- SSDEEP 384:HHMO0iO024YCo6J+Sl1xDnZBPsac4j0lpDII+FNHhX:nrZYCo0+Sl7zZlsac4ID8Lx
- TLSH T17D528DBD9F0138B91A27D1D4EABE9204CD04B6BBDFE2906616143C05CA447B9F4E68DF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 11KB
- SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
- MD5 25e8156b7f7ca8dad999ee2b93a32b71
- SHA1 db587e9e9559b433cee57435cb97a83963659430
- SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
- SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
- TLSH T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 502KB
- SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
- MD5 e690f995973164fe425f76589b1be2d9
- SHA1 e947c4dad203aab37a003194dddc7980c74fa712
- SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
- SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
- TLSH T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 14dac9a28ce7628984d2bfa881fb8159c78d33f9cc0b3ec53285b950419cbe5a
- MD5 c925c97da2e7eb3a38cc8a3f4a19bce0
- SHA1 e07efcd17348721e2ecc2690be06b80a4be83ab5
- SHA512 28e9396c737e743da2608a9c3489ce47c1c8853712b610c838c05c44b7d0b72acb28051d83af0adf15b50c88d8ebdffd8b9258ee30d6fa8652925562ad4514a6
- SSDEEP 192:dOv5zboBMJmyjYxy11d66Joz1zgCl6mc0dz:SboBMJmyj7d66Joz1zgC1jd
- TLSH T1C2D1FE58E729863BC848023BCCA51F401F76395B984E7F2931AC641D2D962DE7A8E17E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 f3fbf14656ab184b67c19542a24ba5911ecbac60a15ecfc9a368cbf725961f5d
- MD5 2535d843a3464ce4ce9ef83779d29d54
- SHA1 9db4dcd6eaf173a18fea501a15507134c0b39408
- SHA512 1f0915c1acbfef5c074f6718aeca8e2fbc24146379f59db68dee7b995d2cfd0e3ed5217fc46d3d4fad554f5730333677f298f5d1c95b2eca4ef8b3c6372e8c75
- SSDEEP 192:w11d66Joz1zgCl6mc0ddOv5zboBZJmyjYx:+d66Joz1zgC1jgboBZJmyj
- TLSH T1FED1DE58E629867BC848023BCCA51F500F36399B984F7F2931AC641D2D972DD7A8E17E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 64925b87a2d8f23baeece4559a929503b0ae1a2d8e54b52f8b34ae80291eee4b
- MD5 baa9ba848d615e82612eac758b604831
- SHA1 abaca02a71e229b180c6371f2049c0232ef6e633
- SHA512 334d286d728322893dd94dfa14b1fd82ed852b52298b188e85844131408099d7c1b65d80272b74d679f723a2e9cf0b4b5a593258b7dd476484dbe5c669f82e02
- TLSH T1E921675C7AB84D7A599BE2DCF541068E53968E060CC75C430D22DE8DCDD9ADA326A838
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\04224a6f-c16b-4564-9b5e-3e534d87b454
- Size 15KB
- SHA256 e7625a5a960d94a41f085166b74f572b949819907d6535026aa89f80b2d318ac
- MD5 69d422eecaea6e7abd4900d4d17c8442
- SHA1 a87d82058d721c49f739fe69a5c83608e2cef311
- SHA512 e3529428f8a08fe80a3eadd3e5050ff6619ba52afd66956fc32d946a3c266042dc0e5579fbd31952d6fc3f7b09f16f9050fe5e54e1063ac8e95ddbf8cf57d03f
- SSDEEP 192:juDuzpsKifGTG6lhGaKyaiK0QSPsEmBTDnDA42E138kBOD7GsUJBi+wyXN+NQV2X:bNsKiuTG6SXDR8kyoBi+/XN+uVy3uw
- TLSH T1F772EA16282045BA8691E3A9D8F8BFC3E5F538CB4C419FCE9BE4BD0829DF05D512794B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\177df23a-9706-46e1-90c9-27e79a24ba76
- Size 2KB
- SHA256 9e3e748fbeca96ce0cb11c6d44231df8889488554a345e28b1e75c9df872a7b1
- MD5 1efff9ea46cc7ebcfcf4007b0094efab
- SHA1 dbb6ff75825669d39a945f0714701272daf06997
- SHA512 6920b31d06a59b7e3e7e1e7ff8dc72e1d06bc9f90174b92dd611a51cc82c87428c29f800933143bb2bc3feb6e2f0f84706c36b3928e7ca48482f17094dbce80e
- TLSH T10D41535C74785DB78DEAF28DD491328E57608A1360C228872E52EE0C8C966DD236E57B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\20573cbc-4b37-4505-876a-f028cd0cca98
- Size 883B
- SHA256 6deb1b06cddac96cd3aea8b0790de074470cfe0275fb986ef4b83602dc7ad2b5
- MD5 8f45810b8308088651a201d13a6eb013
- SHA1 0475864767cf07717c2616d01a592a98655b0b8a
- SHA512 2cdd0de0ef33c75283fde874fdc19c845116af4adac34055276b170bab4bfff466dae57f46369863e4b550408ad74a44c13dfaa0d269c5075d7efd488ca54dad
- TLSH T1CB11C4859534B9F2CDA8C30BCD953B425BD4612380CA94183DA15E180DBE65EA36B31B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\2dad838b-88b4-46d1-a787-5b576eb61abb
- Size 235B
- SHA256 f3191be43a1f4460ad66444c3efcac12d01029c9d2cad4b1208bc97f2d3774ae
- MD5 ff0924939f8a2f1297ff0b7810ad8c07
- SHA1 4452a3dfebfbc6e6e22bc28dbba8a0032496000e
- SHA512 4f2f9ad3c5028050f61dd387a7d64245ebb56ba313fd189102c999141f2ce04d1bd850a5f068f70ec51a604a06f195ff74bc9081cb1517385d36767d83a91811
- TLSH T1A2D0978434886B7D0C000FA3F0A078C630884C3310746C20D76186B8D9F9EC892A2817
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\4d35400f-224f-4ebc-9025-12cb0f926331
- Size 235B
- SHA256 1b1c1ddde15bf37cf555d6df579c00727c17ab89e3164e2ad575e53db902c449
- MD5 2de288c95136a664a3f33183c6d199e1
- SHA1 c901d395feb5fa9f4110d5b9ea2c35e551e0d932
- SHA512 6cc48d75b0be4d68955ff6226e16ff10162fb54d14ea74439db7a376dfd28b47eddc6c885337e0dda1344d2d60a9917d9d889325781fad303f49f8cd08bea0de
- TLSH T10AD097A828A8339D4C040F03B0A028C730448C33A07AE850C99089389DB8EC80293D0B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\9376afae-8a0a-45b2-9d46-84e18de7212a
- Size 886B
- SHA256 22707f78f0118264778e4ebca6cdbf3f1d0b89cd166fd4e27426aa8700740334
- MD5 48583644a714e67b040ab63ca2334ee8
- SHA1 cb98a23d65c9604d386b45eb12cbe8683dd0e909
- SHA512 56e88da13a515e4cc31010e16f83de9cf13c352d2e644228b239fcc50ad9ed1113035a66fc8a01756d54524ed7f3b615ce39e38d6b60ac3aa6b60a5584721e37
- TLSH T1BD1104818524B5B3CCA4D24B99A07B425FD47023C0CA591C7E95971C0DB665DA36731B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\extensions.json
- Size 16KB
- SHA256 3d7e46bede27ac6da93fce67bf7b00406d03457ce74c7c68594c128bbd970ac7
- MD5 bbebdcca00175a57fb8af516d919a286
- SHA1 046e19eac897322f6c30d16f8be39ea3beae8b69
- SHA512 b104a8a87b04cf13efe9faa156a238257e5d3499f6d54202f77704c5a0b080095c1f55b7a2110f2e69729546c4f3d784acd3095efc52d30e51f7a7f44d2c28b8
- SSDEEP 384:7kI4vGUmldvN8dhWP94z+96ofL4HwL4PVL4HZL4H1L4HO4Fb4h2:II4+Rf+X64m6w4S494x4V4u4d48
- TLSH T10472511545049EB8298FA79BAA367D02C27D433B60855C78F4DD8FC802FB5B902FB65B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
- Size 1.1MB
- SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
- MD5 626073e8dcf656ac4130e3283c51cbba
- SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
- SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
- SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
- TLSH T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
- Size 116B
- SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
- MD5 ae29912407dfadf0d683982d4fb57293
- SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
- SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
- TLSH T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
- Size 1001B
- SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
- MD5 580786a5ec9eb650dde3e0e75db8588a
- SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
- SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
- TLSH T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
- Size 18.9MB
- SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
- MD5 15fa9ea03f6f451d587b1dabb2f7b036
- SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
- SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
- SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
- TLSH T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\prefs-1.js
- Size 7KB
- SHA256 c69df04dc5ccb05d4b25ed0cbabda3ed9baad93677d30549b89c34c5712fd5f9
- MD5 b3f1be8c63696377b9432001468d613f
- SHA1 7b1152ff82ab5a89a91f0e690c2eb30f97f6e187
- SHA512 02c65d2fb7d7226619512e3dd835186585e7a5b584fba4b744a54326bb0b5bb95fa64d21ceb8c4df66458e86750542ed834f131dc6d7926241281f22eb9b3889
- SSDEEP 192:3tPAiL2Yo9R4fJ4UY8ONeSSr8Vd7Bw884NYBbeXy:3yiL2YoohDuNj9wINYBbeXy
- TLSH T179F10F789508CF7F64B277BCAC6449706AB2017BB6BF68D610B684C5051CF3441FAAEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\prefs.js
- Size 6KB
- SHA256 40d9500e68172c30a1028ec0e67dd7f236403c47ee39103dc61bfdd467358e83
- MD5 3edbd7ce62a43537115a0fe3ce4916f0
- SHA1 ac1a5bb8bfe05329de823b2b377cce3187394feb
- SHA512 107f7eee22312c297d74f7a0c8a5ecaa6659b7829e89318334780369e13feb7f2a34f84b3b6a0eabac8ad1dcf4f2ba48f4284f546dae3e573c22f4fc8e20552b
- SSDEEP 96:xHltPUTUkqGqFQPfaHm1zSoSSlndv9jDnfyHVd7Bw88P8L4cnsr1z6:3tPHR4faHm5SS18Vd7Bw88Bh2
- TLSH T13CE120789508CB7F64B677ACAC6488316AB2013B77BF68D750B654C4014CF3442F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\prefs.js
- Size 6KB
- SHA256 3a49bbe739c77d02b9ad57fb27a8017de975df1377af11fe466ba44d4a18a004
- MD5 ea038e69fd3523afc34b9b2d0e413dcb
- SHA1 df983de8cdfd9b46fce7d12127a83e494042a7c7
- SHA512 192bb47245b3d3a0750e46049b2bb5b3d2b009c01a5bc13a20fe561714e1570494891fce308aeeceb8bb5e1e7c7f3b9509e555527d2293c61b90965efda7c83e
- SSDEEP 96:xHltPUTUkqGqFQPfaUr0d/S1zSANeSSlndv9jBnfyHVd7Bw88P8L4cnsr1z6:3tPHR4faUY8XNeSSr8Vd7Bw88Bh2
- TLSH T1F4E12F789508CB7F64B677ACAC6488706AB2013B77BF68D650B694C4015CF3442F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\sessionstore-backups\recovery.baklz4
- Size 1KB
- SHA256 450309c13e82a0c273aa293cc1d0d3ac61b2eed2303d92a3843b691592564460
- MD5 92a9559a27cdaefa0db54f367ea36ce7
- SHA1 785678a07326c1e2ba2fa1bcd5956332d785d913
- SHA512 463d267dd4793b4ac9d23b8fd04f6a8c7418950b0550b83927669ddfe995107e88e70a39c145b49b61562ef9f58bb7168c66c7b80b9baa4e16a97bd431152aab
- TLSH T10E21E7627D2A4EFB7B1252AAC0A94FF9D69D34B24C2444E0C5BE830910CAB6D330A51A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\sessionstore-backups\recovery.jsonlz4
- Size 1KB
- SHA256 d3875b5ed6339a9b792b573a9640d5a887d44b551aaddc62a1d5eafd0e62e7c0
- MD5 2f48e6749b7364e8497f1c565e55139b
- SHA1 852bb155367d9c761ec32293f25c8d493e7cb07d
- SHA512 58d6513f25923069f684141cd3a3a3fbf1a041a5977e80fbc8c870f99f689f29c346d8c9e5b867f928d19e50e65fa26972d1d74d3f537f73ffde6c45403f549d
- TLSH T11B210B41CD2D1AF553E58266C2DB9FE5D586B1F28E17F0C1E87DA301416CA06312B118
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 6.1MB
- SHA256 a340d5d06eb7b9e603318279171c63ced60e93373de4ea206225dab6c5640082
- MD5 2a83bd4b1a930c3c68415455fd3f4e6f
- SHA1 1e6eb9e3bf34b0b20fff83fbe9700d7db1b26667
- SHA512 bc1e69ed2d9f6dc5ba45c5ae30cb77fa65acd60a1fef44f8eb278e81e60575a461f8223f264c53e0a40635ee252d1d4e2069f6efe97dab1542efddb68f176e55
- SSDEEP 49152:DskTRVaAIoW8zN6wlsFu/lxuDu3u3K/Rxg3NsDC3jtbsks3aCjKYHYyaA6sHd6M4:SXYHjaA6sHQMWGRz9eBgsJsGv
- TLSH T1E5566DE420E29252F38544B3719A53FB10EFC01C6076CE44579896FAA5B8CEB4E877BD
- MD5 SHA1 SHA512 SSDEEP TLSH