a2253b2f2f5e4fe4831934d2799e3fbc0ad2a5e5367430e2bfe82cd6836a83c7

Analysis

user interaction
yes
max time kernel
898s
max time network
758s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 01:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Lobotomized Playtime free.exe
Size 1.1MB
Sample260623-bpptyshx3n
SHA256 a2253b2f2f5e4fe4831934d2799e3fbc0ad2a5e5367430e2bfe82cd6836a83c7
MD5 2580a322d7e598f5d4e93aa775f29f49
SHA1 4adaa5b7e83fc0a424125e80990e45724bf6bd49
SHA512 a26b0457ae2c3092e4e586eb2ed98d12c511bb58148f8f2befaa89b6e9ab5957a2fb338ba6fe8174d39e64aa13a2f7b039c294cdfae3b0ea4f0c0caa1bb44e0d
SSDEEP 24576:jU+9XNrenyktDLdYNtcdvQNC9wHAP5c1gfHzaw761LPW5A3uHp4/pHlpAg0r7tqS:D5OVeyffV6Qm
TLSH
T1CB45BE61F68540B7D5E238B059BAD3665839FF31273469CB7BE83D6C09312C26A3C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
101	4764	firefox.exe

Executes dropped EXE 5 IoCs

pid	Process
3504	RobloxPlayerInstaller.exe
3752	RobloxPlayerBeta.exe
5692	RobloxPlayerBeta.exe
1932	RobloxPlayerBeta.exe
3480	RobloxPlayerBeta.exe

Loads dropped DLL 2 IoCs

pid	Process
5692	RobloxPlayerBeta.exe
3480	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
5692	RobloxPlayerBeta.exe
5692	RobloxPlayerBeta.exe
5692	RobloxPlayerBeta.exe
3480	RobloxPlayerBeta.exe
3480	RobloxPlayerBeta.exe
3480	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\textures\ui\InspectMenu\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\PlatformContent\pc\textures\water\normal_08.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\textures\StudioSharedUI\ready.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\textures\ui\PlayerList\Accept.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\textures\ui\Settings\Players\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerInstaller.exe	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\textures\ui\Slider-Fill-Center.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\ExtraContent\textures\ui\InGameMenu\TouchControls\touch_action_move_2.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\textures\particles\forcefield_glow_color.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\textures\ui\VR\closeButtonPadded.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\textures\ui\VR\edgeBlur.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\textures\ui\VR\toggle2D.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_3x_11.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\ExtraContent\translations\CoreScriptLocalizationTrimmed.csv	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\textures\AssetManager\explorer.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\textures\ui\icon_localization-16.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\textures\ui\InGameMenu\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\ExtraContent\textures\ui\LuaApp\graphic\Auth\CharacterShadow.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\ExtraContent\textures\ui\LuaChat\icons\ic-group.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\textures\StudioSharedUI\statusSuccess.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\textures\ui\common\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\textures\ui\Controls\PlayStationController\ButtonTriangle.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\textures\ui\Emotes\Small\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\textures\ui\InGameMenu\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\textures\ui\VirtualCursor\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\textures\ui\VoiceChat\MicLight\Unmuted40.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\textures\ui\VoiceChat\SpeakerNew\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\avatar\heads\headI.mesh	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\fonts\Arimo-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\textures\advancedMove.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\textures\ui\VoiceChat\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\textures\ui\VoiceChat\SpeakerNew\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\ExtraContent\textures\ui\LuaApp\icons\GameDetails\contentRating\igrs-3.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\textures\ui\PlayerList\NewFollowing.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\textures\ui\Scroll\scroll-top.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\textures\ui\Controls\key_single.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\textures\ui\Input\Ring_padded.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\textures\ui\Lobby\Icons\back_icon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\textures\ui\MenuBar\icon_menu.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\ExtraContent\textures\ui\LuaApp\category\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\ExtraContent\textures\ui\LuaApp\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\ExtraContent\textures\ui\LuaApp\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\textures\ui\common\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\textures\ui\Controls\PlayStationController\ButtonL1.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\textures\ui\VoiceChat\MicDark\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\textures\ui\VoiceChat\Misc\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\textures\ui\VoiceChat\SpeakerLight\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\fonts\families\AccanthisADFStd.json	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\textures\ui\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\textures\ui\Controls\PlayStationController\DPadDown.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\PlatformContent\pc\textures\sky\indoor512_bk.tex	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\avatar\compositing\CompositExtraSlot0.mesh	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\content\fonts\families\PatrickHand.json	RobloxPlayerInstaller.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lobotomized Playtime free.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

Checks processor information in registry 2 TTPs 25 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe

Modifies registry class 32 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-3da9d00a092c4d59"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-8884371d30284041"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-8884371d30284041"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-8884371d30284041\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-8884371d30284041\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-8884371d30284041\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-8884371d30284041\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3504	RobloxPlayerInstaller.exe
3504	RobloxPlayerInstaller.exe
5692	RobloxPlayerBeta.exe
3480	RobloxPlayerBeta.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6056	Lobotomized Playtime free.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	4764	firefox.exe
Token: SeDebugPrivilege	4764	firefox.exe
Token: SeDebugPrivilege	3504	RobloxPlayerInstaller.exe
Token: SeDebugPrivilege	3504	RobloxPlayerInstaller.exe
Token: SeDebugPrivilege	3504	RobloxPlayerInstaller.exe
Token: SeDebugPrivilege	3504	RobloxPlayerInstaller.exe
Token: SeDebugPrivilege	3504	RobloxPlayerInstaller.exe
Token: SeDebugPrivilege	3504	RobloxPlayerInstaller.exe
Token: SeDebugPrivilege	3504	RobloxPlayerInstaller.exe
Token: SeDebugPrivilege	3504	RobloxPlayerInstaller.exe
Token: SeDebugPrivilege	3504	RobloxPlayerInstaller.exe
Token: SeDebugPrivilege	3504	RobloxPlayerInstaller.exe
Token: SeDebugPrivilege	4764	firefox.exe
Token: SeDebugPrivilege	4764	firefox.exe
Token: SeDebugPrivilege	4764	firefox.exe
Token: SeDebugPrivilege	4764	firefox.exe
Token: SeDebugPrivilege	4764	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
6056	Lobotomized Playtime free.exe
4764	firefox.exe
4764	firefox.exe
4764	firefox.exe
4764	firefox.exe
4764	firefox.exe
4764	firefox.exe
4764	firefox.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
6056	Lobotomized Playtime free.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
6056	Lobotomized Playtime free.exe
5836	ShellHost.exe
4764	firefox.exe
4764	firefox.exe
4764	firefox.exe
4764	firefox.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 4764	2296	firefox.exe	102
PID 2296 wrote to memory of 4764	2296	firefox.exe	102
PID 4764 wrote to memory of 984	4764	firefox.exe	103
PID 4764 wrote to memory of 984	4764	firefox.exe	103
PID 4764 wrote to memory of 984	4764	firefox.exe	103
PID 4764 wrote to memory of 3820	4764	firefox.exe	104
PID 4764 wrote to memory of 3820	4764	firefox.exe	104
PID 4764 wrote to memory of 3820	4764	firefox.exe	104
PID 4764 wrote to memory of 3820	4764	firefox.exe	104
PID 4764 wrote to memory of 3308	4764	firefox.exe	105
PID 4764 wrote to memory of 3308	4764	firefox.exe	105
PID 4764 wrote to memory of 3308	4764	firefox.exe	105
PID 4764 wrote to memory of 3308	4764	firefox.exe	105
PID 4764 wrote to memory of 1052	4764	firefox.exe	106
PID 4764 wrote to memory of 1052	4764	firefox.exe	106
PID 4764 wrote to memory of 1052	4764	firefox.exe	106
PID 4764 wrote to memory of 4600	4764	firefox.exe	107
PID 4764 wrote to memory of 4600	4764	firefox.exe	107
PID 4764 wrote to memory of 4600	4764	firefox.exe	107
PID 4764 wrote to memory of 4600	4764	firefox.exe	107
PID 4764 wrote to memory of 3448	4764	firefox.exe	108
PID 4764 wrote to memory of 3448	4764	firefox.exe	108
PID 4764 wrote to memory of 3448	4764	firefox.exe	108
PID 4764 wrote to memory of 3448	4764	firefox.exe	108
PID 4764 wrote to memory of 4200	4764	firefox.exe	109
PID 4764 wrote to memory of 4200	4764	firefox.exe	109
PID 4764 wrote to memory of 4200	4764	firefox.exe	109
PID 4764 wrote to memory of 4200	4764	firefox.exe	109
PID 4764 wrote to memory of 5124	4764	firefox.exe	110
PID 4764 wrote to memory of 5124	4764	firefox.exe	110
PID 4764 wrote to memory of 5124	4764	firefox.exe	110
PID 4764 wrote to memory of 5124	4764	firefox.exe	110
PID 4764 wrote to memory of 5228	4764	firefox.exe	111
PID 4764 wrote to memory of 5228	4764	firefox.exe	111
PID 4764 wrote to memory of 5228	4764	firefox.exe	111
PID 4764 wrote to memory of 5228	4764	firefox.exe	111
PID 4764 wrote to memory of 4900	4764	firefox.exe	112
PID 4764 wrote to memory of 4900	4764	firefox.exe	112
PID 4764 wrote to memory of 4900	4764	firefox.exe	112
PID 4764 wrote to memory of 4900	4764	firefox.exe	112
PID 4764 wrote to memory of 3064	4764	firefox.exe	113
PID 4764 wrote to memory of 3064	4764	firefox.exe	113
PID 4764 wrote to memory of 3064	4764	firefox.exe	113
PID 4764 wrote to memory of 3064	4764	firefox.exe	113
PID 4764 wrote to memory of 5656	4764	firefox.exe	114
PID 4764 wrote to memory of 5656	4764	firefox.exe	114
PID 4764 wrote to memory of 5656	4764	firefox.exe	114
PID 4764 wrote to memory of 5656	4764	firefox.exe	114
PID 4764 wrote to memory of 3504	4764	firefox.exe	115
PID 3504 wrote to memory of 5692	3504	RobloxPlayerInstaller.exe	119

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Lobotomized Playtime free.exe
"C:\Users\Admin\AppData\Local\Temp\Lobotomized Playtime free.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:6056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:2504

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004EC
1⤵
PID:2752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:2896

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:5836

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Downloads MZ/PE file
  - Drops desktop.ini file(s)
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1968 -prefsLen 27097 -prefMapHandle 1972 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {ed0734ec-0ac8-4766-9ece-b4dfbb78f363} -parentPid 4764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4764" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2440 -prefsLen 27133 -prefMapHandle 2444 -prefMapSize 270279 -ipcHandle 2452 -initialChannelId {6076dba9-2f69-4322-8f2b-62a4a8df0c91} -parentPid 4764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3764 -prefsLen 27323 -prefMapHandle 3768 -prefMapSize 270279 -jsInitHandle 3772 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3780 -initialChannelId {20d4f03c-9670-4135-aa75-ba6993b0bcd1} -parentPid 4764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3928 -prefsLen 27323 -prefMapHandle 3932 -prefMapSize 270279 -ipcHandle 4008 -initialChannelId {9355c3dc-6127-46bb-a793-06cddd7268ab} -parentPid 4764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4764" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2712 -prefsLen 34822 -prefMapHandle 2808 -prefMapSize 270279 -jsInitHandle 2812 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3092 -initialChannelId {1e8c6489-5026-4915-b7c1-9001c54a3c9d} -parentPid 4764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5004 -prefsLen 35010 -prefMapHandle 5008 -prefMapSize 270279 -ipcHandle 2768 -initialChannelId {63824b94-2301-447c-b009-e1e9093ff582} -parentPid 4764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3448
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5184 -prefsLen 32900 -prefMapHandle 5188 -prefMapSize 270279 -jsInitHandle 5192 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5204 -initialChannelId {25bc1e61-55c3-431c-9b26-6f06c243fdfa} -parentPid 4764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4200
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5396 -prefsLen 32900 -prefMapHandle 5400 -prefMapSize 270279 -jsInitHandle 5404 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4880 -initialChannelId {f3699db4-e24a-4edc-b3d1-c2c5b2c052b6} -parentPid 4764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5608 -prefsLen 32952 -prefMapHandle 5612 -prefMapSize 270279 -jsInitHandle 5616 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5652 -initialChannelId {28844de9-7433-4f4e-8a46-0e4c10c68d6e} -parentPid 4764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6684 -prefsLen 33071 -prefMapHandle 6688 -prefMapSize 270279 -jsInitHandle 6692 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6700 -initialChannelId {6c5a3950-5d2b-4bff-908e-51b2845d377f} -parentPid 4764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:4900
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6584 -prefsLen 33071 -prefMapHandle 6124 -prefMapSize 270279 -jsInitHandle 6120 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6076 -initialChannelId {ae5e2930-9777-4767-ab0e-17f54a310a7c} -parentPid 4764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:3064
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5708 -prefsLen 33071 -prefMapHandle 5924 -prefMapSize 270279 -jsInitHandle 6328 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6548 -initialChannelId {a4df7dd0-2b4c-49df-983e-56ae1dcfc203} -parentPid 4764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:5656
- - C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
    "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3504
  - - C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe
      "C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 3504
      4⤵
      Executes dropped EXE
      PID:3752
  - - C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe
      "C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 3504
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      PID:5692

C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:1932

C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3480

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:3100

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:1556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4196

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RobloxStudioInstaller.exe

Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
Size 9.8MB
SHA256 371ba35a7bdc22dc6696dc84f2d4e849393943e322c5d3aef662ec8af4bc43a1
MD5 8a7f0063c03a5916dbaa9ffb602c8da4
SHA1 6d66e30699e5d55a521f5c5ef6061539f81a7038
SHA512 277cd84b8fbc912b4a8e87c3281eb95a3d0065bdd3d475d92c5b48d9b5d18e50476d7dbcb03a68a3f8827a9a716b371b633edbdce42422b5cfb92b28d78e5344
SSDEEP 196608:7m2iP1YkKX1WOtBIMpmsxPKzPsVpcz9+rBEJpU:7oKfpmsxCzPQpcz9+WDU
TLSH
T1B8A6AE22BA01C032E9D100B2D6BD6FB6997C9A301B7944D3B7D45DB95A305E33B39B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.dll
Size 20.8MB
SHA256 00ea1332909419b2ba70bbe0050459054d67ad86ea42b89bf06c43adee5fe9ba
MD5 033d5b4397f750ba214da54b328cc429
SHA1 91904e9cfc0365723f11ca5a0c8e3052e2495b49
SHA512 cd97e4abdeede427a7a7a996c5b22c7ed4758221b5b6ff3f16601c1b2bea3d79bf849ee999c72c775a47bda7c9cb5a9264f28a5ccf0ec8508fce3ff73b54dca7
SSDEEP 196608:jbXVfM9bBF0y3fRM5L2VFzztrXrcSK6x4QcFKKI+Bi:jbXZY0y3fRMlABfcStO5FKKf8
TLSH
T13D27CF8EA5E61A9CC5715170E01F5AE7D612308C4E682FFB86D902213B3329D265EF7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c1sxuejy.default-release\activity-stream.contile.json
Size 4KB
SHA256 36f145206459b5d538d29719d76e1e52d891dc6ceff56cafa2981c1b795f80c5
MD5 57cb5817d5b37c7cd21c7c9d10526a20
SHA1 f3fdd82179a2ff9daa747481ee9520d80a6b66f1
SHA512 0d7d29c8f29192cbf96616ea1f49a191bb360bfbaa20275a1d812f89ee43a39ba09f04219ae11113f4c396a37c341c83d034ac40095d3d35819f40510eb4d1c9
SSDEEP 96:XFV+nlY81KT+mRR+AFKY7Mctdne6Y6D3idj8Kcpy14StILAul:XFV+nljmR0AhMscFwSdj8K2y14StIsul
TLSH
T10EA118DFECA859930393E9EA3C4D275CF1277427C9DE4F4AF6858C1094F9067819E244
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c1sxuejy.default-release\activity-stream.discovery_stream.json
Size 76KB
SHA256 66f4bc0bd1c3e52cd086bd1ae87a2702166e9b565cab73a2815de485d9942fbf
MD5 8d34bf5cdff6c4128e3d123099b0f50d
SHA1 5a350baa53f1eae0b5788c18b2651c001429889e
SHA512 217e08a82905e378fd5ede6682affd7a95d1ebdb2aeadff6573d35560d11a72116955ac61663ea5be57e04ebfd409fdc38eddf7a45fab31e257fb96a825ed85f
SSDEEP 768:lIXziiwEHpDxt2P0ZUH7LvUWzOrFl14IY8rax4JHm/VdS1tMe9DOQxQKhWIS+8rJ:OiEJ2P9DKrf5POxKG/VdSEeV0vwE
TLSH
T1B97308A3E6E9B1BB0B9137CB2C0FB55B62D64145E38506CCECEAC90E918C355523F5AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c1sxuejy.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 0dd881feb71055553d9d1645c1c17cf4c306f17b6f4ad725097f4c685014f377
MD5 ad1d45101bb6151cfab24ba3e3822b73
SHA1 2cf3316221e271e9395bcf4d8e1acba3762e73d9
SHA512 b3ed1c940fb487e4143a8ca4c315a87bfd87105791303f73d165cad6287aca07bbfaaeb0ab75260583f51fc87231ffeab10cb16eaa6876ef4148069368b21094
SSDEEP 1536:kaNZmOPZKgVOvzd4dgd20VdSXyueWSGwE:vNZmYR2Bygd2BCueWSfE
TLSH
T1647319A397E9B1BF1F9137CB2C0B396B62E20185F34506C9EDEDC61CC189654123A6AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

03100235E7AEBB25C597DD91664A8F544DDFC529

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c1sxuejy.default-release\cache2\entries\03100235E7AEBB25C597DD91664A8F544DDFC529
Size 13KB
SHA256 6b83a7c588881cf9e1d8451da40ff436bdadb2877a789969b0b1570c07c8721e
MD5 c32163fa499ff85122d97c643cbde7ff
SHA1 1a377ebcc76ffe35088009947428c9de4f84dadf
SHA512 d052eb2357c7249f9418d00359d391e7c7400fc66e362f6ab86e36c3a593d847d3572c04d4f06c07ea9ebf7a05de6a5e50b3c572e78c450ddd58a3e2fbd8385b
SSDEEP 384:HPC9iO024Yno6J+Sl1xDnZBPsac4j0lpDII+MrC:v9ZYno0+Sl7zZlsac4ID8Lj
TLSH
T1F6528DBD9F1238AA1927D4A5D5BD9244CD04E6BFDEE2906A09143C04CA847B9F4E68CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6D89348819C8881868053197CA0754F36784BF5F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c1sxuejy.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F
Size 16KB
SHA256 b984c2834bede58453280ba22de6a915f1530453db9a00a80062149e825a3571
MD5 942e2a2c8a028e246957fb2dbe26f126
SHA1 20d2f8f054f2c6ec90c5f0863072e0d5cb961336
SHA512 27feafb64ae8fd662069305125505ea32393f0699ee17404df7ec74f3e7706af97a8d0f7553c6f994a435cd94a9e2f8dfc7a61b8f6b2a7c4383f5a8167e09662
SSDEEP 384:T4nBSb1cjRy14SmDty6PtyLhfdDE2Ba/rIVy8eX:cchOf1t7PtShfS2sDIVy8u
TLSH
T13E729DBFCF944C4E0B82D8438C1D27A8BC257127CFE9D2DA7A84250982DA267D4FD1C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_arts_and_entertainment.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c1sxuejy.default-release\personality-provider\nb_model_build_attachment_arts_and_entertainment.json
Size 67KB
SHA256 960065cc44a09bef89206d28048d3c23719d2f5e9b38cfc718ca864c9e0e91e9
MD5 6c651609d367b10d1b25ef4c5f2b3318
SHA1 0abcc756ea415abda969cd1e854e7e8ebeb6f2d4
SHA512 3e084452eefe14e58faa9ef0d9fda2d21af2c2ab1071ae23cde60527df8df43f701668ca0aa9d86f56630b0ab0ca8367803c968347880d674ad8217fba5d8915
SSDEEP 1536:X0A993SJAA1p1MxQm6UjfvidqqishTLaq/HU0Y6bxdgRYeHk2OxFW:EA993SiAv+F6UjHiddpLrAGS/GFW
TLSH
T17F63839547EF4AF1A2CEF9A40CA708936FF551F52BD2229C1BD1908897B5FB010F7A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_autos_and_vehicles.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c1sxuejy.default-release\personality-provider\nb_model_build_attachment_autos_and_vehicles.json
Size 44KB
SHA256 022f9495f8867fea275ece900cfa7664c68c25073db4748343452dbc0b9eda17
MD5 39b73a66581c5a481a64f4dedf5b4f5c
SHA1 90e4a0883bb3f050dba2fee218450390d46f35e2
SHA512 cfb697958e020282455ab7fabc6c325447db84ead0100d28b417b6a0e2455c9793fa624c23cb9b92dfea25124f59dcd1d5c1f43bf1703a0ad469106b755a7cdd
SSDEEP 768:x6/Mifb8i0x9bnuv97xrsEcgcs19DSr1euz5vciyxYZlhCU:x6pfExluv9NncNsb2r1lR6YZlsU
TLSH
T1062384A2A3EF4AF292CAF5E508A70C935F7662F51BC3309C07C1558C53BDEB504D6A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_beauty_and_fitness.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c1sxuejy.default-release\personality-provider\nb_model_build_attachment_beauty_and_fitness.json
Size 33KB
SHA256 eed46e8fe6ff20f89884b4fc68a81e8d521231440301a01bb89beec8ebad296b
MD5 0ed0473b23b5a9e7d1116e8d4d5ca567
SHA1 4eb5e948ac28453c4b90607e223f9e7d901301c4
SHA512 464508d7992edfa0dfb61b04cfc5909b7daacf094fc81745de4d03214b207224133e48750a710979445ee1a65bb791bf240a2b935aacaf3987e5c67ff2d8ba9c
SSDEEP 768:I+ij0TAXOc2OuXvdCDF4FmthuYb495/SvSEtEYNZQytSYfT2TDkEF4JRe9VUwCJd:I+ij0aOc21XvdQF4Fmthug495/SvSd4J
TLSH
T167F273A553EF4AF3A2CAF99448BB08D75B7501F42BD3309C0BD1954C57BDEB404E6A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_blogging_resources_and_services.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c1sxuejy.default-release\personality-provider\nb_model_build_attachment_blogging_resources_and_services.json
Size 33KB
SHA256 c9f2a779dba0bc886cc1255816bd776bdc2e8a6a8e0f9380495a92bb66862780
MD5 c82700fcfcd9b5117176362d25f3e6f6
SHA1 a7ad40b40c7e8e5e11878f4702952a4014c5d22a
SHA512 d38e65ab55cee8fef538ad96448cd0c6b001563714fc7b37c69a424d0661ec6b7d04892cf4b76b13ddbc7d300c115e87e0134d47c3f38ef51617e5367647b217
SSDEEP 768:0aXqUUKuXcV9gAJYQjhAlF803mM4xRdOROo4ZParFJoLNUz73:0aXqjKuXw9gAJYQjyB3mtxRkco4Zyr37
TLSH
T18AF252A143EF4AF2A6CAFA9508B708D35B3551F52BC3319C0BD2954C57BDFB508D2A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_books_and_literature.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c1sxuejy.default-release\personality-provider\nb_model_build_attachment_books_and_literature.json
Size 67KB
SHA256 df23a5b6f583ec3b4dce2aca8ff53cbdfadfd58c4b7aeb2e397eade5ff75c996
MD5 df96946198f092c029fd6880e5e6c6ec
SHA1 9aee90b66b8f9656063f9476ff7b87d2d267dcda
SHA512 43a9fc190f4faadef37e01fa8ad320940553b287ed44a95321997a48312142f110b29c79eed7930477bfb29777a5a9913b42bf22ce6bb3e679dda5af54a125ea
SSDEEP 1536:fFj1H+dLa2mqJTVj0+bFkXfRwVSND7uEZz6YDqa9eLGRQssw2A2:Nj1edLa2XTBnbF4fRwVSxuEzT0iRQT
TLSH
T1D463659147EF4AF1A2CAF9940C6B08976FF551F42BD2229C4BD1918897B6FB010F7B09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_business_and_industrial.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c1sxuejy.default-release\personality-provider\nb_model_build_attachment_business_and_industrial.json
Size 45KB
SHA256 8410809ebac544389cf27a10e2cbd687b7a68753aa50a42f235ac3fc7b60ce2c
MD5 a92a0fffc831e6c20431b070a7d16d5a
SHA1 da5bbe65f10e5385cbe09db3630ae636413b4e39
SHA512 31a8602e1972900268651cd074950d16ad989b1f15ff3ebbd8e21e0311a619eef4d7d15cdb029ea8b22cf3b8759fa95b3067b4faaadcb90456944dbc3c9806a9
SSDEEP 768:inUsWHNnOAvkuPPu2fYAE/ecNjBr0QOdt+RbK7QvsFe1AIKlREQTLGNfGfWeISqK:inUsWHNnrvkuPPuYLE/ecNjBr0QOdt+Q
TLSH
T1E52384A143EF4AF1A2DAF9A408EB08875FF551F52BC3319C0BD1964857B9BB410F3A06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_computers_and_electronics.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c1sxuejy.default-release\personality-provider\nb_model_build_attachment_computers_and_electronics.json
Size 45KB
SHA256 ab20b97406b0d9bf4f695e5ec7db4ebad5efb682311e74ca757d45b87ffc106b
MD5 6ccd943214682ac8c4ec08b7ec6dbcbd
SHA1 18417647f7c76581d79b537a70bf64f614f60fa2
SHA512 e57573d6f494df8aa7e8e6a20427a18f6868e19dc853b441b8506998158b23c7a4393b682c83b3513aae5075a21148dd8ca854a11dabcea6a0a0db8f2e6828b8
SSDEEP 768:6aSj2tjV9bSvFczWWepPoiKLYvmt2fNjods5cstLpIscqqWPCFOAfw3yON8afnXE:6aSj2tjV9bSvFSWR6BImt2fNzcQIcRPs
TLSH
T16F23869557EF0AF2A2CAF9940CAB08979FF552F42FD3614C0BD195485BB9EF010F2A06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_finance.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c1sxuejy.default-release\personality-provider\nb_model_build_attachment_finance.json
Size 33KB
SHA256 384bf5fcc6928200c7ebb1f03f99bf74f6063e78d3cd044374448f879799318e
MD5 e95c2d2fc654b87e77b0a8a37aaa7fcf
SHA1 b4b00c9554839cab6a50a7ed8cd43d21fdaf35dc
SHA512 9696998a8d0e3a85982016ff0a22bb8ae1790410f1f6198bb379c0a192579f24c75c25c7648b76b00d25a32ac204178acaccd744ee78846dfc62ebf70bf7b93a
SSDEEP 768:cieaDKbQMMvEfD4vFMLKqPYE1dRDz7teb0kz3lY80:cieqKbQMMvEfD4vFeKqPYE1dpzPkblYp
TLSH
T1B6F261A543EF09F2A6CAFD9508EB08D76FB512F52BD3219C0BD1518857B8FB504F2A06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_food_and_drink.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c1sxuejy.default-release\personality-provider\nb_model_build_attachment_food_and_drink.json
Size 67KB
SHA256 905357002f2eced8bba1be2285a9b83198f60d2f9bb1144b5c119994f2ec6e34
MD5 70ba02dedd216430894d29940fc627c2
SHA1 f0c9aa816c6b0e171525a984fd844d3a8cabd505
SHA512 3ae60d0bf3c45d28e340d97106790787be2cc80ba579d313b5414084664b86e89879391c99e94b6e33bdc5508ea42a9fd34f48ca9b1e7adfa7b6dd22c783c263
SSDEEP 1536:bOuA7D7UEWOGEsffwBSqW1cWINNwAnnu4p2sUSDTA1hma+36t1n:vuDoEWbEJoDCNNwG1p2fSDTAne6tx
TLSH
T19D63659143EF4AB1A6CEF9940CAB0C976FF551F82BC2628D4B9191589779FB010F3B09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_games.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c1sxuejy.default-release\personality-provider\nb_model_build_attachment_games.json
Size 44KB
SHA256 35e67835a5cf82144765dfb1095ebc84ac27d08812507ad0a2d562bf68e13e85
MD5 4182a69a05463f9c388527a7db4201de
SHA1 5a0044aed787086c0b79ff0f51368d78c36f76bc
SHA512 40023c9f89e0357fae26c33a023609de96b2a0b439318ef944d3d5b335b0877509f90505d119154eaa81e1097ecfb5aa44dd8bb595497cdecfc3ee711a1fe1d5
SSDEEP 768:aPlZWWBHj0sWoa2JBAyMemRwoF/GgQKP2Sgj2KxpxrXDUIsJBaU5Qk0NbrkOVlxh:MnWWBD0sWN2JBqemRwoF/DQKP2Sgj2KP
TLSH
T1392343A263EF8AF292CAF5D508B708935F35A2F51FC3218C07D1554C63BDEB504DAA4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_health.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c1sxuejy.default-release\personality-provider\nb_model_build_attachment_health.json
Size 33KB
SHA256 150f21c4f60856ab5e22891939d68d062542537b42a7ce1f8a8cec9300e7c565
MD5 11711337d2acc6c6a10e2fb79ac90187
SHA1 5583047c473c8045324519a4a432d06643de055d
SHA512 c2301ed72f623b22f05333c5ecc5ebf55d8a2d9593167cc453a66d8f42c05ff7c11e2709b6298912038a8ea6175f050bbc6d1fc4381f385f7ad7a952ad1e856b
SSDEEP 768:p52SrX0UfFfol2F0Qmfw28ZVV5d1kVWWuFzVS7UpLNNpfmNzp:pYSrkUfFfol2F/uw28DV5d1kV/pUttk9
TLSH
T170F273A543EF4AF2A2DAFD9808EB0C935FB512F51BD3219C0BC1558897B9FB010F6906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_hobbies_and_leisure.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c1sxuejy.default-release\personality-provider\nb_model_build_attachment_hobbies_and_leisure.json
Size 67KB
SHA256 47db7797297a2a81d28c551117e27144b58627dbac1b1d52672b630d220f025d
MD5 bb45971231bd3501aba1cd07715e4c95
SHA1 ea5bfd43d60a3d30cda1a31a3a5eb8ea0afa142a
SHA512 74767b1badbd32cacd3f996b8172df9c43656b11fea99f5a51fff38c6c6e2120fae8bdd0dd885234a3f173334054f580164fdf8860c27cbcf5fb29c5bcdc060d
SSDEEP 1536:ex2J49OJ2vESNyvm4q6FZ/jrmEn8eUvQPHqbsrEyZ0FavsBiwrq:ekJ4sJ28SNOm4qK7rx8pvQPHe0E6
TLSH
T12E63429492EF0BB1B6DEF9A40CA708976EF551F92BD1328C1F819158D7B9BB010F3909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_home_and_garden.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c1sxuejy.default-release\personality-provider\nb_model_build_attachment_home_and_garden.json
Size 33KB
SHA256 19edd15ebce419b83469d2ab783c0c1377d72a186d1ff08857a82bca842eea54
MD5 250acc54f92176775d6bdd8412432d9f
SHA1 a6ad9ad7519e5c299d4b4ba458742b1b4d64cb65
SHA512 a52c81062f02c15701f13595f4476f0a07735034fcf177b1a65b001394a816020ee791fed5afae81d51de27630b34a85efa717fe80da733556fdda8739030f49
SSDEEP 768:OQUamVglKm5c3LOBRdNbtgdjdKbnWX1FV61u/oj/2WWa81l:OQUHWln5c38RdNbtgdjdKbnWX1F01u/v
TLSH
T1F0F262A553EF4DF292CEF99508AB08C7AFB512F52BC3315C0BD1959C5778AB014F2A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_internet_and_telecom.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c1sxuejy.default-release\personality-provider\nb_model_build_attachment_internet_and_telecom.json
Size 67KB
SHA256 e646d43505c9c4e53dbaa474ef85d650a3f309ccf153d106f328d9b6aeb66d52
MD5 36689de6804ca5af92224681ee9ea137
SHA1 729d590068e9c891939fc17921930630cd4938dd
SHA512 1c4f4aa02a65a9bbdf83dc5321c24cbe49f57108881616b993e274f5705f0466be2dd3389055a725b79f3317c98bdf9f8d47f86d62ebd151e4c57cc4dca2487c
SSDEEP 1536:inLl7pDjTv1exoCMGh8Mnv8a0Z3b73AvW/BYCxnhFGLaJbPESGccXIdJ4XG4AL25:inL5NTv19TGh8MnveZ3bcvY5fFGL0ESS
TLSH
T1D563989543EF4AF1A2CBFA940C6B08976FF551F42BD2228D0BD1955897B9FB010F2B09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_jobs_and_education.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c1sxuejy.default-release\personality-provider\nb_model_build_attachment_jobs_and_education.json
Size 33KB
SHA256 29080288b2130a67414ecb296a53ddd9f0a4771035e3c1b2112e0ce656a7481a
MD5 2d69892acde24ad6383082243efa3d37
SHA1 d8edc1c15739e34232012bb255872991edb72bc7
SHA512 da391152e1fbce1f03607b486c5dea9a298a438e58e440ebb7b871bd5c62d7339b540eed115b4001b9840de1ba3898c6504872ff9094ba4d6a47455051c3f1c5
SSDEEP 768:yOloEjLuudxPXz9CIwFUwl5cw5zFpyIrf2vutr:yOloEjLuud9z9CIYd8w5zOIb2vutr
TLSH
T12EF274A543EF4AF2A2CAF99408EB08D35F7112F51BD3219C0BD1558C97BDFB514E2A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_law_and_government.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c1sxuejy.default-release\personality-provider\nb_model_build_attachment_law_and_government.json
Size 68KB
SHA256 257ee9a218a1b7f9c1a6c890f38920eb7e731808e3d9b9fc956f8346c29a3e63
MD5 80c49b0f2d195f702e5707ba632ae188
SHA1 e65161da245318d1f6fdc001e8b97b4fd0bc50e7
SHA512 972e95de7fe330c61cd22111bd3785999d60e7c02140809122d696a1f1f76f2cd0d63d6d92f657cdec24366d66b681e24f2735a8aabb8bcecec43c74e23fb4f5
SSDEEP 1536:IwvZ+KSd2cFmpFGB/Sp1xAi6ZxaaF/VZhuthlV2+5pFDo/z:IOgKM2cgGB6p1xAi6ZganZ0thlR5fDw
TLSH
T1FC63639543EF4AF1A2CBF9940CAB08936FF552F52BC2228D5BD191889775FB010F7A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_online_communities.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c1sxuejy.default-release\personality-provider\nb_model_build_attachment_online_communities.json
Size 67KB
SHA256 11b6084552e2979b5bc0fd6ffdc61e445d49692c0ae8dffedc07792f8062d13f
MD5 37a74ab20e8447abd6ca918b6b39bb04
SHA1 b50986e6bb542f5eca8b805328be51eaa77e6c39
SHA512 49c6b96655ba0b5d08425af6815f06237089ec06926f49de1f03bc11db9e579bd125f2b6f3eaf434a2ccf10b262c42af9c35ab27683e8e9f984d5b36ec8f59fd
SSDEEP 1536:ZWJiPPEIYm4hGeujuImzVLA2Y9MMZm7nS83QFDBk2BrdICjt9EyO2B+AMwt0OwDV:FnEnThGequJtvR7S8gF1k21+C/u2c34O
TLSH
T19663769143EF4AF1A3DAF9940CAB08975EF551F92FD2228D0BD1859897B5FB010F3A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_people_and_society.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c1sxuejy.default-release\personality-provider\nb_model_build_attachment_people_and_society.json
Size 45KB
SHA256 4990a5d17bea15617624c48a0c7c23d16e95f15e2ec9dd1d82ee949567bbaec0
MD5 b1bd26cf5575ebb7ca511a05ea13fbd2
SHA1 e83d7f64b2884ea73357b4a15d25902517e51da8
SHA512 edcede39c17b494474859bc1a9bbf18c9f6abd3f46f832086db3bb1337b01d862452d639f89f9470ca302a6fcb84a1686853ebb4b08003cb248615f0834a1e02
SSDEEP 768:7xHLNYPUAcQL9/5EGy6T21Rpuhfkqxceuj/jCPUwXF5YK4otABk3MTicb3twO:7xJYRcQL9x9y6T0RpuhVxcnj/jCPlF5U
TLSH
T1C22331A267EF8AF292CAF59508B708D39F3552F52BC3318C0BD2454C57BDEB504DAA09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_pets_and_animals.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c1sxuejy.default-release\personality-provider\nb_model_build_attachment_pets_and_animals.json
Size 44KB
SHA256 dd537bfb1497eb9457c0c8ecbd2846f325e13ddef3988fd293a29e68ab0b2671
MD5 5b26aca80818dd92509f6a9013c4c662
SHA1 31e322209ba7cc1abd55bbb72a3c15bc2e4a895f
SHA512 29038f9f3b9b12259fb42daa93cdefabb9fb32a10f0d20f384a72fe97214eff1864b7fa2674c37224b71309d7d9cea4e36abd24a45a0e65f0c61dc5ca161ec7c
SSDEEP 768:FLu2LJObDMMGynnlGGRgS3c95S6uqs8hbiiAUU+GFs8XAxr18+to4rN7:FLu2LgfMMGynlGGWS3S5S6uqs8diBUUE
TLSH
T1BB235192A3EF8AB292CAF5D908A70CD35F3592F51BC3308C07D2554C57BDEB504DAA4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_real_estate.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c1sxuejy.default-release\personality-provider\nb_model_build_attachment_real_estate.json
Size 67KB
SHA256 efcf6b2d09e89b8c449ffbcdb5354beaa7178673862ebcdd6593561f2aa7d99a
MD5 9899942e9cd28bcb9bf5074800eae2d0
SHA1 15e5071e5ed58001011652befc224aed06ee068f
SHA512 9f7a5fbe6d46c694e8bc9b50e7843e9747ea3229cf4b00b8e95f1a5467bd095d166cbd523b3d9315c62e9603d990b8e56a018ba4a11d30ad607f5281cc42b4cd
SSDEEP 1536:1HbzBc8oBPUqosGZzqWnp2HGmj2oEVK2rQoe4my08:pX3oBPlGdqWnp2H1j2okJU8
TLSH
T13F63859153EF4AF1A2CAF9940CAB08936FF551F92BD2328C1B9585989775FB010F3E09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_reference.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c1sxuejy.default-release\personality-provider\nb_model_build_attachment_reference.json
Size 56KB
SHA256 3619daa64036d1f0197cdadf7660e390d4b6e8c1b328ed3b59f828a205a6ea49
MD5 567eaa19be0963b28b000826e8dd6c77
SHA1 7e4524c36113bbbafee34e38367b919964649583
SHA512 6766919b06ca209eaed86f99bee20c6dad9cc36520fc84e1c251a668bcfe0afcf720ea6c658268dc3bbaaf602bfdf61eb237c68e08d5252ea6e5d1d2a373b9fe
SSDEEP 1536:CoUbONFuEIHoh/SzhzCb8RxLnIp4umt1iBfOowttMP5cRdH6Q1:CoUGFuEpSz9CWIpN21ihOhtMP6R7
TLSH
T17943539153EF4AF262CEF9A408EB08975FF551F52BD3328D0BD1815857B9EB110F2A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_science.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c1sxuejy.default-release\personality-provider\nb_model_build_attachment_science.json
Size 56KB
SHA256 9606ce3988b2d2a4921b58ac454f54e53a9ea8f358326522a8b1dcc751b50b32
MD5 7a8fd079bb1aeb4710a285ec909c62b9
SHA1 8429335e5866c7c21d752a11f57f76399e5634b6
SHA512 8fc1546e509b5386c9e1088e0e3a1b81f288ef67f1989f3e83888057e23769907a2b184d624a4e4c44fcd5b88d719bd4cca94dfb33798804a721b8be022ec0c6
SSDEEP 1536:LjYZHEpB1Uj1/uC+Kgaj+ZSftvIu46MOYwZ6pFIIP0:LMZSzUj1WC+BajtftvIu4Ep
TLSH
T12F43549153EF4AF1A2DBF9A808AB08935FF551F42BD3718D0BD195489779EB010F3A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_shopping.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c1sxuejy.default-release\personality-provider\nb_model_build_attachment_shopping.json
Size 67KB
SHA256 bfd7e68ddca6696c798412402965a0384df0c8c209931bbadabf88ccb45e3bb6
MD5 97d4a0fd003e123df601b5fd205e97f8
SHA1 a802a515d04442b6bde60614e3d515d2983d4c00
SHA512 111e8a96bc8e07be2d1480a820fc30797d861a48d80622425af00b009512aacb30a2df9052c53bfbf4ee0800b6e6f5b56daa93d33f30fecb52e2f3850dfa9130
SSDEEP 1536:1vkMySD619DD3TjGVEcPtlGjsVLGNy9gvRa6a6ElLf2M3yi70rB:9WG6LDDjjQE6tlGBvRa6hxiorB
TLSH
T1F963845593EF0AB1B6CEF9A40CA708936EF551F92BD2328D1F819098D779BB010F3909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_sports.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c1sxuejy.default-release\personality-provider\nb_model_build_attachment_sports.json
Size 56KB
SHA256 44da98b03350e91e852fe59f0fc05d752fc867a5049ab0363da8bb7b7078ad14
MD5 ce4e75385300f9c03fdd52420e0f822f
SHA1 85c34648c253e4c88161d09dd1e25439b763628c
SHA512 d119dc4706bbf3b6369fe72553cfacf1c9b2688e0188a7524b56d3e2ac85582a18bbee66d5594e0fb40767432646c23bf3e282090bd9b4c29f989a374aeae61f
SSDEEP 1536:YwvnrcvFvtCkX5EAPqPaFg3GlEIwULrIHqBuH5qM:YwfAvgIrqPaq3GlE4Ej
TLSH
T1AA43649157EF4AF166DAF9A408AB08936FF551F92BC3328C0BD1914857B9FB110F390A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_travel.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c1sxuejy.default-release\personality-provider\nb_model_build_attachment_travel.json
Size 67KB
SHA256 4336ac211a822b0a5c3ce5de0d4730665acc351ee1965ea8da1c72477e216dfa
MD5 48139e5ba1c595568f59fe880d6e4e83
SHA1 5e9ea36b9bb109b1ecfc41356cd5c8c9398d4a78
SHA512 57e826f0e1d9b12d11b05d47e2f5ae4f5787537862f26e039918cb14faff4bc854298c0b7de3023e371756a331c0f3ee1aa7cebbbf94ec70cdfc29e00a900ed1
SSDEEP 1536:FNDkURt4oUTXolLQth8P2GHmB8+JEzoKGOcFhgywm3xXfKTvGHOym621Hp7JgET0:F/Rt4okQKoaaG7hPhhXCTvG4COq
TLSH
T1E363759143EF4AF1A2CAFA980CAB08935FF551F52FD2328D4BD5514897B9FB010F6A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recipe_attachment.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c1sxuejy.default-release\personality-provider\recipe_attachment.json
Size 1KB
SHA256 fc07d42847eeaf69dcbf1b9a16eb48b141c11feb67aa40724be2aee83cb621b7
MD5 be3d0f91b7957bbbf8a20859fd32d417
SHA1 fbc0380fe1928d6d0c8ab8b0a793a2bba0722d10
SHA512 8da24afcf587fbd4f945201702168e7cfc12434440200d00f09ddcd1d1d358a5e01065ac2a411fdf96a530e94db3697e3530578b392873cf874476b5e65d774a
TLSH
T16D41F63DB421186302E6676236DF42C4233402BE9EC17758FB88D49A5EFD5792236B2F
MD5 SHA1 SHA512 TLSH

Submit Download

94569313-a353-488e-8bd4-6b596d52d908.zip

Path C:\Users\Admin\AppData\Local\Temp\94569313-a353-488e-8bd4-6b596d52d908.zip
Size 3.7MB
SHA256 b64bb53928366bc2cbb66bfb7dac281b9fffe9e053ce12eaed925ed8b210551d
MD5 0364ce142fe6ce744c1b8cafc122e295
SHA1 8fb373379e3c7417ca5c8afd91d38fcfbe7e55b5
SHA512 4a2c7ee7f4b895f7d6b9f3c0a0073c62d25ef7ff44197e985b3b4a12502c9e40a6e652d005b3261ebb533332af4c9832efef274413dbccb6b6407b76450b11b2
SSDEEP 98304:PrjwkRdWFl1zF6JwXTyIR5fCwFvoUgnaea:Tc8WOJwXTyIR5qwXgnaea
TLSH
T1CC06F135D65C160BCDCF83BA8D0C2FC29C4C4FA68C54A96F6A6A9B715CA31E3DB74844
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 532KB
SHA256 08babde2036bdc0402ade4229ff56c724c42cc42c8c38f4674af2e084ef9b394
MD5 37ba52c2b2399d016aa155c8d2e2a2bc
SHA1 f56111f631e27017737a61ba771f016d39dc89fc
SHA512 74e23703f92e99bc7b6fe0f7d683f4fe9ca6f08e5d924d88c29464086cc71d9e80be107d13454689e913aacc0ce948a5c108ff85006049775bcf900dbb2cfbc8
SSDEEP 12288:fXMQGITl3xRNJQECmVf49eUInO8dmaa11X45CbLxaOQCTVGQyBo7sW4ney0anOa:f8QGo5xRN3dh492O8dhan45C5hQQ8fjJ
TLSH
T143C4F1FAB7657CE3A7BE02079D957F9E1A625E12C64EA0CC403B77C2417372AAF65400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7KE9Z2V0JQ6NITX8GXAC.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7KE9Z2V0JQ6NITX8GXAC.temp
Size 13KB
SHA256 37a1a3ff382e8eee30d3c23fc6aacdcea683547cbdddec39e5acc6be56e2a1f4
MD5 11a5926a0d19e092a17f902ea7110bd2
SHA1 243a7c6d778c5833482a5e95331a1e28628b8ca1
SHA512 bfb868baf16b2e4d12da2ff39a14c4098debe784a1ea7f18c16d2ea5eeb9acd442e5abdc90716e07f0d963bfa59e06f75d61980da7bbcfffeff9ed4afa5b3e7a
SSDEEP 48:B4od3yJ5UgdwqzPRod3yJ/6BdwWP3od3yJ/adwEE3Sod3yJePBdwR0Pbod3yJmTY:hsQs/fs/5sjsmbO+uVFKsMtscO+u76sf
TLSH
T1B652FE010BF71E59F5F396317A317B42AA77F802965A522EC086534908337609AADFE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c1sxuejy.default-release\AlternateServices.bin
Size 8KB
SHA256 4f19229b6b0734668f74525f1493105dd6c8005280b512f6adef1f13a8fec116
MD5 4428f5758beb32d7b900a175c1b9bfb6
SHA1 c030f54714edd7ea0944ae404140bee235e7bbc9
SHA512 572f60f3b756b741a6fb1b126727ecb18e15e035a2e2a2cc909cc80d36e9bbcf0e127f2349ef771b436279fc5b56b89ab688f5bfce088513b4aa4e535f53af96
SSDEEP 24:HuhMZf91dibjn9xp9bs9BtMbA9VvnMbs9F7MbE5q9F55A5S9b:b7ibj9b9bejMbKBnMbe9Mb2I56S9b
TLSH
T14D02A7E75776A432F0A28FF0405D718CCC73072606B99594C74490B716C5BEAD03EBE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c1sxuejy.default-release\AlternateServices.bin
Size 15KB
SHA256 8fd0953e81f5841f32458f531dc1a4971788fd61cd90d5a8e9960e58e6f3b4ed
MD5 4dfd7532c5ee15657f07433d31431b79
SHA1 f29f06c2fadd7c4139ed180e1067f26c8fbe1e99
SHA512 923f0b0dc2886ad881070ed39b268dab4c162aeb5a4d29e34e3aafb5701a2dce8bc1e5571db6660a34bbe878ecbb2d8620097dd441bd275b04907a66e280ee60
SSDEEP 96:iHj9NemKByec2I56uv7y3gFM/pGeyuZQXry8t7:MQ7ZZgrFt
TLSH
T1C16293F76BB26472F0A29FB0409CB1CCDC33072509ADA594C64490B716C5BAAD07FBE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c1sxuejy.default-release\AlternateServices.bin
Size 18KB
SHA256 2b6abe97bf4fb827ba76a2c5416a07a6c8a8757eab02a0d0493fc34b2e0eac37
MD5 6f80bc59fcaa06c6873dea0675910e58
SHA1 c93af67913556e45508a9526c69deb6de95756f2
SHA512 b53cc3e6289674ace2daed2e577830fb78af4c0b18c8bed415596fad81d713ad81701540eef585252f15457d864837209a47987c046a65bc6d3d0ea47a2864cc
SSDEEP 96:KxTj9NwHkMBDk8dk2I56uWUCeFM/pGeyuZQXry8t7FJG2uOz544:KkXLsQ7ZZgrFtSVOz
TLSH
T1E78298F76BB26472F0A29FB0405CB18CDC33072609AD9594C64494EB17C5BAAD17FBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c1sxuejy.default-release\addonStartup.json.lz4
Size 4KB
SHA256 c05c570132f31d7aecebd077bcce20138ccc7742b8c633e6ea68ec1be63e789a
MD5 37a666209512bddaababea60638eaabb
SHA1 2bac34d66446ba26971b698e352b61f39cc7be69
SHA512 26837dc991c0f5600ae74bf65a4b9662276dafd7c9e24578971eb487dd372091008ec819847ac14fed7302a84c79af2a2a2f33775ab2a9bcb7295e653bb98d4a
SSDEEP 96:Ntxm4sHNw6M2xWGhD41MgGvmHhF+rUpO1LnOYvhQhIRhN:NV52xxhD8rGvm6ApwnHUuhN
TLSH
T136A18EBAD141EFA6FE32C04348D97FB2EA9A9B7414A9C4D0F1AA71294C74E735704340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bookmarks-2026-06-23_10_J39FV_i0Kh7UzpFIa2aIn52_9oc_eHFRrWx6Zp4KgeM=.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c1sxuejy.default-release\bookmarkbackups\bookmarks-2026-06-23_10_J39FV_i0Kh7UzpFIa2aIn52_9oc_eHFRrWx6Zp4KgeM=.jsonlz4
Size 857B
SHA256 fc0d8d2747538533a7f7df1066ee7d04175969c7fe5c5fd54ae68ae8908a6e26
MD5 d4210bc3d362b8993f69f5665c4acdd4
SHA1 a7707aafaef252440489cbf47a7d04c8ad8ad610
SHA512 3b5dd8e0af631a4e8dfa770db5a162f397569b0fab44bd72c7d291f5e494701079c690f445808f4ad70bb246e02e76efe52b57f7f7db557a82f2c18990138191
TLSH
T150118ACCF5F101D445D5403614012B99B6D77F02CFC51CECFFCD04681068A8493EA389
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c1sxuejy.default-release\datareporting\glean\db\data.safe.tmp
Size 42KB
SHA256 2be81cb9c2c72ff69c984ef756422ca17e9e1d87b6137bd1498071cdc32aec0b
MD5 11e8f09b78f8d253e807a4296f0594d3
SHA1 c6e0719ac2198f9ff692a3180f68eac6b8a71216
SHA512 0e103161cd119eaa947de747c6804050c24804a26664bb9ab2fe9eb03021147029aef95bfe17ec928486edee34e64501e8da6e5f4543f6f241b805b44e421f88
SSDEEP 768:hNrc86G5vwOwlGcm+un6ZwwKsfKfpf/Pb8bVbRbebGXHqS31I1/:/chG5vJ62wbaem
TLSH
T156133380EB2E953FD41802BBDC951B142F79F88959192FAB3A4C54686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c1sxuejy.default-release\datareporting\glean\db\data.safe.tmp
Size 42KB
SHA256 b9edbb7db41907758fcc0e6b2832cbf011a5e706f53923db601f9aab321d8e14
MD5 b64a58f31b00abe21caf92ff5667b322
SHA1 63e30826d9d620f89ba357ae2efb8e5f6d0f4c1f
SHA512 d2f9c1bf4cd7f262ab69f1a01776cd251856ba7c6fd8bc29d50d218a29a87c58088f028ff0b14b3a09515eff26d69ce5c52eb11832361afd69fdf61f608f8bfb
SSDEEP 768:F1I1INrc86G5vwOwlGcm+un6ZwwKsfKfpf/Pb8bVbRbebGXHqSs:TbchG5vJ62wba5
TLSH
T18C133380EB2E953FD41802BBDC951B142F79F88959192FAB3A4C54686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c1sxuejy.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 9f5e912414a73081423df857218212fceed4ad94321e0607a92fcd067e200ef3
MD5 6f74f709e348e6994066ab2e538a3674
SHA1 68f2e660ed1734370eb6277326e571925a934215
SHA512 efd706a2aef70c8d8e06a5fb653c34e0b8c8f2fef6a0c33aba27c469221e09de95502faafc7be04f2be239bd4fcf40e0d72ddc360ba74048744d3bc8463dab1c
SSDEEP 768:Mhs1I1qiKhL0Gcm+uR8PRJxJFq5bOb0bzbZ:vtiKhT8PI
TLSH
T164D20344EB2E953FD42812BBDCA50B002F79BC8959192F573A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c1sxuejy.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 d2da795b71c6d923ae3b6c2c43f044280ef361092d367de337f7571b077ac849
MD5 7ebbf412e40354e553d5fd17b49eab09
SHA1 285dadc5a51f2e72ff98f36f3748f11c67eb05f0
SHA512 aa2991bd062d7cbd6e22f25ae7135d7ad85a189727975768f8786f29663f2c21a81d4da53583edf51b34bb78111fc476789ec12fbb06f65a9da9145be6f2284a
SSDEEP 768:S251I1qiKhL0Gcm+uR8PRJxJFq5bOb0bzbZ:btiKhT8PI
TLSH
T177D20344EB1E953FD42852BBDCA50B042F79BC8A59092F673A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c1sxuejy.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 118da1bf466384e1fd36e53dd1fb38df55d8f3eff79ae71040caf41ad048db92
MD5 9a7dff20ee61a03f57de87b50be4b0be
SHA1 9db76fc4e7bb7e2deb61fe3435c22dbc245a4565
SHA512 53ceb1574084f48a91fa322c2d3f238380bd1fe803a529b4f2eb493ca4ca1b47c006c26da356b18a4425e5a2510c760e9d0c8045b56a75bcf7c53827cce0d28c
SSDEEP 768:hiKhL0Gcm+uR8PRJxJFq5bOb0bzbZX1I1IHu:hiKhT8PIlE
TLSH
T1E3D20344EB2E953FD42852BBDCA50B042F79BC8A59092F573A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c1sxuejy.default-release\datareporting\glean\events\events
Size 1KB
SHA256 781e1c61de8f62bd2f918b7b55bfac9f2af86e710d4e13e2db86af7dc409fac6
MD5 9457bc319a9295e0cd23fff08a166f04
SHA1 31f454ef49ab5f329f0255e26a12c37640c01c9d
SHA512 8fe4f2ad6959da85b823f0dd183fdd48ef2182be2548a4d76ee7426976d256d4c321bf6e0c8ce85ea6fde2e39cfe717bcc3ad9c1b8fda15e35a13d968777561e
TLSH
T13621255C7DF98D3EA986F6A87445028E97558E0605C72C434D13EF8CCEC1AD9727E42D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c1sxuejy.default-release\datareporting\glean\events\events
Size 5KB
SHA256 3ac0c74f450430a3898a584fbf98f0d4b3996d8ff5d5303adf22ed9800137e56
MD5 7dc82c16f5578158c3aceeede31712ce
SHA1 a9212355834202ab3d1f851c06f711be4732e8f5
SHA512 b1ead8266769264400369e98cda571e48262d268d8945a18c8b01207a9734ba232f0034a5839b29a807c039fab31815628cfb8986c4cb566087e078e953ac7fb
SSDEEP 96:3LOdsizoV0g4bpia3dQ+YzdbOqtJpXyvpy:3SBU0gyQ/vjyvpy
TLSH
T11AB10F1CB8B90C7F69DBE39DB446028D87DD4A0285C718834C87EF4CCDC6B9A722E529
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8aded01e-8cf3-4db4-868d-a823f95b00e6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c1sxuejy.default-release\datareporting\glean\pending_pings\8aded01e-8cf3-4db4-868d-a823f95b00e6
Size 235B
SHA256 2c76666c1959cedd48b3be43d8ca2d68d9a1338ad41bb0eca02af6188d253081
MD5 21d343760bf26adc3657b81387fdbf0f
SHA1 0b7f7744f2b1452e5ae4cfa92971baa2c92c65ac
SHA512 da1a7bf4e98956b5318a8fedcd6cafd641297b8985db909a973adb7a3a7878c030beee70660ac1ea7454fb13ea3c7a778bcfb3aeddcd28e4447cdb52f39f0cf8
TLSH
T161D0A7E529F87B6E08240F1FF1F0E9C770488C3364B55C24E6A18574D9FB9C5516286B
MD5 SHA1 SHA512 TLSH

Submit Download

8d83840a-19fc-41b0-8f65-1678a2095b6a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c1sxuejy.default-release\datareporting\glean\pending_pings\8d83840a-19fc-41b0-8f65-1678a2095b6a
Size 235B
SHA256 22001721e4289993ee99d990671a0090ced4ca3d3beaab645873912e4029365a
MD5 1b9e1186e16b597b32e9363bf51b4b35
SHA1 b6e07863de7ad49b90c43e6b6f8b5fa1e737706b
SHA512 ff413a53d149d884620b6d8d7639c1bce157acead4a9a5e717b800323c81c495ea04ece8f71569fbfa0266213dccb0a27e0b5d5ed489a398fc6db19a06c30a39
TLSH
T13CD0978028A8A36D08204F03B0F06DCAB0854C3368A498108AE21678E9F9DC84165816
MD5 SHA1 SHA512 TLSH

Submit Download

8e1fb06f-3a62-4119-8557-8ad3fd2343de

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c1sxuejy.default-release\datareporting\glean\pending_pings\8e1fb06f-3a62-4119-8557-8ad3fd2343de
Size 871B
SHA256 d066d113e7c2d8948f21a1ea24df7abe2c56ae63f45014abe6b64e7248bbaee2
MD5 ff0c932fca3b17e50857e0c0fd491a07
SHA1 fec8c7c374b6f063024b1a49e23304191612339c
SHA512 d5181bde7b9109d0fe22cb5b6468ce3c0a45f35015bd97908d974057db1accd71a9527a9e6e3b1314ffeb3b70a162a86842424b075f8731fc22fc9ae1942099e
TLSH
T10A11C0859A74B9F2CC68C24F89997751CBB4752380C6440C3DA16B540D7EB1AA79A607
MD5 SHA1 SHA512 TLSH

Submit Download

e096fc9c-9aa7-4307-a5a3-0dafdea0b1f0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c1sxuejy.default-release\datareporting\glean\pending_pings\e096fc9c-9aa7-4307-a5a3-0dafdea0b1f0
Size 2KB
SHA256 41867b45114d5ab1972431bc06c21e8fa836e3f8ca26db478f3bbeb0fd8a5096
MD5 6a2b10406b7c6b85d62203246ddde65b
SHA1 fb6f271cf79392518aec99955af33236134a8cd3
SHA512 d406dc5abefac805d12e38b44fea8f116fbacf2a01e3ec4433d2ede9526c523f4670f7ac224dc211a0dc9f11efad296fdea916dd3cc1b1914a1d9a07b0b7bd20
TLSH
T13D41435C39785C7A9C8FF14DA482274D5370491300C238976E82EF4C8D86F9E336A51B
MD5 SHA1 SHA512 TLSH

Submit Download

f9ea1d2d-8934-423d-b5bf-d2ec7184b33c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c1sxuejy.default-release\datareporting\glean\pending_pings\f9ea1d2d-8934-423d-b5bf-d2ec7184b33c
Size 886B
SHA256 05537e2160e02b9ca4fcd970f3baf0c3ba090ef3dee19f716f9f746060bb38de
MD5 e33bd8b3497463ef451cdc314b24e00e
SHA1 777f0ddca24fa69bb46f7a1b99f6dcf70c24784e
SHA512 06b234bf8eec6df8ad1bbd193c8f59e30041ca9eb2d24be97fe15f1d4728482ce984ff9bf47699c620f70db0d21270c7496daa62558637c248744b25d9b6135c
TLSH
T1391100808BB4B9B2CC3CC24F99E577918BA07423D0CA59083CD06F180DAAB1DA39A707
MD5 SHA1 SHA512 TLSH

Submit Download

extension-preferences.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c1sxuejy.default-release\extension-preferences.json
Size 942B
SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
MD5 20357ec0806e9826d6daf456b6b16bd8
SHA1 7d5d7a921213989294eb5cea2ee760e562ce5293
SHA512 2333fde606ee727a6b6d9812ed40e56e5d0dba4ec35abcc11b67f8ad61d1d3d4af5db699d29b3ed6b459b9e142badae69ffbebf18974b5a1c72e45ecc8cf93cf
TLSH
T17211F13A640B6EB01E8E5625FE384A92E791111B50B7F2E47E69934A13D3970C1ED39C
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c1sxuejy.default-release\extensions.json
Size 16KB
SHA256 ce350a085d210d005acf2abb10434e6b97255421c4164ba12f76c4dbefb09d06
MD5 17af691aa80381de3a535d2cd01e27d4
SHA1 1b92a75ce8b65b8c85abb2bd9e87981c3e7d4744
SHA512 d5342e9ffb148f50c5f2662126e8f63542c8fc862fc7a84590401f885a4b5775407dbf6db4f286e9eb1f307e75841362b9feb02eeb8eddaf48c0e58d06683e71
SSDEEP 384:kkI4v1Umldv+b8dhWb94z/96ooL4HrL4PfL4H7L4HvL4He54hI:rI49RfNXa4Z654X4b4H4T4e4u
TLSH
T10D72411545048E78294EA79BAA36BE01C37D473B60845C78F4DD8FC842FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c1sxuejy.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c1sxuejy.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c1sxuejy.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c1sxuejy.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c1sxuejy.default-release\prefs-1.js
Size 8KB
SHA256 7ff6a5ef4b295729ac555af96a6dfa9bf4d6f40971cb3cbed28a854bedec958e
MD5 ae9b4c7d01aa2b297a385d22babc7ece
SHA1 df9ecd90067c29c02e6a9f609e059d875d97256f
SHA512 794f4eb7ce55304c3c543be725d5c32cee58e088182c696ff987476bb202380ad050ff68db0d82fcb1335c2258206264c10621229255bb152bd18d6513d36698
SSDEEP 96:xHsdVTU50PqGq4rfDV7eNbzSmsSSlBdv9j2nORWR2nbXQUTc8+uBw88VwAg8L4cT:YA0CRGfDV7eTsSSh8R2jTt+uBw88dE+
TLSH
T136020C7C9054CF7F74B676BCAC6848315AA2023B77BF68C650B94489054CF3485FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c1sxuejy.default-release\prefs-1.js
Size 7KB
SHA256 0f6901e4e716fe8ed196b4ad45f7771d91e88b17bc1b52ce8214272e2cf3871a
MD5 94a5d1e3c430e27041b9a114e628d7a9
SHA1 6c607cf21768c69b38f2c9a6688025c838f3ea42
SHA512 0f937da7fb25e9108c436ec34d954553a69d071c8f25b855243e308e6259aeb18d193f01c99cd8532d91ecfe4bfe62654cac3437dd4118438de5424e048e832a
SSDEEP 96:xHsdUTU5JqGq4rfy7eNbzSmsSSlBdv9jlnORH7bXQUTJBw88u8L4cncVATGS:YJURGfy7eTsSSM97jTJBw88++
TLSH
T18AE13F7894488B7F74B676ACAC6888305AB2013B7BBF68C750B554C8015CF3481F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c1sxuejy.default-release\prefs-1.js
Size 7KB
SHA256 989dfb1258f23e30ec6a6496db6b5be9d25bc1ec3a4365cfda71b31a1e98b15c
MD5 711231c06844cbd6e19374cdd668ad4d
SHA1 ff2d2fafba9bfb119f216c3c1e2f9f2a06ff7ed0
SHA512 16beb8a6feb7822411dd942a2c0f5bf6db102c9b4d344a2a86eea4ba8043e5e180525a779f5b3bbb73139f5174955c2260e70649a04d9b357f2552319338af75
SSDEEP 96:xHsdUTU50PqGq4rfy7eNbzSmsSSlBdv9j2nORH7bXQUTJBw88u8L4cncVATGS:YJ0CRGfy7eTsSSh97jTJBw88++
TLSH
T1D4E12E789548CB7F74B676ACAC6888315AB2013B7BBF68C750B54488055CF3481F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c1sxuejy.default-release\prefs.js
Size 6KB
SHA256 b727732bd29b16f1e5789a4575df611a5f0638c8e62c726071093802e185dc88
MD5 58a775767068a452008cdd7c7a1cec6f
SHA1 22066edf464ecc6ab0a64bce706d5a8144aac261
SHA512 d96a2331effeac217293e8ad7e8ed0bd39654a77f999f3f13c9406b6e42211a0014af11ad0b3a1d0cdd0c146bf198d2076cf63b49a62f477b0652097efb0e3f5
SSDEEP 96:xHsdUTU5JqGq4rfyuY1zSM6SSlBdv9jlnORH7bXQUTJBw88u8L4cncVA6:YJURGfyuYJ6SSM97jTJBw88+F
TLSH
T1E3E11E789508CB6F74B676ACAC688C315AB2013B7BBF68C750B554C4051CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c1sxuejy.default-release\prefs.js
Size 12KB
SHA256 6ab02954553ad1136b6fbcd1b88bda562977efd08ea75b7ed692ea6abb68d86d
MD5 be202a71ca30d567b148e0d64ca9dc89
SHA1 52cd175e09edef589fbad74b6f1cf4e7aaf600d3
SHA512 70e0ae3efcd3da59871e65029a26f0e0fb6c905ee7dcaa85a3524cd14fbc1bef0837cc83c52bef133fb86a79319d2b0b578f1d5efef7233e505d7b361b7f36d4
SSDEEP 192:+A0CRGfDV7eTsSShXLR2jTQiEOBw88Pbc1lEtzd7:6FR2jwfYWx
TLSH
T11542AB3C90A08E3F60B6327DAC69497019A1062777BFBCD205F99485489CF2485FBAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c1sxuejy.default-release\prefs.js
Size 6KB
SHA256 d2898fbb37631d57a090ada424c1b76b7cdfd5ba211318493ac21218586dfbdb
MD5 8d39df7ba4c6a58a18d8f03f9e2cec52
SHA1 7be958e27574212c152d402437f89c19126dcfe8
SHA512 7cf6a25d72b03022557d72944acf02c02c1a01cbb46f3c3d5521cb1470c9eadbeaf68e8b38589e6d95f5b7016b469efc3e70524bab35761e4dd62d4d496e9103
SSDEEP 96:xHsdUTU5JqGq4rfy7e1zSmsSSlBdv9jlnORH7bXQUTJBw88u8L4cncVA6:YJURGfy7evsSSM97jTJBw88+F
TLSH
T12AE12F789448CB7F74B676ACAC688C315AB2013B7BBF68C750B55484055CF3481F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c1sxuejy.default-release\prefs.js
Size 6KB
SHA256 f94177f50119784e1c688c61b7e3f4046fb1680a7e96a5d30a8bca35bdcd9628
MD5 62e3955d5bbaddd8407a24289e40b1c5
SHA1 d0c5cdb597ea785e25d40f7e8c9bc0b8a17a42b4
SHA512 f0981f4608e74123b0c47e0ece22465a7e82ac46325fecf99389710eac43177a53cebfe71ed9fc4ef7594a5b19d0590f295cbe7b93dad1279fa8d2982e490817
SSDEEP 96:xHsdUTU5JqGq4rfy7ekzSmsSSlBdv9jlnORH7bXQUTJBw88u8L4cncVATGS:YJURGfy7eEsSSM97jTJBw88++
TLSH
T168E12E789448CB7F74B676ACAC688C315AB2013B7BBF68C750B55488055CF3481F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c1sxuejy.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 7a944b48c6e2f9efd50fefdeb81b6f690f37cda2db2e0a04c9edb118fccce44e
MD5 c4c74aa905ac09ba3c9fdab92b0b23e2
SHA1 9bb9432778ab111bbfe246229f9b6358175dc80f
SHA512 d95212cde74f49e164a553729354e75201df21e25d62be76887b21471cb751b4effbbfd08a33c1f8b6f3242684c7611867c72551cea31cb2806dc55d84543e6e
TLSH
T1A4516D7B5C2B2CFB3562C29AACEF0FC08562202044FA807A7D55E96241FC309E5D6E5F
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c1sxuejy.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 06b6e84b54a5dec0d58bf21e89a2101717f17898ab7bb231e66d2be74f29a72c
MD5 d5e30b7a96f39f7bbf0acbe9ada1c1d9
SHA1 c03be4987ba3f685f88e6f605cb8b1acb29a9627
SHA512 30e6630a4ce83060b2dce5e59d65e589d485589d291f559b87b506863e1b061aca66ac3eeed8add8136b1f96a024194b16c31163bb49b4787c9360a671ca83f6
SSDEEP 96:52eT2j29cZwjQaPg2U3icXRfLCd01VrqM4EcZZi6rLKJyXrkDu:532y9cZwS3HRfLi0v/4lk6
TLSH
T175918E7F1C3A78AF6261D4B15CDE0FE887C650C496E40166AF285EB202BC307869C75E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c1sxuejy.default-release\sessionstore-backups\recovery.jsonlz4
Size 5KB
SHA256 e5991217df8260e817d403151a195d6b830fe379a364a0546ef181fc04160081
MD5 c40e4aa59690d3cbbb37cf21f0159ff3
SHA1 72985abfe1c2650b4ee403d87fdebf16d1414061
SHA512 3b284407f116077ddfa9cc8500f8414422a15da5e9aec94667bf7175aee9d18da307fd148dbe2338860874e082178226ca46cfdf5757a2dac415fe90cb39c056
SSDEEP 96:h2eT2j29cZwjQaPg2U3icXRfdCd01VrqM4EcZZi6rLKJX3k2T5l/YVbIFH/k8gQW:h32y9cZwS3HRfdi0v/4KTUOH/kZQW
TLSH
T18BC18D6B1822B69F3224E8F12CEE0FA5426180C4D6E10159FB393FE651ED305875C3AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c1sxuejy.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 7.0MB
SHA256 f02a861be226b69f295751763aae9b26a02aac472e554c75cf67c99416211764
MD5 5b36836f86661db2ceb5651eeb51e63b
SHA1 88b3806d78e3c4b6a4e026d8e497b2d3313174bc
SHA512 2bdfeff01caf4bd4d9fec3fade359bc408fac38470338b7be78c08ffff504d05e3eff063c6ca8240834069bdc4f253d3eacd71beaf4ad7eb3eadccc4ca9891b0
SSDEEP 49152:OLdLyMaeUH6QC5zYYjQzJgYK/K2uCUP3NNreldXuZuJRX/D/JE0IY0MsSYHTdnAP:3qTsSoTdnAehFfAA
TLSH
T18B765CE420E19253F38644B3719993FB20EFC01C6036CE44579496FAA9748EB8E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xulstore.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c1sxuejy.default-release\xulstore.json
Size 167B
SHA256 a261f6c4c1f49fbaac01d6d7437da1149f9b03588d54b2fd860fdfe969596115
MD5 e116daaa7b2ab9bd0f8985831cbbac49
SHA1 e7d1fed6c2125cee196699694b7f4532f20536c1
SHA512 5d0ccbfdd9e5160a07f658fcb99e7527fdaed658a3f7c78c9bec2b7fcba9025e88be25b804102b371307edc1aec5972752fcdb204239dbc5e65f7a3c59a268b8
TLSH
T1CFC08CB022AFA8087D27CBCF128D22983E398A5491D0529A7AEA94A018C470F9D18388
MD5 SHA1 SHA512 TLSH

Submit Download

RobloxPlayerInstaller.q8lUvf4p.exe.part

Path C:\Users\Admin\Downloads\RobloxPlayerInstaller.q8lUvf4p.exe.part
Size 9.8MB
SHA256 22858fa38591e6f06b10adff0a994b624c8c45b1ff8cc9f349adcdaaf2cbef7b
MD5 c64d69d3b38406a4cee941a7d2635675
SHA1 ccd513891219b9f64fdbfc0f6b0ea044b3c75f11
SHA512 f96707447bd23c0354f773593209186b1975c9c01b55ce151ee96853c5577817b7e8b989abd4e8ddb808512d2005db28b67200e8807b8cff5056a812f968a61f
SSDEEP 196608:oKlQ2GVK1WdgxK1t8msxmlzwDoVa//eB5iyLs:ohVKY8msxGzaoVa//l0s
TLSH
T17DA6BF22FA01C032E9D200B2D6BDAFB6597C9930077944D3A7D45EB959305E33B39B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6056-4917-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-4918-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-4919-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-4922-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-4923-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-4924-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-4916-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-4935-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-4936-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-4937-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-4940-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-4941-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-4942-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-4914-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-4913-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-4912-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-4911-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-4908-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-4906-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-4896-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-5043-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-4892-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-4889-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-4882-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-1857-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-1008-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-953-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-912-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-706-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-0-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-512-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-322-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-284-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-15-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-14-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-13-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-12-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-11-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-10-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-9-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-8-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-7-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-6-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-5-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-4-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-3-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-1-0x0000000077518000-0x0000000077519000-memory.dmp

Download

memory/6056-5228-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-5231-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-5232-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-5233-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-5234-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-2-0x0000000077519000-0x000000007751A000-memory.dmp

Download

memory/6056-5250-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-5251-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-5252-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-5253-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-5254-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-5255-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-5263-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-5267-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-5268-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-5269-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-5270-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-5271-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-5272-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-5273-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/6056-5274-0x0000000000400000-0x0000000000507000-memory.dmp

Download