754712b4ce55c80dc55b7f942672ecfa07cc9934a17cf6f120c32862886cfe90

Analysis

user interaction
yes
max time kernel
760s
max time network
762s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/07/2026, 15:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zilko.xdbot.dll
Size 9.1MB
Sample260712-srfshaes8v
SHA256 754712b4ce55c80dc55b7f942672ecfa07cc9934a17cf6f120c32862886cfe90
MD5 e7f59461133ec9d501e606b2ae66a717
SHA1 3cbad29aa0206347bfea9a8d14ae9dff98f72d90
SHA512 fa49e0090707e0458afdc76f15c8b01a43cace540e342640293dd7febbc9c315c077eeda03f219316db96afd8b1b1d07ccf43d85de8b49d01aaac2ae236bb2b2
SSDEEP 49152:2DbgLdrd2vZR//mBiOJNHRzbyr8NKyKvBF5uTNbbN6/vHHXPzP1+6deruw1rern2:O/PsqiG1sEqLEuYfrve9n
TLSH
T1B5A6F7176B45A26DC9A7C078E18B0392A86171D98F3477EB4149916C3F32BF8AF3D718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
899	2300	firefox.exe

Executes dropped EXE 7 IoCs

pid	Process
1056	RobloxPlayerInstaller.exe
7756	RobloxPlayerBeta.exe
7256	RobloxPlayerBeta.exe
5724	RobloxPlayerBeta.exe
5456	RobloxPlayerInstaller.exe
4744	RobloxPlayerBeta.exe
6832	RobloxPlayerBeta.exe

Loads dropped DLL 5 IoCs

pid	Process
7756	RobloxPlayerBeta.exe
7256	RobloxPlayerBeta.exe
5724	RobloxPlayerBeta.exe
4744	RobloxPlayerBeta.exe
6832	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs

pid	Process
7756	RobloxPlayerBeta.exe
7756	RobloxPlayerBeta.exe
7756	RobloxPlayerBeta.exe
7256	RobloxPlayerBeta.exe
7256	RobloxPlayerBeta.exe
7256	RobloxPlayerBeta.exe
5724	RobloxPlayerBeta.exe
5724	RobloxPlayerBeta.exe
5724	RobloxPlayerBeta.exe
4744	RobloxPlayerBeta.exe
4744	RobloxPlayerBeta.exe
4744	RobloxPlayerBeta.exe
6832	RobloxPlayerBeta.exe
6832	RobloxPlayerBeta.exe
6832	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\LuaApp\graphic\playBtnBackground.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\StudioSharedUI\sort.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\Settings\Radial\TopRightSelected.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\LuaApp\graphic\shimmer.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\fonts\PressStart2P-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\Chat\MessageCounter.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\Controls\xboxX.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\InspectMenu\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\LegacyRbxGui\PlankSide.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\Moments\Reactions\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\PlayerList\AcceptButton.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\AvatarExperience\PPEWidgetBackgroundDarkTheme.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\LuaDiscussions\buttonStroke.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\sounds\impact_water.mp3	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\fonts\Montserrat-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\MenuBar\arrow_right.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\Moments\Reactions\heart-large.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\LuaChat\icons\ic-clear-solid.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\LuaChatV2\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\AvatarEditorImages\Sliders\gr-slide-bar-fill.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\ExpandArrowSheet.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\WarningIcon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\Moments\Reactions\crying-xsmall.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\VoiceChat\SpeakerNew\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\LuaApp\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\avatar\compositing\CompositExtraSlot3.mesh	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\models\Thumbnails\MakeupEnvironment.rbxl	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\Chat\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\PlatformContent\pc\textures\water\normal_17.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\fonts\families\JosefinSans.json	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\InspectMenu\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\Settings\Help\ResetIcon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\Settings\Players\ReportFlagIcon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\InGameMenu\ScrollMiddle.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\LoadingScreen\BackgroundLight.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\TopBar\HurtOverlayAsset.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\VoiceChat\RedSpeakerLight\Unmuted100.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\LuaApp\category\ic-top rated.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\Input\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\LegacyRbxGui\Gold.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\Controls\XboxController\ButtonRB.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\VoiceChat\MicLight\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\LuaApp\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\TopBar\emotesOn.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\VoiceChat\Misc\UnmuteAll.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\LuaChat\9-slice\input-send-message.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\fonts\Oswald-Bold.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\Controls\spacebar.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\Controls\xboxmenu.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\InspectMenu\gr-item-selector-triangle.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\MenuBar\icon_emote.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\LuaChat\graphic\gr-indicator-online-14x14.png	RobloxPlayerInstaller.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\PROTOCOLEXECUTE\ROBLOX-PLAYER	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\PROTOCOLEXECUTE\ROBLOX	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\DisplayName = "Chrome Sandbox"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Children	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Moniker = "fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f"	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-36a2600cebf1487d"	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\ROBLOX-PLAYER\SHELL\OPEN\COMMAND	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-36a2600cebf1487d\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f\Children	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-36a2600cebf1487d\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\ROBLOX\DEFAULTICON	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-36a2600cebf1487d"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-36a2600cebf1487d\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-36a2600cebf1487d\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\ROBLOX\SHELL\OPEN\COMMAND	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-36a2600cebf1487d"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-36a2600cebf1487d\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-36a2600cebf1487d\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-4bb3958a2cde4efb"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-36a2600cebf1487d"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-36a2600cebf1487d\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\ROBLOX-PLAYER\DEFAULTICON	RobloxPlayerInstaller.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1056	RobloxPlayerInstaller.exe
1056	RobloxPlayerInstaller.exe
7756	RobloxPlayerBeta.exe
7256	RobloxPlayerBeta.exe
5724	RobloxPlayerBeta.exe
5456	RobloxPlayerInstaller.exe
5456	RobloxPlayerInstaller.exe
4744	RobloxPlayerBeta.exe
6832	RobloxPlayerBeta.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	2300	firefox.exe
Token: SeDebugPrivilege	2300	firefox.exe
Token: SeDebugPrivilege	2300	firefox.exe
Token: SeDebugPrivilege	2300	firefox.exe
Token: SeDebugPrivilege	2300	firefox.exe
Token: SeDebugPrivilege	2300	firefox.exe
Token: SeDebugPrivilege	1056	RobloxPlayerInstaller.exe
Token: SeDebugPrivilege	1056	RobloxPlayerInstaller.exe
Token: SeDebugPrivilege	1056	RobloxPlayerInstaller.exe
Token: SeDebugPrivilege	1056	RobloxPlayerInstaller.exe
Token: SeDebugPrivilege	1056	RobloxPlayerInstaller.exe
Token: SeDebugPrivilege	1056	RobloxPlayerInstaller.exe
Token: SeDebugPrivilege	2300	firefox.exe
Token: SeDebugPrivilege	1056	RobloxPlayerInstaller.exe
Token: SeDebugPrivilege	1056	RobloxPlayerInstaller.exe
Token: SeDebugPrivilege	1056	RobloxPlayerInstaller.exe
Token: SeDebugPrivilege	1056	RobloxPlayerInstaller.exe
Token: SeDebugPrivilege	2300	firefox.exe
Token: SeDebugPrivilege	2300	firefox.exe
Token: SeDebugPrivilege	2300	firefox.exe
Token: SeDebugPrivilege	2300	firefox.exe
Token: SeDebugPrivilege	2300	firefox.exe

Suspicious use of FindShellTrayWindow 58 IoCs

pid	Process
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe
2300	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2300	3008	firefox.exe	87
PID 3008 wrote to memory of 2300	3008	firefox.exe	87
PID 2300 wrote to memory of 404	2300	firefox.exe	88
PID 2300 wrote to memory of 404	2300	firefox.exe	88
PID 2300 wrote to memory of 404	2300	firefox.exe	88
PID 2300 wrote to memory of 4272	2300	firefox.exe	89
PID 2300 wrote to memory of 4272	2300	firefox.exe	89
PID 2300 wrote to memory of 4272	2300	firefox.exe	89
PID 2300 wrote to memory of 4272	2300	firefox.exe	89
PID 2300 wrote to memory of 3032	2300	firefox.exe	90
PID 2300 wrote to memory of 3032	2300	firefox.exe	90
PID 2300 wrote to memory of 3032	2300	firefox.exe	90
PID 2300 wrote to memory of 3032	2300	firefox.exe	90
PID 2300 wrote to memory of 3816	2300	firefox.exe	91
PID 2300 wrote to memory of 3816	2300	firefox.exe	91
PID 2300 wrote to memory of 3816	2300	firefox.exe	91
PID 2300 wrote to memory of 2400	2300	firefox.exe	92
PID 2300 wrote to memory of 2400	2300	firefox.exe	92
PID 2300 wrote to memory of 2400	2300	firefox.exe	92
PID 2300 wrote to memory of 2400	2300	firefox.exe	92
PID 2300 wrote to memory of 4608	2300	firefox.exe	93
PID 2300 wrote to memory of 4608	2300	firefox.exe	93
PID 2300 wrote to memory of 4608	2300	firefox.exe	93
PID 2300 wrote to memory of 4608	2300	firefox.exe	93
PID 2300 wrote to memory of 4764	2300	firefox.exe	94
PID 2300 wrote to memory of 4764	2300	firefox.exe	94
PID 2300 wrote to memory of 4764	2300	firefox.exe	94
PID 2300 wrote to memory of 4764	2300	firefox.exe	94
PID 2300 wrote to memory of 3836	2300	firefox.exe	95
PID 2300 wrote to memory of 3836	2300	firefox.exe	95
PID 2300 wrote to memory of 3836	2300	firefox.exe	95
PID 2300 wrote to memory of 3836	2300	firefox.exe	95
PID 2300 wrote to memory of 2644	2300	firefox.exe	96
PID 2300 wrote to memory of 2644	2300	firefox.exe	96
PID 2300 wrote to memory of 2644	2300	firefox.exe	96
PID 2300 wrote to memory of 2644	2300	firefox.exe	96
PID 2300 wrote to memory of 1036	2300	firefox.exe	109
PID 2300 wrote to memory of 1036	2300	firefox.exe	109
PID 2300 wrote to memory of 1036	2300	firefox.exe	109
PID 2300 wrote to memory of 1036	2300	firefox.exe	109
PID 2300 wrote to memory of 5540	2300	firefox.exe	110
PID 2300 wrote to memory of 5540	2300	firefox.exe	110
PID 2300 wrote to memory of 5540	2300	firefox.exe	110
PID 2300 wrote to memory of 5540	2300	firefox.exe	110
PID 2300 wrote to memory of 5560	2300	firefox.exe	111
PID 2300 wrote to memory of 5560	2300	firefox.exe	111
PID 2300 wrote to memory of 5560	2300	firefox.exe	111
PID 2300 wrote to memory of 5560	2300	firefox.exe	111
PID 2300 wrote to memory of 5568	2300	firefox.exe	112
PID 2300 wrote to memory of 5568	2300	firefox.exe	112
PID 2300 wrote to memory of 5568	2300	firefox.exe	112
PID 2300 wrote to memory of 5568	2300	firefox.exe	112
PID 2300 wrote to memory of 3908	2300	firefox.exe	113
PID 2300 wrote to memory of 3908	2300	firefox.exe	113
PID 2300 wrote to memory of 3908	2300	firefox.exe	113
PID 2300 wrote to memory of 3908	2300	firefox.exe	113
PID 2300 wrote to memory of 5988	2300	firefox.exe	114
PID 2300 wrote to memory of 5988	2300	firefox.exe	114
PID 2300 wrote to memory of 5988	2300	firefox.exe	114
PID 2300 wrote to memory of 5988	2300	firefox.exe	114
PID 2300 wrote to memory of 6116	2300	firefox.exe	115
PID 2300 wrote to memory of 6116	2300	firefox.exe	115
PID 2300 wrote to memory of 6116	2300	firefox.exe	115
PID 2300 wrote to memory of 6116	2300	firefox.exe	115

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\zilko.xdbot.dll,#1
1⤵
PID:4984

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Downloads MZ/PE file
  - Drops desktop.ini file(s)
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2016 -prefsLen 27099 -prefMapHandle 2020 -prefMapSize 270279 -ipcHandle 2088 -initialChannelId {55e6fe6a-2a37-4eb4-904c-9cc607b14e78} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2476 -prefsLen 27135 -prefMapHandle 2480 -prefMapSize 270279 -ipcHandle 2488 -initialChannelId {d9c0a799-eb13-47d1-a5bc-ff83b8e96940} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4272
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3824 -prefsLen 27276 -prefMapHandle 3828 -prefMapSize 270279 -jsInitHandle 3832 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3840 -initialChannelId {d306ac8b-4111-4fd9-8d77-41e8ecac7480} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4048 -prefsLen 27276 -prefMapHandle 4052 -prefMapSize 270279 -ipcHandle 4068 -initialChannelId {3b202d62-f52b-4016-ae3e-9ca59a83460f} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4408 -prefsLen 34775 -prefMapHandle 4412 -prefMapSize 270279 -jsInitHandle 4416 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4392 -initialChannelId {9fea08ef-518e-4b5a-920d-4d6460325293} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4752 -prefsLen 35012 -prefMapHandle 4864 -prefMapSize 270279 -ipcHandle 4904 -initialChannelId {4ab03763-a314-4cc9-b1f8-0671558b2dd6} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5008 -prefsLen 32900 -prefMapHandle 5012 -prefMapSize 270279 -jsInitHandle 5016 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5024 -initialChannelId {04399b28-6020-4236-8649-cd1da4d277df} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2812 -prefsLen 32952 -prefMapHandle 5232 -prefMapSize 270279 -jsInitHandle 5228 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5220 -initialChannelId {24858d18-e1e6-4347-b4d3-b007eed4e5ac} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:3836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5404 -prefsLen 32952 -prefMapHandle 5408 -prefMapSize 270279 -jsInitHandle 5412 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5420 -initialChannelId {5f3c239b-6284-441a-9759-5f1671e9dc4c} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5580 -prefsLen 36399 -prefMapHandle 4712 -prefMapSize 270279 -jsInitHandle 4584 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5992 -initialChannelId {5632a280-ddaf-4435-9708-32a97cd4849b} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:1036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6460 -prefsLen 36758 -prefMapHandle 6464 -prefMapSize 270279 -jsInitHandle 6468 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6476 -initialChannelId {09fac0fd-5139-4e4b-a761-b61ddd9563e9} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:5540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6636 -prefsLen 36758 -prefMapHandle 6632 -prefMapSize 270279 -jsInitHandle 6672 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6684 -initialChannelId {d01e03a8-998b-47ce-8d25-4b2639e1dc53} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:5560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6804 -prefsLen 36758 -prefMapHandle 6800 -prefMapSize 270279 -jsInitHandle 6808 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6812 -initialChannelId {92fa6ad9-efd4-4965-8050-47e38407e798} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:5568
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5980 -prefsLen 36758 -prefMapHandle 6172 -prefMapSize 270279 -jsInitHandle 6004 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5856 -initialChannelId {c6c2413e-a015-4a08-b3f2-9991bab99afd} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:3908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5864 -prefsLen 36758 -prefMapHandle 4656 -prefMapSize 270279 -jsInitHandle 7500 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5924 -initialChannelId {d5db3a2b-6c51-4a66-892a-8515428e7d71} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:5988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7716 -prefsLen 36758 -prefMapHandle 7720 -prefMapSize 270279 -jsInitHandle 7724 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7732 -initialChannelId {ed4590d1-c27a-450d-bae6-cbbd8185588e} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:6116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7884 -prefsLen 36758 -prefMapHandle 7880 -prefMapSize 270279 -jsInitHandle 7876 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7928 -initialChannelId {8d038f6e-6cba-41f3-ae15-0422b94d435b} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    - Checks processor information in registry
    PID:1076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 8376 -prefsLen 39927 -prefMapHandle 8380 -prefMapSize 270279 -ipcHandle 8392 -initialChannelId {9ffeaf59-c8e7-40a3-849b-76569c2ec578} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 utility
    3⤵
    - Checks processor information in registry
    PID:5900
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8412 -prefsLen 36808 -prefMapHandle 8416 -prefMapSize 270279 -jsInitHandle 8420 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8424 -initialChannelId {41ce23af-c658-412a-8fa3-4213e554d981} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
    3⤵
    - Checks processor information in registry
    PID:6092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 8804 -prefsLen 39927 -prefMapHandle 8820 -prefMapSize 270279 -ipcHandle 8880 -initialChannelId {dc1f4bff-1586-42bf-b77e-3af6b9d6b5f3} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 utility
    3⤵
    - Checks processor information in registry
    PID:6704
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9012 -prefsLen 36895 -prefMapHandle 8976 -prefMapSize 270279 -jsInitHandle 8980 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9016 -initialChannelId {9e350c31-0382-421f-9a8e-c48a96897a27} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab
    3⤵
    - Checks processor information in registry
    PID:6304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5980 -prefsLen 36895 -prefMapHandle 6864 -prefMapSize 270279 -jsInitHandle 7560 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7292 -initialChannelId {6e8d57fc-bb78-40a0-bbd9-3d22bff27eec} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 22 tab
    3⤵
    - Checks processor information in registry
    PID:832
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6912 -prefsLen 36895 -prefMapHandle 6924 -prefMapSize 270279 -jsInitHandle 6936 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9468 -initialChannelId {029c0f09-47ff-4a34-a2ee-516b4ea029b8} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 tab
    3⤵
    - Checks processor information in registry
    PID:6768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8240 -prefsLen 36895 -prefMapHandle 8188 -prefMapSize 270279 -jsInitHandle 8268 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7560 -initialChannelId {45b2cf9a-2d43-4a2a-ba61-a02dfe378cc0} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 24 tab
    3⤵
    - Checks processor information in registry
    PID:6080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9704 -prefsLen 36895 -prefMapHandle 9708 -prefMapSize 270279 -jsInitHandle 9712 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9720 -initialChannelId {f5eb01e4-cbb1-452e-9fd4-ac6e70ececed} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 25 tab
    3⤵
    - Checks processor information in registry
    PID:5216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5184 -prefsLen 37055 -prefMapHandle 5168 -prefMapSize 270279 -jsInitHandle 5172 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9380 -initialChannelId {9d9f2de7-4043-40a2-91fb-5b98d8488f77} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 26 tab
    3⤵
    - Checks processor information in registry
    PID:6112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9496 -prefsLen 37055 -prefMapHandle 9564 -prefMapSize 270279 -jsInitHandle 9568 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6948 -initialChannelId {4f45e2d5-c2e9-4d52-8c9a-cb7cb149943f} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 27 tab
    3⤵
    PID:4908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5204 -prefsLen 37055 -prefMapHandle 5976 -prefMapSize 270279 -jsInitHandle 8708 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7900 -initialChannelId {3a0d6d8b-263c-4885-85a2-0f007b7e3d6d} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 28 tab
    3⤵
    - Checks processor information in registry
    PID:3376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2612 -prefsLen 37055 -prefMapHandle 6000 -prefMapSize 270279 -jsInitHandle 5800 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6296 -initialChannelId {28879802-a3a1-4e2b-a793-a736c8203d40} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 29 tab
    3⤵
    PID:5912
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5008 -prefsLen 37055 -prefMapHandle 5176 -prefMapSize 270279 -jsInitHandle 5164 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9552 -initialChannelId {d8f93389-a838-4bc3-9cfc-75f2d43cbc61} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 30 tab
    3⤵
    - Checks processor information in registry
    PID:6188
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2868 -prefsLen 37055 -prefMapHandle 9704 -prefMapSize 270279 -jsInitHandle 9952 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2972 -initialChannelId {8f8214ad-2860-4055-87a2-6b75e339d988} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 31 tab
    3⤵
    - Checks processor information in registry
    PID:5400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9528 -prefsLen 37055 -prefMapHandle 4792 -prefMapSize 270279 -jsInitHandle 4748 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5012 -initialChannelId {553abe5e-a11f-4400-b0d4-e0a78d64c9a5} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 32 tab
    3⤵
    - Checks processor information in registry
    PID:1516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5012 -prefsLen 37055 -prefMapHandle 9704 -prefMapSize 270279 -jsInitHandle 10580 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10588 -initialChannelId {0f8de63f-c68f-4a6c-b0a7-1945bf7501d4} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 33 tab
    3⤵
    - Checks processor information in registry
    PID:820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8412 -prefsLen 37055 -prefMapHandle 4404 -prefMapSize 270279 -jsInitHandle 4788 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6676 -initialChannelId {34f58504-2e40-4511-ad52-a00c82a76764} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 34 tab
    3⤵
    - Checks processor information in registry
    PID:4328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9688 -prefsLen 37055 -prefMapHandle 9096 -prefMapSize 270279 -jsInitHandle 6772 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10844 -initialChannelId {8127fe54-187e-47a7-a255-2cf958d61a2d} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 35 tab
    3⤵
    - Checks processor information in registry
    PID:3232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10172 -prefsLen 37055 -prefMapHandle 9524 -prefMapSize 270279 -jsInitHandle 5888 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10296 -initialChannelId {61a89acd-a0e1-4af1-b73a-6606034ba727} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 36 tab
    3⤵
    - Checks processor information in registry
    PID:7028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10436 -prefsLen 37055 -prefMapHandle 5804 -prefMapSize 270279 -jsInitHandle 5344 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6100 -initialChannelId {88d68649-d951-4834-b934-5b39efbd21b1} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 37 tab
    3⤵
    - Checks processor information in registry
    PID:6264
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5540 -prefsLen 37055 -prefMapHandle 9372 -prefMapSize 270279 -jsInitHandle 10508 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5128 -initialChannelId {733adfc3-0e19-4e1b-9c3d-efc665688a94} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 38 tab
    3⤵
    PID:2688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5764 -prefsLen 37055 -prefMapHandle 5180 -prefMapSize 270279 -jsInitHandle 5916 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9556 -initialChannelId {7affc0f3-e64c-4cdd-93b1-1bda5c7e4271} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 39 tab
    3⤵
    - Checks processor information in registry
    PID:5964
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11120 -prefsLen 37055 -prefMapHandle 11124 -prefMapSize 270279 -jsInitHandle 11128 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11132 -initialChannelId {fc7326b7-da9c-4e76-9ef5-592955195fe3} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 40 tab
    3⤵
    - Checks processor information in registry
    PID:2800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6404 -prefsLen 37055 -prefMapHandle 11356 -prefMapSize 270279 -jsInitHandle 10044 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5764 -initialChannelId {19511a75-8a1e-42bc-86e8-6d52eac98211} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 41 tab
    3⤵
    - Checks processor information in registry
    PID:2572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11284 -prefsLen 37055 -prefMapHandle 11288 -prefMapSize 270279 -jsInitHandle 11316 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2696 -initialChannelId {6915ffa4-6dde-41da-a168-b0c46c5e195c} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 42 tab
    3⤵
    - Checks processor information in registry
    PID:6820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11720 -prefsLen 37055 -prefMapHandle 11724 -prefMapSize 270279 -jsInitHandle 11728 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11676 -initialChannelId {dfd4409e-87c3-41a8-875c-0ec6376dee12} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 43 tab
    3⤵
    - Checks processor information in registry
    PID:696
- - C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
    "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - Enumerates system info in registry
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1056
  - - C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe
      "C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 1056
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      PID:7756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11724 -prefsLen 37095 -prefMapHandle 9692 -prefMapSize 270279 -jsInitHandle 10380 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7712 -initialChannelId {dbc809d3-c011-4a9a-994e-563c90c6e1c2} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 44 tab
    3⤵
    - Checks processor information in registry
    PID:7416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10372 -prefsLen 37095 -prefMapHandle 2796 -prefMapSize 270279 -jsInitHandle 9968 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11204 -initialChannelId {33722d3a-e42e-430b-8e83-840b8a2d08a2} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 45 tab
    3⤵
    - Checks processor information in registry
    PID:5824

C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:7256

C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5724

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4328

C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerInstaller.exe
"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerInstaller.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5456
- C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe
  "C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 5456
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:4744

C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:6832

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
PID:3296
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\avatar\animations\humanoidR6AnimateChildren.rbxm
  2⤵
  PID:4068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RobloxStudioInstaller.exe

Path C:\Program Files\Roblox\Versions\RobloxStudioInstaller.exe
Size 9.6MB
SHA256 605c024da43bb554542bd91d4d8688db6cc3b725f020e07b67c709de01a2a9c4
MD5 861dd6fa62771d9c50fa74cb94237d1a
SHA1 a1218ed98527ba4d252f01f25c3ea7238944ebd0
SHA512 4d600b8c1a3b89298cacba8549dea286e3962e44496ca9404a30ab7ef400620d780e9acacbe50f6b218726bdfddecbec0e1b16b243deea097e604a9e3d6b19db
SSDEEP 196608:sytUeAe3XKrW86kmLD0msx1WoZivT6WibBrKCZ:s0XK00msx1bZIT6Wi1nZ
TLSH
T138A6AE22B901C032E8D200B296BD5FFA993D9E341B3954D3A7D45DB95A305D33B39B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppSettings.xml

Path C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\AppSettings.xml
Size 144B
SHA256 d5de39863fe721668ce1e115e0fc55a7c733747daff6235d27dad3d160c84dbb
MD5 431a6eb20932ec1c56682a1f60d231d3
SHA1 40bb32db040cabade103c21ba5b6f811dfb0773e
SHA512 0969b9484bb7c661d4e0452ff1c77396796333904b39f24c56d5a92ac4ed4ebde9b8981a985c6950b4af2852e8d9599e071a51ce4f9ef21ead778a2fdc76fcec
TLSH
T18AC09BA45351C4149795CF14977DF690E3B1797444504498D8A1785A0DC51D427D53A3
MD5 SHA1 SHA512 TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.dll
Size 20.7MB
SHA256 650840a8a47d32f6b58d0c8d2b53cd82c07f6153067ea81fca425995b82d56a3
MD5 6880846bde28e2d05a247fa2a2187224
SHA1 8e69b4f935cf78af99d63a10dc7b44dfcb179d2e
SHA512 66fd7997ca331a43ab40102b3fa02cec3269fdc503418cbd1b2476c8e87dde5654e075963cfa26540455a655f6ac6483c3696ab59535c6ea71b8e705757b8eed
SSDEEP 196608:Q3Nw591wKdbnHLuOixYG+YfHLfNqnKUc:gNI9P1inXfc
TLSH
T19327BF4EB8D20AE8D2725070E05F57E3EA62708C0B6D2EF746E94111363369E564AF7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Roblox Player.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Roblox\Roblox Player.lnk
Size 1KB
SHA256 005bd06bd7d9bdfa24d5523f74f920c885e90e50f841637fc86c2998b994fbf3
MD5 9eb5da4756717949023ebde09d85038b
SHA1 b638b35e2621742e574a81fb8831878b99f38783
SHA512 2a0c8636df0e851dc747f82332bb0d83e7709c0d5e23fac9135165f67f8de4caa4219f1386b430c81e40c52890d6dd2223aa73ae281012576544c04b9eb6e70b
TLSH
T17B21CB244EE61769F1F2C531A8F51262FF32BD41BE5DAF2E41CA13AC09A010095A9F6A
MD5 SHA1 SHA512 TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\activity-stream.contile.json
Size 4KB
SHA256 edfbfad03051d16f552bd4b24074804df5cc5d791dbb13bc27ee50b7e9768945
MD5 8042b31cdc488f6e856400f13364b03d
SHA1 4cb207b1ce600005f5925e3e76b9691f4711fe66
SHA512 5cf5bacc61188bb62482123bacf22c4df150e457e8a064ea0d34a244e17e7df2f7c2f917578a893af64d05e629e43930b5b57027c1473132d3bcc24bee754e15
SSDEEP 96:TmYEe8Di8axad8VuzlY7KT+mRdOoHKYyxcfn86Y6DzhSol:IZIa6VuzlkmRdhQVFwzwol
TLSH
T1F4A1E6DFAC7CC8D70320BBE17C1E2799710BF05AD9E98A46FA69CC11C1E425740AE688
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

18211

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\doomed\18211
Size 10KB
SHA256 fcffc81149f68b51c68100357b8f086b538346b89dd68405acbc391b5e1fc53d
MD5 3de51dcd7ea707d77bfcc7d62a0a7d7b
SHA1 fecaa5cd3472206c960fba2ff6e1bc38825b298a
SHA512 49230c431d338cc6d1501a6ca51299c17c7084594f6ffca4412cfe288f77277f99ad3dbaf2f11f795c05484de547897e0bb657f116b943e365baaf5d74169bea
SSDEEP 192:rpU7HVjDMVAcJGv8yNAt36Xq0gau12k9hLPanDw7ONRo+uIctKkBbS3lXKXn:rUHpYVAGGUyeU08k9huMSro+uTtfshKn
TLSH
T1CD32AF3F6F895A1514F14BC68C6B8EDAAE24B883E9C9D0BD8D412E4CD8C4BB99943174
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

24919

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\doomed\24919
Size 22KB
SHA256 6614841774a503af6cb9b6a3d9aaa5f5aea97c3f27c38219088d5ee6feb6970e
MD5 a6ddbd9491973c8b379f9b9aec9a7e95
SHA1 0132c1b23e8944bf5833d4e4bc8c3491f95bdb45
SHA512 4f56ea5dc8e4faa3a3ddcb6c8dab27c6c9a2ad89d158512d937546a8ea34a188ec4dfa79beb4529f1a7752645850b5ca2936e16a750f7982aa71e0a5ab011e2b
SSDEEP 384:W+VvErc2+TFTHYtbbv1qjZERH2zLfjJOi4wvYtTGvYtL87NPvxk:W+VmlKHYtgjZWW19vYVGvYR875vxk
TLSH
T17EA2D07F4D4728A49FF2AED4AD396ACC1F114933D7E4E5BDB23D8A1AA4D43E90C41029
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6827

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\doomed\6827
Size 93KB
SHA256 de6298bad5576702fb44bed16b4dbec6fd77394f6880e58250e1efb07c1073a7
MD5 862f0600b5e5e54f964e74460a4362c3
SHA1 f024ba62da6c728c7ae3037f5653f464efa77971
SHA512 303c5a7c6a601dd3ea4bc1e36e7eb6bd9d5da4b7727a1f37d328b4eb8adec9baf6808aa1d54db18b8240f28c1cdb12171582cb33af4b274a23c63fffda695871
SSDEEP 1536:9dTl6PAYC3yMQyR6mfFBQ1LiRxdUJZYAyInQg6dkzH+spBZS26wO9Rlw23:9dTl6Iw1yQCHQhiR/yYtO6dkzH+wBZSX
TLSH
T115931235E4603F6B44826AA6919B6BD33E04731F7EDD91B82010A714BDC6F3C5638A7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

027294F565F8FA527B06419484DDC1ED2B2C86C7

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\027294F565F8FA527B06419484DDC1ED2B2C86C7
Size 51KB
SHA256 2d1d55d0b0dbffddd9235069e6b8ce026419a9d4cdc6ef956a514c31b84add8b
MD5 46056b4541cea36d3a7153e3b816a8d5
SHA1 14b1f4174d44e46678032392a0505369354f8382
SHA512 2e79ecbc632976110be0ff5fca329f94cdfe1a36aec13963cfdd51686001b7bd054a8cd3b48633df106b032283fc993aaa670f88b35b15fdb7909b7b93c436ce
SSDEEP 1536:cmHkCrHvPAjrWMMI3UJswogl4j7/hSlmbEVRF2:c6nHvPxMUsglU4Al
TLSH
T14933F133DFA0EE650665907489DBBEE85E377443CA33FCEC0D5911C91B81138557AC98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

03D74D5ED346B6A425AA45C38A54C3F6BCFF5085

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\03D74D5ED346B6A425AA45C38A54C3F6BCFF5085
Size 47KB
SHA256 c168f14ae6d40fa1593f817544bc753c87f5a4b83ec4477e55594085e984ffae
MD5 00c9920c7cd4279b5e28f62ebc04fb53
SHA1 4f47bb30622362e1d72f56d34737d737feb16e9d
SHA512 06015c8b652f47b959048fce2d8366c411d8663bb3a35c6db2efe229ea5418a7c4a9611dfb402ef15b09780033f131cd5be8f20624d9635db448cc2db813f553
SSDEEP 768:eUEh2+iKBVQbBhu8vjenqz2Ez6Y/AxHLEaP72sV9qKYbDblXqhP8qwFSE3uqeXqN:eUEEoBVQDjeQaLnP2pfZTqgSELFT
TLSH
T1FE23F1374C8B3E718281F264D4DFD555BC83B453DEA2AEADD0A823C601093DA97652EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0FE3DDAA258850677E5EE86C6E43EFA8E2765124

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\0FE3DDAA258850677E5EE86C6E43EFA8E2765124
Size 29KB
SHA256 fb7323582dd24b3ae9ba5c2df708833f343b09f6dd9d78543d034d34b000bb09
MD5 ac90d5a35595205c6602d763854ff5fc
SHA1 3c2cdb09c4a1db226a9ffcc409da767fd616fa4c
SHA512 2fb2ef813787a5c0b7cbd95630d98a703218747bfe1a8e9cb4b9297704569bca16d0f7526cc9c8b605a80b59705c7bf317ffb13d78b0e60182246bcff226c78b
SSDEEP 768:MzU0RVvWcLUX3qGIVMkafSxKrX8JCGskU8TVjvYVGvYR87REW:IRAao3qGISn6xGe7VTVEw46
TLSH
T1BBD2D03F1D2B32019890FD02CA035BDD4D508A63DF65E8EEB5B81F1146D62EB19678EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1AD35E9EB3AC23B5337850A8128950BD1B88CABD

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\1AD35E9EB3AC23B5337850A8128950BD1B88CABD
Size 91KB
SHA256 526de39f90d7e295cc68e4ac336e70a09cf8bd746526d2b5ce38f82305c76071
MD5 f8263c2f6db816b961ecb16997364c53
SHA1 f996db20f34218e59e2b2d4533e72606f89a57dd
SHA512 c0ee921e2b712ec0dc86b5a9a5b8e46b96fd21bc95b4a11fd1c0a3577ed0d860ac15ac70bf2bb307666c2a99e7f4bd03afa615fccec40a68a30b47ef34b3ec2b
SSDEEP 1536:W248HsAatptwxKNCW/B7v4gvEwzs10ZfvTYASj4KlVk1NNZg/gFvO:WzIzwtwxKzp7vywzTrYHj4KlVkHbkmO
TLSH
T1439313B9FFC4EADADEC3776DD6C8C294B4B128137CDDABAE493105D48045F242A14D4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

299F315C991FD575F8EB91BB6028FC000E6C83D3

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\299F315C991FD575F8EB91BB6028FC000E6C83D3
Size 2.3MB
SHA256 2a4e914822ea4e3826404ab09924a7629a47e68df1d398903e19e96c950c5c46
MD5 fd6c7766b8b5ab978cb6f30584932cc5
SHA1 7d837fe22c3c89a281407b4e1f9e570f96ec6d72
SHA512 f2919bfb5f0bc7cd5ce32509032cac177cec89dd2e07d3ba829b6111553511c9a9304c2429cd3a54bbd1feccc67b827e4b9e5605e643401a7b8e1775a5411183
SSDEEP 24576:zf+D6mgy3n9fC/HOTHaiZ1H72eGdUM4Nu+qEjENk+dHv0IUT3RITbWMVc:b++mg7iZ1rwSaVZb0
TLSH
T16FB5E72BDE856F57C8A482B480AB23753A74D0866BD3F32B65DFB021BC193794D6217C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

33B1D3B9120919BB75B8C5A14128D7BB94C26102

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\33B1D3B9120919BB75B8C5A14128D7BB94C26102
Size 28KB
SHA256 c32265c8d85a449fa20ee6b6300e59a308ebc8c2ef17cc127f489b95412e4370
MD5 66f50e2b53e33fb22c488e3fe1913076
SHA1 0827e747962d6d4f06b33c0dd74291ecffb303fc
SHA512 93784f43b7cf194732eb8e8c603c05c2ec667af0b06f2027bcfd3dfb893517af1583db67b52ad32f75f1ffd91c887cac4bfa2b9d94663809f09f3beb172da829
SSDEEP 768:fxC0So4wRhx90K6ywQLIWS8S5By5AgeeXqFjqwv8AG:85oThPjNS8tIF6
TLSH
T178D2E23FEA8478762BE093DCCC4A9FA86DADB9074C17E5FD1935201190C585A35760BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

341F143AE5A7C181F0930BCDB05F1D91A85D471D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\341F143AE5A7C181F0930BCDB05F1D91A85D471D
Size 31KB
SHA256 73f2ae644d323d75c7b81dd97bc4735a1bfc10b308dd0b8ddae9f61156eaea1c
MD5 1fe4908a32c17bdfa0cc9abe7c9011d2
SHA1 ff28134419181caf40bcc14f996f70e10a007e92
SHA512 24eed49be4bb89caa616affdab9da221c8cf82f8cf38a85300b4f3f3c1fd8a6992fb31fcee5278ebdbacad350c74ab418615b4b39d2981dbdf30c12cda694bab
SSDEEP 768:hIeRXZm4Y+OEguUdMGAXW9Y113uYQ1+L8Sn0a/0cev6XhE9v8Qx:5RXZmHE9ediW9YzunYAa/mtbx
TLSH
T17AE2E17BBF52683F4FE3E3E2C44376E8FC577E07609AAAAA545810854CD52FD8244815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3EDDA4487B7BB0FA688CCAD556998906EC4B89A1

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\3EDDA4487B7BB0FA688CCAD556998906EC4B89A1
Size 16KB
SHA256 4f7b8eff0e875f336a6a63debc1df6c4235fde0aa6d7b75c9b739b8f55231b9b
MD5 ad46063a05d89e9495fd5b9f3cd6c036
SHA1 cadf5f5160d0c90f6d210ea2b6cdb5ce3d9ba443
SHA512 192d9cda6ce98f5c9aaffe8fb5e1d8dc40b1779a027c4ff44c0cbd5231ac08a693344c2b0eccb0f248675c860c4e97d7a9f6165d9ea7a1051d848bdace822254
SSDEEP 384:59MXV9RLyLV1+yPouKAEE8WX5pm3FYHc19ivKAvKrWCt2Bm:AXBOVtRFEE8WX5pm3FYHc190KAvKiw2k
TLSH
T1ED729EBF4E9833424793C1C5E4067B497EB8E61362DEF4DC60342A015A95BBC9CA69CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

42245E93FCBF53FEC33D80FB4BE7D3A8201F0B9F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\42245E93FCBF53FEC33D80FB4BE7D3A8201F0B9F
Size 58KB
SHA256 ed87e1eec84edf846f549e365cba05516643f6ff4219ed39fb76e903232ee819
MD5 150b67d59c623959d7140b2c160cf955
SHA1 5e0a9084cd7fe3eb1c5644265ca85a68d1e84469
SHA512 8936b323aaad2c5c893da9167939861d15c05854f506c700e8446fd751970c6161e8fa7d6a87c8e163e31ee56a9e36d60bcb365c5a2cfb91f81a1e783f5e7ae5
SSDEEP 1536:UH9r8z60U8xzf3ThPTSUdWPg23qds1vCU04e2HV:UH18GbczfDhrSIRoC34e+V
TLSH
T170430235664A394DBEC78073E8D71CC4E9A067A3EC4327DC64F512B4EE06AA792E2421
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

431EE8910D747E04410F9247EECCED740BE3AFC7

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\431EE8910D747E04410F9247EECCED740BE3AFC7
Size 4.4MB
SHA256 7e93a648640e41d1c8f3ce42f022193192631190c8f7a12b45519133f5a400c2
MD5 750b21e055e5ea496e4f9cb20f9c5d0d
SHA1 0f82658fe6ff16c9f11fe2d56aa365ace5a6718f
SHA512 c6dc3b6f6db0a694e4d046ac38ecb1d780f4e153de1adf55a5571376504b23835ed546edccf08bee8cc843409e31064d69551f84b89d1fcb3f76cbdf8288ec34
SSDEEP 49152:J2TwIRFK/mxuCnYGVv13XD6yOBT7bN83lXCzj72IZOpmFZJ5/Snt:J7kM/ms7LZOpmbJu
TLSH
T19B26F81AEE419F53C95403B140B723353B74D0855BE6F32B6ACFB526BC5B3A90D922AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4BD3DC6027B1E270EB0F5D3E4BFAC3D2806D1C63

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\4BD3DC6027B1E270EB0F5D3E4BFAC3D2806D1C63
Size 184KB
SHA256 3af45a636ed2f4565813cde2d380f4108533a426edcfd30f76bf3aba619338d4
MD5 25cb715784e18ca902103c921fc48c1e
SHA1 54682e66b57398a2ef54aa4c94f45de88529ce8a
SHA512 1cdc66be24922e14b29ffcb7266592fc465124e4242ff86693bafba84d63e99da8b3b6cd06f4a51f42358c630b9659d72e38abeb57c9a3b5eecbd04f15a048b2
SSDEEP 3072:TCQw6rfi8yButjdO0BRdfRDHP9ZlDomsdLcYYEYfi9r7L/Nc6SbS6PaW:3wOqEdvzdtv9Do0ozr7MbtiW
TLSH
T1A20412B7A6B63C218CDC5074A1862AFFDFF6E801DBC511EF58AC39D1A673E176408198
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4CC8F2932A3712671AAD38F3B447CB6BF4D9DFB0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\4CC8F2932A3712671AAD38F3B447CB6BF4D9DFB0
Size 100KB
SHA256 f1413cd343997130cb2d1501d70409a8a28db5da04b9b3e006875e26e43b0368
MD5 b3bb6402c1a735729f4ecb09e3d072cc
SHA1 39fb39917c58558536345148ac73d3f47e65962e
SHA512 c776b3206087cf615ae9befd87f4702554236d579a035507394176c9054e5d66bff7248ecf4b3c75a1d23ab8122881d8033ed124e2a822e3285c5688898a78e3
SSDEEP 3072:mC4bGVpru4ALNWsLI/N29tWOJwY/4BnBV4MqFa34e+c:TiGVprRAAQtWOJwMQBm1c
TLSH
T155A3123534905FAE52E518AEC4593919DF60C8D3EEACC256E2F87F04C56C2B2D4EBD08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4CC8F2932A3712671AAD38F3B447CB6BF4D9DFB0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\4CC8F2932A3712671AAD38F3B447CB6BF4D9DFB0
Size 100KB
SHA256 0974d2854bf57e65569669578e4f7fda1a08d09cc6ed01f6e114bbf956654ccd
MD5 bb301324766adbd46bc227d84d4c53a1
SHA1 3407d6314e23bad2864685f1d9dbe528fb305daf
SHA512 9922b17a8049d1da3a737516354afe98f6d94ec443bd792b19d983fc1b946c56b6da5b99038a75020ae06287dd7ef65382d300f9eda565dc69075c4aa823ebab
SSDEEP 3072:ao4LYtk3xPRSlH1k+JOBMDLUZYmp/xv9/34e+e:H4jzSV+0OBMDLUZ/v9A1e
TLSH
T194A3126B2AC01E9C9786DDC206659E4C8D2ECE67EE6CD30B54337D0D8EA7110C19686B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4E16B64B93FDF8EF795F9CA60FE74D480E6570F9

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\4E16B64B93FDF8EF795F9CA60FE74D480E6570F9
Size 6.7MB
SHA256 e6b2b9419b54cc46a29cbc4bfd7922c72af8be764ebb8b753724e8757b2f1907
MD5 79e95fdfa084d48c4e0fbef6978cae41
SHA1 86567f0abde2903b216034f6333b766d8a2f0962
SHA512 0b7045e8a5a0afedc39ce4792241df0f9152fdf01183052417f4f5902a50d49d544750686ff4433af262bb1e265b3949c769b974eb74f0fe725124c172b7902f
SSDEEP 49152:fJ52ydtuYZwV8ARKUBgEXcV8Pma/h1B1JEzZp2wvKXsc4aab/E3aPM:/jt8/RKisJaW0
TLSH
T1F666E616DE939E23C82043B144EB63313B34D1455B96F33B2ECFB5A5FC6A3691DA1268
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

68EED58DBA547D05BDB078B16675F242C0A72D0A

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\68EED58DBA547D05BDB078B16675F242C0A72D0A
Size 41KB
SHA256 a73cc7c59337075ff2f339e8548bd50fa18ee241019dbed79ce1d5aec3cf55cb
MD5 aec26357930c18ed22d95efbff04151a
SHA1 c1661c01daafe7bb26840895119bbdb4887003a5
SHA512 dfc112c3b37d84e480e39a398e4678f9f18015a27221bc8c9ffd7d4800b9b81a81cb251ffe6bc37f561325ad1a5f06bdc59bd94f856010357764395c4bc95f04
SSDEEP 768:YpVRIALhsyakJmtQtLvhdeyHSHfeVBWC2dTmjTH2A8B58hv59D42FpaAp7P:YpXIcJmtQlZgDHWVxCwD2A8C9Zl5
TLSH
T18F134853EF208BABE68886793DABC5653AB0E4426DC5E36F5BC63086143DE705C24C97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6BB0452863B339D83E3AF063D7111CD6957D32FE

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\6BB0452863B339D83E3AF063D7111CD6957D32FE
Size 33KB
SHA256 c72098b9a611dc2215d553801aac0502988abecc618838fc0626ba815d9e8a70
MD5 473545fcb50a80ad235c55f816ca0166
SHA1 ec71a36f256a75756f2e2f5a81e053d83e0d01e8
SHA512 e26ebbde34a422389b277915dba4873d1649772458d3aff0a5453fa0dc531a9aaa628af84c0be432c9887002e00a363f914870e956f7a78181f623716c03bfff
SSDEEP 768:Rm/Pzd9GxqlBZaBq9KRViohRbeBOH0+0zJW8zqN6KtvX/6wUeYbAu42Z:6/GkBZaCsV1eBNTzsH+42Z
TLSH
T169F2F1F9EF25583C3BBBECF1C5927B8C6C90A5531958F4FC19554C0A00A236ECAAACD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

71EB37909C257DBCF5E7FDDE7BEC938575290E24

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\71EB37909C257DBCF5E7FDDE7BEC938575290E24
Size 23KB
SHA256 fc37bf05b6eb0cc6b2e3e058c13560a68b63db0d05d2a62904e26fda7828008a
MD5 918fe91b330934ae33065ea28004664a
SHA1 9e1a624a885fca36b5a58cc6a3434d4ecb6b2169
SHA512 989cb160e83ae9df652f7f33871deab84279f52076ba8571f9a98376c9ad857a473ae4ad04458c1d017c027060217ef593e76f38442b2ba1bea8727c45b6ce1a
SSDEEP 384:W531BDuGIunp9eZoZ3+DfL2IM2Od+ls+5lvYtTGvYtL87Nn1Od:W531HIuLe+Z3sa72xn3vYVGvYR87+
TLSH
T111B2B03F6F4126226BA13A60831B65CA1DA0D943FBB4C57BB4383D4899D57DE8C2347E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

77970BC3D7CDD31F1641F693A36C0168DB56E5B2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\77970BC3D7CDD31F1641F693A36C0168DB56E5B2
Size 110KB
SHA256 92577361ef7e812b6e7cd0f7324d4ecd81fe76f39748c08272b901d32d30e963
MD5 5e0ff29e9b0e6dd70e4bf2799e5d336d
SHA1 d23b81fe263da6ee3827c7f10150ee5a881d0b00
SHA512 5137dc5bc834a9c015c4c30410bfc2d9a2399243b4f4d395949a1dc8b9e3c5189790013c81a6c9c81c96f1f5c7ee7220e55ae5264567711c40eff3d5d60a9317
SSDEEP 3072:JXb9glVuum8fVzF5T0w+k2R/B3en5lVjR2:JMVuYf1FF2e552
TLSH
T1E1B312331A1A25D7BD6E7D9AD334A80C3D086C67FFCB685CF3410591CB94299D6EA888
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

858AEF5133178B326D5FBC2EF3E10A2B839B1F66

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\858AEF5133178B326D5FBC2EF3E10A2B839B1F66
Size 218KB
SHA256 b55fa586154ece85cb448099348cb164b39428189456a0ecca7f9b3ad3f77450
MD5 37509ebfe15c5198ab92647bd4f23d6a
SHA1 a113de7b693852bc44b9fcf43c5241ef33d48825
SHA512 f7888d78d9968caffa6e06a0f41126285d65bb7c2de5c37769cf6a38c8a263a65e1fdb1f59f048a2cef85498547d583b67d37580a3bab15ff4a47119ba94b488
SSDEEP 6144:a+bVAE8+fN5YOoK+zXLAxnzNsXg0kxqsTzt989PBzzTlKrRj0EFWv4I:a+5AIf8hK+z74KXg0kxqOQrz/krNLWvN
TLSH
T1E424237B0EC880E4B97B740A53CE5AC76DE2CB0BC658F025F5FC94093BD2A19D51649E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

85F1A87A951F0338ADD36F0376D9B5A2003667D4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\85F1A87A951F0338ADD36F0376D9B5A2003667D4
Size 8.5MB
SHA256 79f21af0aa190b09cf193beb6af6487f7067fe8f7981931d7f5c1424dded6dba
MD5 d9ba9b65defc768ff8e41e2bcb628bf4
SHA1 c4e4496d25377536b43e18f472c7074ee2a3b20c
SHA512 fc4a8b878d1d9e80b0fc787bdf79bb009316a6ff53f1c039cf29689a20fe42dfc053468145b633b5c8a1c8d27b6d079b487641c5706ae92878cb84448e06f860
SSDEEP 49152:btsGlYfz6pd6Q6D7pKDLQVd4pGcQTUUsnSY9quwwlRqj8uOy8ES5YCro0yuz92A1:J7lfpwkUAV31R
TLSH
T18C961916EF625E22D89803B284B767313734E0005BD6E31BBE8F755ABC973B90D651AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8E34B6EA0E7BE6D8C6D9E5C03B514A835DFA5B0C

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\8E34B6EA0E7BE6D8C6D9E5C03B514A835DFA5B0C
Size 14KB
SHA256 a51d2aa5d44028f5bc6056490b8728365b32dbfd673b18b1c79e35e8a0ce7788
MD5 9136163ab76b4ed1475eb79c13f2765d
SHA1 287c2115ee562e4b9412326c4c989a5e3edb2d2c
SHA512 cbc01cfab1ab9c7228a2dbf22c23e734e4a0a20e868bbd56331ebbbb5f7fbf49a91a11f95eb26a7b4e1bbb68f98828aeba829c3a70088e5c2dcb7d3214f0c325
SSDEEP 384:kPepGwTzT3R6e7fPjOCP16C1gKX1HyMN+Bsqsg7HHgCi6vj:+wfT3QOfSCU4gKX1HyM4eqsgLH5
TLSH
T1CA62CF379F4039482B426D8D882B5A4C5D5CE72BCF9AC2E5AEFD3544CDB823DE6A2401
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9512A4488B00CC053350DAC32D417B4A35C11513

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
Size 15KB
SHA256 a36e0a3ccf347ef7ecb24054ebc26e024150cef2806bd3b8ab73eb2f48508b03
MD5 e6b9d7bc3b043929c909739c9e1cbba6
SHA1 3a72ec392d159d313399d150c5ee0cc1eafe2ceb
SHA512 7cc3023ef72750b2970157991baaf5d1b0ee410c38ef781705eabbae264b4865cfc053e6d55b9e817c681791250f482f8dccda048024b4790c4d7de4904f8151
SSDEEP 384:H9XghOiO024YZdcs3hk2nhfdDE2Ba/rIVy8eGEv:dX+ZYZdv3hk2nhfS2sDIVy8K
TLSH
T135729DBB8E116C5D1957D585C8AD937ADD04F9BBCBF6D0B608203449CB8432AB0FA08E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

997EA9D31DAF8C3E0AA0F0A16E2C8853F41BE111

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\997EA9D31DAF8C3E0AA0F0A16E2C8853F41BE111
Size 84KB
SHA256 55f5dc42d1432a461b2efd49d748b3d400fa32e3c799d1dc0e56e878e989f1e9
MD5 bb363927dc792cdbe6c06c8ba8b9eae3
SHA1 f82de428249b764ead5bd57b997cd78523c7a9ee
SHA512 19cf82ce9806dadf66dd978e2e4bcfead3c7006736aea7bfc76fcf085ddf49e3e3f72874ba985df011dcbe4fc8fcc7f3ad919d203c0aa035bd365d578ca9d5e7
SSDEEP 1536:TF0lxSH9Rjw58ajOqFAcmyKZ2zl58uOjRXFKo5mlRebgGMxEd+nY3o1YfqVjR6:GOHnw58ajLfEtjtFKoglReMZn/YiVjR6
TLSH
T1CD8312358EE2B8233CB3C161121E79467FEAD943EF54CD92FC85825502E136D54A3AFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A11614F67B3DAD21C8B1EC4E48D9E8A6742D07DB

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\A11614F67B3DAD21C8B1EC4E48D9E8A6742D07DB
Size 1.4MB
SHA256 f3d7e63fa13ef5296f0ca5979d81062b969ead2e7153784bd9b8af83638de8df
MD5 832abf2e620f21c19781ee00547aa947
SHA1 6abc1f673ed9695d6ea07950bd2d77bb4980f929
SHA512 c034babf6c6ad296c6a861d0b7a937e99f5d8c38d93285b5436dbc39b37b067afd4b639f1261b762ea20605d8f945140d163f2b26cb125aece6256990dd4fc06
SSDEEP 24576:ION3ML+gYWLQGS9W/ZJDShV+GyRs7pRQq9C13P1H:11MigYWLQGSwBJDSp7+1/p
TLSH
T141650919FE919F53C81113B140B723363B75D0855BE6F32B2E8EB1627C6B3A90E525AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A169F6A56F48FF41FC8E73CDA3B604DD3F2361B6

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\A169F6A56F48FF41FC8E73CDA3B604DD3F2361B6
Size 134KB
SHA256 3ee900683d0b70f9ab674e7f0a7f88098052a2c17716cb5e113bc7cfb605aadc
MD5 a9a5bdcfb99fbe1e7b624e94cf391a8e
SHA1 cd4c70bc6157220c519db8d26a8cef00bb104d1a
SHA512 ce17c36dff888ab0f3bae033fa2608acb8f5a81d606e7ee0aee14ca4ea8010cbd8683a0bd36ddbc6668a19e4e053342f90afeba83eb21254e13fe05004e1722c
SSDEEP 3072:b4XkN5u3RbAR2r4lJ8FBnP7fNblbKBRvqg:fGdA8FBP7fNb5g
TLSH
T17BD3123FFD21AF661E5324DC5C8A12C05C1AB1F7E4B3E06CF559B07283612BD966C609
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AA852F505655BA2D079AF53C82476234B7526F20

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\AA852F505655BA2D079AF53C82476234B7526F20
Size 101KB
SHA256 389eca214e9c3eb0c57be201b5ab1877f9f0d3afc9ab5a05e78bdbc651e6d86c
MD5 30e866283458c9784958652535601f50
SHA1 e3e5007a579f0bd84b441ad8c28ebd18214a4199
SHA512 8591213a88066e7e17f1480c26c2219b3617df36335374fc7b878615170a493205958b65af6518cc60806eeb8bdc1d32c151101cb7ddae9f3d60f38cc9b20b2b
SSDEEP 1536:dgAn2kXb1Yt0piykwxjVg0Bo47gnoSWDpYRRWseuEw40:WK2kXJWbykqo48nWDpYR8s/Ew40
TLSH
T104A3093AEFA28A22C868023684B367313234D50527DBD71BBF8F75127E667B04D55DAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AE1D1362E0D2BBC3460DF80CF79A1044EBA7AF4F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\AE1D1362E0D2BBC3460DF80CF79A1044EBA7AF4F
Size 157KB
SHA256 8e2a0dc9b4e902b6dabacbd829c8b3fdb6caf0beefcc482d5300fc8bd773ebd9
MD5 43f67b060fb15489468697f529481ab0
SHA1 07b46e89bfce48525bbb191671ace5d2ef55cca4
SHA512 7af5160fd39bbb6929d2caea4347d139a2706e57f938d16a92f15f130431253739e94b0bc39c6cfb5601116aa19cc570ef59c420336e3deb16166ecee560cf76
SSDEEP 3072:zdUJHvLbtLE5OeMZTzphe3JrxbyO9AjwuYTGaVt9tmQ47TJpjbJjeSJn8+U:ZUxLxLk9MZ/phe3Ly7jwuYftmQiRFn8F
TLSH
T14FF323316FE3461C3D0F80409525DED2BA4EADE260F2FC1AE5114375BEC53E2A1E9E56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B33ED46EF6AE04F2C6B79527CC20527EF2EE835F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\B33ED46EF6AE04F2C6B79527CC20527EF2EE835F
Size 2.6MB
SHA256 085cf4517b2f40a14f064d41a67306383606cb4fef0c7fb694f2fe20be2cd460
MD5 8fb25585d77b7d3da4a483c52d94fbe9
SHA1 260179c742d4eb76576c5a42a6a612a89267021d
SHA512 7da94d9da07d06d095026a67165a332c5101f9935bd14191b00f14aff88016552101486a7e2f6815b074ad37073d99d4c110285cc4291b458f89483da0c45b28
SSDEEP 24576:CuEviyXHYsHarWe4N61BCj+4vgI8Hq/mxDnmp8S1m5vSK852MaxvidYS1dVxjx6K:aFoPrRKe0d6HlaWqZNF
TLSH
T16FC54A7B4B054A6AEAB3157D000736177C68C4A6A746FED16F8DC8F3A85816F1C9B0EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BA6D88D1818A3AB75B55EDA11ED3BE347418E040

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\BA6D88D1818A3AB75B55EDA11ED3BE347418E040
Size 52KB
SHA256 98758bf22ef3e4b406dfd6f6b9fffaa5479558fbe0d5d350183ece5190922e8e
MD5 87fdf8f002b2cce3ef5548a92a8a30b4
SHA1 976bc7d4c51d10221141bed8908d6ea7086a04cf
SHA512 76e39c064c8183e195f3f537674791a081a6f009c154fdc9ce79465dd02a9a2761713e084d7cc7a6665e839a7a2c96b284807e34d0a6ceadd3ea582b4faf7f0e
SSDEEP 1536:Q5DC/lX0gWMbzzb2Y7Pwe2HVFIZkU04e2Hy:YDW+M39OD34e+y
TLSH
T1D733023747BA3ACC0FD31D0A461B10F09C5C678BED9CE78EA2B938514DAC6B0762549B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BBF446C2E3B5F6F5849B1D15C564CD1EA3405A11

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\BBF446C2E3B5F6F5849B1D15C564CD1EA3405A11
Size 22KB
SHA256 71f8f8db11fb5af1786a004f9ecdc47c83e193400f17a602960ccf845b02d471
MD5 f70bc1e3c05603241f52976e4ef821f0
SHA1 3ed0c3fe66cb17ba5c47332a11968153124fd64f
SHA512 0f77735b09208b67cf5322c13c033f3817a426058f7c12fa2c1f1930a2f8c0b63e57d9819fb977bc0b332f37ae5812bef2cfe7801d65800a4be8cdc132ccdc85
SSDEEP 384:W+VvEc2+TFTHYgzbv1qjZERH2zLfjJiusvYtTGvYtL87NB:W+VclKHYgojZWW17svYVGvYR87f
TLSH
T1B9A2CF3F5E4234589FF27AE4ED39ADCC1E5158238BE4E0FDB13D9B4AA4D43BA4811029
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C0FB504EB8D5022AF1CCEBDDE5137444D06410FD

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\C0FB504EB8D5022AF1CCEBDDE5137444D06410FD
Size 22KB
SHA256 5ff6f3ed23eb9e7015666799db23da6dd75c6d3e4284492f1016f3b2c5965c76
MD5 ea34ed6a5eab01bc066af083377b2e41
SHA1 8bbf6a49379e63a5d0177ae4230d4a10f47a2ad0
SHA512 0d6c9a248a9758b7c288d679ed66752ffc4a3af346f396a40ae14a36842417b3a76b19556e9aba1d86f08623d78a8bb649f0387080973a5f09fd9178a3137145
SSDEEP 384:WiL+t987esWFRk+QDqfkSDj4YiMl/2A+73KmEUp08COvYtTGvYtL87NHrCw:WX9woSrGkSD+Mlo5EUW85vYVGvYR87pP
TLSH
T17AA2BF7F1F29241866E054B5E98AFACC2C54E903EB61E4BFF9B85B106CF839C942701D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C2750E52206CE7B7754D7CC85A457AE1085627BC

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\C2750E52206CE7B7754D7CC85A457AE1085627BC
Size 97KB
SHA256 c337580a9980ef4ed9c4a57a8dd5bc49c114742382450145b8958232f403c66e
MD5 c6e9b259402a9a517cd4befa1462def8
SHA1 d77317cdc132d3bcb5cfe91ec61ad0bdafb4b208
SHA512 822d6745529ca993bc0c15d8485753195bcdcceaf4a6a61406c6676cae05a1412f449ff5f894222b2884920137e90bdad2d2e262e89f36dc8efce6b348482d68
SSDEEP 3072:6c2DnPoBuKLmFCl9caxllQ67RlD2SBEw4P:P2IuKLmQlVxlO67fySBv4P
TLSH
T18FA30726EE514A13C4A9223148F357363638D40627DBE30B7FCF3116BE963B94D9295D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C2B9E127DED2DA262FA5A81EB534637A12D61C9F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\C2B9E127DED2DA262FA5A81EB534637A12D61C9F
Size 5.8MB
SHA256 8a8d1e79f5fbe59ff6da05a55f3cfedde98de611f7c8a37a734533fdd0a80218
MD5 9360c91cd52162d1f1cfea5177241176
SHA1 8b9cb507e67743dcb88704dadba56c490871d215
SHA512 2713cac7c91108aa55ab7f7d84b801628f6c361ef7d428897367fdee12d6114692566a5fd9618a5af5d6ad85406b3a6236b76cffc244dd9b4a988798d7d8a88c
SSDEEP 49152:crxbE84ElGKNJHXRgy1WVP5sRyh5YHUe52tciPU6B15acdx5yJ2KGs0NJtdzMlV6:qbnv6+ExpEK26maTDw5oVCuMeh
TLSH
T106564C16EE925E22C89403B584AB23353E34D0859BD6F32B7ECF7125BC5B7B90E5126C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CC1FBC21DF8BADF9C543C4113D92604F07F02DF7

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\CC1FBC21DF8BADF9C543C4113D92604F07F02DF7
Size 31KB
SHA256 4e50c240a733d4ea041f2857b9d5bb4f059923ee3e13bbe117ff174a771741dd
MD5 81a09613717779b81efac02148147c7b
SHA1 702da9ae53257cb05f71e7c004de59f34d153ac4
SHA512 f3dd018cde84c169c66015316b35505013b4bd82ddb3d56f0aa65738d6fc7538b48777201bdeb9becd603d9525b70c90c1cf33badf7d22f8e3f26df65852a483
SSDEEP 768:41S0CMV7fPmxQy/rrvXYTcTNYjIkoVjR87n:CDVTudTrvUcY8VjRg
TLSH
T1E4E2F1BA8F992662DFA876B0D45BA2CC1F25A80FC97DC8B5E170391088F13BD50654BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D095A003BF46AF98DFA90F89984F51D01581CD6E

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\D095A003BF46AF98DFA90F89984F51D01581CD6E
Size 21KB
SHA256 65d651b8c7dfcea31844dab42c7950e6e6f838737e0d596d33c59a2318599e7e
MD5 29a6b582131e5804d6496e1e55d05d4d
SHA1 95c372f8ad13587ee72952cc5e1c31f75bf61bcb
SHA512 ca5056227ff807285fa4e974b25a4e80888a340f14c46dccad2d781bdd745f758bf1cc8306b23bc11f2e39489602fcc2831cd116a43cb415ea866d0896abf282
SSDEEP 384:llCeR1PwFy+sNG/vjdcqytaPwuV0a0LcP3Tnti1nvYtTGvYtL87NSpap/q:lljwFy+aGHSUPwa0aNZ0vYVGvYR87WQC
TLSH
T1C1A2E13F2A1E296409E52CB0F295B5C96D5057829B7CE43FA518E110AEF873DCC37139
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D7FE39155DEAED4EF8D7793E6533929C2FDD60E0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\D7FE39155DEAED4EF8D7793E6533929C2FDD60E0
Size 239KB
SHA256 ec87c894214a928124266e6692190d56e0c87ddb3f643b834c8bf9e103f45440
MD5 c795d9ea29aeb6817dbb82cc943e0bb9
SHA1 de627ce13ba5d1f51cda799670f7994f79e25d05
SHA512 cc9fcbc1a37ae587914c898662469639acb6b629607f6f980660e951d078df16219f3f6a7a63098fc715d6399048448b6ecb02815759c67bed829089e1c11ad0
SSDEEP 6144:K+SpN+JKeVMIatdGicGpmXHx+oRqgmCv4E:qH+JFRQGiJmXHx+GRmCv4E
TLSH
T127343B6BAE529F23C5D882BC447323703B35C40657DBE36B2F8E7461BC6A3A44D165AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D87ED5221F8FD1265B5E35F95550AE6DF69A475F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\D87ED5221F8FD1265B5E35F95550AE6DF69A475F
Size 19KB
SHA256 c6a12c9917fbfc625568beb921cb77bcff7be96cf71612edd8252d433808670a
MD5 0a6c8cc64433b27b2c70357d3ef5efa2
SHA1 36fd4ef75f412bce4963b709f988e3c59a58d886
SHA512 e58449a7641e01f5f3b1c7d46d4b3b3ace44db59a500cb866436506c1d8920af15bcc1f61e0697ef32547c8211f79fb1f5d026e62d6b1a3b77881459af95527b
SSDEEP 384:jGFnMyWQltCCeCh7C1n9PWtD84nvYtTGvYtL87N0j:jKMyWQP6/1n9Pb2vYVGvYR87Wj
TLSH
T1DB92C0772F11752156907EA0E75E72E93FA0E903FAB4E13CE458BE216CD13B98037168
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DC0CD12B74D94F2867E091C06CCAA568B1C1FFD8

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\DC0CD12B74D94F2867E091C06CCAA568B1C1FFD8
Size 2.1MB
SHA256 56db74cd0634b46d8525177d034dc1e00b6a8cf26ea709e8d756df1d7df8fa41
MD5 64ff6bc7d7fcd825ea9d9b463503a704
SHA1 38606c0e355f98d81113b9da3ac64c92d99ff923
SHA512 9bf7a5eb58666d41980ae69f7233831ba4b000937dc347f6c18c9e27cea302d0dee29574dc1303fa1815c4fcc4ae146c52323403afee67b1940d1dff113e86ca
SSDEEP 24576:1Gmj0Exv1bx91a+tUDXIkWmNhH47cpvLqjy5ewsyqvj:dj0eJFa+tUDXIkWmzH4QpkH
TLSH
T1DDA50A16EF565E13C82403B240BB63313B34D0856B96F33B6ECFB565BC6A3690DA526C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DCE1788F2E3B87A30916F357CEC2838253E8F892

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\DCE1788F2E3B87A30916F357CEC2838253E8F892
Size 211KB
SHA256 bc159c8c789d527a04d3247b9605d947ed1fca1b2f9b6effed77ad7eb672d759
MD5 0e64d0c29d89c20510aec69e8f6323ec
SHA1 07e36f267c7ddcab868f27fb6a7d42ac8d589c46
SHA512 836d34c171fe4e00876dc8c8cf333fa3a65b154ee897af5042d305150474983ffa4cf40ae85fe2b2683a39a29e23268b9820c30da7ef7372c13d793de145ce49
SSDEEP 3072:4dqbTzd5CppoCnTRWAGEyxcv7lAJhQWFFytTtQn1GakJYx398RiON/UXTooi:Hb+pp9QF1+hAHFFiS1Iotq
TLSH
T1CE2412D01E91B8FA39804CF1D78BC09D7D497957D9CBD8EB085E26C4B2B89C8E18B09D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E26A67035FAF0BDDDDB10C917287074CF3B2C295

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\E26A67035FAF0BDDDDB10C917287074CF3B2C295
Size 12KB
SHA256 07315cb32e4841e73411b0eaf6cd724412a443daeb95da7b0a04f5e933ed29e2
MD5 cfc73560f5c5d2f89c43fb04ceac29e1
SHA1 527f6611ce00013543be652a1da0daf70314bdce
SHA512 0b9589a869fe1c05f9fd2f52ea2e6b7dfb6894c87671267c90dfa3309d40fc2f0507b73cb87fb846e4ff96322ccb0516e18aca9484bbc3cfe0f8a7e381f56b37
SSDEEP 384:ECTnZtmI0LEtvX0vYtTGvYtL87Nnr1hXl:33iLykvYVGvYR87/Rl
TLSH
T119427E3F9F02252589F0BA50FA1A3DCD2D109D03BBE8F47EF0587991A5D135994760AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E26A67035FAF0BDDDDB10C917287074CF3B2C295

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\E26A67035FAF0BDDDDB10C917287074CF3B2C295
Size 12KB
SHA256 a75a95c414150f34e6a923edb209cba9a8f46cfd57d96410abed95d36d2f5d0c
MD5 87bee2ece22d2bdbc2f0eb386a2d9988
SHA1 00c64b49dd14816c68b1e6efb7b1b1ca5bbb9414
SHA512 25f9ac1a6b7a404afb31208e6a5ec2c366542403f209a045fa72f70420d20e72a55ba13b515b46c109faa97e2d12e084f5bdd69764ba3f96ac94561a56d3113f
SSDEEP 192:eso69Kl/u41fqNvq9h7Ii8nvWqJjvYwFmyQ7qJjvYwFmyYWU587N6W/b7fbcn:esoX/h1y5qbIiurvYtTGvYtL87NnLcn
TLSH
T125428E3F2F06211156F1BAB0E94DAECD3D109B4397B8F9BEA89C750455F0759803B86D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2E41CA3E48D2627D2A1C76828444D9215432E1A

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\E2E41CA3E48D2627D2A1C76828444D9215432E1A
Size 14KB
SHA256 f51a7f8a023f3dd3053164cf3a69e72a3be7dd1dc1acdc307c4acc5eb5716cc1
MD5 ecca6ca38114a0f24ae5aa5e4064271b
SHA1 be2d329455368ef892d2482090ec4c7df0222649
SHA512 0c179d305aa90a71f0cf66a6692541e6213d953e8e39688ea9ec02080151792387225dd887d4c5f27ca20b7053e54ec69b1ac6e87cb5a3e69990422a75434a2b
SSDEEP 384:7yMBmpFiG/06veO5np9gO8WX5pm3FYHc19ivKAvKrWCt2Ba:7zBIeO5wO8WX5pm3FYHc190KAvKiw2Ba
TLSH
T114529D3F1E54731542A3E0C1D68337CD3F25AB1796DAE0E8A0142F11A69877DDD91DCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E48D4FE0038407CD03216A3F244F569E49FD280F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\E48D4FE0038407CD03216A3F244F569E49FD280F
Size 173KB
SHA256 96614a69aad3c6e28c9671a418a7da73ad1f131f304f160d581c7347ef5d7b24
MD5 f202ae156039267c76848d88b74876d3
SHA1 cf487bd8781c5776f2429ffbacc9aa97a333fe61
SHA512 39fd2326402b337f5ec7cfbdad58d5a1b5014c5743958edb1b7c852b5fda48a781da79416377e23bdccda997fe5cb4ba2a64ac8fedae0a36956935f74ba9c013
SSDEEP 3072:P0dAyqwIgeAPJiu2MK0Ere+4FYVZIlHIIFWMrP1QivEBJBsryVjRM:PAqwbeAN2MKJ14mVZIhIgWA1T8M
TLSH
T1690413F2BF69230585616BB0A8DF3E4A6A74B205E8D214514EB01CE2C4D6777F22BCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E5E64E52DFEC73AAA46B59FA1856DF0913CAC1B9

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\E5E64E52DFEC73AAA46B59FA1856DF0913CAC1B9
Size 2.1MB
SHA256 3e7778c0a945371f732f9eb73d9a85011201706a191b0d3bfe0661b32fa15bc6
MD5 1ccff4d10434780083eec12fe30f8b93
SHA1 197c3eb1b056e2b0cd57b640c8bb71a6de511e6e
SHA512 13aa72a6da005f25beb9a2e8f7bdadbfa560327e9e24a4a39e2887a43c801917bd8ee67a9c0a1b2c59b514bcc3eca9f9c8ee362fd6341f4f79349192606a1c1c
SSDEEP 24576:DHpzXgOy7/32UvoGmuclA+HrBNwzwNQJA5F9Zz1zsJAp9ZzpwQBVQdZzbwQBV8dU:lzXgOyL32UvoG3uIL0V2
TLSH
T142A5E85AFF82AF22D951127140B723313B75E48157E6E22B3E8F75257F1A3680E6236C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E9127BA2ED6A2452A94D5D475676998E02A4061F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\E9127BA2ED6A2452A94D5D475676998E02A4061F
Size 83KB
SHA256 766514d374e21e39c8819b82c8e960ead181b5cd43bfd2e10381b589e277eda3
MD5 a427e650727a815f6b6a455ac0afc809
SHA1 f13e9cd112def2e51082f8ccf1bb6aecbaa7a909
SHA512 e017e696cbf541c202526c77f15955735c1bcf357a12b0795a52ba750607c16fcbe8b1d27d12b4dd59c641c73ca8461c33fc74ff9583a650c551f48f719ef42f
SSDEEP 1536:9uedEKZCYiObeMg5lJCsZeGl7Adnk6jBJSkCe1EGYBzpEsp2A8C9ZlQ:MeOKbe9tLUw7YXHSaeG0pZp28ZlQ
TLSH
T1C68312FB2D37AFAC854641A1CCBCCD297818E6F285C598B8D6DF226205003D749F9B5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EA87465A6B977981215042B94E7AB9FECDDEE708

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\EA87465A6B977981215042B94E7AB9FECDDEE708
Size 13KB
SHA256 51c52bf089db5f15e042e852790284c179b61d8b73035f7246f6e8a650ff5294
MD5 31f778dcd7c6c7c93f78fd0abc747f9a
SHA1 bca25da10e568dbd308ba0cc3dd7b09dbde0a68a
SHA512 3de7d9505815349242cc83dd0badc65005b0da6fa0c04e1049f8236078574e5ae03b3bf352350f99c513d971d93408aed9b73b90e47eca7c0e685d435a519d84
SSDEEP 384:9a9mIcFOwqX1sXV+caVgKAvKrWCt2Bmr+:Q9dDwqXWl+ctKAvKiw2BX
TLSH
T16352AF7BA979360946D1D5C1DB862BCD6E95F6038FE9E1FC21287F018090360BC9B4AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EF5B2C7802FEDAE4865567ECEFA126431C2F6B99

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\EF5B2C7802FEDAE4865567ECEFA126431C2F6B99
Size 1.7MB
SHA256 3a43092ed61848fa94d2b4c97f16dce1e53304c97cbf351fd65a689af45f9321
MD5 f368e28e9668c4373aae1eda9a719a58
SHA1 ab9779bd3c1b6dc8c211e5274dcbda99b68496ba
SHA512 1d0c2e92f09506516f1ca02d6fb23a1cf5ea2a5f02d47b0271eb0fa61d88c84b2baf944fd6fc769222628d6b862272813ebc38d98fb8964a40f991655daf65e2
SSDEEP 24576:Vkl4ehqyYImbT1yh9ohiMW4IQqRQmW2f9d6cWGJx3HmHYH:VkOQSP2xfDH
TLSH
T1B685092BEE855F53C9614274806F23363B34D486ABD2F32B65CF7061BC1A3B94D616AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F1AC9004F653F6171B82F1953FC70B5E5FB394AE

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\F1AC9004F653F6171B82F1953FC70B5E5FB394AE
Size 103KB
SHA256 fbe047017a772156f6c8278b5b4552fe5bf23d8f0eecc5685e03f6adc8968c96
MD5 27f483a93bd6fe45b5112e00a00aa372
SHA1 4b85c0b33cf6ad90e03207d7e7bd80ce3de2f44e
SHA512 1f234fb78cc2d91210707733905fdb24e2bcf66720cc2f8c8a7956518b8a2c33b22e72a3c03823c93f430e3b56241d75fec8519da0586183aa5b78dd6d512f12
SSDEEP 1536:DlaiionYlKTZDzN4DFIj0i8zfxgnf0Sg/7QNqkJXI/U04e2Hd:MwTcuYiA6n3gwqkJY/34e+d
TLSH
T1ADA3D729FF87AA62CC56127540B733363B72E08417E6E3176B8B7052FC267690D52E9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F895DC50C8159CC8F907CC4A5E65953FE9CC8549

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\F895DC50C8159CC8F907CC4A5E65953FE9CC8549
Size 54KB
SHA256 c46bc8e30fc886c89d2d9fc066218f61b9a5850fa3e3013a03cae199a51e936d
MD5 a8d2511975ed2d0be1592de3d3b9b987
SHA1 6015a03bb56ebe873f9f3b4f931599034d27b933
SHA512 4b65c1e99e172186841618d26c5cfb158395f9ba2841d4b6d598c1df10e91f273d4ee30ec3c360aa7338eb9e7126f9469683a0bd35801dd15a1d1f83f5e385db
SSDEEP 1536:iTzr24iqE3XwKquEs2ti9H+HbwMg0ClVjRt:ywhXwKcs21HbWnVjRt
TLSH
T11D43F13B5E349112EE717068801FA9DE9C8CF943EB77D43EA4A569D2CCCC675244B8D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FA92BE27C379D54C17B5E685C47B924F5F04799E

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\FA92BE27C379D54C17B5E685C47B924F5F04799E
Size 702KB
SHA256 62ac9608befce8147de95cb621c47161273bcce0262c3d61f5ac30461da67877
MD5 6f2ab4cef98f5517171045667a8b43ac
SHA1 b4db2a538d5f0a32880ab07fbcaa2d59a3078e32
SHA512 885bc6acd0d123faa56f882766f7c171af48f4e7040679931b46f4c22bcd07b9a2f1151fb260cdf84eaaa9e51c7ad0b749b4b77fa6aabc91556238a5f4480ff3
SSDEEP 12288:dYBqUq3CB59sxavQvCNFwsgt257c8RaJJ4N44z:knq3CB+aw6Fws6257YS44z
TLSH
T18FE4E627FE86AA62C92102B140BB23353B35D5456F96F3171EDFB126FC2A3691C624DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a2694b00b2fc053ac5960b4b32ccb808.png

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\thumbnails\a2694b00b2fc053ac5960b4b32ccb808.png
Size 6KB
SHA256 d6f502c5f6e2ae605e4d42e974005ed1a9ff191599f473fe465bb0178363a046
MD5 9b74e29c957db79b82dce2c9bcbc36db
SHA1 e0a111d3f61917028faf773c0d722a412f926f6a
SHA512 af9589ae0a46034d2be7a0b0812c644eb1dbc09d8a7b1a12a570173dae7d194032911d857de4019512c9a811472023a0ad899bbf79bbe7e6ce3e319f7132adaf
SSDEEP 192:g3k0ofYo8G+UqS1r6TzTLBf4f8d+kKvHhhhhhhhhhhhhhhhhhhhhhhhh6Z:g3k05o8G1jr6TznB61pvHhhhhhhhhhhU
TLSH
T1FBD14C93A612B2EF022413C3FAE541B5B11FADAB5DC72265CC0F66C0781672C4B5E983
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

05ad996224bf0ecb21cd232070fbbd2b

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\05ad996224bf0ecb21cd232070fbbd2b
Size 596KB
SHA256 16cd03787910fec0340c58cd4efd4ba47d1f00d61395c76693cd5db695db58a4
MD5 05ad996224bf0ecb21cd232070fbbd2b
SHA1 6cdfe9d46d3269e9e6f02883db3d1d14f0183af7
SHA512 f6cea90b1282aa0ac2554cb98335a5817186ebf4327458333ba1b160918b6e37c66ff6e4966d95ca11461017171900e4b1eb5e5324ed805c32537386f5dc7e36
SSDEEP 12288:Btj29etcNztbhDOlam2l03KHsvwyjwLKqneiAKWBTd+lPINsbtrOqefzK:v2U4jDKa5K3kByjwOqePjBd+jY7K
TLSH
T110D423A413287960EAE768E78E143C0E7511DF347F0737970A9097E17C6D7EACA609E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

10461fdfb35f35cca13dbe35dcf21343

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\10461fdfb35f35cca13dbe35dcf21343
Size 3.5MB
SHA256 73c9d9a9333623a070ccc1e5f6cf325d83f1ef9ce35c4d255b66a1733f6e6a91
MD5 10461fdfb35f35cca13dbe35dcf21343
SHA1 42806bf7d078a0dfeb1e462bc9e5ad6e90159b7e
SHA512 15b6bc4c957ef618f56188227bcffdbda3ab990ba80362d3fe89f97e74a01763cd46bbbace7548d5a29244dbaa842da0c7f9e449b2df715f33b708a5a629d3ab
SSDEEP 98304:LnvauOC4zP8kaSRljlFUkXqUU3aSpTMKK7d7RSktipIWcLEq:brOCuP87wlFUgU352KK79toIN
TLSH
T107063389920D485BD1FD213F4523DDB085B8315CA803CEAA28DB867C7F6A89DF13E95D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1d0390337d1a4a58e5514be1a9481ad6

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\1d0390337d1a4a58e5514be1a9481ad6
Size 2.3MB
SHA256 c79f0eeb2bca4905c585c50333db3c6f727a554f5db82e64948f93668fbc18aa
MD5 1d0390337d1a4a58e5514be1a9481ad6
SHA1 0c09b611223f335af2a42dbc371dc95ba4f18979
SHA512 382e5d7a61398d54bf15bcd928ec7755817fe92a860840efac6f6417229678cb1fd1756c5a7c82e02754a23732f63882c4a640bc6d73d28f30110d0028ae6fb8
SSDEEP 49152:DejtLQNcZOH6b3nbU/s3lgwvTS2sqQFIPg8Fb5iLcWvFXO2+xPh83+H:iJCcbz4/YlgwvLtQG4mULcz2s583Y
TLSH
T132B53399FB0A54B7BE60CE1753CF779A7F1882A510A033E7CED7ABFC1A79A404521406
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

331df482a776e835d787830ffe766a7e

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\331df482a776e835d787830ffe766a7e
Size 2.5MB
SHA256 820759f47f22be04f50097018971257bf4e872d094e88b3688d9199bb4155c82
MD5 331df482a776e835d787830ffe766a7e
SHA1 82b2a994ea8effbb07104335be05a4a7b60a9393
SHA512 996cfeaf16af1e573c42c58875f51f9cef770d7c5188af2182d5e45ba4e0d9bd9916ca8125a89bfb3e42f3489e5ed8e8527c705c35d1fb585d8c64a8c930301e
SSDEEP 49152:OK+JChfrRt5Ur6cQ+IP3f5sI4FVrbOjBenUofSqjNUTa0+lN3ms/cMCvIt6S:z8eR6zIkrSLof9jNUD+Xb/cMCvItz
TLSH
T11DC533D8D9813A16D07F3AB2A2617D0188794623E8D0DF97CB7C16F484C5ECB1BDE698
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

38ac79fa258e010f4a92b99e09492275

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\38ac79fa258e010f4a92b99e09492275
Size 789KB
SHA256 126921fe2b2ab3b6a20a1f53cbf7d94c7dce4bbe73953a4b7c9e946d9bd62725
MD5 38ac79fa258e010f4a92b99e09492275
SHA1 bdaecbfc5532471819406ace20a9757044c34c86
SHA512 fd454a15a019a36573d8b4b0f76e8b329ccb889b9324c3c744e1085633cc2b40c0fe393fb738e584270b11dfbb8c03ed1b9ca4aeb31465d3f3d9870bbfd867f2
SSDEEP 24576:oGaGEdAJttFAmgH0ro5yOs2zfhPWqozMwr:xEO/tq+oDsuZPyX
TLSH
T12805334253FE634ED0B037D64384889391819FB893E8DAD29A6B85C1275C2F8D50F97F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3e9e4a4de6d1f9dd136331b3548856d0

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\3e9e4a4de6d1f9dd136331b3548856d0
Size 81KB
SHA256 857b1a36c86d038303688d3e62874d9b1d8156ecfc220ed2438ca974489bc944
MD5 3e9e4a4de6d1f9dd136331b3548856d0
SHA1 383b056d4302376cb87ece2e82579337523d2d2c
SHA512 58fe13d85f8931ce2616e3d6c5ed820a81f6f846183e07a6acbc680b0acebfa218f2c7edd6b01e57620c20639ed6db1fd6e48ca1440d765e0a50a51a2b2e6cf5
SSDEEP 1536:TvP9ZIqELBtsTZs1u++7JT32d4xA8ppYXFpfJ12+42tUES0psc506DrjHA:DP9Z3Qb6+oj2oCv2UQ0e6DPA
TLSH
T1D783125DF691E4BCE54719FA88208130C8DBDF9838DF51C0BBDA7685D9C4208F2A9E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4ac49d8d828e4ad16e4d7a5b78b0248c

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\4ac49d8d828e4ad16e4d7a5b78b0248c
Size 10.1MB
SHA256 d301e49ea3fd0058b1c9f9d82f6d8116416311526df381071710b6b938b27bbb
MD5 4ac49d8d828e4ad16e4d7a5b78b0248c
SHA1 aefb94d80b262ce052ad560ce6b1680fa702bb75
SHA512 2209491058ffb49d88bd5042c7d6b64201ea2dbbbb4ea085748845cd5c96bfc0aa43dd24dbbfc004d7b02cfa729e92211f5e301210555cbeb367a00c01953a92
SSDEEP 196608:tlvS4WoVlxQyLrSBm3iUz9mIWI3KiaOm5Yms+kS4oa2P3b9nHncYqdsFWsC13cuV:PxRV7TS03iUzhNK+uO64oaGZHncH8Wjp
TLSH
T13DB6339AA9ADDE34FC04FA44EAF25217030F021ED55687402F96CA77BB4FAC75926730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

60ff26bd565e7c94c4940267a6a59608

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\60ff26bd565e7c94c4940267a6a59608
Size 364KB
SHA256 e66c6ed4b6a62cebb7a36b0fc8ceb16aa247bcf6c676787d0481fcfe107fd192
MD5 60ff26bd565e7c94c4940267a6a59608
SHA1 e9a1a48902aae36eab907b8ced8a517ccb21dede
SHA512 42fb8e70bb7dfb9971a3ad02346bb619777fba9d9a0b2dcfd55950d95516002274137ad9d4e8021fd671f3313689febb8464860fcec842ef15e614ff204ae8fe
SSDEEP 6144:F2Hgp/tCg7SoadtRE5/lISa5eLDYfVN6mrAmYnlpTAG7mSbpM:1p/tCg7So+RE5tIVkDINa7v3bpM
TLSH
T1E784231181D479853FBBB862AAA1C8B5D28797CF7D62D5A1B7030C87C195C071B3BACB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6b08236da8cd970595ee637755046d13

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\6b08236da8cd970595ee637755046d13
Size 322KB
SHA256 2997be874355e3ea9bc36c05fb7fc9b9a2a8e6da87d2014ecfbc8b95f77b5686
MD5 6b08236da8cd970595ee637755046d13
SHA1 109114621c5a8b85ff7612d0ba2c17616fcbe536
SHA512 6f496266dcf7e3885791c0aad0703240dbc68f632f05102c482d8db7cb7dc9b79013f93b8ba7cf2a081cdc2772b9f5121d4f88aaf219b91161754d873dc3a217
SSDEEP 6144:j7bhY6n1UVvdL3rfcsbR8cN8wOcdm/B+F/s7Caa8sjGOFisi:vxyrhbJ1Y/cSTa3hFi
TLSH
T108642339C802506EE54A71BEF48BA523FCE407C38835096F76D6A47086BF3D3C1BA946
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7071af81f7fad1d26ec29b7699f2d96f

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\7071af81f7fad1d26ec29b7699f2d96f
Size 5.7MB
SHA256 21f2759a5148c427118911ae402be2a2def56f29bedbd33ace3ed2ed714422fb
MD5 7071af81f7fad1d26ec29b7699f2d96f
SHA1 0b0d2efd7915cba61b677389858e4a1b3d896699
SHA512 966824925a1446316197f19616854318a76047c1a20af4bdc34f41dcec60f7a93d68f2c69578be830c886610d094df90cbb757450549daa5e7a3ac43665e0fe0
SSDEEP 98304:MPozI9K4jo9oagQ0ParlUCuJ9P3Vt3yA/owp7PcA1VyzKSpPd7ibGGg5caGctpTc:Mg94jwoalYarlrG9P3VEkx7PcHf5xiai
TLSH
T16F5633D0AA7B040AD1BFF6704C2B1F144E998299093CED4E5D25D0B989D74F763EA8AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8064cd2d4382103eb14beda9944e9fcc

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\8064cd2d4382103eb14beda9944e9fcc
Size 23.5MB
SHA256 19fa8617e433dcaea13844420261d2087e274deb11754a3e7cdf2c2cbd7de653
MD5 8064cd2d4382103eb14beda9944e9fcc
SHA1 8136708dcdee1815021dc4e1820b6fb2b1f5043a
SHA512 1a252952bf3ff13969ee575271ceff42c48ff6e85ba46219762409e8e62e58551b018c99dd16532bb0e4e257c41a834ab754767aaf3ddfa6a0132414044f6531
SSDEEP 393216:ac3LIZKKA/hky948NqOUJn7ZhPq0VQdmek2popT8bs9rs7pKkb7uhuBWeGNKOfP8:pbWKZUiqO2nYdmekXFU7Qkb7uhuseGNg
TLSH
T1D7473324FC6B657C165B8FEE3B560199970C466848A697FC8144BFDF3DBACC0BA40B48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

82749026fce27062a4c968059ffce7f7

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\82749026fce27062a4c968059ffce7f7
Size 302KB
SHA256 6fb13b21ae210c79474d0b8bb2ec0a0433435174f99eec981c8c99343da34acf
MD5 82749026fce27062a4c968059ffce7f7
SHA1 f52c68418a8c84afb2a8a37aa6317853761a93be
SHA512 61372921ee7fee75065a78e215bd50958a4f053381adfd2b73a0040b0848b7d0b0024015f6a2beb0adcb23198466f68cb9ddce8fdca47d9e87971033f0513d6c
SSDEEP 6144:6vzbGEkFlF8j41PH+uvUrx2lDiDWVVNydwlllgMyRWf2/1K:6v/Qz841vSyVLgqUMyRWf
TLSH
T12D6412BFC41644AFC172FBBB22FD2D1185082CB74206D89E6E7512B82F5B0D7A71B5A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8f379ec2b22ff106b837d79f7fdbf0d8

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\8f379ec2b22ff106b837d79f7fdbf0d8
Size 13.1MB
SHA256 6620658a6288e6b58b8d86aaef4e7734e10778974e9a01d364fc7aac4d35f10b
MD5 8f379ec2b22ff106b837d79f7fdbf0d8
SHA1 977223c04f192d8a157603c1f18d6d6a301e88b1
SHA512 1aa837f64e2d9652221ed5bdbf78c353e04a0536d09a3502a230b7f2f034dd404bef0e1a4ce57a42cd03f860f64965d94c2b638aa0994a3dd41fdbc6d751458d
SSDEEP 393216:DL5briJop9j7Yl/feBa5tMaNqGOGwdCUQUJ9Y2Ondq:npWJehYl/DFNDMJ+2Ondq
TLSH
T140D6339AE0F53A5B79933C7526053C970ECBF06BB59B152C24EB0452C2EDFF67401A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8fe59dc7f0e856efe66cb5568c170c41

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\8fe59dc7f0e856efe66cb5568c170c41
Size 127KB
SHA256 407015a647c74640d86242bef633a8896561993d55b3a8e2ccd6c1d769943b7f
MD5 8fe59dc7f0e856efe66cb5568c170c41
SHA1 f75a2d275e2ba5fa00ca0319117d8e77d21d474d
SHA512 69d0ff458c1f0bfdbc2152769e39804b3d80346c5cdd579714b5ae80381ebe116e787257f54f2dc591ac0a2f5aedcc730e1b52a7b9b24330ab620f281799130e
SSDEEP 3072:mV2Bk7YWRsKohFyopBzW1AT3rJsYcEpv+KBXmBkSuG/:mYBqPRsnRq7Ybl+wX0kQ
TLSH
T129D312783C789057E617E00621AF9233F53BC9D4A2B023D99A93D79721183F25773AA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

97327884177381d0f42d428110b4c516

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\97327884177381d0f42d428110b4c516
Size 3KB
SHA256 b8d4802f5c25d188268bf6a3a1c72a00d56a7b3f7fe64bb7f5fc4d6e8f6b8a28
MD5 97327884177381d0f42d428110b4c516
SHA1 f1486a304c7b458dcbaa53836632d723f0e87505
SHA512 9fae3ae92fe1073f7e720eb6da6ad99c19bbcdf6caad9408feff07140d5df9f845f0e5f652ae90a87185bcfb0a90287b4e0da174f1b0ea1e7055cab16baef369
TLSH
T1CB616CDD8D95121BD31F963354055E668C7FAF2AC006224F30201C2ECC0AEDF9148B7E
MD5 SHA1 SHA512 TLSH

Submit Download

9c0c53e6eec0b3b1ccc275362f6c0a72

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\9c0c53e6eec0b3b1ccc275362f6c0a72
Size 5.5MB
SHA256 e4b76c7eeb85001e05c94d3310fd23ce1c77fbdae2ad23b6096ed2dd36561df6
MD5 9c0c53e6eec0b3b1ccc275362f6c0a72
SHA1 194cda0369b6a054bd9250f4982b875706272242
SHA512 de7328599f1fa86e85fd3eb80715d9e20d92d6729b6bb31495fae0ea08434b95f60ad1bf28f6a9d513c7f28e7d920cce47852fa0edc8a00d6db0581c73f3c5f6
SSDEEP 98304:N0Tdul0TFdExpVBJc5fqP6PP58ynUTufWXMAtUcHoY4zxeo:N0gl0RYhitU6PB8iUT1VUD
TLSH
T1FE4612FAFF7D493DC177977992038812AC68641A9A2C650F09296C7499C3AC7DB423F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cb3b2b5618a8f78a13350b01ca89c5e7

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\cb3b2b5618a8f78a13350b01ca89c5e7
Size 597KB
SHA256 5c77cd5cff244d6a30d8049a1d2410c0a321c648d0d4f6578d83d9b3cbd1d221
MD5 cb3b2b5618a8f78a13350b01ca89c5e7
SHA1 6594b0bb4104970795b4d8fa5cc135a9d1e0c8f5
SHA512 5addf4d5f8fb99ce04c4d06caae36fd7b5f3a1deda164fde7d2b67c90181896d42040f0483b3482adadb1bba58d80fc3317306426b31bef229f5ab028fb7f6df
SSDEEP 12288:kWoEp4kmwpJpZMqvykVpQog/BCglT9CKmWTXU48aUB0eFbSr12NknX6jZZc/5Lb:kWalwpnZfyoJMCglhCKmev8aUB+kXDcp
TLSH
T1E9D4234C2EB17C6BE816E3B14DB06F498500799A4E682E4F64F6F456EB031F09E891DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dc589dfcd63f854ad81edd0c34caa2d2

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\dc589dfcd63f854ad81edd0c34caa2d2
Size 6.6MB
SHA256 ec49efcf2d661b65ac3adf78af072fae4dd3c05cdf3fbe70c6af3a9001f2f1bb
MD5 dc589dfcd63f854ad81edd0c34caa2d2
SHA1 1003f7ddaacdf912ddd6e60e8185911050e1183d
SHA512 1bb8df2a45c5016a1e0ea58730fb74d06218856e9c0c1be1f75cac1cba9ede19175041de21306b3f1ec90440dd680339f8ad139dcca425387402f60e1edc6586
SSDEEP 196608:XRZ7Rvm4Y1p/NK3KqufSicEsnWJ9Int84ZJH9hgw:BZ7Ru71prqJE9CpXDR
TLSH
T1566633FAFEB4093ED267AB36300198526C26CF55CA14501F642A64B4EEC33979F436DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eb9dd4d0637fd6ae21747e6b6a281d21

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\eb9dd4d0637fd6ae21747e6b6a281d21
Size 459KB
SHA256 5a3aae5657899b6452004f3f43f122cb6c166c99b7261efbeb965da906626ed8
MD5 eb9dd4d0637fd6ae21747e6b6a281d21
SHA1 387c79caeee5a5a850e328f8b9ce812b5048cefd
SHA512 f9b87df46149f2fe52690e3c906ee1cfc92e3196b8db50210269312999a56b9aff354b1b5c74da192b37646dcee5305d8afde6d2c80334a484b1a8a375950b5b
SSDEEP 12288:CtpZwzl7szmrFyHHU8ibAQXgwntX3dh7ZVNx:ClGl78WKHebAKtX3D7ZVNx
TLSH
T141A4235BC725D298D9A2D17EE22215BD68FF29AD8010F52A08015E417FAE70D6FF02DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Roblox\logs\cacert.pem
Size 223KB
SHA256 2eba303a7b3c87f0c52fa8f977b703ec6dea7de703f97644546d2d34e53e4cd9
MD5 2ef00fa979161001a3a5cd5169a7de48
SHA1 0d3ee6044ef954db79d4db9984cad411dfd4c3c7
SHA512 f0b7f015d3e766b390a663ca5b1498175fa241259cad73f4b8d2b9646b56bc08a698fea7f5a28324b9a59af1622296ef79d77830a50bce14fd5f02f7f9228fdb
SSDEEP 6144:EqU9NgI6FdZL52dTOgwQh1hV1AP2A2FTR:knh6fZL5mOi1hXAP+9R
TLSH
T1E624AEAACF953C4A28E3F094C9AB037ED919C3629DDAB0B31D593845C78972D61FD08D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8913724486d5e3c463c493b25346ca31

Path C:\Users\Admin\AppData\Local\Temp\Roblox\http\8913724486d5e3c463c493b25346ca31
Size 64B
SHA256 4bbcb3d26b41f0cc7f516d28b4e6e4ac9baeb91888ad68f48505c338b7b33e52
MD5 1e8ba605b53b9e4978fd23e68f8f8dce
SHA1 bdcd7c2e5df0d2d43d96eaf6420c54da101216e6
SHA512 bceb6c612f4cf4d8a6716b458310a5d7326f8d95e42d4e08a82dd1cbded92a0592cb7394cd9f33d8424cb6e58197f85de29a055c08d532e2232a4da2ac2f89b7
TLSH
T127A022022C080E20888A3838CEAE020C223008E03F000B80800FA2C00C080C8E8A8200
MD5 SHA1 SHA512 TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download