19c68344c5e95d70bb59475a696838b50d94216ccdbb6c27c6c29e4d729c0171

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 17:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RobloxPlayerInstaller.exe
Size 13.2MB
Sample261102-v3e2fsfg34
SHA256 19c68344c5e95d70bb59475a696838b50d94216ccdbb6c27c6c29e4d729c0171
MD5 b2d39424d98b15791a22ae607d85dd3f
SHA1 5ff42a9afac12adbb60346c7f1bb923015683c48
SHA512 7155696c4e4fae5a77ddfc55a50867625c4c94672a3825b4437bf7537cdecc9eff25cd106fe712da4c170f9eae7776cb3f87582ed1d548481d4944727a02f013
SSDEEP 196608:oGNlRA0k5a4nF9Ljyl6OqZr5LT8EI3i5pAPtGEgT:oY8tFol6O+r5LT8EfYngT
TLSH
T118D69D6AB2B800E8D4BBD178C6465617EBB1B41603709BDF1AA046F61F63BE41F7E350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery persistence spyware trojan

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
5140	RobloxPlayerBeta.exe
1888	RobloxPlayerBeta.exe
3960	RobloxPlayerBeta.exe
4000	RobloxPlayerBeta.exe

Loads dropped DLL 2 IoCs

pid	Process
1888	RobloxPlayerBeta.exe
4000	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 6 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
1888	RobloxPlayerBeta.exe
1888	RobloxPlayerBeta.exe
1888	RobloxPlayerBeta.exe
4000	RobloxPlayerBeta.exe
4000	RobloxPlayerBeta.exe
4000	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\VR\Radial\SliceBackground.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\scrollbar.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_1x_5.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\Controls\DesignSystem\Thumbstick1Horizontal.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\LuaChatV2\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\models\Thumbnails\Mannequins\R6.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\AvatarImporter\img_light_custom.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\VirtualCursor\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_2x_15.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\fonts\Merriweather-Italic.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\fonts\families\Montserrat.json	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\ImageSet\InGameMenu\img_set_2x_1.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\sky\sun.jpg	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\avatar\heads\headB.mesh	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\configs\DateTimeLocaleConfigs\zh-cn.json	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\configs\PerformanceConfigs\rofiler.tools.js	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\models\Thumbnails\Mannequins\R15.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Controls\DefaultController\ButtonY.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Controls\XboxController\ButtonRB.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\models\Thumbnails\MakeupEnvironment.rbxl	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\particles\sparkles_color.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\TouchControlsSheet.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\PurchasePrompt\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\Controls\DesignSystem\Thumbstick1Vertical.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\LuaApp\9-slice\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\LuaApp\graphic\shimmer_lightTheme.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\LuaChat\icons\ic-more.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\fonts\Arimo-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\IBeamCursor.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\LuaApp\graphic\album_art_fallback_pink.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\LuaChat\graphic\gr-send.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\models\MaterialManager\smooth_sphere.mesh	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\particles\forcefield_glow_alpha.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Chat\ChatFlip.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Settings\Help\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\AvatarEditorImages\Stretch\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\particles\explosion01_shockwave_main.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Slider-BKG-Left-Cap.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Controls\XboxController\ButtonLB.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\PlatformContent\pc\textures\studs.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\avatar\unification\AdapterReference.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\configs\DateTimeLocaleConfigs\ko-kr.json	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\fonts\Montserrat-Medium.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\VoiceChat\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_1x_7.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_2x_19.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Controls\DefaultController\ButtonR1.png	RobloxPlayerInstaller.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RobloxPlayerInstaller.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe

Modifies registry class 31 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-5a21b87bbc2641cf\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-5a21b87bbc2641cf\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-7062aec9dbe74b14"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-5a21b87bbc2641cf\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-5a21b87bbc2641cf\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-5a21b87bbc2641cf"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-5a21b87bbc2641cf"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4884	RobloxPlayerInstaller.exe
4884	RobloxPlayerInstaller.exe
4884	RobloxPlayerInstaller.exe
4884	RobloxPlayerInstaller.exe
1888	RobloxPlayerBeta.exe
4000	RobloxPlayerBeta.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1172	firefox.exe
Token: SeDebugPrivilege	1172	firefox.exe

Suspicious use of FindShellTrayWindow 20 IoCs

pid	Process
1172	firefox.exe
1172	firefox.exe
1172	firefox.exe
1172	firefox.exe
1172	firefox.exe
1172	firefox.exe
1172	firefox.exe
1172	firefox.exe
1172	firefox.exe
1172	firefox.exe
1172	firefox.exe
1172	firefox.exe
1172	firefox.exe
1172	firefox.exe
1172	firefox.exe
1172	firefox.exe
1172	firefox.exe
1172	firefox.exe
1172	firefox.exe
1172	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1172	firefox.exe
1172	firefox.exe
1172	firefox.exe
1172	firefox.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 1888	4884	RobloxPlayerInstaller.exe	93
PID 5548 wrote to memory of 1172	5548	firefox.exe	105
PID 5548 wrote to memory of 1172	5548	firefox.exe	105
PID 1172 wrote to memory of 5232	1172	firefox.exe	106
PID 1172 wrote to memory of 5232	1172	firefox.exe	106
PID 1172 wrote to memory of 5232	1172	firefox.exe	106
PID 1172 wrote to memory of 2804	1172	firefox.exe	107
PID 1172 wrote to memory of 2804	1172	firefox.exe	107
PID 1172 wrote to memory of 2804	1172	firefox.exe	107
PID 1172 wrote to memory of 2804	1172	firefox.exe	107
PID 1172 wrote to memory of 5796	1172	firefox.exe	108
PID 1172 wrote to memory of 5796	1172	firefox.exe	108
PID 1172 wrote to memory of 5796	1172	firefox.exe	108
PID 1172 wrote to memory of 5796	1172	firefox.exe	108
PID 1172 wrote to memory of 3864	1172	firefox.exe	109
PID 1172 wrote to memory of 3864	1172	firefox.exe	109
PID 1172 wrote to memory of 3864	1172	firefox.exe	109
PID 1172 wrote to memory of 2592	1172	firefox.exe	110
PID 1172 wrote to memory of 2592	1172	firefox.exe	110
PID 1172 wrote to memory of 2592	1172	firefox.exe	110
PID 1172 wrote to memory of 2592	1172	firefox.exe	110
PID 1172 wrote to memory of 4716	1172	firefox.exe	111
PID 1172 wrote to memory of 4716	1172	firefox.exe	111
PID 1172 wrote to memory of 4716	1172	firefox.exe	111
PID 1172 wrote to memory of 4716	1172	firefox.exe	111
PID 1172 wrote to memory of 4796	1172	firefox.exe	112
PID 1172 wrote to memory of 4796	1172	firefox.exe	112
PID 1172 wrote to memory of 4796	1172	firefox.exe	112
PID 1172 wrote to memory of 4796	1172	firefox.exe	112
PID 1172 wrote to memory of 3436	1172	firefox.exe	113
PID 1172 wrote to memory of 3436	1172	firefox.exe	113
PID 1172 wrote to memory of 3436	1172	firefox.exe	113
PID 1172 wrote to memory of 3436	1172	firefox.exe	113
PID 1172 wrote to memory of 4232	1172	firefox.exe	114
PID 1172 wrote to memory of 4232	1172	firefox.exe	114
PID 1172 wrote to memory of 4232	1172	firefox.exe	114
PID 1172 wrote to memory of 4232	1172	firefox.exe	114
PID 1172 wrote to memory of 3648	1172	firefox.exe	115
PID 1172 wrote to memory of 3648	1172	firefox.exe	115
PID 1172 wrote to memory of 3648	1172	firefox.exe	115
PID 1172 wrote to memory of 3648	1172	firefox.exe	115

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\RobloxPlayerInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\RobloxPlayerInstaller.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe
  "C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 4884
  2⤵
  - Executes dropped EXE
  PID:5140
- C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe
  "C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 4884
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:1888

C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:3960

C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4000

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5548
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1172
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1960 -prefsLen 27097 -prefMapHandle 1964 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {dea41dee-b7ba-4006-8c0f-7e8ce4c39132} -parentPid 1172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1172" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2416 -prefsLen 27133 -prefMapHandle 2420 -prefMapSize 270279 -ipcHandle 2428 -initialChannelId {aa092aeb-141e-4e21-926c-c6c4e5e328af} -parentPid 1172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1172" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:2804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3728 -prefsLen 27274 -prefMapHandle 3732 -prefMapSize 270279 -jsInitHandle 3736 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3744 -initialChannelId {a1226e91-66e6-43f1-b047-c70f69a98cb4} -parentPid 1172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1172" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3892 -prefsLen 27274 -prefMapHandle 3896 -prefMapSize 270279 -ipcHandle 4000 -initialChannelId {44eb0002-626e-46a0-a7ef-fdbdd4d0ae4b} -parentPid 1172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1172" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4540 -prefsLen 34773 -prefMapHandle 4544 -prefMapSize 270279 -jsInitHandle 4548 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4556 -initialChannelId {af303334-26f5-49a1-bfc5-f393cd27527c} -parentPid 1172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1172" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5300 -prefsLen 34822 -prefMapHandle 5304 -prefMapSize 270279 -ipcHandle 1108 -initialChannelId {62dbc19c-c172-4add-91d8-caa2720952f7} -parentPid 1172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1172" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4848 -prefsLen 32952 -prefMapHandle 4836 -prefMapSize 270279 -jsInitHandle 4824 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5148 -initialChannelId {e8596db1-795c-44f8-b374-241467e6d0f7} -parentPid 1172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1172" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5620 -prefsLen 32952 -prefMapHandle 5624 -prefMapSize 270279 -jsInitHandle 5628 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5636 -initialChannelId {3275c158-6ee9-4593-844a-62bfd2f87e22} -parentPid 1172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1172" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:3436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5808 -prefsLen 32952 -prefMapHandle 5812 -prefMapSize 270279 -jsInitHandle 5816 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5824 -initialChannelId {a3e8879d-eddb-4d71-beed-cc45d5b61400} -parentPid 1172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1172" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6416 -prefsLen 33071 -prefMapHandle 3160 -prefMapSize 270279 -jsInitHandle 2784 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5176 -initialChannelId {6e4a7e63-c8b1-41e5-b3bc-3df86c8b4fcb} -parentPid 1172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1172" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:3648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Modify Registry

T1112

Credential Access

Discovery

Debugger Evasion

T1622

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RobloxStudioInstaller.exe

Path C:\Program Files\Roblox\Versions\RobloxStudioInstaller.exe
Size 13.1MB
SHA256 f52514b1b91376ff9ac66f49d16f7cbda4096d44fcfe3dbb662a2b8547dac9b8
MD5 18f405651d9446df3579f785ee96034b
SHA1 2dfa42893bef7f8277339dd44a412780db67aa36
SHA512 9d17596e911fcbe3e2870b6477c00c4ef63b9ed5a1b2e682b4c411cdf155283a6cdb150a4729264274cc1778898ee40a7f0428177e0af5e7aa173037e8f25a6b
SSDEEP 196608:jVhIFplZ45+y23Ftw2xYxKDi3zA3/4rsm5p/FMrp/2IK:jVs1F/YxKDozA3/4VdMrp/dK
TLSH
T160D69D6AB2B800E8D4BBD178C6565613EBB1B45603709BDF1AA046F61F67BE05F3E340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.dll
Size 16.9MB
SHA256 b5e81e0cf070efa2ee8024bcd180156a5bdaddc56d0d1f4a9bc620b8753761de
MD5 980b49493bad518eef7e0c1ef65b031e
SHA1 ee5d01897c67d557c4552b3731a1c74cbcd1350d
SHA512 453218cdafb5ad9d8c506ebb80e46fbfdb359daf750f1c21383fc037cd43c5dc87732eba294ca17c63f46bcb9d5dc9ff22a60d9dd894e1cf088c1979da3120aa
SSDEEP 196608:blIMWAqLfs3M0aicICjqSiy788hVQcRO8wYXGK:K5L03Hajriy7nhVi8uK
TLSH
T11107C04EF4D616E4C5635070D26F56E3EB21309C4A682FF79A9502203A6378E3A19F7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xoeudfhc.default-release\activity-stream.contile.json
Size 4KB
SHA256 54bce7cd162946df5afdff4ae97b593656d9ea6c389c52b1fc55b3cc2c1bd277
MD5 2f2059799c8c0008475c5a0e941e2190
SHA1 f5146ead4b5deb3ef061e72d3e017c99fb1379df
SHA512 3dd99dfd2cce88787d55707adb76c75803c49f9177037f4499d601f199d78e3a61ea397e835958db2daeb292983923ec504639a7a70560da81b5788e959b9b0b
SSDEEP 96:Tg2KMS55mWuhe4UT+mRt+n4KY+cK+SK6Dw9lz:0jMI5dwe4FmRt+PmSKww9F
TLSH
T10091E95FE4744A931B31BAE12C4B3A9CF007B408F9F48F5971579C21C6EC7B991EAA44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xoeudfhc.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 34301e063a66b744956f01522eab8e65eff81f183f7b733879f5f103191371fd
MD5 bf1df23ddf5fa93bb84996b6b1d24689
SHA1 1dfc74e1d01244ee214a2734d661f865093b0a5f
SHA512 6f1901cee093623e77a8ebab49d4c5775805cf7d05df0d2a503390206f8f118b44c36197b3375f5ad58838739e0479a86113669e1fc35df77a238ae3d133596e
SSDEEP 768:OByhAwAcCtOSASHNeVr51Ip+G3itqb9vXjOOr7I1kyOFaK:OwhDIONSHNeVl+QG3eQ9I2yOFaK
TLSH
T12B7309A3E6E972FB1BA077C72C0FB95B61D20145E74506CCFCEDC91C818D658423A6AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

26017

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xoeudfhc.default-release\cache2\doomed\26017
Size 52B
SHA256 23b2481619e96411a615759ac3a913a3b1bad078214eeda321baf683c793387a
MD5 d30404fd84b061675d1f3bcf317ff445
SHA1 9c44a04876df7aadcae16c0adf1cfc1c5d97475f
SHA512 218b7e8fd1bb4c5d01c7a2fe6e9f36aecf4a75cc59634b454ecdfd2b9b7f7cff3bfe5ad4516366164cbc4484a144c5df139d33b202d3f67aae630bcd227699f0
TLSH
T1379002085A55A994D1589131195180BD44103D048481567379A54B9106710D66418800
MD5 SHA1 SHA512 TLSH

Submit Download

2835

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xoeudfhc.default-release\cache2\doomed\2835
Size 256KB
SHA256 9cf1574cd6153b67e6d408433207d0c8302c1aaa16c791d5ba6f945bdac43b1e
MD5 bccb6d01f93976d4db9b9ba3ff9ec825
SHA1 1a3ec08d953d45c1eee8270a3d748c9c99b25744
SHA512 2452f7606d1ffdac6f478d4e96239b36df4c06d8c7c963c360e86fd62791f167ef063ff3b45bd0e488346b2126ee47258cb985aeaf16bbe3c4f906d9b584ec6b
SSDEEP 3072:SSKXUyfjZ4mcdmdDPgB4x2te4675uG2Zj30:2jckD0Q
TLSH
T1DA4407F3D6AC30FB075286DC2C1D72CF62AF417ADB5209DAF86C8158C3C9A65107679A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xoeudfhc.default-release\cache2\entries\06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4
Size 16KB
SHA256 7e4a712c7617d3c599207ad7783b1d3e076d66339fbb6c70f87156a90160b100
MD5 a85b376c544dcecb6f2cc9f8b91838a9
SHA1 b158e9dacbe1f7cd46707d734f2ce9ffe8d6f228
SHA512 8fcaa0ee3ecc1ad743cef21062bc627e09a0a818a049986404f59f42b60ba2b9eae5c5fabe4ed78a9905e3abadb00d91b09fd1740bed473b073bd8dd6be9468c
SSDEEP 384:HXwIiO024YWWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAjv8:36ZYWWTToXJWTTogB7S/AmVAf+hRMyv8
TLSH
T169728E7D9F413CAC1767D0E8C8B983598D18B2A7DFB5C02D259C3E09CA88A5671F584F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

08B2F11DC2B96DD8A3BD8DA58CE657A4F145B477

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xoeudfhc.default-release\cache2\entries\08B2F11DC2B96DD8A3BD8DA58CE657A4F145B477
Size 357KB
SHA256 bb11a0814b196a0ce1ceddf453fce756c1618d5d5bfda107e01a7739e39ed238
MD5 b1eb7de6d16984939d5ce3b4b39a153c
SHA1 b36accc35963f0b0451989d54227105fbb008c91
SHA512 9c8bfaf154b093fe0966d1552a3d2d46fc05f193ad85cd29390985d749d703e8158d74e02c53f3198198e0ca22003bb5f74aca0d290ff2aa18f0599bd5a67216
SSDEEP 6144:wZpDEwRnuLHBNUjtt7heEW7eSh21T5TKK2lSu1raoZYlbTV:wZdEwRuHsh17SmNTKKLoUV
TLSH
T13174233A0AC189E0404F13F2F6646F9EA599318F5E63FC0EFB15E58791AF1D66F21209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xoeudfhc.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 c5c01d814f3cb846ecb6208c57dd751d21b1bf5e32d90f16f82fd00536b016a0
MD5 281c3d1c9b5f7f609b575bf1714b2480
SHA1 b651e253dd5e393d69fe4885a9a125729688b1d0
SHA512 1863c7f7866ad48cd0099ca5864e706f65072b62fb3ba4a50fdd55c07b6873ed88112052eb166ad61e68df7ff4fc35c325a592e47a0f554a113b53dcdd720c43
SSDEEP 3072:j3ll7pUs922C6rU/ehWERcGYMn/GFL12E6R:p9J2f6424ER/YwJ
TLSH
T194A39EF7DFA28D3D54FFD02D6B82C83EFD212404B3A72409C957661066CABA87679248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xoeudfhc.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 7351d8913b48247e8bfd76644982d25c3ee496746026f53f87a0c8bec069a9a4
MD5 7ef8f625dbabd490b9295b4cb81e0158
SHA1 312a38e0b93f29409abbcb0658b8e23b79eaee11
SHA512 930bcd25faa6dc95773070650ef4db9d8f608dcffb57ec65dd42c1efdcb9d6037deb32a17c18446d0f8f52704dea21fed00a15a34e81d31ff234e3c425beab38
SSDEEP 3072:X3ll7pUs9HiqLLgFB0h4aRcGYMn/GFL12E6Z:F9JHBLkiyaR/Ywh
TLSH
T1DBB3AFF7DFA28D3D54FFD42D6B82C93EFD212404B3A72419C953361066C6BA876B9248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c543f146-88db-41f5-80a5-6f6c7d82b5ca.zip

Path C:\Users\Admin\AppData\Local\Temp\c543f146-88db-41f5-80a5-6f6c7d82b5ca.zip
Size 3.8MB
SHA256 ae8968444be8a77b69f219cd6b35eded970010727fef812820df19f254b860ad
MD5 30a35cf455bbd02eab62ce1ec6bc672c
SHA1 e364ae9d1e029ca2b0d6ed5340972d94ee830275
SHA512 9318c263826c2e3505be9cb23a6105f302702bee84a53006d9f53624e12c91d08daf375173d11ce0d2805afd5016631876d4d9742b790c8cf1fa4f8ac1884a96
SSDEEP 49152:tFVWusWylhTFvRd+k9qQ/DYC5lpflkgbm/nFSzFmj2JWh2MZkejO1qyUVZE6WQ7t:tjWuM+vqYaflkUMj2J22Mnj4Wr7MsVV
TLSH
T15706F175D25C1609C9FF83FA853C2FC2B84C4FA68354A96B7A6A8D715CA31EE1F74840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 21.9MB
SHA256 1090c5d6881985c042370d506e15f1db1d0a88bfb7e9602a9202fac421098eb3
MD5 322a050bc53af9aad7a659054354862d
SHA1 44dec61c400db851b57e4e2645fb253609db7d1d
SHA512 ae8624becb7619dd9602f416203c54096ae0e23c4c2574c8069e633f9682b0b9bf5bbb95e94fca6610b9581746d5ed648fd41c47d762b174bd5d632937df6689
SSDEEP 393216:vKuarWwW0LmrEr38dudevJCJU2kpq1gL2aVRHA:wWCmz0dwJIkpqCs
TLSH
T16337E14AE35310E9E81ECDF4866E9A62E4343C4E03319BEF17D47A355A727C42A39F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\addonStartup.json.lz4
Size 4KB
SHA256 84cfc2c6bd38c37ddecb7c32860809f0c94675fb0b65cdb7f398f050ddd39fc6
MD5 d776bb66bdb4b2d8b909f1351ada128b
SHA1 aca1c04620e14412dff73d71d058279717bff452
SHA512 fb5dce5221faa0a50398bae0d2350a58450e7b66b6135a8806b094a520297feca51de8f83927595c1c5794e4a004508421bcf834dbba9b3ca4a2a1e81635e346
SSDEEP 96:NWk4sHNw6M2xWGhD41MgGvmHhF+rUpO1LnOYvhQhIRhN:Ni52xxhD8rGvm6ApwnHUuhN
TLSH
T1A7A16C7AD541EFA1FE32C04358D97FB2EA9AAB7414A9C4D4F1AB72294D34A735704340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

broadcast-listeners.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\broadcast-listeners.json
Size 221B
SHA256 56fdee3df787f4c2db48e5f314b093d83c722e12dfb0ef66f08938c0d32c6b60
MD5 51b76c718fd558b39e477768477f778b
SHA1 3726f8857d44e6cf09ae949ac0ea2efd7c959260
SHA512 33fa12732548b228bd6dadd9db7ae261f14e66e196f82a717b3ba42e893f1b9699e0ac67e31a651b9df934be0cb6596c783894de0a9a09e0d8f0712b68f662b2
TLSH
T109D0A91A50123C7F8A88A629E00827858AAA200A6670903D83AA20640A2AAEC800C290
MD5 SHA1 SHA512 TLSH

Submit Download

broadcast-listeners.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\broadcast-listeners.json
Size 221B
SHA256 869ab815eac07e856e7e37ea5988123ba60ea9bb5bd038f044f2b4be83b2428c
MD5 0c0724163642c0bb56be531129f5525e
SHA1 45bed96d31803d69c5389a6b82a1554b31f55028
SHA512 497a2c5b6e0152372fd874a95459b2e531b1ccab88b41147b0eb78f5573a5ec67084818b07052950fc01a1ee27ced909aa4cc2845d74feb53a9398b96efdfbf3
TLSH
T135D0220E24133C7F4B886739F00527824B9A240A3270903DC3AE24A41A6AAEC41492D0
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 66f07deccebd119d79fc0247e47567abc510ab618894d1aa0c88a4a6928a43fc
MD5 4cbedc9b415d1f77a426935c1a994cc3
SHA1 167af5e008aff78607208313af344252944079da
SHA512 878287eefce4aa5a70d3d83dd979996ab8668b1a5c043a577987a0165b21a45e8aaebaf55916ebf63a2089f16aa1b4d4d472d6d9c67e7001f3b0dcac323a7098
SSDEEP 192:HOv5zbo7aZdYyj+xNH1d66JoztdzgCl6mc0dz:4bomZdYyjmVd66Joz/zgC1jd
TLSH
T1FCE1DBA8E328863BC418027BCCB62B500E35389AD88E6F1971DD645D3D972DD778E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 d9fdefb6eec9ffc26fb50e10347d9176b0a2580675318e4580729db22086eb5f
MD5 042e38a733b5c3b0f4e0246c85c210a1
SHA1 68e6256a7695e36faa1f4f8dfb262d3c184da5ec
SHA512 cd0d7fe68820383a3a386f1c63341a5d0fb9abe6779a6500b9df031cecb93587113d78cadd93f05022974713cdd75ace283d7795ba440de07e4d507b39b48eaa
SSDEEP 192:HOv5zbo7aZdYyj++gH1d66JoztdzgCl6mc0d:4bomZdYyjCVd66Joz/zgC1j
TLSH
T165E11FA4E628867BC408027BCCB62B414F35389A9C8E7F1975DD650C2C572DE778E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\db\data.safe.tmp
Size 32KB
SHA256 480a702ebe34d142facbdeda4d71eb62dc54e763d9ec1278371d89b74d60074d
MD5 7f3e91f07252bef2b6fcdbd488b79129
SHA1 8bf50015d9b189faff77582d9787aaeb4784f954
SHA512 8d91d31a71ee93b5fb701c8bf3e8773c3dad55e9882b2b4d1d6378861d1f3d2c2268bf6dbb49a3c7979a9d619752a360583e03655653c9f0fc4828e4b370fc70
SSDEEP 768:Ci16WVK+mHIGcm+u/YKqNwxabfbzerS5kd:C/WVKxJYTEd
TLSH
T16FE20E84FB2E953FD41812BBDCA51B142F79B88558092F9B3A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\db\data.safe.tmp
Size 32KB
SHA256 eb307b03a4939eb3036e20a815231ed8009d4c6985b8e21daaf537793a0389e9
MD5 b0a68139c60e09c4ddfef1ce265fab88
SHA1 f03b186b71141a3ff309823b3d082ac4a011ad22
SHA512 e680bb44e89d71c89158fb4591119229ddc73f9f5b348f699157816154c0a631edca66a00c8e3cf23950cf299275a7975761a43ef79cb550e9448ff4b55bbe6d
SSDEEP 768:1WVK+mHIGcm+u/YKqNwxabfbzerS5WBi1/:1WVKxJYTE3E
TLSH
T15CE20E84FB2E953FD41812BBDCA51B142F79B88558092F9B3A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\db\data.safe.tmp
Size 32KB
SHA256 d76122196dc608b6a4f958ccec4a76fc7228c96dfbe013618b852378f5c23191
MD5 2247e9c6742d4511f22b188db82b5a8c
SHA1 4a6a4ca67ad909ad61844c7d2ec7075580c46171
SHA512 82040b055ae492df57fee85b82bcf5f27f5aa5bc1cfdc8d3e5c25557d7be0b794aae109a84f60ea4ba4f25a695035762ce7856686b3200f06288af68d5c1e7eb
SSDEEP 768:fkBi16WVK+mHIGcm+u/YKqNwxabfbzerSs:m/WVKxJYTE5
TLSH
T113E20E84FB2E953FD41812BBDCA51B142F79B88558092F9B3A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\db\data.safe.tmp
Size 32KB
SHA256 0a444865fd20aea7c2266e49e301270153d9e0b5e2255e90df6c75b8089e133a
MD5 2c08df2cf53e9f670a228aeac80be391
SHA1 1c88aea6d3f680f636d6436d22c535e856e2fc07
SHA512 4b800a1da216ea08c3ba9ab9ff30e9df873e4090c507458afc72131861c9095ef5d9b89775d616334126d5efc4d0d2258210d2d75dc98a6957f573747c1a7839
SSDEEP 768:fWBi16WVK+mHIGcm+u/YKqNwxabfbzerSs:Q/WVKxJYTE5
TLSH
T1F3E20E84FB2E953FD41812BBDCA51B142F79B88558092F9B3A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\events\events
Size 1KB
SHA256 7b4c2b332b02a2908012d26b13bea53415f3c1c03bf36663a61fa2b4d6559962
MD5 481b0db14733184a7c74418eb9a0e3f9
SHA1 d4d2096e2e66f12129ea032c7633ea0987477937
SHA512 cbe8aeb71af85058fecc9cc62b57d69e595880f3e05a3ca165b222f19cf1fff41df564c3bfb734046a1ada1c686fda21e8f65efbcfa0e1f97ecf3677849a3e53
TLSH
T1ED21AC5C79B85D2E7CC7EAAC7544078E97A15E0B04871C438D02DF8DCD81AD932AD87D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\events\events
Size 3KB
SHA256 299e4d7ea1434328f00a91d913f4064adac2d41dac3452d3108a4db44cc2ccfd
MD5 402bff5d7fb5efd6a6557f882a2f15c0
SHA1 ec5cd3723b0e991eaf9e7d867b82563cccfde989
SHA512 4e9cbd148826894aa2ade0c34669b3f40ae7559414c56f7512ca8a14e2853b458ba8c662ce206d0660213e2e8f4b5cdf8fbacbb76a5971a0e564696da13884c9
TLSH
T19A711E1DA5A80C7E7DEBE7A8B405078E87995B0384871C838CDADE49CC86AD9325E46C
MD5 SHA1 SHA512 TLSH

Submit Download

3bbd2b37-63a0-4249-ae46-b092be544ec8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\pending_pings\3bbd2b37-63a0-4249-ae46-b092be544ec8
Size 2KB
SHA256 07c97fba1200d737afd58db23ec879bae7c3f004319156c6955b7554f834acdd
MD5 676dd5204743fea63caa1f4eabe10dfd
SHA1 0e3607be7a9074eb60d7e16d55142d02bff60d44
SHA512 782c70d14037e92315de1941514e5c268d10dd4775351ea93aba4d7909d9da7cce6a1304f35beafc388172325a1539a77541dd4b4264ba3dc94f85d0a3f728da
TLSH
T18641415C75F84D7B5D8BF15D8482338A57608E1344C218837E92DF0CCD96A9D63BA42B
MD5 SHA1 SHA512 TLSH

Submit Download

9e6b0109-01fb-4e70-8f63-3424c3dfa043

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\pending_pings\9e6b0109-01fb-4e70-8f63-3424c3dfa043
Size 235B
SHA256 9cb5d247f3e7084a83801736abd6de995c3e2cdb62823a0e6059e2e359666cb9
MD5 e7877cbd4f746f9e26ef85d6945bc99e
SHA1 c7117b497ef5a7ea4e18f6fbbbf69ba560316403
SHA512 1a75bd4e167d81d508708f71f5f0d97e313716fbc5c868321e10c4550dc0d7df32ab4dc6d8156aa84d9f963592a0a62bda4155032c0f905e176d6bdc888da569
TLSH
T122D097C024D8BB5D28240F0BB0A02AC6F08C4C3314A0A8188A560678DAF9AC88262956
MD5 SHA1 SHA512 TLSH

Submit Download

d67794b5-7a68-4cee-9d9a-6dfa42a65552

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\pending_pings\d67794b5-7a68-4cee-9d9a-6dfa42a65552
Size 883B
SHA256 a4c66e7ac6539f3ca6bb85a74b1919f17aab408b560a17d20ccb9e061a569445
MD5 926d735663a41ef1e1b8f04fc1237bd3
SHA1 ec023cbe6b19a14a90f98d4f35321a8272bf8313
SHA512 a67d5d17c4f524ec5124409f5dc56ff1f5901ab7900d3758f4510c799924fa03a8c86b636044aadcccb8381dfc08ab614f1b0f1c945747d2af32f875e6e04462
TLSH
T1FE11C490A66579B3DE2CD25B85D5771287A47123C0C5C4043DE58E084CBE91EA37A60B
MD5 SHA1 SHA512 TLSH

Submit Download

d7acb7d3-90d9-46a4-8805-d54d5a5484d0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\pending_pings\d7acb7d3-90d9-46a4-8805-d54d5a5484d0
Size 886B
SHA256 0343b1d9f67c1b797d0f0155914f965a0cdde831c9bb9ec1fc833126daddbfd9
MD5 da29b3404af1e5f066a3609784c215b0
SHA1 89b3792b3324f7557559a508a12ddf81996db519
SHA512 b96949fffeb4ee68bcef6e269e1fed22647bf8c62c007452d8ff44c1de00f52009146556a1bd6a8351ea8c24ba78cd03a5c0759f109c4492fa7b2d08246f560c
TLSH
T1E11100909660B9B29E2CD29B85D57B428BA4703380CA88087CD58F0C5CAE91EA37B207
MD5 SHA1 SHA512 TLSH

Submit Download

d85e68c4-c0f6-4a11-bd9c-ce54fbb80bea

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\pending_pings\d85e68c4-c0f6-4a11-bd9c-ce54fbb80bea
Size 16KB
SHA256 fff12631a1ace6dd398253c94a657b4fb7599233fd0672c6bda1233ef5d3a79e
MD5 c42e1091daedbf52972da5948af2f99c
SHA1 6548b09dc1022cd9dbde504c6adc0b4ee725e59e
SHA512 97cb80011e55d3ac9ad825be03bbab94249559d7ccd3288151cd12a7a2d6a575af3f8589e1024f59ccd4637e906a8947fa54bc09995f51cfe9c230de711e799f
SSDEEP 192:Ds8Wn39r24kktK67zxRiXgTkRTNPmcVfryCbUBSIe1dR5i753T70C8zlE+ci740i:DEnU4ZtK67lRiQoRTNPmwThUcIiwQvVw
TLSH
T1CF72C8565820557A8691E36994FCBFC3E6F628CF4C418FCE9BE4BE0829DF06D112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e61d8645-7245-4719-b56c-a8e7d7fb5ccb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\pending_pings\e61d8645-7245-4719-b56c-a8e7d7fb5ccb
Size 235B
SHA256 280a3dd9b98c40d812ce65bb09761c2e0361819b24b16a826075d4a141a1ccdf
MD5 ac62a160efcac29da6bacf168e059560
SHA1 65fa16d7572f25b59d312cc9ef44555e1a408e85
SHA512 8c13b2c80892d27d354f73b0afbf589f8a18f98b1d93013888fb273479c0316d939b28925faf1b6f3f5ea21d3cfc9d1854edf3f6915f5deb449827702694575d
TLSH
T12ED023C0188863BC0C240F37F0F028D670844C3320785820D99900788DFFFC81276917
MD5 SHA1 SHA512 TLSH

Submit Download

extension-preferences.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\extension-preferences.json
Size 942B
SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
MD5 20357ec0806e9826d6daf456b6b16bd8
SHA1 7d5d7a921213989294eb5cea2ee760e562ce5293
SHA512 2333fde606ee727a6b6d9812ed40e56e5d0dba4ec35abcc11b67f8ad61d1d3d4af5db699d29b3ed6b459b9e142badae69ffbebf18974b5a1c72e45ecc8cf93cf
TLSH
T17211F13A640B6EB01E8E5625FE384A92E791111B50B7F2E47E69934A13D3970C1ED39C
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\extensions.json
Size 14KB
SHA256 a2e21f6b1af114d61328e7decb2a1b15d63ce8587e88f19a3b4a1f892427f15e
MD5 eb42279ff4647b48313ed77da5cb2fc3
SHA1 4676e0f62974562ad107968f96a6998a66f12eb1
SHA512 45b21007b29d4f064adf99862235fb9c0eab1bf146de534ca9f565fbbe7a0cd8e60f0e37598f2463d71895f6fedaee8f09d293eb834498d66de9752f56f45877
SSDEEP 384:9kI4vyUmldv98dhWY94z+96oBL4HxL4PpL4HJL4HnL4HC:+I4qRf+Xp426u4J454B4r4i
TLSH
T13662432549049EB8294F578BAA367D01C37D573B70445C78F4DD8FC842FA5B902BB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\gmp-widevinecdm\4.10.3112.0\LICENSE
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\gmp-widevinecdm\4.10.3112.0\manifest.json
Size 1005B
SHA256 1cc15465230ffb75fd028ee3b2189c8774f56bc7dee8dd17b952e6ca92144004
MD5 58954048e70c81669675d4f87ab50af1
SHA1 8ab675ea31801bbb91c33fd381f4c202bfd7882e
SHA512 f9b8c236c9404936b93ba92550c21a0344b657c42cd98e091cda32e33fed860d59ac0cb97451ca61b2d8e6a943a983ded569b1d7ecd541e832e3ca87b39ecbd0
TLSH
T161115E00DD384DD326D4B6A21CC6580957661DAF5CC27E54379E161D4F1C8AB927376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\gmp-widevinecdm\4.10.3112.0\widevinecdm.dll
Size 21.9MB
SHA256 7b44e84403fbb3faee15ca2d56eb8432fdf4eb68812c4460abdd20972528e825
MD5 5614c2225ece73a37e47894ff3c19aa3
SHA1 df3aadd22db3b5841fe488c985365269709b4b27
SHA512 8b8e55347a7a496cfe52222670781654ada20accf21f3e2dd88847e0a7a00cb083609a5f3907bcc1f927c1227de20373a744028466663c5389ad286a46fc3286
SSDEEP 393216:SKuarWwW0LmrEr38dudevJCJU2kpq1gL2aVRHy:dWCmz0dwJIkpqCW
TLSH
T1CC37E14AE35350E9E81ECDF4826E9A62E4343C4E03319BEF17D47A355A727C42A39F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\gmp-widevinecdm\4.10.3112.0\widevinecdm.dll.sig
Size 1KB
SHA256 f9f160cb5ca37ef81a3aa80eeb7fef8b302e18c82d92c34f42503e0ab085ada5
MD5 a0dd5d559b24af4590e5cae3ac11a0fd
SHA1 04b83b414c36ab24fd27fe432a690de636bd2996
SHA512 2d69ea26916ed156f214c17d57c158cb680f1119849b8dd1f7315fd3fa6981c9d6ec2026b494d8e2e70e969205f063979287265a94e73704fe392884e8b4e4ac
TLSH
T1DE21E9DD697012242880793E5FEDF016FD3325C2AA3014FF456B65C2BCE376018C462E
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\prefs-1.js
Size 7KB
SHA256 29d3947f6c92899f09645e4a66ef1cf966114c999d9be8f80b61f517291c0dbd
MD5 a44478cf8a84c9254a048e154fe70319
SHA1 ce8d8ffa619b78d677bb8922ea5cc907f9f5158d
SHA512 114b18ad75caf7aed61afc381fde5ab6f694a81412322bc50be4d5d16929acbea990ca97d38c58cb166b1bcb168e3abbb51d87760c6d8cd4ec3623f32bd6d2a4
SSDEEP 96:xHeUTUDqGqTfX43NbzS8SSlXdv9j9fnNHG/C+DBw88u8L4cnEtjVGS:8eRTfX43BSSRG/C+DBw88G
TLSH
T123E11E7894088F7F74B677ACAC6888315AB2013B7BBF68C750B54489054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\prefs-1.js
Size 12KB
SHA256 64d8fff173ebbedc66d6f72da3f731a2d60f6a4d6c2d2cd0f06cfdfc98692c0d
MD5 9ab25758e015075d4d789a4c857e24dd
SHA1 0b9ead031276151ad936fd043c637fa85993de56
SHA512 8d45b789766ed4f98e4e22e137c9f2b3f54f14509673242f1e1278a72c768616ee2ea4b3fe83c10767ffbb9be801b2cb7946e908c89b298fd7d493e31e2e2966
SSDEEP 192:KLRTfF43BSSLLRT/C+Hrda/Bw88g19hcBnE:cqRT/C+HWwu2E
TLSH
T14142BB3CD1419B7F38B2327DAC294A6019611127BBBFBCD345F994D2044CF6842EAAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\prefs-1.js
Size 6KB
SHA256 083dd74bd20facc1b7d7d9ac57563e0bb6b570f841c21fc6f38357fc74497b58
MD5 b1317a345f422dcf655c8829c8ba1058
SHA1 a9f918b30b8e97d3dee378c55a4a8fad2a2bac2f
SHA512 db27005a1d809133d5c54aa8b381eb28201d000058ab66012042296742227c8385fe724da45bb3a91d80aa66a4929afb00149cc072bd771705d8c50aaf719c66
SSDEEP 96:xHeUTUDqGqTfX431zS8SSlXdv9j9fnNHG/C+DBw88u8L4cnEtjI:8eRTfX43VSSRG/C+DBw889
TLSH
T119E1FE7894088F7F74B677ACAC688C315AB2013B77BF68D650B55489054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\prefs.js
Size 6KB
SHA256 aae1e9d0c0743a009edc8ca62ef73497d179c08ccbf7f856ae783fa09fae0613
MD5 33d3b3d09b4c6a115a3aab46cd30bbce
SHA1 0e53b4fdc01d246cf309449d57a3e20dd6dea624
SHA512 57623356cf9e9b3f35f4f9857a14bb1a88ab033de417877a4f1043c0ec98ce50154f5b7ee9abc6f7826af35937b4e23d771fa577aeb85185b3ca7f1b257e56ce
SSDEEP 96:xHeUTUDqGqTfXc61zSkSSlXdv9j4nNHG/C+DBw88u8L4cnEtjI:8eRTfXc61SSsG/C+DBw889
TLSH
T11FE1207894488F7F74B6776CAC6888315AB2013B77BF68C750B95489054CF3882F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\prefs.js
Size 7KB
SHA256 5b8a193e26e95def8937b083290107653eab8603da4139822011e05a3b406281
MD5 29af72d1e558bf1c6d793f2ef242b441
SHA1 87d0a07a16e689597a4382ee008f513b20189b3a
SHA512 f6c45432499dfbbc9de169a65b4ac22768b9427d8ffb5671a5cc34971294162c8d5efe98c3e6148dc938c65646a09fa71035605b10a5e05a61c6ff2c732daf8e
SSDEEP 96:xHeZTUDqGqTfF43NbzS8SSlXdv9j9fnNHG/C+DBw88H8L4cnEtjVGS:8LRTfF43BSSRG/C+DBw88v
TLSH
T1F8F1FE7890088B7F78B677BCAC6849315972013B7BBF68D650B554C9054CF3842FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 68e2965da1de61102b86fc1087b2ebc3145c484e61489a02a8bf6d416401e3c3
MD5 5df0268f001cb3c1cfecf191e5524bd2
SHA1 f14db0322b0180a809c9187fbd12645ab15ec448
SHA512 343be55e01585f5d2cdbbd5c21f448135dc089fe64432566f248f53eb54570cc0d47408b2a9cc4295dedeaf16f78331994ee9446d50b8ff13f11de84b224df08
TLSH
T11F21EA4784792EF339F08175558D0FE5C64A342285F048F0C0E84D0236EA05D3787766
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\sessionstore-backups\recovery.jsonlz4
Size 5KB
SHA256 fb6cafd232253e04ae257a5d3b3b271b9dd42631db52043fb1bf9ccddf3ff598
MD5 4024d5ab7e77a30c821d3d2bdd3ac560
SHA1 52863c60afe183d2083e01d1950367beef522685
SHA512 b2d83a830a50ea48c13ff22503ac4db6754fb5ad8d42f25d7ea1d22215bf6a48c24c04a9c9ebecb252c1f78392a9cf5230ba3b4e3b4962649f2bda88b9dd92cf
SSDEEP 96:sN2rQfKs9U3J90+rnzjy93q9sSdwVsg27jMeLZgf8eLQc3goS26Qn:sN8M9o90Az+93q9s3+MeLZqpLeQn
TLSH
T1D1C17D87C50E7CC3C8E995BC08C68EE7EBBF800087F48CADD8345D3244D65882A84776
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 a7b04953af95307b53a733875de39281f40e996071774f2e92176a58aa47181a
MD5 4cedef09a23ace471040a53ee50f29b5
SHA1 8195bb4d93c43f59a2168a1d113fb2702f879bb3
SHA512 ccf74cec551499a15b7ea540279840c0caf447bbbfdcca83211ce5c11638e0896b86aba21e7f5b119d6602ee59354b3d12471900a3e4f7bb7ee585d5a1f9ec52
TLSH
T14921EA89DE1F2CF321C8C01800CA6FDCED965092837498F0D478664116C445D7B9D34A
MD5 SHA1 SHA512 TLSH

Submit Download