2874f03b4d1d487574ae8f04050109d806c869a8a0e81e2d582d8006afb79c35

Analysis

user interaction
yes
max time kernel
149s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/08/2026, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RoCookieNew.ps1
Size 2KB
Sample260803-2fgp4ayeng
SHA256 2874f03b4d1d487574ae8f04050109d806c869a8a0e81e2d582d8006afb79c35
MD5 ef34f1f674c2dae0ed216167c678017f
SHA1 7bad4393da235a3e7fd119e61941f985c8e4e2e9
SHA512 2ef74bd61d9d0e5b4c3e2dd779a6563e79cd78281f7b119ac5828be5c690e100224031a9181729ab4979695ab6d78e7525fbf276d089926c78be34b449a1983d
TLSH
T12E51E14055C3D72982F18766FA4821A9EF16405F0B451024B26D83859FF4BD787ED7CE
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2220	PowerShell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2220	PowerShell.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2220	PowerShell.exe
2220	PowerShell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2644	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2220	PowerShell.exe
Token: SeDebugPrivilege	5088	firefox.exe
Token: SeDebugPrivilege	5088	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
5088	firefox.exe
5088	firefox.exe
5088	firefox.exe
5088	firefox.exe
5088	firefox.exe
5088	firefox.exe
5088	firefox.exe

Suspicious use of SetWindowsHookEx 24 IoCs

pid	Process
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
5088	firefox.exe
5088	firefox.exe
5088	firefox.exe
5088	firefox.exe
5088	firefox.exe
5088	firefox.exe
5088	firefox.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 1380	2644	OpenWith.exe	86
PID 1380 wrote to memory of 5088	1380	firefox.exe	87
PID 1380 wrote to memory of 5088	1380	firefox.exe	87
PID 5088 wrote to memory of 1732	5088	firefox.exe	88
PID 5088 wrote to memory of 1732	5088	firefox.exe	88
PID 5088 wrote to memory of 1732	5088	firefox.exe	88
PID 5088 wrote to memory of 400	5088	firefox.exe	89
PID 5088 wrote to memory of 400	5088	firefox.exe	89
PID 5088 wrote to memory of 400	5088	firefox.exe	89
PID 5088 wrote to memory of 400	5088	firefox.exe	89
PID 5088 wrote to memory of 2884	5088	firefox.exe	90
PID 5088 wrote to memory of 2884	5088	firefox.exe	90
PID 5088 wrote to memory of 2884	5088	firefox.exe	90
PID 5088 wrote to memory of 2884	5088	firefox.exe	90
PID 5088 wrote to memory of 2668	5088	firefox.exe	91
PID 5088 wrote to memory of 2668	5088	firefox.exe	91
PID 5088 wrote to memory of 2668	5088	firefox.exe	91
PID 5088 wrote to memory of 3976	5088	firefox.exe	92
PID 5088 wrote to memory of 3976	5088	firefox.exe	92
PID 5088 wrote to memory of 3976	5088	firefox.exe	92
PID 5088 wrote to memory of 3976	5088	firefox.exe	92
PID 5088 wrote to memory of 868	5088	firefox.exe	93
PID 5088 wrote to memory of 868	5088	firefox.exe	93
PID 5088 wrote to memory of 868	5088	firefox.exe	93
PID 5088 wrote to memory of 868	5088	firefox.exe	93
PID 5088 wrote to memory of 5488	5088	firefox.exe	94
PID 5088 wrote to memory of 5488	5088	firefox.exe	94
PID 5088 wrote to memory of 5488	5088	firefox.exe	94
PID 5088 wrote to memory of 5488	5088	firefox.exe	94
PID 5088 wrote to memory of 5496	5088	firefox.exe	95
PID 5088 wrote to memory of 5496	5088	firefox.exe	95
PID 5088 wrote to memory of 5496	5088	firefox.exe	95
PID 5088 wrote to memory of 5496	5088	firefox.exe	95
PID 5088 wrote to memory of 5504	5088	firefox.exe	96
PID 5088 wrote to memory of 5504	5088	firefox.exe	96
PID 5088 wrote to memory of 5504	5088	firefox.exe	96
PID 5088 wrote to memory of 5504	5088	firefox.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\RoCookieNew.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2220

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3328

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\ProgramData\Install.log"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\ProgramData\Install.log
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5088
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1976 -prefsLen 27097 -prefMapHandle 1980 -prefMapSize 270279 -ipcHandle 1940 -initialChannelId {ef44dd22-fac9-4662-a68a-f95eeca78de6} -parentPid 5088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5088" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:1732
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27133 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {0c0e0a9f-2aeb-4d9a-9592-ad9def0601b4} -parentPid 5088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      Checks processor information in registry
      PID:400
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3560 -prefsLen 27323 -prefMapHandle 3564 -prefMapSize 270279 -jsInitHandle 3568 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3576 -initialChannelId {9e971416-8039-4b8b-976f-7a500f10e722} -parentPid 5088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:2884
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3732 -prefsLen 27323 -prefMapHandle 3736 -prefMapSize 270279 -ipcHandle 3804 -initialChannelId {90e6b860-d318-4449-a0fa-fcdc9db54d9c} -parentPid 5088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5088" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:2668
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4472 -prefsLen 34822 -prefMapHandle 4476 -prefMapSize 270279 -jsInitHandle 4480 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4488 -initialChannelId {5c13359a-0824-4c79-856e-596e3ba295d2} -parentPid 5088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:3976
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5036 -prefsLen 34903 -prefMapHandle 5040 -prefMapSize 270279 -ipcHandle 5048 -initialChannelId {5b97b003-a91a-4f9f-8704-e8f36cce52b5} -parentPid 5088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:868
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2768 -prefsLen 32952 -prefMapHandle 5368 -prefMapSize 270279 -jsInitHandle 5384 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5460 -initialChannelId {4f991281-f723-4fd2-bb20-1ecda6079536} -parentPid 5088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:5488
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5600 -prefsLen 32952 -prefMapHandle 5604 -prefMapSize 270279 -jsInitHandle 5608 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5612 -initialChannelId {aa883b40-cdcb-4eb7-852b-f6382dcbfa3c} -parentPid 5088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:5496
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5784 -prefsLen 32952 -prefMapHandle 5788 -prefMapSize 270279 -jsInitHandle 5792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5800 -initialChannelId {d211fae4-733e-49ea-81af-503f98aa3ac2} -parentPid 5088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:5504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Install.log

Path C:\ProgramData\Install.log
Size 307B
SHA256 d412cfb2a5db574741017b3740ffa35923d9b1e7a430db589e7b606f740b6ed0
MD5 6ced8b7ee6bdf1f65d3e5e51131ad09f
SHA1 e850908935e45f4f8c1351a3443eaad278d792c7
SHA512 d7d94973d8ad24ce5a2b502c42e065759679bd4e74fdae44ff397838f62d9c2e4302bb81c09f6d0525bc25f8d20c374caf05bf25817e257e15c546182beab50e
TLSH
T1D9E0CDC6A2BF53FA4FA21797928A345C07B475476347425CB3630523C0A451799F3FC2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ycmqmwix.5iw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ycmqmwix.5iw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 58bf70f103ede5c2c449b8fc38b2f17c20a989aeaf7f4991d47931543fb7c00c
MD5 5b13e97aa9ee655debdbc252d1d994d5
SHA1 ba49e45fc82bd4c6886f4dd3cec0959b42ef21d1
SHA512 e274713ff25fe07e334581d48e615d43edb7b38bfbb1e02a128a66fb282518747cac427ce2aaecd37a04c152fd2f8c4320c500463204b352774600a50ec066f1
SSDEEP 192:/I07IaOv5zboHBZhIKSyjoIAxQ1d66Joz0dzgCl6mc0dz:/zkbohZhVSyjoad66JozQzgC1jd
TLSH
T1D4D1EB68E62C863BC415023FDCA61B500F36389A989F6F19329C641D2D962DD7B8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 4e4100789454586aaaf050c25a55866ffd23006d9e80312eba92f1b783ccef65
MD5 6c8e040856c12802695379e4e353f97a
SHA1 0fdd87f208ea113da305ba34c47f5a89a054600d
SHA512 774e3c6aeda00a88dc3f2ae90dfc1b77d8a5cac1cb32229871c27db3e175f8d68b842f744fc5df51a7747d8b1c0fc059935dbf28d8bcd626fc1ba4b5443aecb7
SSDEEP 192:SI07IaOv5zboHlhIKSyjoI0BF1d66Joz0dzgCl6mc0dz:SzkboFhVSyjovd66JozQzgC1jd
TLSH
T12EE11CA4E62C863BC419027BDCA51B410F3A385A9C5F7F19319C601D2D9B2DD7B8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\events\events
Size 1KB
SHA256 ec49dfcf9808f59405e087eea25378e92e01440e2c2b92e85c9bf88f0d12513e
MD5 e1f2066320cb4916e31f8acdbe3f7e63
SHA1 3605e96ba001589a1499ce6bf477252f60dcac20
SHA512 7da1fa4bf3201be82dbd589caa8c8032ac92a64eaabe031595bd49074a1861ab977cf8778e8abe99cd9cd45b783c5beec728f3178113e93edb594420b7b935be
TLSH
T1F8216B5C39F84D2A99CBF7AC7540128E53914E0719CB1C534D12EF8DCED1AD932AA43D
MD5 SHA1 SHA512 TLSH

Submit Download

5a2db92c-c3c7-4eeb-b1e0-e4c03d16e626

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\pending_pings\5a2db92c-c3c7-4eeb-b1e0-e4c03d16e626
Size 883B
SHA256 3da6406e0317cc1e9a9c176abb4176198518857db06b18888e591ad751f2d397
MD5 3c458eccae2b24b6b317d5b842640e26
SHA1 eb45bac80f115c34739f4b28a4ba5c9291616ab8
SHA512 fa70ce6fb6a0cd346bfe72a166e4c95636de4ceb881d779cd8dff703f47000e4637269f8a458b64bd28e55fec53415677b934731ff35d2ce96c683462d02843c
TLSH
T1521116C19638B9B2DC38D24FCB953B124BE4753780C694287ED14E184DFD96EB3A620B
MD5 SHA1 SHA512 TLSH

Submit Download

7332ae40-e56e-4f68-bb83-1d31aa35724e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\pending_pings\7332ae40-e56e-4f68-bb83-1d31aa35724e
Size 235B
SHA256 640a7a22f78c091340cade6ffbdea584d60de6613ebcac8603b6900fc1468528
MD5 d2bd60c32285a0616896251f608a51d6
SHA1 3d04234873ec4a934214009223a2de70d9844a72
SHA512 98ad47d6a573b13784f93a796d85818defdb66046781b24ad19c1ae1316772359bbc890f4bcfb0ecb49021537f2d192a4864c27a83faf590617f0ecb7ec6f596
TLSH
T13CD023E014A8271D08101F03F0F56DC630988C3314B4A830E9701374AEFFDC801B2C27
MD5 SHA1 SHA512 TLSH

Submit Download

a6524b05-3f02-4e29-ad83-68a9078154db

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\pending_pings\a6524b05-3f02-4e29-ad83-68a9078154db
Size 2KB
SHA256 fa78629d9cab47d9c7a83c64746b75832ae362b399307fb2545c94595d3c20b7
MD5 f4e4b7b94fb38b1572e2c436de76a197
SHA1 ae697e15c2ac49e688cf3838891458bfc457f160
SHA512 4e853347ac5183e4042fc78ef36fa7bd284de5ac721571f88d20265baa22cf641d727a0b47c7721a5973a1fbb6339e4caf81555ef91a392281b8f836637b13e2
TLSH
T1BD51B6A65124D87EC83DA30ED92137828FF2180F408F184EAFE89F0B157FD5EA359605
MD5 SHA1 SHA512 TLSH

Submit Download

beddef3a-db09-4ffc-82a8-24804dd02eff

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\pending_pings\beddef3a-db09-4ffc-82a8-24804dd02eff
Size 235B
SHA256 18aeb4c617768838b2071b988b5b9c1681508b710b8986adb43e48ba4d41bc02
MD5 570ac0bad7c5b107e5165103bc62616d
SHA1 53cb982c6031ad4e09568f77d2f09ef06269d4f8
SHA512 5948ba4605cc9cb11a393f3e5afd103b8e4192a79686c06623d7b02fed10e3698688531d418628704a69affd46907b9e4f5827b37eea70dc51ff175b9d7586ff
TLSH
T174D097816888731D49041F07F0E128C230848C3360A4E810969045748AF9AC681B1807
MD5 SHA1 SHA512 TLSH

Submit Download

e472828c-339d-4104-8d42-5e5a049cfc6c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\pending_pings\e472828c-339d-4104-8d42-5e5a049cfc6c
Size 2KB
SHA256 63726fb814de3e8c24ab1b81ad5cf50f383fdae40bde73e3861b4bbf2b215504
MD5 b747e8eb36138561ffa7c6255e5ba869
SHA1 fa2c39b0cf0da270fa93f14405ae1b95a15f8f6d
SHA512 042404b637d010a61c9c7a13bda7218a178c57dd6cdb81296ef72b2156661b4dd16bc38bf05351d01c1015facb71a0ba6dee4532c2f4a72115c41349e10de725
TLSH
T17E41205C367CDCB69C9AE18DD5C2374E43608A1700C72C836E61DF0C8D8A6AE336A52B
MD5 SHA1 SHA512 TLSH

Submit Download

f2ba750f-31ec-4b8f-9c4a-431bb9be9cb1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\pending_pings\f2ba750f-31ec-4b8f-9c4a-431bb9be9cb1
Size 734B
SHA256 1cdc383c9ad6586066224e9ebed1492058ea2273256696327849c6f28e92a988
MD5 4bc256cbe58029cb56c41e9af2162765
SHA1 5a058959f61a174ed1ed8a40b3bf3fe25722db51
SHA512 1e7de6b59c1fae4c0e9d0d5498c51458165331eb25d0b74f922eddc4c2d3cdba3df2d75983594a1df4da5c8a5ec9562d8bebf242a41ffd4dff98737fe109ad2e
TLSH
T1BB01DCD14124B963EDB8E34ED95977058BA4B43280C79428AEF4CA080DFF02B92A5B0B
MD5 SHA1 SHA512 TLSH

Submit Download

ff5e6044-f083-4af6-878f-85480f34d8ab

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\pending_pings\ff5e6044-f083-4af6-878f-85480f34d8ab
Size 886B
SHA256 e13047dc3ce6c25b6d4f939812a3cbf12d0d10725621de727b120b588e0fdc4f
MD5 f2c44480c51c2dd494b50565d89b823d
SHA1 b96b10af7f5b3cb2e84e02f872930f6b7a8b27d2
SHA512 6e7d7274de6a53bfbabaca77131befdaebbc94c180091ed8d9dfc044e49c8029a2faa1c47a43c795d39ff57a7d159428f9b744a604e0d1c79762f967c4892668
TLSH
T14511238186BCB8B2DC38D25F55E1BB1287A4702380D659587E909F180DAE16EB76A60B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\prefs-1.js
Size 6KB
SHA256 f733d06d39c00aa14354baac853190b837faac4123e61e06b3bf6c32cd19dc00
MD5 b85496456f04cec254d3930215e2b8cc
SHA1 8c32fc492df6c8b60505fce2486398dd7d0b5a3d
SHA512 887f57916db9574643d91562268acbf00d023981939848484210698f18cdfed74149c7bafcda43e71f1c3aae351ebd8a6088258b3d7101a99e3d606ac709803b
SSDEEP 96:xH/UTULXqGqSfw5gObzSkSSl+dv9jonRERHPKLy4Bw88H8L4cnEQIym:hb6RSfw5gqSSS9PuBw88qI5
TLSH
T1B2E13F7894088F7F74B6766CAC6888316AB2013B76BF68D710B94485055CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\prefs.js
Size 6KB
SHA256 bc008453782090080b64ec164cba3840d87a3c3a244260626da871ca12eee68b
MD5 bb39781a2dbc27c969b29957429e62e7
SHA1 386a9d1244f7df9adb37dd255d22ea5bdac42957
SHA512 6a084446f0350a3bbc04ad01d1e83ed4f5d64cc6a9439bd87e5c9570a1ac31713b4dba7ea8508d90189df044f67f06a1aa2c70d457a4d0bc40f81d18aa988b65
SSDEEP 96:xH/UTULXqGqSfwpmk1zSOJSSl+dv9jCTnRERHPKLy4Bw88H8L4cnEiIym:hb6RSfwpmkXJSSL+9PuBw888I5
TLSH
T120E12F7894088F7F74B677ACAC6888316AB2413B77BF68C710B95485055CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\prefs.js
Size 6KB
SHA256 28cd3507f5364319a9bc82019a531389026c965344a1d530545a1d47bab0feff
MD5 fddee06c5326932c814f015be2f044ad
SHA1 2827198ed50b7f89226e34d9a84e80880fddf9d3
SHA512 bdbfa3d37a8648d9353d1253f1cfc8c858751b057bf920193cae2ae69da59b8f593ce4cabd0ea2176ba2c58e4d3df9b825b9a506a53b3d313e8ce2a6fc78f864
SSDEEP 96:xH/UTULXqGqSfw5g1zSkSSl+dv9jCTnRERHPKLy4Bw88H8L4cnEiIym:hb6RSfw5gZSSL+9PuBw888I5
TLSH
T1C4E13F789408CF7F74B6776CAC6888316AB2013B76BF68D710B94485055CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\sessionCheckpoints.json.tmp
Size 288B
SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
MD5 948a7403e323297c6bb8a5c791b42866
SHA1 88a555717e8a4a33eccfb7d47a2a4aa31038f9c0
SHA512 17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a
TLSH
T1A5D08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2220-1-0x000001CCB0430000-0x000001CCB0440000-memory.dmp

Download

memory/2220-9-0x000001CCB0430000-0x000001CCB0440000-memory.dmp

Download

memory/2220-7-0x000001CC96870000-0x000001CC96892000-memory.dmp

Download

memory/2220-0-0x000001CCB0430000-0x000001CCB0440000-memory.dmp

Download