d460c38f77672140608a4149b7ccf75436f25892da9bdfa93b280d1aa2f55697

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/08/2026, 15:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RoCookieNew2.ps1
Size 4KB
Sample260804-tal4matfmd
SHA256 d460c38f77672140608a4149b7ccf75436f25892da9bdfa93b280d1aa2f55697
MD5 e98afc061e150699a01b0d3db2c0a0f8
SHA1 d7af5af9f3ba6a1641438ef7d313371f355c2235
SHA512 6ebbd8a4de03539a23e655898384c0f5f2984d850c36328eb13e621cb5ce5623bac33bba9a69562b3be1246d1775fb5715b9b37eecfea1c312823058a6eebf1c
SSDEEP 96:M4vmPEGdjZt2vNthIyIrI0HSonWllP9EOH:v4EGR21rORWlllh
TLSH
T1E4915209598BC728C1F08726B889229EFF59045F06015515B6AD9181DFB0BDBC7FC7EA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1472	PowerShell.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1472	PowerShell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3120	chrome.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2444	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303322916497199"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1472	PowerShell.exe
1472	PowerShell.exe
1472	PowerShell.exe
1472	PowerShell.exe
1472	PowerShell.exe
1472	PowerShell.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1856	chrome.exe
1856	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
936	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1472	PowerShell.exe
Token: SeDebugPrivilege	2444	taskkill.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
5028	firefox.exe
5028	firefox.exe
5028	firefox.exe
5028	firefox.exe
5028	firefox.exe
5028	firefox.exe
5028	firefox.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe

Suspicious use of SetWindowsHookEx 24 IoCs

pid	Process
936	OpenWith.exe
936	OpenWith.exe
936	OpenWith.exe
936	OpenWith.exe
936	OpenWith.exe
936	OpenWith.exe
936	OpenWith.exe
936	OpenWith.exe
936	OpenWith.exe
936	OpenWith.exe
936	OpenWith.exe
936	OpenWith.exe
936	OpenWith.exe
936	OpenWith.exe
936	OpenWith.exe
936	OpenWith.exe
936	OpenWith.exe
5028	firefox.exe
5028	firefox.exe
5028	firefox.exe
5028	firefox.exe
5028	firefox.exe
5028	firefox.exe
5028	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1472 wrote to memory of 4580	1472	PowerShell.exe	82
PID 1472 wrote to memory of 1760	1472	PowerShell.exe	83
PID 1472 wrote to memory of 2444	1472	PowerShell.exe	84
PID 1472 wrote to memory of 1892	1472	PowerShell.exe	86
PID 1892 wrote to memory of 4608	1892	chrome.exe	87
PID 1892 wrote to memory of 3832	1892	chrome.exe	88
PID 1892 wrote to memory of 3120	1892	chrome.exe	89
PID 1892 wrote to memory of 3832	1892	chrome.exe	88
PID 1892 wrote to memory of 820	1892	chrome.exe	90
PID 1892 wrote to memory of 1580	1892	chrome.exe	91
PID 1892 wrote to memory of 1580	1892	chrome.exe	91
PID 1892 wrote to memory of 820	1892	chrome.exe	90
PID 1892 wrote to memory of 5028	1892	chrome.exe	92
PID 1892 wrote to memory of 5028	1892	chrome.exe	92
PID 1892 wrote to memory of 920	1892	chrome.exe	93
PID 1892 wrote to memory of 920	1892	chrome.exe	93
PID 1892 wrote to memory of 556	1892	chrome.exe	95
PID 1892 wrote to memory of 556	1892	chrome.exe	95
PID 1892 wrote to memory of 3184	1892	chrome.exe	96
PID 1892 wrote to memory of 3112	1892	chrome.exe	98
PID 1892 wrote to memory of 3112	1892	chrome.exe	98
PID 1892 wrote to memory of 2548	1892	chrome.exe	99
PID 1892 wrote to memory of 2548	1892	chrome.exe	99
PID 1892 wrote to memory of 444	1892	chrome.exe	101
PID 1892 wrote to memory of 2604	1892	chrome.exe	102
PID 1892 wrote to memory of 220	1892	chrome.exe	103
PID 936 wrote to memory of 1632	936	OpenWith.exe	107
PID 1632 wrote to memory of 5028	1632	firefox.exe	108
PID 1632 wrote to memory of 5028	1632	firefox.exe	108
PID 5028 wrote to memory of 1900	5028	firefox.exe	109
PID 5028 wrote to memory of 1900	5028	firefox.exe	109
PID 5028 wrote to memory of 1900	5028	firefox.exe	109
PID 5028 wrote to memory of 2444	5028	firefox.exe	110
PID 5028 wrote to memory of 2444	5028	firefox.exe	110
PID 5028 wrote to memory of 2444	5028	firefox.exe	110
PID 5028 wrote to memory of 2444	5028	firefox.exe	110
PID 5028 wrote to memory of 2604	5028	firefox.exe	111
PID 5028 wrote to memory of 2604	5028	firefox.exe	111
PID 5028 wrote to memory of 2604	5028	firefox.exe	111
PID 5028 wrote to memory of 2604	5028	firefox.exe	111
PID 5028 wrote to memory of 220	5028	firefox.exe	112
PID 5028 wrote to memory of 220	5028	firefox.exe	112
PID 5028 wrote to memory of 220	5028	firefox.exe	112
PID 5028 wrote to memory of 3888	5028	firefox.exe	113
PID 5028 wrote to memory of 3888	5028	firefox.exe	113
PID 5028 wrote to memory of 3888	5028	firefox.exe	113
PID 5028 wrote to memory of 3888	5028	firefox.exe	113
PID 5028 wrote to memory of 6044	5028	firefox.exe	114
PID 5028 wrote to memory of 6044	5028	firefox.exe	114
PID 5028 wrote to memory of 6044	5028	firefox.exe	114
PID 5028 wrote to memory of 6044	5028	firefox.exe	114
PID 5028 wrote to memory of 5080	5028	firefox.exe	115
PID 5028 wrote to memory of 5080	5028	firefox.exe	115
PID 5028 wrote to memory of 5080	5028	firefox.exe	115
PID 5028 wrote to memory of 5080	5028	firefox.exe	115
PID 5028 wrote to memory of 588	5028	firefox.exe	116
PID 5028 wrote to memory of 588	5028	firefox.exe	116
PID 5028 wrote to memory of 588	5028	firefox.exe	116
PID 5028 wrote to memory of 588	5028	firefox.exe	116
PID 5028 wrote to memory of 3012	5028	firefox.exe	117
PID 5028 wrote to memory of 3012	5028	firefox.exe	117
PID 5028 wrote to memory of 3012	5028	firefox.exe	117
PID 5028 wrote to memory of 3012	5028	firefox.exe	117
PID 1892 wrote to memory of 1856	1892	chrome.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\RoCookieNew2.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Google\Chrome\Extensions\dimjkjabclbilgifejdicfmccaipfplj" /f
  2⤵
  PID:4580
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Google\Chrome\Extensions\dimjkjabclbilgifejdicfmccaipfplj" /v path /t REG_SZ /d "C:\ProgramData\Microsoft\Windows\RoCookie\RoCookie" /f
  2⤵
  PID:1760
- C:\Windows\system32\taskkill.exe
  "C:\Windows\system32\taskkill.exe" /f /im chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffacd97c728,0x7ffacd97c734,0x7ffacd97c740
    3⤵
    PID:4608
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1604,i,13357260503121613299,12161285373316922494,262144 --field-trial-handle=1840,i,2043329032795664500,5089061276554111190,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1832 /prefetch:2
    3⤵
    PID:3832
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2124,i,16889519073636213460,15531522238384020824,524288 --field-trial-handle=1840,i,2043329032795664500,5089061276554111190,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2140 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3120
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2284,i,6287502150132295653,13733359294681055894,524288 --field-trial-handle=1840,i,2043329032795664500,5089061276554111190,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2408 /prefetch:13
    3⤵
    PID:820
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3060,i,4750930496141098681,17816234049912806110,2097152 --field-trial-handle=1840,i,2043329032795664500,5089061276554111190,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3100 /prefetch:1
    3⤵
    PID:1580
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3056,i,9211133859273838860,7800035092442670251,2097152 --field-trial-handle=1840,i,2043329032795664500,5089061276554111190,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3088 /prefetch:1
    3⤵
    PID:5028
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4292,i,17173493236770456947,9446575901676742387,2097152 --field-trial-handle=1840,i,2043329032795664500,5089061276554111190,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4308 /prefetch:9
    3⤵
    PID:920
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4580,i,11822392632085129843,6063597408855721404,2097152 --field-trial-handle=1840,i,2043329032795664500,5089061276554111190,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4752 /prefetch:1
    3⤵
    PID:556
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,7180050195773135371,6856483475792513152,524288 --field-trial-handle=1840,i,2043329032795664500,5089061276554111190,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5512 /prefetch:14
    3⤵
    PID:3184
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5532,i,523214217797148123,15100889662884813356,2097152 --field-trial-handle=1840,i,2043329032795664500,5089061276554111190,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5748 /prefetch:1
    3⤵
    PID:3112
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=6080,i,130418111407813887,978503034600236376,2097152 --field-trial-handle=1840,i,2043329032795664500,5089061276554111190,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6020 /prefetch:1
    3⤵
    PID:2548
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5596,i,9842644553393177610,12180976983726542051,524288 --field-trial-handle=1840,i,2043329032795664500,5089061276554111190,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4796 /prefetch:14
    3⤵
    PID:444
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4832,i,6445056765857776027,6164315310291270809,524288 --field-trial-handle=1840,i,2043329032795664500,5089061276554111190,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4828 /prefetch:14
    3⤵
    PID:2604
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3736,i,5542792424855203465,12428641140880924717,524288 --field-trial-handle=1840,i,2043329032795664500,5089061276554111190,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4864 /prefetch:14
    3⤵
    PID:220
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1128,i,6982193647517217087,17441703676910126323,262144 --field-trial-handle=1840,i,2043329032795664500,5089061276554111190,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4864 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1856

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1608

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1224

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:936
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\ProgramData\Microsoft\Windows\RoCookie_install.log"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\ProgramData\Microsoft\Windows\RoCookie_install.log
    3⤵
    - Drops desktop.ini file(s)
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5028
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1984 -prefsLen 27097 -prefMapHandle 1988 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {6be283e1-a139-42f5-8f19-f03265cc8a34} -parentPid 5028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5028" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:1900
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2448 -prefsLen 27133 -prefMapHandle 2452 -prefMapSize 270279 -ipcHandle 2460 -initialChannelId {38ef38d7-df81-48cd-9f2e-5232ad702698} -parentPid 5028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5028" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:2444
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3904 -prefsLen 27274 -prefMapHandle 3908 -prefMapSize 270279 -jsInitHandle 3912 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3920 -initialChannelId {fd90d337-48bb-4f2b-8396-aaf7562923b7} -parentPid 5028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5028" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:2604
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4072 -prefsLen 27274 -prefMapHandle 4076 -prefMapSize 270279 -ipcHandle 4100 -initialChannelId {84b6483b-c6f3-4db6-9b41-34ed7681debc} -parentPid 5028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5028" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:220
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2892 -prefsLen 34773 -prefMapHandle 2988 -prefMapSize 270279 -jsInitHandle 2588 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2640 -initialChannelId {fd92d73b-d4d8-42b5-998d-dfe70245e784} -parentPid 5028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5028" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:3888
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2892 -prefsLen 34929 -prefMapHandle 4712 -prefMapSize 270279 -ipcHandle 1696 -initialChannelId {e88718f5-d2fe-492b-8fa7-36ac902e3b6d} -parentPid 5028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5028" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:6044
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1668 -prefsLen 32952 -prefMapHandle 2780 -prefMapSize 270279 -jsInitHandle 2776 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3040 -initialChannelId {4e9a606a-b8e3-4ce8-9494-9ed33a84f329} -parentPid 5028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5028" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:5080
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5240 -prefsLen 32952 -prefMapHandle 5244 -prefMapSize 270279 -jsInitHandle 5248 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5264 -initialChannelId {95c69350-bf44-47b2-b969-f1f4e4361633} -parentPid 5028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5028" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:588
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5424 -prefsLen 32952 -prefMapHandle 5428 -prefMapSize 270279 -jsInitHandle 5432 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5440 -initialChannelId {2bda1d24-750b-45ea-89c7-5c3f6b0e2ff9} -parentPid 5028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5028" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:3012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RoCookie_install.log

Path C:\ProgramData\Microsoft\Windows\RoCookie_install.log
Size 1KB
SHA256 180b3143fc57acd046359b3cbc2fb06034701f0a660e31e611d355072d76d1bb
MD5 05d5e526507178a6094ba6b061376892
SHA1 6a0f0b2ccdea32af41e154fe14559ad69b269713
SHA512 14bb58a74fa9b05d1420866f3fe862218e7e6e11705125481853d40595d53ebfd9a70eb675b4c0aa2b347f4cfb65747ccf3314409b6463a066d5f51ffa328bdd
TLSH
T1D521C05155BFC1DA6B731189DF104F0C2A97F58FAB88304EF3B7915068C5B118EE288A
MD5 SHA1 SHA512 TLSH

Submit Download

01ce2733-fe36-4e66-86b2-24f969de6409.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\01ce2733-fe36-4e66-86b2-24f969de6409.tmp
Size 13KB
SHA256 57830a1300f1eca36efba1d9cd64eeadbf49f2ff12e63cdac60b4b0e0029bdb8
MD5 1ef4bcc4ebf06a14141d62ce17304a76
SHA1 92251f66e6730dcf327186fb7b87f12b045749f2
SHA512 0f621f1f9bba4acc5c4b0958201e4905d67f7c0225fa655073a95248fe74ae4707d3a79994c05625f94117680758b386fcdb634f1d8441a1cf9591592a54c267
SSDEEP 192:RRP3vYXyVKv7H+pAPRp2X9WHsb+WNNonc1Na0VNMTcqAckw1IXQqacktVyIsnAU/:RRPfTGiUXQUwN7O0VyTDVCe8
TLSH
T18052C63DBD14753B9CDAC32AFE517AA3D3F6212561941E84E6FC892C14D7ACC222B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ced9d72d6213b358ce7524c2b1623aec7a5c25b5e65396f99aa1a1701611d3f9
MD5 4353b3714c5683aa7b6c017747ba8501
SHA1 cc032e1af36019dec7c5a1593b7678f9e8cb649b
SHA512 d3999b921c007e0c9dde69fce373dc83e562d4343b7887481c2c62fa7c4d4f924250843d488a29f1e5c9043542f2328042a99851fbf99eb8b925b9c3e564f287
TLSH
T183E02BE9D831EC370CFD071964544789E711139F26908A8F363D55088FB073A5595D5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 8cc8ef5dbc13c76cc764e2c0f60a7e607e00a39eeed38127317a2da3f2ecb856
MD5 8b7eb4756cbee250c7fa8f20fb997406
SHA1 be3243e55d1ba8f01a86c3c98f8eba8b9540229f
SHA512 cff4a121f66dc2879dc86e3ee6f070430a0f2a180401db28a718db7a9e34b80a886a4fdeee7b53162a81fabe6dffdb5848f6e31e81c1a9d67fd4fcb5a79ad09b
TLSH
T143D0121463570009D7451EF3F45904F301E5491C064C08D343C3979CD8266969C2D0B3
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 746a481e79a4d28c92dabaad0077881d7d8e118b2ce537d64011ab176bc3b664
MD5 a2d77b7ef14fd2f854765c47c12076ab
SHA1 c4b729a7e0832e5e2a3b4878790d4486158363cf
SHA512 d23af584846080316b2d3a3fd73c4ccffbd2ab879a35b6016b1cd916702c76608abffd0240ae422c517c27fcaab9e68dc48ba6f93719dd3a4f2003561c698cd6
TLSH
T1DF6199B3D3E4CA7D891156E4DA216E2FDD6D0A25122C3C62C9D4AE5B43F28B2D20078F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 0f5f89fb590b50dd65ad15861ec4eb2f02c2f497d615a676aed6e0effae1b3f0
MD5 d19ad4b2c41e90e3f1913c091206bd94
SHA1 f74cab62e18c08c9b5720e234da3a9b8a01f6863
SHA512 58736e49c10af8977174d64e0db98145d2fe0462f8b14b3510e097036bf10da2053469b5c7f9a0fa239eec841203b32c55cee07f3db15dd3a2b7d2462f838628
TLSH
T125719AB3D3E4CA7D891156E5DA216E2FDD690A25122C3C62C9D4AE4B43F28B2D20078F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 a487a90aa586ffb722bc45a76d1e954f5a6f5ff4286551d2445a524e0f1cc25d
MD5 a6b03dd39d632b77a2b691136935ce1e
SHA1 660afa8fb43d4f28bf93dfee7ad6659850a1dd80
SHA512 fd42fd771a90c2ac5460f1c04885199c7f6c1ae3796cb236a749714522d06dac63689becd9a9f638977639774ddf2dbbc07689355940492b636644edffad801d
SSDEEP 384:6kj+F7KxkXqKf/pUZNCgVLH2HfgslzO7pLuLcSjsNXOD+F+ErU3JbHGvYKD0S:6o+F7KxkXqKf/pUZNCgVLH2HfgsJO7pT
TLSH
T15F72F867684C9E370FD4CACCED167A4FADB5024B65E9886443FA582503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 21215c84e524e8981a1c65e0a857d93aae08d4a3b603e2ad0899b446a63dd120
MD5 213b4679083cf1818003c0800de5fd0a
SHA1 fd83fb399540bc063c93e9c1e2f45eba96d782f4
SHA512 2fdbf20c6428aa9e50ae5d2c19efd5c43b029848602371ab503c54f42803c83f6f107e674344ce8aa463e8192146da54f3bef750a62687f98ab44a2b4415659f
TLSH
T1F4B01254C4415511D05202B11146248871555F20E70B1B0143F46A32C82D1618428051
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58abfa.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58abfa.TMP
Size 96B
SHA256 d9ec1a6a00066b3198dcd498bc1b020b7b9c7e5e57058a14df69f6167fb7c9d8
MD5 d6da03ffa97c608fb45a6f71f2bc143c
SHA1 8cdd173f9a36fd573637a411df9f9958228cbaf2
SHA512 41ca8cc5cf62e22031480fd1fdd5f74e902e70ea672cfba311ad6e268dc90c8a9cf9f533a28f95d6e6e21ab10c1e8da99503ac5b7ba2619653d9110366b0eb96
TLSH
T1D8B02202C002E232C00203B230A283CE32A0CF20CA03328282E00E33CC28238022C220
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 5f4fbcfb2069a1589c1f6b9fc2cace780c6fc63b413ab7bb0b5ced768047d34b
MD5 04544293aedeaab9170b393c47e79015
SHA1 4f1a1fa4b1cd517acef05fb96ec0a156b6f44f74
SHA512 cb21d3067bd0b7a2ed05e6dad399ecdf8319f3bbd1e9a3131540a45723969ef3437fc0e4fa59f1bf32cf5bdfef0bdc8b1f0ba44b1c2ecdf06e3bfbb57708c2c1
SSDEEP 3072:azWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:QWDfxA3OnjrYQ9EU0/hEV
TLSH
T15EC302A11C3ABD660DF8EE98B44D3A60BFF4AC9A91835DC361ED2F4C14FA5C81139930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 4fcc54a85180d05b02c8016d095f59b18146a4f3a10c4fc2765fa0b968764228
MD5 1533909ed8e7a92dc66670a132e245b6
SHA1 9e641787fa6ab0f646542069939bb52a45cd7c9a
SHA512 06462a900ed07149dd2aabc3bbb692c10e369029d927b4e0ae38151a26f0faf1422c3c2c66a3a2bab05e1a5dfa4ce618ec67facb16cf0cd0dab477ff27d4b677
SSDEEP 6144:kOlsPQCfjiXVzoJHg6JOMxheoPPWDfxA3OnjrYQ9EU0/hEU:kOlsIejilEJAkbz2Dfxjjs+C/
TLSH
T16D3412A14C357D7B0CB8EE19740D5E51FFC48C9DA38B5DD283C92B8D22AF0C46A27A25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 711b0bc77bfdfed6c40f6119e5cc9d54d27d5b9d4f3244115d3e2eafb0e104b5
MD5 a316378d5b4f4e2d397f15e3e62a107c
SHA1 285ba5992b4a90252f513d7747cb6e206be7f4d7
SHA512 fe6ca0b2c1c01b887843fe2711acbcb7cfb5840d46efa2133b5ed68b0dd733e6d3157e8d1895f5f8ae9bf39893d0d96e96b7000a6a1d4bec05c4871370dae0b5
SSDEEP 6144:qOlsPQCfjiXVzoJHg6JOMxheoPPWDfxA3OnjrYQ9EU0/hEU:qOlsIejilEJAkbz2Dfxjjs+C/
TLSH
T17E3412B15C357D7B0CB4EE09740D1E51FFD48C9BA38B6DD293C92B8D22AE0C45A27625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 7073fb855e376719099d1522680e35cced0ef227ba6a224a6486e9dce57dbff4
MD5 67f5978d9b8b78073e77c0096c880df1
SHA1 616f6ae174c7a8cefd7714cd037d7a457c68652e
SHA512 f6931bdce92eedb560e215845641a75e8c5e8b35d8d21e08c7d5839df2dcab54460cf42ffc2d8e18710c32d46b0949fc97033bb11efcedad58880e959bf8ea78
SSDEEP 6144:dOlsPQCfjiXVzoJHg6JOMxheoPPWDfxA3OnjrYQ9EU0/hEU:dOlsIejilEJAkbz2Dfxjjs+C/
TLSH
T17A3412A14C357D7B0CB8EE19740D5E55FFC48C9DA38B5DD283C92B8D22AF0C46A27A25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e4veoxpw.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 d3da0305f462dc5920fa3463906d0417fa1ea38a2a218cb8582768f9e6225d54
MD5 880e7093211976053b139a84e4953ff7
SHA1 122b1f327f485ecbd5d150a4fc28c187c09438fe
SHA512 110f74e32a45bf072a515eaaaf1a5adde4a536413854943d79add0d3ecdabb7e83da10f0b993ddd2abb94489fac934243401ffea132182b9c799d94eb066a735
SSDEEP 384:HwCe7iO024YqDL84KKDL849B7SOEAd9KVRaAcP+AWRMAQ0q:QqZYqDL8lKDL8CB7S/AmVAf+hRMD0q
TLSH
T1AA728D3E9F413CAC1997D0E8C5B992D94C19B7A3CFE6806D21683D0DCB98969B0F544F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

16c1a280-e7dc-4b82-b80b-eb8be14f185f.zip

Path C:\Users\Admin\AppData\Local\Temp\16c1a280-e7dc-4b82-b80b-eb8be14f185f.zip
Size 3.7MB
SHA256 af9706aaf2d0e4ca1f1e61133a874b82399bc07a3ca5c0989b282fc708550f22
MD5 6b3eed16a0429bc80002520153b11312
SHA1 2dfd5fbda201131485a8058fb554a0dca2ac7b0d
SHA512 959d6c1ef639c8bafc4be37090c3b5aabd016211a517e95f1f4be5ce05c8fc2ae66313f0902e40f0ceecc7556ac60d054d07c020550aa066d943049cfdf2af92
SSDEEP 49152:ykscKtlbXGjjTWP9eEsGYXvViBp5eKtPKulVAyXaAlWIiFFvMuGLuyJS+q16Twms:xscEPbKNiBfNQyXagWIYM094Twmjo
TLSH
T18306E0F5D65C1609C9FF83BA850C2FC2C8FC4B6E8054A55BEAEA95715CA31B21B448FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_syr2fg5w.sud.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_syr2fg5w.sud.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\db\data.safe.tmp
Size 46KB
SHA256 18ff153b012812663e72b832a10d4376392775cab6b3fbb8ab0c679eb9ae2f99
MD5 7b390fae42ebb9f46dbdbd8a4c64b4a8
SHA1 5cfb53f39e34ec1b878bfa38323db4231c39924a
SHA512 8df67e638a12aa287513a0a1e2e97be8951e4446546bbd31f70fcaf1c58c4246b1356b6af4664ffef394f82de21c34a189522f74286225bf171c16ba7f9b88e9
SSDEEP 768:gmn5G5khgQ9xka6Gcmhur0ZJxCKlptS3sr531ZGblbXbDbObFbHbEbAbwN8XmFJk:v5G5khgQ9xDZJY5N8XmFJF42BYVflXp
TLSH
T1FE23EE44EB5E963FD82812BADCA607003F38F889595A2F57365C64782C872DC3D9E07E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\db\data.safe.tmp
Size 46KB
SHA256 9f53d32cc649e5c8ea7a39087ccfd70aa80fa77d52794e66c53cd0e50d2d0e80
MD5 d08a717bff35773d083e24e8d71567df
SHA1 28cc98946a77d378ca7797f1bb47b0d544d7fcd7
SHA512 0ee6b8dfa3dc1e14cf9c198f9249c459dbbfbcf501c9cbaf2efb95a747fab4036d5354391654346611c61d8342cdd5cf2be2f82074220ab867b96faddef0ca69
SSDEEP 768:w5G5khgQ9xka6Gcmhur0ZJxCKlptS3sr531ZGblbXbDbObFbHbEbAbwN8XmFJF4w:w5G5khgQ9xDZJY5N8XmFJF42BYVflX+
TLSH
T1D723EE44EB5E963FD82812BADCA607003F38F889595A2F57365C64786C872DC3D9E07E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 901676b3c7962e46e92625ed7a2ddecfb8559ffa5dbd1475f9d2a16977d658a4
MD5 26ac31e713b42ff0d6185b52c0cfa33a
SHA1 f53308fd9d55ea55fcc0a8b41707598f48c1974f
SHA512 d5e2581eac61ecf104ff527e21219b366d0768b8cadd3473c02ecb7c7be7bbbbd22b76d1e476a93cf1fef9863c25ba86b30593763e27dab98e18e808df1d7757
SSDEEP 192:g1d66Joz0dzgCl6mc0dbOv5zboQZLayjO6mC:ad66JozQzgC1juboQZLayjHJ
TLSH
T162E1FD68E629863FC408527BCDA61B400F39789A984E3F19719C741D2C5B2DD7A8D1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\events\events
Size 1KB
SHA256 77ff0b068cc9ea9721e46dbd04a456a89d2342c8a5599aedd187f1404f7654da
MD5 174a9cd8e90ca07485db9da28fe48bc2
SHA1 37cc67349ca930beb043a7b717ed1b4bb3611cbe
SHA512 e91ba440d2de98e65d148dad82436b206097350a8f196783c4905cf6cd6348d6fcd852477274682530a22cc74e1244b86204f1f38facc554b1395ca33aebbfa9
TLSH
T170216A5C3EB84D2AACC7F3AC7480128E93554A0705971D472D53EF8DCED5AD9326A83A
MD5 SHA1 SHA512 TLSH

Submit Download

186e0af0-af7a-47ab-9011-dfbae1aebb90

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\186e0af0-af7a-47ab-9011-dfbae1aebb90
Size 2KB
SHA256 01244211be89f888febcc2b4e170f213cdff157a19b4ff785e7c52c8a364c61b
MD5 e4b5c18ac8601fcf7658b2895a837a07
SHA1 be2803156552de5fde178785db95c032aab2fdc6
SHA512 8c319cde0af167e852745fe078fb9cda60db5920c7f4c77cbf75513f1ca989066a454a8fd767a273820c513d0fe3bcbbdcfea07716b11d0cdec9e8e95ffaa14d
TLSH
T15841739C74789CB78C9AF18DD5D2278E67648A1310C22C832E56EE0C8C9669D737E53F
MD5 SHA1 SHA512 TLSH

Submit Download

1da67534-3bd3-4748-b365-2c83ee853eca

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\1da67534-3bd3-4748-b365-2c83ee853eca
Size 886B
SHA256 d62663817161f510bb9c2674c3ec3ecf92faeb09daf79c2b23c4036f400d9cad
MD5 5175a2eaeab215c48448aa4772321525
SHA1 0c60edb515a4a0091853c665eec0cf0776c54695
SHA512 78f179b5fc1e9e0bb0411d20c9d53f8d13d7b171a0659bc7727dcf5eeed6fabae8c63c43d6ba4d23dee0be85e66a7dfa992719cc70664a02d481b61a8b08703e
TLSH
T17A11C080C57179B3CD28E19FDAE5B74246E4B42390CB19087DA96F090CBA51EA76A70F
MD5 SHA1 SHA512 TLSH

Submit Download

392815e2-4bc3-4ff6-88ca-7ca19b6e16a2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\392815e2-4bc3-4ff6-88ca-7ca19b6e16a2
Size 235B
SHA256 56ae888fde0edbe7270afe6d73596f44fd355684f3e6ac0472551b534894e404
MD5 1eaf1c0b3ccec188dff4b68a83d88b23
SHA1 c286336964e378b055714f3571559ad588fb652f
SHA512 c129755a08bab381690c14fe069fc659a69617abac57cbf59f2012977f007de142acd3729a64419df5908acd704a9bf94364ab41468692d1fceebb06b80d575c
TLSH
T17BD0978014D8331D88100F0EF8E0BAC274944C3320B0A820EAA048B4EAF89C441A1817
MD5 SHA1 SHA512 TLSH

Submit Download

3cf13e22-9986-4738-b658-7abaea943e22

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\3cf13e22-9986-4738-b658-7abaea943e22
Size 2KB
SHA256 1ca6a3c6eca97a1ba5761347e357018eaae3e452f2c9b5c7bdc03c8dc0d44c80
MD5 3ce680e399742015cec1d6182d90a41a
SHA1 84a3c0437c2f8a9e37345515d181d724a18292d7
SHA512 12387f945a859c00d16049ba49459bfe1d2f985686c3697f4d6abdfe974ef5cb24ff026c274623e4786f0d6dc36326b25ae89fa63b24b82250f56c2f1ef2b07a
TLSH
T1FE51A7658060D8BEC87DA31ADD2537828FF2541B408F284EAEECAE0B143FD5E9358605
MD5 SHA1 SHA512 TLSH

Submit Download

4a3d997a-4587-40a4-8048-cf196e63a518

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\4a3d997a-4587-40a4-8048-cf196e63a518
Size 883B
SHA256 82507c0a9e0b004c1dcbf907ce5454199de65503567a1fb979e0cd7ac7193f84
MD5 ddd8e96aab3952c9c460566991af280f
SHA1 256f39a2870dbad3602dd53fddb0cac5c0b6ddf2
SHA512 ae1400fdf75e0b164d841bfe1379742d96b0a2ef988e2254c52d90e03dd8767262842a5af126a01429ebcbb161d5cd91f24bcaa8b29e61c563634418fc7da73d
TLSH
T1CF119C819531B9B3CC7C914F8AA677428AE4B52380C619147DA659050D7AA1DA36A70B
MD5 SHA1 SHA512 TLSH

Submit Download

be8626e8-4bbf-4a35-ba32-8bb94e443723

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\be8626e8-4bbf-4a35-ba32-8bb94e443723
Size 235B
SHA256 eb1e6d61bb8cd983675741c884abfbd612b37207ce3da1d500ca1fdbf25c68e9
MD5 7d539df74ae7ee4605d06fc6c34755db
SHA1 271f2066124def5573778f6d7174030d18f5629d
SHA512 e4c2014384f7e8ea6062bbcf196823f252191f0bb81dabad9b7705774c02b45551475b0fee4918517c52fe59e326b691e25e877b329d4a4b42b293ccbaf80c69
TLSH
T15FD097901488676C08141F27B0E0BAC6304A8C3390B09810A9500674AAB8EC88125917
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\extensions.json
Size 16KB
SHA256 a7ef7b565ae86272185960b8b9693626becb4731f5f26528d12108eebcd77584
MD5 df54f80e5911efab36f19a3a0f38d289
SHA1 d76796fe48daf4be5679b05c1f9fdd3075f79801
SHA512 260c1cc5b3b02d4aab63ad8bac06f4b0ad024f576ff00f40378d8acd5b23f06271f1759653c03d3f101fab71a63020707574ce0448e796cc5f116c2c908dc59c
SSDEEP 384:0DkI4v0Umldvg8dhWSD94zY96owqL4HgL4PuL4H5L4HNL4HhI4hj:0AI4cRfJXHp446Q4i484R4t4m4Z
TLSH
T1E272411545049EB8298EA79AEA367E01C37D473B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\prefs-1.js
Size 12KB
SHA256 3f4c1fafbc0ecd73d8b7e4ea7f6f32702f0123d7e0f2daf199d9d4227a9a4706
MD5 c426fb3f5f73a85dd4ea6b9986d3b5a7
SHA1 36050a8c261d38d7c7268d0d9b90cf60ce7ef701
SHA512 0091c87e2e3069e2ff4f2f4fa8ed1254fce9828c6d6e724fc18bd6f93601bd6a889a8da0ba70c3ca39d54052fd3aa14806ec9be93c4a3bc4556e0bca24f8928a
SSDEEP 96:xHzpTU1qGqQf5a+ObzS7nSSlZdv9j5KnJpwoDR7ZztEJ5OBw88DjAQWZYJ2w8L4F:tVRQf5a+xnSS6LRlztuOBw88DXWZYJv
TLSH
T10942EF385900CB3F24F7327DAC654AB119650227B6BFBCE325F99892045CF6441E6EEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\prefs-1.js
Size 8KB
SHA256 3a58f04d355c6645c59bfa29a84214c93fb9ec06438f5aef6eab441b4a7610a6
MD5 d72882da59d0ba8dbd4abc072501649e
SHA1 0d2b6ee5da4b9ebbc77405f74c082319434b660b
SHA512 f48e9dab0ae6e116216319e4e62179d34be22a5687f87671427af60f50351b8c7087b5dc502af0b9bc30e313f9b65bf6c9397b28e30ddaf79eacc5a8bfbd168f
SSDEEP 96:xHcpTU1qGqQf5a+ObzS7nSSlZdv9j5KnJWR7ZztQBw88xRd8L4cnc1qvq:CVRQf5a+xnSSLRlztQBw88z
TLSH
T1E5021E789504CB7F74B2377CAC6449715AB2023BB6BF68D720BA5885054CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\prefs-1.js
Size 6KB
SHA256 d3d890e93c15776a3ef0b1b8fedfefe6671a961fd3fcd0a7efb00fd5a8a51368
MD5 40c45ac7b81f80cfbcbb828bf0693e58
SHA1 5d1a66ef7624f642561866cb1ec7717f0f215f3a
SHA512 eaec899801c95204e895d7c190bb03facd97c17fcfec5fc32a0b5f88861699a966baefff54f4183125e095350d9675826551d7496f20d6d85ba378855d98d77a
SSDEEP 96:xHcUTU1qGqQfAa+1zS7nSSlZdv9jQnJH9zzBw88H8L4cnc1qGq:C4RQfAa+anSSq9zzBw88e
TLSH
T19AE12D7895088B6F74B6776CAC6888316AB2413BB7BF68D710B654C5050CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\prefs.js
Size 6KB
SHA256 b48e7fd12a47e708fdc3174fcf1f8f110e7ed58b93f15914d75949ff6f7a80ad
MD5 bedc2768a084a3ac209c9c876215269b
SHA1 b92e6f66be0fbaf07ccbb3cc4d1846f29624c51c
SHA512 f4d58213782fb49c8c7711b7d746f4a781d5448c160e3383bc4990241fa87b8e5b6066496e0145248d77a674e5721266756f37f7ee3302c3e06071c1c13eefa5
SSDEEP 96:xHcUTU1qGqQfA151zSvSSlZdv9jQnJH9zzBw88H8L4cnc1qGq:C4RQfA15ySSq9zzBw88e
TLSH
T169E120789408CB6F74B677ACAC6488316AB2413BB7BF68D710B554C5054CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\prefs.js
Size 7KB
SHA256 eb8daded32d97e21b908b6a87843b0593afaf4251fe8883c46c95f8a32cbdf57
MD5 484a22dd9e002d36354e858df18fa2b3
SHA1 a93f1656f9f59d2c6e9643c4c6f77ea143a9ebeb
SHA512 f33c3ba5ed99b5abc7987a9d74a53d372635d657c4d44a9768983520e0bbdcf24ab6d85c993d019241d84ad96e83ab373b1d2f1261b381d7dd23cb88afb8d810
SSDEEP 96:xHcpTU1qGqQfAa+ObzS7nSSlZdv9j5KnJH9zzBw88x78L4cnc1qGq:CVRQfAa+xnSS+9zzBw88w
TLSH
T12BF10E789508CB6F74B2377CAC6449316AB2023BB7BF68D710BA5485054CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 f90981bd0f3d7ef3e3d7d27196c426e0c5747b60ceb93aaca0bb56cc9a98e6b1
MD5 cd41026e47a4d7807108bae0ad56477f
SHA1 8acb4692899cdc2829d50088db6d1803d7a34b53
SHA512 680802fc5d61d6c37a22e868a47f9d3dab4507e8176bcce2f8f0e308f8cf534c5f3dfd93b40bd84e0b3517c7c4c770bf66a22d637f1734a63a31ccff3d343e49
TLSH
T1B021C941FA3F38999D41322A92CFAEFED685745549FC50B467D99F01069D80E339C009
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 0b11332611ec443fd4dffdc0bf4067ac11ba6b275e54ae0b57ed2b743fa0ee1f
MD5 96b80e310f0dc654b62ecc7c2c859c33
SHA1 11851dec42ed7db50bf9915d49256427d31a4cf0
SHA512 cc038d3c4a7a37c6e0446de3c735b43d2f3fa496553d5dfde2755ddde1af26924a84a331c93e6ca8e722c3219141e538946641fbd4d22f382be223c3026d87a6
TLSH
T1C7211B41FA2F389B9944311683CFADFAD6C5B0204AFC80B067E4AF010799C0E339D008
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.4MB
SHA256 2e4c6862bb2ea812efa74befed390cd9e2dbad237f10658161b778c6701a215b
MD5 6eb637b5c07076dcdbfc9a563159a0b7
SHA1 8376a117c9c07437df650f2a0fd994a02e55e4f7
SHA512 d472779c5fb453c6ef6e038cb0c5033600bfe9d07fb51fd6fcc13e91e159ecd5ec5ba58b2f718c3bbaedaef9287ad2b2d65820ec1d1899a0b5b898b3f20b340a
SSDEEP 49152:jLxLybaeUT6QC5zYYzHiJ5qzGgceSss+kJtNCe1OrNz27J8yQEpPYPoJHPk+ay4L:tbzvk+juwtvhaWXszc
TLSH
T1A0665CE420E29252F34140B3719A53EB11EFC01C6077CE445B9896FAA5B8CEB4E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1472-56-0x000001371BE40000-0x000001371BEF3000-memory.dmp

Download

memory/1472-55-0x000001371B990000-0x000001371B9AC000-memory.dmp

Download

memory/1472-0-0x0000013719680000-0x0000013719690000-memory.dmp

Download

memory/1472-59-0x000001377EF10000-0x000001377EF1A000-memory.dmp

Download

memory/1472-58-0x000001377F3C0000-0x000001377F3DC000-memory.dmp

Download

memory/1472-57-0x000001377EE50000-0x000001377EE5A000-memory.dmp

Download

memory/1472-61-0x000001371B9B0000-0x000001371B9B8000-memory.dmp

Download

memory/1472-60-0x000001377F3E0000-0x000001377F3FA000-memory.dmp

Download

memory/1472-48-0x00007FF416230000-0x00007FF416240000-memory.dmp

Download

memory/1472-62-0x000001371B9C0000-0x000001371B9C6000-memory.dmp

Download

memory/1472-63-0x000001377EF20000-0x000001377EF2A000-memory.dmp

Download

memory/1472-19-0x000001377F3A0000-0x000001377F3B2000-memory.dmp

Download

memory/1472-18-0x000001377EE40000-0x000001377EE4A000-memory.dmp

Download

memory/1472-9-0x0000013719680000-0x0000013719690000-memory.dmp

Download

memory/1472-2-0x000001377EE60000-0x000001377EE82000-memory.dmp

Download

memory/1472-1-0x0000013719680000-0x0000013719690000-memory.dmp

Download