760a7d590535a9fb90a7721a6ad593a3f1fd43a3853c10f368cecf5137f4681e

Analysis

user interaction
yes
max time kernel
52s
max time network
43s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ramsoware.ps1
Size 8KB
Sample261102-e8nmsasw6j
SHA256 760a7d590535a9fb90a7721a6ad593a3f1fd43a3853c10f368cecf5137f4681e
MD5 81c7e8e06c94ef86dba4edbbfb28fc76
SHA1 333478da10b2c8338b3eac99c785fcc0968f50bb
SHA512 05b0201677250fff8f036b42cd7888931bcde9bab6e85cd7ebffbb72d4c607c4c0516efde99df561bce258b5d28696fafe106dd56fdfc6a9a85aba0fca26659d
SSDEEP 96:MG5bkJJTQ0kW4M3z4d/dB+6zb2vn499FfXLJNWpPEW7lOwbEuJ+kyT9bi:9bwG07z4pdBZPFfXLJNIPnBpEBs
TLSH
T12502722E7F44816521B2D23A610BD50DEA1560BB04D26DC5B3BDC5E4BFB5B8DC23C87A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1444	powershell.exe

Checks processor information in registry 2 TTPs 25 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3532	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1444	powershell.exe
1444	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1444	powershell.exe
Token: SeDebugPrivilege	3952	firefox.exe
Token: SeDebugPrivilege	3952	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
3952	firefox.exe
3952	firefox.exe
3952	firefox.exe
3952	firefox.exe
3952	firefox.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
3952	firefox.exe
3532	EXCEL.EXE
3532	EXCEL.EXE
3532	EXCEL.EXE
3532	EXCEL.EXE
3532	EXCEL.EXE
3532	EXCEL.EXE
3532	EXCEL.EXE
3532	EXCEL.EXE
3532	EXCEL.EXE

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 3952	1884	firefox.exe	97
PID 1884 wrote to memory of 3952	1884	firefox.exe	97
PID 3952 wrote to memory of 4072	3952	firefox.exe	98
PID 3952 wrote to memory of 4072	3952	firefox.exe	98
PID 3952 wrote to memory of 4072	3952	firefox.exe	98
PID 3952 wrote to memory of 1620	3952	firefox.exe	99
PID 3952 wrote to memory of 1620	3952	firefox.exe	99
PID 3952 wrote to memory of 1620	3952	firefox.exe	99
PID 3952 wrote to memory of 1620	3952	firefox.exe	99
PID 3952 wrote to memory of 3032	3952	firefox.exe	100
PID 3952 wrote to memory of 3032	3952	firefox.exe	100
PID 3952 wrote to memory of 3032	3952	firefox.exe	100
PID 3952 wrote to memory of 3032	3952	firefox.exe	100
PID 3952 wrote to memory of 4280	3952	firefox.exe	101
PID 3952 wrote to memory of 4280	3952	firefox.exe	101
PID 3952 wrote to memory of 4280	3952	firefox.exe	101
PID 3952 wrote to memory of 1720	3952	firefox.exe	102
PID 3952 wrote to memory of 1720	3952	firefox.exe	102
PID 3952 wrote to memory of 1720	3952	firefox.exe	102
PID 3952 wrote to memory of 1720	3952	firefox.exe	102
PID 3952 wrote to memory of 5596	3952	firefox.exe	103
PID 3952 wrote to memory of 5596	3952	firefox.exe	103
PID 3952 wrote to memory of 5596	3952	firefox.exe	103
PID 3952 wrote to memory of 5596	3952	firefox.exe	103
PID 3952 wrote to memory of 5624	3952	firefox.exe	104
PID 3952 wrote to memory of 5624	3952	firefox.exe	104
PID 3952 wrote to memory of 5624	3952	firefox.exe	104
PID 3952 wrote to memory of 5624	3952	firefox.exe	104
PID 3952 wrote to memory of 5636	3952	firefox.exe	105
PID 3952 wrote to memory of 5636	3952	firefox.exe	105
PID 3952 wrote to memory of 5636	3952	firefox.exe	105
PID 3952 wrote to memory of 5636	3952	firefox.exe	105
PID 3952 wrote to memory of 5688	3952	firefox.exe	106
PID 3952 wrote to memory of 5688	3952	firefox.exe	106
PID 3952 wrote to memory of 5688	3952	firefox.exe	106
PID 3952 wrote to memory of 5688	3952	firefox.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\ramsoware.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1444

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3952
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2020 -prefsLen 27100 -prefMapHandle 2024 -prefMapSize 270279 -ipcHandle 2096 -initialChannelId {7a7abebf-f575-4054-be07-a74ab13e05cf} -parentPid 3952 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3952" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2468 -prefsLen 27136 -prefMapHandle 2472 -prefMapSize 270279 -ipcHandle 2480 -initialChannelId {ea101869-377b-4ee2-885c-3538adfed0ed} -parentPid 3952 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3952" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:1620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3888 -prefsLen 27276 -prefMapHandle 3892 -prefMapSize 270279 -jsInitHandle 3896 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3904 -initialChannelId {4a9961c3-b5af-43fc-8061-a88029e2cf7f} -parentPid 3952 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3952" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4052 -prefsLen 27276 -prefMapHandle 4056 -prefMapSize 270279 -ipcHandle 4152 -initialChannelId {25f10cbf-2c23-4bb2-aa4f-28736a06820e} -parentPid 3952 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3952" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3184 -prefsLen 34775 -prefMapHandle 3092 -prefMapSize 270279 -jsInitHandle 3084 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1340 -initialChannelId {cc9ca19e-95ce-4317-beab-1f81f0dad798} -parentPid 3952 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3952" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1720
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3216 -prefsLen 35012 -prefMapHandle 4920 -prefMapSize 270279 -ipcHandle 4912 -initialChannelId {f21ad56e-62c0-4180-bb8c-c660e2f057d2} -parentPid 3952 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3952" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5148 -prefsLen 32900 -prefMapHandle 5152 -prefMapSize 270279 -jsInitHandle 5156 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5164 -initialChannelId {9e1caa0a-ab65-4199-81cd-b2da1744cae5} -parentPid 3952 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3952" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5184 -prefsLen 32900 -prefMapHandle 5188 -prefMapSize 270279 -jsInitHandle 5192 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5200 -initialChannelId {da82f2b7-a04e-4565-832b-70d656756dd0} -parentPid 3952 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3952" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5148 -prefsLen 32952 -prefMapHandle 5328 -prefMapSize 270279 -jsInitHandle 2840 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5544 -initialChannelId {14f0dcf3-4ce0-4eb9-9960-2518a8b69318} -parentPid 3952 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3952" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5688

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\SplitRestart.xlsx"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3532

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\sln8pgmh.default-release\activity-stream.contile.json
Size 4KB
SHA256 3d76c6822eec3ec6b7d36fe340f95b91ebd046168fa85e4b735abd33a078ecf2
MD5 628d134956cd8cc19d83b0cba2adfcd6
SHA1 f9347c56ef6752c0d17081f41dd63ff0a588d0e4
SHA512 dc873ca1c6c63ee4cbe3edb6047f622faa1a454176b1ee8e6cae0b9b6bcdc03e4f70d201d3085f93f678b8932755839825eafc0aa7cb6964402338d9f6cc9ee3
SSDEEP 96:THkxMrH/Lqoma3k4vhUT+mRUdon4KYmz+hhK6DxHlz:LGMTLqo7U4vDmRUdoshcwxHF
TLSH
T16791B98F91B889121B31AAE07C4F27ACF107F406DAE19E5C715E9C61C56D7FA80DB548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\sln8pgmh.default-release\activity-stream.discovery_stream.json
Size 74KB
SHA256 794b45baed068b1dc6c473a8c862b3e043437e51ee16bed31152f6f4b160eb39
MD5 fad8c62d131e0cfdbd5ca3291a8dfdf1
SHA1 ed458e5b234ea1e2dfa30e0491162943faa46421
SHA512 cfe8abf21900487d53ce6e9308ece681726ea6847ca95d2a1eceba185bd06cdac9cd4a5dcc17cc4bfef9a442081be82c54c233d819cf7894b8400f013bfcd4da
SSDEEP 1536:swbmk08Da452cM1SGy4EV1cNMMMQMCgV31:l9Da452To1OgV31
TLSH
T1BA732AA396A8B1BF1FA137D71C0F795B66D60189F74A01C8ECEDCA1D81CC754823A5AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\sln8pgmh.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 67d89a7d6c5988e3aca580932ba56f068a5b2ed02baf03da85236959a5ab5059
MD5 778f4bffd3d7d95a69caa220bfa76867
SHA1 afbd17c05aacd3e0d871836ae26c484a9dd66f1d
SHA512 9fad3116b2d114884d576df5dc09717ca096ce2f0cfbaa133be22249b17f134642a770e37e158b0b33fbc6e8ce26842570461b0fc0942d9fe4350b89228e0179
SSDEEP 768:sByV9LQsD4mIomu98K51qii+pbRliWaSixzOOrJKC9Qk2GPaDGLgscCheM+GrO3:swV9XjMC44RlzGxZ5yFE8wqtGY
TLSH
T191732BA396E872FB0B9137D72C0F796B56F10185E38506C9ECEACA1D81CC754123A6AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.weather_feed.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\sln8pgmh.default-release\activity-stream.weather_feed.json
Size 14B
SHA256 1bead770ec2d7afc6ec1e9d35383f40ef676591e079dece21c38db17c5c24a20
MD5 3ea4da2ce03c4204ffe9b30074d62fac
SHA1 b6b82844f7ce93098971fea6f2559b220be08e2d
SHA512 dbbbee11f26deb954124b96d0fb7748ad170d9bab095f79691c83fb1dcfe57b453cd4ffd6a367c701d86bd676d40aabde7a390ecc57e2fcbd0c545d9940a41f2
MD5 SHA1 SHA512

Submit Download

12498

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\sln8pgmh.default-release\cache2\doomed\12498
Size 52B
SHA256 d1f4430b433878018d2df18c0fbd274e0f844847d9f26f30c9f1c6798e1f4181
MD5 11e6479250fbd2e4a4dc61ad3ea2bba5
SHA1 04322cb26a95a434eaa70cbdf44d5c8ff275dd1f
SHA512 669857f400b0817fc606ec7f0fdd852671ab1f50fb6d877d23c27373927a80774d41aa0687ced1f30a42164530f29d56473e97ad2bacdf51b46521367e78ce5c
TLSH
T1AE9002048152AA89D0A48330094085F804207A54D481031278A1175145111DA640D240
MD5 SHA1 SHA512 TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\sln8pgmh.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 4ba657003557fd264b2dcdc2bf01f5de7b46c6d3daad3134de1c492f820024af
MD5 22b306ba75331dbfffa536a10ff66516
SHA1 5fbfcb68447f023602143ec184ad80debcdec28c
SHA512 564d407c4ee41fcd192af9365ce251eeccf671f066408433ce4514362a9ca612396b350fc4f946753008d7a16cb6a5411e4ea3e58fb52eafc8db854d08b195e3
SSDEEP 3072:j3lAjgM9b/cVwv7tBHJpcYyova4PBfGKCiF3GD6L5v+:pAXbkqTtB7cYyovdBftS6tW
TLSH
T1C7B39EF6DFA2893D69FFD42D97C2883EF8221404B3A7300DC913675462C6FA46679749
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_5v1f1343.hrz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5v1f1343.hrz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 5671e29f2da7ff9ed67b491182172ee15107b3fb92a037f5b343b9b73f60da2e
MD5 d8e30cdfc1c609d14b6bb739af1c08b7
SHA1 61a634507f37844a1b562dffa2f4fb5589c95e58
SHA512 7f1ff51b538ff44385f7aaf191664cf488ac967c4cf485f7422f332765a59df7e17fb756509499b5693f40807e33e414ee5cc624e472b70f85b160cc29eb10c9
SSDEEP 96:lFg2omi7/dd66JozGzgClKtmc0d/UlSdF95/7bkW60rcEHlyUR6Zx2WZ:E1d66JozGzgCl6mc0dEOv5zbowbHlyjd
TLSH
T175C1CC68F6284A3BC408023BDCA61F510F763897988E7F2972AC64192D5A2DD768D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 ac212a50ddd8ac20548d86793eb6cf6a143c452a2a7512ac51acab5998fbaec5
MD5 74089271de03e44e223e2ea34045f935
SHA1 ef81d8af77bc4e662fadc796d4bb12f210d94fff
SHA512 e1886929fd3691ff893fd1330132777644ae79d3e821273b34f8c8b82bca1cd40c200b45a87a5d757abd5fc522557ce8c78d5598a3ef4c874206e33a1770ce17
SSDEEP 192:qOv5zboP/HlyjsMH1d66JozGzgCl6mc0dz:Jbo3Hlyjfd66JozGzgC1jd
TLSH
T1F0E12F68E6284A7FC408027BDCA61F410F39389AD88E3F1975ADB51D2C1B2DD768E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 49213727f3b3f3775a64f5e63564117552a184bf0de3819ce355a4781f4dc60d
MD5 533bd96913fe4b38cc003ae23cc2d6a9
SHA1 38904784ca160a9d9dcbe9db13e9a257274eb438
SHA512 780f65bd66be11e61b0ea3414f1607d8915be1d2984d673f579787ea53cadda44064caae3fdf7554f1d6e3f6ef966c75cfd9a4a09b34fadcfa801ef21bc565d1
SSDEEP 192:VOv5zboPYZHlyjsMc1d66JozGzgCl6mc0dz:KbowZHlyjQd66JozGzgC1jd
TLSH
T1D3E13068E6284A7FC408027BDCA61F410F39389AD88E3F1975ADB51D2C1B2DD368E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\datareporting\glean\events\events
Size 1KB
SHA256 31a9cb5b897b48822a0eb52bca532147c29093bc8a21de046de1d07cd6d49b2c
MD5 645766580ae5af05ebc31bba967c9047
SHA1 28ae844af75c95da37190e8b3ad32deb93d994cb
SHA512 7b9e64b9b821a0ca3da943be61b63c1da471ff17181c8414b19808621e1739a272cf74f8d0a1d8a3bb322f159f42a9388dde48e8bbd8f0553a53a30758b61ba3
TLSH
T15F116DDC3AF94D29AD8BE6BC7441028E935A4A4A058B1D434D12DFCCCD90AD9B1AD83C
MD5 SHA1 SHA512 TLSH

Submit Download

0d11fa39-7693-4e02-88ce-a8e85ffa920f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\datareporting\glean\pending_pings\0d11fa39-7693-4e02-88ce-a8e85ffa920f
Size 883B
SHA256 f6d0bd10bfcfa500b97ab8490745802e5bf618ee0d759069d11bb90a30292df7
MD5 0bb8411e2af4d9716c33a41790128f84
SHA1 5ba0d44f275a589250e29a498ffb2d5b49b17560
SHA512 dd1f0cc97fba07558646adc40c09d6fc296ea6da5a8bb3be29384299796a0cc5155d6960b3b7e73a564900dd0c9b06ded33baba6a1697b9334cb600f8b9594ce
TLSH
T1D3119C81A6717CF2DD6CD24B85E53B0297F47523D0C995143EB15A240C6E61D9366607
MD5 SHA1 SHA512 TLSH

Submit Download

54e61d57-ff10-413e-b758-f6984f07d62b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\datareporting\glean\pending_pings\54e61d57-ff10-413e-b758-f6984f07d62b
Size 886B
SHA256 a281438ffddd7d12a4dc0ababe2d041bd25a16bd418c3b1513d8bbd85e173396
MD5 6f118a848e8b2fd86bd1a638070087e2
SHA1 2f72c83106aaed0a6cf129117312afd6297277a6
SHA512 a1eefb7f0dd0a23a81753f62548467e20ab9ab5892f48f7ba1b0a79db62ed4dbf94792a006fd9ab996ac59cba2669b8ad99359ca1e48305716b68b1ac5718bd9
TLSH
T1CE110081E76078F2CD2CD28794E077038BE57563D0CD8D147DB19B280CBB51D9366A0B
MD5 SHA1 SHA512 TLSH

Submit Download

779569b1-9246-45c5-8266-abf9d13a2f62

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\datareporting\glean\pending_pings\779569b1-9246-45c5-8266-abf9d13a2f62
Size 15KB
SHA256 e70e8e4940506988aae35824dd6550081996f785b387d5e091483fd014e23f39
MD5 e524729238519a71fa7f1e3466d8bc22
SHA1 2fd6f7884f3625f908f6752ca51d5f172df2926c
SHA512 1c87808ffaa2c2c7c6ebf2327cef9d19faab67629f8cd2ad55bb3ff6cd2f913d9600eb351889e156dadf8a3d9ca892a566b85ee0ec44d66695c30ab50c579808
SSDEEP 192:5wrEGiuusBOuEQ8E56yG+KMUizX/wQiMVXugQwJpyOwxp8H7j1zxb2XKStbB:5wcHshl9G8jyOY6xlb2XKStbB
TLSH
T1EF62D8566470597E8691E3A8D4F87FC3E1F618CB4C019FCE9BE4BD0869EE06E1127847
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86b746a4-a515-4005-838f-24373ff70f9a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\datareporting\glean\pending_pings\86b746a4-a515-4005-838f-24373ff70f9a
Size 235B
SHA256 537a7f878bd3858a51b5328ee23f27dfaeac0a78381bc195681349f050348bd1
MD5 8c93551e42054309c251251405f59557
SHA1 6eeb97d464a5a06ce3d2c734f58d1545890e2c2a
SHA512 48725678e7e433ba6d724c8c6682ffc39a1e3225546b2959412c6cb3cf39b1cf0d6bb2de11167c1d4e8e49badb9bd08ca10514369dca0b78e3870888a93c341f
TLSH
T1F1D097801C88271D4C000F56B4E02AD331494C3714B8A860C9A545B8CABEEC991E180B
MD5 SHA1 SHA512 TLSH

Submit Download

b0d0818d-e47f-4c60-9129-48242d847aba

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\datareporting\glean\pending_pings\b0d0818d-e47f-4c60-9129-48242d847aba
Size 235B
SHA256 505be81033b536ddbb0c3404b5884ad5bb4c4af682fb950d07f7b2ef84f7182d
MD5 90670b38576443d8a172816d601a8207
SHA1 c50564c0bd9022b4cccead5200c39e25a8467439
SHA512 668935b08f51a69181d4561a4eeb9992ca01d762e6736e212c4afb96e2ff93e5eed0763030768ae2c3e82a3c92f22cd6dcf07c5440aad1d5dbee8a3e7bfb8b20
TLSH
T1DCD097902498B75C08200F07F0A029C6718DCC3710B09C1095A140389AFCEC802A2C26
MD5 SHA1 SHA512 TLSH

Submit Download

f6e2efc3-0179-4dd3-8e9b-61db500b3b49

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\datareporting\glean\pending_pings\f6e2efc3-0179-4dd3-8e9b-61db500b3b49
Size 2KB
SHA256 80052e64232e597af18884d5e39846d5d9df2f93e8413e7820f100679ffce538
MD5 7f04862f96e6923f7702043aa3e99b0c
SHA1 9e7b0c2bfed72ac740d73f42824bf643ea34ba0c
SHA512 8eb5dcbe41be0f9800709dd87c4b2b9eb374526a36c2566f32826ebb12b8b286c0ba1217e66bacfd9a0cc77a507ad990e536c568f9cdea410cc6b9112a604712
TLSH
T15241835C76B88D779CDAE14E9491338E5B744A4380C11C832E51EF0C8EA779D23AB92B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\prefs.js
Size 6KB
SHA256 c75313c46a1266c8e16ccd9e92e7b391d241b4e9d7351eeb678259496e0d0e46
MD5 7eeeb41c218ef208e4dd2863981884cc
SHA1 c4d7a1dd85dab1119dc7c15ea036b23f43c733c6
SHA512 318ba8e8f0092bc23cf24d7f8c5f2dbab1e2f732d22eb823d56833b23e5f7bc6c3fb4cffe75435c7616ee388339c31745742aabf48583639caec058f93ecd47d
SSDEEP 96:xH5UTUGqGqFfKjO1zSxSSlSdv9jqn2RHKpBw88n8L4cnEVoR:XBRFfKjO4SSw9KpBw88ZG
TLSH
T150E11E7894488B6F74B6776CAC6888315AB2013BBBBF68D750B554C4011CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\prefs.js
Size 6KB
SHA256 21b1e7b91aca8442bd170b932e46512605847aef9819e95091094cf230a12287
MD5 2983e1e03e79d13cdf1a9dff945fe45e
SHA1 70f8a8304edd150b89523685ec5de2819621d960
SHA512 7556d0386c4bca880b49733c9427ed27889ef70fa3c62ea27eba5f4674a3d74b551f08bf69653a4d5aca0b7739801da7bceeb4d3e1bbd9b0956b2ab191e18706
SSDEEP 96:xH5UTUGqGqFfK4v1zSzSSlSdv9jnn2RHKpBw88n8L4cnEVoR:XBRFfK4veSS39KpBw88ZG
TLSH
T15DE10E789448CB6F74B677ACAC6888316AB2013B7BBF68D650B554C5011CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\prefs.js
Size 6KB
SHA256 ae78f4880413f9882a1ed136fe3bb8d079e49c0eb2679225d22539fa6183af9a
MD5 187ec34adf30035a71cd2f3db1eecfc6
SHA1 53dc4a17a90c7c704d4b6b497ac58295f6925351
SHA512 f45484470ce93c58d6889097614185c5bfc0eda9b02023b9b575b14f07a86168f11d9c3b96a1bfd7a07a6cee4f42b85db7b3354d147322eb6e71a55c66b38800
SSDEEP 96:xH5UTUGqGqFfKjO1zS2SSlSdv9jqn2RHKpBw88D8L4cnEVoR:XBRFfKjOfSSw9KpBw88FG
TLSH
T1F1E12E7894488B6F74B637ACAC6888715AB2013B7BBF28D750B554C5011CF3842F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

search.json.mozlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\search.json.mozlz4
Size 327B
SHA256 a4c8d0344cbf6e230cecbc4d989de36ec075cd8eda7ae740242e1b05b5dd3fd4
MD5 240589068f063f8f706378168230e975
SHA1 9531374a22dea374d032f7484567fb1b201af87d
SHA512 6d04629da44769a64b8808d198f3b3ba6388a0cd5441269e35ca39e7595c4e9abd32618f76ff60b79df80732838ee2a67455e195a801a67334a592b6b6240da5
TLSH
T169E07D3E9C15A0B6C2AC0AC35F0F494A0F58583A9324AC8C90B49D91557FF9B5248E2B
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\sessionCheckpoints.json
Size 122B
SHA256 72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
MD5 99601438ae1349b653fcd00278943f90
SHA1 8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9
SHA512 ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55
TLSH
T14DB09296895A1070CE83259D73A47B92AE3E14F676A1164471ACA98C24BB0278657883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\sessionCheckpoints.json
Size 146B
SHA256 7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d
MD5 65690c43c42921410ec8043e34f09079
SHA1 362add4dbd0c978ae222a354a4e8d35563da14b4
SHA512 c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9
TLSH
T1C9C02BC385460070CEC3229D33A07F92AE3F00FB37B10604706CA54C14770278203443
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\sessionCheckpoints.json.tmp
Size 288B
SHA256 3a0285c8233ef0324b269f7291094e19fd9b77259f9419861ad796f7e9c979f3
MD5 6b77a9f779399e95d1cee931a2c8f8ff
SHA1 826efd4feb0d50fcce5696111af7c811b81adcd9
SHA512 ef537c75fab8e86483ac03cc0d2feaf41575e35f54b95669a26bf6dfbf58021dc9a5bbe54d9537b55da3fbb0e0262adf6c5efd4394faaec81a31604533afec4f
TLSH
T120D08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\sessionstore.jsonlz4
Size 1KB
SHA256 9c3e6738d3e09a515120c4cd44488d7e338d0ba821b78c2fee9b188ae3bee7cf
MD5 5b3c274ff24fae4dcab02e770353b162
SHA1 5b4088d5a859050c414ddda63b93df6fe5e56168
SHA512 bd350ee309ad591ff1edb0bd75cc2a390e357f5520d628ba3a03f0b068b300eca4d15365126464039799d2d360d142efbb1661b1287d9ae5a47c1e4734190c93
TLSH
T1392163CACE6F6DF17E61C272C0490AF9CA9D302189D449A5895D4B07249B08D2AC761E
MD5 SHA1 SHA512 TLSH

Submit Download

targeting.snapshot.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\targeting.snapshot.json
Size 3KB
SHA256 498e64114873fd457967f6e567cc9d4632ab6f32e40219fc6a6255dd18e009fd
MD5 f55917c1472fef9e42fba02f0f0ca9b1
SHA1 8d0c04ae46af0fd3d95651fe7194d7437448999b
SHA512 459bdda9a07f1e092ccb4ce316a3f7232f7f89316dbdbfa9bf064f13cc236f76d5dcecceb438c43f2ca65ae4e0cc56a62a9d075c3f18354aaab4f6c4602a707a
TLSH
T12871700CA61CA4BEA66BC3C0D684BF978BBD053370446458DAFE460C55FB5FB122621B
MD5 SHA1 SHA512 TLSH

Submit Download

xulstore.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\xulstore.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

memory/1444-10-0x000001CBD6680000-0x000001CBD6692000-memory.dmp

Download

memory/1444-7-0x000001CBD61E0000-0x000001CBD6202000-memory.dmp

Download

memory/1444-11-0x000001CBD61D0000-0x000001CBD61DA000-memory.dmp

Download

memory/1444-16-0x000001CBBBA70000-0x000001CBBBA80000-memory.dmp

Download

memory/1444-15-0x000001CBBBA70000-0x000001CBBBA80000-memory.dmp

Download

memory/1444-1-0x000001CBBBA70000-0x000001CBBBA80000-memory.dmp

Download

memory/1444-0-0x000001CBBBA70000-0x000001CBBBA80000-memory.dmp

Download

memory/3532-460-0x00007FFB71A70000-0x00007FFB71C65000-memory.dmp

Download

memory/3532-463-0x00007FFB2F8A0000-0x00007FFB2F8B0000-memory.dmp

Download

memory/3532-450-0x00007FFB31AF0000-0x00007FFB31B00000-memory.dmp

Download

memory/3532-449-0x00007FFB71B0D000-0x00007FFB71B0E000-memory.dmp

Download

memory/3532-456-0x00007FFB71A70000-0x00007FFB71C65000-memory.dmp

Download

memory/3532-458-0x00007FFB71A70000-0x00007FFB71C65000-memory.dmp

Download

memory/3532-461-0x00007FFB71A70000-0x00007FFB71C65000-memory.dmp

Download

memory/3532-448-0x00007FFB31AF0000-0x00007FFB31B00000-memory.dmp

Download

memory/3532-462-0x00007FFB2F8A0000-0x00007FFB2F8B0000-memory.dmp

Download

memory/3532-459-0x00007FFB71A70000-0x00007FFB71C65000-memory.dmp

Download

memory/3532-455-0x00007FFB71A70000-0x00007FFB71C65000-memory.dmp

Download

memory/3532-451-0x00007FFB31AF0000-0x00007FFB31B00000-memory.dmp

Download

memory/3532-454-0x00007FFB71A70000-0x00007FFB71C65000-memory.dmp

Download

memory/3532-453-0x00007FFB31AF0000-0x00007FFB31B00000-memory.dmp

Download

memory/3532-457-0x00007FFB71A70000-0x00007FFB71C65000-memory.dmp

Download

memory/3532-452-0x00007FFB31AF0000-0x00007FFB31B00000-memory.dmp

Download

memory/3532-476-0x00007FFB71A70000-0x00007FFB71C65000-memory.dmp

Download

memory/3532-493-0x00007FFB31AF0000-0x00007FFB31B00000-memory.dmp

Download

memory/3532-494-0x00007FFB31AF0000-0x00007FFB31B00000-memory.dmp

Download

memory/3532-492-0x00007FFB31AF0000-0x00007FFB31B00000-memory.dmp

Download

memory/3532-491-0x00007FFB31AF0000-0x00007FFB31B00000-memory.dmp

Download

memory/3532-495-0x00007FFB71A70000-0x00007FFB71C65000-memory.dmp

Download