Analysis
- user interaction
yes - max time kernel
100s - max time network
101s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
15/07/2026, 04:33
Behavioral task
behavioral1
Sample
VapeLiteV3.4.2.zip
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
VapeLiteV3.4.2.zip
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
VapeLiteV3.4.2.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target VapeLiteV3.4.2.zip
- Size 12.8MB
- Sample260715-e6jaaabx3m
- SHA256 50bcee764e58a8fdcd525ac20bf0105d660aec2184f7ad0622cd0e7ceaef5c74
- MD5 7b2c093163211f33353a9c570fee01dd
- SHA1 7379348a9f9896eccd3d1424b78a1e84516096f6
- SHA512 2e3f2e1298d8da38a87031e187da064c0321b02ae0b49ee803ed53b619b201604e7f745dc0ddb599f089d4ee0fed2dae9defc3f8b2b3c1cdac8a77331ebe6bb0
- SSDEEP 393216:iJVl/lMdTtGKv7/qY2wWOiSE+MSa4KtnLXi:iJLOWUyY2wZiqd6nu
- TLSH T15CD6334C92859366DDCD7AB0DF46FBA0C28618D9C767C7956EF03396BC124C07BAA093
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 36 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings firefox.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 1956 Loader.exe 1956 Loader.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2196 taskmgr.exe Token: SeSystemProfilePrivilege 2196 taskmgr.exe Token: SeCreateGlobalPrivilege 2196 taskmgr.exe Token: SeDebugPrivilege 4412 firefox.exe Token: SeDebugPrivilege 4412 firefox.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 4412 firefox.exe 2196 taskmgr.exe 2196 taskmgr.exe 4412 firefox.exe 4412 firefox.exe 4412 firefox.exe 4412 firefox.exe 2196 taskmgr.exe 4412 firefox.exe 2196 taskmgr.exe 2196 taskmgr.exe 4412 firefox.exe 2196 taskmgr.exe 2196 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4412 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4308 wrote to memory of 4412 4308 firefox.exe 103 PID 4308 wrote to memory of 4412 4308 firefox.exe 103 PID 4412 wrote to memory of 3088 4412 firefox.exe 104 PID 4412 wrote to memory of 3088 4412 firefox.exe 104 PID 4412 wrote to memory of 3088 4412 firefox.exe 104 PID 4412 wrote to memory of 3044 4412 firefox.exe 105 PID 4412 wrote to memory of 3044 4412 firefox.exe 105 PID 4412 wrote to memory of 3044 4412 firefox.exe 105 PID 4412 wrote to memory of 3044 4412 firefox.exe 105 PID 4412 wrote to memory of 1792 4412 firefox.exe 106 PID 4412 wrote to memory of 1792 4412 firefox.exe 106 PID 4412 wrote to memory of 1792 4412 firefox.exe 106 PID 4412 wrote to memory of 1792 4412 firefox.exe 106 PID 4412 wrote to memory of 3404 4412 firefox.exe 107 PID 4412 wrote to memory of 3404 4412 firefox.exe 107 PID 4412 wrote to memory of 3404 4412 firefox.exe 107 PID 4412 wrote to memory of 3804 4412 firefox.exe 108 PID 4412 wrote to memory of 3804 4412 firefox.exe 108 PID 4412 wrote to memory of 3804 4412 firefox.exe 108 PID 4412 wrote to memory of 3804 4412 firefox.exe 108 PID 4412 wrote to memory of 5952 4412 firefox.exe 109 PID 4412 wrote to memory of 5952 4412 firefox.exe 109 PID 4412 wrote to memory of 5952 4412 firefox.exe 109 PID 4412 wrote to memory of 5952 4412 firefox.exe 109 PID 4412 wrote to memory of 6004 4412 firefox.exe 110 PID 4412 wrote to memory of 6004 4412 firefox.exe 110 PID 4412 wrote to memory of 6004 4412 firefox.exe 110 PID 4412 wrote to memory of 6004 4412 firefox.exe 110 PID 4412 wrote to memory of 6064 4412 firefox.exe 111 PID 4412 wrote to memory of 6064 4412 firefox.exe 111 PID 4412 wrote to memory of 6064 4412 firefox.exe 111 PID 4412 wrote to memory of 6064 4412 firefox.exe 111 PID 4412 wrote to memory of 2164 4412 firefox.exe 112 PID 4412 wrote to memory of 2164 4412 firefox.exe 112 PID 4412 wrote to memory of 2164 4412 firefox.exe 112 PID 4412 wrote to memory of 2164 4412 firefox.exe 112 PID 4412 wrote to memory of 5672 4412 firefox.exe 113 PID 4412 wrote to memory of 5672 4412 firefox.exe 113 PID 4412 wrote to memory of 5672 4412 firefox.exe 113 PID 4412 wrote to memory of 5672 4412 firefox.exe 113 PID 4412 wrote to memory of 5280 4412 firefox.exe 114 PID 4412 wrote to memory of 5280 4412 firefox.exe 114 PID 4412 wrote to memory of 5280 4412 firefox.exe 114 PID 4412 wrote to memory of 5280 4412 firefox.exe 114 PID 4412 wrote to memory of 5312 4412 firefox.exe 115 PID 4412 wrote to memory of 5312 4412 firefox.exe 115 PID 4412 wrote to memory of 5312 4412 firefox.exe 115 PID 4412 wrote to memory of 5312 4412 firefox.exe 115 PID 4412 wrote to memory of 4728 4412 firefox.exe 116 PID 4412 wrote to memory of 4728 4412 firefox.exe 116 PID 4412 wrote to memory of 4728 4412 firefox.exe 116 PID 4412 wrote to memory of 4728 4412 firefox.exe 116 PID 4412 wrote to memory of 5572 4412 firefox.exe 117 PID 4412 wrote to memory of 5572 4412 firefox.exe 117 PID 4412 wrote to memory of 5572 4412 firefox.exe 117 PID 4412 wrote to memory of 5572 4412 firefox.exe 117 PID 4412 wrote to memory of 5064 4412 firefox.exe 118 PID 4412 wrote to memory of 5064 4412 firefox.exe 118 PID 4412 wrote to memory of 5064 4412 firefox.exe 118 PID 4412 wrote to memory of 5064 4412 firefox.exe 118 PID 4412 wrote to memory of 6092 4412 firefox.exe 119 PID 4412 wrote to memory of 6092 4412 firefox.exe 119 PID 4412 wrote to memory of 6092 4412 firefox.exe 119 PID 4412 wrote to memory of 6092 4412 firefox.exe 119 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\VapeLiteV3.4.2.zip1⤵PID:560
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2196
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4860
-
C:\Users\Admin\Desktop\Loader.exe"C:\Users\Admin\Desktop\Loader.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1956
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2000 -prefsLen 27100 -prefMapHandle 2004 -prefMapSize 270279 -ipcHandle 2088 -initialChannelId {494daa22-cf3c-4dbc-ab5c-708fcfaaf4d2} -parentPid 4412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4412" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵PID:3088
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2452 -prefsLen 27136 -prefMapHandle 2456 -prefMapSize 270279 -ipcHandle 2476 -initialChannelId {36f24936-3edc-4aeb-8dc1-72c54273c72b} -parentPid 4412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵
- Checks processor information in registry
PID:3044
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3768 -prefsLen 27277 -prefMapHandle 3772 -prefMapSize 270279 -jsInitHandle 3776 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3784 -initialChannelId {083bcdf8-1561-4657-b0c2-0fd57a8659f5} -parentPid 4412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
PID:1792
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3968 -prefsLen 27277 -prefMapHandle 3972 -prefMapSize 270279 -ipcHandle 3764 -initialChannelId {e656d6d1-96b6-4f04-ab03-892a41468237} -parentPid 4412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4412" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵PID:3404
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2780 -prefsLen 34776 -prefMapHandle 1652 -prefMapSize 270279 -jsInitHandle 3100 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2908 -initialChannelId {55165a67-e814-424f-837b-31897e3016f4} -parentPid 4412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
PID:3804
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4988 -prefsLen 35013 -prefMapHandle 4984 -prefMapSize 270279 -ipcHandle 1236 -initialChannelId {6d1c778f-5a29-4a13-9906-9f7801566a0c} -parentPid 4412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
PID:5952
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1640 -prefsLen 32900 -prefMapHandle 4632 -prefMapSize 270279 -jsInitHandle 1636 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2820 -initialChannelId {5aea9a82-f856-41a5-9b8f-06470219761e} -parentPid 4412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
PID:6004
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5124 -prefsLen 32900 -prefMapHandle 5136 -prefMapSize 270279 -jsInitHandle 5188 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5196 -initialChannelId {0ac5e8c5-b630-44c9-9cbb-68ef2baeb53b} -parentPid 4412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
PID:6064
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5572 -prefsLen 32952 -prefMapHandle 5576 -prefMapSize 270279 -jsInitHandle 5580 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4632 -initialChannelId {94bb3b7a-f10d-4540-8c11-a705e0d08bab} -parentPid 4412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
PID:2164
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6416 -prefsLen 33071 -prefMapHandle 6420 -prefMapSize 270279 -jsInitHandle 6424 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2784 -initialChannelId {a4697f33-7e88-4d5c-a445-005182610f41} -parentPid 4412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab3⤵
- Checks processor information in registry
PID:5672
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6976 -prefsLen 33071 -prefMapHandle 6980 -prefMapSize 270279 -jsInitHandle 6984 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6992 -initialChannelId {c1d08ff3-0856-4019-9022-a1418c1cbdf5} -parentPid 4412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab3⤵
- Checks processor information in registry
PID:5280
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7212 -prefsLen 33071 -prefMapHandle 7216 -prefMapSize 270279 -jsInitHandle 7220 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7160 -initialChannelId {ab3286d4-5fab-407b-880f-3f76df412c7f} -parentPid 4412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab3⤵
- Checks processor information in registry
PID:5312
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 2696 -prefsLen 35184 -prefMapHandle 2736 -prefMapSize 270279 -ipcHandle 7472 -initialChannelId {ca4d0716-3be6-4564-a948-9a8dfdf40a82} -parentPid 4412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 utility3⤵
- Checks processor information in registry
PID:4728
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5380 -prefsLen 33071 -prefMapHandle 5392 -prefMapSize 270279 -jsInitHandle 4992 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5828 -initialChannelId {48183e71-6df7-4554-a94e-6855155fdc8f} -parentPid 4412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab3⤵
- Checks processor information in registry
PID:5572
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8268 -prefsLen 34854 -prefMapHandle 8272 -prefMapSize 270279 -jsInitHandle 8276 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5400 -initialChannelId {f9e94a25-d8ed-4f25-88b4-ad9773f2a253} -parentPid 4412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab3⤵
- Checks processor information in registry
PID:5064
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5588 -prefsLen 36758 -prefMapHandle 7380 -prefMapSize 270279 -jsInitHandle 8040 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7024 -initialChannelId {b86d2124-6c93-4680-8eb2-005d54ef1f49} -parentPid 4412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab3⤵
- Checks processor information in registry
PID:6092
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
- Size 15KB
- SHA256 30026e64a1d36276a7e90d92f5cf8898d88a9b634a542c132dc79b4395f6c0e6
- MD5 042aa7b8681bdb7c0c17c110b5087403
- SHA1 854886dcab4f79bacbe7f9b5c620f9cee7a22604
- SHA512 b5fba617bffae58d7874de31bb0b87921d9d42e6b52b1b6a58e8a2f41a7170d72e827f2fe9f0b357fbcd16e2fb7e4d919638753852841fcb733ed1540c9d53ea
- SSDEEP 384:H9XghOiO024Ypdcs3hk2nhfdDE2Ba/rIVy8epdy:dX+ZYpdv3hk2nhfS2sDIVy8x
- TLSH T18F729DBB8F116C5919679585C8AD5369ED05F9BBCBF690B618103489CB8432AB0F60CE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 11KB
- SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
- MD5 25e8156b7f7ca8dad999ee2b93a32b71
- SHA1 db587e9e9559b433cee57435cb97a83963659430
- SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
- SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
- TLSH T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 502KB
- SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
- MD5 e690f995973164fe425f76589b1be2d9
- SHA1 e947c4dad203aab37a003194dddc7980c74fa712
- SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
- SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
- TLSH T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\AlternateServices.bin
- Size 10KB
- SHA256 bdf2fd99be260a21283cd6392e078ea0bf30a984fa422cb769e7062aba254225
- MD5 17025cd8901c385d5a3d0e69962565fe
- SHA1 e66f7808aa78ca75c3ba36569e41d34ecc9ede15
- SHA512 c2008cc7af13cbdb49c0ad748798987abded52c0fdd36e4590298374dd1538ad93d77058e9ca8dc39e087aef1c82bee279bd12bc0f5fe38d25ca8c169f126559
- SSDEEP 24:EjuhMZOs91guo9xwro9BU49VvSS85q9F55A5Z09Fe19lF:EPauiari2yBSS+I56ZWEf7
- TLSH T1682285E76B76A4B2F0A2CFB0409A719CDC7307254A69D5C4CB5490F312D1E99913FBE8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\AlternateServices.bin
- Size 25KB
- SHA256 8ee8203010b4f5495063b7715bcac5cb83131e298b6e07502898e64f66cae203
- MD5 9fdbe11cfcf4e7328ac48e3fc28b185c
- SHA1 aa68033032eeb525c8da7766fde95c941b0da936
- SHA512 c542fdf527df885bed77ab8d330e2e9262e302efdcedd98c4eb8d6c3f7f4fb5b4f6d61bb3bf2050f9086adba97fb6da4c01e07a8c41bd6f59e13d2b289d42714
- SSDEEP 96:Wauiari2yBSS+I56ZWEf70ahfM/pAsyx2mYyuZa6y8tataykWF4kB7T6Ji6wQm:/KQT22HZZ7Ft
- TLSH T159B2A3F76BB164A2F0A28FB040A9719D9C33171949A9C598CB44D0A712E5FE5D03FBEC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\AlternateServices.bin
- Size 35KB
- SHA256 1b5c0b5808595a49c6e40f42a480b83102ac45a0f166ad55725d5d8a2a7dd7f9
- MD5 8c40be3dedf763359445d4400e613579
- SHA1 75e199f193f4bca55ca90aa3f8e7dffd57bc228f
- SHA512 41421624fac470114aee3772b4e79679c75ab3dae94ab6abacb445011c8d6ee077ee49dd2e1b5af51806c90ab6f4ac47c760fd7d92cd9e79b61be37e59a9ce95
- SSDEEP 96:kNYwU0IBIPI56bvQC1x0ahfM/pAsyx2mYyuZa6y8tataykWF4kB7T6Ji6wQmfW6d:QLQT22HZZ7FtAp6/aVEEkHg
- TLSH T142F2A3FB2BB17462E0729FB144D9719DDC7317198A99C5988B04D0A702A5FA4E03FBEC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\db\data.safe.tmp
- Size 7KB
- SHA256 7fd9c0384504d3812637101ef156b2f7fb6f0b215a011a7df4c5c30610f9e38a
- MD5 e82e5aeeb9d12b10f61021dbfab3360f
- SHA1 520d4de94b08b2d5d044fee1d1c8cb31ecb9c726
- SHA512 64d517e097110892b17ed5d13d897b899e412c1cd9d84c47e2e95e0dad5089ddbd00acd70af3d46d32bb29c761befbfd9799b6922b205113934555cdced29763
- SSDEEP 192:NOv5zboAPHoyj48u1d66Joz1zgCl6mc0dz:ibooHoyjWd66Joz1zgC1jd
- TLSH T10DF11EA4EA28867BC408027BCCA61F410F36395B9C4E7F1A35DC645C2D576DE368E1BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\db\data.safe.tmp
- Size 7KB
- SHA256 6b476daeed6788709742c9ff2f59aecd28ca380983b51d0947878f7814d7643e
- MD5 b5106fa7d0ffbd0a053027c7544e6e7b
- SHA1 0d5582198c1c56c173d2293d599dd3c4df76207f
- SHA512 64d6754f633d3830b1ccdc70cfc9c149debfb3caa652771d0c4dda55db6a2d0f10fef0ecd89d05b46d43546ace1d05b482c8063981c0857725b3f01d25936067
- SSDEEP 192:0Ov5zboAPHoyj48f1d66Joz1zgCl6mc0dz:XbooHoyjDd66Joz1zgC1jd
- TLSH T137E11DA4EA28863FC414027BCCA61B410F36395B9C4E7F1A35DC645C2D576DE368E1BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 0742b48f385ef04dd28d8bf7dcc73cc2bc2158ed7879cb782a93abcbb3283ce9
- MD5 56a02b767f11b7cca37b6f2b81fde6e8
- SHA1 67cf64c8c639dddbfda6c5198318879cfc605e7f
- SHA512 df8b1d3ad599a6909f8aa51196d54e2bb297d963dc068964bd12b7872964058f2921a6a3803d470af5a9f92c3a15aa44ca84387ee10ee5a91fc8df71ddab0c73
- SSDEEP 192:JOv5zboBZHoyjMxz1d66Joz1zgCl6mc0dz:GboBZHoyjwd66Joz1zgC1jd
- TLSH T10DD1CB68F628963BC409023BCDAA1B400F36399B9C5E7F1A31DC645D2D572DE368E17E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 d3d0a39b8d728b6c20a4e7bff00cee046e537a08f517ee664c15f8d957e78cf9
- MD5 e9faed554b49a3ec3df22d5e01f93a4a
- SHA1 1d1ca27832b5b834aad515e1349efec7fb05b3d4
- SHA512 5f6e685f81966e7e5e89fa87f6e19a15bbcfd0d7831ed5bbb5e631809d0f9b98ba7de33319d136a43b85443727dfb551eb7320c160b24b9b01546423d9e3415e
- TLSH T168214B5C39B94D2AD9C7E65C7C4111CE93518E0648C71D470E22EE8DDEA1AD9327A82D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\events\events
- Size 5KB
- SHA256 1bfa0f4d4352902abdf4a068e551919080bea90d21ee50f5a5bcbb9c8ab76d7f
- MD5 35f3824064b95e952812144af67e2212
- SHA1 392bb4be3b6091d681b593caa58f5d110d53cdb6
- SHA512 ec2b7e5f11266f2024f836e60390dc6247fd65641f4b68a109cf40856db22d2ab202d9bcfff45fbb783c222d0a8a9815a039c187330ce7e0fcf418d8b8a66289
- SSDEEP 48:YrXyPbYs8A/YPpZv+7wrYXn/zsJ0PFPY3HFK2bwkhGXZF43SMxESMtO/dSz2+s3v:Vaf0NY0pF4rdRKdliXzjY4F17DV069l
- TLSH T15AB1022C34F80C7E99D7D75D3C8153EEC79C4A0289871C0B4D6BFE89CED8A9A3269564
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\pending_pings\0090bec0-cce5-48cb-ae3d-e93f0786c79d
- Size 886B
- SHA256 9082a42f3fc0b1bb79e5675c2efbf82567b1316712ba5724751f0cd0f9e71647
- MD5 f2b2704650809ab4971752cc8d0fbc4b
- SHA1 dae2bd8ebfe5170e76928f46ba47d126f7e9ed86
- SHA512 71278a2290c984bf2c7b688f3bf3d9c42c3fcfc11ea4f6ca01c5a78aa74ff76b51687a9e9edddab107f6d56a2f8148fad8fc263abb5b2d9eb0fad4e4611a8b0a
- TLSH T1C71104808A74B6B2CD649287D59477434BE0752384C94C143D945F180EAE51E53A6607
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\pending_pings\79135e8d-9290-4f69-80c8-9eaf9353a274
- Size 12KB
- SHA256 20e66cfdd3b7fd369fd8d68211a6127f091ebf570e209232bc8214c2e9847fcc
- MD5 67f99ee976af2fec3b2198fa8b657392
- SHA1 7b482e87ffc3d211398cdc57516d1bf8394b1046
- SHA512 821e0e0b7eecd4dee5f4c03db19e8693c4589950187c8decc5d8220be422eb10c02a41a51d17fe0a35010cb36e00b84ac47affc5b32ff1332e45b8a471155529
- SSDEEP 384:fQBYVsHmRmD4K9Z5WySleQALn1ne8iXVBangbX:fQBY2HmRmD4K9Z5WySleQALn1e8KVBaY
- TLSH T19342CCFEDC2241433A66E52DF1E8ADAB005609314ACEC7DC65FE4C3A32D2AB7561B314
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\pending_pings\7ee2ffe9-9017-4c24-a147-3dae456746c5
- Size 2KB
- SHA256 7e2b0227543258bcef2c209ace51f59e0685e1a22fa818b68eef864d2ed952e9
- MD5 8fb4d91b89958a557ff2143cfe87d231
- SHA1 bb8faf8fc94d77e3cb21d0cded63a4b43fa46a24
- SHA512 3e0d19037fc85401689f8daf56be22a0b2f1c891c0f85678c26dfd34b1520f9c1af75898a1411b618215836118a125d09cd117ed8f32a7110ff7e28daa7b9c59
- TLSH T1FD41546C35785DBB8DD6E59DD885339E47A1490310C61C432D62DE0CCCD6F6A336B82B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\pending_pings\83c9655c-edc5-46bf-b944-fb89a9c4a744
- Size 883B
- SHA256 568e1d30e7baab4f54b6d1d291449850f62e080bb7888c1ac268198df00d59c2
- MD5 f968468c9a38c5e4ca32cd2e2f91bb93
- SHA1 6a1e92758a752f14785e344654885b8e37a14e9d
- SHA512 6edbf9f4a51d385e4bb94d72b9098e71462b9469213dd26347aa525128c6f2d75dcfec85ef3c3a4b7e9a50d2e73ae2f6496548ad891a85be0609c514ff1a2692
- TLSH T16E1127419674FAB2CD74924BC95977524FF47523C4C9C8143DE05E080D7F61EA36674B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\pending_pings\855af726-3043-48f2-a19b-36f3eb3caef1
- Size 235B
- SHA256 9fa06180447a1e4c2e52f7cfe520802512da59a90da56a63c396e0340abf7fa7
- MD5 8b00967748bbe61410764c379e0c7af9
- SHA1 7e2d346245610f7bc4f9ec4c4c57c1da16662cf4
- SHA512 2c8610d8d5be53be6a88aece010a3a9f4b6989d1a513b1204237f441972b14d89f31666ea9b0b219b64deda424cf92cec6befa250c99e9dbcef1b9e0731eb807
- TLSH T141D0978828B8676C48140F0AB0E078D239444D3B54A1AC50F55085788ABABC8021382A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\pending_pings\98e88913-11dc-4622-ae92-4bb241ad2db5
- Size 235B
- SHA256 9edbfa887c3041a360b9ca9608fe8cc95799cd54123815bedb350e29f3b738c9
- MD5 20694ac823e5dabafef3d81063358fbc
- SHA1 08fbad44254ab4b2faba74c06c1baf699f4c3512
- SHA512 8e8d986f8fcd582feefc5e4b4a49c55f9b48379f38fb2ec0f0b8e4e772f9529b7a553eb31a400076d79c985ca53afbec97f0047a67ba9560d200c11c05a4c013
- TLSH T122D0978414EC376E48244F07F0F069C330844C3310F15860EAA182348AF8ECC0313807
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\pending_pings\cf8d8f6d-337f-4860-ad65-a7a1a5a14f70
- Size 16KB
- SHA256 e512141f37888b883d8c3f283563a743e6a98120741d5f055fb56deb4f6c112e
- MD5 ccb974f623c18d6104b867692b6580a1
- SHA1 1d9597e0452c2efe3a0e024666667a90ef55a73c
- SHA512 80c794ce88c4680c9e378485e4e3baaa7ddf8cee0fe783f825222afd305476f5277785fcb8cb2ede1ea0c02398eb55f92821f7aa056f019526aa85edaba8cf6f
- SSDEEP 192:IwyCTDlZBeesga9GldVlqZlz0c17dvwnJFFyFv+E9a2Pz0lz98IPibbNELulBS7K:/IBwJHyF2E9pPzaB8IPibbOLAcI/0j2
- TLSH T1B672EA166860457A8791D79DD4F8BFC3E5F628CB4C418FCAD7E4BE0829DE0AE112784B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\extensions.json
- Size 16KB
- SHA256 262bd792c571113b1ea63a450f77c213a182690fd881d04ee7c2ed753befb320
- MD5 8750390304725a4af2c56dd75271b1b2
- SHA1 2371201bbfe211b6ee157072b9de3861d4a1e711
- SHA512 2c7b069093ea8bd964c942830831daa2b2c592fe487d5727d93f7f00f8fec3a085853b8dde55efc34bc5c9c22f3805bed9f86457fd560b95cd83658d46988d9e
- SSDEEP 384:zkI4vW9UmldvHM8dhWa94zjD96oqL4HML4P2L4HuL4HGL4Hpx4hk:QI4ARfVXn4J6D4m4U404M4L4+
- TLSH T17972411545049EB8294EA78AAA36BE01C37D473B60845C78F4DD8FC842FB5B902FB65B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
- Size 1.1MB
- SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
- MD5 626073e8dcf656ac4130e3283c51cbba
- SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
- SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
- SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
- TLSH T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
- Size 116B
- SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
- MD5 ae29912407dfadf0d683982d4fb57293
- SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
- SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
- TLSH T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
- Size 1002B
- SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
- MD5 dcffff15fa618a53834ee4ae8673bd23
- SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
- SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
- TLSH T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
- Size 21.6MB
- SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
- MD5 d14dd3f0107ff91c3e21f301d83f82b0
- SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
- SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
- SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
- TLSH T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\prefs-1.js
- Size 6KB
- SHA256 b1f5e91c6be6ee9625dc8ead07f80a37ae08cfb29fdf9d122554ec818819e78b
- MD5 aee7c034d402e47f5cd9b9d307bf93dd
- SHA1 c3f49d6c79381328d06f8571efb72110f8fe3e8f
- SHA512 3321534a8265162dc17bcc07d37f71ad6e9a3f8bda9fed78c43bc771ca4da3dc7fe3e3fb69914c611ac2fcefa800263cb67a8cd8852eb0c0175439815729cca3
- SSDEEP 96:xHLkUTUiqGq2fkkFkzSfSSlNdv9jvn+H/vukBw88P8L4cn+r5GS:KVR2fkkFVSS0nukBw88n
- TLSH T16FE1307894088F7F74B676ACAC6888315AB2013B7BBF68D750B558C4010CF3446F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\prefs-1.js
- Size 8KB
- SHA256 d115f43e60a51f971e79681d53edbd0c610fab0d8cc5048f88627ce74aeb6833
- MD5 7eb3719d018ef36892f285d5df93a66e
- SHA1 878c260ea7cf61846000d749073a097d7d079cc4
- SHA512 c6a569a904aa11d0759e46ccc235a44abb045606438c1137f3ccf324d3e2097c327fffd848cdfe1b7a103c01faded2586381c95fcc9491a8db4983aaaeca1396
- SSDEEP 96:xHLk1TUiqGq2fJkFNbzSfSSlNdv9jvn+WRPbvuIBw88+0RE8L4cn+r5GS:KIR2fJkFaSSRRjuIBw88DA
- TLSH T1BD021F3C5448CF7FA4B6767CAC24497199A2023BBBBF68DB10B95485011CF3445FAAEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\prefs-1.js
- Size 6KB
- SHA256 970f74b59a7a0b14e69304078619047b2c01717766d2412127764a732fc8d78b
- MD5 6abc43c8cbf232d12b4f485cdc5191c0
- SHA1 c5ef5e212408439330a0e5613c0aa6a409f3cbe7
- SHA512 e6ec2e2db96e902ffb640bab30ec276f145fbc2a3b8da188d31fbfa23aa6f42a8b13a6996d9949c6e16e842e445205a6d2a1b9f88c2a50cc201497b463c2b8a0
- SSDEEP 96:xHLkUTUiqGq2fkkF1zSfSSlNdv9jvn+H/vukBw88P8L4cn+r5GS:KVR2fkkF2SS0nukBw88n
- TLSH T13FE1107894088F7F64B676ACAC6888315AB2013B7BBF68D750B55884051CF3446F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\prefs.js
- Size 6KB
- SHA256 153173b9c53386eb41d1eb9a59b24cdac85788ce4aa9226a5264e1bc70b495ba
- MD5 3935494d6323c5265eca1ac78b73124a
- SHA1 ee0d9a8b6f6a349f9f8e42e7daa8b947f0c5ff61
- SHA512 93fd1801b52da9504a60c920d662ea4fda6e5f20a3bf4d88c2e70943facb1dbadc8d65053a6fc30fc65494271c0c57a3155e1590ba81393f36695cf4176f8693
- SSDEEP 96:xHLkUTUiqGq2fkIj1zS6+SSlNdv9jbn+H/vukBw88P8L4cn+rM:KVR2fkIjL+SS4nukBw88A
- TLSH T14AE1307895088F7F74B677ACAC6888315AB2013BB7BF68D750B64884010CF3446F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\prefs.js
- Size 7KB
- SHA256 a51221d33d6ae59c7028b6f6c61935eb78f46bab0a5212ffcb0c7a16b84856b6
- MD5 9ae73a7cd6fa51118e0fdb9e0e1f3c01
- SHA1 a50604504e14e248729c61d4089748fdd543423a
- SHA512 1338f4892046c4c88a4c7c35d573b5587ca207f099c5e5584713bcd0797983504de6fe7f910639c52740293f6ec3940629db6365e9db86943af8365b8c58077b
- SSDEEP 96:xHLkUTUiqGq2fkkFNbzSfSSlNdv9jvn+H/vukBw88P8L4cn+r5GS:KVR2fkkFaSS0nukBw88n
- TLSH T149E1307895088F7F74B676ACAC6888315AB2013B7BBF68D750B558C4011CF3846F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\sessionstore-backups\recovery.baklz4
- Size 2KB
- SHA256 b34cdf21b491a6549e26b1008346626036f97e03d693fdc6965e7189a8151209
- MD5 ec5f7c6da8226bd91dcf70d88cb73523
- SHA1 30ab071bda9fa3e52d3447fb71acd732133606df
- SHA512 f6cc9396174df49ac2bd65c666abdaee723b88fe02827fd09221982eca0dea53db70f1051604bad9dde44b2e9154f4f3bfa11e6524668c3372b897bf29876aa2
- TLSH T17A4109EADCDA5FF31931C059D0C02BEBF6A3501352D889F4DC51CB0619A82977AAE649
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\sessionstore-backups\recovery.baklz4
- Size 5KB
- SHA256 8a4f5319713dc773c2d13e03443a8d27ccb58a544665d723d8fa3cb0455fd55f
- MD5 13118a2b32860e00aa84fc6dfd3577a4
- SHA1 e2a6cf65e4dc8ea1577c083d6bbc6d8ac627db39
- SHA512 d7d57e98a62825a5b09dc6d01deb7cf8d173249d7ed8bb63977ab68144cb35a2ede53b1489b8d1dc8ca65430c42023a47da37af7ca0d9f73642eea9ceaa345a0
- SSDEEP 96:o2O54nj69M1qA9XgrN/pq4I9X2dipjJdm0GUsZ/TdCZz/s:o+m9LAZgZhq4ICSNATZTdCps
- TLSH T159B17D9BDEBACD5A457289948CC53B7ED3F32043D2EC081CD8158B1F5AB8956731D38A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 4.2MB
- SHA256 f866d56f5f6c254403b5318c93dabe59a046818050f06f49e972c542a535cc66
- MD5 5dea72e3fff943101638e068a824cd8d
- SHA1 278d1a264bea1ca17438f691eaa3bbba127fe9c8
- SHA512 97734c6eb55d128734a74ecfb9ce09542f3ecb20147417912c18b5adc91f3f18d9824cf5864c97804d3afdeadab2c404945877728afb73b111a86faac5fae60c
- SSDEEP 49152:EDmgOugQA5lUT2lAecNxazvgiRBb4xYegN:8m7ugF56T2yzxazvgi1N
- TLSH T1BE1639F820D1A257F3818037668563EB21AFD00C6477DD444BE966F994B8CEF9E05B2E
- MD5 SHA1 SHA512 SSDEEP TLSH