Analysis
- geolocation tags
nanew-jerseynorth-americaunited-statesususa - user interaction
yes - max time kernel
95s - max time network
99s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
20/07/2026, 14:07
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://cdn.discordapp.com/attachments/1469733424745939067/1528765269193920734/mapspoof.com?ex=6a5f7d1b&is=6a5e2b9b&hm=931578b1ce4717e2077844fc437408fa81268334b31b9ae48c7b0c76d45c0fc0&
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
15 signatures
300 seconds
General
- Target https://cdn.discordapp.com/attachments/1469733424745939067/1528765269193920734/mapspoof.com?ex=6a5f7d1b&is=6a5e2b9b&hm=931578b1ce4717e2077844fc437408fa81268334b31b9ae48c7b0c76d45c0fc0&
- Sample260720-rfdy4aew2v
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
flow pid Process 16 2792 firefox.exe - Executes dropped EXE 3 IoCs
pid Process 412 mapspoof.exe 5024 mapspoof.exe 2696 mapspoof.exe - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 81 ip-api.com - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 22 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings firefox.exe - NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\Downloads\mapspoof.com:Zone.Identifier firefox.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4708 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 2792 firefox.exe Token: SeDebugPrivilege 2792 firefox.exe Token: SeDebugPrivilege 412 mapspoof.exe Token: SeDebugPrivilege 4708 taskmgr.exe Token: SeSystemProfilePrivilege 4708 taskmgr.exe Token: SeCreateGlobalPrivilege 4708 taskmgr.exe Token: SeDebugPrivilege 5024 mapspoof.exe Token: SeDebugPrivilege 2696 mapspoof.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2792 firefox.exe 2792 firefox.exe 2792 firefox.exe 2792 firefox.exe 2792 firefox.exe 2792 firefox.exe 2792 firefox.exe 2792 firefox.exe 2792 firefox.exe 2792 firefox.exe 2792 firefox.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe 4708 taskmgr.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 2792 firefox.exe 2792 firefox.exe 2792 firefox.exe 2792 firefox.exe 2792 firefox.exe 2792 firefox.exe 2792 firefox.exe 2792 firefox.exe 2792 firefox.exe 2792 firefox.exe - Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 4904 wrote to memory of 2792 4904 firefox.exe 83 PID 4904 wrote to memory of 2792 4904 firefox.exe 83 PID 2792 wrote to memory of 928 2792 firefox.exe 84 PID 2792 wrote to memory of 928 2792 firefox.exe 84 PID 2792 wrote to memory of 928 2792 firefox.exe 84 PID 2792 wrote to memory of 2336 2792 firefox.exe 85 PID 2792 wrote to memory of 2336 2792 firefox.exe 85 PID 2792 wrote to memory of 2336 2792 firefox.exe 85 PID 2792 wrote to memory of 2336 2792 firefox.exe 85 PID 2792 wrote to memory of 1348 2792 firefox.exe 87 PID 2792 wrote to memory of 1348 2792 firefox.exe 87 PID 2792 wrote to memory of 1348 2792 firefox.exe 87 PID 2792 wrote to memory of 1348 2792 firefox.exe 87 PID 2792 wrote to memory of 1040 2792 firefox.exe 88 PID 2792 wrote to memory of 1040 2792 firefox.exe 88 PID 2792 wrote to memory of 1040 2792 firefox.exe 88 PID 2792 wrote to memory of 2700 2792 firefox.exe 89 PID 2792 wrote to memory of 2700 2792 firefox.exe 89 PID 2792 wrote to memory of 2700 2792 firefox.exe 89 PID 2792 wrote to memory of 2700 2792 firefox.exe 89 PID 2792 wrote to memory of 1284 2792 firefox.exe 90 PID 2792 wrote to memory of 1284 2792 firefox.exe 90 PID 2792 wrote to memory of 1284 2792 firefox.exe 90 PID 2792 wrote to memory of 1284 2792 firefox.exe 90 PID 2792 wrote to memory of 2432 2792 firefox.exe 91 PID 2792 wrote to memory of 2432 2792 firefox.exe 91 PID 2792 wrote to memory of 2432 2792 firefox.exe 91 PID 2792 wrote to memory of 2432 2792 firefox.exe 91 PID 2792 wrote to memory of 3996 2792 firefox.exe 92 PID 2792 wrote to memory of 3996 2792 firefox.exe 92 PID 2792 wrote to memory of 3996 2792 firefox.exe 92 PID 2792 wrote to memory of 3996 2792 firefox.exe 92 PID 2792 wrote to memory of 4952 2792 firefox.exe 93 PID 2792 wrote to memory of 4952 2792 firefox.exe 93 PID 2792 wrote to memory of 4952 2792 firefox.exe 93 PID 2792 wrote to memory of 4952 2792 firefox.exe 93 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://cdn.discordapp.com/attachments/1469733424745939067/1528765269193920734/mapspoof.com?ex=6a5f7d1b&is=6a5e2b9b&hm=931578b1ce4717e2077844fc437408fa81268334b31b9ae48c7b0c76d45c0fc0&"1⤵
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://cdn.discordapp.com/attachments/1469733424745939067/1528765269193920734/mapspoof.com?ex=6a5f7d1b&is=6a5e2b9b&hm=931578b1ce4717e2077844fc437408fa81268334b31b9ae48c7b0c76d45c0fc0&2⤵
- Downloads MZ/PE file
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2008 -prefsLen 27100 -prefMapHandle 2012 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {e3f8730e-6373-4f8c-a34f-dd8d3800cda3} -parentPid 2792 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2792" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵PID:928
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2500 -prefsLen 27136 -prefMapHandle 2504 -prefMapSize 270279 -ipcHandle 2512 -initialChannelId {e08a3b6b-8f27-41de-a272-0a5ccca2e222} -parentPid 2792 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2792" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵
- Checks processor information in registry
PID:2336
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3768 -prefsLen 25164 -prefMapHandle 3772 -prefMapSize 270279 -jsInitHandle 3776 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3784 -initialChannelId {6c5d856f-20c2-41bf-bcc4-7f37cd31a5ce} -parentPid 2792 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2792" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
PID:1348
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3936 -prefsLen 27277 -prefMapHandle 3940 -prefMapSize 270279 -ipcHandle 4024 -initialChannelId {f7eaa6c7-c843-4aa1-96ab-f770f9792d24} -parentPid 2792 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2792" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵PID:1040
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4396 -prefsLen 34776 -prefMapHandle 4400 -prefMapSize 270279 -jsInitHandle 4404 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3120 -initialChannelId {906da0f7-664e-45b1-a63b-54548b864951} -parentPid 2792 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2792" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
PID:2700
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5016 -prefsLen 34825 -prefMapHandle 4984 -prefMapSize 270279 -ipcHandle 5028 -initialChannelId {7b7c64a8-5e29-4985-984e-88fab426200b} -parentPid 2792 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2792" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
PID:1284
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5284 -prefsLen 32952 -prefMapHandle 5292 -prefMapSize 270279 -jsInitHandle 5296 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2816 -initialChannelId {b0c82407-21cb-4d8b-930a-3d301b12b674} -parentPid 2792 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2792" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
PID:2432
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5372 -prefsLen 32952 -prefMapHandle 5376 -prefMapSize 270279 -jsInitHandle 5380 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5388 -initialChannelId {1293c7f4-403c-4e2d-88d2-928f83abcb68} -parentPid 2792 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2792" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
PID:3996
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5636 -prefsLen 32952 -prefMapHandle 5640 -prefMapSize 270279 -jsInitHandle 5380 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5372 -initialChannelId {8579953a-7d90-46c8-9c1f-ab9b914c3105} -parentPid 2792 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2792" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
PID:4952
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2980
-
C:\Users\Admin\Downloads\mapspoof.exe"C:\Users\Admin\Downloads\mapspoof.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:412
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4708
-
C:\Users\Admin\Downloads\mapspoof.exe"C:\Users\Admin\Downloads\mapspoof.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5024
-
C:\Users\Admin\Downloads\mapspoof.exe"C:\Users\Admin\Downloads\mapspoof.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2696
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 11KB
- SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
- MD5 25e8156b7f7ca8dad999ee2b93a32b71
- SHA1 db587e9e9559b433cee57435cb97a83963659430
- SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
- SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
- TLSH T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 502KB
- SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
- MD5 e690f995973164fe425f76589b1be2d9
- SHA1 e947c4dad203aab37a003194dddc7980c74fa712
- SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
- SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
- TLSH T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 566a563bc5ddfa3cdfef214551170fc2033cbecc97566280e115d0d86466f231
- MD5 f6d305bf4a5451de988c62b7e23cd489
- SHA1 dc6972223b3885040e37fcde0a8766b28c9d1ba9
- SHA512 73ff9b47513a9b717f01844cd3f3c7afe94b71346c04296d812a95db3788b3a8f731b886a7e7b19580671de468b9f3e06b3d2bbe534e39b0d255c96d7dd5481b
- SSDEEP 192:bOv5zboBZHoyja+1d66Joz1zgCl6mc0d:EboBZHoyjdd66Joz1zgC1j
- TLSH T1F9D1BA68F629463BC408023BCDA51B400F76399B9C4E3F1631EC645D2D5B6DE768E1BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\db\data.safe.tmp
- Size 33KB
- SHA256 54a0af14e83433d72db53cea3cc53cccf5d00c296878642bff43e5dc4ba4b0ff
- MD5 9912a9beb368cef3d935149429973add
- SHA1 107766e4f928837f58c289a73a6ce6b7c5ea65ae
- SHA512 7034cfb608a40cca95adccdc04b816961bc59713c6305abe92262a15e0ef3baa6b355ef018fcf8db5423bbc4aa7997d4ec38c9a757e9307d34e60a2cbaeb7d8f
- SSDEEP 768:rpBPrwAJlnnuGcmhucW9AKWFKrjFlRbbbtbYbdbw:HwAJlny9AA
- TLSH T1D1E2EE44FB6A913FD41412BBDCA51B002F79F88A58192FA73A5C64686C872DC3D9E07F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 67e697ba854c01d9deaccb63fc005636f2d214a850747f819f267dafba712d64
- MD5 64fa54cae80af9abb815364bc995306d
- SHA1 836b547ea0ab075deebd7a001a6416abf8dcac23
- SHA512 79ccb636452e34e0dcb3bfca80bddfca7afdb2ba679fbe029835e7c46edf2cabd813e2fd9e033fe58f85a5d8b35b4e2741ae46a0eca43995a2cac05ac3072b80
- TLSH T1B021285C3DB98D2A99C6E29CB48113CE63954B47148B2D430E16FE8DCE95FDA316A43C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\pending_pings\210524d6-6fe9-4a98-8b13-6994c870db9a
- Size 886B
- SHA256 2a0217100f891e7831a4d7cb32fdef8d97c70d36c65065f822c9c35957d5b98a
- MD5 167b02595ac44b9ac0359a6d84b6afed
- SHA1 982cb2af4c5fb7beb0c3680deef21aa6386371df
- SHA512 15a23c929a1f583f23b0d2a1675902ff1d1318f1f52c594b3813aabbaacff03275a86c1ed5f515686cfd6aa6c4146532646c12dc9369abfadcede1e5a8d8fd5c
- TLSH T17911238187B4B6B2CD74D28BD4A07B438BE0B42780CA5C083D644F080EAF52EA36760B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\pending_pings\3304ee2d-a7af-4cd5-a2d6-05eb8faf2c25
- Size 235B
- SHA256 ca080e40e0b95f3e89c4f81ce0c1f9983d9a59d21fd7d1a9ff580f955e587bcc
- MD5 1e3dbbb6cb07d60d44984a50d1866d12
- SHA1 5d44715413857505e49c7a5b99c212448cbe59d4
- SHA512 a67261044a49ea67fdb1cbce9841b7a959ead28a048ec0c2be393ee7d6b8b0876dc94351f9442722272a0d59c5021facd2f12ee818400667d1826402d9205723
- TLSH T108D097802C88A7AC48280F5BF1E029CBB0884C3324746824D9B240B89AFAAC84161C0A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\pending_pings\33445625-0bc9-44cf-a65d-3c57dd02c8af
- Size 16KB
- SHA256 ed96606f3c8cdcaa1273d83b00ace6caeca637c384fe89b25cb7da0bd12e7efa
- MD5 09d3cbf56ac65c81812ff4ee36799d2c
- SHA1 022f22da3371f1337e5e5db742f852c2c7e24f55
- SHA512 fd0da1fced3dd01ed4aa231d3e3362c9b7b40c72df632bb35fe2f3f74b04f0eeafe9d96ada446f28fba53383e61391dff85feb99031bd7762ccceefe8ed01e0a
- SSDEEP 192:JlzxRRjC1kCk0kEueVUliLhwfhA+c6qlaNw+kWVd1dmLwBWD9DKvJeQHX+oNFk8C:JllRRjC1kQkEKnow6FKvQ1ok8cv
- TLSH T11172EA166860457AC791E39DD4E8BFC3E5F628CB4C419FCAC7E4BE0829DE06E112784B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\pending_pings\36f68a00-2ee3-4d04-a36e-79ff98295028
- Size 883B
- SHA256 101c7ebcd38fef531283f142440d19a64f44f56ef59194ecf71196dae984d0b6
- MD5 2dd1db2b2d955d9893c183a9d07cefc1
- SHA1 21b17917a51aea13c2c8a098b309f21e19bda4c9
- SHA512 b94fe9ad9be4b25fa1528cf2bb496e817d8c8a7dc1b5ebbf0b762e2e7ebcb2cb43018c9d3f651de5e6860da024cfe33312d9081a83c6a6bb774ba0253960fcff
- TLSH T1E21123819670B7B3CD68925BC65537034FE4793384C958143DE04E080DBFA2EA3AB64F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\pending_pings\691bcb1d-3320-4799-a9c1-bdd34cf04c30
- Size 235B
- SHA256 5bb1d51adad758c438deb7cc1d67c9ab149234298811469299c190b519499390
- MD5 1d231e4308d6b0ad3d2ea34e5c07998b
- SHA1 94d17169153974d4e535e51000a426d3790132c7
- SHA512 5fe6c353c4279c437d6bcd6475f6c17d200a78adf55027485c5c8d6560249985317dddef184d65ffb20b36499e1e31f2fb0f855e03eccfe46cf8215efa73c735
- TLSH T119D097806898239E58000F07B0B06ACA324C4C3352756824C5A04A74CEF8DC80161827
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\pending_pings\70a04ee3-fdb1-4004-85d8-a061ec474b71
- Size 2KB
- SHA256 8d6bf831d9f6ad87d71bed07804df2a400b8c15294d8b1647b2e99ef150df11f
- MD5 95efaa35cb24ec9cf958b0f385afbcb3
- SHA1 10c57f8f8c910ea79da9a83ec3ddcd7c1113ee26
- SHA512 2ae8ad09bf1fda3819e005c55e4f169422c211bcd92f9b1e2091ddecc54454874c68aa505023c3e1eb757c8a065fde5e2e3edeaacff2c6095ba1ab52bb1d2aee
- TLSH T14041436835B44DB6CD9BE18ED451338E07618A1750C61C436E62DF0C8CCA6AA336A42B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\extensions.json
- Size 16KB
- SHA256 e9434d97b834c649baa9503a2aa81cc2e23a94f5cfeda1f1aae4e926b19eb973
- MD5 13414d8d46db7c103e859afc4e8f38c1
- SHA1 e5914578b5ef685bd8554591e84f30c256567b45
- SHA512 22e558f6cc4bf4bb953ebd82ec2cb52356bdef774382c188eefc3c9134ed5ab09c3da177c31193beb3f3cebcc45fce407b01bc70181f5b52d2e515dbe3f53db0
- SSDEEP 384:zkI4vW9UmldvHM8dhWa94zjD96oqL4HML4P2L4HuL4HGL4Hsc4h7:QI4ARfVXn4J6D4m4U404M454p
- TLSH T10E72411545049E78294FA78AAA36BE01C37D533B60845C78F4DD8FC842FB5B902FB66B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
- Size 1.1MB
- SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
- MD5 626073e8dcf656ac4130e3283c51cbba
- SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
- SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
- SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
- TLSH T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
- Size 116B
- SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
- MD5 ae29912407dfadf0d683982d4fb57293
- SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
- SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
- TLSH T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\prefs-1.js
- Size 7KB
- SHA256 ccde470e6088451f53afa0627c332c96f57c781a8f0b5204d54f30816c4758c7
- MD5 4b0deb3dad940e19850152398ec03d2c
- SHA1 c2855c190fd7a914cef37cbf3d56fb54b4956a90
- SHA512 841d6e7372ff4ebe7b4a017bde74f880555018f74d273ffc8ae742e90274dcfe3a6661ba3dcbd84848009370f1add0c83127b85ebad54dfa4964a1dc669f95ef
- SSDEEP 96:xHLktTUiqGqXfk+FObzSNSSlNdv9jKn+H/vukBw88A8L4cn+VM:KwRXfk+FrSSBnukBw881
- TLSH T1BCF12E789548CF7F64B6366CAC2449315AB2027BB7BF68D710B958C8010CF3845FA6EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\prefs.js
- Size 6KB
- SHA256 c87d9335d815aabb3697fae887f87ab4aea702c417af7ca84ce5d8bcbb786851
- MD5 4db279c1f8f1b1a87a8aafaa652ae16f
- SHA1 6306c39db16d46cd2e582d480faf7daf3d436c49
- SHA512 0d9a9d77ff575f0b694af9e2c6d0fbe016b81f640c23425aba8e0cc2687b8a27a031304f12a79c28d813ca28df242c9dacf68c8ffa7b1001d8539e7c8deba774
- SSDEEP 96:xHLkUTUiqGq2fkIj1zSsGSSlNdv9jOn+H/vukBw88P8L4cn+rM:KVR2fkIjBGSStnukBw88A
- TLSH T1B4E1217895088F7F74B677ACAC6488315AB2013B77BF68D750B54885050CF3446F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\prefs.js
- Size 7KB
- SHA256 87a7f47769bc71aad0480c4656d75ed3de0b6467b70ad2f7ad07621fcbc20377
- MD5 ed5d32ddfc1760328a2177e653964031
- SHA1 71eb2e6536092be0c227d4e637ff15a5aea283b4
- SHA512 5a7b74c8dac832e288863dd60df6b30d53f792ea982152b9132c7c010d5489602b8b48a003e23dfb64679de91adfa8bcf26135c2fffd33dce07fb35b738c5e40
- SSDEEP 96:xHLktTUiqGqXfku1+FObzSNSSlNdv9jKn+H/vuCBw88V8L4cn+VM:KwRXfku1+FrSSBnuCBw888
- TLSH T13CF11E789504CF7F64BA366CAC2449715AB2027BB7BF68D710B99888014CF3445FA6EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\prefs.js
- Size 6KB
- SHA256 8d4775406b81696acdb5f84f974b2bd194a2a97b09cccc893c4aa4b4542dc11e
- MD5 bc93a1a0e570183c3a13f080a9250808
- SHA1 98361c3a1fa28b0f95be4e47d747c6a88a09ad42
- SHA512 96d7c911d538998f7db89e943c1939df8f6871efc404effb0a9cec9ab9a63f5814e944c4caacbe0d21a2f742839d7d0fd9aab5873d7f9ee195be95c6af0a2012
- SSDEEP 96:xHLkUTUiqGq2fk+F1zSNSSlNdv9jOn+H/vukBw88P8L4cn+rM:KVR2fk+FQSStnukBw88A
- TLSH T139E12F7895088F7F74B676ACAC6888315AB2013B77BF68D750B94884010CF3446F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\sessionstore-backups\recovery.baklz4
- Size 1KB
- SHA256 06df442bec9bd8fed3c55fb0cf6baacebbcc7363e7a007f4609b51029ac5d441
- MD5 07ed642c4af5bd83898daae679a40e9f
- SHA1 30f93c8cdfb69010844c711917ff99e93d034a99
- SHA512 1499c9f511836c96982060498cc0fd81860616e1298d3d3dd5ba43fcff6ca417663671c23c6cd456af6cc4dc71fe088885df0aca32d38a63e804e2a7e2ea12ed
- TLSH T1832119D3890A2EF635805E6DCC0B0BF6D65C34604AF504F0D1ACCA06A8CD94F3BD251A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 4.1MB
- SHA256 52b87f9907c14ca7d93203bc64f8e149ebcd495faa8c4c1447771a4c8d308ac8
- MD5 fd1d80d1ebcbe5d5273f08790ab0f2ca
- SHA1 1121895b4b091c90eca47171c59f947bea54437d
- SHA512 9ca472e0c18b66599ef115494f7d77abfb44f5283268de34aa9c3e01c706f9346064a90f41a54dee9e8ee33324d2cbf5af7d33c501a0e8c20a71f63990d36e26
- SSDEEP 49152:PDmgBukjA5lUv2D/TcNeaKvgmRBbFOYFg/:7mUuk856v2jceaKvgmm/
- TLSH T1D31639F824D1A257F3818037668563EF21AFD00C6467DD484BE966F990B8CDF9E05B2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\mapspoof.com
- Size 131KB
- SHA256 84377d4574463226339031a6914598ed33c87358d8a0de9d36eb99af21e92540
- MD5 30f4ba2d780a879725ecf31b1f0c307c
- SHA1 251717325d622187ad83b1ffba74fdcf87016226
- SHA512 88e98f9e1d02b441a8df6ace5dc558e1b69fa80163ea6b23265f32cbfe3e1bb3b3519d7387492c6d0c74b600815f31c6b3d6add77c4b7464f6bf4bc3e9132030
- SSDEEP 1536:IvDWVk3Bg5Kl0Nk3Hk6q6uvNbYl++4pxORK07FjMws1TbOZG0dLmf8m:RVkAKlkcUtYn4p6v7Fjfmb6G0d6fP
- TLSH T163D33A6EBB824D16C94D5D73846320885779DA972227FFE720E8D8B45BE38DC8D8B4C4
- MD5 SHA1 SHA512 SSDEEP TLSH