Overview
overview
3Static
static
1wifiphishe...le.bat
windows10-2004-x64
3wifiphishe...le.bat
windows11-ltsc_2024-x64
3wifiphishe...onf.py
windows10-2004-x64
3wifiphishe...onf.py
windows11-ltsc_2024-x64
3wifiphishe...t__.py
windows10-2004-x64
3wifiphishe...t__.py
windows11-ltsc_2024-x64
3wifiphishe...uth.py
windows10-2004-x64
3wifiphishe...uth.py
windows11-ltsc_2024-x64
3wifiphishe...ons.py
windows10-2004-x64
3wifiphishe...ons.py
windows11-ltsc_2024-x64
3wifiphishe...ces.py
windows10-2004-x64
3wifiphishe...ces.py
windows11-ltsc_2024-x64
3wifiphishe...min.js
windows10-2004-x64
3wifiphishe...min.js
windows11-ltsc_2024-x64
3wifiphishe...g.html
windows10-2004-x64
1wifiphishe...g.html
windows11-ltsc_2024-x64
1wifiphishe...x.html
windows10-2004-x64
3wifiphishe...x.html
windows11-ltsc_2024-x64
3wifiphishe...dex.js
windows10-2004-x64
3wifiphishe...dex.js
windows11-ltsc_2024-x64
3wifiphishe...min.js
windows10-2004-x64
3wifiphishe...min.js
windows11-ltsc_2024-x64
3wifiphishe...h.html
windows10-2004-x64
1wifiphishe...h.html
windows11-ltsc_2024-x64
1wifiphishe...dex.js
windows10-2004-x64
3wifiphishe...dex.js
windows11-ltsc_2024-x64
3wifiphishe...min.js
windows10-2004-x64
3wifiphishe...min.js
windows11-ltsc_2024-x64
3wifiphishe...x.html
windows10-2004-x64
1wifiphishe...x.html
windows11-ltsc_2024-x64
1wifiphishe...min.js
windows10-2004-x64
3wifiphishe...min.js
windows11-ltsc_2024-x64
3Analysis
- max time kernel
148s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/07/2026, 13:31
Static task
static1
Behavioral task
behavioral1
Sample
wifiphisher-1.4/docs/Makefile.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
wifiphisher-1.4/docs/Makefile.bat
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
wifiphisher-1.4/docs/conf.py
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
wifiphisher-1.4/docs/conf.py
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
wifiphisher-1.4/tests/__init__.py
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
wifiphisher-1.4/tests/__init__.py
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral7
Sample
wifiphisher-1.4/tests/test_deauth.py
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral8
Sample
wifiphisher-1.4/tests/test_deauth.py
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral9
Sample
wifiphisher-1.4/tests/test_extensions.py
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral10
Sample
wifiphisher-1.4/tests/test_extensions.py
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral11
Sample
wifiphisher-1.4/tests/test_interfaces.py
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral12
Sample
wifiphisher-1.4/tests/test_interfaces.py
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral13
Sample
wifiphisher-1.4/wifiphisher/data/phishing-pages/firmware-upgrade/html/static/jquery.min.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
wifiphisher-1.4/wifiphisher/data/phishing-pages/firmware-upgrade/html/static/jquery.min.js
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
wifiphisher-1.4/wifiphisher/data/phishing-pages/firmware-upgrade/html/upgrading.html
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral16
Sample
wifiphisher-1.4/wifiphisher/data/phishing-pages/firmware-upgrade/html/upgrading.html
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral17
Sample
wifiphisher-1.4/wifiphisher/data/phishing-pages/oauth-login/html/index.html
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral18
Sample
wifiphisher-1.4/wifiphisher/data/phishing-pages/oauth-login/html/index.html
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral19
Sample
wifiphisher-1.4/wifiphisher/data/phishing-pages/oauth-login/html/js/index.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
wifiphisher-1.4/wifiphisher/data/phishing-pages/oauth-login/html/js/index.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
wifiphisher-1.4/wifiphisher/data/phishing-pages/oauth-login/html/js/jquery.min.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
wifiphisher-1.4/wifiphisher/data/phishing-pages/oauth-login/html/js/jquery.min.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
wifiphisher-1.4/wifiphisher/data/phishing-pages/oauth-login/html/oauth.html
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral24
Sample
wifiphisher-1.4/wifiphisher/data/phishing-pages/oauth-login/html/oauth.html
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral25
Sample
wifiphisher-1.4/wifiphisher/data/phishing-pages/oauth-login/html/static/js/index.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
wifiphisher-1.4/wifiphisher/data/phishing-pages/oauth-login/html/static/js/index.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
wifiphisher-1.4/wifiphisher/data/phishing-pages/oauth-login/html/static/js/jquery.min.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral28
Sample
wifiphisher-1.4/wifiphisher/data/phishing-pages/oauth-login/html/static/js/jquery.min.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral29
Sample
wifiphisher-1.4/wifiphisher/data/phishing-pages/plugin_update/html/index.html
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral30
Sample
wifiphisher-1.4/wifiphisher/data/phishing-pages/plugin_update/html/index.html
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral31
Sample
wifiphisher-1.4/wifiphisher/data/phishing-pages/plugin_update/html/js/bootstrap.min.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral32
Sample
wifiphisher-1.4/wifiphisher/data/phishing-pages/plugin_update/html/js/bootstrap.min.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target wifiphisher-1.4/wifiphisher/data/phishing-pages/plugin_update/html/index.html
- Size 4KB
- Sample260727-qsj57stcpf
- SHA256 1ccbfe4e2acda6f58b8f0b04347c2ffbf34ae36e64d7cc46a8fb76000bab0ba2
- MD5 3bc5705d740c8aeaef0726bba1eb3f12
- SHA1 0687d6eac439c4e1fc77a341ec896e68efbfde7d
- SHA512 675bdc0a24aafd3f28423792804fee6ad4fb99de5443e04781a17f2d330dbd63826b5259520f9113f51ad20cdba440fb03b7eb1083ecabe5b309c49ad56dfaa1
- SSDEEP 48:c36o/O/ssrxDHuJ21ZdnfT6gS1SjND4coC/xc4VSg6P:Fo/2s8pHD1jGgtqT2xaP
- TLSH T1E691546799FCA5570A32408569942BBB3EDAC14FA24B8640387D46B81F53C918C7F74E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 18 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2540 firefox.exe Token: SeDebugPrivilege 2540 firefox.exe Token: SeDebugPrivilege 2540 firefox.exe Token: SeDebugPrivilege 2540 firefox.exe Token: SeDebugPrivilege 2540 firefox.exe - Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 2540 firefox.exe 2540 firefox.exe 2540 firefox.exe 2540 firefox.exe 2540 firefox.exe 2540 firefox.exe 2540 firefox.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2540 firefox.exe - Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 2532 wrote to memory of 2540 2532 firefox.exe 86 PID 2532 wrote to memory of 2540 2532 firefox.exe 86 PID 2540 wrote to memory of 1544 2540 firefox.exe 87 PID 2540 wrote to memory of 1544 2540 firefox.exe 87 PID 2540 wrote to memory of 1544 2540 firefox.exe 87 PID 2540 wrote to memory of 3392 2540 firefox.exe 88 PID 2540 wrote to memory of 3392 2540 firefox.exe 88 PID 2540 wrote to memory of 3392 2540 firefox.exe 88 PID 2540 wrote to memory of 3392 2540 firefox.exe 88 PID 2540 wrote to memory of 3620 2540 firefox.exe 89 PID 2540 wrote to memory of 3620 2540 firefox.exe 89 PID 2540 wrote to memory of 3620 2540 firefox.exe 89 PID 2540 wrote to memory of 3620 2540 firefox.exe 89 PID 2540 wrote to memory of 2228 2540 firefox.exe 90 PID 2540 wrote to memory of 2228 2540 firefox.exe 90 PID 2540 wrote to memory of 2228 2540 firefox.exe 90 PID 2540 wrote to memory of 4012 2540 firefox.exe 91 PID 2540 wrote to memory of 4012 2540 firefox.exe 91 PID 2540 wrote to memory of 4012 2540 firefox.exe 91 PID 2540 wrote to memory of 4012 2540 firefox.exe 91 PID 2540 wrote to memory of 3768 2540 firefox.exe 92 PID 2540 wrote to memory of 3768 2540 firefox.exe 92 PID 2540 wrote to memory of 3768 2540 firefox.exe 92 PID 2540 wrote to memory of 3768 2540 firefox.exe 92 PID 2540 wrote to memory of 208 2540 firefox.exe 93 PID 2540 wrote to memory of 208 2540 firefox.exe 93 PID 2540 wrote to memory of 208 2540 firefox.exe 93 PID 2540 wrote to memory of 208 2540 firefox.exe 93 PID 2540 wrote to memory of 4824 2540 firefox.exe 94 PID 2540 wrote to memory of 4824 2540 firefox.exe 94 PID 2540 wrote to memory of 4824 2540 firefox.exe 94 PID 2540 wrote to memory of 4824 2540 firefox.exe 94 PID 2540 wrote to memory of 4264 2540 firefox.exe 95 PID 2540 wrote to memory of 4264 2540 firefox.exe 95 PID 2540 wrote to memory of 4264 2540 firefox.exe 95 PID 2540 wrote to memory of 4264 2540 firefox.exe 95 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\wifiphisher-1.4\wifiphisher\data\phishing-pages\plugin_update\html\index.html"1⤵
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\wifiphisher-1.4\wifiphisher\data\phishing-pages\plugin_update\html\index.html2⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2036 -prefsLen 27099 -prefMapHandle 2040 -prefMapSize 270279 -ipcHandle 2112 -initialChannelId {43594896-38a0-4203-83b4-9eb9329eec3c} -parentPid 2540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2540" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵PID:1544
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2492 -prefsLen 27135 -prefMapHandle 2496 -prefMapSize 270279 -ipcHandle 2516 -initialChannelId {038f246c-d84e-4e5c-a3cf-b8039cff0166} -parentPid 2540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2540" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵PID:3392
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2736 -prefsLen 27276 -prefMapHandle 2752 -prefMapSize 270279 -jsInitHandle 2756 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2892 -initialChannelId {10810572-e375-4f88-a2e1-93d13b747f12} -parentPid 2540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2540" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
PID:3620
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3796 -prefsLen 27276 -prefMapHandle 3800 -prefMapSize 270279 -ipcHandle 3912 -initialChannelId {78088d49-fec6-4ed7-abc8-4f48b2a97558} -parentPid 2540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2540" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵PID:2228
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4344 -prefsLen 34775 -prefMapHandle 4348 -prefMapSize 270279 -jsInitHandle 4352 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4360 -initialChannelId {ad817809-ccec-40eb-ac7e-e49b12473589} -parentPid 2540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2540" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
PID:4012
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4204 -prefsLen 34931 -prefMapHandle 4660 -prefMapSize 270279 -ipcHandle 2980 -initialChannelId {0a2ec364-1d8a-428a-9de7-a49837a232dc} -parentPid 2540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2540" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
PID:3768
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1640 -prefsLen 32900 -prefMapHandle 4584 -prefMapSize 270279 -jsInitHandle 4732 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4960 -initialChannelId {7644c42c-fb27-405f-b5c2-aa17cfd54a62} -parentPid 2540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2540" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
PID:208
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5036 -prefsLen 32900 -prefMapHandle 5040 -prefMapSize 270279 -jsInitHandle 5044 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5052 -initialChannelId {0d374ce5-1e92-48c5-9ec3-71eb484e2eb2} -parentPid 2540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2540" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
PID:4824
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4732 -prefsLen 32900 -prefMapHandle 5036 -prefMapSize 270279 -jsInitHandle 5220 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5476 -initialChannelId {058e861e-b6c2-4568-b3b9-20fde9c425ec} -parentPid 2540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2540" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
PID:4264
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
- Size 15KB
- SHA256 8fc3e6a6bdb059ca4d2f408feb1d32a8c26c05bc9d4429927ceb866ab3391b15
- MD5 cca069d7a6c343bb67eacb2170d56232
- SHA1 0811e9fe761fb1b80d36c70c2b28e64ad77be0d8
- SHA512 6aca1323767b682e210d8493ff2f98d2ac3b34e1779cbaea35ba0a55e7640f7b2db721cc022189f2f9488d02ee45b23c075a679cdfc6eff77acd87a29768ee83
- SSDEEP 384:HwCe7iO024Y2dcs3hk2nhfdDE2Ba/rIVy8e8E+QE+2:QqZY2dv3hk2nhfS2sDIVy8a+z+2
- TLSH T1EF729DBBDF516C5D1917D989C8AD5369DD05FAABCFF690A608203449C784326B0F608F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 11KB
- SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
- MD5 25e8156b7f7ca8dad999ee2b93a32b71
- SHA1 db587e9e9559b433cee57435cb97a83963659430
- SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
- SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
- TLSH T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 502KB
- SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
- MD5 e690f995973164fe425f76589b1be2d9
- SHA1 e947c4dad203aab37a003194dddc7980c74fa712
- SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
- SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
- TLSH T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 8d08e66c57a8509a4e41ed5cf104ddf3f29dd081c7dc368cb3291a8a7496cbee
- MD5 4500daf3773f741101634590f73f5fc0
- SHA1 26c0eaa72cbd1c488ea23ea892752df885626490
- SHA512 608eaff49c2ee83732fbeb3cfe7ef94c1a7c66a9124c636fa1f1b350f609713337fd8d81add8ff18a4775b6cc1258407a1237baa6b3111c5c35aba46ea45430d
- SSDEEP 192:xb1d66JozGzgCl6mc0dOPOv5zboXbqmyjFi:xZd66JozGzgC1jwgboXbqmyj
- TLSH T104E130A4FA28863BC408127BCCA61F414F35395ADC4E7F1A359D741C2D5B2AE368D1BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
- Size 3KB
- SHA256 05195b4716d5b1ee76a469f3de80924a0768ad12d234f270576a09cb13795fb1
- MD5 ef0d719869f68f7896edf1cd55b97fc0
- SHA1 b982ba41cec8b05309eb6d485b28484a7054fbbe
- SHA512 eee6626ca45b1b679bd7d8cb94b35f46c8ada9a6e2b46c2373c9518d0a1b6cab8fc657898f1232ab04ba66914d9941fc2b6b964fa7913e1b78ca77497e5af71c
- TLSH T11661C798F229863FE045413ACC861B411F747456A8AF7F2A38AC608C1E4B2CE76CD57E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
- Size 7KB
- SHA256 c5aeb70b43cb0ab0743a15aae30a017c71cfa9598484dcb8a8f7a3cfd166696e
- MD5 29c89528970000949d4538a4ba7da7ac
- SHA1 00dbe122e47331ca40d5fa56c0694ba1369a35fc
- SHA512 63ea2d4723ebd7955aecf5d96d1ebf986c1d3e239e1d101d02ff42a58d27646a563b0fc77bfda39298b4cc86dee6a37d19156cb609718c9fb936c52367a95758
- SSDEEP 192:xb1d66JozGzgCl6mc0dgPOv5zboP6ZqmyjFiY:xZd66JozGzgC1j+gboiZqmyjX
- TLSH T1B2E110A8F628863BC408027BCCA61B814F35389ADC4E7F29359D741C2D572DE368E17E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 791a437aabeaf80432fcee7efb4b48538c142cd517cee72c6414af42f639b4ba
- MD5 bc9f84b23ca27499c33f2376d90e828c
- SHA1 c38b6e071b9178a45ebb161bb4cd2d00f2ad5446
- SHA512 3070944e8339c1f3c77b7c767c9a8f7f7ece31c5845d9a04012bcd73dbc264e8f6f18bae88ef14665fe9043aafb5877303a4216c967e4f196bb75a28ea073843
- TLSH T1DA217C4C79B84D6BA8C7E35C7481018E53618E0714871C434D52EE8CCE82BE9326E43D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\05131ec1-dfaa-4949-ad46-9114ea8a6a9a
- Size 886B
- SHA256 a92eaf3f486a95fdac3b7377d369777a74c6b05acab82d177162651800815eba
- MD5 9e463e5f9293aeb1ea83abb28d027165
- SHA1 279321d47bdecf112507dc1e570603ac7c276925
- SHA512 9f006567a072da70424fb89704c5a9872779d57605c6075a14046150ea495c662f0a0a03eae7bfab96080d4122ea84c15fc7d15e42827cc6c9e39cb59b2001b6
- TLSH T1331123D18A75B9738C68D287D6E177428BD47537C0CA48103E602E280DEB52E67AB70B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\32c17a9e-7ad9-4d66-9ea6-d37715c46ee1
- Size 235B
- SHA256 c80e85b01d1123c8c284e04b0e8f1bbb89527004620cc682a4ac8850aa163753
- MD5 7f2b2fad448e8d1e1899b9c3b282de01
- SHA1 22e2d1a98096910110b6113af726b6123744bcce
- SHA512 860ce1d0634b3f1491580200188088eb300f91df841621ac1ab3496fa012e10462e065ced3d7b3aa538b30487a1c344f1226d78b1e5b97c0e3cd319e8ad26619
- TLSH T12DD097A418A873AE08154F46F0B06AD730944C33A4B0982089A505789EB9ECA4293917
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\3f6bcecb-d51d-443e-80b1-31adc1df18ef
- Size 883B
- SHA256 94c58e20d8b23a8e579c961c6e3be02dfb4d5b8ffeb28312be9f734bbc935653
- MD5 fc523287e352d6f72e7c57d0ef47ee95
- SHA1 b5761c5668b74556b654887df45951c3b59cac79
- SHA512 5ae25da94ca46b86ebf6c857497495310acb8b43a9ef5b3087858f8c2ce0d2495ddfb8650a09f727587db7056419a046e47e4c1e2255735b5f22b19fb0c478cc
- TLSH T1151123C19934B873CC7C924BC6D177429BE87527C0CA90183DA179280D7E91E976A20B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\4d6f40d8-b3ff-4c46-acfd-27e716d64077
- Size 2KB
- SHA256 ce6ae4db14bfb2d8d65b0e6d890548424468bfb55d71b8094142959f02a50011
- MD5 aed6676e2b1b813e1aa44c68774776bd
- SHA1 8789232a95861738d52b6a8d7edbb32bea7c2296
- SHA512 9bda8c8b5de7ecba786e162f51a1e50a7129e02c1ede3ce501a559080414b96310b581167ace375a4925ad7b9a01973530ceba331e87e7816ed432094886927d
- TLSH T1A441235C75784CB74CDBE54DD191338E53A08E2380C61C932E51EE4C8C9E6A9336E43A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\7a83f19b-885f-4114-947d-1944ce2cfce1
- Size 235B
- SHA256 0530b3cfd82ac19207ead4755dab0020476b2e187b06cb0c41f3a016feacdc79
- MD5 9fd22e8317e123fa5580e4bf458cc6c1
- SHA1 cc65629eb0b4874d7b5619ddbace2d51d56fb6d7
- SHA512 ab8e00c4be7c7251701ad533a44d80d0ff3810cb89da3c1136527c5069725e1d87dfc95fe6cf97df8715d897771ae83c77b43cddee428d083f39725a5fb0af95
- TLSH T133D097FC18A867AC48240F03F0A02DEA30588C3718706C10C5A289348ABADC80161807
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\c88654df-afb8-487b-a949-f9f63169cbe3
- Size 16KB
- SHA256 e3ae553a7f8f4b98f9b66f814ea5de85738a41e656387948b293ce32687940c7
- MD5 e1607aa816e7d83d0a000b6a21ecb567
- SHA1 76c05267e16449f63f6896c95b265af6f8b24339
- SHA512 495cafcce2b396ad7f168289dec8e25861667cc817f7d445497ff788e53b0888a6ed3943488e4c0261bf353128a2816cfc144a82f055b698e0a5333b6102b380
- SSDEEP 384:fOurEQ+/NMbiNc5DkS/SKRuuztLRh1wqY:f//Dk/KpN1Q
- TLSH T14372C856682045BB8251E36994F8BFC3E6F628CF4C419FCADBE47D082DDE06E112794B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\extensions.json
- Size 16KB
- SHA256 88813254ac5ff632f3e807a21266e1731acf8efdf422ac59ceb0041e2661ae6f
- MD5 483820d95fd76540d80f547937fb33b0
- SHA1 1a6cfaa053720ef1106f428091f9316c247b2d41
- SHA512 d981298567737029d9f9da158557fa2bc1fbc7be3c262d44c28fad7fdc8d9de0ba18d1178957ff49173ab3fd7b2512ae2562e4a027284766bb5ef99358fbdb79
- SSDEEP 384:uskI4vdUmldvt8dhWE94z2p96o3L4HLL4PfL4HXL4HzL4HrK4hp:ujI4VRfOXN4e60434L474f424H
- TLSH T12C72531545049EB8294FA78BAA367E01C37D473B60845C78F4DD8FC802FB5B902BB66B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
- Size 1.1MB
- SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
- MD5 626073e8dcf656ac4130e3283c51cbba
- SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
- SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
- SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
- TLSH T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
- Size 116B
- SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
- MD5 ae29912407dfadf0d683982d4fb57293
- SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
- SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
- TLSH T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
- Size 1002B
- SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
- MD5 dcffff15fa618a53834ee4ae8673bd23
- SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
- SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
- TLSH T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
- Size 21.6MB
- SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
- MD5 d14dd3f0107ff91c3e21f301d83f82b0
- SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
- SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
- SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
- TLSH T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs-1.js
- Size 7KB
- SHA256 b09b68b7eaa2aef9286213aab13d2b3c9d57a35482643054f9c65e257c59ccb4
- MD5 d18f1afdc8b4c7daed983faf0702a0b6
- SHA1 6ac9556b0fad12724d419f8e64664ace92c87542
- SHA512 a4ab1aa11b45df58e0e99ae7bdc47a79bbd9b3dd27530777d087e04bcb02b626937a5d2562fe651cfda873f762b9523c618649e1ffb0f70a3df644580f2d5e7e
- SSDEEP 96:xHcFTUuqGqdf7fmObzSBSSlDdv9j9nERHjBO+yzBw88dI+8L4cnrzBHK:6ARdf7fm/SSA9AzBw88Ow
- TLSH T18CF1FD789404CB7F64B2776CAC6489705A72023BB7BF68D750B95885050CF3446FDAEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs-1.js
- Size 6KB
- SHA256 ae050a1daecc8bbc25a572fb3110ea52be26c711a29092600c9001bbd79127a4
- MD5 87d34ae0752bc3f4a0d3ea878ec3ac67
- SHA1 272ef80c97073c05902e73f574b9436bc8bd7fb3
- SHA512 dee8d64f7ae77bad7a409c8cbfc8c699fb67b1a87901f1af139e9611373d19c03b8f9ccda2999c252b0fd27185710c3d82f893437e0a1729e117ccdb93ed113c
- SSDEEP 96:xHcUTUuqGqdf2fm1zSBSSlDdv9j9nERH9O+y1Bw88n8L4cnrzBHK:65Rdf2fmESSA9A1Bw88+w
- TLSH T1D0E1217894088F6F74B6776CAC6888716AB2413B77BF68C750B954C4050CF3442F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
- Size 6KB
- SHA256 b6002f69ae63f41f148416143472fb02b4a98496f0a87fd9bfbaf3adb4b88447
- MD5 5b725f7deea66bfb54cc09c62f6ffc6b
- SHA1 00938b933e50d774881daa79d6033b77dad9a1b5
- SHA512 607b6fd477ec71e43c374e9c1673ac6758af8a8fbbe6cd986d80c7f7dbbee6f8f88dad5e04043ceb0db9694ab15499a21b8e2a44cf9b502bc9a01a6c84c0fd5f
- SSDEEP 96:xHcUTUuqGqdf2oE1zSVSSlDdv9jnnERH9O+y1Bw88n8L4cnrzBHK:65Rdf2oEISSy9A1Bw88+w
- TLSH T19DE1407894088FBF74B6766CAC6888716AB2013BB7BF68C750B954C4050CF3446F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionstore-backups\recovery.baklz4
- Size 109KB
- SHA256 955cde6996a0942e6adc32abc7dc574c3a7b81f86e94d4a37c87dcd0b47d37a9
- MD5 05e499cf652a8fcca97c7eff47a7ce67
- SHA1 2e18c1bfc67b219755dae9644fe18766ef974734
- SHA512 db23a0a0a6da952b155ee2c97a6b0072579d2db8a6244269e49f6592ab40cf3f65436457ec0b8352b7ef61a12b372530b6d880450163b3de0bcda0b6c5b3bef0
- SSDEEP 3072:fM/6/YISjTznxiaCZ5BT0kTYvYiF9wF3D:sCLSjTnCRLUZ9wF3D
- TLSH T196B3F120696F7AE883FBC526E1CA4555EDA38C74629C1DCD8421B9E026BDDC2CFFD120
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 4.5MB
- SHA256 304cd402bc7ea4a47a63484ed34d520129e27f4553d9f4d37c4697046e745eeb
- MD5 771c522475c4d18a1f176a58a4832c34
- SHA1 13009a14e99520165562b76bec16aea14b656c8d
- SHA512 e28e59ce66b25ab3d47d01c60433c123f04582ddebcb035281e8b798cd6206a1ee9eab98d003609c658b72eed5e57a2d257f1db48385cc01ee6e471173691dff
- SSDEEP 49152:CDmgsuOi5lUa2lkfthJeaKvgmRBbFOYEg/G:umBuOi56a2eReaKvgmx/
- TLSH T1CB2639E860D1A257F3814073A64553EB21FFD00C6037DE084BA956E9A4B8CDF9E16B7E
- MD5 SHA1 SHA512 SSDEEP TLSH