Overview
overview
3Static
static
1wifiphishe...le.bat
windows10-2004-x64
3wifiphishe...le.bat
windows11-ltsc_2024-x64
3wifiphishe...onf.py
windows10-2004-x64
3wifiphishe...onf.py
windows11-ltsc_2024-x64
3wifiphishe...t__.py
windows10-2004-x64
3wifiphishe...t__.py
windows11-ltsc_2024-x64
3wifiphishe...uth.py
windows10-2004-x64
3wifiphishe...uth.py
windows11-ltsc_2024-x64
3wifiphishe...ons.py
windows10-2004-x64
3wifiphishe...ons.py
windows11-ltsc_2024-x64
3wifiphishe...ces.py
windows10-2004-x64
3wifiphishe...ces.py
windows11-ltsc_2024-x64
3wifiphishe...min.js
windows10-2004-x64
3wifiphishe...min.js
windows11-ltsc_2024-x64
3wifiphishe...g.html
windows10-2004-x64
1wifiphishe...g.html
windows11-ltsc_2024-x64
1wifiphishe...x.html
windows10-2004-x64
3wifiphishe...x.html
windows11-ltsc_2024-x64
3wifiphishe...dex.js
windows10-2004-x64
3wifiphishe...dex.js
windows11-ltsc_2024-x64
3wifiphishe...min.js
windows10-2004-x64
3wifiphishe...min.js
windows11-ltsc_2024-x64
3wifiphishe...h.html
windows10-2004-x64
1wifiphishe...h.html
windows11-ltsc_2024-x64
1wifiphishe...dex.js
windows10-2004-x64
3wifiphishe...dex.js
windows11-ltsc_2024-x64
3wifiphishe...min.js
windows10-2004-x64
3wifiphishe...min.js
windows11-ltsc_2024-x64
3wifiphishe...x.html
windows10-2004-x64
1wifiphishe...x.html
windows11-ltsc_2024-x64
1wifiphishe...min.js
windows10-2004-x64
3wifiphishe...min.js
windows11-ltsc_2024-x64
3Analysis
- max time kernel
148s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 13:31
Static task
static1
Behavioral task
behavioral1
Sample
wifiphisher-1.4/docs/Makefile.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
wifiphisher-1.4/docs/Makefile.bat
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
wifiphisher-1.4/docs/conf.py
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
wifiphisher-1.4/docs/conf.py
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
wifiphisher-1.4/tests/__init__.py
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
wifiphisher-1.4/tests/__init__.py
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral7
Sample
wifiphisher-1.4/tests/test_deauth.py
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral8
Sample
wifiphisher-1.4/tests/test_deauth.py
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral9
Sample
wifiphisher-1.4/tests/test_extensions.py
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral10
Sample
wifiphisher-1.4/tests/test_extensions.py
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral11
Sample
wifiphisher-1.4/tests/test_interfaces.py
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral12
Sample
wifiphisher-1.4/tests/test_interfaces.py
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral13
Sample
wifiphisher-1.4/wifiphisher/data/phishing-pages/firmware-upgrade/html/static/jquery.min.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
wifiphisher-1.4/wifiphisher/data/phishing-pages/firmware-upgrade/html/static/jquery.min.js
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
wifiphisher-1.4/wifiphisher/data/phishing-pages/firmware-upgrade/html/upgrading.html
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral16
Sample
wifiphisher-1.4/wifiphisher/data/phishing-pages/firmware-upgrade/html/upgrading.html
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral17
Sample
wifiphisher-1.4/wifiphisher/data/phishing-pages/oauth-login/html/index.html
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral18
Sample
wifiphisher-1.4/wifiphisher/data/phishing-pages/oauth-login/html/index.html
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral19
Sample
wifiphisher-1.4/wifiphisher/data/phishing-pages/oauth-login/html/js/index.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
wifiphisher-1.4/wifiphisher/data/phishing-pages/oauth-login/html/js/index.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
wifiphisher-1.4/wifiphisher/data/phishing-pages/oauth-login/html/js/jquery.min.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
wifiphisher-1.4/wifiphisher/data/phishing-pages/oauth-login/html/js/jquery.min.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
wifiphisher-1.4/wifiphisher/data/phishing-pages/oauth-login/html/oauth.html
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral24
Sample
wifiphisher-1.4/wifiphisher/data/phishing-pages/oauth-login/html/oauth.html
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral25
Sample
wifiphisher-1.4/wifiphisher/data/phishing-pages/oauth-login/html/static/js/index.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
wifiphisher-1.4/wifiphisher/data/phishing-pages/oauth-login/html/static/js/index.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
wifiphisher-1.4/wifiphisher/data/phishing-pages/oauth-login/html/static/js/jquery.min.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral28
Sample
wifiphisher-1.4/wifiphisher/data/phishing-pages/oauth-login/html/static/js/jquery.min.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral29
Sample
wifiphisher-1.4/wifiphisher/data/phishing-pages/plugin_update/html/index.html
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral30
Sample
wifiphisher-1.4/wifiphisher/data/phishing-pages/plugin_update/html/index.html
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral31
Sample
wifiphisher-1.4/wifiphisher/data/phishing-pages/plugin_update/html/js/bootstrap.min.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral32
Sample
wifiphisher-1.4/wifiphisher/data/phishing-pages/plugin_update/html/js/bootstrap.min.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target wifiphisher-1.4/wifiphisher/data/phishing-pages/plugin_update/html/index.html
- Size 4KB
- Sample260727-qsj57stcpf
- SHA256 1ccbfe4e2acda6f58b8f0b04347c2ffbf34ae36e64d7cc46a8fb76000bab0ba2
- MD5 3bc5705d740c8aeaef0726bba1eb3f12
- SHA1 0687d6eac439c4e1fc77a341ec896e68efbfde7d
- SHA512 675bdc0a24aafd3f28423792804fee6ad4fb99de5443e04781a17f2d330dbd63826b5259520f9113f51ad20cdba440fb03b7eb1083ecabe5b309c49ad56dfaa1
- SSDEEP 48:c36o/O/ssrxDHuJ21ZdnfT6gS1SjND4coC/xc4VSg6P:Fo/2s8pHD1jGgtqT2xaP
- TLSH T1E691546799FCA5570A32408569942BBB3EDAC14FA24B8640387D46B81F53C918C7F74E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 19 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2508 firefox.exe Token: SeDebugPrivilege 2508 firefox.exe Token: SeDebugPrivilege 2508 firefox.exe Token: SeDebugPrivilege 2508 firefox.exe Token: SeDebugPrivilege 2508 firefox.exe - Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 2508 firefox.exe 2508 firefox.exe 2508 firefox.exe 2508 firefox.exe 2508 firefox.exe 2508 firefox.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2508 firefox.exe - Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 4200 wrote to memory of 2508 4200 firefox.exe 89 PID 4200 wrote to memory of 2508 4200 firefox.exe 89 PID 2508 wrote to memory of 5244 2508 firefox.exe 90 PID 2508 wrote to memory of 5244 2508 firefox.exe 90 PID 2508 wrote to memory of 5244 2508 firefox.exe 90 PID 2508 wrote to memory of 1596 2508 firefox.exe 91 PID 2508 wrote to memory of 1596 2508 firefox.exe 91 PID 2508 wrote to memory of 1596 2508 firefox.exe 91 PID 2508 wrote to memory of 1596 2508 firefox.exe 91 PID 2508 wrote to memory of 4348 2508 firefox.exe 92 PID 2508 wrote to memory of 4348 2508 firefox.exe 92 PID 2508 wrote to memory of 4348 2508 firefox.exe 92 PID 2508 wrote to memory of 4348 2508 firefox.exe 92 PID 2508 wrote to memory of 5492 2508 firefox.exe 93 PID 2508 wrote to memory of 5492 2508 firefox.exe 93 PID 2508 wrote to memory of 5492 2508 firefox.exe 93 PID 2508 wrote to memory of 2844 2508 firefox.exe 94 PID 2508 wrote to memory of 2844 2508 firefox.exe 94 PID 2508 wrote to memory of 2844 2508 firefox.exe 94 PID 2508 wrote to memory of 2844 2508 firefox.exe 94 PID 2508 wrote to memory of 3032 2508 firefox.exe 95 PID 2508 wrote to memory of 3032 2508 firefox.exe 95 PID 2508 wrote to memory of 3032 2508 firefox.exe 95 PID 2508 wrote to memory of 3032 2508 firefox.exe 95 PID 2508 wrote to memory of 2308 2508 firefox.exe 96 PID 2508 wrote to memory of 2308 2508 firefox.exe 96 PID 2508 wrote to memory of 2308 2508 firefox.exe 96 PID 2508 wrote to memory of 2308 2508 firefox.exe 96 PID 2508 wrote to memory of 1172 2508 firefox.exe 97 PID 2508 wrote to memory of 1172 2508 firefox.exe 97 PID 2508 wrote to memory of 1172 2508 firefox.exe 97 PID 2508 wrote to memory of 1172 2508 firefox.exe 97 PID 2508 wrote to memory of 6020 2508 firefox.exe 98 PID 2508 wrote to memory of 6020 2508 firefox.exe 98 PID 2508 wrote to memory of 6020 2508 firefox.exe 98 PID 2508 wrote to memory of 6020 2508 firefox.exe 98 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\wifiphisher-1.4\wifiphisher\data\phishing-pages\plugin_update\html\index.html"1⤵
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\wifiphisher-1.4\wifiphisher\data\phishing-pages\plugin_update\html\index.html2⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1976 -prefsLen 27097 -prefMapHandle 1980 -prefMapSize 270279 -ipcHandle 1904 -initialChannelId {94f6df7f-0f8f-4e69-8b05-781c844b43cb} -parentPid 2508 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2508" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵PID:5244
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2412 -prefsLen 27133 -prefMapHandle 2416 -prefMapSize 270279 -ipcHandle 2432 -initialChannelId {e2e2922d-e834-41b4-bd4d-90c8b12ba15c} -parentPid 2508 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2508" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵PID:1596
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3788 -prefsLen 27323 -prefMapHandle 3792 -prefMapSize 270279 -jsInitHandle 3796 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3804 -initialChannelId {189e01de-1870-4489-8c78-ce5ff7db2ee1} -parentPid 2508 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2508" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
PID:4348
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3840 -prefsLen 27323 -prefMapHandle 3932 -prefMapSize 270279 -ipcHandle 4052 -initialChannelId {a6ce5ca6-4f5f-4c2c-8639-8ed685b269f6} -parentPid 2508 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2508" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵PID:5492
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4432 -prefsLen 34822 -prefMapHandle 4436 -prefMapSize 270279 -jsInitHandle 4440 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4444 -initialChannelId {145d6c02-dbbb-41b3-a584-04886b74cc88} -parentPid 2508 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2508" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
PID:2844
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4396 -prefsLen 35010 -prefMapHandle 2908 -prefMapSize 270279 -ipcHandle 4436 -initialChannelId {3f647f24-d6ef-42b0-805b-ecc921141aeb} -parentPid 2508 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2508" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
PID:3032
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2788 -prefsLen 32952 -prefMapHandle 5344 -prefMapSize 270279 -jsInitHandle 5360 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5372 -initialChannelId {9381da3b-ac38-4afa-89fc-ca841faaada6} -parentPid 2508 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2508" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
PID:2308
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4608 -prefsLen 32952 -prefMapHandle 4632 -prefMapSize 270279 -jsInitHandle 5376 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4900 -initialChannelId {6237dd1f-9f22-4736-967e-1183934c366f} -parentPid 2508 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2508" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
PID:1172
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5724 -prefsLen 32952 -prefMapHandle 5728 -prefMapSize 270279 -jsInitHandle 5732 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5740 -initialChannelId {99a33f54-2e42-4acd-ac86-d65afeb68f92} -parentPid 2508 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2508" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
PID:6020
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z75qv1qk.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
- Size 15KB
- SHA256 413fefdc7220a314c95b9372632299cedf81c034a1ce37d6a9638a5822763023
- MD5 4a8c1a75f76d4da79a8758781b717fc6
- SHA1 4030a7d01aa71f071775fda0bb2ed4df024c8f5b
- SHA512 310e279deebb9f03ba3b745992b5b47f5a55964961fd5f1e3122b7cf02681cf19a7e1e14ebaf5511dce0e60b01ca36df4b2327df15191f3c81d88b4cf6a2fb9e
- SSDEEP 384:HwCe7iO024Yedcs3hk2nhfdDE2Ba/rIVy8e8B+QB+/:QqZYedv3hk2nhfS2sDIVy87+i+/
- TLSH T1B5729DBBDF516C5D1917D989C8AD536ADD05FAABCFF680A608243449C78432AB0F60CF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 11KB
- SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
- MD5 25e8156b7f7ca8dad999ee2b93a32b71
- SHA1 db587e9e9559b433cee57435cb97a83963659430
- SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
- SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
- TLSH T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 502KB
- SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
- MD5 e690f995973164fe425f76589b1be2d9
- SHA1 e947c4dad203aab37a003194dddc7980c74fa712
- SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
- SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
- TLSH T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\db\data.safe.tmp
- Size 7KB
- SHA256 f3336286be61874252c6d0beaf2fac04d9d4de50960d4159fe0228d05f30a22b
- MD5 202823f123f373f0cf797a6394c6fd74
- SHA1 9e83dda116c81ba3cdf61dc46e90ef36505001c8
- SHA512 ebb110bf0cdfcb2b15524090d39ae8319c319b79513b4f8876654b69bf9f857f5dbc3686ead1e8deb3f428b40d198224651edcb447ca3bcc611067e90bb4a0f8
- SSDEEP 192:ZOv5zbo7RZAmyjvwWN1d66JoztdzgCl6mc0d:2bodZAmyjLd66Joz/zgC1j
- TLSH T1C3E1FDA4E628867FC418427BCCA61F404F39395A984E7F1975AC74082D9B2DE37CE17E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 84c29bd2429aadb6bf6dfbe44decde62862ab998836c74ab6506e5881b2dce04
- MD5 6ba2afe29fcf7e8429830e2e2b01b8fb
- SHA1 d177c60760faf6671719dec88498d3640da61f9b
- SHA512 e62b96d4ee14bccf67791fd449c28fa1cc016ac3533f08d5777ef10939a51d7f67c24387bae7118ab5afa546572b337e8f6bd296c89967beae6993fe0b9f81ac
- SSDEEP 192:ROv5zbo7RbAmyjvwWN1d66JoztdzgCl6mc0dz:ObodbAmyjLd66Joz/zgC1jd
- TLSH T179E110A4E628463FC408437BCCA51F404F39395A984E7F1975AC65082D9B2EE37CD17E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 3dcaf0b0fbed1309e967428a71058fa3f71edf81b2ed92138c13b7bde8842502
- MD5 bbcf18a384831768abfb1742d061046e
- SHA1 907fea3b86553b97899645feaf309d313db15b28
- SHA512 12b65a24ea27d1e404caecaee31fe993d6a07081063f396cb5f77f22ca65515fffd8ea7d9d8ef2021c691f35306b0bf85b905647d737c2b829e1177fc6e73440
- TLSH T1C2213A5C79B94D6BA8C7E39C7481028E53654E0714871D434D12EE8DCEE2BE9326E43E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\0630c1b3-6007-4a4b-939b-a67be8a15453
- Size 16KB
- SHA256 f549b674f9ed5a2098ad8da05a49e091062e6dd66c1d8ebd595b83cee8cf9fa2
- MD5 5149983ea38a0cb382f56fc200c5169b
- SHA1 d17b37df41dedcc948cd514a611d465210fa1409
- SHA512 2f750530592d8e7dbc9e9c60691a6b6f8c1e81b06595e99d6cde1a39a20ba81b82e3229b5e07186aebef39442e36858b70e23c41e3796ee24ba201ac886488e9
- SSDEEP 192:cbdzb9xra3nLo7lvECpuDPqIPgzzCZsf1m11OdBbxVTruPxzxR5yAICbK8jv4J14:czhxcJ8zzff1aSB7iPxlR5yAICK8jWGP
- TLSH T15672D856186056BA8151E36894EC7FC3E6F638CF4C419FCE97E4BD081DEE0AE112784B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\74734653-be75-412d-aef0-78a22b524379
- Size 886B
- SHA256 ef46d40149a95e249440106782a94d93b83df3ec029255b0bdd879d38b4b5bc4
- MD5 2af58c7b0cccd64a0e8736dff1de1a82
- SHA1 c2e0f7aa8c302aa639047f8dc49ee54eb8e43dc4
- SHA512 b5f4e397247db614c65debbc9c63c87e9c11258801ac448926f9c9ef5e256b591ebe0b717cef5c2e6b240d3d197144aed724515cc375004ece630cd66f048024
- TLSH T185110480866575F18C38D24B89B57752C7D4752380CA590C7D645F084DFF41A67AA70B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\9911da02-8ecc-4faa-96fd-acfaf383b53f
- Size 235B
- SHA256 51ed7545bf9fa480bcb8a6b1ba8eecea0848f2f0c91525d073f0f7235f6098c5
- MD5 b9e6441340630c00089ab692975c9dc5
- SHA1 a7becc9914fd9a26258ea61022a7d8b6bd0c1bdc
- SHA512 fde92149cee1e6a4e71f06db9c99f49f300e9a59cb356c6b99d784fb34467718161881c0fe57d2f6a5e9d32ccef675eb4da0b905ecf4a21d967a7bf5ec52e312
- TLSH T156D097801488632D48340F0BB0E0A8E731CB8C3364A46820CE614534AAB9ECA412291A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\9cba49b3-8040-4149-a500-8f9ba83d9272
- Size 2KB
- SHA256 25923902fadf97e4a7efda80aaf92a68813da3e28863e1bb73f8321a38b58c8c
- MD5 7896e9f9800ac761c7fc0cdfedf9f953
- SHA1 58dc641e26ec8ab13b80d80d1e2b708a52a0d716
- SHA512 3da8c5d91077e88d75913de0fbc82da284d7f34e87ffaf86004a2e9581e809de457e109e9af8b6295caec27d542df83b436b4e0ee7978eeac7fec21cc448aaed
- TLSH T15A41645C39784D769CA6F14C849233CD93A48A43048328432D55FF4CCED66AE336E51F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\d3f12c47-60a3-47b0-bae5-90df488e9641
- Size 235B
- SHA256 db2aabeb55f93b5c9b46fff999169f474f8c4fc05a5bfe0a9f98e0b4a875073d
- MD5 556abaad0fc5ebb461b549f7acd85ca5
- SHA1 e6da4cba31ea85712c2bc6bb464928dcfdbfb5a3
- SHA512 5ca8ac0534d06775fbfbd31bc5f0958f8de2cc7cff12754c5575ee93ea6d1fe0b650499f41b6d1f3c03a31c8b92dfaffa1629fd1a2db68a4a8071d9081f07802
- TLSH T1F1D097B014F8A36E08081F03B0A8A8C230888C3324B1A820AA915574AAF9AC8411180B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\ff84c005-cb55-41c5-a200-5e16aa557dd9
- Size 883B
- SHA256 97c5bd8dcfd761c07d88e2bd2d136a773a492d4ebfcaf669510ee38e56996cd5
- MD5 ee0cd5c9f0ff3fb862c3e62835627f8d
- SHA1 e4bcc6e2a8c4cd2c8866299de758a0ed0b2692ab
- SHA512 70f266edd71fbb9886a56240cb79529bb4de0afc1b019832125298f05a14bf260b781ee8d6b1eafc98c0b76ea36649c0f084b8f280ac47e94d2f32ff3dea3532
- TLSH T1D21123809675B5F2DC38C24FC9653B0287E8742380CA95083DB59E040FBF52F939A30B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\extensions.json
- Size 16KB
- SHA256 5952400ee8910ccc3070ac0f1f5e12d9447e8702223bdb2816b0d1c8b77152be
- MD5 a6c008c733ba3c2d044a185de7106925
- SHA1 a077cd1015fa738c5f3ff0f05d8c9918bc96209e
- SHA512 b77e1f92e591709c66fd53fb98ba27bd25388f9feed42b0121fda01885dd22ba2dcaefbe210b1dd9070716bedde4be0e7f8db5bb1150aaacb9f4b3e05d2373be
- SSDEEP 384:CkI4vnUmldvO8dhWd94zt96o8L4HTL4PfL4HKL4HZL4H0O4hJ:1I4vRfjXM4H6F4/4r4Y4x4/4z
- TLSH T13E72521545049EB8294FA78AAA367D01C37D433B60845C78F4DD8FC842FB5B902FB65B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
- Size 1.1MB
- SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
- MD5 626073e8dcf656ac4130e3283c51cbba
- SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
- SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
- SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
- TLSH T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
- Size 116B
- SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
- MD5 ae29912407dfadf0d683982d4fb57293
- SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
- SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
- TLSH T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
- Size 1002B
- SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
- MD5 dcffff15fa618a53834ee4ae8673bd23
- SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
- SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
- TLSH T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
- Size 21.6MB
- SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
- MD5 d14dd3f0107ff91c3e21f301d83f82b0
- SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
- SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
- SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
- TLSH T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\prefs-1.js
- Size 8KB
- SHA256 a1a3a9c77bb4ff96c225f5d9ee7ae108743f499acc1020b1274d1176d0011dd1
- MD5 ccc8c5e084a7e4b5e33793ac3e5d1199
- SHA1 3aa1b8a2cda3c608cb634d34def3bfbcf49f3743
- SHA512 0912145c9a95b53d841ccdf4d8230a311c6bd3f7e8a01658cfe102d5389057032c6bcb7d68c92791e0538e1c2a48514204b75daf0ea109ca437703a5b9fe3897
- SSDEEP 96:xHSFTUNqGq1DfGxwObzS9SSlvdv9jwnNeRWR3EcSqZJgxRBw88Od58L4cn1VnAx:cpR1DfGxwPSS38RUjPRBw88jM
- TLSH T13A0210789004DF7F74B2776CAC6449706AB2023BB7BF68D610B95885054CF3841FAAEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\prefs-1.js
- Size 6KB
- SHA256 5ac0f006b8144082d0beae15f2e04f725edf903f2cc8864cf1daa315dfc1db36
- MD5 6a787b3de214c97d3092aea7d01efcdd
- SHA1 dbc1270ac4d0139a4df037b2f3212e350d29a0b2
- SHA512 7caa7dbfe21fe2a74b0e9f9eaa13acababa9f28ce18cd96e008d66ca89151b7985b434713c21efac513b5f98484405d09e0fb66218c0af37213aa41125343f6e
- SSDEEP 96:xHSUTUNqGq1DfGxw1zS9SSlvdv9jwnNeRHIcSqZJghBw88u8L4cn1VnAx:cgR1DfGxwcSS39IjzBw88jM
- TLSH T1D2E11F789408CFBF74B6776CAC6888316AB2413BBBBF68D650B55484054CF3441F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\prefs.js
- Size 6KB
- SHA256 d8d43937c695a3714e814a1960a22e92e4137a530be3a8970a7d8e68ad2608c6
- MD5 78bcfd7fb77bc03c197b1e1f2d3dca76
- SHA1 1dd397e4dac74dd7a6efcf1c82eee606d1873ff9
- SHA512 d11b02ccb0854a408692bf0582ae071e35d8a43c1291e661ebb4a40d97214a356153e176bad24df711664daa4ea3c9b7633f7277d4555384002668ab103f2bb1
- SSDEEP 96:xHSUTUNqGq1DfG45G1zSkHSSlvdv9jmInNeRHIcSqZJghBw88u8L4cn1VnAx:cgR1DfG45GfHSSAd9IjzBw88jM
- TLSH T102E1107890088FBF74B6776CAC6888316AB2013BBBBF68D650B554C4054CF3841F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\sessionstore-backups\recovery.baklz4
- Size 109KB
- SHA256 764329f6895eeb10463fd0b392c901e62916ac1a25817b28dd1acc8f08081155
- MD5 1fc5392067fc007d925d93d8aba7436b
- SHA1 8e2c2dca62a114779e93d1f45fa72e1fbdbe698f
- SHA512 7382ddeb257a1d52b1dd4e33703ed653fdf2b7df52e83e6eeee0a1949c95cd5ea70bed76cc9d436988d644be4bb0889cc5891688509c3a09eed9d709e58472c2
- SSDEEP 3072:UM/6/YISjTznxiaCZ5BT0kTYvYiF9wF3H:DCLSjTnCRLUZ9wF3H
- TLSH T13EB3F120A96F79A883FBC527E1CA4555EDA38C74629C1DCD9421B9E026BDDC2CFFD120
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 5.4MB
- SHA256 226814500b564a71e981cd6622252dca4945c5ca2a9f05ea2c98da43245d91f5
- MD5 3c4fe632dccd271a4e0a4f7961cba92b
- SHA1 5850d3fdb736a4fb625ce4ae9ecbe219e508d6bc
- SHA512 1ec4cedb3d0a20617aef69348a1793dde124e7ffccacb5269aa31a2cf77d2d088a9c256300ee6a7caf531471e48e913e7c40b29b6251e6faf47f9fd6f26ebaa4
- SSDEEP 49152:yQZLL7RjjSRvYcc3llnSIf605p/JNFcV94:LLpVlnSIf66p/lcVu
- TLSH T16F4629E860D1A257F3814073724993EB21EFD00D5037DA085BA95AE9A474CEF8E17B7E
- MD5 SHA1 SHA512 SSDEEP TLSH