Overview
overview
7Static
static
3waif_v4.5....]_.zip
windows10-2004-x64
6waif_v4.5....]_.zip
windows11-ltsc_2024-x64
1waif_v4.5....XX.dll
windows10-2004-x64
1waif_v4.5....XX.dll
windows11-ltsc_2024-x64
1waif_v4.5....WU.dll
windows10-2004-x64
1waif_v4.5....WU.dll
windows11-ltsc_2024-x64
1waif_v4.5....up.txt
windows10-2004-x64
1waif_v4.5....up.txt
windows11-ltsc_2024-x64
1waif_v4.5....s.json
windows10-2004-x64
3waif_v4.5....s.json
windows11-ltsc_2024-x64
3waif_v4.5....re.dll
windows10-2004-x64
1waif_v4.5....re.dll
windows11-ltsc_2024-x64
1waif_v4.5....re.lib
windows10-2004-x64
3waif_v4.5....re.lib
windows11-ltsc_2024-x64
3waif_v4.5....indata
windows10-2004-x64
6waif_v4.5....indata
windows11-ltsc_2024-x64
6waif_v4.5....indata
windows10-2004-x64
6waif_v4.5....indata
windows11-ltsc_2024-x64
6waif_v4.5....me.txt
windows10-2004-x64
1waif_v4.5....me.txt
windows11-ltsc_2024-x64
1waif_v4.5....mm.dll
windows10-2004-x64
1waif_v4.5....mm.dll
windows11-ltsc_2024-x64
1waif_v4.5....mm.lib
windows10-2004-x64
3waif_v4.5....mm.lib
windows11-ltsc_2024-x64
3waif_v4.5....if.exe
windows10-2004-x64
1waif_v4.5....if.exe
windows11-ltsc_2024-x64
1waif_v4.5....if.otf
windows10-2004-x64
7waif_v4.5....if.otf
windows11-ltsc_2024-x64
3waif_v4.5....ly.bat
windows10-2004-x64
3waif_v4.5....ly.bat
windows11-ltsc_2024-x64
3waif_v4.5....a.json
windows10-2004-x64
3waif_v4.5....a.json
windows11-ltsc_2024-x64
3Analysis
- user interaction
yes - max time kernel
299s - max time network
299s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/07/2026, 19:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
waif_v4.5.4_[unknowncheats.me]_.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
300 seconds
Behavioral task
behavioral2
Sample
waif_v4.5.4_[unknowncheats.me]_.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral3
Sample
waif_v4.5.4/Release/FTD3XX.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral4
Sample
waif_v4.5.4/Release/FTD3XX.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral5
Sample
waif_v4.5.4/Release/FTD3XXWU.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral6
Sample
waif_v4.5.4/Release/FTD3XXWU.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral7
Sample
waif_v4.5.4/Release/discordoverlay_setup.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
300 seconds
Behavioral task
behavioral8
Sample
waif_v4.5.4/Release/discordoverlay_setup.txt
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
300 seconds
Behavioral task
behavioral9
Sample
waif_v4.5.4/Release/grenades.json
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
300 seconds
Behavioral task
behavioral10
Sample
waif_v4.5.4/Release/grenades.json
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
300 seconds
Behavioral task
behavioral11
Sample
waif_v4.5.4/Release/leechcore.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral12
Sample
waif_v4.5.4/Release/leechcore.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral13
Sample
waif_v4.5.4/Release/leechcore.lib
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
300 seconds
Behavioral task
behavioral14
Sample
waif_v4.5.4/Release/leechcore.lib
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
300 seconds
Behavioral task
behavioral15
Sample
waif_v4.5.4/Release/player models/player_ct.skindata
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
300 seconds
Behavioral task
behavioral16
Sample
waif_v4.5.4/Release/player models/player_ct.skindata
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
300 seconds
Behavioral task
behavioral17
Sample
waif_v4.5.4/Release/player models/player_t.skindata
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
300 seconds
Behavioral task
behavioral18
Sample
waif_v4.5.4/Release/player models/player_t.skindata
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
300 seconds
Behavioral task
behavioral19
Sample
waif_v4.5.4/Release/readme.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
300 seconds
Behavioral task
behavioral20
Sample
waif_v4.5.4/Release/readme.txt
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
300 seconds
Behavioral task
behavioral21
Sample
waif_v4.5.4/Release/vmm.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral22
Sample
waif_v4.5.4/Release/vmm.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral23
Sample
waif_v4.5.4/Release/vmm.lib
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
300 seconds
Behavioral task
behavioral24
Sample
waif_v4.5.4/Release/vmm.lib
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
300 seconds
Behavioral task
behavioral25
Sample
waif_v4.5.4/Release/waif.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral26
Sample
waif_v4.5.4/Release/waif.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral27
Sample
waif_v4.5.4/Release/waif.otf
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
300 seconds
Behavioral task
behavioral28
Sample
waif_v4.5.4/Release/waif.otf
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
300 seconds
Behavioral task
behavioral29
Sample
waif_v4.5.4/Release/webradar-only.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral30
Sample
waif_v4.5.4/Release/webradar-only.bat
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
2 signatures
300 seconds
Behavioral task
behavioral31
Sample
waif_v4.5.4/Release/webradar/data/cs_agency/data.json
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
300 seconds
Behavioral task
behavioral32
Sample
waif_v4.5.4/Release/webradar/data/cs_agency/data.json
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
300 seconds
General
- Target waif_v4.5.4/Release/player models/player_ct.skindata
- Size 1.2MB
- Sample260730-xt72zsec43
- SHA256 b39e6080e8acf9a406f181c5e3495d1c335feaef5629a771dd948db86de7eae0
- MD5 13cff49c9d0b5798db64cb47a7bf2175
- SHA1 6472256d88c66f0d499b80b0233bc8a8a0197355
- SHA512 9c4bf04b8fd1c25881046a07fd915c987ff45ee4f7c997ed565d0b8c399c059e102e30a5197103480b5b645f617460bf68132684281741cb5a0ab40531a7b4ee
- SSDEEP 24576:/OgMHi/14zOgMHi/14zOgMHi/14inXZhJ0HEqCWDkXjwRlvvx7lm:/OgMHi/14zOgMHi/14zOgMHi/14iXZh8
- TLSH T1EA455965DC27467CD4B52932006B5F19E6B8E1AE91B418371331FAAC3CE071F49EAE8D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Drops desktop.ini file(s) 3 IoCs
description ioc Process File opened for modification C:\Users\Admin\Documents\desktop.ini firefox.exe File opened for modification C:\Users\Public\desktop.ini firefox.exe File opened for modification C:\Users\Public\Documents\desktop.ini firefox.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 560 cmd.exe - Checks processor information in registry 2 TTPs 18 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe - Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\skindata_auto_file\shell\open OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\skindata_auto_file\shell\open\command OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\skindata_auto_file\shell\open\command\ = "\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\"" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings firefox.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\.skindata OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\.skindata\ = "skindata_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\ā OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\ā\ = "skindata_auto_file" OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\⌀耀\ = "skindata_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\skindata_auto_file\shell OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\skindata_auto_file OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\⌀耀 OpenWith.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3380 OpenWith.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1660 firefox.exe Token: SeDebugPrivilege 1660 firefox.exe Token: SeDebugPrivilege 1660 firefox.exe Token: SeDebugPrivilege 1660 firefox.exe Token: SeDebugPrivilege 1660 firefox.exe - Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 1660 firefox.exe 1660 firefox.exe 1660 firefox.exe 1660 firefox.exe 1660 firefox.exe 1660 firefox.exe 1660 firefox.exe - Suspicious use of SetWindowsHookEx 26 IoCs
pid Process 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 1660 firefox.exe - Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 3380 wrote to memory of 3732 3380 OpenWith.exe 97 PID 3732 wrote to memory of 1660 3732 firefox.exe 99 PID 3732 wrote to memory of 1660 3732 firefox.exe 99 PID 1660 wrote to memory of 4380 1660 firefox.exe 101 PID 1660 wrote to memory of 4380 1660 firefox.exe 101 PID 1660 wrote to memory of 4380 1660 firefox.exe 101 PID 1660 wrote to memory of 4924 1660 firefox.exe 102 PID 1660 wrote to memory of 4924 1660 firefox.exe 102 PID 1660 wrote to memory of 4924 1660 firefox.exe 102 PID 1660 wrote to memory of 4924 1660 firefox.exe 102 PID 1660 wrote to memory of 3032 1660 firefox.exe 103 PID 1660 wrote to memory of 3032 1660 firefox.exe 103 PID 1660 wrote to memory of 3032 1660 firefox.exe 103 PID 1660 wrote to memory of 3032 1660 firefox.exe 103 PID 1660 wrote to memory of 752 1660 firefox.exe 104 PID 1660 wrote to memory of 752 1660 firefox.exe 104 PID 1660 wrote to memory of 752 1660 firefox.exe 104 PID 1660 wrote to memory of 1128 1660 firefox.exe 105 PID 1660 wrote to memory of 1128 1660 firefox.exe 105 PID 1660 wrote to memory of 1128 1660 firefox.exe 105 PID 1660 wrote to memory of 1128 1660 firefox.exe 105 PID 1660 wrote to memory of 5300 1660 firefox.exe 106 PID 1660 wrote to memory of 5300 1660 firefox.exe 106 PID 1660 wrote to memory of 5300 1660 firefox.exe 106 PID 1660 wrote to memory of 5300 1660 firefox.exe 106 PID 1660 wrote to memory of 5356 1660 firefox.exe 107 PID 1660 wrote to memory of 5356 1660 firefox.exe 107 PID 1660 wrote to memory of 5356 1660 firefox.exe 107 PID 1660 wrote to memory of 5356 1660 firefox.exe 107 PID 1660 wrote to memory of 5364 1660 firefox.exe 108 PID 1660 wrote to memory of 5364 1660 firefox.exe 108 PID 1660 wrote to memory of 5364 1660 firefox.exe 108 PID 1660 wrote to memory of 5364 1660 firefox.exe 108 PID 1660 wrote to memory of 5380 1660 firefox.exe 109 PID 1660 wrote to memory of 5380 1660 firefox.exe 109 PID 1660 wrote to memory of 5380 1660 firefox.exe 109 PID 1660 wrote to memory of 5380 1660 firefox.exe 109 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\waif_v4.5.4\Release\player models\player_ct.skindata"1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:560
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\waif_v4.5.4\Release\player models\player_ct.skindata"2⤵
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\waif_v4.5.4\Release\player models\player_ct.skindata"3⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2008 -prefsLen 27099 -prefMapHandle 2012 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {d776033d-cd90-466a-b090-a161dd01e3bb} -parentPid 1660 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1660" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu4⤵PID:4380
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2484 -prefsLen 27135 -prefMapHandle 2488 -prefMapSize 270279 -ipcHandle 2496 -initialChannelId {a5edb1bf-0261-41c3-9106-6deb5e34957f} -parentPid 1660 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1660" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket4⤵PID:4924
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3584 -prefsLen 27325 -prefMapHandle 3588 -prefMapSize 270279 -jsInitHandle 3592 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3600 -initialChannelId {7b42b452-3546-460e-99c4-48972dcb903e} -parentPid 1660 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1660" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab4⤵
- Checks processor information in registry
PID:3032
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3748 -prefsLen 27325 -prefMapHandle 3752 -prefMapSize 270279 -ipcHandle 3848 -initialChannelId {702daa4e-0cd5-4078-9644-2e299680da45} -parentPid 1660 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1660" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd4⤵PID:752
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2964 -prefsLen 34824 -prefMapHandle 2736 -prefMapSize 270279 -jsInitHandle 4348 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4356 -initialChannelId {c9d004fc-b352-4771-986d-e67588009551} -parentPid 1660 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1660" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab4⤵
- Checks processor information in registry
PID:1128
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5164 -prefsLen 35012 -prefMapHandle 5160 -prefMapSize 270279 -ipcHandle 2908 -initialChannelId {e15a2881-050f-4965-a825-8af515c69cb5} -parentPid 1660 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1660" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility4⤵
- Checks processor information in registry
PID:5300
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5312 -prefsLen 32900 -prefMapHandle 5316 -prefMapSize 270279 -jsInitHandle 5320 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5328 -initialChannelId {be12ee63-d6db-4f6f-b6df-8a7a2fda92ed} -parentPid 1660 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1660" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab4⤵
- Checks processor information in registry
PID:5356
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5348 -prefsLen 32900 -prefMapHandle 5352 -prefMapSize 270279 -jsInitHandle 5356 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5360 -initialChannelId {bbee712d-9368-4f8a-8207-59826969419d} -parentPid 1660 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1660" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab4⤵
- Checks processor information in registry
PID:5364
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5724 -prefsLen 32952 -prefMapHandle 5728 -prefMapSize 270279 -jsInitHandle 5732 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5740 -initialChannelId {9f768584-f25e-40e7-b6f0-03a561ab7efd} -parentPid 1660 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1660" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab4⤵
- Checks processor information in registry
PID:5380
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
- Size 16KB
- SHA256 70e6ccbf62ae05216612b5009a23f444eda7eedba9a17ac3c0ebd496d869ab2f
- MD5 630c4451d9d74f55d4eae7257e59dc8c
- SHA1 4a7d618d15c8d45d48a815a047c612a70b9847a3
- SHA512 ec38923e1cb551eb8fac3e9322e78553dbef4f325f477e98ff914c4335808529f8e9f6ef4bd273c9960f93681c2eea66eb9fee6ec03820c3ca002393c9e2d620
- SSDEEP 384:HwCe7iO024YLDL84KKDL849B7SOEAd9KVRaAcP+AWRMA9jpF:QqZYLDL8lKDL8CB7S/AmVAf+hRMmjf
- TLSH T1B7729E7D9F013CAC1597C0E8C0F992D98D18B6A3CFE6806D21683D0DC798969B1F548F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\b399c853-16b4-4e6c-8353-97a3ec2f6e28.zip
- Size 3.7MB
- SHA256 dd544d48a457b6c12041612325df3c7f9b4c3cd0369ca24cc4f71128e625be98
- MD5 3850f642d336e5b283975359ae18e3d7
- SHA1 3978cd7a6dd7a3e7cd38e17b153e16ec119d7cee
- SHA512 31254b8b9d53e4ea690eda16e079bcd983d40379e410e8078803078ec9a9ab4e168f3b9f7b591dadfda36bbe9c5cae7b8a9570f712af61ef14ccfc47de52a54f
- SSDEEP 49152:7Vv1Dboz1hnoFzgmLWGBR/VvhF62rIydNOW2ytsj6F6Qyla0NPjuO4J/ceo0nw8E:Zv1vgHohhFLGmtsjO6QINNohnw8ZG
- TLSH T15906F175D75C1609C9FF83BA850C2FC2984C4FAE8054A96BEA6AD9715CE33EE1F4484C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 11KB
- SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
- MD5 25e8156b7f7ca8dad999ee2b93a32b71
- SHA1 db587e9e9559b433cee57435cb97a83963659430
- SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
- SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
- TLSH T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 502KB
- SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
- MD5 e690f995973164fe425f76589b1be2d9
- SHA1 e947c4dad203aab37a003194dddc7980c74fa712
- SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
- SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
- TLSH T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
- Size 3KB
- SHA256 e2986eb85fc20a67de4c8011214ac502a87917c35f62416f94a3c5a6feacac02
- MD5 3367613322964617775b1da07f553732
- SHA1 fae22b87b7e09152d96c1f6336c7506c7c1fdb4f
- SHA512 1c7d90af2f69924535299517ca6a45223ed7ffb9a3b5187be6d246352309b95d40121c2eb848bcc22f96e0d2cb8ddd91fac628a2443621d60324ceb81e5ac14a
- TLSH T151619558F2298A3FE445413ACC821B412F747446A8AFBF2A35AC614D1F5B2CE76CD07E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
- Size 24KB
- SHA256 d601536356f924ed2aebddd347a86bbf4b8eb043924476256cf600a47e75353c
- MD5 5b9c7320367ecb14ee82791d17906b83
- SHA1 306402fa225b579c368c4c8fa282cad28d6b7424
- SHA512 fa420880d7186376b0f2ee719cdc633e635e87d4d13f367e0ab21892bc164bd55bb32ba322daf55c35caf40edd01e43e9338d5aac253b9f5c0fecec82cb4318d
- SSDEEP 384:r0CfsiPuxAGcmhur0b7huKDtPtrbMbGvIhd66JozGzgC1jWbop9OcyjB:r0UsTyGcmhurIkKDtPtrbMbCXEka+
- TLSH T1E8B20F84FB2A953FC41552BBDCA607001F79B88A580E2F573A4D64682C872DC7E9E07F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 cfc1265b643697ec9695db36e418a0dbf77a31ef7789ec5b7e92b1865a3cb5de
- MD5 5aafc1ab94c94436dad79547825d2a70
- SHA1 d309ba92f0d145244a635aabce834c223adee549
- SHA512 0c49f0501bb2c976752b2988d08589b8702b513a172ff40289f3fa6a537698da261b7b30fad4dfbc0947b52254d704efd805fb1e1b13003a93eac07cbebb1ee7
- SSDEEP 192:fOv5zbowZRgcyjPUkD1d66JozGzgCl6mc0dz:QbowZOcyjdhd66JozGzgC1jd
- TLSH T17FE13164FB28863FC408427BCCA10B454F7A389B984E7F15359CA5082D572DE7ACD1BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
- Size 24KB
- SHA256 f1c9a55a82d9f3e1557d805086ab4786949b0cb58e6d598a046092aafb468c62
- MD5 d9a77a4f00619b50fb7836425fa92c77
- SHA1 611816fabe0369816e1a7b97b8b750806ba5ebde
- SHA512 d62ddb1d4452164fe4bc1bb7821a61ecb415bd108c0b7dadcb4e0040d822692729884a2311f10751989a8d84a806f2195d3e5e0095e7f3a58aee9504e38d126c
- SSDEEP 384:5bop9OcyjA0CfsiPuxAGcmhur0b7huKDtPtrbMbGvIhd66JozGzgC1jd:Zaf0UsTyGcmhurIkKDtPtrbMbCXE/
- TLSH T16EB20F84FB2A953FC41552BBDCA607001F79B88A581E2F573A4D64682C872DC7E9E07F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 b4e7cf60d67ed555d6cba0075089ad667b4a3d9587809993f2244ce18a743c6f
- MD5 8adc644eea777858cdcece21cb141b10
- SHA1 f2cb728055f3dce2ebff50263eb9f20c2f8d982c
- SHA512 845a1e0d5831a6bfa311ef0ca75543442f93db234cf04e83b4ec54a0c22a0d935f64af2949bbd9a3c19e0ca961cdf3241e46a016bb53356d2ac02f3c0bfabe23
- TLSH T1F0217C4C39B94D6A6ECBF3AC7441058E57958E0644871C474D12EF8DDEA1AE9316A43C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\0b778520-6329-4e28-b288-3e50a6157422
- Size 886B
- SHA256 6bf43ccf3c8055f143cdfce272834e533231bb3ff9afc6a0841c3c56def08cc3
- MD5 769be1ce4ee6a116773d37a52504f7c3
- SHA1 cb7ce10932b71e02c03e385fb6523dbbac017243
- SHA512 b61d435a614dd60a8abe29665cf50e9c1fa3655998cfbb369fec0b0b5bf5276426849fc2824490a1df091b03f9180c9d3b59e4cea2013663a098e155049619d7
- TLSH T17B1104909638B4A2CC78D28795A177068AE4741380C599043E609B184EAA11E93AA71B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\12fe6d1f-c0bc-406b-adaf-5cba094fca01
- Size 2KB
- SHA256 110b282c869fe9f3ce7fc28b73bef4500be5333e2b029c0af72cf0afa136333c
- MD5 4bd9c55182d6e1c6d8acdb42527fe47c
- SHA1 968483992db5eae9c715f66a061313388f6e7d5c
- SHA512 cc0303ae250d9a5a08417e841177cebb5b6cf3b299ffe6992dd899c221e5235d71cebb5ccf5e05240f1d77830f8855fdf614f2506b428d20109d3ca2f89b622b
- TLSH T18E41255C35785CB78CDAF58CD482374E57648A1300C628832D61EF4CCD897AE73AA977
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\1488949a-2f97-41cd-8ce7-17f26dd36e20
- Size 883B
- SHA256 9655ce063965f6555ffff47720cd05de08d569e4518c90c35d059faf7f992204
- MD5 11db8c1b394444545c3337ee125eed5f
- SHA1 f3ebe8937223f2dd833bee45932c081b55c5deae
- SHA512 9733d0948be850162d3a763abc60487bcff74d3b38a5a77fad5ae99d0b6a74c9055762dbf1b28487be0def3ff0e55441b9b3754b26708f9f7111adcbcec3519f
- TLSH T197112350A738B9B7CC38D24B89553B068FF57423C0C991143EE08E180E7B51EE39A60F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\906af1a6-6c70-450e-b8e2-82a2cad2f7d9
- Size 15KB
- SHA256 5c41f69e26d763826de7cc148bb002c7dd140aa5463bbb6c2b81b38e34044ea6
- MD5 082dfb9767b6bcd5e618397ecfe657bd
- SHA1 1e7a99badd3c009396a276382ec58ce38c41ff0a
- SHA512 0ab92a3155eb74803b00c89a8a7c0264c0092cf1a5a7bebf91520a28e31e52c6bd3944bd63010e47f3cfb106d471505a439add9feee85d767c4c4033291430fe
- SSDEEP 192:Iy+IM1hPDOxpGy4hCCM8SOiRv4VTi6SOxER5BDfnfmU45B21S2SqQorNYvjqXK7t:IpjPixshW5o55aYbqXK7bNtSics
- TLSH T1CD72D9166870457A8291E3A894ECBFC3E2F538CB4C419FCADBE4BD085DDE06E112794B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\9235a459-357d-4770-abb5-cc0bee4240e0
- Size 235B
- SHA256 a60b299fff42bc6a92a2de3c3d262330e3ec31bd768f4fe772bd4f7134b08324
- MD5 9d19430f9a512ad316d254487dc1715c
- SHA1 924cb1dee0cc7d7207e9997285201f8af36cca34
- SHA512 71cb15b31375bc7285c0df8af7e0b56eacf339c106c615d898e18f88a032e826248ff4652e2e210a6ae7ec1f276b70d1f80e8a6e02fb2de4c56bb04aa11c7128
- TLSH T175D097C02498A71C48081F06F0A0AAC230888C3310A85810CAA18238A9FD9C80161C17
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\ce35dc4e-b4e3-4d41-bd93-3ee6a6d9234b
- Size 235B
- SHA256 8650d223043525368e71fca1ce7f2fa018d087bfc0d30e32c3ef4748d0924f4d
- MD5 0b8a3333dae56f86c9334d051b6135c5
- SHA1 f0ad1b38806bfdccf6cc2bce771f6295538dffcc
- SHA512 f772ba8364741fd7e95e32dcb0ad74cd927505ad7055b1b653e72295b31d6d588360ea2119c9c3dfa8c1877ca546ef775fc2bd4b9670ab2a78a1efb6dc66c373
- TLSH T186D097A07898236C58140F53B0F42CC371444C33187168209A6005348AFEEC48112C0A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\extensions.json
- Size 16KB
- SHA256 337ba9d04f584658b675ac8ded6604249c3fe9ece255a36a6b8438c11e116553
- MD5 88638824c418909d44f0491b3c852cf5
- SHA1 6f0962e1f7d759063747229e38cd6977ef39a670
- SHA512 74cd7c712a93b3e2679c2e794843a8633e8e0eaf3c259b7a930679083b78d4977ca86f908fa7acb0cc9976f71f10fdac5e4b75b916304b83d7cee4499163007a
- SSDEEP 384:ghkI4vzUmldvQ8dhWo94zr96oQL4HQL4PGL4HzL4H/UL4HP+4hh:PI4LRfJXF4F6Z4y4U4f424G4j
- TLSH T12172531545049EB8294EA78BAA36BE01C37D473B60855C78F4DD8FC802FB5B902FB65B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
- Size 1.1MB
- SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
- MD5 626073e8dcf656ac4130e3283c51cbba
- SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
- SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
- SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
- TLSH T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
- Size 116B
- SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
- MD5 ae29912407dfadf0d683982d4fb57293
- SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
- SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
- TLSH T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
- Size 1002B
- SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
- MD5 dcffff15fa618a53834ee4ae8673bd23
- SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
- SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
- TLSH T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
- Size 21.6MB
- SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
- MD5 d14dd3f0107ff91c3e21f301d83f82b0
- SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
- SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
- SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
- TLSH T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs-1.js
- Size 9KB
- SHA256 337747918add90979d5087f202d87cc00fb46f6b2da94b72048aace3a84ac842
- MD5 1f37465e59b752ef35e1bb59121a10af
- SHA1 51881c4daa817d3e6351944fd8a78cd387e888d1
- SHA512 e6f038300b8487e99d993e3709df7ba9ca26f5930ccc56812b45790c08e38e40d3a95ea99274cf6aeb6a057c6bdfabdf52192498d356df3cf8665c6994322d5e
- SSDEEP 96:xHUdTUMqGq/fQIEObzSn0SSlmdv9jwnytWRy5AsO7HjvQBw88MkMUui8L4cn23U4:2aR/fQIEuSSm4RtsIHzQBw88MUuQ
- TLSH T1DF22DB3860448F3F25F6367DAC248D715A624237B7BF7CDA51B98481145CF2841EAAEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs-1.js
- Size 7KB
- SHA256 cd21a86ab96a517a730f7b986d89057f9a7e6e45324656bce329e2495dd930a4
- MD5 04d466a473197c2675017f0f7c67b482
- SHA1 257dee99bfe77b59622435ea01ff53b98ad44754
- SHA512 363f5a4dc801edcc9cde5231bfb34a4f9c28924ec5868afff17b2a68f49ae48541b8dfc9aa3b59d4a9f17d41667b16fed0f2d9016b2586d34b7302f82dd58399
- SSDEEP 96:xHUUTUMqGq/fSIEObzSn0SSlmdv9jwnytHlAsO7HjvPBw8818L4cn23U1K:2/R/fSIEuSSmxisIHzPBw88/
- TLSH T1D6F12D789418CF6F65B676ACAC248D315AB2013BB7BF68D710B994C4015CF3442F9AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs.js
- Size 6KB
- SHA256 8f9760e60c65e2ac09032182f0486bd00657b966d4aa387ba28766a045b65c0f
- MD5 8decd31927e40d9dbe5e52a46a685ed4
- SHA1 a5944b0f6e41d12b585e950e0ae82d9d0ad6cc8c
- SHA512 f0632cfcd6c671e06a6acf59162682ceec1c977acdb31b1a20927c1094cdc6bb206c2c33bae41cfc9f8e9a6a1acd849d2d7c7e7abf982343a46d6147bc95ce76
- SSDEEP 96:xHiUTUMqGq/fSrO1zSQSSlmdv9jtnytHlAsO7HjvsBw88n8L4cn23U1K:U/R/fSrOVSSnxisIHzsBw88J
- TLSH T139E131789044CF7F64B676ACAC688C716AB2013BB7BF68D650B594C4015CF3442F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs.js
- Size 6KB
- SHA256 decca066342a9d1af8b80344a6f6e7fdd94ca9cd7e053d95c2c7ad8ba73bca4b
- MD5 18bf9e71f43574c12329920dc10744a3
- SHA1 db56b4ef7d115b018fa205511989f81a297550c2
- SHA512 06c58a240a6b459cb94beaff114503c4dd32ea3f5de20c48b97a9128bb00fedf298b2b296958345a568e62bd9da1aab1c8c77c5fb59119f9d9ebc3e55f83ae0f
- SSDEEP 96:xHiUTUMqGq/fSIE1zSn0SSlmdv9jtnytHlAsO7HjvsBw88n8L4cn23U1K:U/R/fSIERSSnxisIHzsBw88J
- TLSH T186E13F789018CF6F64B676ACAC688C316AB2013BB7BF28D650B594C4015CF3442F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs.js
- Size 6KB
- SHA256 b2ac167320120f28fcd14752b43246e67393d5c3d5790c71788b9c399a29100a
- MD5 a0da854f1b6be86b5fe5f9b3e7d33994
- SHA1 9854d4e5dabf8b7852f85a0b69a2fd6e09c60b08
- SHA512 ab5fff1836cefa39acf57c429b44f8d234147d0638f2368dd9d8c0f9472108793b37884203c1e8f1dd767d34a6b1a159ab13ee064a7e08770e38ce3ba7310f9f
- SSDEEP 96:xHiUTUMqGq/fSIEObzSn0SSlmdv9jwnytHlAsO7HjvsBw88n8L4cn23U1K:U/R/fSIEuSSmxisIHzsBw88J
- TLSH T1FBE13F789008CF6F64B676ACAC688C316AB2013BB7BF68D650B594C4015CF3442F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\sessionstore-backups\recovery.jsonlz4
- Size 1KB
- SHA256 8ab1c9a79537c14ed96f30891b9bb485de0c7522ba32cb1b7d85858217e81a18
- MD5 3c60775c47fdd7fab7e5ea7ff8008085
- SHA1 da5f800b53436628587918c1a879c20c0e3ab9da
- SHA512 9040626cf0adc49f27c2a4361fcf06876434db836d5575a3237b7f48c5425db723953fb01b5e41bbfcbd9fc36a9fba0e7716fe33eda23f94d141107125de7a8d
- TLSH T16D210643A9623FF32B87C19A98048FF9020A3035417108E0925ACF0A2DAE08AF74650C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 4.2MB
- SHA256 5eadc6c87b1815e837f2964a9a2ed1dae770731550977feedc31b22577d3e43c
- MD5 4acb7e3827c75ed365c4a6c28c2516eb
- SHA1 5934578e6102122e63fcf4a9745ad7ca07f6cdcd
- SHA512 1654cfe28ff2f518e5fc44279edafac93a1c9cc4b80e91a4714146cf9727d83ccef7371dbc8fe8ff40a1bb142ee92f0d3e44da2b15f88a175d43588c3045557c
- SSDEEP 24576:FB2lSCI+v9htciTaYsNdK8T8D5/eXZaW3fp/vtXwE4j4TEwXn6DyGhQ:FBK9hWimYccD5WXZaW3x3Bwd4TEwGyGe
- TLSH T1FE163AF824D1A257F3808037668563EB21AFD00CA477DD444BD966F994B8CEF9E05B2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 12.3MB
- SHA256 58b1309edda13b2e3c1e9dbbf6d1550178e364a817ec02478a34b303d99ea472
- MD5 5c00311fa52bf52788648bb2a190cdc6
- SHA1 25f092ace69554c1075f1ecf195c817f585f7721
- SHA512 3b63dc3cc4bf5d7203c96cd54fff09b8d5dc7f45554c60ef9957e4d18021c067b806bc12fb60f50d0ae17cd27bf489ebeba61bf1ac46065f989e4a2b911f8ba4
- SSDEEP 49152:oVKn9hWizYBz2sC2AuBWoLGOmBUNvgu9WYJMPRCKBOrpd:ijCRuBWoLpmBUnWYKRCM
- TLSH T177D63A9270E4DA92EE0186B2F30F43DB317FC1DC20E6859416B8B95C596369BEE2F354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\TGHFox26.skindata.part
- Size 1.2MB
- SHA256 b39e6080e8acf9a406f181c5e3495d1c335feaef5629a771dd948db86de7eae0
- MD5 13cff49c9d0b5798db64cb47a7bf2175
- SHA1 6472256d88c66f0d499b80b0233bc8a8a0197355
- SHA512 9c4bf04b8fd1c25881046a07fd915c987ff45ee4f7c997ed565d0b8c399c059e102e30a5197103480b5b645f617460bf68132684281741cb5a0ab40531a7b4ee
- SSDEEP 24576:/OgMHi/14zOgMHi/14zOgMHi/14inXZhJ0HEqCWDkXjwRlvvx7lm:/OgMHi/14zOgMHi/14zOgMHi/14iXZh8
- TLSH T1EA455965DC27467CD4B52932006B5F19E6B8E1AE91B418371331FAAC3CE071F49EAE8D
- MD5 SHA1 SHA512 SSDEEP TLSH