Overview
overview
7Static
static
3waif_v4.5....]_.zip
windows10-2004-x64
6waif_v4.5....]_.zip
windows11-ltsc_2024-x64
1waif_v4.5....XX.dll
windows10-2004-x64
1waif_v4.5....XX.dll
windows11-ltsc_2024-x64
1waif_v4.5....WU.dll
windows10-2004-x64
1waif_v4.5....WU.dll
windows11-ltsc_2024-x64
1waif_v4.5....up.txt
windows10-2004-x64
1waif_v4.5....up.txt
windows11-ltsc_2024-x64
1waif_v4.5....s.json
windows10-2004-x64
3waif_v4.5....s.json
windows11-ltsc_2024-x64
3waif_v4.5....re.dll
windows10-2004-x64
1waif_v4.5....re.dll
windows11-ltsc_2024-x64
1waif_v4.5....re.lib
windows10-2004-x64
3waif_v4.5....re.lib
windows11-ltsc_2024-x64
3waif_v4.5....indata
windows10-2004-x64
6waif_v4.5....indata
windows11-ltsc_2024-x64
6waif_v4.5....indata
windows10-2004-x64
6waif_v4.5....indata
windows11-ltsc_2024-x64
6waif_v4.5....me.txt
windows10-2004-x64
1waif_v4.5....me.txt
windows11-ltsc_2024-x64
1waif_v4.5....mm.dll
windows10-2004-x64
1waif_v4.5....mm.dll
windows11-ltsc_2024-x64
1waif_v4.5....mm.lib
windows10-2004-x64
3waif_v4.5....mm.lib
windows11-ltsc_2024-x64
3waif_v4.5....if.exe
windows10-2004-x64
1waif_v4.5....if.exe
windows11-ltsc_2024-x64
1waif_v4.5....if.otf
windows10-2004-x64
7waif_v4.5....if.otf
windows11-ltsc_2024-x64
3waif_v4.5....ly.bat
windows10-2004-x64
3waif_v4.5....ly.bat
windows11-ltsc_2024-x64
3waif_v4.5....a.json
windows10-2004-x64
3waif_v4.5....a.json
windows11-ltsc_2024-x64
3Analysis
- user interaction
yes - max time kernel
300s - max time network
303s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/07/2026, 19:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
waif_v4.5.4_[unknowncheats.me]_.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
300 seconds
Behavioral task
behavioral2
Sample
waif_v4.5.4_[unknowncheats.me]_.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral3
Sample
waif_v4.5.4/Release/FTD3XX.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral4
Sample
waif_v4.5.4/Release/FTD3XX.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral5
Sample
waif_v4.5.4/Release/FTD3XXWU.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral6
Sample
waif_v4.5.4/Release/FTD3XXWU.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral7
Sample
waif_v4.5.4/Release/discordoverlay_setup.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
300 seconds
Behavioral task
behavioral8
Sample
waif_v4.5.4/Release/discordoverlay_setup.txt
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
300 seconds
Behavioral task
behavioral9
Sample
waif_v4.5.4/Release/grenades.json
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
300 seconds
Behavioral task
behavioral10
Sample
waif_v4.5.4/Release/grenades.json
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
300 seconds
Behavioral task
behavioral11
Sample
waif_v4.5.4/Release/leechcore.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral12
Sample
waif_v4.5.4/Release/leechcore.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral13
Sample
waif_v4.5.4/Release/leechcore.lib
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
300 seconds
Behavioral task
behavioral14
Sample
waif_v4.5.4/Release/leechcore.lib
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
300 seconds
Behavioral task
behavioral15
Sample
waif_v4.5.4/Release/player models/player_ct.skindata
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
300 seconds
Behavioral task
behavioral16
Sample
waif_v4.5.4/Release/player models/player_ct.skindata
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
300 seconds
Behavioral task
behavioral17
Sample
waif_v4.5.4/Release/player models/player_t.skindata
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
300 seconds
Behavioral task
behavioral18
Sample
waif_v4.5.4/Release/player models/player_t.skindata
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
300 seconds
Behavioral task
behavioral19
Sample
waif_v4.5.4/Release/readme.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
300 seconds
Behavioral task
behavioral20
Sample
waif_v4.5.4/Release/readme.txt
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
300 seconds
Behavioral task
behavioral21
Sample
waif_v4.5.4/Release/vmm.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral22
Sample
waif_v4.5.4/Release/vmm.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral23
Sample
waif_v4.5.4/Release/vmm.lib
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
300 seconds
Behavioral task
behavioral24
Sample
waif_v4.5.4/Release/vmm.lib
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
300 seconds
Behavioral task
behavioral25
Sample
waif_v4.5.4/Release/waif.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral26
Sample
waif_v4.5.4/Release/waif.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral27
Sample
waif_v4.5.4/Release/waif.otf
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
300 seconds
Behavioral task
behavioral28
Sample
waif_v4.5.4/Release/waif.otf
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
300 seconds
Behavioral task
behavioral29
Sample
waif_v4.5.4/Release/webradar-only.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral30
Sample
waif_v4.5.4/Release/webradar-only.bat
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
2 signatures
300 seconds
Behavioral task
behavioral31
Sample
waif_v4.5.4/Release/webradar/data/cs_agency/data.json
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
300 seconds
Behavioral task
behavioral32
Sample
waif_v4.5.4/Release/webradar/data/cs_agency/data.json
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
300 seconds
General
- Target waif_v4.5.4/Release/player models/player_t.skindata
- Size 708KB
- Sample260730-xt72zsec43
- SHA256 c3bf851d34f9f658eafa66448af4602d874fc88f836cbda94189e973532efe2f
- MD5 6c179150b792565ed9ea924e775e5950
- SHA1 3b5440fa0c7fca005b385d2d267f546d6dc2d5c7
- SHA512 857bfab876352fcf1f67d2c8b51ac1314ee16018297114cda11a0d10100a78f77562cc3c8df8d97b9649713f342aca9fe2d67b96876492dc3c266b9752bb2bb9
- SSDEEP 12288:PxggxL8zLC1Gyb9L+QjOxUsO2ZFCkCX30o9Y/oSsNz3cu:pgSL8z/yd+QjmUKCkCXk/oSsNz3c
- TLSH T178F43957B8539B3DC1BD02B180FF0E6A993E8945891229B3A33995583EE371B75C37C8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Drops desktop.ini file(s) 3 IoCs
description ioc Process File opened for modification C:\Users\Admin\Documents\desktop.ini firefox.exe File opened for modification C:\Users\Public\desktop.ini firefox.exe File opened for modification C:\Users\Public\Documents\desktop.ini firefox.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2008 cmd.exe - Checks processor information in registry 2 TTPs 18 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe - Modifies registry class 24 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\㕦㉚៷蠀约翺 OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\skindata_auto_file\shell\open\command\ = "\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\"" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings cmd.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\\ = "skindata_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\ጀ웙ɋ OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\ヨ焍翺 OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\㕠㉘退۴\ = "skindata_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\skindata_auto_file\shell\open OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\skindata_auto_file\shell OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\.skindata OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\skindata_auto_file OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\铰웚ɋ OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\skindata_auto_file\shell\open\command OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\㕤㉜ᘀ退쒁ɋ\ = "skindata_auto_file" OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\ヨ焍翺\ = "skindata_auto_file" OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\㕦㉚៷蠀约翺\ = "skindata_auto_file" OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\铰웚ɋ\ = "skindata_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\㕠㉘退۴ OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings firefox.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\.skindata\ = "skindata_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\ OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\㕤㉜ᘀ退쒁ɋ OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\ጀ웙ɋ\ = "skindata_auto_file" OpenWith.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4400 OpenWith.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1972 firefox.exe Token: SeDebugPrivilege 1972 firefox.exe Token: SeDebugPrivilege 1972 firefox.exe Token: SeDebugPrivilege 1972 firefox.exe Token: SeDebugPrivilege 1972 firefox.exe - Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 1972 firefox.exe 1972 firefox.exe 1972 firefox.exe 1972 firefox.exe 1972 firefox.exe 1972 firefox.exe 1972 firefox.exe - Suspicious use of SetWindowsHookEx 18 IoCs
pid Process 4400 OpenWith.exe 4400 OpenWith.exe 4400 OpenWith.exe 4400 OpenWith.exe 4400 OpenWith.exe 4400 OpenWith.exe 4400 OpenWith.exe 4400 OpenWith.exe 4400 OpenWith.exe 4400 OpenWith.exe 4400 OpenWith.exe 4400 OpenWith.exe 4400 OpenWith.exe 4400 OpenWith.exe 4400 OpenWith.exe 4400 OpenWith.exe 4400 OpenWith.exe 1972 firefox.exe - Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 4400 wrote to memory of 4880 4400 OpenWith.exe 97 PID 4880 wrote to memory of 1972 4880 firefox.exe 99 PID 4880 wrote to memory of 1972 4880 firefox.exe 99 PID 1972 wrote to memory of 836 1972 firefox.exe 101 PID 1972 wrote to memory of 836 1972 firefox.exe 101 PID 1972 wrote to memory of 836 1972 firefox.exe 101 PID 1972 wrote to memory of 4872 1972 firefox.exe 102 PID 1972 wrote to memory of 4872 1972 firefox.exe 102 PID 1972 wrote to memory of 4872 1972 firefox.exe 102 PID 1972 wrote to memory of 4872 1972 firefox.exe 102 PID 1972 wrote to memory of 4860 1972 firefox.exe 103 PID 1972 wrote to memory of 4860 1972 firefox.exe 103 PID 1972 wrote to memory of 4860 1972 firefox.exe 103 PID 1972 wrote to memory of 4860 1972 firefox.exe 103 PID 1972 wrote to memory of 4476 1972 firefox.exe 104 PID 1972 wrote to memory of 4476 1972 firefox.exe 104 PID 1972 wrote to memory of 4476 1972 firefox.exe 104 PID 1972 wrote to memory of 4836 1972 firefox.exe 105 PID 1972 wrote to memory of 4836 1972 firefox.exe 105 PID 1972 wrote to memory of 4836 1972 firefox.exe 105 PID 1972 wrote to memory of 4836 1972 firefox.exe 105 PID 1972 wrote to memory of 5308 1972 firefox.exe 106 PID 1972 wrote to memory of 5308 1972 firefox.exe 106 PID 1972 wrote to memory of 5308 1972 firefox.exe 106 PID 1972 wrote to memory of 5308 1972 firefox.exe 106 PID 1972 wrote to memory of 5380 1972 firefox.exe 107 PID 1972 wrote to memory of 5380 1972 firefox.exe 107 PID 1972 wrote to memory of 5380 1972 firefox.exe 107 PID 1972 wrote to memory of 5380 1972 firefox.exe 107 PID 1972 wrote to memory of 5388 1972 firefox.exe 108 PID 1972 wrote to memory of 5388 1972 firefox.exe 108 PID 1972 wrote to memory of 5388 1972 firefox.exe 108 PID 1972 wrote to memory of 5388 1972 firefox.exe 108 PID 1972 wrote to memory of 5396 1972 firefox.exe 109 PID 1972 wrote to memory of 5396 1972 firefox.exe 109 PID 1972 wrote to memory of 5396 1972 firefox.exe 109 PID 1972 wrote to memory of 5396 1972 firefox.exe 109 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\waif_v4.5.4\Release\player models\player_t.skindata"1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:2008
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\waif_v4.5.4\Release\player models\player_t.skindata"2⤵
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\waif_v4.5.4\Release\player models\player_t.skindata"3⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27099 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {9ff72c71-f2bb-4050-bc36-feb952608203} -parentPid 1972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1972" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu4⤵PID:836
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2468 -prefsLen 27135 -prefMapHandle 2472 -prefMapSize 270279 -ipcHandle 2480 -initialChannelId {8cb0b580-a6db-410c-9870-3703197b7d31} -parentPid 1972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket4⤵PID:4872
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3652 -prefsLen 27276 -prefMapHandle 3656 -prefMapSize 270279 -jsInitHandle 3660 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3668 -initialChannelId {d665f8d8-0843-4b40-8af7-d9ab82c788e9} -parentPid 1972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab4⤵
- Checks processor information in registry
PID:4860
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3840 -prefsLen 27276 -prefMapHandle 3844 -prefMapSize 270279 -ipcHandle 3656 -initialChannelId {ea16c6ed-aed7-4bf5-8f81-6839c621c0c7} -parentPid 1972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1972" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd4⤵PID:4476
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4276 -prefsLen 34775 -prefMapHandle 4280 -prefMapSize 270279 -jsInitHandle 4284 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4292 -initialChannelId {aa056ca8-c25a-4ad9-974b-f3908bfbc74c} -parentPid 1972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab4⤵
- Checks processor information in registry
PID:4836
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5048 -prefsLen 35012 -prefMapHandle 5128 -prefMapSize 270279 -ipcHandle 5112 -initialChannelId {d04edba9-b044-402b-8c1e-aa0c0dc71232} -parentPid 1972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility4⤵
- Checks processor information in registry
PID:5308
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5240 -prefsLen 32900 -prefMapHandle 5244 -prefMapSize 270279 -jsInitHandle 5248 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5260 -initialChannelId {7999ae3d-3a92-4abd-9ee4-df122dd58731} -parentPid 1972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab4⤵
- Checks processor information in registry
PID:5380
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5364 -prefsLen 32952 -prefMapHandle 5368 -prefMapSize 270279 -jsInitHandle 5372 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5380 -initialChannelId {66fd07d8-2723-45de-8d9a-57d4c80dcd48} -parentPid 1972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab4⤵
- Checks processor information in registry
PID:5388
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5700 -prefsLen 32952 -prefMapHandle 5704 -prefMapSize 270279 -jsInitHandle 5708 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5716 -initialChannelId {06720856-92df-4e26-85c0-0225e7bb7233} -parentPid 1972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab4⤵
- Checks processor information in registry
PID:5396
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
- Size 16KB
- SHA256 8516912d11d83760e45a0b364b76b3218d344eaf88266fceb07c0b5027d7f5ea
- MD5 674434c7cbe94d4acf850c26dcebb08e
- SHA1 3a2f4866a3c549de15d1a2dcb59d43e913d5b30e
- SHA512 1b9eb3ec7a2cd2eee354fcc1bd73c51924ea8986c1b34c6d6582ed64cf563edb37f0c7b34d097295a4196234cb4942fe82f16d7836ab65b782ad86eed366dd30
- SSDEEP 384:HwCe7iO024YjDL84KKDL849B7SOEAd9KVRaAcP+AWRMANad:QqZYjDL8lKDL8CB7S/AmVAf+hRMMad
- TLSH T121729E3E9F413CAC1997C0E8C5F882D94C18BBA7CFE6806D21583D0DCA98969B1F548F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\14e2a25c-47b3-4323-b6f6-ef2c5211c5aa.zip
- Size 3.7MB
- SHA256 dd544d48a457b6c12041612325df3c7f9b4c3cd0369ca24cc4f71128e625be98
- MD5 3850f642d336e5b283975359ae18e3d7
- SHA1 3978cd7a6dd7a3e7cd38e17b153e16ec119d7cee
- SHA512 31254b8b9d53e4ea690eda16e079bcd983d40379e410e8078803078ec9a9ab4e168f3b9f7b591dadfda36bbe9c5cae7b8a9570f712af61ef14ccfc47de52a54f
- SSDEEP 49152:7Vv1Dboz1hnoFzgmLWGBR/VvhF62rIydNOW2ytsj6F6Qyla0NPjuO4J/ceo0nw8E:Zv1vgHohhFLGmtsjO6QINNohnw8ZG
- TLSH T15906F175D75C1609C9FF83BA850C2FC2984C4FAE8054A96BEA6AD9715CE33EE1F4484C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 11KB
- SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
- MD5 25e8156b7f7ca8dad999ee2b93a32b71
- SHA1 db587e9e9559b433cee57435cb97a83963659430
- SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
- SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
- TLSH T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 21.6MB
- SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
- MD5 40bf410fa9ef0d5499907e34885af6f4
- SHA1 4d7722337a0e26bf4a1c6478129356acb2f7b720
- SHA512 b763712aa4bd9819b7972a40216c08fd32338b14fab7ce4b166e39ce441ad62678bf0e1f25da436ffdb56ff1b1a21e3dbbaf47c0f5918c252e70656f5d0307ac
- SSDEEP 393216:KYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHY:3mghF5QDwWCm/2YU8Ivq9u5P
- TLSH T14F37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 502KB
- SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
- MD5 e690f995973164fe425f76589b1be2d9
- SHA1 e947c4dad203aab37a003194dddc7980c74fa712
- SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
- SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
- TLSH T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
- Size 3KB
- SHA256 e9fb2d57662876b034af6209a51a4125c3046f28bc61b89e24e7caf32fb1789e
- MD5 4018506720db6c3b03c35bf75a2c54a0
- SHA1 108f76729249fcc3cdcbd2dcec2104c584728521
- SHA512 87e77818c978f2dc9357cb7e316682f0a7b39742293cd2a689387aa2d3c81f9d6793fe310232a68408593a7a0f787efdd33d143edfe23704ca11685190e27665
- TLSH T19161A858F629863FE444423ADC961B406F747416A8AF6F2A36AC604D1E4B2CE77CD03E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 c9013b792f369a6786196735b83b50403212225bac76a3380b709448dd984ce7
- MD5 4d80ff2d851ad27e19f63f7b2f5961c6
- SHA1 3bb627601194b77c7f1c6929210277b5b6e40c05
- SHA512 15bcd33da777be899f5109a3c3744bbff6a031557306c6a9b52810e94ad96c6e2d821ee3d92fcb4d5898176133da206f6d5c528200a6a39bee4cfca3e3920d93
- SSDEEP 192:JIIS3x1d66JozGzgCl6mc0d3Ov5zbowbRgcyjP6:Jcd66JozGzgC1jebowbOcyj
- TLSH T160D11EA4FA28863FC404527BCCA51F414F3A385B984E7F19359CA4082D5B2DE768D1BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
- Size 7KB
- SHA256 8bba1922145e8f43a53ee925245164027e52e6b2f6cb0f684368133c112ef40b
- MD5 719fb6b48147d7acbb00df9c027165a7
- SHA1 60af1a2768899ade6ee70e76b19d63f420f19a41
- SHA512 eb37fbd0f76c7a49666b9037e1dd5639bfc2d6ce62243630a016c036b3897122f7e71ada2ef2a375928d41baeb30838c24f13f221f8be5f1cae583236bd749fe
- SSDEEP 192:UIIS3x1d66JozGzgCl6mc0dkOv5zboP/YZRgcyjP6H:Ucd66JozGzgC1j1boIZOcyjC
- TLSH T184E11FA4FA28863FC404527BCCA11F454F39385B984E7F19359CA4182D5B2DE778E17E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
- Size 25KB
- SHA256 4e3f28416702e2f087e066a227bfb38886c8cf6a548d974b05445e9043229092
- MD5 e95bf3ea354af4d71138b83f2c04fc3c
- SHA1 bbc3453840c96167a1221de4a0c6f47ef8ea7b02
- SHA512 1e3eaf592345bceb1d0884fe71e972df385b2e6285c403a41b150d748b852648b8b141383473cd17bfecc8c9d122855fe80d3d61000db492eca2d83de3fc0b3e
- SSDEEP 384:ZXCLETcQOoPGcmhur0B8E+vKDxVe2b+baD9cd66JozGzgC1jWboUOcyjC:ZXYETpPGcmhurQNoKDxVe2b+bqTEkJR
- TLSH T13EC20F94FB2A953FC41552BBDCA507002F79B88A981D2F573A4D64682C872DC3E9E07F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
- Size 25KB
- SHA256 50fd40a474e2fc3f0dcc68eca90940669a205223c21b40bf75d1847b89f611f3
- MD5 9ff1c45d958d872e3d4e250ccf9a21f0
- SHA1 9f90e393d4aa8b5d5667ec2b01a172e6678119c2
- SHA512 1b3ea315e677238b0d030aa72f14822fac7b2b4e244b5ab7ea3762266d19962b5d8738041b2fb1913db5ad2f1bcf141b7bbe8d5421a91ebd9c71142b944cf8bd
- SSDEEP 384:Jcd66JozGzgC1j+XCLETcQOoPGcmhur0B8E+vKDxVe2b+baDlboUOcyjC:PEEXYETpPGcmhurQNoKDxVe2b+bqVJR
- TLSH T11DC20F94FB2A953FC41552BBDCA507002F79B88A981D2F573A4D64682C872DC3E9E07F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
- Size 25KB
- SHA256 8fa451760ff75703520af3786dec6980034a442eb3a8eb3bba15048a0f60ba4c
- MD5 63a336933c73c88795648d624f4d5043
- SHA1 2302ac86adf2e0929b98c00c1ccd464093a370e1
- SHA512 e51b3a3a74a8da627548aa8f48734bf6939cad3fe096ebd4b4b03706e0a22f4c2fd4cbde5dadeb49ff1e5910e81d7b558ee2cf0ff3b46bc0c7dda9fa52e41916
- SSDEEP 384:Jcd66JozGzgC1jWboUOcyjZXCLETcQOoPGcmhur0B8E+vKDxVe2b+baD:PEkJyXYETpPGcmhurQNoKDxVe2b+bq
- TLSH T14CC20F94FB2A953FC41552BBDCA507002F79B88A981D2F573A4D64682C872DC3E9E07F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 3372111bf279f7e558c5580602e08905e9b8ab827aefc376b168981137a5934a
- MD5 b93fe05ab3b2256c469fc7a6857587f6
- SHA1 5f37a7bb4af126e4a9aad8162e78efdde93f3ad2
- SHA512 8c166e6145efeaea6fc38a354ab3a6e9a0a17288075908e7268ee8d17ce594e6670b1af8418bf3c0b9c23258926bc9b3b58b9c76e12f9c604382873b9e0dbec0
- TLSH T1CB214F5C3AB84D7AA9C7E79C749115CE57618E0748471C570E02EF8DDEC1AD9326B43C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\11300839-2224-4070-a66c-28c68a90e195
- Size 235B
- SHA256 d51e98d1f26a0e9cbf3bc635af685bc30a8f7308c8bbfdbe7b2a9814e5f2c205
- MD5 cb3adebf6816efd300e2e719b7c4b7a8
- SHA1 14f1ac64a30f00523fa6e7f327290eb497509014
- SHA512 79ec2045465f9f7a6628fb96efb0502ed39c1e79d4f5cf139d7718ef4ddcc81804ea997095cdbb259a0b5fcf31b4df7fc2e36cb7a0367ae26dba02031a85d13d
- TLSH T151D0978024ACBB1C08188F16B0E028C631548C3B14B45820D9A542B89DB9EC84115D6B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\1991ba62-e2e6-4714-a10a-a66cfa3c4fb8
- Size 235B
- SHA256 24496ac9c8991dfdfdcfea46e5a0893fdc1866cb961afcf1a7d6977ed98e2a42
- MD5 5e3d67b20870e98827bc3e2463a91154
- SHA1 0bd230165f2ba2d58f99870e2c66e86bcb18e21b
- SHA512 386ba6743d4fdca6472b14916b8d6b5fd29b4a73771bd6fe45530c5b9e7bb5e4cbce0775e703c73873fbb8503a68736058973e2c95e7703028b95ad5aa228ccc
- TLSH T1B6D097941488632D08040F07B0F02CCB30944C37A4B6A8608B5044BC8AB9AC4022180B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\1adfac36-95b4-4992-bfcc-57e540d4c269
- Size 2KB
- SHA256 c06d6480b8a2094a1167f75e967862a86ef8e375850d9d06226f6811a165e2f2
- MD5 625273edcb7f75f61da350aefb14d5d4
- SHA1 41e055483fc8313042d3b5b6e896811c0a024eae
- SHA512 a618ee708b33fec80a07d3e79e48973ed05c8ffc3a4b7c24ffc4ce619710de2650ccd0ec5b9ef5b254db8fcf994c627e640305501d16cdc69fc2cc9c361c4f3f
- TLSH T1AD41236C35788C779CAFF59DD483238D87688A0344C62D832E91DE0CCD9A65A736A43F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\23995757-2311-406b-bb8a-9276c85471a7
- Size 886B
- SHA256 a6ed4a78b350d517c4fa55b123bf61b6fa5c0eb0a4da71c1935b3729791b7d08
- MD5 3895affbbfcfc541cf1394478236009f
- SHA1 6891399fa7e84262e0c2342c9f5c7ab7b1d4394e
- SHA512 2db98d979bdfc6c27bd8fc4ce61dd7b5aaca563a316c537f0a18b6e2b7e09df98f2315b75bbc077240a0fd8da6488710e91de982fc903746de850987d2bc68d7
- TLSH T1821127909638B573CC78D24B99913B068FE03423C0C599047E519B184FBE11FA39660B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\a5752d4d-c216-4349-b69e-0ea8148a5ed4
- Size 15KB
- SHA256 f49b1a6f5be79828c528bcdfeeee7946c880cb24379b5249eb3ce45ddab0a20b
- MD5 d45aab503736ed4b8183ad35aba1862a
- SHA1 ad4aba04ac4390508a69d45079342f5ce2feee93
- SHA512 c14986a4693f4348830328f1784eb87fd9876a7daefacbb12344ceed8ac01b472e133315a0c44f2445a321c512a84fd1e2415faa76bf38460e568f39d8a380ef
- SSDEEP 192:HLX8UPNUWDYblbQ2U21R4nB22q/S80CRzxU3FjozhJKU5D91TaCiUm1bNZgdGzHd:bfPGWWBUlrq/S80CRlU3VwhlE06
- TLSH T1A072D9166830457A8291E36994ECBFC3E6F538CB4C419FCADBE4BD085EDE06E112794B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\b92ffa4b-2f00-4182-b345-9fc85c78b81b
- Size 883B
- SHA256 e61a52f8ce43def2944fd248e2a7fff55796cd7b2c0d1a7a8cc9419db673edde
- MD5 68fcbb94e0222a0d3e424a7417b5d5ca
- SHA1 c440a36ab9f0fdf1395575b417c79c5c911c41b0
- SHA512 1ce3a794c13a6190474354d67c0619d22121140c95f55f0514f95f27b3c129d1cbe4376a75f0cc8754e8653e026335fd4c12192a3b85517301381138a07bf4e4
- TLSH T17E110050A739B9A3CC78D24B895177068FE4392380C588043EA08A240D7E52EE39A64B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\extensions.json
- Size 16KB
- SHA256 fdf03b748a802a0fd89cbefeb51760a7d03ba46c463f0116fd8abbf67cb8b19d
- MD5 c75adcd3f68490a19cf889183e19023e
- SHA1 db9b71413bec24135428d16dfd78659748a5f7c5
- SHA512 e46da850068612928878089eb2f2ecfe25e5c7c4469639d66803723f06250268e6534f98681243c86c2a8461970783ddd05f9a7e57d982481a75b9e70734523b
- SSDEEP 384:ghkI4vzUmldvQ8dhWo94zr96oQL4HQL4PGL4HzL4H/UL4HEf4hy:PI4LRfJXF4F6Z4y4U4f424S4k
- TLSH T1E772521545049EB8294EA79BAA367E02C37D433B60855C78F4DD8FC802FB5B902FB65B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
- Size 1.1MB
- SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
- MD5 626073e8dcf656ac4130e3283c51cbba
- SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
- SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
- SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
- TLSH T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
- Size 116B
- SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
- MD5 ae29912407dfadf0d683982d4fb57293
- SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
- SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
- TLSH T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE.tmp
- Size 473B
- SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
- MD5 7406820f5d56fda6baffa951c60679d2
- SHA1 e7d4894993e506e235d55b3e47aed019d0584148
- SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
- TLSH T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
- Size 1002B
- SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
- MD5 dcffff15fa618a53834ee4ae8673bd23
- SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
- SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
- TLSH T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
- Size 21.6MB
- SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
- MD5 d14dd3f0107ff91c3e21f301d83f82b0
- SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
- SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
- SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
- TLSH T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs-1.js
- Size 7KB
- SHA256 9870d4f9e8e569014621f3102a604cb8df9ce68412163d53a728d8599c1e7c76
- MD5 7019915b06595673d6b6d59954511848
- SHA1 60280810da9a57fe3c7b4352779b5c0412d4f4a0
- SHA512 19e9c0199feb162517b7641815532940437f6964327628fe8e9364f4046ba7f5f2d99c23d8bd3f5f1d1cf7b5f365b9d67c5e53ff9c31a45c427f0a28cbd3bbed
- SSDEEP 96:xHUUTUMqGq/fSLaObzSkSSlmdv9j9ZnytHlAsO7HjvDBw88c4N8L4cn23U1K:2/R/fSLa2SSVxisIHzDBw88f
- TLSH T18FF12E7895048B7F65B6367CAC2489716AB2013BB7BF6CD610B594C4015CF3842FAAEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs-1.js
- Size 12KB
- SHA256 2a82785ba7dfb3dbb205b62608871b4e9103c1ab5812dac9349c79e17ff1b97f
- MD5 ea28553b04a7c356d808c1a571b46df8
- SHA1 d5be1c0b43156e96c42408ecd837b3c10fa53d5f
- SHA512 095e3955e2be74fde173ff131bc63f06f7eb92cc6ae6a8974138a863dd9a2b8ea0ec8e0ad0d47df96ff80d59b3384023e70cad4fd9282320a2e0dd8c971e4090
- SSDEEP 96:xHUlTUMqGq/fxLaObzSkSSlmdv9j9ZnytpwoDR1n5AsO7HjvaZBw88EO4w/SPD2b:2yR/fxLa2SSVrLRAsIHzyBw88EG/SPDi
- TLSH T1BF42BD3CA1408A3F25F3357DAC218DB01AA54227F6BFBCDA05F8D481155DF6841E6AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs.js
- Size 6KB
- SHA256 4961ce247a990421ceb828fcfc0f35b82391b546297ae9b227f79d08b988ce32
- MD5 7ed8969e1b4ecdeb41caaeda2460c978
- SHA1 a3d7306a7f4778e2252cef13c3008a995cdc5c89
- SHA512 bc6bb9686bc2570810d83357ebbb737a45ad18cbf2849bafa54f80c47a735768615667c89bde04e41b6a99b2dedd0903f65a6212df2065886902ff3025a89a88
- SSDEEP 96:xHiUTUMqGq/fSrO1zSRSSlmdv9jYnytHlAsO7HjvsBw88n8L4cn23U1K:U/R/fSrOoSSuxisIHzsBw88J
- TLSH T163E130789048CF6F64B676ACAC688C716AB2013BB7BF68D750B594C4015CF3442F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs.js
- Size 6KB
- SHA256 014691b83f4d07804df70219aeb017669d2e2fc497cb42d0ddec71a6251edfa4
- MD5 996f4a0e6a9a183acfb79a5d6e744a59
- SHA1 1351d0374a533baf2ab6f4f4e249a03f68f90960
- SHA512 06b1823ea2fcb3267748f4c4127a84c8413078ae2022dcc1e952ec28b3fb9372b958b97e85a30dcba0c43cc3ec1faed32217085fd2c2f5fc7d370ae557929f93
- SSDEEP 96:xHiUTUMqGq/fSLa1zSkSSlmdv9jYnytHlAsO7HjvsBw88n8L4cn23U1K:U/R/fSLatSSuxisIHzsBw88J
- TLSH T10AE12E789048CF7F64B6766CAC688C716AB2013BBBBF28D650B594C4015CF3442F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 13.1MB
- SHA256 800d0fef3e921d2afd204a26a86f14f152a7d49b8819c4bfc48005996a075955
- MD5 a2dd5fce927299d632801c297fd33c7a
- SHA1 c23239d45123558c181ed136d151b71b185615bc
- SHA512 036d1ec1dc6a909dfa79aebbe5f1d0a90b61291c024e7c9520bc8848ff2ffebfa8a752e1d289870834fc954283eb0770d16463b6003eed9caec1e022c606f426
- SSDEEP 49152:kLJLyyaeUT6QC5zYYttNJ0+5d6KFmbH0m7Us8JXKg8Rgu9h1rYYGDYprCFB5oLGk:m2p2FB5oLxmBYAWYZynn
- TLSH T12CD63A9270E0D692EE0086F2B31F43EB313FC1DC20E689941678B56C596769BEE6F354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\DCOAdN08.skindata.part
- Size 708KB
- SHA256 c3bf851d34f9f658eafa66448af4602d874fc88f836cbda94189e973532efe2f
- MD5 6c179150b792565ed9ea924e775e5950
- SHA1 3b5440fa0c7fca005b385d2d267f546d6dc2d5c7
- SHA512 857bfab876352fcf1f67d2c8b51ac1314ee16018297114cda11a0d10100a78f77562cc3c8df8d97b9649713f342aca9fe2d67b96876492dc3c266b9752bb2bb9
- SSDEEP 12288:PxggxL8zLC1Gyb9L+QjOxUsO2ZFCkCX30o9Y/oSsNz3cu:pgSL8z/yd+QjmUKCkCXk/oSsNz3c
- TLSH T178F43957B8539B3DC1BD02B180FF0E6A993E8945891229B3A33995583EE371B75C37C8
- MD5 SHA1 SHA512 SSDEEP TLSH