ff7fa0ce5b11ca5fd96b0f176a298702de373de8a11a9070fe5d2aebe6787a7b

Analysis

user interaction
yes
max time kernel
298s
max time network
205s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/08/2026, 16:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Vape Lite.zip
Size 6.5MB
Sample260808-t9jsjs1bkh
SHA256 ff7fa0ce5b11ca5fd96b0f176a298702de373de8a11a9070fe5d2aebe6787a7b
MD5 8dbdb8cbc7dfd04b7cbfacae08567c4d
SHA1 f1d00dfec4e5e1eba1f1aab1e37816919ba6567b
SHA512 433e34d16f16afdc4edc2b1259c6c530559ca4a71392a6f3857e496964eba70ae7a5b9b2cc4eff33e4b01b4491975de6fd737a372d9ce5e94a7768f3a1aaa5ab
SSDEEP 196608:9WByvouIX3QaAV8T6pSO6FDijgl2MOJ2QzDz3GD:0NRAa+pR6ArMQzPWD
TLSH
T1426633411F761EEA831E8FD978AE90600581875A73A73B38D2A8B37D06FC2DF5C54A53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4500	firefox.exe
Token: SeDebugPrivilege	4500	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3244 wrote to memory of 4500	3244	firefox.exe	81
PID 3244 wrote to memory of 4500	3244	firefox.exe	81
PID 4500 wrote to memory of 3276	4500	firefox.exe	82
PID 4500 wrote to memory of 3276	4500	firefox.exe	82
PID 4500 wrote to memory of 3276	4500	firefox.exe	82
PID 4500 wrote to memory of 3768	4500	firefox.exe	83
PID 4500 wrote to memory of 3768	4500	firefox.exe	83
PID 4500 wrote to memory of 3768	4500	firefox.exe	83
PID 4500 wrote to memory of 3768	4500	firefox.exe	83
PID 4500 wrote to memory of 4420	4500	firefox.exe	84
PID 4500 wrote to memory of 4420	4500	firefox.exe	84
PID 4500 wrote to memory of 4420	4500	firefox.exe	84
PID 4500 wrote to memory of 4420	4500	firefox.exe	84
PID 4500 wrote to memory of 1204	4500	firefox.exe	85
PID 4500 wrote to memory of 1204	4500	firefox.exe	85
PID 4500 wrote to memory of 1204	4500	firefox.exe	85
PID 4500 wrote to memory of 2636	4500	firefox.exe	86
PID 4500 wrote to memory of 2636	4500	firefox.exe	86
PID 4500 wrote to memory of 2636	4500	firefox.exe	86
PID 4500 wrote to memory of 2636	4500	firefox.exe	86
PID 4500 wrote to memory of 5968	4500	firefox.exe	87
PID 4500 wrote to memory of 5968	4500	firefox.exe	87
PID 4500 wrote to memory of 5968	4500	firefox.exe	87
PID 4500 wrote to memory of 5968	4500	firefox.exe	87
PID 4500 wrote to memory of 2116	4500	firefox.exe	88
PID 4500 wrote to memory of 2116	4500	firefox.exe	88
PID 4500 wrote to memory of 2116	4500	firefox.exe	88
PID 4500 wrote to memory of 2116	4500	firefox.exe	88
PID 4500 wrote to memory of 3924	4500	firefox.exe	89
PID 4500 wrote to memory of 3924	4500	firefox.exe	89
PID 4500 wrote to memory of 3924	4500	firefox.exe	89
PID 4500 wrote to memory of 3924	4500	firefox.exe	89
PID 4500 wrote to memory of 4560	4500	firefox.exe	90
PID 4500 wrote to memory of 4560	4500	firefox.exe	90
PID 4500 wrote to memory of 4560	4500	firefox.exe	90
PID 4500 wrote to memory of 4560	4500	firefox.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\Vape Lite.zip"
1⤵
PID:2448

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3244
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1988 -prefsLen 27097 -prefMapHandle 1992 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {bb2991cb-61fd-4c45-a334-cb97cbebb360} -parentPid 4500 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4500" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3276
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2436 -prefsLen 27133 -prefMapHandle 2440 -prefMapSize 270279 -ipcHandle 2448 -initialChannelId {e83ca70d-f183-4f08-b220-0312f710eaa8} -parentPid 4500 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4500" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:3768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3756 -prefsLen 27274 -prefMapHandle 3760 -prefMapSize 270279 -jsInitHandle 3764 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3772 -initialChannelId {713b05fd-7525-437c-a89b-b28b4f8a49bb} -parentPid 4500 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4500" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3920 -prefsLen 27274 -prefMapHandle 3924 -prefMapSize 270279 -ipcHandle 3940 -initialChannelId {07ffcd4d-795c-4103-b3d2-0ca064b58d52} -parentPid 4500 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4500" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1284 -prefsLen 34773 -prefMapHandle 4408 -prefMapSize 270279 -jsInitHandle 4412 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2484 -initialChannelId {05c0aa1c-4379-4cd3-97d8-41ad5b1dd1d2} -parentPid 4500 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4500" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4840 -prefsLen 34929 -prefMapHandle 4844 -prefMapSize 270279 -ipcHandle 4860 -initialChannelId {3cdad98c-a5dd-4301-81fd-94b0f6180341} -parentPid 4500 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4500" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2944 -prefsLen 32900 -prefMapHandle 2948 -prefMapSize 270279 -jsInitHandle 2980 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2704 -initialChannelId {ca239068-e34b-47ac-a450-e674d1d84646} -parentPid 4500 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4500" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:2116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5360 -prefsLen 32952 -prefMapHandle 5364 -prefMapSize 270279 -jsInitHandle 5368 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5372 -initialChannelId {0de1ce0b-af7b-4a13-a542-40146d7b7ec5} -parentPid 4500 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4500" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:3924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5580 -prefsLen 32952 -prefMapHandle 5584 -prefMapSize 270279 -jsInitHandle 5588 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2848 -initialChannelId {7ea63ab8-8484-4704-8e2c-97f44f0c01e4} -parentPid 4500 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4500" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\datareporting\glean\db\data.safe.tmp
Size 31KB
SHA256 7e01be05fe52db3adbc00ed586f54fd86054b9deb002ab2d06afc1f98c51606f
MD5 eb3a55b7de5d0f5b3635bc3848145055
SHA1 7e484e663c9a40244528315784565b2856146400
SHA512 5f09a837def842d1e4c29ed29be0a0932efe3c8107127adbea551714b67ef48bd9aedecd4319cbb71f2941f39846ef84e0b82b478a642c5704f5590691c76d25
SSDEEP 768:x/pmclgFpIGcmhuBNKi5CXANhUbLbtbPbE:hlgFkNF
TLSH
T12AE2E044EB2E963FD41412BBDCA517002F79B88A591D2FA73A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 3713e247111883c875ad5396ccaae7dd04dbd833b2f4112683a28a6804492f36
MD5 fd418de0171e5316ec7b48a25b60cdd0
SHA1 5c370fd3f0b5d9968c91a6fda2752a34c8eadd7c
SHA512 841a2eba73cd514dbc8d86d354f244ed179b786afb9ebd4b9b4b12fc9a761c17fba141ed023f3a0dd2bd358815256c7d4a7edf1d1c19691de8ba802744ddb599
SSDEEP 192:JOv5zbo4ZHVyjvOt1d66Joz0dzgCl6mc0dz:Gbo4ZHVyjsd66JozQzgC1jd
TLSH
T1DDE1FFA8E728863FC458467BCCA61F450F35389A9C4E3F29319D640C2D572EE368E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\datareporting\glean\events\events
Size 1KB
SHA256 21936b331e703424f21417f66fe0f2324f13f2f95f82578dd804b7471d639730
MD5 5ec6774d4cf8d35d6fe6aaab47e93f07
SHA1 04ec3bea83f2b93fe1ca7b5f4c087a5daecb640a
SHA512 3dd7777dd30c3e63d4804ddd805b3c2b8b746f7cec8b410f9069171b77d012dbe903741fd87881e04672c8b530e979f584acbd275734d6c50b89432a07b4e117
TLSH
T1EB213A5C39FD4D3AA8C7F29C7441068E93554B0B04871D478E53EF8DCE92A9A316A83A
MD5 SHA1 SHA512 TLSH

Submit Download

58d0d50e-c98d-40bc-a6b5-b05051e2f8ee

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\datareporting\glean\pending_pings\58d0d50e-c98d-40bc-a6b5-b05051e2f8ee
Size 16KB
SHA256 7f357e2dd6f72d4c759ab66116799f438cc84a57ce6af7e931f2d771060cdfbd
MD5 147573969f30eab809bd5c5e3faceb5a
SHA1 d4d99a87c5402470d6c13174e354e90fa866428c
SHA512 046dd45bc3e1f0b2bf0b9848f245004507ac535c5d09c7e8091997b9d209460fcabf265b19ccb4f975e24a9acde3f3a012f8f80d4fa9c6f4cbe482d0f87d251f
SSDEEP 192:MhU0JZLi0T12xli5enSGpjI4xs5Mbxt2SocCrmOsSVbRnpzxzaiLdtn1dSf4uBqq:Io7K4O6bDL3KsSVbRnplzaixofXN
TLSH
T18272EA56242045BA8251E36994FCBFC3E6F528CF4C419FCE9BE4BD086DDE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

70251f27-132e-44d5-bae0-92f10da65992

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\datareporting\glean\pending_pings\70251f27-132e-44d5-bae0-92f10da65992
Size 886B
SHA256 6df9d190332c65abbfc7a7c88dc9c82aa450f7f9686900bab6ac6d8a6a23a74d
MD5 341890cb974b8c561909b167f8601189
SHA1 837abd4694bc47162214b6e82b0afc372c1209f7
SHA512 853123e5faf538bd6993c8fa30bd6f56a4fca41f062d46b2cd81a7d70a6ea4fa09957d188d1a331aee15c062a0eb276fae59b6ceb5953a6165bcace25fa14a86
TLSH
T124110485D664B5B28D6CC18BC9E17B424BE47023C0CA492C7D915A088DEA62F7367707
MD5 SHA1 SHA512 TLSH

Submit Download

bf375122-ea19-4a04-a8cb-80d2d8285096

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\datareporting\glean\pending_pings\bf375122-ea19-4a04-a8cb-80d2d8285096
Size 235B
SHA256 8fc795e6ccd561192a34991bc22a545b6eba57b3dcd91405efb651c664135012
MD5 7e2a390800819e2dc2359b334ee13b26
SHA1 0bc8034181bceabcb6a7b995e522561b8fdfbe04
SHA512 67aa7e86e8cd8cabaa488c5a93bfe841e769a84335a9c1e5566dd37444ca0b2dceab88d28d8244ff54735d087ba0d63a9c065aa68696ae2e375dca6ebf0f15cf
TLSH
T1FDD097817888A36D0C082F0BB0E069CB70C84C3318B85820C9624074ADF9AC81292C1A
MD5 SHA1 SHA512 TLSH

Submit Download

cadb04e9-5766-47cc-a12f-dc2d80a192cf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\datareporting\glean\pending_pings\cadb04e9-5766-47cc-a12f-dc2d80a192cf
Size 883B
SHA256 950dcfe9956000b868f80d39ad327672acbd3c4dc80212b2189ca121690dd1e8
MD5 d328e531750784b30563cecd3dcfd494
SHA1 c45ff12bbae39db3631c7fe3f75b7d9e38b8a331
SHA512 94698afab520edce72c0dd70c669ee3561672a91318a26e2e1a939635d7093af3af1818e48b26f0959475d4107f9a0b5f249d97262261e49dce9c498f08da7c1
TLSH
T11C110485D631B5B38DA8C24BC5553B428BF47523C0CE45143D615D044DBA52F636B74B
MD5 SHA1 SHA512 TLSH

Submit Download

d3442f75-f068-4a17-ab2b-27ab39b09e35

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\datareporting\glean\pending_pings\d3442f75-f068-4a17-ab2b-27ab39b09e35
Size 2KB
SHA256 d36e5eeeda214690211c81d5419f1e80a4f974ed8dc8ba2d81b934b41ac38be2
MD5 40f90589c457a0068add43afe1d49223
SHA1 a0f05e640fe13de231caa7b75920300b48ff6641
SHA512 27e70b7b7c8bacbdd5cfc295380d195edfe0619ad536a93b7056967ed60fdce0a45bfc78f87cce75eef7c1f6b4cdcfcd2a2d8c809702454a210d358253a71ac8
TLSH
T1B441416C75784DBA9CDAE5CDD482274D57608A0300C758832E61EF0C8CCA7AA336E42B
MD5 SHA1 SHA512 TLSH

Submit Download

dd13dfc3-6043-43e3-9409-6d89b91eaee4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\datareporting\glean\pending_pings\dd13dfc3-6043-43e3-9409-6d89b91eaee4
Size 235B
SHA256 9574812374f0c6125331a19c7318241298bc8ce51a6e99026ce28b7078ea1d4a
MD5 977850231f06e8a69f1bdfe03382da25
SHA1 c556e6902e384047c77865fbe8a704237f2a7811
SHA512 7a39504fea4f77d741af8e97150771ff2b16940b0dbb25db967cd7c099bf42f4a11d4aeffb7215dfa46b44c1356f6de748b04951ba49f0ecd01d7456923f2d5f
TLSH
T127D0978034E8275E08384F17F0E029C630468C3320A5A820A9A24034A9F9DC4029281A
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\prefs-1.js
Size 6KB
SHA256 e4660245e70db9ada1e345d709ea28c576e93018f987cc6e56af87e8c46aae50
MD5 53e993038dff86f97ff3a434a9e72f3e
SHA1 7d4e54429a10f56f68d26d1ad7e79e0c67c0b5a5
SHA512 ef61127bdc20a24ab984000dca32937456d11836ac69b1f63714ee57c6bacc64fde6c029470903687735c8bb83b674acd8bc1b8c2f4ebc5edbc141c22f3966d8
SSDEEP 96:xHcHUTUJqGqzfBxal1zS5JSSlqdv9jK6nrH1WknMBw88H8L4cnzuAGS:eHERzfBx4SJSSeNMBw88i
TLSH
T1F2E1107895088F7F64B677ACAC688C315AB2013B7BBF68D750B55485014CF3441FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\prefs-1.js
Size 7KB
SHA256 9c236ec2171a3eefb0d091ccdedfe9a6958fd34c0c4ec23df66371fdd684352b
MD5 aa1890a7c4d3092b38057a4a42c417d1
SHA1 a99f0d2929de1f8655751223f5f9e641d54790cc
SHA512 92f985aaacd5603b9aa50e7c921def917fc80df4b124a70af2ded590ba40c3fada2a480829c001e31d2814155180a80a8007be98381ea040fd682412d3231fa8
SSDEEP 96:xHcHUTUJqGqzfBxalObzS5JSSlqdv9jK6nrH1WknMBw88H8L4cnzTAGS:eHERzfBx4rJSSeNMBw88N
TLSH
T197E11F7895088F7F64B677ACAC688C319AB2013B7BBF68D750B55484014CF3841FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\prefs.js
Size 6KB
SHA256 853e5f5e260c54b5711c52b8521c2e2f1d245c25fe10cf7ad00dbb7fbb3a1650
MD5 e026cd21ab1a2d815eb989a0f2ca91c4
SHA1 d6733c91e0a1639b0cbf273d6574e746f8394a73
SHA512 148f073cbd1075639daa8e9cae5161de9eef84c08ee1c542b2a933606fc3145bb4aec6ebd6a0f70fe62168502737cedcbdc9f4c44fccc5647c144341cb716fdc
SSDEEP 96:xHcHUTUJqGqzfBt08S1zSMsSSlqdv9jwDnrH1WknMBw88H8L4cnzu1:eHERzfB6VBsSSnnNMBw88p
TLSH
T1ADE11E7890088B6F64B676BCAC688C315AB2013BB7BF68D650B95485050CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\sessionCheckpoints.json.tmp
Size 288B
SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
MD5 948a7403e323297c6bb8a5c791b42866
SHA1 88a555717e8a4a33eccfb7d47a2a4aa31038f9c0
SHA512 17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a
TLSH
T1A5D08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.2MB
SHA256 d5be52013572ad88cd7aac8718fa036213ccefaeb6d53a731306df76ae428527
MD5 353c05f59a6864908230e05f5e93b4f2
SHA1 3ef872a136a747091a04362a166751da67fdee59
SHA512 437d5cb748ec384873f38b6f3441c227e02c5ac298f878fdde56d20a734ee870627a7a6b6d91aa4d4416e5585cca31cb27a283be32a7167b69231e7d1f790dce
SSDEEP 49152:DXg3QAjgjKR7bWrYXluFGwF1+B9/TRli4oYnW:Lg3QAjgmduFGS1+//TRCYnW
TLSH
T16C1639F824D1A257F3818037668563EB21AFD00C6477DD444BE966F990B8CEF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads