Analysis

  • user interaction
    yes
  • max time kernel
    898s
  • max time network
    901s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    09/08/2026, 02:30

General

  • Target
    Ripple_Delay_Pro_Setup.exe
  • Size 8.0MB
  • Sample260809-czebmsydpd
  • SHA256 b74f7528dcd73c98135c7951e34ac1246a28bac724de7820c4d85d4c3a539f8e
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops desktop.ini file(s) 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

    Inno Setup installer

  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 11 IoCs
  • Suspicious use of SetWindowsHookEx 31 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ripple_Delay_Pro_Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Ripple_Delay_Pro_Setup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3208
    • C:\Users\Admin\AppData\Local\Temp\is-1B7G2Z7RK9.tmp\Ripple_Delay_Pro_Setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-1B7G2Z7RK9.tmp\Ripple_Delay_Pro_Setup.tmp" /SL5="$602A6,5811535,893952,C:\Users\Admin\AppData\Local\Temp\Ripple_Delay_Pro_Setup.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4596
  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3980
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      2⤵
      • Drops desktop.ini file(s)
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4420
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1984 -prefsLen 27097 -prefMapHandle 1988 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {3aa10c6e-82df-4951-91d1-ace8e871619c} -parentPid 4420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4420" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        3⤵
          PID:1652
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27133 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {942379a7-3f95-46ec-9392-050e820ec2ff} -parentPid 4420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
          3⤵
            PID:2356
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3808 -prefsLen 27274 -prefMapHandle 3812 -prefMapSize 270279 -jsInitHandle 3816 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3824 -initialChannelId {18042d33-b1ae-4a39-8d15-f35a994c9055} -parentPid 4420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
            3⤵
            • Checks processor information in registry
            PID:1580
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3972 -prefsLen 27274 -prefMapHandle 3976 -prefMapSize 270279 -ipcHandle 3992 -initialChannelId {2dbef3a7-3890-4e78-9a44-9d1f39bbbaed} -parentPid 4420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4420" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
            3⤵
              PID:1796
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2612 -prefsLen 34773 -prefMapHandle 2816 -prefMapSize 270279 -jsInitHandle 2600 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1448 -initialChannelId {9610702f-bd51-4961-b657-7a9dae2f5e01} -parentPid 4420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
              3⤵
              • Checks processor information in registry
              PID:3140
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3316 -prefsLen 34903 -prefMapHandle 2800 -prefMapSize 270279 -ipcHandle 4984 -initialChannelId {9f620a7a-bb32-47a2-94eb-2f2f8254b493} -parentPid 4420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
              3⤵
              • Checks processor information in registry
              PID:2620
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5056 -prefsLen 32793 -prefMapHandle 5060 -prefMapSize 270279 -jsInitHandle 5064 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5072 -initialChannelId {847af453-c144-4f8c-aa05-5250e1f94f97} -parentPid 4420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
              3⤵
              • Checks processor information in registry
              PID:2300
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5304 -prefsLen 32845 -prefMapHandle 5300 -prefMapSize 270279 -jsInitHandle 5296 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5328 -initialChannelId {3cac16ee-0cf7-4993-909d-d2453e661ff0} -parentPid 4420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
              3⤵
              • Checks processor information in registry
              PID:1524
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3424 -prefsLen 32845 -prefMapHandle 5332 -prefMapSize 270279 -jsInitHandle 5336 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5344 -initialChannelId {75585089-abf8-41bc-a7a1-1bcc3a2a3afb} -parentPid 4420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
              3⤵
              • Checks processor information in registry
              PID:4904
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6496 -prefsLen 33031 -prefMapHandle 6480 -prefMapSize 270279 -jsInitHandle 6484 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6488 -initialChannelId {da78f593-f38c-4dec-ab8c-f4d7cb98a78c} -parentPid 4420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
              3⤵
              • Checks processor information in registry
              PID:4288
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5236 -prefsLen 36808 -prefMapHandle 6112 -prefMapSize 270279 -jsInitHandle 5808 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5176 -initialChannelId {2599f6c9-d512-4221-b361-d4f696ca953b} -parentPid 4420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
              3⤵
              • Checks processor information in registry
              PID:4416
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 18836 -prefsLen 40510 -prefMapHandle 18792 -prefMapSize 270279 -ipcHandle 18356 -initialChannelId {0fb68a6f-9326-4f93-ba3b-bf72ca9141e1} -parentPid 4420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 utility
              3⤵
              • Checks processor information in registry
              PID:5264
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
          1⤵
            PID:5400

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                activity-stream.contile.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e4veoxpw.default-release\activity-stream.contile.json
                • Size 4KB
                • SHA256 c2b33456d943d1ae9f5027f2f7a8b67346876bb4d49408311cacbd42e3875fcf
                • MD5 SHA1 SHA512 SSDEEP TLSH

                activity-stream.discovery_stream.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e4veoxpw.default-release\activity-stream.discovery_stream.json
                • Size 75KB
                • SHA256 4694a0e2bcf25aa1df010a552d401f0bead0ff9835459255b693f328887e9142
                • MD5 SHA1 SHA512 SSDEEP TLSH

                4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e4veoxpw.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
                • Size 16KB
                • SHA256 78968ba87480fc8a57ad87493aec3e962f378851ddc8047e3d7c66542947b3a8
                • MD5 SHA1 SHA512 SSDEEP TLSH

                86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e4veoxpw.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
                • Size 16KB
                • SHA256 2e8b267e4df2801834445d6f04584a4d4bbb96db43125ea2813df78fa7c95c60
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_arts_and_entertainment.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e4veoxpw.default-release\personality-provider\nb_model_build_attachment_arts_and_entertainment.json
                • Size 67KB
                • SHA256 960065cc44a09bef89206d28048d3c23719d2f5e9b38cfc718ca864c9e0e91e9
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_autos_and_vehicles.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e4veoxpw.default-release\personality-provider\nb_model_build_attachment_autos_and_vehicles.json
                • Size 44KB
                • SHA256 022f9495f8867fea275ece900cfa7664c68c25073db4748343452dbc0b9eda17
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_beauty_and_fitness.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e4veoxpw.default-release\personality-provider\nb_model_build_attachment_beauty_and_fitness.json
                • Size 33KB
                • SHA256 eed46e8fe6ff20f89884b4fc68a81e8d521231440301a01bb89beec8ebad296b
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_blogging_resources_and_services.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e4veoxpw.default-release\personality-provider\nb_model_build_attachment_blogging_resources_and_services.json
                • Size 33KB
                • SHA256 c9f2a779dba0bc886cc1255816bd776bdc2e8a6a8e0f9380495a92bb66862780
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_books_and_literature.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e4veoxpw.default-release\personality-provider\nb_model_build_attachment_books_and_literature.json
                • Size 67KB
                • SHA256 df23a5b6f583ec3b4dce2aca8ff53cbdfadfd58c4b7aeb2e397eade5ff75c996
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_business_and_industrial.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e4veoxpw.default-release\personality-provider\nb_model_build_attachment_business_and_industrial.json
                • Size 45KB
                • SHA256 8410809ebac544389cf27a10e2cbd687b7a68753aa50a42f235ac3fc7b60ce2c
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_computers_and_electronics.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e4veoxpw.default-release\personality-provider\nb_model_build_attachment_computers_and_electronics.json
                • Size 45KB
                • SHA256 ab20b97406b0d9bf4f695e5ec7db4ebad5efb682311e74ca757d45b87ffc106b
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_finance.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e4veoxpw.default-release\personality-provider\nb_model_build_attachment_finance.json
                • Size 33KB
                • SHA256 384bf5fcc6928200c7ebb1f03f99bf74f6063e78d3cd044374448f879799318e
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_food_and_drink.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e4veoxpw.default-release\personality-provider\nb_model_build_attachment_food_and_drink.json
                • Size 67KB
                • SHA256 905357002f2eced8bba1be2285a9b83198f60d2f9bb1144b5c119994f2ec6e34
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_games.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e4veoxpw.default-release\personality-provider\nb_model_build_attachment_games.json
                • Size 44KB
                • SHA256 35e67835a5cf82144765dfb1095ebc84ac27d08812507ad0a2d562bf68e13e85
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_health.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e4veoxpw.default-release\personality-provider\nb_model_build_attachment_health.json
                • Size 33KB
                • SHA256 150f21c4f60856ab5e22891939d68d062542537b42a7ce1f8a8cec9300e7c565
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_hobbies_and_leisure.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e4veoxpw.default-release\personality-provider\nb_model_build_attachment_hobbies_and_leisure.json
                • Size 67KB
                • SHA256 47db7797297a2a81d28c551117e27144b58627dbac1b1d52672b630d220f025d
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_home_and_garden.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e4veoxpw.default-release\personality-provider\nb_model_build_attachment_home_and_garden.json
                • Size 33KB
                • SHA256 19edd15ebce419b83469d2ab783c0c1377d72a186d1ff08857a82bca842eea54
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_internet_and_telecom.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e4veoxpw.default-release\personality-provider\nb_model_build_attachment_internet_and_telecom.json
                • Size 67KB
                • SHA256 e646d43505c9c4e53dbaa474ef85d650a3f309ccf153d106f328d9b6aeb66d52
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_jobs_and_education.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e4veoxpw.default-release\personality-provider\nb_model_build_attachment_jobs_and_education.json
                • Size 33KB
                • SHA256 29080288b2130a67414ecb296a53ddd9f0a4771035e3c1b2112e0ce656a7481a
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_law_and_government.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e4veoxpw.default-release\personality-provider\nb_model_build_attachment_law_and_government.json
                • Size 68KB
                • SHA256 257ee9a218a1b7f9c1a6c890f38920eb7e731808e3d9b9fc956f8346c29a3e63
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_online_communities.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e4veoxpw.default-release\personality-provider\nb_model_build_attachment_online_communities.json
                • Size 67KB
                • SHA256 11b6084552e2979b5bc0fd6ffdc61e445d49692c0ae8dffedc07792f8062d13f
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_people_and_society.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e4veoxpw.default-release\personality-provider\nb_model_build_attachment_people_and_society.json
                • Size 45KB
                • SHA256 4990a5d17bea15617624c48a0c7c23d16e95f15e2ec9dd1d82ee949567bbaec0
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_pets_and_animals.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e4veoxpw.default-release\personality-provider\nb_model_build_attachment_pets_and_animals.json
                • Size 44KB
                • SHA256 dd537bfb1497eb9457c0c8ecbd2846f325e13ddef3988fd293a29e68ab0b2671
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_real_estate.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e4veoxpw.default-release\personality-provider\nb_model_build_attachment_real_estate.json
                • Size 67KB
                • SHA256 efcf6b2d09e89b8c449ffbcdb5354beaa7178673862ebcdd6593561f2aa7d99a
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_reference.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e4veoxpw.default-release\personality-provider\nb_model_build_attachment_reference.json
                • Size 56KB
                • SHA256 3619daa64036d1f0197cdadf7660e390d4b6e8c1b328ed3b59f828a205a6ea49
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_science.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e4veoxpw.default-release\personality-provider\nb_model_build_attachment_science.json
                • Size 56KB
                • SHA256 9606ce3988b2d2a4921b58ac454f54e53a9ea8f358326522a8b1dcc751b50b32
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_shopping.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e4veoxpw.default-release\personality-provider\nb_model_build_attachment_shopping.json
                • Size 67KB
                • SHA256 bfd7e68ddca6696c798412402965a0384df0c8c209931bbadabf88ccb45e3bb6
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_sports.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e4veoxpw.default-release\personality-provider\nb_model_build_attachment_sports.json
                • Size 56KB
                • SHA256 44da98b03350e91e852fe59f0fc05d752fc867a5049ab0363da8bb7b7078ad14
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_travel.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e4veoxpw.default-release\personality-provider\nb_model_build_attachment_travel.json
                • Size 67KB
                • SHA256 4336ac211a822b0a5c3ce5de0d4730665acc351ee1965ea8da1c72477e216dfa
                • MD5 SHA1 SHA512 SSDEEP TLSH

                recipe_attachment.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e4veoxpw.default-release\personality-provider\recipe_attachment.json
                • Size 1KB
                • SHA256 fc07d42847eeaf69dcbf1b9a16eb48b141c11feb67aa40724be2aee83cb621b7
                • MD5 SHA1 SHA512 TLSH

                499bcbba-0412-462e-a643-ef86004badfd.zip

                • Path C:\Users\Admin\AppData\Local\Temp\499bcbba-0412-462e-a643-ef86004badfd.zip
                • Size 3.8MB
                • SHA256 0c21f80ad1b3796c49429949e6a3d52cbe9c3b5b4c317690a749d80076396d0c
                • MD5 SHA1 SHA512 SSDEEP TLSH

                Ripple_Delay_Pro_Setup.tmp

                • Path C:\Users\Admin\AppData\Local\Temp\is-1B7G2Z7RK9.tmp\Ripple_Delay_Pro_Setup.tmp
                • Size 4.2MB
                • SHA256 2534175d93593a45f7f430f9109658d2e8ba3277774eaa068607a910be40b286
                • MD5 SHA1 SHA512 SSDEEP TLSH

                remote-settings-startup-bundle-

                • Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
                • Size 574KB
                • SHA256 807e9c2788d4f35b62d7d32367b48df5390fba6b42a00e7a7ad4379511b4d0e3
                • MD5 SHA1 SHA512 SSDEEP TLSH

                tmpaddon

                • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                • Size 11KB
                • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                • MD5 SHA1 SHA512 SSDEEP TLSH

                tmpaddon

                • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                • Size 502KB
                • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                • MD5 SHA1 SHA512 SSDEEP TLSH

                6824f4a902c78fbd.customDestinations-ms

                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
                • Size 9KB
                • SHA256 06e5a6793a405d85a72d5fff969a5bb09f714a5955091371c984ba64a4531920
                • MD5 SHA1 SHA512 SSDEEP TLSH

                6824f4a902c78fbd.customDestinations-ms

                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
                • Size 9KB
                • SHA256 1f335e6520e767af9950662335aefca9f897d20038866b5d3068c4fe1c324125
                • MD5 SHA1 SHA512 SSDEEP TLSH

                addonStartup.json.lz4

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\addonStartup.json.lz4
                • Size 4KB
                • SHA256 3918a2a23672be68b1d34c7cb0b27da00c5a2fc38b9408a88d1d32ddb1393341
                • MD5 SHA1 SHA512 SSDEEP TLSH

                bookmarks-2026-08-09_10_jOXDdFc-2nMoefCP6u2_Oi1vscyPi7G7Q0krApQShO8=.jsonlz4

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\bookmarkbackups\bookmarks-2026-08-09_10_jOXDdFc-2nMoefCP6u2_Oi1vscyPi7G7Q0krApQShO8=.jsonlz4
                • Size 856B
                • SHA256 280d56fe11a742224be98279e869ae9825163f92145ba1698e2f806a87951be5
                • MD5 SHA1 SHA512 TLSH

                data.safe.tmp

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\db\data.safe.tmp
                • Size 77KB
                • SHA256 247a7c99029c113048626533146575790df4079a96fff436a40b2d860bb682f2
                • MD5 SHA1 SHA512 SSDEEP TLSH

                data.safe.tmp

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\db\data.safe.tmp
                • Size 77KB
                • SHA256 a91f67aa7c68bf7321a9e77f507f4a1895d267f8f93915765b12781228e49d92
                • MD5 SHA1 SHA512 SSDEEP TLSH

                data.safe.tmp

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\db\data.safe.tmp
                • Size 77KB
                • SHA256 db323d35f8443e0d3ef0582fbd909fa6879feff559d1a15515d4f58b32daaf91
                • MD5 SHA1 SHA512 SSDEEP TLSH

                data.safe.tmp

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\db\data.safe.tmp
                • Size 80KB
                • SHA256 b8534165a132874fb4bc07d9f2c5539d334c26f92f355f68e08b4ea770584cfd
                • MD5 SHA1 SHA512 SSDEEP TLSH

                data.safe.tmp

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\db\data.safe.tmp
                • Size 7KB
                • SHA256 1217061406399ea7fcc728e1380974d2393929ed6a3a04613ff03bc3e18deb69
                • MD5 SHA1 SHA512 SSDEEP TLSH

                data.safe.tmp

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\db\data.safe.tmp
                • Size 5KB
                • SHA256 74b4ecf36248093f2e0e3f54b4d6f3592d733d4d45d5bc86724cb3016e17e08a
                • MD5 SHA1 SHA512 SSDEEP TLSH

                data.safe.tmp

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\db\data.safe.tmp
                • Size 6KB
                • SHA256 082e51e635b15276ccef86990d51449696594473e636e3c8aeb86afc8a9e5d25
                • MD5 SHA1 SHA512 SSDEEP TLSH

                events

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\events\events
                • Size 1KB
                • SHA256 6a17f608b329a939cb8a8f58b7d293ab2b76ed66fb0cd4610d5bcb7c54c576f9
                • MD5 SHA1 SHA512 TLSH

                093ac74d-1480-4cd5-b74c-df0bd880463d

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\093ac74d-1480-4cd5-b74c-df0bd880463d
                • Size 235B
                • SHA256 b051145c9553d0401c169da7c5420a64369719c0605ff8d80541935f51604ac6
                • MD5 SHA1 SHA512 TLSH

                966e6fd4-0db8-4d77-8654-c7d6ecead2a8

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\966e6fd4-0db8-4d77-8654-c7d6ecead2a8
                • Size 871B
                • SHA256 0178977ebf3ef6854f9fdd81f3b671ec80be0d2f846d8df663f9ec0e10b73933
                • MD5 SHA1 SHA512 TLSH

                9e075469-1ec0-4954-a948-1c6063fcc92c

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\9e075469-1ec0-4954-a948-1c6063fcc92c
                • Size 235B
                • SHA256 6c8ba9cde7abdf9df35b8a78b30ab66ec88265330468d058a409737783c6cd3c
                • MD5 SHA1 SHA512 TLSH

                c63d7162-caf9-44f2-9e30-10965d7b3f54

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\c63d7162-caf9-44f2-9e30-10965d7b3f54
                • Size 2KB
                • SHA256 17d7c9e884a64332af95a8fd9c6c9ace8c9936e4b1a320cd9b03164c83f7c685
                • MD5 SHA1 SHA512 TLSH

                e1679ba0-0530-4181-98da-4e5f285bb505

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\e1679ba0-0530-4181-98da-4e5f285bb505
                • Size 886B
                • SHA256 d1c600b206a22f2b1a1a5abf4a7e56c073a055be8655dbd12adfa15e748f4144
                • MD5 SHA1 SHA512 TLSH

                extension-preferences.json

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\extension-preferences.json
                • Size 942B
                • SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
                • MD5 SHA1 SHA512 TLSH

                extensions.json

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\extensions.json
                • Size 16KB
                • SHA256 a1945d34507c84adfa8e74961ffd62ac6239be63d5ae5564331c30a4ba647fc7
                • MD5 SHA1 SHA512 SSDEEP TLSH

                gmpopenh264.dll

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                • Size 1.1MB
                • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                • MD5 SHA1 SHA512 SSDEEP TLSH

                gmpopenh264.info

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                • Size 116B
                • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                • MD5 SHA1 SHA512 TLSH

                manifest.json

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                • Size 1002B
                • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                • MD5 SHA1 SHA512 TLSH

                widevinecdm.dll

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                • Size 21.6MB
                • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                • MD5 SHA1 SHA512 SSDEEP TLSH

                prefs-1.js

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\prefs-1.js
                • Size 12KB
                • SHA256 bbef8a2afd7aea0fd4c733d621acd2a63b16b31144b0ba2e82ac969e9b9e8eac
                • MD5 SHA1 SHA512 SSDEEP TLSH

                prefs-1.js

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\prefs-1.js
                • Size 12KB
                • SHA256 5b4a68dee14a01b9321a7f673bd7c255c3f73c0ff0fb621e7fe16ed7c6a013d2
                • MD5 SHA1 SHA512 SSDEEP TLSH

                prefs-1.js

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\prefs-1.js
                • Size 6KB
                • SHA256 4767d5d65f8a736736bc72ccaa9a2aaf08833b12961e93301bb4eb66ce016b72
                • MD5 SHA1 SHA512 SSDEEP TLSH

                prefs.js

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\prefs.js
                • Size 6KB
                • SHA256 de3679f69b34136ccc0e17fab2d49eb25df4118d9babfb58fd2dc04194fda0a0
                • MD5 SHA1 SHA512 SSDEEP TLSH

                prefs.js

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\prefs.js
                • Size 7KB
                • SHA256 6d5eadc9bba6c95fb0f39e5aafc9a223f4d322fded503b43a3e5a59dd15310a8
                • MD5 SHA1 SHA512 SSDEEP TLSH

                prefs.js

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\prefs.js
                • Size 7KB
                • SHA256 2529a4c3777069a9a56312f33debc04ecac47c682a358016bdb450d740080a38
                • MD5 SHA1 SHA512 SSDEEP TLSH

                recovery.baklz4

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\sessionstore-backups\recovery.baklz4
                • Size 3KB
                • SHA256 f1c90aa774e32a3e3288c0c757889d808e5655297ee0c807e6eb85afa7e92e82
                • MD5 SHA1 SHA512 TLSH

                recovery.baklz4

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\sessionstore-backups\recovery.baklz4
                • Size 3KB
                • SHA256 306c7ed20ac3b865d98fe5519ddf12b0dbd8402130552c3ddc4a7daea7080d4a
                • MD5 SHA1 SHA512 TLSH

                recovery.baklz4

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\sessionstore-backups\recovery.baklz4
                • Size 3KB
                • SHA256 e09dad3f5840653cd011af547d318b8d3738addab84de4f62f2c0e8145e3d257
                • MD5 SHA1 SHA512 TLSH

                recovery.baklz4

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\sessionstore-backups\recovery.baklz4
                • Size 3KB
                • SHA256 75c13dd93a8c1cc11a8b10d29e3a93d05235b5a2f34eddd6040eedbd2f832a99
                • MD5 SHA1 SHA512 TLSH

                recovery.baklz4

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\sessionstore-backups\recovery.baklz4
                • Size 3KB
                • SHA256 7aee0efef0ace0a6653191d81cb602ed6b80ab605131eb5d7e6fb284bac41d1e
                • MD5 SHA1 SHA512 TLSH

                recovery.baklz4

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\sessionstore-backups\recovery.baklz4
                • Size 1KB
                • SHA256 cd22eca19d717bc38d5565fd5af77c9ebc496e5ee4bae57bf574836a4cf70dc9
                • MD5 SHA1 SHA512 TLSH

                recovery.baklz4

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\sessionstore-backups\recovery.baklz4
                • Size 2KB
                • SHA256 68a5e49ccfe0bb36f0fe1dda037f9da783f2a6d1b0f731eca0bf4812eed995db
                • MD5 SHA1 SHA512 TLSH

                recovery.baklz4

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\sessionstore-backups\recovery.baklz4
                • Size 2KB
                • SHA256 acc47bcb647599928fd7842e31286a0ca36c02afa005ae17615fa347cf10e366
                • MD5 SHA1 SHA512 TLSH

                recovery.jsonlz4

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\sessionstore-backups\recovery.jsonlz4
                • Size 3KB
                • SHA256 bc23b457d1b7c3b57fc6b3a17e3b0812178e2d887b6e00c79df4efd63d7b4f93
                • MD5 SHA1 SHA512 TLSH

                3870112724rsegmnoittet-es.sqlite

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                • Size 11.0MB
                • SHA256 d989f91ee412a51e7628251586da444a561c8eaedfc7e64ac22d5632e67d5174
                • MD5 SHA1 SHA512 SSDEEP TLSH

                memory/3208-0-0x0000000000A20000-0x0000000000B09000-memory.dmp

                memory/3208-6-0x0000000000A20000-0x0000000000B09000-memory.dmp

                memory/4596-7-0x0000000000330000-0x000000000077B000-memory.dmp

                memory/4596-8-0x0000000002EB0000-0x0000000002EB1000-memory.dmp

                memory/4596-5-0x0000000002EB0000-0x0000000002EB1000-memory.dmp