hxxps://gofile[.]io/d/OGtTwc

Analysis

max time kernel
900s
max time network
605s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/06/2026, 01:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/OGtTwc
Sample260620-b8dk2acx8m

Score

6^/10

discovery persistence

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
8	api.gofile.io
9	api.gofile.io
24	api.gofile.io
7	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	1572	firefox.exe
Token: SeDebugPrivilege	1572	firefox.exe
Token: SeDebugPrivilege	1572	firefox.exe
Token: SeDebugPrivilege	1572	firefox.exe
Token: SeDebugPrivilege	1572	firefox.exe
Token: SeDebugPrivilege	1572	firefox.exe
Token: SeDebugPrivilege	1572	firefox.exe
Token: SeDebugPrivilege	1572	firefox.exe
Token: SeDebugPrivilege	1572	firefox.exe
Token: SeDebugPrivilege	1572	firefox.exe
Token: SeDebugPrivilege	1572	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
1572	firefox.exe
1572	firefox.exe
1572	firefox.exe
1572	firefox.exe
1572	firefox.exe
1572	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1572	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 1572	1500	firefox.exe	79
PID 1500 wrote to memory of 1572	1500	firefox.exe	79
PID 1572 wrote to memory of 1856	1572	firefox.exe	80
PID 1572 wrote to memory of 1856	1572	firefox.exe	80
PID 1572 wrote to memory of 1856	1572	firefox.exe	80
PID 1572 wrote to memory of 3736	1572	firefox.exe	81
PID 1572 wrote to memory of 3736	1572	firefox.exe	81
PID 1572 wrote to memory of 3736	1572	firefox.exe	81
PID 1572 wrote to memory of 3736	1572	firefox.exe	81
PID 1572 wrote to memory of 1804	1572	firefox.exe	82
PID 1572 wrote to memory of 1804	1572	firefox.exe	82
PID 1572 wrote to memory of 1804	1572	firefox.exe	82
PID 1572 wrote to memory of 1804	1572	firefox.exe	82
PID 1572 wrote to memory of 3424	1572	firefox.exe	83
PID 1572 wrote to memory of 3424	1572	firefox.exe	83
PID 1572 wrote to memory of 3424	1572	firefox.exe	83
PID 1572 wrote to memory of 2708	1572	firefox.exe	84
PID 1572 wrote to memory of 2708	1572	firefox.exe	84
PID 1572 wrote to memory of 2708	1572	firefox.exe	84
PID 1572 wrote to memory of 2708	1572	firefox.exe	84
PID 1572 wrote to memory of 3788	1572	firefox.exe	85
PID 1572 wrote to memory of 3788	1572	firefox.exe	85
PID 1572 wrote to memory of 3788	1572	firefox.exe	85
PID 1572 wrote to memory of 3788	1572	firefox.exe	85
PID 1572 wrote to memory of 848	1572	firefox.exe	86
PID 1572 wrote to memory of 848	1572	firefox.exe	86
PID 1572 wrote to memory of 848	1572	firefox.exe	86
PID 1572 wrote to memory of 848	1572	firefox.exe	86
PID 1572 wrote to memory of 2108	1572	firefox.exe	87
PID 1572 wrote to memory of 2108	1572	firefox.exe	87
PID 1572 wrote to memory of 2108	1572	firefox.exe	87
PID 1572 wrote to memory of 2108	1572	firefox.exe	87
PID 1572 wrote to memory of 3236	1572	firefox.exe	88
PID 1572 wrote to memory of 3236	1572	firefox.exe	88
PID 1572 wrote to memory of 3236	1572	firefox.exe	88
PID 1572 wrote to memory of 3236	1572	firefox.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://gofile.io/d/OGtTwc"
1⤵
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://gofile.io/d/OGtTwc
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27097 -prefMapHandle 1960 -prefMapSize 270279 -ipcHandle 2052 -initialChannelId {45a79fbb-f6dd-49b7-aba8-6d64d8564c18} -parentPid 1572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1572" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2444 -prefsLen 27133 -prefMapHandle 2448 -prefMapSize 270279 -ipcHandle 2456 -initialChannelId {62e7786b-0860-4781-a54c-9269b855c8d3} -parentPid 1572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1572" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3736
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3628 -prefsLen 25213 -prefMapHandle 3632 -prefMapSize 270279 -jsInitHandle 3636 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3644 -initialChannelId {261e326a-e1ca-4400-a126-e7d9d6c04dc3} -parentPid 1572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1572" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3820 -prefsLen 27323 -prefMapHandle 3824 -prefMapSize 270279 -ipcHandle 3892 -initialChannelId {5b22cbec-0f7b-4fe9-8623-3532ffdcf0e9} -parentPid 1572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1572" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4384 -prefsLen 34822 -prefMapHandle 4388 -prefMapSize 270279 -jsInitHandle 4392 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4400 -initialChannelId {35a124c8-a332-4f40-9061-3b25f0ae7972} -parentPid 1572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1572" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5068 -prefsLen 34822 -prefMapHandle 5072 -prefMapSize 270279 -ipcHandle 5084 -initialChannelId {86d28d90-905a-48d3-820f-045d5288ea3b} -parentPid 1572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1572" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3788
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5288 -prefsLen 32952 -prefMapHandle 5292 -prefMapSize 270279 -jsInitHandle 5296 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5304 -initialChannelId {56d90df1-9df3-4a1f-84b4-f5236f0c44e1} -parentPid 1572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1572" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5476 -prefsLen 32952 -prefMapHandle 5480 -prefMapSize 270279 -jsInitHandle 5484 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5492 -initialChannelId {a125edc5-91a9-4dce-9f79-95d3f2f1fbd7} -parentPid 1572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1572" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:2108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3244 -prefsLen 32952 -prefMapHandle 3252 -prefMapSize 270279 -jsInitHandle 5652 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5644 -initialChannelId {623d7c0d-8c87-408f-8509-3bb55bd73fe3} -parentPid 1572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1572" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:3236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\activity-stream.contile.json
Size 4KB
SHA256 b841cfb4591bdd1d168b5ada052041e17d94b06ff1c54a8c1bdd579ad1839d1c
MD5 1021b6c3f5da9f9b673adc1ba81ea4db
SHA1 8527ea95f252cfa68cbccb22d9daa60828d8dbf1
SHA512 499ff3637fc001533c14a83f431a9851e0cce08304810be804ba14c8b00268e7889c1afe3587b21f32f749e558cd608caef2658d361ce1b66b50aa3fc223d52e
SSDEEP 96:OVV+nlYPvT+mROkFKYDcjni6D4Gjcrpy1kHtI66l:OVV+nlcymROkZtw4GjcNy1mtI66l
TLSH
T1C3A1F7FFADF84C030222F6F56C4E33ADB113716B9EE8590AFA9A8C11A8C5257819D484
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

03100235E7AEBB25C597DD91664A8F544DDFC529

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\cache2\entries\03100235E7AEBB25C597DD91664A8F544DDFC529
Size 13KB
SHA256 8c300f8690e7ae636c23ca540fdf3cdb8a189946e49a29f30c7ba476a02b3835
MD5 9668543eb0cd805474c9c277494defe7
SHA1 ca6a8817446b1d6ea21f4af922590dcd70fb7049
SHA512 f20ec8cd8b2be1d22c636c870d0ddb500f4a2351017c68f2abd070942b321af8949a0ca39cadd1bb70c0fbad91b74f676438a6fdae2604be033bcf9d96e34dcb
SSDEEP 384:HPC9iO024Yko6J+Sl1xDnZBPsac4j0lpDII+mTw:v9ZYko0+Sl7zZlsac4ID8Lz
TLSH
T17C528DB99F0239BE1923D0A4E5FE9244CD04E6BBEEE2906516143C04CA447B9F4E68CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

N3U06IEOTGY2UKSEXN0U.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\N3U06IEOTGY2UKSEXN0U.temp
Size 7KB
SHA256 c492f2fded11c9740dbb71366c30bcadb96a08abc309dd6e230249e24e55f466
MD5 c835a9d604ae281afc795d22a20082cd
SHA1 1ef9b737b96f5c7934cf1f3ef87c9dadd87fed10
SHA512 8d83e3761763b11fa84d2b57156fda129712ea48edc1565a59bb1b84232a681ab5ee3d32a90a0619c40f6f0c72f2a079f11fa8d5275c3362e2d7fff4f03568dc
SSDEEP 48:2B3dQiJ5UgdwMzvI3dQiJ/6Bdwcvi3dQiJ/adw+xhu3dQiJXkl5fQYNiU9Jy2iZD:cXmX/TX/lXXgQ09JBm89JgP
TLSH
T1C6F122010BF70985FAF396327A727B026773FC02A71B865EC2416A4A0D7335085ADFA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 4da81b501ab1db5cb5f8f8d20a86384e5cd63d9ebfb16b5ab0420ad9281b8245
MD5 591f0687de7db63cd837bd10933b0b3e
SHA1 c3eb03ec1aec7f7f5aa198588f86f575a55b2137
SHA512 aca94a4f88df3fc4712a06dceebaa7a95aaaabedc9e684ee5468e84280a7c799fb854af69942fcf4c9fe97264e7acb96be27a10095abdca1953e5607e788c107
SSDEEP 192:NI07IaOv5zboRZhIKSyjoIAx91d66Joz0dzgCl6mc0d:NzkboRZhVSyjord66JozQzgC1j
TLSH
T1D2D1ED58F628963BC418023BCDA61F400F36389A9C4E7F1932DC645D2C972DD7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 a0fa63b55bf0f04c720e1f06f26318d56e8e9c6f65264a4f553d21df04ca4ff8
MD5 3063cb7da4597742609344c050943fab
SHA1 137cb0def52e594ab3b592825dd41108641b0b2d
SHA512 74d16bfb4887bb818d4039a3dd68166ea017a032cf0fb9213166f7f634d160e02e61d10f2626d597a75f142f818a4dcad77eb8ce1c5b922a908ace73e556c407
SSDEEP 192:L1d66Joz0dzgCl6mc0dUI07IaOv5zboHDhIKSyjoI0wP:Jd66JozQzgC1jqzkbojhVSyjoe
TLSH
T185E11FA4EA28863FC408037BDDA21B410F3A385A9C4E3F19359D655C2C9B2DD778E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 87dc2699213c31227cdd6c1957eed76dae3f6dec9a25ad46b3b7bc765fcdec60
MD5 0f68941a4beccba9ec178d5a7d428648
SHA1 5f20194a7941da8901a0f2ae3ebfb3c4d92c21a4
SHA512 8a729033c50c6f5044a8fdb627b8ee4138702f6d9290bccd26ed22467c67371d31fbbfc86067397961f840d8c6fbaaa4c8ee4508465aef1cde3a07e08838ed32
SSDEEP 192:QI07IaOv5zboH4ZhIKSyjoI0wI1d66Joz0dzgCl6mc0dz:QzkboYZhVSyjotd66JozQzgC1jd
TLSH
T198E10DA4E628863FC408037BDDA21F410F3A399A9C4E3F19359D65582C9B2DD778E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 01b436fda233e8d710585820d957fb66f59d3eebf1d17949a10f03cb5ed1a1a0
MD5 05a33d0428e1d87821f43f25c3b64143
SHA1 7d962bc910828cd8f06d9c324c2b30e7d3909a3c
SHA512 aaed603e689ddab78f8ff0840f50e251d78ec04745e45b7fefa4da9a677ab93733c4c0c400f275b21f2b27e9320b7818d73daae992c39ace7745778bcde8a231
SSDEEP 192:QI07IaOv5zboH7hIKSyjoI0El1/66Joz0dzgCl6mc0dz:QzkbobhVSyjok/66JozQzgC1jd
TLSH
T17DE1FDA4E628863BC408037BDDA11B450F3A399B9C4E3F19359C61582C9B2DD778E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\events\events
Size 1KB
SHA256 666f64481c907671c84bc1e392b468d6b78b7d7175dd0b08edafaef3b754325f
MD5 35375f8310667f3295ebb1262cf4fbbf
SHA1 2b554a7cc5c2be05c5e44f855f27cfd0ce8fd8bc
SHA512 34037b417862613ed41c355fea89cb77e86fc7c06057d9fa5c0f0153ed22703cccb3697cb12a76280f29e48d1e7f5459431e1aab2982160d4f9ba7ac0ecb5941
TLSH
T171219E4C39B8CD2E98CBE69C7441028E53818D07049B6C4F5D53EF8CDE92AD9316A53C
MD5 SHA1 SHA512 TLSH

Submit Download

0288fec4-bbd6-4f3c-aeab-d531363117fb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\pending_pings\0288fec4-bbd6-4f3c-aeab-d531363117fb
Size 871B
SHA256 b36038e422eead74f3d5a879faf66cf3471ba27c5e66007070970c5e2bf40b8f
MD5 41feaa00da49ccaefe98e40c12431219
SHA1 affb6e9302f18138584e2cb5d09271663ba93333
SHA512 e8c214a7eb169cd00f2e022f06c2c08da017bc35cfded6695c27b84707b7702f677fd1276cf9396e77a6825df1ae06bec37e79945b80c101c91b4ea9d61d6464
TLSH
T11011E3C59638B9B2CC68E34F86917B024BB4762380C644143EA59E240D6A56EB3BA30B
MD5 SHA1 SHA512 TLSH

Submit Download

2b065e62-d0ff-4c89-a88e-b30644bde2d4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\pending_pings\2b065e62-d0ff-4c89-a88e-b30644bde2d4
Size 235B
SHA256 6647674a9cc2af7cf16d075acf082dce75f51be7d2e79fbf4b4a8a82e3f00ef6
MD5 b872b6da0bdef2122c28eeefb9b29c70
SHA1 de6ef07c78ba204d3976d312d834f9f421937b69
SHA512 b1ce28ae8678022595be6f391c906894de123883e2be959bcd102239460379c04ab64edce25943215ea19a02bb9a9eeeec0ab05e4c08e1a6ae6e5f9b4373391b
TLSH
T191D0A7802498676D19194F06F0E16ADA31654C7714B89828D67145789ABDDC85192D17
MD5 SHA1 SHA512 TLSH

Submit Download

4110e489-7b48-47c8-bc92-a3b8424d27c2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\pending_pings\4110e489-7b48-47c8-bc92-a3b8424d27c2
Size 2KB
SHA256 46219e98d6f1c32468876e783b8b3d11ebba874f71cc3fa47e48acf8fd17882b
MD5 149fc34ede16113f21db576b9842929d
SHA1 237c2f0154bbf776e1eaa24a972d346fdb6782de
SHA512 ee752eee811cd85ca73a82fd87f3e78fc4018fdf0bcd227b1e73af1dcd0062c4a359b1061365bbf493391284b6173d44ae18215ec5b6ab622295c59914e86100
TLSH
T17541135C35789C769C9AE29DD581234E57A08A0300C65C836F61EF0C8C967B9736F53B
MD5 SHA1 SHA512 TLSH

Submit Download

69879752-f476-4f1c-a1f5-bbc958dc8c33

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\pending_pings\69879752-f476-4f1c-a1f5-bbc958dc8c33
Size 235B
SHA256 d486b752ad4a84e427aeb0acc3aae54f0b4555504f4a6a195fda7f0f19a0b87c
MD5 22d0853031a3e3e93723014b065e85f6
SHA1 d2b5cac07dc95ac07eb0948a3389dbc27c1bdb2f
SHA512 7647b096ebde80639447d72d2e983b9fd661efc1b8a28020502eb598b424a223cae2bce0bc75d93ed9d088776e74cf98fd5d85cf3c71197fe35bbd6953c9645d
TLSH
T141D097861888337D48080F0BB0F069D630948C3320B45C20C5908AB88ABEEC88162966
MD5 SHA1 SHA512 TLSH

Submit Download

e32d499e-0283-4e5b-a35e-ec6bb6b07844

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\pending_pings\e32d499e-0283-4e5b-a35e-ec6bb6b07844
Size 886B
SHA256 807357619d82c91863272bebf12097f7bf11aefb07fe31dbbf7909c9cd8dd1ee
MD5 0c78117002f3d9abaf926d4a9e7fb695
SHA1 f38928a0137809a98e50474a37bf7b79d9ff3977
SHA512 81500345d93f647fc358ece561c008673b57cd520cbc0f4625b1f21c65490747141695f2eef375e7dfaac8f2fa73774349e64efc77ae9b4f788796742f9065ab
TLSH
T13B1104804538B972CC28E25F95D1B7524BA07023C0C64D143F54AB184CAB56EF37A307
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\extensions.json
Size 16KB
SHA256 d64f481d74748902521ab4b92cf6b8f31075f88913b39392120aec9d7e37faa0
MD5 266615e7b5f2ebda7390444f1cb3c2b7
SHA1 844f71ffc9fe4129cfd0a3749a94a96be9022552
SHA512 ba4e01e9774eb9060dfd5c917e1914c6bf0b63c0379b1975fd77a9878e6cd9940e36248fbf0ad1cc687ac87ca00047ac5e6c6d2009d29a48f5a8875f7ffbb2d5
SSDEEP 384:YkI4vIUmldv68dhWR94zX896oKL4HUL4Pw5L4H3L4HRL4HCj24h9:PI4ARf/Xo4M6f4u4ox4b4p4G24b
TLSH
T1EF72521545049EB8298FA79AAA367E01C37D433B60845C78F4DD8FC842FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\prefs-1.js
Size 7KB
SHA256 a9b9f54f7aa92ba5aaf84f205a4ef29966a3f719cd726ec9abf9dfde4c1ebaf9
MD5 b7e3ca42007d410d3ef2db8db538268a
SHA1 2984a55b03ffb8be87615d6e2087a05ffedac730
SHA512 0b2e61e47570388533e9935d53cbcd80e9d728a2805237fc258db9d437d6f75776548cf7094d23b8832b550a0ddd7e3af4603c75f24f7344d60ea0aecf1a6d54
SSDEEP 96:xH/pTULXqGqSfbPHObzSpCSSl+dv9jknRERHPKLyJBw88UxeH8L4cnEiIym:hy6RSfbPHXCSSi9PzBw88b8I5
TLSH
T167F1FE789004CB7F74B6766CAC6449715A72023B76BFACDB10BA44C5055CF3842FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\prefs-1.js
Size 6KB
SHA256 08877442d5fe047ec1c007b1c167c9d0f4c66535b1630ef2101f3cfc51960205
MD5 0bf95257ce9601087ecbed240c7513ad
SHA1 78479f8e37350b95b08ff3235a7b14771261a7b7
SHA512 8d81f2b1449f80db1f39696b306fb8c6d979e5e727556e862e38471154802f90b1a489f3f7f8eb91b172a46e7be5fbdee080ad329c66086a29f47373317f89cf
SSDEEP 96:xH/UTULXqGqSfwPH1zSpCSSl+dv9jknRERHPKLy4Bw88H8L4cnEiIym:hb6RSfwPHUCSSi9PuBw888I5
TLSH
T180E11F789408CF7F74B6766CAC6888316AB2413B7ABF68C710B954C5055CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\prefs.js
Size 6KB
SHA256 5e1efe176a54bb4f13be951207867ba7e83a9d48c4f734db3cf7c3970c64f2da
MD5 1368226ff9f3617fc561f6fa2b2028b3
SHA1 93dbc0ae85a31b9dea93e6873654eb686f71aab4
SHA512 66922c20393533c78c4a2bd3eadf26787df97199d6edd93cc0e3940cdab667c30cfa7c89269fae37adc041e01dbfc15bb33b6bd9a285e9a0868450f75d419c90
SSDEEP 96:xH/UTULXqGqSfwpmk1zSDPSSl+dv9j6nRERHPKLy4Bw88H8L4cnEiIym:hb6RSfwpmkuSSo9PuBw888I5
TLSH
T1C3E11F789408CF7F74B677ACAC6888316AB2413B76BF68C710B95485055CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 c4e9f4d1228474d988d6bb45b5c8090f0e26750e4d9bfc1cbd5b7f53677406b9
MD5 71dba49a27ab47a315a6c23bfecf1825
SHA1 39caf461f0bca224969e0d291c6de6d2ca734ec1
SHA512 c5c5c939f57e5dfdc3bcd375a999a2311d8a8673076a5d76bb1f6036a824026a6c6e3438ba5b8025c73fe8e69b95d5573d1c3c963e13496aa454fffd920a2e77
TLSH
T126414C47169E1EAAFD70C818F0CE6BE9C7A6301B04F85440D687278EA69E9C5312659D
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.5MB
SHA256 6a1daf0bedab8a4692361ec5a46b6bb2955ef14f42de2ec7b9eee9dec66e75ed
MD5 f498aba9de067913b5ff79be941f0287
SHA1 edb0648d039ce548808eb40ea0a23f2eb79bd5c7
SHA512 bb670bb4adb6038f833538ccf0268ba5fab1fd88c63c70423336b6ee6bd0a007aa2cde59f2ed01acafdef89b21f8e96b620d1f60bbc009fbf0a5e74b89abfaa6
SSDEEP 49152:tlPbkMngvZR+Uh3YdA1fVQ9hJIHkdar5zRFN9:HPbkMngRTfVQ9haHkdiV
TLSH
T1BD2639E820D1A257F3814073A64553EB21FFD00C6037DE484BA956E9A4B8CDF9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads