Overview

overview

8

Static

static

1

URLScan

urlscan

1

https://gofile.io/d/...

windows10-2004-x64

6

https://gofile.io/d/...

windows10-ltsc_2021-x64

6

https://gofile.io/d/...

windows11-21h2-x64

6

https://gofile.io/d/...

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    899s
  • max time network
    605s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/06/2026, 01:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    https://gofile.io/d/OGtTwc
  • Sample260620-b8dk2acx8m
Score
8/10
adwarediscoverypersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops desktop.ini file(s) 3 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 19 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 39 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of FindShellTrayWindow 56 IoCs
  • Suspicious use of SendNotifyMessage 44 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://gofile.io/d/OGtTwc"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2312
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://gofile.io/d/OGtTwc
      2⤵
      • Drops desktop.ini file(s)
      • Checks processor information in registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5368
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1972 -prefsLen 27097 -prefMapHandle 1976 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {c8e35d5c-8c72-44e0-a3ad-bddc626f00d3} -parentPid 5368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5368" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        3⤵
          PID:4540
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2420 -prefsLen 27133 -prefMapHandle 2424 -prefMapSize 270279 -ipcHandle 2432 -initialChannelId {40197bcd-6244-473f-858c-3c1620b68157} -parentPid 5368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5368" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
          3⤵
            PID:5904
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3968 -prefsLen 25213 -prefMapHandle 3972 -prefMapSize 270279 -jsInitHandle 3976 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3984 -initialChannelId {094b3ad1-d737-42a0-bf03-337ef1b397e9} -parentPid 5368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5368" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
            3⤵
            • Checks processor information in registry
            PID:3832
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4128 -prefsLen 27323 -prefMapHandle 4132 -prefMapSize 270279 -ipcHandle 4200 -initialChannelId {a5ca0565-8f58-46e7-b0f4-0fcffd1730d8} -parentPid 5368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5368" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
            3⤵
              PID:2956
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2804 -prefsLen 34822 -prefMapHandle 2648 -prefMapSize 270279 -jsInitHandle 1528 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3052 -initialChannelId {61c7bb63-ec1c-4b42-b71d-345990798e55} -parentPid 5368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5368" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
              3⤵
              • Checks processor information in registry
              PID:2908
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5076 -prefsLen 35010 -prefMapHandle 5080 -prefMapSize 270279 -ipcHandle 5084 -initialChannelId {e29f2f63-bf9b-4d9f-9c9d-75d996dfe52c} -parentPid 5368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5368" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
              3⤵
              • Checks processor information in registry
              PID:2284
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5640 -prefsLen 32952 -prefMapHandle 5516 -prefMapSize 270279 -jsInitHandle 5664 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5460 -initialChannelId {b83cfcb1-e44b-40af-b5e4-63508cc382d9} -parentPid 5368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5368" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
              3⤵
              • Checks processor information in registry
              PID:3148
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5644 -prefsLen 32952 -prefMapHandle 5552 -prefMapSize 270279 -jsInitHandle 920 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5676 -initialChannelId {4f0178c0-fb67-4f61-b34d-e0b28128a9a5} -parentPid 5368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5368" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
              3⤵
              • Checks processor information in registry
              PID:5628
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5960 -prefsLen 32952 -prefMapHandle 5964 -prefMapSize 270279 -jsInitHandle 5968 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5976 -initialChannelId {7ea1fbb1-7e92-466a-b9fc-6216f6780fd6} -parentPid 5368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5368" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
              3⤵
              • Checks processor information in registry
              PID:5284
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1720
          • C:\Windows\explorer.exe
            explorer.exe /LOADSAVEDWINDOWS
            2⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Enumerates connected drives
            • Checks SCSI registry key(s)
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            PID:764
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:5512
        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:5876
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k GPSvcGroup
          1⤵
            PID:4236
          • C:\Windows\System32\SecurityHealthHost.exe
            \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
            1⤵
              PID:4380

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  activity-stream.contile.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\activity-stream.contile.json
                  • Size 4KB
                  • SHA256 b841cfb4591bdd1d168b5ada052041e17d94b06ff1c54a8c1bdd579ad1839d1c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  activity-stream.discovery_stream.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\activity-stream.discovery_stream.json
                  • Size 75KB
                  • SHA256 0f7183011ee02d06459195420aae73600d69c3917b83f098eb356ab174243d0f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  03100235E7AEBB25C597DD91664A8F544DDFC529
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\cache2\entries\03100235E7AEBB25C597DD91664A8F544DDFC529
                  • Size 13KB
                  • SHA256 9515bb29a66178e3d416614c89e983d8f9794f7d4b3e6651ece02c2d08c880b9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_arts_and_entertainment.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\personality-provider\nb_model_build_attachment_arts_and_entertainment.json
                  • Size 67KB
                  • SHA256 960065cc44a09bef89206d28048d3c23719d2f5e9b38cfc718ca864c9e0e91e9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_autos_and_vehicles.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\personality-provider\nb_model_build_attachment_autos_and_vehicles.json
                  • Size 44KB
                  • SHA256 022f9495f8867fea275ece900cfa7664c68c25073db4748343452dbc0b9eda17
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_beauty_and_fitness.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\personality-provider\nb_model_build_attachment_beauty_and_fitness.json
                  • Size 33KB
                  • SHA256 eed46e8fe6ff20f89884b4fc68a81e8d521231440301a01bb89beec8ebad296b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_blogging_resources_and_services.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\personality-provider\nb_model_build_attachment_blogging_resources_and_services.json
                  • Size 33KB
                  • SHA256 c9f2a779dba0bc886cc1255816bd776bdc2e8a6a8e0f9380495a92bb66862780
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_books_and_literature.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\personality-provider\nb_model_build_attachment_books_and_literature.json
                  • Size 67KB
                  • SHA256 df23a5b6f583ec3b4dce2aca8ff53cbdfadfd58c4b7aeb2e397eade5ff75c996
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_business_and_industrial.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\personality-provider\nb_model_build_attachment_business_and_industrial.json
                  • Size 45KB
                  • SHA256 8410809ebac544389cf27a10e2cbd687b7a68753aa50a42f235ac3fc7b60ce2c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_computers_and_electronics.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\personality-provider\nb_model_build_attachment_computers_and_electronics.json
                  • Size 45KB
                  • SHA256 ab20b97406b0d9bf4f695e5ec7db4ebad5efb682311e74ca757d45b87ffc106b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_finance.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\personality-provider\nb_model_build_attachment_finance.json
                  • Size 33KB
                  • SHA256 384bf5fcc6928200c7ebb1f03f99bf74f6063e78d3cd044374448f879799318e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_food_and_drink.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\personality-provider\nb_model_build_attachment_food_and_drink.json
                  • Size 67KB
                  • SHA256 905357002f2eced8bba1be2285a9b83198f60d2f9bb1144b5c119994f2ec6e34
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_games.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\personality-provider\nb_model_build_attachment_games.json
                  • Size 44KB
                  • SHA256 35e67835a5cf82144765dfb1095ebc84ac27d08812507ad0a2d562bf68e13e85
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_health.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\personality-provider\nb_model_build_attachment_health.json
                  • Size 33KB
                  • SHA256 150f21c4f60856ab5e22891939d68d062542537b42a7ce1f8a8cec9300e7c565
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_hobbies_and_leisure.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\personality-provider\nb_model_build_attachment_hobbies_and_leisure.json
                  • Size 67KB
                  • SHA256 47db7797297a2a81d28c551117e27144b58627dbac1b1d52672b630d220f025d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_home_and_garden.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\personality-provider\nb_model_build_attachment_home_and_garden.json
                  • Size 33KB
                  • SHA256 19edd15ebce419b83469d2ab783c0c1377d72a186d1ff08857a82bca842eea54
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_internet_and_telecom.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\personality-provider\nb_model_build_attachment_internet_and_telecom.json
                  • Size 67KB
                  • SHA256 e646d43505c9c4e53dbaa474ef85d650a3f309ccf153d106f328d9b6aeb66d52
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_jobs_and_education.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\personality-provider\nb_model_build_attachment_jobs_and_education.json
                  • Size 33KB
                  • SHA256 29080288b2130a67414ecb296a53ddd9f0a4771035e3c1b2112e0ce656a7481a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_law_and_government.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\personality-provider\nb_model_build_attachment_law_and_government.json
                  • Size 68KB
                  • SHA256 257ee9a218a1b7f9c1a6c890f38920eb7e731808e3d9b9fc956f8346c29a3e63
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_online_communities.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\personality-provider\nb_model_build_attachment_online_communities.json
                  • Size 67KB
                  • SHA256 11b6084552e2979b5bc0fd6ffdc61e445d49692c0ae8dffedc07792f8062d13f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_people_and_society.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\personality-provider\nb_model_build_attachment_people_and_society.json
                  • Size 45KB
                  • SHA256 4990a5d17bea15617624c48a0c7c23d16e95f15e2ec9dd1d82ee949567bbaec0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_pets_and_animals.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\personality-provider\nb_model_build_attachment_pets_and_animals.json
                  • Size 44KB
                  • SHA256 dd537bfb1497eb9457c0c8ecbd2846f325e13ddef3988fd293a29e68ab0b2671
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_real_estate.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\personality-provider\nb_model_build_attachment_real_estate.json
                  • Size 67KB
                  • SHA256 efcf6b2d09e89b8c449ffbcdb5354beaa7178673862ebcdd6593561f2aa7d99a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_reference.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\personality-provider\nb_model_build_attachment_reference.json
                  • Size 56KB
                  • SHA256 3619daa64036d1f0197cdadf7660e390d4b6e8c1b328ed3b59f828a205a6ea49
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_science.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\personality-provider\nb_model_build_attachment_science.json
                  • Size 56KB
                  • SHA256 9606ce3988b2d2a4921b58ac454f54e53a9ea8f358326522a8b1dcc751b50b32
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_shopping.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\personality-provider\nb_model_build_attachment_shopping.json
                  • Size 67KB
                  • SHA256 bfd7e68ddca6696c798412402965a0384df0c8c209931bbadabf88ccb45e3bb6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_sports.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\personality-provider\nb_model_build_attachment_sports.json
                  • Size 56KB
                  • SHA256 44da98b03350e91e852fe59f0fc05d752fc867a5049ab0363da8bb7b7078ad14
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_travel.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\personality-provider\nb_model_build_attachment_travel.json
                  • Size 67KB
                  • SHA256 4336ac211a822b0a5c3ce5de0d4730665acc351ee1965ea8da1c72477e216dfa
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  recipe_attachment.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\personality-provider\recipe_attachment.json
                  • Size 1KB
                  • SHA256 fc07d42847eeaf69dcbf1b9a16eb48b141c11feb67aa40724be2aee83cb621b7
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  prep_Activatable Class_Hermes_perf.cache
                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                  • Size 599B
                  • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ec057989-0b95-48af-8c30-d9755cc8d63e.zip
                  • Path C:\Users\Admin\AppData\Local\Temp\ec057989-0b95-48af-8c30-d9755cc8d63e.zip
                  • Size 3.7MB
                  • SHA256 1afe575ced9068192cf94d15644297c4ebb199b043f220e5dc0c270216689afb
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  remote-settings-startup-bundle-
                  • Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
                  • Size 532KB
                  • SHA256 df24c2dc721ea5aaa822a72620d3ef45b7f07094cfa2a77af098ee1fe3d68168
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  tmpaddon
                  • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                  • Size 11KB
                  • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  tmpaddon
                  • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                  • Size 502KB
                  • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  I3L94CV1DKLWT73JZGMT.temp
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\I3L94CV1DKLWT73JZGMT.temp
                  • Size 7KB
                  • SHA256 9ae1d2d716f5b009ab6f9d3b91bbb3c9ac9b5d03a87960a07b9a382a51b58d2a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  addonStartup.json.lz4
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\addonStartup.json.lz4
                  • Size 4KB
                  • SHA256 7dfe4ccf89dfd7e0556357496bcaf4152c9cc1087e210fe9df935cecbb9fb76c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  bookmarks-2026-06-20_10_SsbCJW8_dx7tMEZ9wxGVQxdellIUscIt7Wr2k8lIkQo=.jsonlz4
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\bookmarkbackups\bookmarks-2026-06-20_10_SsbCJW8_dx7tMEZ9wxGVQxdellIUscIt7Wr2k8lIkQo=.jsonlz4
                  • Size 859B
                  • SHA256 ee154a4ca3a9b79ddcb9481608f8e08541def886ca897c2bfcfe146c40b27bb5
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  data.safe.tmp
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\datareporting\glean\db\data.safe.tmp
                  • Size 28KB
                  • SHA256 757e8778a85ac1bf75c0c497f761443ccc51e290f8154f6b3662d0850f4f6634
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  data.safe.tmp
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\datareporting\glean\db\data.safe.tmp
                  • Size 29KB
                  • SHA256 5cd31f774214de411a7a1e9fb62af10827a595d46e08b7e8bdf36ef1e1be251e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  data.safe.tmp
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\datareporting\glean\db\data.safe.tmp
                  • Size 35KB
                  • SHA256 6596c807693ac9dbd042bb1d4a0913bbd411bf64486c60d90a908d22424974b8
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  data.safe.tmp
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\datareporting\glean\db\data.safe.tmp
                  • Size 35KB
                  • SHA256 415bbc168e2b61ee757eb6713d9ec02d84c43e88a664415e38bcd0465fe6ce26
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  data.safe.tmp
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\datareporting\glean\db\data.safe.tmp
                  • Size 35KB
                  • SHA256 9ab2b8d96db0abfd7821a0715120012779a71917cd3a7e310a8443c64e153f1f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  events
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\datareporting\glean\events\events
                  • Size 1KB
                  • SHA256 b31c9899bae3b16d3928c6f71cc23e8a284f00df694cde3cefa06081c3306f91
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  63848d3c-8725-47b0-90ba-05465ebc40c5
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\datareporting\glean\pending_pings\63848d3c-8725-47b0-90ba-05465ebc40c5
                  • Size 886B
                  • SHA256 4cb736f3b71c2beef8209d6ab990312a33412e3d2ee0f40716d8f9d06512290f
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  96d4c8cb-9232-436b-a42b-235013f67796
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\datareporting\glean\pending_pings\96d4c8cb-9232-436b-a42b-235013f67796
                  • Size 2KB
                  • SHA256 4e2257887816b0e6975359ef4e4f108591e9f77696437b56b47a22db38845519
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  b76e6736-438f-444b-9c83-ac1135cfef38
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\datareporting\glean\pending_pings\b76e6736-438f-444b-9c83-ac1135cfef38
                  • Size 871B
                  • SHA256 59cd9c5949c62155708634e42d9b2b7646cdc2275777bd44ddb25487cf3d67d5
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  d2ad3534-3880-4a55-a7f0-bcd1009138a8
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\datareporting\glean\pending_pings\d2ad3534-3880-4a55-a7f0-bcd1009138a8
                  • Size 235B
                  • SHA256 db89e9895c5f8d5c089e5d872c0a7e55544c3328ffb350510b135e53af85aa6b
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  dd396fcc-193b-4a13-9e10-ddb28cdb45e4
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\datareporting\glean\pending_pings\dd396fcc-193b-4a13-9e10-ddb28cdb45e4
                  • Size 235B
                  • SHA256 7655fa245f515d10b7206c31f15e2e7a05e2ac55bebd229b978ca774da6379df
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  extension-preferences.json
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\extension-preferences.json
                  • Size 942B
                  • SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  extensions.json
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\extensions.json
                  • Size 16KB
                  • SHA256 eb26abdf1b6a9cbc63e2755210ac7232fb132e6b7933481a8560c95ea788a8f9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  gmpopenh264.dll
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                  • Size 1.1MB
                  • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  gmpopenh264.info
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                  • Size 116B
                  • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  manifest.json
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                  • Size 1002B
                  • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  widevinecdm.dll
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                  • Size 21.6MB
                  • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  prefs.js
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\prefs.js
                  • Size 6KB
                  • SHA256 4aa8e16b845bb8bc685db932adc80b1c2a78c6293919f5d1e0ed7783752c22e4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  prefs.js
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\prefs.js
                  • Size 6KB
                  • SHA256 d03fa4cd6049468769c7ba4fea3112178490ebd06793571b3c4dbae6beffc486
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  prefs.js
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\prefs.js
                  • Size 6KB
                  • SHA256 c81c942f80f489c6382e817201caa53ae86a9e79888b4301651509f134f4bf2e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  prefs.js
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\prefs.js
                  • Size 12KB
                  • SHA256 348a37808b5228ea0844a8502b3f05e0dc329426f766d7a9dc4c5092ab1cf630
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  prefs.js
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\prefs.js
                  • Size 8KB
                  • SHA256 d82f06abc5cb8738a376fc643c228748820561bf8af55fbc504d1a10c1812130
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  recovery.baklz4
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\sessionstore-backups\recovery.baklz4
                  • Size 2KB
                  • SHA256 e0d77213d669f36162ba8430f7718d3462921aa6f2c3efa42932fd2831ffd4ba
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  recovery.jsonlz4
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\sessionstore-backups\recovery.jsonlz4
                  • Size 2KB
                  • SHA256 9ed97932fcf15103c25e761c13b5e227da20c950ebc2d4948688238b44693dd6
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  3870112724rsegmnoittet-es.sqlite
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                  • Size 7.1MB
                  • SHA256 aca9f9f06c0e64ae575c8d3cdfdef7957640a4c4e80ceaa6909c0af1ae2b67c9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  memory/5876-668-0x0000025600170000-0x0000025600270000-memory.dmp
                  Download

                  memory/5876-714-0x0000025614130000-0x0000025614150000-memory.dmp
                  Download

                  memory/5876-700-0x0000025603BB0000-0x0000025603BD0000-memory.dmp
                  Download

                  memory/5876-681-0x0000025613DB0000-0x0000025613EB0000-memory.dmp
                  Download

                  memory/5876-680-0x0000025603850000-0x0000025603870000-memory.dmp
                  Download