hxxps://gofile[.]io/d/fuS2bF

Analysis

max time kernel
124s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/fuS2bF
Sample260722-tlqaesydkc

Score

6^/10

discovery persistence

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
4	api.gofile.io
8	api.gofile.io
31	api.gofile.io
1	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	756	firefox.exe
Token: SeDebugPrivilege	756	firefox.exe
Token: SeDebugPrivilege	756	firefox.exe
Token: SeDebugPrivilege	756	firefox.exe
Token: SeDebugPrivilege	756	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
756	firefox.exe
756	firefox.exe
756	firefox.exe
756	firefox.exe
756	firefox.exe
756	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
756	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 756	5020	firefox.exe	87
PID 5020 wrote to memory of 756	5020	firefox.exe	87
PID 756 wrote to memory of 2252	756	firefox.exe	89
PID 756 wrote to memory of 2252	756	firefox.exe	89
PID 756 wrote to memory of 2252	756	firefox.exe	89
PID 756 wrote to memory of 5316	756	firefox.exe	90
PID 756 wrote to memory of 5316	756	firefox.exe	90
PID 756 wrote to memory of 5316	756	firefox.exe	90
PID 756 wrote to memory of 5316	756	firefox.exe	90
PID 756 wrote to memory of 5508	756	firefox.exe	91
PID 756 wrote to memory of 5508	756	firefox.exe	91
PID 756 wrote to memory of 5508	756	firefox.exe	91
PID 756 wrote to memory of 5508	756	firefox.exe	91
PID 756 wrote to memory of 3416	756	firefox.exe	92
PID 756 wrote to memory of 3416	756	firefox.exe	92
PID 756 wrote to memory of 3416	756	firefox.exe	92
PID 756 wrote to memory of 3260	756	firefox.exe	93
PID 756 wrote to memory of 3260	756	firefox.exe	93
PID 756 wrote to memory of 3260	756	firefox.exe	93
PID 756 wrote to memory of 3260	756	firefox.exe	93
PID 756 wrote to memory of 6116	756	firefox.exe	94
PID 756 wrote to memory of 6116	756	firefox.exe	94
PID 756 wrote to memory of 6116	756	firefox.exe	94
PID 756 wrote to memory of 6116	756	firefox.exe	94
PID 756 wrote to memory of 5116	756	firefox.exe	95
PID 756 wrote to memory of 5116	756	firefox.exe	95
PID 756 wrote to memory of 5116	756	firefox.exe	95
PID 756 wrote to memory of 5116	756	firefox.exe	95
PID 756 wrote to memory of 5000	756	firefox.exe	96
PID 756 wrote to memory of 5000	756	firefox.exe	96
PID 756 wrote to memory of 5000	756	firefox.exe	96
PID 756 wrote to memory of 5000	756	firefox.exe	96
PID 756 wrote to memory of 5236	756	firefox.exe	97
PID 756 wrote to memory of 5236	756	firefox.exe	97
PID 756 wrote to memory of 5236	756	firefox.exe	97
PID 756 wrote to memory of 5236	756	firefox.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://gofile.io/d/fuS2bF"
1⤵
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://gofile.io/d/fuS2bF
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1936 -prefsLen 27097 -prefMapHandle 1940 -prefMapSize 270279 -ipcHandle 2012 -initialChannelId {4135b1db-3bc0-43ed-b968-293395f36a56} -parentPid 756 -crashReporter "\\.\pipe\gecko-crash-server-pipe.756" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2420 -prefsLen 27133 -prefMapHandle 2424 -prefMapSize 270279 -ipcHandle 2432 -initialChannelId {ffb1de3d-7a43-491a-bca5-6b095b3a6155} -parentPid 756 -crashReporter "\\.\pipe\gecko-crash-server-pipe.756" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:5316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3708 -prefsLen 25164 -prefMapHandle 3712 -prefMapSize 270279 -jsInitHandle 3716 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3724 -initialChannelId {f51f3bdd-5228-491f-a70a-0e275e39fe01} -parentPid 756 -crashReporter "\\.\pipe\gecko-crash-server-pipe.756" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5508
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3860 -prefsLen 27274 -prefMapHandle 3864 -prefMapSize 270279 -ipcHandle 3932 -initialChannelId {4b9b0640-0d4d-43cf-b838-e056c26749cb} -parentPid 756 -crashReporter "\\.\pipe\gecko-crash-server-pipe.756" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4376 -prefsLen 34773 -prefMapHandle 4380 -prefMapSize 270279 -jsInitHandle 4384 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4392 -initialChannelId {369137af-c284-4032-9b60-1d7d12b250e9} -parentPid 756 -crashReporter "\\.\pipe\gecko-crash-server-pipe.756" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3260
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5196 -prefsLen 35010 -prefMapHandle 5200 -prefMapSize 270279 -ipcHandle 5112 -initialChannelId {552340e0-ac5a-414f-9aeb-f39446825a65} -parentPid 756 -crashReporter "\\.\pipe\gecko-crash-server-pipe.756" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:6116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2920 -prefsLen 32952 -prefMapHandle 1552 -prefMapSize 270279 -jsInitHandle 3152 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5512 -initialChannelId {4a7a682f-e396-4ac8-96e6-7d42e6847992} -parentPid 756 -crashReporter "\\.\pipe\gecko-crash-server-pipe.756" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5668 -prefsLen 32952 -prefMapHandle 5672 -prefMapSize 270279 -jsInitHandle 5676 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5684 -initialChannelId {575515e9-dc99-4dd3-9f52-f1b392924a0a} -parentPid 756 -crashReporter "\\.\pipe\gecko-crash-server-pipe.756" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5856 -prefsLen 32952 -prefMapHandle 5860 -prefMapSize 270279 -jsInitHandle 5864 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5872 -initialChannelId {510f571c-3621-441a-a57d-78968128438d} -parentPid 756 -crashReporter "\\.\pipe\gecko-crash-server-pipe.756" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 15KB
SHA256 826895e2e354cc13251f6e3dab5541d1743578237acd4e5629684ae536c06472
MD5 68bc35c7fd4feec0b41f70096eb7a284
SHA1 807285569e00da70e35250abb0b98edec8e20d3c
SHA512 9bb9083fc001209e828fddec6d536e7284c2d6052c5266ab6a42e7cb70c3c52e454557e2507ddcb512558251a871097b49d2203a484d85eed0f662e5502cdde8
SSDEEP 384:HwCe7iO024Yqdcs3hk2nhfdDE2Ba/rIVy8e7m+nm+P:QqZYqdv3hk2nhfS2sDIVy8D+m+P
TLSH
T1F6729EBBCF416C5D29579589C9AD5369DC15F9ABCFF6C0A608203049CB8432AB0F608F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9512A4488B00CC053350DAC32D417B4A35C11513

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
Size 15KB
SHA256 c7df956120b707fdbb21242a73601e5c5b249c235c8488e8b2d07b21db0402cb
MD5 6dd01a9caa24cb4745e119bf61aa68d2
SHA1 352f8a44f492fd5739ec5f679d3d73180590fbaf
SHA512 dc095613121de5c4055409b9a1593759e92c55d799d89efe4edff81eada5a864995827ae9e890d97019bc7524b3820beaa3a48ddc8fd3ff043ba30ce8468a669
SSDEEP 384:H9XghOiO024Y3dcs3hk2nhfdDE2Ba/rIVy8e1Z3:dX+ZY3dv3hk2nhfS2sDIVy8q
TLSH
T171728DBF8F016C5929679585C8AD8379DC15F9BBCBF690A608243549C78472AB0FA08E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 e131f1b263db432eaeb727ce68a38d7dcd9646eccf20079d787fd343fd88aa4f
MD5 ec50e432c87778c304b76ec73c1981e9
SHA1 140d119c96c5ea4a1574370f03f4c6580dba24cf
SHA512 06ce5be0ecaab00489ca3e9f304c0fd10fe5fbf267b75254d18d1dbd1e02ec6e5aea2d4237a196806c8f79ceb331638fea50c493fb4368f238c5d93524dc442c
SSDEEP 192:1bB1d66JoztdzgCl6mc0diOv5zboMZ5myjswW:Bd66Joz/zgC1j3boMZ5myjA
TLSH
T116E11F68EA28463BC404137BCCA65F400F36789A984E3F2975DC74182D572DE3A9E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\events\events
Size 1KB
SHA256 57da9ce06395ba2281bdb9cd29337a3b5a00dc93d7e1b7278955d581712e0806
MD5 9ba29798571f938354271db9a619d2f7
SHA1 a358cd92de34fc31e5717e19b7109e0dce0cc9fc
SHA512 810fcce4f784279d198e88359ce6ccd38662a8e4789291f094174b66c98120868a07020d6918c77a01a297c12c585eea7d9dbf671df45aeb2c22d712f644e4fe
TLSH
T1262148AC39B84D2A98D7F69CB481128E53948B06045B1C4B4E62FF8DCE91AD9326A42D
MD5 SHA1 SHA512 TLSH

Submit Download

0c3d4438-fda0-4539-a70d-4542b66e5f63

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\pending_pings\0c3d4438-fda0-4539-a70d-4542b66e5f63
Size 235B
SHA256 91813a91521f7ca9f0d43acac3a3d8f97c8e491f446f5bd9fcab087eaf6524e3
MD5 443f19a878a8b0b7468789395c59f701
SHA1 f6e46af96581613c36e01a1db61f6c6581bb717a
SHA512 2717ce03dfe9547c746bcda56d0cba8852e45753f85afc104f270b1e864d834884ed2bab09a5aad1d27dac1ecb79fe7860736ebef4555746a241038433703f83
TLSH
T140D097C824982B1D4C084F1BF0A028DA34888C3364B69C108B5080F99EB8EC441A1C2B
MD5 SHA1 SHA512 TLSH

Submit Download

3370aa0e-f1d9-442e-b6c6-c483bd565973

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\pending_pings\3370aa0e-f1d9-442e-b6c6-c483bd565973
Size 886B
SHA256 4c5d8ea5fb77ec5f5cfae3488e2c20f4448c1c83b99a3391f11d4bf96ee4918c
MD5 72a243a720705f61034f62ae94698a30
SHA1 e6011d5824db18e9a2ab87a1d6db4d44fe93d105
SHA512 4be1d04fbfbbdb3e7e6fb78a50f65c6416484828e5f804fa0a85e0cb4e20489d1c9a96dd02f602c46522ce6d64113191f530df5a98ec29a1b753c7d298d775dd
TLSH
T1CA1127458A347571CC6892D784D17B5387E4B42380C66D343D905F140DBA50F9766707
MD5 SHA1 SHA512 TLSH

Submit Download

7f335f24-4925-4ac9-b26e-66ca87ae2b86

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\pending_pings\7f335f24-4925-4ac9-b26e-66ca87ae2b86
Size 16KB
SHA256 dfc525dd0f62153587a6676fd173d012703e124615af66cad70829a4a4b0d70b
MD5 451edaf82098666fad49d7b8040dc587
SHA1 285e3cf543f73ee33ff145530d762ebf90b798e4
SHA512 45c97295d5e1fce0c0ab5eab14f9df0afba1db8018d8d6ec5339f628a1ddbad25fd8d8ebf25a6c71db0b1e8e3cd4e09d0e52e386ec2bab61b7cc8a5de61fcdf6
SSDEEP 192:mcPuo1mB9i1mJBFEW4djzJpr+EZ7uubRizzJ8uTisnpRNB/ypUvdAH9BBlg44NBm:7PuFrfZ4NVZ7ZbRiXJ8spN/ssdyn2qfx
TLSH
T17E72B916582055BAC191E3A994F87FC3E2F528CF4C419FCE9BE4BE085DDA06E512784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccaf294c-d874-4420-934c-360a420f242b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\pending_pings\ccaf294c-d874-4420-934c-360a420f242b
Size 235B
SHA256 5a3b46625ce0e38639cf3c82ab94bdbb2af612378123202904f1cf820f5f6a5f
MD5 1512aba3ee17dfebd02d63e356552c4c
SHA1 f9f29992b16c5d90eb8ec7fa1705194cb4160cbb
SHA512 9c9699bad0082f6cc17952695c2d845bfcceb7ffbd6a37bfe3b7cc553161f4ce145b2547ce540d2f8cd4ded048f1dbd1050b0b8c0870d39e505b09d5a9d7beb6
TLSH
T11AD0978058A86BAE48080F2FF0E02CC634444C332068A810877104788AFE9CC815182B
MD5 SHA1 SHA512 TLSH

Submit Download

f02382a8-b937-4df0-84f1-c9f67a3b292e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\pending_pings\f02382a8-b937-4df0-84f1-c9f67a3b292e
Size 883B
SHA256 bcf5756ae80245499c2826c07f5c30eecbfa581ff92c5f7daaa35f30792339fe
MD5 56855dd6efcbe6f1be1fc2a9ca6efc01
SHA1 3c9e18d957625bb01ca2b70636e264b19082a0a8
SHA512 3e2ff9d7ac8b59bfc9ea14fbaea839a09121459c94c9a250aac6c539f039caabc9d31c70ff284d01ff50331bb66cdc69bd56f175394fef068c89af800e00cbc5
TLSH
T1BD1163849630B5B2CC6C928FC8957B124BE4F423C0CBA4203DE05E180E7B50FE769647
MD5 SHA1 SHA512 TLSH

Submit Download

fa83d7bd-1299-47af-87db-f9ce5b23817f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\pending_pings\fa83d7bd-1299-47af-87db-f9ce5b23817f
Size 2KB
SHA256 7f0e811c42a7d1357c1e212ae71d4a962a1b895bf436dfcf9a67ad6e25eb2a20
MD5 66dd82b771a48cedb08f8dfc0d1d5a2e
SHA1 25ad5e3b7665758aa8bc7a790ca1992abfe2660a
SHA512 6edd1248e5d74911727accce6ca57b4e8b81f0d85dabdb454d063f873e5009fe99a23bc42f916a2e08bf9736d404e2ee53e61ada0cf431ffd37af58dadaa05d7
TLSH
T14141665C35788C769CCAF18C949237CE83B1D90300C26C932D91EF0C8ED269E376A42B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\extensions.json
Size 16KB
SHA256 56fee814c5ed818611ef9f60f6afa0d53851fc523bb26b9a3372fdbb75eddb4d
MD5 c38361f5f80df73e6c8a192756694d1e
SHA1 d685a7ce34c931d2baaa9d8c9b0da6128a9d06a5
SHA512 9ed809e87faa64bcac3d53470830f7bbd5b80ae424d2ed51f6510718fd16295a002bd4c77dc24128c2118479076939658f37c9ba619c251db631bc2add4b167a
SSDEEP 384:XkI4vjUmldvi8dhW794z+96oCL4HN9WL4P36L4HLL4HoL4HeF4h8:0I4rRfHXS4u634jc4fI434K424y
TLSH
T1B372441545449EB8298EA78BE636BE01C37D433B60845C78F4DD8FC842FB5B902BB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\prefs-1.js
Size 8KB
SHA256 e613af021a097ebe89c12ec06c3a9034983094e5f46b1f337e96ca376803f285
MD5 cbab913df279499f81cf8d1096f1461f
SHA1 07d0abfa4a65a49c15d48be5cde7043f4383c999
SHA512 0d843aa35affe9b5a476d80cab7ca3f1497b9a8886932639ca6787ce8223a7caeb6df5afc24f3037792c1ef93cafed26663dfa3b950d445c9208e824479987a8
SSDEEP 96:xHVNTUOvqGqZCfgVYObzSs+SSlvdv9jfnlFWRFjqcBw88YsiRg8L4cnQVywS:DWRAfgVYi+SSQRkcBw88iRoe
TLSH
T1ED02ED7C90448F7F74B6777CAC2889715A62023BB6BF68D710B99485050CF3845FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\prefs-1.js
Size 6KB
SHA256 cb183284a86c8cd04f89353dd3b11dfe0d261314170d472f895dec84f0acaf85
MD5 d1c83a071a2016c05180b8958989a4da
SHA1 b4215bab8e17b5553828e09ecd5e801b36268982
SHA512 ef3936ad92b6e89a315de99218b1c9e0615d25b9a01e27407635af0e5274a528929fb4c971039afd8701609df6a1dfbb3ef2cd37a518d7b9f34c771fac27375e
SSDEEP 96:xHVUTUOvqGqZCfSVY1zSs+SSlvdv9jfnlFHvqRBw88u8L4cnQVywS:DPRAfSVYt+SSZyRBw88Ce
TLSH
T1C5E11E7894088B7F74B677ACAC6888316AB2013BBBBF68D750B554C4050CF3845F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\prefs.js
Size 6KB
SHA256 f3f1e2fdc003aefd235e4023683a1b1be28f5da6678332b4578ab40d091fd474
MD5 a4ad4ef662a2ed36389d30721816f021
SHA1 30738f26b8ec1f209a47eeb45bed152ba8bef5d0
SHA512 27b3aca0c0d1c7ed6a0799dbe8af35ca0d2833144b742c8575808cef4878295bdb46915cd0ec2d403278fa80fcab1eca8a55e6c8a7e817c0257dca313fdbb1b3
SSDEEP 96:xHVUTUOvqGqZCfSgY31zSZSSlvdv9j9nlFHvqRBw88u8L4cnQVywS:DPRAfSgY3USSHyRBw88Ce
TLSH
T17CE11E7894088F7F74B677ACAC6888716AB2013BBBBF68D650B554C4050CF3845F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 7f837154d030a290dd23076b613a66e45e6b13d7dc78e985e92a8f5b15b2acc5
MD5 5988b47d3465bd649dff1c91b6766555
SHA1 3a81432610bf1b873f4f13e46fa60da2856daa85
SHA512 28bc2b2cdccb2e872e08b59fce945d1430065cd4a371650c629a4b94e02a66fcd6e9cd01b1a2bd6ae08b962a7ff49cb8fbafdec39720a5662b2d418e1c9ea2e9
TLSH
T1FE219843852F2EF5B635550F94455FFA83973432447648E0949FDE022A8D99CB78311A
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads