25df468b80183d89a1a3b5d3c8148638083bf3436910ea9b725527af61672091

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/09/2026, 22:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ssssssss.png
Size 1.7MB
Sample260904-14cwdaap21
SHA256 25df468b80183d89a1a3b5d3c8148638083bf3436910ea9b725527af61672091
MD5 efabb79b46e037cabaeba9ca81b6c56c
SHA1 b5c91d02094e3afc2599895fda6842f3071ba3a4
SHA512 db8f0d83ce856e292e243afa6c67208dbfcc6d5fe4e6be096ea57620582d4959b32cab66a9c68fd361197309164830f7990083976c912a511875321c3933b34d
SSDEEP 49152:NokJMaeWdVlkj4YxoEW9CHIvSzxk1rivjZycR7rwtGK:NQ0wxxoHkH+Sdk1rCYU7reGK
TLSH
T1BF8533E1F7AA88D3D7B9FA3D0D4014EC1E2B92236D2F5E1EB5D410B68A4EFC14194639
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

persistence

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
100	api.gofile.io
104	api.gofile.io
105	api.gofile.io
107	api.gofile.io

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4952	mspaint.exe
4952	mspaint.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	564	firefox.exe
Token: SeDebugPrivilege	564	firefox.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
564	firefox.exe
564	firefox.exe
564	firefox.exe
564	firefox.exe
564	firefox.exe
564	firefox.exe
564	firefox.exe
564	firefox.exe
564	firefox.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4952	mspaint.exe
4952	mspaint.exe
4952	mspaint.exe
4952	mspaint.exe
564	firefox.exe
564	firefox.exe
564	firefox.exe
564	firefox.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 564	4420	firefox.exe	107
PID 4420 wrote to memory of 564	4420	firefox.exe	107
PID 564 wrote to memory of 1856	564	firefox.exe	108
PID 564 wrote to memory of 1856	564	firefox.exe	108
PID 564 wrote to memory of 1856	564	firefox.exe	108
PID 564 wrote to memory of 2804	564	firefox.exe	109
PID 564 wrote to memory of 2804	564	firefox.exe	109
PID 564 wrote to memory of 2804	564	firefox.exe	109
PID 564 wrote to memory of 2804	564	firefox.exe	109
PID 564 wrote to memory of 2152	564	firefox.exe	111
PID 564 wrote to memory of 2152	564	firefox.exe	111
PID 564 wrote to memory of 2152	564	firefox.exe	111
PID 564 wrote to memory of 2152	564	firefox.exe	111
PID 564 wrote to memory of 2292	564	firefox.exe	112
PID 564 wrote to memory of 2292	564	firefox.exe	112
PID 564 wrote to memory of 2292	564	firefox.exe	112
PID 564 wrote to memory of 3728	564	firefox.exe	113
PID 564 wrote to memory of 3728	564	firefox.exe	113
PID 564 wrote to memory of 3728	564	firefox.exe	113
PID 564 wrote to memory of 3728	564	firefox.exe	113
PID 564 wrote to memory of 5812	564	firefox.exe	114
PID 564 wrote to memory of 5812	564	firefox.exe	114
PID 564 wrote to memory of 5812	564	firefox.exe	114
PID 564 wrote to memory of 5812	564	firefox.exe	114
PID 564 wrote to memory of 5824	564	firefox.exe	115
PID 564 wrote to memory of 5824	564	firefox.exe	115
PID 564 wrote to memory of 5824	564	firefox.exe	115
PID 564 wrote to memory of 5824	564	firefox.exe	115
PID 564 wrote to memory of 5916	564	firefox.exe	116
PID 564 wrote to memory of 5916	564	firefox.exe	116
PID 564 wrote to memory of 5916	564	firefox.exe	116
PID 564 wrote to memory of 5916	564	firefox.exe	116
PID 564 wrote to memory of 5928	564	firefox.exe	117
PID 564 wrote to memory of 5928	564	firefox.exe	117
PID 564 wrote to memory of 5928	564	firefox.exe	117
PID 564 wrote to memory of 5928	564	firefox.exe	117
PID 564 wrote to memory of 5520	564	firefox.exe	118
PID 564 wrote to memory of 5520	564	firefox.exe	118
PID 564 wrote to memory of 5520	564	firefox.exe	118
PID 564 wrote to memory of 5520	564	firefox.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\ssssssss.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:4108

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:5060

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2016 -prefsLen 27099 -prefMapHandle 2020 -prefMapSize 270279 -ipcHandle 2096 -initialChannelId {50899167-e296-442b-9186-5f7220e29475} -parentPid 564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.564" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2476 -prefsLen 27135 -prefMapHandle 2480 -prefMapSize 270279 -ipcHandle 2488 -initialChannelId {f88aaf18-2c98-43aa-b223-73390ade6a85} -parentPid 564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:2804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3816 -prefsLen 27276 -prefMapHandle 3820 -prefMapSize 270279 -jsInitHandle 3824 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3832 -initialChannelId {021e5f72-f841-41d6-98f7-e6b86a3383f2} -parentPid 564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2152
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3972 -prefsLen 27276 -prefMapHandle 3976 -prefMapSize 270279 -ipcHandle 3992 -initialChannelId {9c222c78-7f33-4e67-819d-d1a07d936776} -parentPid 564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.564" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2292
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4400 -prefsLen 34775 -prefMapHandle 4404 -prefMapSize 270279 -jsInitHandle 4408 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4380 -initialChannelId {6becd9ac-2c3f-4c6e-a577-bddea4fb92b0} -parentPid 564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4624 -prefsLen 35012 -prefMapHandle 4704 -prefMapSize 270279 -ipcHandle 4840 -initialChannelId {db573a71-d587-4f7d-8544-4e1942176c9d} -parentPid 564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5052 -prefsLen 32900 -prefMapHandle 5056 -prefMapSize 270279 -jsInitHandle 5060 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5068 -initialChannelId {74e33779-0598-4fca-b939-2c5640ce2223} -parentPid 564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5092 -prefsLen 32900 -prefMapHandle 5096 -prefMapSize 270279 -jsInitHandle 5100 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5104 -initialChannelId {9c5dcbea-a330-4a01-99a3-ce47d07975cf} -parentPid 564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5428 -prefsLen 32952 -prefMapHandle 5432 -prefMapSize 270279 -jsInitHandle 5436 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5444 -initialChannelId {5d45a668-5f42-4c49-a81c-0db78ed3add4} -parentPid 564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5928
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6476 -prefsLen 33031 -prefMapHandle 6480 -prefMapSize 270279 -jsInitHandle 6484 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6456 -initialChannelId {0a45acad-ed23-4445-9166-454f57c7c00e} -parentPid 564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

00DF834B2FA774653605B557F847DDC3C19DE9B3

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\cache2\entries\00DF834B2FA774653605B557F847DDC3C19DE9B3
Size 11KB
SHA256 7477769f4ffa75969bde8a37dfad68f604de5b61311680c14ca7e3392997f1d1
MD5 4d6ad7e74b4228b06b8701408f0b7ae0
SHA1 2b42a469d8432461b9d446232075add80f41af05
SHA512 14875e67f5b89d32b584e311058c5a2e970287c86c07f78c430e4e88958509e978297de50285291c8b02ee5ec0ff68ec58f9c09e7f7c5229c05ef43c0c1f4b59
SSDEEP 192:ubcRA37LAJjASP0dFUWsTo0HKQUnd2FO4II6jiQt7ij20vz10h3cdZqdZB:JQuZP0YWsTZHKNk76jht7KDGh8ZmZB
TLSH
T14F42AFBF6E100D2925C38BA6A4ABD7886E04B303AF659DDED5543A94808537CFDE918C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

04036917C7D45E0F3841833AFD24BE70FF43D789

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\cache2\entries\04036917C7D45E0F3841833AFD24BE70FF43D789
Size 11KB
SHA256 640454ea3b297229733b5f2f534bce214051bcc55a2eafc049df3c48402e1e0e
MD5 5b156939c5c51a3f9f2863073583adaf
SHA1 5b29066b1c3836fe2ec8ba1c6c445d52205689bf
SHA512 6e2921a06766dc41e31b4cde0bbac69e4c1716407d304b58814238d7e0457a0182992cb27cbc4efbad834ffcc9f19271171e11783e3579499b5f3dc96162282a
SSDEEP 192:Ms13mferzzexcAp3tSEsOoD+R8O6h1slR9Und2FO4II6jiQt7ij20vz10h3cdZLx:M03mfeqxrtLoD+6xmlRuk76jht7KDGh6
TLSH
T1D032B0B2EE1239001D525CF2C6EFC7A95D8AF2038F50D5BDF6603948E1497B4E9D518C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5E43012191E7B1F510ACD5BF039D8BF1B9A277B2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\cache2\entries\5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
Size 16KB
SHA256 4581b1f2655fd15879321111ac95db4da69508e9684cddc04ac0667abc0b05ea
MD5 ccd4cf9900e970b042f5789b3ab79281
SHA1 6eca79d18284baa128f618bd224181cf1b818273
SHA512 db73c56fc0e423e28dfa07ebd564c7d33d21fd87ff13ba91e2b45fc2624975053e3cc5c6b25453c281809bb01c5ae35434827cf58f004779e4c1c8e9cf08b57d
SSDEEP 384:HkCjiO024YgDL84KKDL849B7SOEAd9KVRaAcP+AWRMAd:EzZYgDL8lKDL8CB7S/AmVAf+hRMk
TLSH
T107729E395F003CBC1597C1E8C5F9529A8D18B7A7DFE6C06D21583D0DC798A69A0F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B25B953675CE53485607F175D818D80467AB7D83

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\cache2\entries\B25B953675CE53485607F175D818D80467AB7D83
Size 14KB
SHA256 35aec70f642fa8d9fe8d94bf2398e7c776369057002529598ce51fe3df8f9999
MD5 abd86761cbda8a211d7ae5dd853dcb7c
SHA1 a61ddb92d9b59e51854c7d0b153a6a9148c4c2b2
SHA512 e95dbd4cf135c04f6893bdc12934872c20338f291d438b15b19f3b386e9090ed850ee9ba9058808598a956b8da86eb882e8a7cf095334011afd40430c56497a2
SSDEEP 384:zS4/MfdWw7J58f+FaNk76jht7KDGh8ZEJZE8:zNgIw7b8mF976H7KQnY8
TLSH
T1BB62AFF9AE000906A443DC92D4B5CBC86E8DB203E89155BDA5DC35D9C484AB4FEF911D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CA823165F5069EFAEE3D24E346510755EB5136FF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\cache2\entries\CA823165F5069EFAEE3D24E346510755EB5136FF
Size 11KB
SHA256 2f8a6cf358f5f41623737fdafde21440d4a8dc933fbe89a0eaa7f3ea456b4fc0
MD5 3fd54c44edda64a06aafd668250608eb
SHA1 53597d1472ad9068a5efda82f59c83291a12636a
SHA512 8aef667e1ebb0e8e2c5922aedd4cc17d5546b2143e11992953779048848c19f713d59406dc9e4b52974cf6da2ab74481c6be95a88b0964d7bed409a97a3cec74
SSDEEP 192:fKdbl+K1B5jFMKZkmLimXUnd2FO4II6jiQt7ij20vz10h3cdZ8dZ6:4kc5jFdhqk76jht7KDGh8ZMZ6
TLSH
T12232AFBFBD102C4534868EA3D97BC7C03D48B1039A7995FE55983885D08AA7CFAEC58D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 4de735814c039918ce3449dd0a034baed0a645d7e4eb268087094109e040f8f7
MD5 d6fef28b25971bf3603e4f4db5e95c7d
SHA1 d127cb12296eafcd2b0da60c2ecb462584ae79bb
SHA512 c088d3450d1bc9d6067605eedd67db046c33167e80637b30cd805bab3e4fae1ca0c8c14694bd987e716f69ee82d0829c517f452eb8dcc77a205dd8c4175cc402
TLSH
T17E61A958F229863FE445413ACD925B411F347856A8AE7F2A35AC604D2E5B3CD76CD03E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 05a1c1af97b4b38a1fd4e21861496d8e7184e59d0ecedf5899f976a9fdad200f
MD5 6f82a483159548c8e7876084f8065919
SHA1 a8352790cff97a4868b6a4d7f67b4a8e227efb7f
SHA512 7c31d8afaeef628475eae39cfd6d943ced446c63af763ab14cde055fc1f943582ad912ae9d66eeb89cf88c4e17d66a4a216ae833b50693589d09e991ee34b7e3
SSDEEP 96:OnFw2FXF+F/Fm/dd66JozGzgClKtmc0d/URHSdF95/7bkW60rcECWyUR6IWI:W1d66JozGzgCl6mc0d6Ov5zbowbCWyjk
TLSH
T172C1EE28F629863FC405423BCDE52B510F763987988E7F1931DC75182CAA2DE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 b64a1bc2924871b92f05665a0cccc8f36fd579a7d5703d94b3654a56d939854b
MD5 75ccd00277011fa1e26ed2331f0977b2
SHA1 23db6bfc7d0ae7c5c9719c1b07f00281be88e63a
SHA512 dbd62e7fbcb565689f09b2d0db226bb6135c41e9b76cc40e3941d80153578d6a4a0738ccfea5033a44a9625b5478af95d6df95449fdccb1bfd1a31d6ce8c7971
SSDEEP 192:n1d66JozGzgCl6mc0d0Ov5zboPOZCWyj1O+:1d66JozGzgC1jdboGZCWyjZ
TLSH
T14FE12068F628867FC405027BCDA22B450F3A388A984E7F1935DD75182C972DE76CE17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\events\events
Size 1KB
SHA256 e4a3b885bd062688aea696c3f8bfb705d363ba03bed592061ea16a2b1032c830
MD5 68cf74016087ff7fc691f0ba18e78e62
SHA1 ee086c74149a53c89df248ac46dc24783f8ba08f
SHA512 1e94d36303c5bb577aba82c40b7b912c0749dbf084ae507bf99ac3ce26f93e45073112ed96bdf055f8ff74fd506011bd2c6c83518111b57fb854f2b7c591559f
TLSH
T10D217C4C39F84E6AEAC7E29C7441068E53A54E0705471C934E23EF8DCED1AE9726A439
MD5 SHA1 SHA512 TLSH

Submit Download

1efc09d0-1ecc-4a09-b40c-d73d14110dfb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\1efc09d0-1ecc-4a09-b40c-d73d14110dfb
Size 235B
SHA256 3553655802f530553cef2693589086a4d182be2d13221fb3ca125cde0aa5b1a9
MD5 462081c2b88a189335c9116eb71a913a
SHA1 4af76d35c5829dfb725e0f68a92bbb9babf6c90e
SHA512 ba1c0c3c95fcda0a53138a83e49057f75e94f52c09bad91f36d1e69686a3942bcda4a9463a57c22806549c38570728fd9f55d2ab0b385520fe8ef40d6fe1799f
TLSH
T120D097C06888A37E08145F13F0E02AC7B1888C3725BAA820C5604078ADB99C88251907
MD5 SHA1 SHA512 TLSH

Submit Download

21a13f0b-b3df-413a-a6c5-c37cb3ff45ce

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\21a13f0b-b3df-413a-a6c5-c37cb3ff45ce
Size 15KB
SHA256 42453ca8d58fe297d51675b838b55e81ed891780a89bedce62bc2c59a8a07a88
MD5 791c87caa2fb29b3b697bc633ca27802
SHA1 59f3e4569b80b20e58b4e092949cfdbeceb17cdb
SHA512 c49b495d6de3959c0ef27596842ede7488fb92b24bce018a610d5fbd20d6ad7a06e354b1637ba7f66495675ec063f01a98a6bf72655250283e3abaf0e82d3ea7
SSDEEP 192:7KycJ+mHQZ/V8AtQwB8HBOx/we1o109EgmPwsb2FSzARTKokpotQs3uW4:7fzB8H2wnATmPwicSMRTKogotD3W
TLSH
T19072B75A5820457A8651E3A898FCBFC3E6F638CF4C019FCA9BE47D086DDE06D112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6444f415-229e-4d8f-90d8-6e61ba69ce8c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\6444f415-229e-4d8f-90d8-6e61ba69ce8c
Size 883B
SHA256 2addaf5e09ccb1ecfca9e09fb78d1a91f22e0e743a07e83e8974bdc57dbe8918
MD5 95b9295e9dcb38f5aec67aa4ccfe10a8
SHA1 a4a0e49eedebc709e95511c4c301f832b405df75
SHA512 5d2e883dcf7e35098e42f2678ae6f05d84c4233a6d051877dca48d13dcc20795dae11bd0d2e217578285ffa3b30a1a25869fb5c58bea7e70edcb7a54b07911d8
TLSH
T1AC112341A630F5F6CD68C31B8A9177269FF9752380CA95183DE25F140CBEB1EA36630B
MD5 SHA1 SHA512 TLSH

Submit Download

89bd9c1a-8701-4f65-bf60-24ab23aee994

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\89bd9c1a-8701-4f65-bf60-24ab23aee994
Size 886B
SHA256 e3a1106b8fe20ef8cebecc8a31cdde1c844d09aeaca3689e8135b061f005de99
MD5 09c02208caca68e82a7b010707297010
SHA1 1467a2eb7def6af11b5be97e14686a33f7baef61
SHA512 91c03c8128c38378a277677d05148b1a028df83aa5412c4fdbb7333417989c65da6441fba45f0c40cb563c14ea5e34a0d7ffeccfff7f986a4421b68d3127c652
TLSH
T179112340A530B5B2CC699257DAE177538FF87923D0C689187EA12B184CFE61E63AB307
MD5 SHA1 SHA512 TLSH

Submit Download

ad9c14eb-d4dc-4a0e-8f04-f1042c3e7933

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\ad9c14eb-d4dc-4a0e-8f04-f1042c3e7933
Size 2KB
SHA256 41495360f9c30b96926ad1790eb49cbf6edd34d1324d7adf36132f7bebaffb2e
MD5 18497244827df45dcbd2d085c20ae480
SHA1 301eafcb2dc95450345a8df18cb4ab71d30a2915
SHA512 b61b221ac71b65403b4b8583f2cb9abf71d2863522fb39933b2d0cbd303784a673a4810df270a0d3affc4ad23a8545a270c962110bff42631149f207e004749c
TLSH
T13241545C79744CBB8DDBF19DD482338E47648A5200C728832E61EF0C8CDA6DD736A52B
MD5 SHA1 SHA512 TLSH

Submit Download

cf760eca-90f8-47d5-bd6c-72d90b1b5293

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\cf760eca-90f8-47d5-bd6c-72d90b1b5293
Size 235B
SHA256 edd3e66e56456ee32a213dbbd58d3955515d204d992e9ed05a1ba8195e4f79a6
MD5 02e5f65b33d04cc178bd127ffe719a13
SHA1 70aa63ea5644cc3673b8e0504a77f7270759efa6
SHA512 dd50ef3e49ce9cb1af3b973f61b1d29e1beec812354b9c103580395eb81077a38e987d5f6fa61cc5412e7872323742daa790192aa883b6cf9ed9c921e754e406
TLSH
T1C3D0978024D8277C0C240F03F0A028EA308B4C3328B4A810CA9045B8EAFD9C48251817
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\extensions.json
Size 16KB
SHA256 13bed04b095b816fc83c4e86f0fc73cac354c5078a4137929f748315fa664190
MD5 f92af010f65c6c753c4e15560ea7b006
SHA1 a8b7ac0b77d41114e05a60290c80a694a8ea0c30
SHA512 29834cf14e8c57a4f646c11324929eea611ee6f446cdb610cf342faf6948d7c18ee8170b94be28ccd5e57ccd5998ed6b306d4c16e78129fa9a7a27988552ce5b
SSDEEP 384:qkI4v3Umldvc8dhWA94z196o3tL4HzlL4PTL4HeL4HCL4HGd4hQ:NI4PRflXV4H6Ct4p4H4E4Q4K4u
TLSH
T1CF72421545048EB82A4FA79AAA367D01C37D473B60845C78F4DD8FC842FB5B902FB66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs-1.js
Size 6KB
SHA256 1011c6560f2ac7972f8e36a87392fb3250e42a0f48165a715f7668d2d42f7cb9
MD5 ac2b7b93c5a8b210f28b72d5988485e5
SHA1 73bab3cab5fa67af9fe429aa7fb760565e7862be
SHA512 ffc27b3713fb4da8e2cfa346bf987b761f7a705e94a3264d296577ff58d5a476aec73c2ab9b9c6a5e48d0ee677a12dc29585e9ce3e0f44425a98840d2f682547
SSDEEP 96:xHgUTUPDqGqnfL7R1zSMSSladv9jSn3H8RNBw88n8L4cnFpLGS:yfORnfL7RBSSh8HBw88y
TLSH
T13CE120789408CB7FA4B6776CAC6888716AB2013B77BF68D750B554C4015CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs.js
Size 6KB
SHA256 b3e7d49da6301354ce81f5fe5abedb34426dd00d3c35b7b0d1a9c29268816a9b
MD5 29724409985d517e73e7d30ea52b390f
SHA1 a9eb9835dbfbfdddb0dc945c301ed4e986364b5d
SHA512 0a4a1a35abb133be3e86a676a0a0c480f1802a78c512ddec76d1806b62f29d574248ece3e613a6fc3e2c08a3c590c8f27f8c1a04f873e66eb75fd2a99ae5c5a7
SSDEEP 96:xHgUTUPDqGqnfLLy1zSSUdWSSladv9jvn3H8RNBw88n8L4cnFpC:yfORnfLLybUdWSSU8HBw885
TLSH
T1AFE11F7895088FBF64B6777CAC688871AAB2013B77BF68C650B554C4015CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs.js
Size 8KB
SHA256 fb03285421c43d0c4c45b7337351b6f5a02df348a2ffad573700dbd782f12f16
MD5 8873ce04eb2116b08d8e7514b7eeda28
SHA1 9b90fba3db0b47fc4be655986a603d6604c11cd0
SHA512 0fa5592b56c2f79bdee2b2bff0df0cbc7c1fa58cdf2586d3c8f30de496f14757e3121f08fff69c366b43c803acb635d45062cb4fed9557669a989dc68c5febe3
SSDEEP 96:xHg5TUPDqGqnfL7RObzSMSSladv9jSn3H8Rw8Bw88f+o8L4cnFpLGS:yuORnfL7RCSSh8VBw88GZ
TLSH
T14002FF385404CF7FA5B677ACAC6489715AB2023BB6BF68D710B554C4054CF3842F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs.js
Size 7KB
SHA256 68d346c437a2233ea04087303cbb7fe105beb43419fd526f5489c58eaee169d9
MD5 0fde82786f51549737ecc1df68cd18eb
SHA1 073cefe6755abc1837e684af3ab935cdfcf13877
SHA512 b5a95c78018684b6ae0bd376c3c19b36b2622a1fac6dbfe2e0fd358ad6f67695c48ff33f0986f46535e4341178545c259b2bc046b7a926b1d3888fd1f8c88aa1
SSDEEP 96:xHgUTUPDqGqnfL7RObzSMSSladv9jSn3H8RNBw88n8L4cnFpLGS:yfORnfL7RCSSh8HBw88y
TLSH
T1F4E13F7894088BBFA4B6776CAC6888716AB2013B77BF68D750B554C4015CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 3adeb465cb8c8121415ecf1ae098bd5866b480d8da022f28595640dc53ed404e
MD5 70dc721c03b2cae95554c9207960bd03
SHA1 199f1ae351b52f292d8bbdb4fd4fe3176466daa1
SHA512 9192a0e7000f36212ee9dda6912fb453834c8dbe6b27f1ad0939d4d50a01aa84fef52fdf86a88eeaf13fb2b946ec9f60a37c47dcb02a6a932a59d6d4d322f4f8
TLSH
T1E04108811F9E996BDEA8D504A14237BCC7BD7003127E5982E24A1312846D99E542AEDB
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 8320b4e52de37a3701d0421e4939dfe0f19fa8c7f1ab403b82396467bcc9c5df
MD5 94e8e75a1bf504c7105ce12550daa14f
SHA1 357084e807e2f3c52c8cc10c4e0d5550a6e6e2b1
SHA512 d1d2a7d19333eef68fbf9dff8490bcf0550fed9f5f773b02abea3ea1b7239ee37e22b21c8459863d25a68a596cc23c3343993b1546534edd309370d6871057ed
TLSH
T187413C852B7D4C78DD74C104A0C67BD9D7AC702705580C40E9C2650950FD1CA35BF9EF
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.2MB
SHA256 9ce0048f97acd686c13ae40e4dcee72a78edace69961558d94dbca14fb16674c
MD5 f51ab801bc4015ead2422a62b1274515
SHA1 c00dcc62082ed097e673a1937893cb1fb2b70999
SHA512 edbb67b93681c33cd7125967c35208e0a7daa2c8c17b26726dcecac0adfdf165fe01ba7a635a1470a039e8ba82d5069640eab0310489ba91147342d4c2f0de74
SSDEEP 49152:VDmgOugQA5lUT2lAecNxazvgiRBb4xYegN:lm7ugF56T2yzxazvgi1N
TLSH
T1DF1639F820D1A257F3818037668563EB21AFD00C6477DD444BE966F994B8CEF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download