hxxps://gofile[.]io/d/rpDWKXph

Analysis

user interaction
yes
max time kernel
199s
max time network
199s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
05/09/2026, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/rpDWKXph
Sample260905-cdgvmsvcph

Score

8^/10

defense_evasion persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
62	3032	firefox.exe

Executes dropped EXE 1 IoCs

pid	Process
3824	CS2Overlay.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
44	api.gofile.io
47	api.gofile.io
49	api.gofile.io
50	api.gofile.io

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\CS2Overlay.exe:Zone.Identifier	firefox.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\CS2Overlay.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3824	CS2Overlay.exe
3824	CS2Overlay.exe
3824	CS2Overlay.exe
3824	CS2Overlay.exe
3824	CS2Overlay.exe
3824	CS2Overlay.exe
3824	CS2Overlay.exe
3824	CS2Overlay.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3824	CS2Overlay.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3032	firefox.exe
Token: SeDebugPrivilege	3032	firefox.exe
Token: SeDebugPrivilege	3032	firefox.exe
Token: SeDebugPrivilege	3032	firefox.exe
Token: SeDebugPrivilege	3032	firefox.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
3032	firefox.exe
3032	firefox.exe
3032	firefox.exe
3032	firefox.exe
3032	firefox.exe
3032	firefox.exe
3032	firefox.exe
3032	firefox.exe
3032	firefox.exe
3032	firefox.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3032	firefox.exe
3032	firefox.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3032	firefox.exe
3032	firefox.exe
3032	firefox.exe
3032	firefox.exe
3824	CS2Overlay.exe
3824	CS2Overlay.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 3032	780	firefox.exe	82
PID 780 wrote to memory of 3032	780	firefox.exe	82
PID 3032 wrote to memory of 1896	3032	firefox.exe	83
PID 3032 wrote to memory of 1896	3032	firefox.exe	83
PID 3032 wrote to memory of 1896	3032	firefox.exe	83
PID 3032 wrote to memory of 2948	3032	firefox.exe	84
PID 3032 wrote to memory of 2948	3032	firefox.exe	84
PID 3032 wrote to memory of 2948	3032	firefox.exe	84
PID 3032 wrote to memory of 2948	3032	firefox.exe	84
PID 3032 wrote to memory of 2444	3032	firefox.exe	86
PID 3032 wrote to memory of 2444	3032	firefox.exe	86
PID 3032 wrote to memory of 2444	3032	firefox.exe	86
PID 3032 wrote to memory of 2444	3032	firefox.exe	86
PID 3032 wrote to memory of 4892	3032	firefox.exe	87
PID 3032 wrote to memory of 4892	3032	firefox.exe	87
PID 3032 wrote to memory of 4892	3032	firefox.exe	87
PID 3032 wrote to memory of 3320	3032	firefox.exe	88
PID 3032 wrote to memory of 3320	3032	firefox.exe	88
PID 3032 wrote to memory of 3320	3032	firefox.exe	88
PID 3032 wrote to memory of 3320	3032	firefox.exe	88
PID 3032 wrote to memory of 1936	3032	firefox.exe	89
PID 3032 wrote to memory of 1936	3032	firefox.exe	89
PID 3032 wrote to memory of 1936	3032	firefox.exe	89
PID 3032 wrote to memory of 1936	3032	firefox.exe	89
PID 3032 wrote to memory of 5316	3032	firefox.exe	90
PID 3032 wrote to memory of 5316	3032	firefox.exe	90
PID 3032 wrote to memory of 5316	3032	firefox.exe	90
PID 3032 wrote to memory of 5316	3032	firefox.exe	90
PID 3032 wrote to memory of 5328	3032	firefox.exe	91
PID 3032 wrote to memory of 5328	3032	firefox.exe	91
PID 3032 wrote to memory of 5328	3032	firefox.exe	91
PID 3032 wrote to memory of 5328	3032	firefox.exe	91
PID 3032 wrote to memory of 5368	3032	firefox.exe	92
PID 3032 wrote to memory of 5368	3032	firefox.exe	92
PID 3032 wrote to memory of 5368	3032	firefox.exe	92
PID 3032 wrote to memory of 5368	3032	firefox.exe	92
PID 3032 wrote to memory of 3824	3032	firefox.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://gofile.io/d/rpDWKXph"
1⤵
- Suspicious use of WriteProcessMemory
PID:780
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://gofile.io/d/rpDWKXph
  2⤵
  - Downloads MZ/PE file
  - Drops desktop.ini file(s)
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1988 -prefsLen 27100 -prefMapHandle 1992 -prefMapSize 270279 -ipcHandle 2088 -initialChannelId {1946b9e4-9c1f-4c15-ad54-14eec803e44f} -parentPid 3032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3032" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2484 -prefsLen 27136 -prefMapHandle 2488 -prefMapSize 270279 -ipcHandle 2496 -initialChannelId {07431254-aeae-4423-ae82-9c5190b2aef6} -parentPid 3032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:2948
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3880 -prefsLen 25164 -prefMapHandle 3884 -prefMapSize 270279 -jsInitHandle 3888 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3896 -initialChannelId {6d992d8c-3068-4150-869e-9ff66c3bdacf} -parentPid 3032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4068 -prefsLen 27277 -prefMapHandle 4072 -prefMapSize 270279 -ipcHandle 4120 -initialChannelId {7b4760cf-b8a6-4905-8a64-7bb700f000f3} -parentPid 3032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3032" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2704 -prefsLen 34776 -prefMapHandle 2708 -prefMapSize 270279 -jsInitHandle 2796 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3076 -initialChannelId {6df531ec-eb4e-46b9-a0fb-7ddd90d9bdbf} -parentPid 3032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3160 -prefsLen 34932 -prefMapHandle 3164 -prefMapSize 270279 -ipcHandle 4456 -initialChannelId {069908b6-7ef7-4e16-acc6-73e008a38eec} -parentPid 3032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:1936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2820 -prefsLen 32900 -prefMapHandle 5276 -prefMapSize 270279 -jsInitHandle 2824 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5304 -initialChannelId {ad56d469-5987-4fd6-be85-22f07244b34b} -parentPid 3032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5492 -prefsLen 32952 -prefMapHandle 5496 -prefMapSize 270279 -jsInitHandle 5500 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5024 -initialChannelId {a13284db-f479-4ca2-a81a-8b16f7e3987b} -parentPid 3032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5696 -prefsLen 32952 -prefMapHandle 5700 -prefMapSize 270279 -jsInitHandle 5704 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5712 -initialChannelId {669d9432-bccf-4f07-8dc4-4cb5eafa1326} -parentPid 3032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5368
- - C:\Users\Admin\Downloads\CS2Overlay.exe
    "C:\Users\Admin\Downloads\CS2Overlay.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:3824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5E43012191E7B1F510ACD5BF039D8BF1B9A277B2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ploc9qy0.default-release\cache2\entries\5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
Size 16KB
SHA256 c475d2bdc6a7a5d8f7d74d04a161f71746325e6876ef6ee051b4e14bd4de1449
MD5 77f5d030676915d1dbf0535daa9789e5
SHA1 5959ef1ed0947de1baae540d98dcbfd594744131
SHA512 e710b2dc1023dd3a081732ccdec230956b6ebd9a89c4b6fe8b4aad2f3132988ca15c0f401f57538ed042695623c626974fd3af9a6d1d34259470560bf3a026b9
SSDEEP 384:HkCjiO024YqDL84KKDL849B7SOEAd9KVRaAcP+AWRMA2:EzZYqDL8lKDL8CB7S/AmVAf+hRMb
TLSH
T1AD728D795F003CBC15A7C0E8C5F5929A8D18B7A7CFE6806D21583D0DCAD8AA9B0F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\datareporting\glean\db\data.safe.tmp
Size 35KB
SHA256 63ca9ece53bf607407a596d6e8f0a7a764b61d3dff9cb05d741ee46bd313b802
MD5 7c8914ce025f31839f75cd6bb982a4c0
SHA1 ddd550be635217a695fc2e62ba40c2d1b4e802f6
SHA512 63a7fa9d13ca81603eda7b7b256656b303916acd20da73707521e233c2c1bcd1c1baad06b7acaa450e9225eaa64ad77826c22add05c591a29f80b9241144a439
SSDEEP 768:DE7RN7rCzIKbUGcmhuc2iQcKqaUqZi+ObYbEbpbJbYznP/:+RN7rCzINiQcuzH
TLSH
T1ACF20084EB1A953FD42812BBDCA50B002F79F88A59192F573A5C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 54cf784f8023b8dd0e9ff96129baf805ab86f61e729b730b565144f4bfa946ea
MD5 1bbabc2126bedbe3cedc7f9bb291d658
SHA1 adde01b8a31bfb99712d4045480f09b1f448c435
SHA512 32b319e0cb557ba2f71ce68f5dc9b8cb34a6df70fcda2653d722768a1803882c3ed4fe248b0ee4c80948ab0c086965376d450a11bbdef9ecb7234efd7d403caa
SSDEEP 768:xnPPjYNqIJV1fGcmhuHVRYAZipbbab3bJb0:xMNqIJVpV6
TLSH
T1D9D20244EB1A553FD41912BBDCE50B002F79BC8A58092F673A4C64686C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\datareporting\glean\db\data.safe.tmp
Size 35KB
SHA256 d7aa18514b459738e011d7a94d9351e3d5d4bc720c42ca3ecc19285412e3d179
MD5 bb791ca239c3c6cfd68303ace9161850
SHA1 3e2a2fd0b08e8dd7c61d2b04f1acb9d3b8fcb4f4
SHA512 59d09d2d2b21dbc54bda0653fc6f1c1cb1d4b808b01327a5dffb841e92ccaacc8767fbda3cb366d138b6d59d6e1581662d1167f94a703c401e14f94237fb2ed6
SSDEEP 768:PRN7rCzIKbUGcmhuc2iQcKqaUqZi+ObYbEbpbJbYxEVnP/:PRN7rCzINiQcuaH
TLSH
T19AF20084EB1A953FD42812BBDCA50B002F79F88A59192F573A5C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\datareporting\glean\db\data.safe.tmp
Size 25KB
SHA256 351ab0c835f105a64305786c8e354c5bda86b80c08061fe718d3397da38077ac
MD5 8b1d05f449a4a5efe17c39ab5cde6840
SHA1 ffb3680fcb104cbfc5360703717e805b561bcd8d
SHA512 57d5a91ec5fbc0d6d9958301a5905367977b0d4cb591222d2cb259f13429adc050d363af069c999d021f9020832c480277186866aa9ede5be0b7a4e917f1b6c9
SSDEEP 768:M9NqIJV1fGcmhuHVRYAZipbbab3bJb0FnP/:QNqIJVpV6FH
TLSH
T16FC2EE84EB1E953FD41912BADC914B002F78F88A59192FA73A4C646C6C872DC3D9E47F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\datareporting\glean\db\data.safe.tmp
Size 35KB
SHA256 b4dee8149b8820fbdb4759f0f26ca0e574c2efd2bd0ef78f11c384cb17f2fc74
MD5 d223ab13ed8e6a727e0ea25e4555689d
SHA1 c14dc485d422ec86c762c39393d9bb7387bdb158
SHA512 2f5b873a206e6b82468a812959a826de9f205c09f442f56792ed19408634a34f26f8100ed5dcdf973a3a110de0a9136fa733c7adcd376039cf58ccbd876a51fe
SSDEEP 768:xnPGE7RN7rCzIKbUGcmhuc2iQcKqaUqZi+ObYbEbpbJbY:x1RN7rCzINiQcu
TLSH
T1DFF20084EB1A953FD42812BBDCA50B002F79F88A59192F573A5C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\datareporting\glean\events\events
Size 1KB
SHA256 979321055afa5923c5c019cec02728438826fb1842e8c5d4bf8085e2b3de8b40
MD5 04933b366ed56fbcb398afe77b533c84
SHA1 d546ccaa945004fee5ebb749641b062c57f28dd4
SHA512 3dacfe4dba14e254ed220e32e30062e6dae456400a4599fd2064a1611f52d3aa09cacc0236218ef139d4a828d102890756907cdc111e50b0bec4c2f1dc6dbff2
TLSH
T1FA21AC4C7DB84E6A9ECBF2AD7844068E93254A02144B1C430D12EE8DCE81ED9326E439
MD5 SHA1 SHA512 TLSH

Submit Download

48f7b42e-7407-46e3-9983-32a210bd464e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\datareporting\glean\pending_pings\48f7b42e-7407-46e3-9983-32a210bd464e
Size 235B
SHA256 985cb63337f4158e1b971ac8fe18fc8534f4d0da3d2eab667c27c3657ad52488
MD5 fafff4df61d51679729870e1bb2abbe4
SHA1 8eaa1610fed13f9807b21d4066f89008426b59c4
SHA512 585d48f56c3564b02b055fd4e70552b8ee9ce41b93f2da9a08196626ba6de6824c3176c85f773de34b90c586d912152a60d8454390ef45a7a63dfd9d20f13fa0
TLSH
T14DD0978A2888335C0C150F17F0A1AEC230954C3328BAB820EA706235AABD9C88221807
MD5 SHA1 SHA512 TLSH

Submit Download

4967ac23-900e-4723-8235-57b334fff121

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\datareporting\glean\pending_pings\4967ac23-900e-4723-8235-57b334fff121
Size 2KB
SHA256 44e1aa24852785d9a1f904d6ca68bf724e6e5fa4db9d122dc58411defc73ee29
MD5 1f87f5f7d8cf2c296bb595d40649f4ab
SHA1 cb0bf9a6bedcc7059084241510d5064947549aa2
SHA512 7c5425a63b78a6cf7ee06173a629dad2410b1c32dac830d1d8a47c7f441ef43b581c18ffd88df8cb9fe8e99b8dcc7fc288abf1356f72604efb45b514a256f267
TLSH
T17B41625D39785CBB9CDAF28DD882234F57608B5300C62C472E56DE4C8CAA65E337A47B
MD5 SHA1 SHA512 TLSH

Submit Download

79220a4e-dd53-4284-92b6-6b82dafad03c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\datareporting\glean\pending_pings\79220a4e-dd53-4284-92b6-6b82dafad03c
Size 871B
SHA256 d21c8ea546a40c0fa10652d8f4b158348f0ffef9a5f5bef6c77655c3a4fa113c
MD5 a25572eace07a7b8a906f7aa18780e73
SHA1 a98c3f70de6b1c90a6ad21f9b031f9c076da08a1
SHA512 00439d9c018693743a5d4d4d0a0e34fe39d54ad6b81828502f9e24f502ccf27f936bee8b8577f244b58ca2bc3600a05c1229466104a1b986ffa4dd0500f50574
TLSH
T1EA11E342A630B5B3CCB8D15FC99577468FB4752380CAE1183EA15D084C7E61E977734B
MD5 SHA1 SHA512 TLSH

Submit Download

7c274645-d6be-4013-b94d-dafca323c21e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\datareporting\glean\pending_pings\7c274645-d6be-4013-b94d-dafca323c21e
Size 280B
SHA256 cdbce2553c1a68276e603d4b7a6e708d0635f1f12bfed90b3607b68c232d09ab
MD5 0fc2025dc6cb10553a97f983676be7e6
SHA1 857f8370fef9a310931b03db34432fc6a03391f0
SHA512 0b9ef5f563493283a54df4c2f12dfeca6f71299e222e107b319754a53e9b8d79bca1515b797cf4dd85057c120994c278883b3fb033c1de2ea4eb1df0fd9dd186
TLSH
T19BD0EB90A88C335C0C281F0BF0B035E631690C3320FAA81098E000248EFEED8803080A
MD5 SHA1 SHA512 TLSH

Submit Download

912a25d9-c50c-413e-8ad2-613028557d98

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\datareporting\glean\pending_pings\912a25d9-c50c-413e-8ad2-613028557d98
Size 931B
SHA256 cdd0661e9384ef24209d333d2eb6db3ce9f9aca1199f47c5b32bbe96266c7860
MD5 bfb5410f6d32361789b02c9c25472f7f
SHA1 0fe940614cf1ec0b1579592b66cb4208df7254ab
SHA512 9b9b88cee11e82f82724596be7fde4157dd978588022dc4ab0bfcecf34bdc70c9fc74e67af2b3180818d9be947c81206185b4d95dd21abe18c0695a9dae3d2f7
TLSH
T176111081AA6474B38C78D29BD9A47342CEA46423D0CA9A187E905A140CBF52E937770B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\extensions.json
Size 16KB
SHA256 e99ff9cc9a9184fdded3dbfeb2d52a06025b92722b51ced73fe108eafa6c5d89
MD5 63d2670521cffa8d34d1fadf147e9437
SHA1 8ad3707751f43062fe23ddb708c54f64ffedb079
SHA512 22bddf7762cd529d3926d0149659776c6001c627d3a281e02381d55a58a7a80a13e6fe5a1b2a2da9954afe3db4d71d68cfeccd7c4487b3267d895bbf06b2e0d5
SSDEEP 384:XAkkI4vSUmldv18dhWM94zl96oHL4HWL4PdL4HcL4H5L4HgN4hc:X6I4KRfWXd4H6M484F4W4R4s4S
TLSH
T13F72311545048EB8298EA79AAA367E01C37D473B70845C78F4DD8FC842FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\prefs-1.js
Size 6KB
SHA256 40a67c3c6392a925cb3d7a08963bc81d37539fb0b95363562e45206afd92ebf5
MD5 3b6d20169dd575347f74cf7dc818cb05
SHA1 5934b31534fa37deabdcb7ae0cd38fb406c3fcc0
SHA512 31316e8acad7e8c6180595387c65d0deffe719614c0e77849ba55dbc21044ccdb9308f7f824c34c20aa60ba6e5e7e285cb31494a631e64c6b1db05048a4dcff2
SSDEEP 96:xHyoUTUQqGqi66fLyx1zSRzSSlNdv9j/uun0H6nyBw88P8L4cnfToUh:NLRz6fLyxQzSSLMXBw88W9
TLSH
T13FE11D389148CB7F74B6766CAC688C716AB2013B7BBF68D650B954C4050CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\prefs-1.js
Size 7KB
SHA256 65776c7ffb1b770007b80171ce733c3b2bef5c7d380064c3424cdef51002e58b
MD5 ba1fc13d93f6015d4b8668bc87619d52
SHA1 849fbdf94ec1d1546d3bbff02e31029faa135f6c
SHA512 623ebab140afd2e0638505075cdfc5208cc4c2830b25feb9aaf580043d887d9e0bd5f290a019602c34f55dbefa7d31a989a5ddaa12064a40a4f343f53cf5289b
SSDEEP 96:xHyodTUbPqGqi66fDyxObzSRzSSlNdv9j/uun0H6nWBw88N8L4cnfTRUh:NWCRz6fDyxrzSSLMDBw884m
TLSH
T19FF1F93C9048CB7F65B636ACAC684C315AB2023BB6BF6CC650B944C4051CF3852F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\prefs.js
Size 6KB
SHA256 b7f1c8632667a6c31dbcce2c5c0076a3416e0e44485fdf94f01c27e8a87c1949
MD5 5454c602c54973bddd5b9a1b623b0f37
SHA1 8abe19941545400ff33f361289dd98dcb5127d1d
SHA512 1d8612dbe1a53c8c4dcbcc22b15e5a481c51302cd5705136be3a7dd1681b4ecb2425647363f4a7cec6ff6b499eeee293df172c3ea182cb8b6ef8284961377259
SSDEEP 96:xHyoUTUbPqGqi66fLyxObzSRzSSlNdv9j/uun0H6nyBw88P8L4cnfToUh:NrCRz6fLyxrzSSLMXBw88W9
TLSH
T120E12D7891488B7F74B6766CAC688C716AB2013B7ABF68D650B544C4050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\prefs.js
Size 6KB
SHA256 d06308355a98b5667fe4f54ff3e7d49de9b8802a1d9c5a8438cf82b102bc6695
MD5 a0b5450ba1ed4a0721bfb1917306ac8d
SHA1 5bea9c1d4460bac5d70b14809461fce99a5237e8
SHA512 68a733ae6bcee7ece68649811ec27e9847c3c855ebd84e1994f2483ceb238288380de2f51dd0b93ae454e0acfef1649e0da9d60875d7ff8b1439f52f9e87c3ef
SSDEEP 96:xHyoUTUQqGqi66fL361zSRzSSlNdv9j4Un0H6nyBw88P8L4cnfToUh:NLRz6fL36QzSSEZXBw88W9
TLSH
T1F8E13F789048CB7F74B6776CAC6888716AB2013B7BBF68D650B544C4051CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 35d5fc89234d560e685badd282a776cf77a815aa34b53e1fb201ce75ab1055b1
MD5 ad3e8606dec24fc8874b5cb936e3ed18
SHA1 b4fe960c1d6f0f82d216c70115aeca768c4d7b46
SHA512 1c0b7ced1f34a695b10190ee7d260849727226c890c8aafdbef28e050bcadfe918635dfbec72e93e9461ccdbf2cd74c140a1bce42290bac0a635e232523edf98
TLSH
T18D415C87144F4EB6E7B5C04CE0825BF9CB9E381705781840C98A9CCAA1AF9CD29A54ED
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\sessionstore-backups\recovery.jsonlz4
Size 2KB
SHA256 d4acb71b8d218116e63ea7d1eb84f675dee0833207975cc8372e371f5dfc4f42
MD5 82732a1e5737ab271152ff51c9f8952b
SHA1 d91d6c087f3c58c9892241af60dc66409ce10a13
SHA512 a568d4a0513647a5893ddd71d605dbfbd6203a03e38b5761ee457c01e4be32bf9ef5dcdd08be9f1a293e4a8e9ba566c7927e145d16e295a7ca8d99982aafc925
TLSH
T163413A87184F4EB6E7A5C04CE08257E9CB9D381706781840D98A9CCAA1AF9CD29A54ED
MD5 SHA1 SHA512 TLSH

Submit Download

CS2Overlay.exe

Path C:\Users\Admin\Downloads\CS2Overlay.exe
Size 524KB
SHA256 5fc544e17626b97f58c7047436025f8e0ae13a2e9e1915427409b67d9a3c2dbe
MD5 58449a8837ce113b99b36ffcdf6806f7
SHA1 11843defbff5df9c8aaa0a4b86f356cc2839267c
SHA512 0a856518e57864ecd2737226c3b2ae1382a02bd447e2570714e87715c1adb41b264c1ca2a81de39b875f83ff70e50743a3e64ed5a740d440b7d6b8578ab1c0b6
SSDEEP 6144:98NRKpkLdBtucOfikr6f6kqv6RtXnynxVgFVQiO31FBmOco5+nDfrxPyZvZ1hJoF:Rk/tu5ptnxVgFm53LrEBU1hJo7Rtnz
TLSH
T1DEB49E85F1E957F8D17BA178A586B60BF9353848071086CB73F449982FE37E42AB7312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download