hxxp://adf[.]ly/DFGCr

Analysis

user interaction
yes
max time kernel
40s
max time network
41s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/07/2026, 17:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://adf.ly/DFGCr
Sample260724-vramlaszgw

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 26 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1932	firefox.exe
Token: SeDebugPrivilege	1932	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
1932	firefox.exe
1932	firefox.exe
1932	firefox.exe
1932	firefox.exe
1932	firefox.exe
1932	firefox.exe
1932	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1932	firefox.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 1932	3920	firefox.exe	81
PID 3920 wrote to memory of 1932	3920	firefox.exe	81
PID 1932 wrote to memory of 3428	1932	firefox.exe	82
PID 1932 wrote to memory of 3428	1932	firefox.exe	82
PID 1932 wrote to memory of 3428	1932	firefox.exe	82
PID 1932 wrote to memory of 3336	1932	firefox.exe	83
PID 1932 wrote to memory of 3336	1932	firefox.exe	83
PID 1932 wrote to memory of 3336	1932	firefox.exe	83
PID 1932 wrote to memory of 3336	1932	firefox.exe	83
PID 1932 wrote to memory of 5000	1932	firefox.exe	84
PID 1932 wrote to memory of 5000	1932	firefox.exe	84
PID 1932 wrote to memory of 5000	1932	firefox.exe	84
PID 1932 wrote to memory of 5000	1932	firefox.exe	84
PID 1932 wrote to memory of 3028	1932	firefox.exe	85
PID 1932 wrote to memory of 3028	1932	firefox.exe	85
PID 1932 wrote to memory of 3028	1932	firefox.exe	85
PID 1932 wrote to memory of 2516	1932	firefox.exe	86
PID 1932 wrote to memory of 2516	1932	firefox.exe	86
PID 1932 wrote to memory of 2516	1932	firefox.exe	86
PID 1932 wrote to memory of 2516	1932	firefox.exe	86
PID 1932 wrote to memory of 3472	1932	firefox.exe	87
PID 1932 wrote to memory of 3472	1932	firefox.exe	87
PID 1932 wrote to memory of 3472	1932	firefox.exe	87
PID 1932 wrote to memory of 3472	1932	firefox.exe	87
PID 1932 wrote to memory of 3864	1932	firefox.exe	88
PID 1932 wrote to memory of 3864	1932	firefox.exe	88
PID 1932 wrote to memory of 3864	1932	firefox.exe	88
PID 1932 wrote to memory of 3864	1932	firefox.exe	88
PID 1932 wrote to memory of 4276	1932	firefox.exe	89
PID 1932 wrote to memory of 4276	1932	firefox.exe	89
PID 1932 wrote to memory of 4276	1932	firefox.exe	89
PID 1932 wrote to memory of 4276	1932	firefox.exe	89
PID 1932 wrote to memory of 2300	1932	firefox.exe	90
PID 1932 wrote to memory of 2300	1932	firefox.exe	90
PID 1932 wrote to memory of 2300	1932	firefox.exe	90
PID 1932 wrote to memory of 2300	1932	firefox.exe	90
PID 1932 wrote to memory of 2520	1932	firefox.exe	91
PID 1932 wrote to memory of 2520	1932	firefox.exe	91
PID 1932 wrote to memory of 2520	1932	firefox.exe	91
PID 1932 wrote to memory of 2520	1932	firefox.exe	91
PID 1932 wrote to memory of 2672	1932	firefox.exe	92
PID 1932 wrote to memory of 2672	1932	firefox.exe	92
PID 1932 wrote to memory of 2672	1932	firefox.exe	92
PID 1932 wrote to memory of 2672	1932	firefox.exe	92
PID 1932 wrote to memory of 2376	1932	firefox.exe	93
PID 1932 wrote to memory of 2376	1932	firefox.exe	93
PID 1932 wrote to memory of 2376	1932	firefox.exe	93
PID 1932 wrote to memory of 2376	1932	firefox.exe	93
PID 1932 wrote to memory of 2328	1932	firefox.exe	94
PID 1932 wrote to memory of 2328	1932	firefox.exe	94
PID 1932 wrote to memory of 2328	1932	firefox.exe	94
PID 1932 wrote to memory of 2328	1932	firefox.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://adf.ly/DFGCr"
1⤵
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://adf.ly/DFGCr
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1988 -prefsLen 27097 -prefMapHandle 1992 -prefMapSize 270279 -ipcHandle 2080 -initialChannelId {775b65ef-5406-47c4-8e1f-08b21d7911df} -parentPid 1932 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1932" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2448 -prefsLen 27133 -prefMapHandle 2452 -prefMapSize 270279 -ipcHandle 2472 -initialChannelId {2dad6a8a-4c27-476d-86f8-f941da56b0f5} -parentPid 1932 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1932" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3336
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3912 -prefsLen 25164 -prefMapHandle 3916 -prefMapSize 270279 -jsInitHandle 3920 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3928 -initialChannelId {c48fcb7c-164a-43a9-97dc-0f9f7d087353} -parentPid 1932 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1932" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4064 -prefsLen 27274 -prefMapHandle 4068 -prefMapSize 270279 -ipcHandle 4140 -initialChannelId {02a5d329-8068-4842-a842-195fffaf4a02} -parentPid 1932 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1932" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4700 -prefsLen 34773 -prefMapHandle 4704 -prefMapSize 270279 -jsInitHandle 4708 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4716 -initialChannelId {dbf6ccd5-f2e9-4930-b4cb-313603ba094c} -parentPid 1932 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1932" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5028 -prefsLen 34876 -prefMapHandle 5032 -prefMapSize 270279 -ipcHandle 5116 -initialChannelId {0b0665b4-1db8-43e2-b7df-08db48f5904f} -parentPid 1932 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1932" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3472
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2820 -prefsLen 32952 -prefMapHandle 2824 -prefMapSize 270279 -jsInitHandle 2828 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5412 -initialChannelId {4ffae20b-030f-4703-be36-670c49184f04} -parentPid 1932 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1932" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5672 -prefsLen 32952 -prefMapHandle 5676 -prefMapSize 270279 -jsInitHandle 5680 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5460 -initialChannelId {caf9418e-bf59-4290-8c80-a96b147b6ae4} -parentPid 1932 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1932" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4276
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5824 -prefsLen 32952 -prefMapHandle 5828 -prefMapSize 270279 -jsInitHandle 5832 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5840 -initialChannelId {4cd625ad-b3e0-4e9a-ab2d-3fea2ac56e20} -parentPid 1932 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1932" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6008 -prefsLen 32952 -prefMapHandle 6012 -prefMapSize 270279 -jsInitHandle 6016 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6024 -initialChannelId {daec7d96-b749-4c08-b673-4c5fdeb17266} -parentPid 1932 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1932" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:2520
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5852 -prefsLen 32952 -prefMapHandle 5864 -prefMapSize 270279 -jsInitHandle 5824 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6280 -initialChannelId {9c650d8f-7eb8-4527-817c-401839f127ed} -parentPid 1932 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1932" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:2672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6416 -prefsLen 33002 -prefMapHandle 6280 -prefMapSize 270279 -jsInitHandle 5952 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5972 -initialChannelId {3f00c1a0-885f-4900-bd21-29be17a48147} -parentPid 1932 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1932" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:2376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6856 -prefsLen 35112 -prefMapHandle 6852 -prefMapSize 270279 -ipcHandle 6688 -initialChannelId {544d3cde-91b8-420e-ac79-553163760a70} -parentPid 1932 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1932" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 utility
    3⤵
    - Checks processor information in registry
    PID:2328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e4veoxpw.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 15KB
SHA256 abeec6d44f1bb4ebd54f443880ff924d828d3cba640f999b4cd064151e92c942
MD5 7c9f2a9aeadc82f2eb15e3692dac39a6
SHA1 9a94c200881462e020ec6908402546822bde444a
SHA512 e5b428eb1afe5a94c5198f95c4c069b574c1e4104a4032978a3ccb6c6d298ac8584666942e19211122d40580acef0d37f1d05d7eaf75baf1ad95da1fc241ed78
SSDEEP 384:HwCe7iO024Yidcs3hk2nhfdDE2Ba/rIVy8eAe+se+L:QqZYidv3hk2nhfS2sDIVy8A+d+L
TLSH
T1E1729DBBCF416C5D1967D985C8AD83A5DD05F9ABCBF6D1B608203449CB84326B0FA0CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\AlternateServices.bin
Size 7KB
SHA256 b89431acad58d97370fa10444640e8b9d5651ee8bfea5554258a6b9b12cf9371
MD5 7f5041ac2420de691e5f97ddf73b8c44
SHA1 e24464d7dfcde6ed0ba4c0d855f0a508be3d316a
SHA512 c9567b56c00146d5fe0c10a58f88a5431cd9f370d7511f5cdcabc6e0cd91a4d89cd69319a338c8398c3b2fabd7d6807310159d39a79f4e43dfd0e04c504f8e4f
SSDEEP 24:WuhMZUm/xM1JV7MtVSA0KD6/xMlvLVgMDxM1JxM/xMRjxM:WZMfV7MLULZMNLCMFMVMZMPM
TLSH
T17BF1B7EFA776D830F0726F7090D871CCCA738279693CB895E608E0D715A16E5903EB48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\AlternateServices.bin
Size 21KB
SHA256 bc25d1faeb80fb5999dabba310d11a2e9c96c25d8005652a9a1e4fabc4156a7d
MD5 ea1cfa9973b0e021ffd9edc4c915f3a6
SHA1 bf5b5aa786c646e6fc2e3cb38e2fd71bc1a57cc6
SHA512 8080bfa7edaeca12fe5562351572af2b40aeda12d99566c3dac7651ea159e7936f9c655703144acd4ea72f26b93b6ae778c2216b1fa8e08a0a092d9d913938e5
SSDEEP 96:7y0UOeXvFF00na8EYBPxW3ol5v3rXHP3qsSyPYw6/et9u4:ZUSPY
TLSH
T192A288EBAB75D825F0B27E7480C871CCCB3382695D78F985E608E0C712A56D5903EF58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 1e62bedfff86db3983c102fe281b339721574f40f86f2adc14729af332ac50b8
MD5 0a212d3c9fc11902da5f5a4d902f97a2
SHA1 4a5174289db1e5988ef6b97a4da0f4efa04a66d5
SHA512 3d0d2fbd356b336f282e6ca91233c6216e8c5e3672cca65141d2e68f181665674058c1ff7606fe840d0abc527b4e0b599ee141da6da9d4d471a754bc9e83d541
SSDEEP 192:da1d66Joz0dzgCl6mc0diOv5zboHlZLayjSi:dEd66JozQzgC1jPboFZLayj
TLSH
T1F5E130A8E629863FC408027BCCB61B444F75389A984E3F19759C750D2D472DE778E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 806b3f31ae319506446d83d8ed984ada3170d9cc12fc102c35156e68a694e67a
MD5 f232afe1e9590eb3a0ab5134b108122e
SHA1 095631f975bf710252106d3373fa992f1e5cb5c4
SHA512 bd6f7e5376d789d557fbad31fe8851abc123f3cdf36065028d74cadc33e2941ed79afab027d0887190a84b0b8f2a27f739b728d02888bf5b903520581dbce0e0
SSDEEP 192:8a1d66Joz0dzgCl6mc0dhOv5zbooZLayjOx5x:8Ed66JozQzgC1jUbooZLayj
TLSH
T151D1FE68E639867BC448023BCCB60B500E76389A988E3F19719C741E2D572DD7A8D27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\events\events
Size 1KB
SHA256 5ac6343268dd47e665313da96693df4530577ece5b076833112b56760dc22ebe
MD5 2fd0085809e4c992bc3a99212cb4c1ab
SHA1 6f462303e42be8b7f53afc02d749fc53c5a0721c
SHA512 72387c254c2fc200dd4bfb482ce3abca2322aa3a5ec1136762fff7642dfbabce0035a7a4c1fdc5b51a187691338fb425e2325b2b4cc575bf1c7b67f788fffa4c
TLSH
T14421AC4C39B94D2EA8EBE25C744052CE93154E4304871C971D62FE8CCE91EDD326A43D
MD5 SHA1 SHA512 TLSH

Submit Download

1016d9ca-41e8-4027-a4bb-abcd48a5a25e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\1016d9ca-41e8-4027-a4bb-abcd48a5a25e
Size 2KB
SHA256 e636c4cacdb4ca79acf48ec294baed90a673e20de2ba8af7933eb6e9218fe211
MD5 bb04f11f9550e958fbff89e7a88a5f3f
SHA1 41a5ed13c4263e803c9403ec16c872b61d185baf
SHA512 b4cc4f43fd408fa0ba481f5ff3f2db4f23b7cbe59ab2ec8e2f56515511b7b8c724a5cb05411981d0ea81f1a531deb898fb731930eaff12d3da44c0ee63ffee22
TLSH
T15B41235835789CB78D9EE59DDC93234E57A08A0300C61C436D66EE0D8C967AE336B92B
MD5 SHA1 SHA512 TLSH

Submit Download

8232b056-e733-40b1-8cb6-395b1b1582fb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\8232b056-e733-40b1-8cb6-395b1b1582fb
Size 235B
SHA256 12cec47394f32434c9c90beb1480214d1dc7fd55b0ac9071158d4cb5962579ea
MD5 cdf1163b6e63e133718bc72869069d7a
SHA1 f5874238bd47905f29997830a6b6651532c1ee1a
SHA512 aaed5dab3c43b739472a7ccd8d32f6f6f5b8f3a9e606e34e62aa408a07c09a559b15492cc8273fa9d49e005885e4dbda988ca0dbe7f12b965bdbe7bb878d2a8b
TLSH
T144D097C038A8732D18146F03B0A06CEB304C4C3325A568108AA042748EFEDC8465180E
MD5 SHA1 SHA512 TLSH

Submit Download

9fc39d28-6161-4f73-a9d9-daa7812ed827

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\9fc39d28-6161-4f73-a9d9-daa7812ed827
Size 883B
SHA256 ef5c42afdb45f99dd4aeb160d684e50a259906148f6570b1b2f204a827ade54a
MD5 250d8b4b9f7375a3f015f44ce4a06cbe
SHA1 a41e6d8d057f30e5dfe456a4077f7d545dced8f3
SHA512 90a2c0885ef40cbcdb3d4b829f8cbf4175348ea1ecec0359eaa05c8217b7df03452aa8022ff495ef1a800a586bc859d4e39110cda8e495c73cbf8ab498ae0fcb
TLSH
T1531100C0D631B8F3CC38A20F89A277419BF4753380CA15107DA95E050CBA92EE3AA70F
MD5 SHA1 SHA512 TLSH

Submit Download

b02433c1-afc3-4dcf-98cd-8a922b4ca60c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\b02433c1-afc3-4dcf-98cd-8a922b4ca60c
Size 2KB
SHA256 f09de6ae837602e2d079769ea383f7349b2c5b89bdab0f48c4185616f541d61d
MD5 733aab662e2210bc9b0167a068679679
SHA1 1da887736e50390347f20ffab6cd91c0abc345e3
SHA512 746f22a534676b527b14649aebfae588caeaa832fbbf929aeaf163a1b6c27c32ce6a5bd9cd36b5fde43b3ebb0e19292f0af8845e800e798ef7f32ade490a6661
TLSH
T1695197698160D8BEC93DA31BDD253B82CBF2140B408F194E9EDCAE0B157FC5E9369745
MD5 SHA1 SHA512 TLSH

Submit Download

bf286d85-424b-4190-b615-5a7f0c3c6b51

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\bf286d85-424b-4190-b615-5a7f0c3c6b51
Size 235B
SHA256 83a98e759448ea2b7cdbf367f382e04cf2153b22d6724184c0c410ad6845d4a8
MD5 922ae2f2032288d484fa254b009992d6
SHA1 743950557ab680a34c12794359e07454669bdea4
SHA512 1a6e5578779271f912f4750beafac877826cd5ed696d33063bf60bccf04b98368292b175ca0b87d043a8ae1796d6b165257ec5f7370e0026a6ef5cce3c823481
TLSH
T14ED0979014A8735E0C100F1AB0B128C6B0494C3B10B858A0CAB2803CE9BCAC44251D4E
MD5 SHA1 SHA512 TLSH

Submit Download

ef5b672c-f822-4406-b7e4-759c22676aa1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\ef5b672c-f822-4406-b7e4-759c22676aa1
Size 886B
SHA256 4062e93fc0d6aa86787d350a8ebf85e4e08310e458f066ea19137ffaa47900dc
MD5 fa5a1d377418bb147c95cbdb4b4581e1
SHA1 6aeb306f49ff2ed93aeb81df169d7450aec7321f
SHA512 ecc684af26113d2bbfe17ab0e75e690ac8c3b955463679d0296f42f89af1cf560b8c5479c4727216d9cdee02daa9321c79372a57bbf996e8e0ba90f01ce9f85a
TLSH
T117112391C535B4F3CC78A24F99E1B7418EE4B02380CA1A147D996F080DAA56FA37A70B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\extensions.json
Size 16KB
SHA256 4dcb4cfab9cde3dee23ba1422ee873c8b4bcb5716bf82f2b75d5cd5cbb8ea9a4
MD5 1dfe4615b7dfd7be9717f888846ae343
SHA1 56a0eb0b2ba6265023d504b9c5a7e2eae953785f
SHA512 20dab64aa653f78e89ba46f36eceed9d0c752cb64aa189f7cb2606bc93c756cb3d43ce3b0f4c7304abc885a942ee7d1aa1d13e18a8607dea593a4e43c4d2308d
SSDEEP 384:0DkI4v0Umldvg8dhWSD94zY96owqL4HgL4PuL4H5L4HNL4HRO4hN:0AI4cRfJXHp446Q4i484R4t4s4j
TLSH
T1B772411545049EB8294EA78AEA367E01C37D473B60845C78F4DD8FC842FB5B902FBA5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\prefs-1.js
Size 8KB
SHA256 e5f06e01551d2dad4c574eb15bb1edb0fc0efaea642d5462698a667c54c8bb92
MD5 77f82d2f3e4714a3e3cc00566056b0fa
SHA1 445a21b1568a25cb4d3704e7cd063d1d17bbc758
SHA512 eff606e9839a493e9fb6444f751dff3ea007a3d385211a22ae825ab5223e7a93a04e24ce4b685b4eef52e89f9465984a9c108f8950d05bd0b78936fb65b3487a
SSDEEP 96:xHcFTU1qGqQfQLJObzSQSSlZdv9jCnJWR1ZzpwjBw88gWE8L4cnc1qiDGS:ChRQfQLJeSStRTzmjBw88I
TLSH
T105020E385404CF7F74B2366CAC2489305AA2023BB7BF68D710B9A4C5051CF3852F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\prefs-1.js
Size 7KB
SHA256 4008d09e0dc1651e503bb4c080b8376d3a169645438b88e5392e7bcd590fa457
MD5 d57eb0ee1a207628f8561b57ddcd936c
SHA1 35615d30d05d546e8a9b229834d6089ce3ac752f
SHA512 b527ce4a4f49bff05583ffc9468e52a35b915afa3ba0edabae2af1b460ff873eade131bf580a30759d299a86fd7ec53b71b09c8dd299c50346b82246278428a1
SSDEEP 96:xHcUTU1qGqQfALJObzSQSSlZdv9jCnJH9zzBw88H8L4cnc1qGDGS:C4RQfALJeSSo9zzBw88d
TLSH
T180E13E7894088B7F74B6776CAC6888316AB2413BB7BF68D710B554C4051CF3842F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\prefs.js
Size 6KB
SHA256 63c0021b6c57006147fcb0ac0f9e7cecd98e129ffc932da8e9e7ac1bacedc708
MD5 75da877fab5645c19666a83a6ea95bf1
SHA1 8b6f60b474cc0781baea9455de66b1f070234d9f
SHA512 b3834663774b5ec23117aa3ff30c4ba1a03f37f702ac702522f0d03c583e1be320d0545f7635273db79297436450ce34daa738aa7df2c65cf9449ff4c9e97ac6
SSDEEP 96:xHcUTU1qGqQfA151zSX9xNSSlZdv9jnCnJH9zzBw88H8L4cnc1qGq:C4RQfA15cvSSY9zzBw88e
TLSH
T16BE12F789408CB7F74B677ACAC6888316AB2413BB7BF68D710B55485054CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\prefs.js
Size 6KB
SHA256 a378e4fdc12d6d93895d93f0d6d5fd57ba7a8c1ea10182512785fda9322fe902
MD5 fa7a8acc397f1da3ca4863440803007a
SHA1 3ac632d7b8f4171a734205f44f1bf844b6201253
SHA512 e3585973f6359541647d0aec2eae126c9d3e8c5b73ac3810c283a5c83fea18e3548dac7089b22e6176118a4621b12d465ab12e8ed2e8d11f485a6be85ea5f726
SSDEEP 96:xHcUTU1qGqQfALJ1zSQSSlZdv9jnCnJH9zzBw88H8L4cnc1qGq:C4RQfALJ5SSY9zzBw88e
TLSH
T10BE12E789408CB7F74B6776CAC6888316AB2413BB7BF68D710B55485050CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 e59faa45b491293331d059c7dbf63934207ac5a8c9859bd850387ff4c5e9bad5
MD5 7e563dac94abd30cb9e6381748311703
SHA1 7a912326db275101290e24ab8c98f3ba46e71197
SHA512 7ba96a193fb5866bd44ba87a72009637821536210f667e63cdc313042fbcbc500c09bc76dc53f79a0ff76f0c841ee18810136600a233e0d9a94528d1bc791b71
TLSH
T113715C538D731ED5D45729FD804237FBC6A726348A92FCF1829C6F00A40A71837AB945
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.1MB
SHA256 7b026e74c2e732847796c3f6078f47b964b8ee278f32a6e799025fb6d74f0ceb
MD5 fbaaf1da1859cca3e0fc01d8fd0ceccc
SHA1 23d1958dc9d93664ecddd14b7eac9ab6786f88e0
SHA512 8217ef7be08beadea63886f0cc97c5024cc330368420266c8b595f419af86859fbf4f62b29527f3960047f7dc214141f21292709d010118ffc45279bd956748f
SSDEEP 49152:5IbfpQBfzagT0lbDoYsV1g8iHbZMplZXTtvAEHm:abfpQBfzag/1diHbZwrXZIkm
TLSH
T1D21639F824D2A257F3818037668563EF21AFD00C6467DD484BD966F990B8CDF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads