091609705a031d5832f21548291c2670f06eadd781d465d3e1a5fad3772adc91

Analysis

user interaction
yes
max time kernel
598s
max time network
476s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/10/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$RESOURCES/AACGUARD/AACGUARD/PresentationNative_cor3.dll
Size 1.2MB
Sample261018-vbpftassbx
SHA256 091609705a031d5832f21548291c2670f06eadd781d465d3e1a5fad3772adc91
MD5 76c57f8f951306b6fe29c83f9844cb6f
SHA1 9aa8c8bf7af042ac0d95f6169d71a5ddd6a0cc4c
SHA512 019050f80430ae459e6fd6ffce5cbff4af49073834169d40083f6a9b22abebac1d605ab8b409449d4313a3bea08bebfc62c9b93905bcc327e8b20016414133c1
SSDEEP 24576:XjOnXauaPQDzcpsVOE4PU5tbg5ChWmAjHSa+YrHAvlFk8TQh6p1zwPwYffvhXYj5:ZuaofcpsQ5PU5ZhWmAjHjAvlF5QhURwA
TLSH
T10A453A22D2E642E5C47FC1B8C646972BFBB1740A131C66DB47608B592F27FE0963E364
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4072	firefox.exe
Token: SeDebugPrivilege	4072	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4072	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 4072	4516	firefox.exe	101
PID 4516 wrote to memory of 4072	4516	firefox.exe	101
PID 4072 wrote to memory of 1748	4072	firefox.exe	102
PID 4072 wrote to memory of 1748	4072	firefox.exe	102
PID 4072 wrote to memory of 1748	4072	firefox.exe	102
PID 4072 wrote to memory of 924	4072	firefox.exe	103
PID 4072 wrote to memory of 924	4072	firefox.exe	103
PID 4072 wrote to memory of 924	4072	firefox.exe	103
PID 4072 wrote to memory of 924	4072	firefox.exe	103
PID 4072 wrote to memory of 2404	4072	firefox.exe	105
PID 4072 wrote to memory of 2404	4072	firefox.exe	105
PID 4072 wrote to memory of 2404	4072	firefox.exe	105
PID 4072 wrote to memory of 2404	4072	firefox.exe	105
PID 4072 wrote to memory of 2120	4072	firefox.exe	106
PID 4072 wrote to memory of 2120	4072	firefox.exe	106
PID 4072 wrote to memory of 2120	4072	firefox.exe	106
PID 4072 wrote to memory of 2376	4072	firefox.exe	107
PID 4072 wrote to memory of 2376	4072	firefox.exe	107
PID 4072 wrote to memory of 2376	4072	firefox.exe	107
PID 4072 wrote to memory of 2376	4072	firefox.exe	107
PID 4072 wrote to memory of 2868	4072	firefox.exe	108
PID 4072 wrote to memory of 2868	4072	firefox.exe	108
PID 4072 wrote to memory of 2868	4072	firefox.exe	108
PID 4072 wrote to memory of 2868	4072	firefox.exe	108
PID 4072 wrote to memory of 4100	4072	firefox.exe	109
PID 4072 wrote to memory of 4100	4072	firefox.exe	109
PID 4072 wrote to memory of 4100	4072	firefox.exe	109
PID 4072 wrote to memory of 4100	4072	firefox.exe	109
PID 4072 wrote to memory of 4420	4072	firefox.exe	110
PID 4072 wrote to memory of 4420	4072	firefox.exe	110
PID 4072 wrote to memory of 4420	4072	firefox.exe	110
PID 4072 wrote to memory of 4420	4072	firefox.exe	110
PID 4072 wrote to memory of 5900	4072	firefox.exe	111
PID 4072 wrote to memory of 5900	4072	firefox.exe	111
PID 4072 wrote to memory of 5900	4072	firefox.exe	111
PID 4072 wrote to memory of 5900	4072	firefox.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$RESOURCES\AACGUARD\AACGUARD\PresentationNative_cor3.dll,#1
1⤵
PID:4868

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2020 -prefsLen 27099 -prefMapHandle 2024 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {e1d01280-9728-4199-a6f3-9c98e90fa282} -parentPid 4072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4072" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2480 -prefsLen 27135 -prefMapHandle 2484 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {8721d308-a47f-48b1-94cf-ac3ff8997e26} -parentPid 4072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4072" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3844 -prefsLen 27276 -prefMapHandle 3848 -prefMapSize 270279 -jsInitHandle 3852 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3860 -initialChannelId {5f5c63d5-dbcb-44cc-a898-39cebe9c50d3} -parentPid 4072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4072" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3076 -prefsLen 27276 -prefMapHandle 3080 -prefMapSize 270279 -ipcHandle 4040 -initialChannelId {a410680c-9c59-402f-9795-bcc5e143c8d6} -parentPid 4072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4072" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2120
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2728 -prefsLen 34775 -prefMapHandle 3056 -prefMapSize 270279 -jsInitHandle 3808 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3796 -initialChannelId {25e3b610-5e04-422f-a490-56462f11bca4} -parentPid 4072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4072" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2772 -prefsLen 35012 -prefMapHandle 4856 -prefMapSize 270279 -ipcHandle 2800 -initialChannelId {dc8b0063-9d89-45b9-a14e-f0f048c3e243} -parentPid 4072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4072" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5100 -prefsLen 32900 -prefMapHandle 5104 -prefMapSize 270279 -jsInitHandle 5108 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5116 -initialChannelId {52b219b6-25b6-4b68-a044-051ed9d1a8b6} -parentPid 4072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4072" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5380 -prefsLen 32952 -prefMapHandle 5384 -prefMapSize 270279 -jsInitHandle 5388 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5392 -initialChannelId {9911ba12-7db6-4653-b160-cbd42ca92840} -parentPid 4072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4072" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5584 -prefsLen 32952 -prefMapHandle 5588 -prefMapSize 270279 -jsInitHandle 5592 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5600 -initialChannelId {d69826fd-e33e-4d77-9021-c8d48747d0f0} -parentPid 4072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4072" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\activity-stream.contile.json
Size 4KB
SHA256 4ae57bc69a7b435da4ab0e8857e9db276e5ec32c711a4c168f28625a2622750f
MD5 5fe18a67b06abccfd79a6e1f5517818c
SHA1 5785e15e3c8ff9f20ba41b8d20b1d0de51827f78
SHA512 20e0cc7b1d093a3e1c0b9e0f32eeb2f974265be5fc092c5bd6da96480331f44c46b437f05c11ded476278d134622e37383b40a98a36c85b353fc9b1ff8bae99a
SSDEEP 96:Tj9PM+18mNA3ERhT+mRL1on4KY1zbV6DS4lz:lMU8/URwmRL1oIVwS4F
TLSH
T11891B66B947805161F70AAE65C4F3398F10BB846D9F18A9CB16B9C31C5787BD90CB988
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 c88adaf1bbd11c56421adc69cd2554540ee43494e8dcf74be76b22344f64485a
MD5 9075ced60627d319bf568a33d355b6b8
SHA1 d91c1b8104cfe391f53d114befa159d51a13d4f8
SHA512 0d799eec94f9d08614da059157ba801ef51897e24d34721cc26b1cfe0ad1bfd1ee84b21dd5eb486c75551ec6f3ddc8259251a6c8d493584d71abb00fde738eb8
SSDEEP 768:1ygrdQsDpgOv5q5bri+1+XiXeU51giO7OOrDRf1Fo3J7sOtVKC+GzwfTA:0grHk97Xbi37No3JsOtVaGzP
TLSH
T19373F9A3D6E8B1FB1B9037CB2C0B795B56E50199F34606CCECEAC91C81DD754123A6AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 1c12ff346a1f5744b680c9a9060d1cd867e7d0aef4262ddc5210127aa9b00459
MD5 62f70bd806c1c70830bdd72d6728e134
SHA1 af7989b6331b5afd550e683039d1d42ab8cb10e2
SHA512 c840c4c28c2ea6c6c4023212bdb5eb08724dd162af291fcad52bfae9a1fd925d873fdfd8f09f4ac46b58a1abe87f22ec48ffb83b01d32de23237666dd1fe2b22
SSDEEP 768:1yuRJKGSZUrSY6/XB7eZPu6hSZzIhL/DDdHjXH:0uRJrrh6Xc//D5Hj3
TLSH
T17F731AA396A8B1BF1B913BCB2C0BB95B57E14195E74601CDFCEDC60C80DC695123B6AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.weather_feed.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\activity-stream.weather_feed.json
Size 14B
SHA256 1bead770ec2d7afc6ec1e9d35383f40ef676591e079dece21c38db17c5c24a20
MD5 3ea4da2ce03c4204ffe9b30074d62fac
SHA1 b6b82844f7ce93098971fea6f2559b220be08e2d
SHA512 dbbbee11f26deb954124b96d0fb7748ad170d9bab095f79691c83fb1dcfe57b453cd4ffd6a367c701d86bd676d40aabde7a390ecc57e2fcbd0c545d9940a41f2
MD5 SHA1 SHA512

Submit Download

6435

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\cache2\doomed\6435
Size 52B
SHA256 35b3bfc513c672db81b0891d22f6d85b146def0af1a43678dc4c4a382ab2aa47
MD5 3cb2df74274835038f640eafcd70236f
SHA1 464368a948f422a616022faa94c6b2b217a8289a
SHA512 de07fbf038e7dc2344e2b4b3816a2f9e2016ffb2e7de87ee03ff0602146b860fce35a5fc8254e51f4f1a109efb70247128c4f675131e266e3f16e4d2bd75a050
TLSH
T1CA90040C53D5CD40F437C0310F04CDF504107D4074C1D71737D107515C710D74410110
MD5 SHA1 SHA512 TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 dbd99db2699b5f6543c44cf871460d2d1d90e173bbe4e0b4fe34bfbb3db949bb
MD5 07a425a727a49cbb42ea845c4652bcb0
SHA1 c4eb90dc5be8cd0e5eab1503a5d895d51a375b53
SHA512 517dadfc22fd7c49b762ab00bb5e6af4e08f10a8ef06264c1e22223a60e6125b06a012158ff70f3be57ca9d4d934b66a73ea7d5d409bcffd2c9c9d050bc3ba47
SSDEEP 3072:j3ltE01rAeKzJPe5sNynfwZSP7+A3XobTD:ptPCeKzJPRcfwZSPawXo7
TLSH
T196A3AFF6DBA28D3D54FFD41D6AC2853EFD22640473A73009C923632562C6FB8B679248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\addonStartup.json.lz4
Size 5KB
SHA256 c4a6e36f18384a5103ace435516b1369af7661d6b565cd832ea84d5ff8099c26
MD5 6535cb47d1e98e858ab6f455cc4418ca
SHA1 7515d89cf81ba87127d0567df8649f0aaf17a978
SHA512 07cbf1e26b0dcae908f6747807cafa7bd9b4b37a8a56fb1d6ee8a60372bb12578bc0f54efa2dda14f9ea8bfb2423117810bbfe0d1357206559c36f61efc2d87f
SSDEEP 96:lU55sWNNd2xWNhD4fMgGvmH6M++PHsyRdQHg4zB2k9N1bU8RXBYjjxyaY:lW2xohD4rGvmaM8yqVcMM8R6saY
TLSH
T188C18CB9DC88FE15BF76944EB8DABB32C6F91E3411D98821B4ADB3014D90AF11345390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 324b950ec5356b3c3ba0670e7041a01ca61f6822e6e79f6dfe1fff94860499c3
MD5 6b0dc9c4b48eb0f8dae38d35ac3a639b
SHA1 e3a245cb22a61ad3d1c35c03b5c39837d66dc0af
SHA512 c35fa36866995aa5a7d748514c9875c3925710ea0637bd50da1fc486f82c4d79181d4c916c383b8866402af8b291eada74adb84c4fe7802f1482ad8c17fe8610
SSDEEP 192:dOv5zboPuZoCyj/+P1d66JozGzgCl6mc0dz:SbomZoCyj6d66JozGzgC1jd
TLSH
T1A7E10EA8EA29863FC004037BDCA61F410F39389ADC5E2F29759C641C2D563DD7A8E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 fc4580bda66c9955b86b2d6990f794e3161951e5440c2fba56e57d28ac83b1fc
MD5 e81233971864fce5bd412dee671b92f3
SHA1 5c854e2671eb3ea8d17b6acb8cf90f7c507108be
SHA512 2ff61716b43010198ecc7cf50b24537593b752323313c97cf06c0f57373840d19232611ddc1a798a5fe6aa83cefe545b63261d6ec6496e11f4f220702e46699e
SSDEEP 192:A1d66JozGzgCl6mc0dnOv5zboPzoCyj/+o:6d66JozGzgC1j+boroCyjh
TLSH
T14BF11FA4EA29863FC008027BDCA61B410F35789ADC5E2F29759C641C2D573DD7A8E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 ad48934d53e2b059fe6875647c5d874f7551593b7d3dd9e1cf885f6616666ff5
MD5 b59534591cf87ef1def34ceb8f1a5b1d
SHA1 74da19a72937bd4c6060e10f749a284a7221fbf8
SHA512 e1be9ea0199450c727f6d06b96fe09ce98817ddb2a55fd1ab8f2369446032062a270e11aecdab42dfea727776d9ac45c3c7bc3a707858a02ef1cf4b6ace49970
SSDEEP 192:l1d66JozGzgCl6mc0dfOv5zbowboCyj/+o:jd66JozGzgC1jmbowboCyjh
TLSH
T14CD10DA4EA28863FC044033BCCA61F414F35389BEC5E3F29359D651C2D5A2AD7A8D1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 34e9812cb9c8e9b29a17053185cc085a900f81ef325509af39952a62333598f2
MD5 ad305273c54e62e26fc30dd351c71bd7
SHA1 462ddacc479461d49501daa1f5ef48c3ab4a1096
SHA512 10e4c38f00c66efb6e21a3ad5cdc630e1924181e0baa700bc556076e9510c30d73184a0312d4d98b74ea5d718b7bd99c620154d05f9606af16fb073dca3b54d5
SSDEEP 192:l1d66JozGzgCl6mc0dnOv5zboPzoCyj/+o:jd66JozGzgC1j+boroCyjh
TLSH
T124E110A4EA29863FC004037BDCA61B414F39389ADC5E2F29759C641C2D573DD7A8E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\events\events
Size 1KB
SHA256 1f2baa5a1c2dca73b32e762e416d84c0d113e68bd8f403e7519ac2f477f94056
MD5 d46f360f053c33f38af00785d21d8eef
SHA1 62432c4d84e058864b70fa204ea1720d76a3d201
SHA512 fdb962f354f62de1b361b182eef0d2bb6cb244db61e5cd50286d0dd8bc41fa42d3c54d8cb2eae2836add68f926292bbda8ecb85b9af4686cb67bf374bc9f40a2
TLSH
T1AF213A5C3DB84D6AA987F69D7881028E93518E4A4C871D4B4D52DF8CCD81ADD32AE53C
MD5 SHA1 SHA512 TLSH

Submit Download

6ce051a7-44b8-4f07-8f1b-73d17e878a34

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\pending_pings\6ce051a7-44b8-4f07-8f1b-73d17e878a34
Size 235B
SHA256 25b0532d0f53e646f74982afccf4f71922451c650970dad7d9cbcccda0146841
MD5 b99924d913bfac1f2609316540eebbd4
SHA1 3ebd25804a4de8f5231e32c538af1eaeb1aab9fe
SHA512 a82b001b04596489b3ae20780ae7b72f6dc363102a2d40f15a20c6bc5d59f6050c511ee6af2d2e243007a52473ab230d34e0bba559dfd7bc55baa7ec434010a2
TLSH
T193D097A42888632C88204F82F0B429C230984C3351695821D9A18138DABDDD643A2D17
MD5 SHA1 SHA512 TLSH

Submit Download

7a9ad3ff-7d56-41b7-84ce-fd5dce5501b3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\pending_pings\7a9ad3ff-7d56-41b7-84ce-fd5dce5501b3
Size 886B
SHA256 483d04359dcf179fc6a421904fde9692d88938b1dc73004f39243eeb6aac213e
MD5 638849bdc122a95641a8676dc89c62ba
SHA1 d30e726899aac38cfa5bb85a9f5f2160451b1968
SHA512 5e4ea2184d4432727fa7307ff88548bc35017fc045865d08ed6c925378095091f1a5aba3342941efe79ece0a3e406d6d02e657f5e916752e8a2e50341ff6f427
TLSH
T1A81140908921B572CCA8D24BD1F1770252F47133C0CA0C187E610A280DAAA1DA367207
MD5 SHA1 SHA512 TLSH

Submit Download

8ff01dd1-5f70-416b-9155-10e4dfd3a5bd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\pending_pings\8ff01dd1-5f70-416b-9155-10e4dfd3a5bd
Size 2KB
SHA256 9f94f6ca61ace70db6b094ae3f156b2d0d7f474c361c55ac17e2e419c9f67dc0
MD5 cd16a99b8e213ecdb298831e2c236035
SHA1 5c831092e18c3125a17bb226ddac32a7f076792b
SHA512 e582d6413295c904540e63deec4a7c4851eea8fe66b3ff94daaf04b8a3bc3a5f564adbbb1a12bb47cb49d967387391e54a446e9ae5b28bd8c2863a2130ce9b2b
TLSH
T1EA41215C79F84C7AA8C7E14E94D2234E57748E9340C618836E52EE0CCDA675E736A42B
MD5 SHA1 SHA512 TLSH

Submit Download

a1deaece-2aaa-463a-9234-0c067d994702

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\pending_pings\a1deaece-2aaa-463a-9234-0c067d994702
Size 826B
SHA256 4f5875f6e22245da9df10a022fb60a0c91e050eae59ccb0aa474914db5bfc489
MD5 f606019afb5bd7d9b0d4bf13c7955916
SHA1 cd86b43129c666ec14d36c7915d77ae7b12ca141
SHA512 fb6b08506fee55f25f247ab61d055827df7e9ffb57043cfbdcd71c540ff8686ea8355b0969fa12fc4659b6efc5d971c17a6ac5d9c35579d8a68ec41994eb55c8
TLSH
T12E01C2E14611B432ECB4D30FD661771B62A6F433C4CA41197EFD49240DFB62F852631A
MD5 SHA1 SHA512 TLSH

Submit Download

a9252396-7c95-4708-9447-d74929c6d4d6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\pending_pings\a9252396-7c95-4708-9447-d74929c6d4d6
Size 15KB
SHA256 ee19a980c118449b586425c2c49f0a01d630d3db6034d4a67fd3ab22532f337f
MD5 74bf1d91242a86f02d9433e1bb360421
SHA1 0b80039a1ba8e14916d1b6d360233eb6a84110b4
SHA512 74a2892dbe7d85aa1009235a09f594f5fa30a364b20a837e6d8e7936263dd8b63d0e0594d30b4652b723f6b5029c320f862a6b72618eb1df391a54b405e9a37b
SSDEEP 192:qnIpCVpy2/ZDDDlAt2mQ9D+mibQ1XF7Oy4BlTI0E1Bf7nwzxRicbb7jFRioj2t:B0pvN1ibhy4DTN0nwlRicbb7ZAoj4
TLSH
T13672DA562830497A9651E3A994FCBFC3E1F528CF4C418FCA9BE4BD085DDE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c3fcc42f-46b3-4d37-a708-d04dff101b2b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\pending_pings\c3fcc42f-46b3-4d37-a708-d04dff101b2b
Size 883B
SHA256 2ee2f151832d208021e23141c25b5ece3bdb4acf9de63fc169f124a9755e5683
MD5 767c1e1a1ffcf1e37124ece14c7dd59d
SHA1 7313ebff2d27a7adbd409ef6ce753c9088e2d53c
SHA512 ed792badf8e032389a513f17d6f9d975769eb43c929f28a22b01a4f3cdfbd2d23d2e8833796ac813e3abe95d4663c77d8783cdcc95304e6d95e02ce9f82bb35a
TLSH
T11D112380A972F5B2DDA8935FC5B9370263F47563C0DA48287EB149180D7EA1DA3A7247
MD5 SHA1 SHA512 TLSH

Submit Download

f1494e72-9030-4a30-bab4-f196e496a327

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\pending_pings\f1494e72-9030-4a30-bab4-f196e496a327
Size 235B
SHA256 f86a49d7adad49ac932cb6ca52d25f49c26367a009808dd13bdd1346940fb08e
MD5 74470a5d67f1f68feb9b9fafa0c54e8f
SHA1 cf81f318eb687e745e0ae3d695eef9fecdaab6ef
SHA512 9c31d9ff04ef57eb22520a03e8c8c3aabaa197d9ce8add4e3efead903f4f05770c1ff2460ec735c88a53d6899e89dd531f75112f395f4ce3465ecf684f2fbf11
TLSH
T1FED097C014F8639E28200F07F2A0AAD63259CC3B18A59810B69210788EB8AC442D28A6
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\prefs.js
Size 6KB
SHA256 cba55977a9b2b7089061a14a04f05179e4e60565b8fee3ebeb7b033d24f47a1f
MD5 72e9497d644a780476b0eda1cc927389
SHA1 f33849c39d8c7efc652e3676512c84fb0bd2694d
SHA512 397537f5059ef4220d8a2f472d6f3c4dd207829d94391a54502cdb37280f857e576b32cbb886a7965fd75d95df879a9d2f5b791648cf7f55496f49ed0fff8175
SSDEEP 96:xHlwUTUnqGqEfxTik1zSGSSlSdv9jhnHRHZlejyiBw88n8L4cnihK:0aREfxTikzSS49ZTiBw88k
TLSH
T1B1E110789408CB7F74B6766C6C6888316AB2013BBBBF68D750B554C4055CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\prefs.js
Size 6KB
SHA256 356902da19b79d10043ee05019472dc2bf5453083954ae7cb2dd1910ed889a1b
MD5 4673fc6e49cd127b8c7da3cc38ed2066
SHA1 3653805b32247886347bf41b494c2504441debd2
SHA512 070a2d89ae839f6a04c3969226d13229c9b70e5712c0560c1e293b7c34f29c4cc7a06b7d65ecfb6f464e583538cd9b8de9379b6e9c3b29a487583e9f63d4d471
SSDEEP 96:xHlwUTUnqGqEfxTik1zSbrSSlSdv9jhnHRHZlejyiBw88n8L4cnihK:0aREfxTikmrSS49ZTiBw88k
TLSH
T158E11F789408CB6F74B6776C6C6888316AB2023BB7BF68D750B554C4055CF3842F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\prefs.js
Size 6KB
SHA256 7c6a57a9eed0a9317a710661e6aad59f42847ff4b5c247241084a3466f1d5268
MD5 17f237a114bfb6908b9faa967426cc31
SHA1 c340c94d22ad25681182b060bbfe22f423bdfbce
SHA512 24c01dd521e011710f682dd1298f984b7840d6a9fc6cd278a75991de2f618f2db3e7c1608c4178f0bfda7199a1db9768b4575806ca597c73c64d72a00a6366e3
SSDEEP 96:xHlwUTUnqGqEfx7r1zSGSSlSdv9j7nHRHZlejyiBw88n8L4cnihjGS:0aREfx7rzSS29ZTiBw88L
TLSH
T144E1117894088B7F74B677AC6C6888316AB2023B7BBF68D750B554C4055CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\sessionCheckpoints.json
Size 122B
SHA256 72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
MD5 99601438ae1349b653fcd00278943f90
SHA1 8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9
SHA512 ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55
TLSH
T14DB09296895A1070CE83259D73A47B92AE3E14F676A1164471ACA98C24BB0278657883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\sessionCheckpoints.json
Size 146B
SHA256 7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d
MD5 65690c43c42921410ec8043e34f09079
SHA1 362add4dbd0c978ae222a354a4e8d35563da14b4
SHA512 c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9
TLSH
T1C9C02BC385460070CEC3229D33A07F92AE3F00FB37B10604706CA54C14770278203443
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\sessionCheckpoints.json
Size 288B
SHA256 b779351c8c6b04cf1d260c5e76fb4ecf4b74454cc6215a43ea15a223bf5bdd7e
MD5 362985746d24dbb2b166089f30cd1bb7
SHA1 6520fc33381879a120165ede6a0f8aadf9013d3b
SHA512 0e85cd132c895b3bffce653aeac0b5645e9d1200eb21e23f4e574b079821a44514c1d4b036d29a7d2ea500065c7131aef81cfc38ff1750dbb0e8e0c57fdc2a61
TLSH
T10CD08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\sessionstore.jsonlz4
Size 1KB
SHA256 7d64e215e59f791358eebb0492de5d2318ded115d974dbd459460f300a73edc8
MD5 43756708dbe509403b96ff8cb8f8c221
SHA1 de74b0c6182ca1855be803e857783ab5b5637823
SHA512 2bbf9a25411863bf82a01c63197228001fd686f9906c33f5515fd5fe40193af98b9c6143319254c770cfce7124c1a62dfe2017cab7bde0edb84111a008ead977
TLSH
T14721C683886B1DFA7FA1D126E48C8FFEF9093035895D10B0909C8A4321DE40C6B8F12E
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.1MB
SHA256 957a5a5ae37867b4c4f3ffe726588c50d3bdd2c89705ccec161601ebbe5be3e2
MD5 6b15e55181b93a55d7a8e13ab7671b1b
SHA1 33795476725969b9927d653bbcd1b905c9349471
SHA512 f78ed3c374e75b377429634b6f0da76e05c08c984755e17f54b83b3753c1d35211b11b7d441ed2bcab3a1a0591784a4e68b537bcbed55c721bebc10f6bbe499e
SSDEEP 24576:XxMyD7VRPaQRjujY8K43+3WhbrHy2gLgk+7HGplmDiuQI+1k0kqx:XxJK8KjYyagk+7imDif3k0kC
TLSH
T1E24629F820D1A257F3414033664593EF21EFD00C6027DA085BE95AE9A5B4CEF9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

targeting.snapshot.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\targeting.snapshot.json
Size 3KB
SHA256 b380a3c3bad680d94c4ba4a8ec45818b9596cfa33b9ba1212682997ee2f58604
MD5 f89241d3a977ca5a606ea22909c82e9b
SHA1 2c650f72e63ab47a3cba2bd672f29606986d63ac
SHA512 0fe0ed0407a879a284ea3f28c10a7f74a24ae55fa04900c73924a074ce20661aa219ef391ac20ee513a9013e91fc58c1255e40b7accafe1a05ba8e89f81d4b90
TLSH
T1F071930CA61CA4BEA65BC3C0D6447FA78BBD053370406458DAFE460C95FB5FB163621B
MD5 SHA1 SHA512 TLSH

Submit Download

xulstore.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\xulstore.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads