d0c711b0dc658d94fa5c8f86a62352f93ad854dce07d9850fdfe38f5123ac62f

Analysis

max time kernel
283s
max time network
282s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
07/08/2024, 13:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Rex.zip
Size

3.6MB
MD5

fae6e02202985a7866201658818ce1bf
SHA1

d61117122cb828bc865a8064b07fb63915f82775
SHA256

d0c711b0dc658d94fa5c8f86a62352f93ad854dce07d9850fdfe38f5123ac62f
SHA512

8f429e326759d15ffa1f58f05624bf4eb487936328df2cce331b7f52ded526edb8e7e00423d694707b45d0681da8b6d47e3be5cd0554884f8c169939e203f534
SSDEEP

98304:x2tc5jmwfUiPQm7KXeGLGDjk1g83+UyLK66J8txZ06c:x265Cw8Nm7KOGLg8gzDWVSxZ0h

Score

9^/10

credential_access discovery stealer

Malware Config

Signatures

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000003000000040000000200000001000000ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\TV_TopViewVersion = "0"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\9	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\0\0	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\IconSize = "16"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\11	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\SniffedFolderType = "Generic"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202020202	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\SniffedFolderType = "Generic"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\0\0\0\1	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Sort = 000000000000000000000000000000000200000030f125b7ef471a10a5f102608c9eebac0a0000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\0\0\0\MRUListEx = 0000000001000000ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202020202	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\7	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\0\0\0\1\0	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Mode = "4"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000	firefox.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2336	firefox.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeRestorePrivilege	2736	7zG.exe
Token: 35	2736	7zG.exe
Token: SeSecurityPrivilege	2736	7zG.exe
Token: SeSecurityPrivilege	2736	7zG.exe
Token: SeDebugPrivilege	2336	firefox.exe
Token: SeDebugPrivilege	2336	firefox.exe
Token: SeDebugPrivilege	2336	firefox.exe
Token: SeDebugPrivilege	2336	firefox.exe
Token: SeDebugPrivilege	2336	firefox.exe
Token: SeDebugPrivilege	2336	firefox.exe
Token: SeDebugPrivilege	2336	firefox.exe
Token: SeDebugPrivilege	2336	firefox.exe
Token: SeDebugPrivilege	2336	firefox.exe
Token: SeDebugPrivilege	2336	firefox.exe
Token: SeDebugPrivilege	2336	firefox.exe
Token: SeDebugPrivilege	2336	firefox.exe
Token: SeDebugPrivilege	2336	firefox.exe
Token: SeDebugPrivilege	2336	firefox.exe
Token: SeDebugPrivilege	2336	firefox.exe
Token: SeDebugPrivilege	2336	firefox.exe
Token: SeDebugPrivilege	2336	firefox.exe
Token: SeDebugPrivilege	2336	firefox.exe
Token: SeDebugPrivilege	2336	firefox.exe
Token: SeDebugPrivilege	2336	firefox.exe
Token: SeDebugPrivilege	2336	firefox.exe
Token: SeDebugPrivilege	2336	firefox.exe
Token: SeDebugPrivilege	2336	firefox.exe
Token: SeDebugPrivilege	2336	firefox.exe
Token: SeDebugPrivilege	2336	firefox.exe
Token: SeDebugPrivilege	2336	firefox.exe
Token: SeDebugPrivilege	2336	firefox.exe
Token: SeDebugPrivilege	2336	firefox.exe
Token: SeDebugPrivilege	2336	firefox.exe
Token: SeDebugPrivilege	2336	firefox.exe
Token: SeDebugPrivilege	2336	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2736	7zG.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe

Suspicious use of SetWindowsHookEx 44 IoCs

pid	Process
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 2336	2616	firefox.exe	37
PID 2616 wrote to memory of 2336	2616	firefox.exe	37
PID 2616 wrote to memory of 2336	2616	firefox.exe	37
PID 2616 wrote to memory of 2336	2616	firefox.exe	37
PID 2616 wrote to memory of 2336	2616	firefox.exe	37
PID 2616 wrote to memory of 2336	2616	firefox.exe	37
PID 2616 wrote to memory of 2336	2616	firefox.exe	37
PID 2616 wrote to memory of 2336	2616	firefox.exe	37
PID 2616 wrote to memory of 2336	2616	firefox.exe	37
PID 2616 wrote to memory of 2336	2616	firefox.exe	37
PID 2616 wrote to memory of 2336	2616	firefox.exe	37
PID 2616 wrote to memory of 2336	2616	firefox.exe	37
PID 2336 wrote to memory of 2620	2336	firefox.exe	38
PID 2336 wrote to memory of 2620	2336	firefox.exe	38
PID 2336 wrote to memory of 2620	2336	firefox.exe	38
PID 2336 wrote to memory of 2744	2336	firefox.exe	39
PID 2336 wrote to memory of 2744	2336	firefox.exe	39
PID 2336 wrote to memory of 2744	2336	firefox.exe	39
PID 2336 wrote to memory of 2744	2336	firefox.exe	39
PID 2336 wrote to memory of 2744	2336	firefox.exe	39
PID 2336 wrote to memory of 2744	2336	firefox.exe	39
PID 2336 wrote to memory of 2744	2336	firefox.exe	39
PID 2336 wrote to memory of 2744	2336	firefox.exe	39
PID 2336 wrote to memory of 2744	2336	firefox.exe	39
PID 2336 wrote to memory of 2744	2336	firefox.exe	39
PID 2336 wrote to memory of 2744	2336	firefox.exe	39
PID 2336 wrote to memory of 2744	2336	firefox.exe	39
PID 2336 wrote to memory of 2744	2336	firefox.exe	39
PID 2336 wrote to memory of 2744	2336	firefox.exe	39
PID 2336 wrote to memory of 2744	2336	firefox.exe	39
PID 2336 wrote to memory of 2744	2336	firefox.exe	39
PID 2336 wrote to memory of 2744	2336	firefox.exe	39
PID 2336 wrote to memory of 2744	2336	firefox.exe	39
PID 2336 wrote to memory of 2744	2336	firefox.exe	39
PID 2336 wrote to memory of 2744	2336	firefox.exe	39
PID 2336 wrote to memory of 2744	2336	firefox.exe	39
PID 2336 wrote to memory of 2744	2336	firefox.exe	39
PID 2336 wrote to memory of 2744	2336	firefox.exe	39
PID 2336 wrote to memory of 2744	2336	firefox.exe	39
PID 2336 wrote to memory of 2744	2336	firefox.exe	39
PID 2336 wrote to memory of 2744	2336	firefox.exe	39
PID 2336 wrote to memory of 2744	2336	firefox.exe	39
PID 2336 wrote to memory of 2744	2336	firefox.exe	39
PID 2336 wrote to memory of 2744	2336	firefox.exe	39
PID 2336 wrote to memory of 2744	2336	firefox.exe	39
PID 2336 wrote to memory of 2744	2336	firefox.exe	39
PID 2336 wrote to memory of 2744	2336	firefox.exe	39
PID 2336 wrote to memory of 2744	2336	firefox.exe	39
PID 2336 wrote to memory of 2744	2336	firefox.exe	39
PID 2336 wrote to memory of 2744	2336	firefox.exe	39
PID 2336 wrote to memory of 2744	2336	firefox.exe	39
PID 2336 wrote to memory of 2744	2336	firefox.exe	39
PID 2336 wrote to memory of 2744	2336	firefox.exe	39
PID 2336 wrote to memory of 2744	2336	firefox.exe	39
PID 2336 wrote to memory of 2744	2336	firefox.exe	39
PID 2336 wrote to memory of 2744	2336	firefox.exe	39
PID 2336 wrote to memory of 2744	2336	firefox.exe	39
PID 2336 wrote to memory of 2744	2336	firefox.exe	39
PID 2336 wrote to memory of 2744	2336	firefox.exe	39
PID 2336 wrote to memory of 1752	2336	firefox.exe	40
PID 2336 wrote to memory of 1752	2336	firefox.exe	40
PID 2336 wrote to memory of 1752	2336	firefox.exe	40
PID 2336 wrote to memory of 1752	2336	firefox.exe	40
PID 2336 wrote to memory of 1752	2336	firefox.exe	40

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Rex.zip
1⤵
PID:3032

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2756

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\Rex\" -spe -an -ai#7zMap6805:86:7zEvent2853
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2736

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2336.0.496638869\1673895893" -parentBuildID 20221007134813 -prefsHandle 1212 -prefMapHandle 1100 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0174f907-93a2-4a35-bc23-f596435a2755} 2336 "\\.\pipe\gecko-crash-server-pipe.2336" 1288 b2cee58 gpu
    3⤵
    PID:2620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2336.1.2071645422\1800619245" -parentBuildID 20221007134813 -prefsHandle 1532 -prefMapHandle 1528 -prefsLen 20928 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2bc3f5da-d908-45f8-88ca-7d1503743b80} 2336 "\\.\pipe\gecko-crash-server-pipe.2336" 1544 a03eb58 socket
    3⤵
    PID:2744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2336.2.1354356253\1367138466" -childID 1 -isForBrowser -prefsHandle 2328 -prefMapHandle 2324 -prefsLen 20966 -prefMapSize 233444 -jsInitHandle 688 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {72a4cb93-d94a-4251-b08b-bb769130de86} 2336 "\\.\pipe\gecko-crash-server-pipe.2336" 2340 1927b558 tab
    3⤵
    PID:1752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2336.3.1791933751\187272255" -childID 2 -isForBrowser -prefsHandle 1804 -prefMapHandle 2152 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 688 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {04d5a533-b28a-47af-9ebf-5948f782f72e} 2336 "\\.\pipe\gecko-crash-server-pipe.2336" 2256 d62858 tab
    3⤵
    PID:1748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2336.4.1750756868\296352065" -childID 3 -isForBrowser -prefsHandle 2840 -prefMapHandle 2836 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 688 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a6be1cd-a19a-4891-8d0e-4cf0927aec64} 2336 "\\.\pipe\gecko-crash-server-pipe.2336" 2868 1c634458 tab
    3⤵
    PID:1588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2336.5.1021742420\260386978" -childID 4 -isForBrowser -prefsHandle 3832 -prefMapHandle 3828 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 688 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4399c782-7467-468a-b6cf-5d5a8ead0879} 2336 "\\.\pipe\gecko-crash-server-pipe.2336" 3844 1d87e458 tab
    3⤵
    PID:668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2336.6.974408769\1179662149" -childID 5 -isForBrowser -prefsHandle 3956 -prefMapHandle 3960 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 688 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e00d594-4e07-44e4-bf6c-58a79d0a91f4} 2336 "\\.\pipe\gecko-crash-server-pipe.2336" 3944 1d880258 tab
    3⤵
    PID:2056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2336.7.244261411\1147199292" -childID 6 -isForBrowser -prefsHandle 4136 -prefMapHandle 4140 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 688 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1d00f23b-520b-4bcc-bc3d-126e5342398b} 2336 "\\.\pipe\gecko-crash-server-pipe.2336" 4124 1d87f058 tab
    3⤵
    PID:2788
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2336.8.721667889\1959397236" -childID 7 -isForBrowser -prefsHandle 5380 -prefMapHandle 5384 -prefsLen 27140 -prefMapSize 233444 -jsInitHandle 688 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {054ea91c-d3ea-473a-9750-45382c89fcf9} 2336 "\\.\pipe\gecko-crash-server-pipe.2336" 5368 2a2a6058 tab
    3⤵
    PID:3196
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2336.9.1691239574\1222571770" -parentBuildID 20221007134813 -prefsHandle 1672 -prefMapHandle 940 -prefsLen 27315 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c36a288e-5b01-4262-9f9a-3545aed7e005} 2336 "\\.\pipe\gecko-crash-server-pipe.2336" 4828 2c07d458 rdd
    3⤵
    PID:2616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2336.10.899800277\1523344553" -childID 8 -isForBrowser -prefsHandle 5708 -prefMapHandle 5724 -prefsLen 27315 -prefMapSize 233444 -jsInitHandle 688 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2dc35896-780e-4b61-81a4-593bd4f9a39f} 2336 "\\.\pipe\gecko-crash-server-pipe.2336" 5736 2c1ab258 tab
    3⤵
    PID:1676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\sexvjvzg.default-release\activity-stream.discovery_stream.json.tmp

Filesize
26KB

MD5
df43f9c86e919a6a1a6f465817567a0f

SHA1
29f6c383c163551fded46a8e0b925e5d1bf746c1

SHA256
3e74e9009922f9b2921a472f8dba920fbd8b923e83ec7ed4cc06afcc96e53146

SHA512
70b91d40a527887b069660728abdae3ec467e22d190e3d7cf2d23f1aec85fa73d888302f5fd8163715d5ec165bf1ce8e74dbd711667722268c412561916d72b1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\sexvjvzg.default-release\cache2\doomed\16133

Filesize
11KB

MD5
d881ef64512226325777407d0b534dab

SHA1
9a1a578e524b064d3b5d10c76e172a6778ad8ca9

SHA256
45840fbe802b2dcb8f08565460808d0cf0bd7cd9e1a5abfe320b7a1b8a54c0ce

SHA512
bdfe5d9363c9fe5289b8dce191d0308ec232f8d45c5811fa1af3253b2b824098718e5f1d766476c80896dbf92b4a5bed88e2b9056f5e7104b752596933322b5a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\sexvjvzg.default-release\cache2\doomed\5022

Filesize
12KB

MD5
e22545753e272e2a32d116341f1154dc

SHA1
9f32180ae9481ef9c274be07d2a6b1347b0a7dd3

SHA256
7eff46e5de529ff89492669261d5b743c66ce17dea8d54d04040e86cb732ece6

SHA512
12a3b45399b1b5769ec7a21964e231b049e96d12792aa95d9263ea21e767476d4ca956217a4f67bed2f1c2e4cac35a370ed81e8957237ea34038c3cb6fd6d3a6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\sexvjvzg.default-release\cache2\doomed\5560

Filesize
10KB

MD5
ffb61003277f9a2f1cdf67ee6a4ae4d6

SHA1
3670a1ef3e72cf6bea7c491ff7daaedeca75cfa0

SHA256
536f5fb39ed42122204543af524e500563cfe71b58dba53caece74f29a57d157

SHA512
dbc4041d5592c794f2f858c972241dc7c8debe745c503dcf3b90895f88457871ca95b3c1ea267809c8cb6c129a99f177b1fa35ec81082b9eaf4d9ac186d1dd10

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\sexvjvzg.default-release\cache2\doomed\7715

Filesize
11KB

MD5
18305d3563e7f2f53e1d959952569a28

SHA1
b45f13bd2e5b87a534db08d7953eb7f7e9b76fea

SHA256
4d49dd2c984da81d902ea61bf5b72c33ebafb7304d46377bc4042b2dbd2bfa55

SHA512
7ff575fc1c4ed63b117ab8fbfc5134bf69d6a1ff4fefeacb9032095741ae5ab79ad23786b30ec912b6975acc13b9fd170e66d97fac9b134634aefefbc079a5f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rex\_locales\en_PH\messages.json

Filesize
4KB

MD5
94a75b93caacabd05bf1a0987a14afae

SHA1
7a0606f4c9c8a8937dda955f9e2df6aae3c1da75

SHA256
21706c41c93af0d4b8d23c822e43c5b7d7011c9f4ed5048a5aecf12a0f785ac5

SHA512
103973cc303bd12d422ca329f9770eecdf5253bdd836aca681f9ef3f9818959a157621e7a61fbcdef8aa9e0caa67085ccf4c75379b1f67da0034a276a9a00a52

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rex\_locales\es_US\messages.json

Filesize
4KB

MD5
dda454c66f68e8ae133b96078358b00a

SHA1
68a61271b24db6844776e56d19e256479252679f

SHA256
8ec49f381698bf428b7ea8f49fc6208479af3451d09a1223d4d24f93483c4438

SHA512
6d45a90ca2dea977007cc729ae580f44895bb32443aeb40ed2949b8a754cfaa1309484eb86a42a24bbdd9c53afd1e0517c5b55e8648d2dc3f3d81bdb1c1a0d07

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rex\_locales\no\messages.json

Filesize
4KB

MD5
bd4c63bd77cf9e9d71a6879c935cc566

SHA1
ba9dec87c2a1dcdfc3b778eecea20baa97432927

SHA256
5013bd334055df78a365532496d3c1eb1e26315bb552f79d2bf6f37f9b836431

SHA512
385b14b22cd791f64d7adf1955f0ed05f6dfcb85b5821ab3dd4dd1d0525952bc82bed72739bb4b40d5883205b48e4d6d28e507a42b84663d73b20da5790bca47

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rex\_locales\pt_PT\messages.json

Filesize
4KB

MD5
d0b1e7acc802bba89e15c735c81e0f02

SHA1
9ddbe137afe5640aacde424bc93e994523bd0b22

SHA256
4b1f62dc79f3f1307bd916efcae0204b69f46734ceef420d46aeee469c24793a

SHA512
1e9629c0f0e52535b0d93097afe1fb49c8fc9b700b295575f1c31ae227b99a2269bda4e10489dcc5b93cf00d9a5c7b0045647b1d1fe73c30d755ddbf8f0d48fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rex\_locales\zh_Hans\messages.json

Filesize
4KB

MD5
671be8f15414f65774a8ddbe668a8d18

SHA1
bc84bb42cd2f63d99573fb91575361481d90c71c

SHA256
d158d4efddf442b65311bf433aa5449627225ab7632f519589879f355fa883a3

SHA512
4102268aa07d374aa272d5a4fdab90d4b35febc360fd1905167b3e1653de490166a0611ef1af8023548ae9761a2b597978394c2e93a27e029d4c6b04e6e7bf47

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sexvjvzg.default-release\datareporting\glean\db\data.safe.bin

Filesize
5KB

MD5
4af1850730fcf0f86cb386dae600457d

SHA1
a3c01be58c7a08b38121981c287c515e428c6e7a

SHA256
115727b8daccd8100acaf52fe19210b096e676417b0b2b2e470622738ee50b32

SHA512
8ebcc04f8953e65182e4459e33e27e7ba5607931d552fce2cda922eb5bc1cb2534b947556156da541ca23c3e38a6cff5bdfdd06fa38a21472ab7d5aceb2ceeef

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sexvjvzg.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
4fe1698db16fb180b366ba5e06801e40

SHA1
ab95d05b60634847706c4aae847592fceb06dd24

SHA256
b99a4e0b46ed06767683e4826bcf042f63186e1ac8fd4a640bb6159e20200bc5

SHA512
79e898af9e43450cae3563ede30b5460a814817bc3b51698f7e5ffacf22e28d3e848ac405ee38d042817599f896e87358b57cbdadd7886190a21b8436a01928c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sexvjvzg.default-release\datareporting\glean\pending_pings\3fb305b0-320d-45d3-9631-5f4975ff22a3

Filesize
12KB

MD5
3bd7efad9d317154659c91bfca25ce8c

SHA1
5dc19b861846ce46e2a0cac17e230a4d8957f7f0

SHA256
c6610a909d8645904b8ca4fe5d6d4497405a76ecb644edc335d10b997435ac4f

SHA512
ae78ec57f3dbcf0d89c85a2d76dd76509a81aae396da763e9aa5d5cd3822ddfd1c507cb21eaaa2cfae90eb553b1603380ffde925a21a79523a41dc21d9188c32

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sexvjvzg.default-release\datareporting\glean\pending_pings\7a0b9718-77e9-4f51-b0b7-d978d3e93755

Filesize
935B

MD5
a522b64ddda08f709167053d95cc2131

SHA1
9e31b6a57e4b38401bd942a386556f4c850f3a1b

SHA256
eb89bc7596051ff0972c36eefc6c194cda2166518ef0f50220c4a0d0b78e052a

SHA512
31f2125d99b63f196de177782c8c6e5640f6cacf6b73d897a49af70bc0404874b76308be7fba77330e65d6bc0099bb00feeae00a8dec75d43bc184612240c230

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sexvjvzg.default-release\datareporting\glean\pending_pings\a1e25c25-75d9-44eb-8f50-b8636b698407

Filesize
854B

MD5
f786e44076e7b6c3e888f19a9e6b1aaf

SHA1
e1c8c83a80f9d53f2ae97b9f54af92c1f54b3c24

SHA256
689639b192e519ab259279f3516f755ae285ec58180460653ea6fa426f3a1f96

SHA512
32a4d736c0021de4085b45fd754a212b1fcd4c69f6b6048458186ab1484a05e7be65b6493b9bfba719f24341cf4f3913e445d75e827d1f670da5c9a4dddeeee6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sexvjvzg.default-release\datareporting\glean\pending_pings\fe62b0a6-3ce0-40d7-8939-205182079067

Filesize
745B

MD5
ef62194177c1313f7a1353c616ba0fd0

SHA1
16a5fec7e32a6e5c074c98090cae79cbc7f10c78

SHA256
7248a6b9f461e8d3f9fda04a303346d910f8b877b474b3c6d4436ba677723113

SHA512
7eaa734eb619e7f8590e42219b830ae8b6165578ddb396cbd885adb76b63c826dd7e26d85e7ad9a3bd49888fb0be07570367a3735bf8ceb18e362811b1c7b885

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sexvjvzg.default-release\extensions\{440a538a-e2a4-4fba-9f11-8cda0713a049}.xpi

Filesize
3.6MB

MD5
fae6e02202985a7866201658818ce1bf

SHA1
d61117122cb828bc865a8064b07fb63915f82775

SHA256
d0c711b0dc658d94fa5c8f86a62352f93ad854dce07d9850fdfe38f5123ac62f

SHA512
8f429e326759d15ffa1f58f05624bf4eb487936328df2cce331b7f52ded526edb8e7e00423d694707b45d0681da8b6d47e3be5cd0554884f8c169939e203f534

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sexvjvzg.default-release\logins-backup.json

Filesize
615B

MD5
3e3e95ce16de16d6c722654db7ecb0fa

SHA1
6712071dba3f7d2a4ea3235cae3155d27e32ea3e

SHA256
17b187fefd4658af153a0ecee7ded6cedf1cce75dcd3223d3494b260ac30a0ba

SHA512
b32ff9d1686a6441e195b007413ad067f67b3fe032965282d5aa1188b45fcb8a573c18e90a37e43de6de751edd93ea8efb712e6f555808828ad5b58360299c6c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sexvjvzg.default-release\prefs-1.js

Filesize
6KB

MD5
5e55c8e4d8a252719f72a4537ec07723

SHA1
c1412fd63ef498ef373b132d6a09d3aba84cd135

SHA256
a4f07e0f50b4cf2870177b3eda3fe2aef38aa514789198f2f03aa178081a13d2

SHA512
8dfd2f0bbbf768b5fc6222c6452b190d70ef3357915f29be498a1b6ecd7c59103982bb10c9de08c2ef751f096b7adc013c3413cb26447fc30dbf576186765a79

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sexvjvzg.default-release\prefs-1.js

Filesize
7KB

MD5
f4832d4804a3e5e41917ebdd2a58b2c1

SHA1
e0c3c0bff429e48b8e1661967bc2ed8a1c15d79f

SHA256
04262175f5e74e63d51a5aa55645a3964e85d14b01495e35cf9e6c1995ffbfc8

SHA512
6771762520076b61f328eabb011d2f8b017d5f7a102200a18b9cf0aa1247d2ca7f26be0507954e2e6b41d861becf4f91e3a3ac8be0f8f659af2215d02eb93b78

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sexvjvzg.default-release\prefs-1.js

Filesize
6KB

MD5
0eb5a9f202654d388616f539c6c71675

SHA1
fd32c35c109f6b2335e625c03cfe4085f9529b11

SHA256
502053709f9a7e77561290761e4bc346bdb99415e46e890346c10a5f1cb2ab05

SHA512
23c8a8f8a769ee1c53a2fef97ac20d1b3ad30f196a6c5a25f2cdb7de3bfc2e2dcb1a1e384d08205fba64069a6c5c96da5d68aaf2a95f83cfc8a23e2e6f90a006

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sexvjvzg.default-release\prefs-1.js

Filesize
6KB

MD5
4b66c795b3225b493e46af7a6b14183d

SHA1
e92c6add02b178a476908512a08075f5f4fb2d98

SHA256
7bd070b53bd8a227847c9ad59f3ba0869dfa962aa6875e7b3914e29c038aeb92

SHA512
cc6523c96eeba24941727fb87dc6ead430272cbaa314f0e2c464fd48b98a17971d243124d13cb4174b81b0f0080f138fbf76a52eff7e46a6f4f36951d70f3de3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sexvjvzg.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
3bd6ba1c59e30908e0d06e2dd6ccc965

SHA1
d401656f032d1a84fc0a0926d8fdc939f44464ad

SHA256
d6d70a8e177e59ff7025cc5eb3ee81af3ed087b4c80f335c49cbb65ed6e8d522

SHA512
e2df9b07384fe13052b4288aef00503401f119e279962b65b747c6a873e52edcdac4ca379b5343d64a8d2d43f11c2cde24ae985e4a6748d098e427d078180309

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sexvjvzg.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
863b379c1e62940da4061f5c495fc750

SHA1
0e68d29de40ec33ec626ba1d70221e4e35449b9d

SHA256
657a894828141dd293c391a2c2ba4269257ba545450966aa377186421e864e7c

SHA512
8d520c89f971bb49e40b5b090ebbc799b6368eaeaac572cc3d9cab881673997fb706b3c1e82fc0a6e805f9328b2a716311b1be8d006816be864f460a183c8190

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sexvjvzg.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
9bf1d0f0da7bc56d585227c2c4f36a71

SHA1
2f8fb9c38051dea3848f37c599335cd8b42bb3a1

SHA256
c705cdd608ec20ac470dfbb2da1520e3490906c17a10f0c34b18bb2e8ad0f49f

SHA512
2e0400604487cdd37ce5e71a3a3cfb535faf0dbd1069067f132fd52714ec4d1374c07c0780164a5c4bbfa4badf467fd767301f0d9f681f6e0559124cafb87d23

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sexvjvzg.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
4d37efa830f9adddd86dd2b94d9f0416

SHA1
993894c1aefc1e7bde99e3f8014a2049a8ee36b4

SHA256
74047c4055abbdabbb8acf8dc294daba2be831614fffd9225aa0e678400c77b4

SHA512
4ca08e7c18f51fd1161ab5dae223b1f16cf23b0d8445bbbb7d6e4d00625bf8560cfb18bfd336c5a647f7ea593c8fc1fe6261deaefd13d5a0e115fabb1f8ba3dc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sexvjvzg.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
2bf61d6505e6dc244eb7918b41b2fa73

SHA1
a49b8cf277b982d2d132268bd5d1618c700aee4c

SHA256
c413d8e4731365137e027133606c505ac33fa3ba2ac94d14c721b74184304b1c

SHA512
6a8cb8d8a66072c2177b8a24989cc8801bfcab30b77aeb2b7669c1fb52a19f3bdcf2858997e6a57d4965c4319c2c38d2474557c669e008a98d75d7b615588f6e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sexvjvzg.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
f306bd103ac4105e14e8de71ca2af897

SHA1
96990a3db45820eb71deb34292e9544c87987c5a

SHA256
3fb5874809b679489fed0df361cd21663bb80dbc7ab4aed29a8a6d4beabf7422

SHA512
3088a1740f5705e07d6659221a3395f774a6ee156e5fa9f3b6f528e3c60953911e27439cbfc918769c9b5b6178694c7405b57e1d9a736f0632b8bb08cfce4480

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sexvjvzg.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
a389488a64107abd8d3a80414d5776da

SHA1
d2f2407e887dca38c14bca305b99f14726705ead

SHA256
c7b473b5f4d273cf375f7c4ddd6dde9ca1320a349bc1f46811ff05d214ed2176

SHA512
b8d398de4c73def0c2af6b2c5d8ae49aa9348c1de8e5e94709463143fa82a32956d76560e3336cc171ac6449078373eed5970f52a8894a4eb45d92e478bf3676

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sexvjvzg.default-release\storage\default\https+++www.roblox.com\idb\3140325527hBbDa.sqlite

Filesize
48KB

MD5
1613159a74676e3fac10346f1c844afd

SHA1
8d4a25beab0ac99b5c365b3171b584e559d02f0a

SHA256
1da3186b71471109e84b6f7edd131f87890e7da526ebb2eb91b9b8d9fbe46aee

SHA512
6fa8a86183f18b574b43e68ce8a1dbddd07bd25e5f7e8572bf794b481465b67d6b7f78a608e52593d74d7165604888496ff4e248ef169235995bfff0ea44c379

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sexvjvzg.default-release\storage\default\https+++www.roblox.com\ls\usage

Filesize
12B

MD5
80e65134049779477df306ea0f3fc532

SHA1
894c2a5db6074cfd015590b17e620930410e11b4

SHA256
788f6a3ed9224f05cf8b7d9a78c1291d2155c538cff0ec121376707210525c97

SHA512
f228270c1e34d94733fd6537231c3a7bcaf227f622f73d54e83f41e764c2488415b53d66bd76c8fd9accc9ee01ba0a66d906759452e053b60a93eaed3613a80c

Download Submit