6acaae0fb470790102a338e23dfe2263f31e529288e4efe51b34bca30371cb36

Analysis

max time kernel
154s
max time network
203s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
11-08-2024 23:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MonkeModManager.exe
Size

217KB
MD5

1d62aa3d19462f3d5575fc54159911b4
SHA1

b37eab86c0075245fcc517a280f0705f6dffb852
SHA256

6acaae0fb470790102a338e23dfe2263f31e529288e4efe51b34bca30371cb36
SHA512

78a9501d7920920577a586396e5d9e2278a7c926448c9a98d7844db9032dbd887df90d2f389fe1754bf5a2071a19dfd5d40315624923e903ef9ef6cbb214b1df
SSDEEP

3072:V9UmbMwyLMmJx+WAE090AF23P88RiiE090HjD:Kxs/E09hWPTE09yD

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies registry class 35 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	MonkeModManager.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	MonkeModManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	MonkeModManager.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	MonkeModManager.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	MonkeModManager.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	MonkeModManager.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	MonkeModManager.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	MonkeModManager.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	MonkeModManager.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	MonkeModManager.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	MonkeModManager.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	MonkeModManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	MonkeModManager.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	MonkeModManager.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	MonkeModManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	MonkeModManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	MonkeModManager.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	MonkeModManager.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	MonkeModManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	MonkeModManager.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	MonkeModManager.exe
Key created	\Registry\User\S-1-5-21-131918955-2378418313-883382443-1000_Classes\NotificationData	MonkeModManager.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	MonkeModManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	MonkeModManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	MonkeModManager.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings	MonkeModManager.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	MonkeModManager.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	MonkeModManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	MonkeModManager.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	MonkeModManager.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	MonkeModManager.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	MonkeModManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	MonkeModManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	MonkeModManager.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4232	MonkeModManager.exe
Token: SeDebugPrivilege	5488	firefox.exe
Token: SeDebugPrivilege	5488	firefox.exe
Token: SeDebugPrivilege	5488	firefox.exe
Token: SeDebugPrivilege	5488	firefox.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
4232	MonkeModManager.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 5488	2104	firefox.exe	91
PID 2104 wrote to memory of 5488	2104	firefox.exe	91
PID 2104 wrote to memory of 5488	2104	firefox.exe	91
PID 2104 wrote to memory of 5488	2104	firefox.exe	91
PID 2104 wrote to memory of 5488	2104	firefox.exe	91
PID 2104 wrote to memory of 5488	2104	firefox.exe	91
PID 2104 wrote to memory of 5488	2104	firefox.exe	91
PID 2104 wrote to memory of 5488	2104	firefox.exe	91
PID 2104 wrote to memory of 5488	2104	firefox.exe	91
PID 2104 wrote to memory of 5488	2104	firefox.exe	91
PID 2104 wrote to memory of 5488	2104	firefox.exe	91
PID 5488 wrote to memory of 1072	5488	firefox.exe	92
PID 5488 wrote to memory of 1072	5488	firefox.exe	92
PID 5488 wrote to memory of 1072	5488	firefox.exe	92
PID 5488 wrote to memory of 1072	5488	firefox.exe	92
PID 5488 wrote to memory of 1072	5488	firefox.exe	92
PID 5488 wrote to memory of 1072	5488	firefox.exe	92
PID 5488 wrote to memory of 1072	5488	firefox.exe	92
PID 5488 wrote to memory of 1072	5488	firefox.exe	92
PID 5488 wrote to memory of 1072	5488	firefox.exe	92
PID 5488 wrote to memory of 1072	5488	firefox.exe	92
PID 5488 wrote to memory of 1072	5488	firefox.exe	92
PID 5488 wrote to memory of 1072	5488	firefox.exe	92
PID 5488 wrote to memory of 1072	5488	firefox.exe	92
PID 5488 wrote to memory of 1072	5488	firefox.exe	92
PID 5488 wrote to memory of 1072	5488	firefox.exe	92
PID 5488 wrote to memory of 1072	5488	firefox.exe	92
PID 5488 wrote to memory of 1072	5488	firefox.exe	92
PID 5488 wrote to memory of 1072	5488	firefox.exe	92
PID 5488 wrote to memory of 1072	5488	firefox.exe	92
PID 5488 wrote to memory of 1072	5488	firefox.exe	92
PID 5488 wrote to memory of 1072	5488	firefox.exe	92
PID 5488 wrote to memory of 1072	5488	firefox.exe	92
PID 5488 wrote to memory of 1072	5488	firefox.exe	92
PID 5488 wrote to memory of 1072	5488	firefox.exe	92
PID 5488 wrote to memory of 1072	5488	firefox.exe	92
PID 5488 wrote to memory of 1072	5488	firefox.exe	92
PID 5488 wrote to memory of 1072	5488	firefox.exe	92
PID 5488 wrote to memory of 1072	5488	firefox.exe	92
PID 5488 wrote to memory of 1072	5488	firefox.exe	92
PID 5488 wrote to memory of 1072	5488	firefox.exe	92
PID 5488 wrote to memory of 1072	5488	firefox.exe	92
PID 5488 wrote to memory of 1072	5488	firefox.exe	92
PID 5488 wrote to memory of 1072	5488	firefox.exe	92
PID 5488 wrote to memory of 1072	5488	firefox.exe	92
PID 5488 wrote to memory of 1072	5488	firefox.exe	92
PID 5488 wrote to memory of 1072	5488	firefox.exe	92
PID 5488 wrote to memory of 1072	5488	firefox.exe	92
PID 5488 wrote to memory of 1072	5488	firefox.exe	92
PID 5488 wrote to memory of 1072	5488	firefox.exe	92
PID 5488 wrote to memory of 1072	5488	firefox.exe	92
PID 5488 wrote to memory of 1072	5488	firefox.exe	92
PID 5488 wrote to memory of 1072	5488	firefox.exe	92
PID 5488 wrote to memory of 1072	5488	firefox.exe	92
PID 5488 wrote to memory of 1072	5488	firefox.exe	92
PID 5488 wrote to memory of 1072	5488	firefox.exe	92
PID 2668 wrote to memory of 560	2668	firefox.exe	94
PID 2668 wrote to memory of 560	2668	firefox.exe	94
PID 2668 wrote to memory of 560	2668	firefox.exe	94
PID 2668 wrote to memory of 560	2668	firefox.exe	94
PID 2668 wrote to memory of 560	2668	firefox.exe	94
PID 2668 wrote to memory of 560	2668	firefox.exe	94
PID 2668 wrote to memory of 560	2668	firefox.exe	94
PID 2668 wrote to memory of 560	2668	firefox.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\MonkeModManager.exe
"C:\Users\Admin\AppData\Local\Temp\MonkeModManager.exe"
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4232

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1980 -parentBuildID 20240401114208 -prefsHandle 1896 -prefMapHandle 1888 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e66e2903-8c05-4a43-a88f-f2f346f25fb2} 5488 "\\.\pipe\gecko-crash-server-pipe.5488" gpu
    3⤵
    PID:1072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2380 -parentBuildID 20240401114208 -prefsHandle 2372 -prefMapHandle 2368 -prefsLen 23714 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1da97c73-aea8-4f6d-8671-063ca706c6bc} 5488 "\\.\pipe\gecko-crash-server-pipe.5488" socket
    3⤵
    - Checks processor information in registry
    PID:4804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3180 -childID 1 -isForBrowser -prefsHandle 3136 -prefMapHandle 3232 -prefsLen 23855 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ffb0950-3af8-4fe7-9fd8-16484dcbf187} 5488 "\\.\pipe\gecko-crash-server-pipe.5488" tab
    3⤵
    PID:5516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3660 -childID 2 -isForBrowser -prefsHandle 3596 -prefMapHandle 1488 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {52a47b5b-8262-4589-ba14-e081ec15bae7} 5488 "\\.\pipe\gecko-crash-server-pipe.5488" tab
    3⤵
    PID:3368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4720 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4756 -prefMapHandle 4748 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {38e68cd1-e8c9-412d-aedd-3a06c5cd9077} 5488 "\\.\pipe\gecko-crash-server-pipe.5488" utility
    3⤵
    - Checks processor information in registry
    PID:4232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5664 -childID 3 -isForBrowser -prefsHandle 5652 -prefMapHandle 5608 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {857c158b-92ca-4bb6-8bd4-056a96655dc5} 5488 "\\.\pipe\gecko-crash-server-pipe.5488" tab
    3⤵
    PID:5340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5772 -childID 4 -isForBrowser -prefsHandle 3564 -prefMapHandle 5600 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a688641-3cee-4c85-8124-77f4951df250} 5488 "\\.\pipe\gecko-crash-server-pipe.5488" tab
    3⤵
    PID:1676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5764 -childID 5 -isForBrowser -prefsHandle 5396 -prefMapHandle 5640 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e8a8686-3e5a-422d-8fe1-3c0890f447e4} 5488 "\\.\pipe\gecko-crash-server-pipe.5488" tab
    3⤵
    PID:5632
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6244 -childID 6 -isForBrowser -prefsHandle 4132 -prefMapHandle 4136 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {924915a1-4f3d-4594-87e2-10d103320076} 5488 "\\.\pipe\gecko-crash-server-pipe.5488" tab
    3⤵
    PID:5708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4124 -childID 7 -isForBrowser -prefsHandle 6796 -prefMapHandle 3588 -prefsLen 28072 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8f25a041-f99b-400b-b541-1a95d2242eae} 5488 "\\.\pipe\gecko-crash-server-pipe.5488" tab
    3⤵
    PID:1784
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6844 -childID 8 -isForBrowser -prefsHandle 6840 -prefMapHandle 5932 -prefsLen 28072 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1404f755-a4a3-40e9-a00c-e9e0f4818a0c} 5488 "\\.\pipe\gecko-crash-server-pipe.5488" tab
    3⤵
    PID:1940
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5092 -childID 9 -isForBrowser -prefsHandle 4384 -prefMapHandle 7132 -prefsLen 28293 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5677b0c5-0f68-43a5-bc99-d99b78c47ca0} 5488 "\\.\pipe\gecko-crash-server-pipe.5488" tab
    3⤵
    PID:1300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6700 -parentBuildID 20240401114208 -prefsHandle 7268 -prefMapHandle 7288 -prefsLen 30924 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {38ccd759-b064-4743-87ef-bdbd6f45e360} 5488 "\\.\pipe\gecko-crash-server-pipe.5488" rdd
    3⤵
    PID:5260
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7324 -parentBuildID 20240401114208 -sandboxingKind 1 -prefsHandle 7284 -prefMapHandle 7304 -prefsLen 30924 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6b48e057-af79-4e6f-8d88-767895b6d5ce} 5488 "\\.\pipe\gecko-crash-server-pipe.5488" utility
    3⤵
    - Checks processor information in registry
    PID:1840

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  PID:560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pzaexue0.default-release\activity-stream.discovery_stream.json

Filesize
42KB

MD5
9d9866c83656ce220754a40cc1244fba

SHA1
1a799de029c1dec8cbe20f1e476505104b1c1c06

SHA256
c381ad9aaa79b35be6e43d73cfa7b8a1b8c04242eed046c49f7407f3f3871bb9

SHA512
027d9dc5a4cdfab63b1f9ccf9da28fef672042e9ec181b5548125aec9de7afac36eeda63c6fc8ee09dd54f0d116717e070c6ff853097c2ff3968560d7d0db87c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pzaexue0.default-release\cache2\doomed\30629

Filesize
170KB

MD5
8e6a5617f45f9b3d4754ed2030b9e2b1

SHA1
216dd5e460d4700cc8dc614c7bf0e27edf17397a

SHA256
f3f84d2eb2e6de0d874f01f88e6d954b149416961eacea7b32e4105e54a14978

SHA512
818d202b1402ae72b058963fb45c67a3483b09e66c566d660f5f2653da9a62f3c9d97b0f4516610934b54c1069fde8163f17ed74a9a9f02ff82fc2a2b407bce4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pzaexue0.default-release\cache2\entries\01ABD05F24B7C929E9BBF7B620E2289C4EE00CD6

Filesize
70KB

MD5
c830fc3a30a8bc989cdfd7131a0e19de

SHA1
cb7a364055ef298d77be163a9377772baf301bd7

SHA256
b2a4f91b7ac3f61b55d81b14ecc1a6e405ef5ab70498eb5d3262a8a4ed81060a

SHA512
fabc317c1ab23d3c0040dcab11f4a944ea064919b5ef4a41b8c102fee507bb77df5328f8d3da25aeabbc5618e356fb0e582f375e688ecfa6370b7231fcf9e42d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pzaexue0.default-release\cache2\entries\07CEAD446DB7F115A165E2479580FACACBE7C320

Filesize
17.8MB

MD5
8bf265c64da9dd309ee480d3fc6e5cb0

SHA1
3000d52b56860d9a36cd42247a2a9fb014fb900e

SHA256
0bdd8ad1a75cdb3def5e37947ee38b49c134737d5fa358cf099e211ddaa60ba5

SHA512
53f0d60733634cb1c26699769c93266652c79315977ee50660c196bc2175476f94a9794acc49900b4f725e3f04fe6b9341b3cab962ea1d010adfba78cc5d2dbd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pzaexue0.default-release\cache2\entries\1243152E7867EAA24697321508C34F9CEF98EF1A

Filesize
112KB

MD5
7b7bd5c3f981dc753dae384b4e45d597

SHA1
05e7879ffa0ed92c3281f9c66ccb61071cc095a5

SHA256
08fe8cbb350f0ccbddf2aae9696177778c0a7ffe1b0d1e0e0ef019f76b59bd5d

SHA512
945d711513c866c4115bf554b47a98941a6665c925a5cb39935fa467e974c3cbf40d1e3ba45998df25c42160010b77a0f29952bb6050513028529cbdfe61eb92

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pzaexue0.default-release\cache2\entries\18CA28E6E62173D42A705044C717CAA487C6ABF1

Filesize
604KB

MD5
dd53c2cc9cd4e14d33c3e6493f5be6a0

SHA1
540f6f95611a8e74ac2fef426980f9ac544a5ce4

SHA256
b82704e92a7e6cd2516fde42a46e99c2a3b0bbf1bf8e2f8e1d3f6208e534b309

SHA512
de173d71a15d6604aa105885f6052641fb743397effa7881e25c3a415ed82b2143b55ebfe14eb84c7ae4f7347531c152a562d7ec43cd9ce917a2acf50680fa19

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pzaexue0.default-release\cache2\entries\1A46D3B03B4914D068209FF81CDD6A6313AE1758

Filesize
143KB

MD5
22575d8e2271a0a401eeb838ef5e8b13

SHA1
e2aac7fcf822da07c23921c7497eafd5362ba5d7

SHA256
09702818447a645c25749a5f897b3e993e45e57dbb96da61f5bc859ffb0c9abb

SHA512
44112b809c73c265fa070b5c77ce1dfe034024b337e46103729d31957f2faee13a346a14be24c2b6e219e9207b1fb6faa1dc737c0161b0bdd75ab0ff45a37688

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pzaexue0.default-release\cache2\entries\45C13727B6DB444F70F2FAA20129C63BE433735D

Filesize
63KB

MD5
349c70f2d89c20e2d5b8b909ac8fcfd3

SHA1
1a04d7313f44935b52c0bc47d82ecfbe985ef2a0

SHA256
02aa61e772797f4925d59e0372b5278066df7b5cddec53bd0d49bc02f6e83a1d

SHA512
b7cf9c0836556ac3b6be99bce6b20e4166ebbaac724fdb86d9f1a2b182553d467cfa0567a911b2a266ec1d809869f168f197caaf92dc8871b0771a4d85500c8f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pzaexue0.default-release\cache2\entries\80285EC16EDB2FCB53FE4D6500B0396AC776DCD0

Filesize
1.1MB

MD5
eb2a3f9089723727699ab1e6de571fcc

SHA1
46e68ed3dd9bf2c18e7d3fab372f01fe9be4d177

SHA256
180ee89c9237144f8c354bfd0afebb03a25a5a3a7aa7b46a6d71d3515aeca229

SHA512
557f53c78e2a05e6739672aa29b9089e12290dc274614cb2b7f00b34250435edce3d62622739834a01f8039cc5f01e000237b9a4fa44ba529c47210045c0f658

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pzaexue0.default-release\cache2\entries\835A4839D6A39CAA733ED874F649B48AFF73BA56

Filesize
414KB

MD5
3265d6341c54d1716889698d6a0c9227

SHA1
3d39d6248033ed386c89b9f4c6bc85ec75f5371d

SHA256
5279101d3c036adb4afe33711851c21db37fd335bc770146ca51ef7c2736d5b2

SHA512
fd99a38076355594df56ac044df2773d17233caba59afe7ea02ed93422c3f8f902ed34019a2419925f2e8210269d433055711fa92fe7daea06b52885198200b2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pzaexue0.default-release\cache2\entries\93A3F61C53110DFB2A449EAE79580128ABAB08D7

Filesize
140KB

MD5
b504fd750a0750ee98244da9a231d9c4

SHA1
fecbb8d0e70dd752d18ae69f66e8c95ebb8ca696

SHA256
8a75d7c8b24f5c06552930069f79d8312cb97c441497f8b43b80e9fa4ba76036

SHA512
fde3849e3e726fc02c7d7e0ae2b4d544695f6b3cabf90edab14008c571496ca0a82509fd245c25f0c2966f72de483a6fa02f3d66b9d1d3fe018c8c4507a31f21

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pzaexue0.default-release\cache2\entries\ADB77CF89BB7C3EACBA0400910D8956D4F8A5D23

Filesize
2.0MB

MD5
f128cf091a69ac64f62c41ba3ce3c93e

SHA1
5c729a007ecbc75ed022870b60ccef2aeb16e365

SHA256
d68de388058f6f9803579937741953fe6311c71ca80e44c8528aa33a1148e1eb

SHA512
3c036daa73d942e31578e2f61dcdaeec49e41044e8547c2318f765c1280a9404ba76c9c25505d985f838c724003df1f27ae65f34e8f17c2145e1dbbc0da28a12

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pzaexue0.default-release\cache2\entries\BB5FB70C74C290CCB9F25BF1EAEDFF4CAF215688

Filesize
97KB

MD5
83722dce469af66e0a15f58be69ac7af

SHA1
03a8841f61604b65fe387b658e781fac17b47adb

SHA256
dc9b4213d71950f12931d237617722121066381abd44a74fca6681a38783f9cb

SHA512
0182071c5b09c50d751cdaa928f930e632d2ec1c555d8ed3907472995801874863ef72ff2c1138856eacac6e08ca3524aca0caec5f4d6b94def24656569e4fb3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pzaexue0.default-release\cache2\entries\BD518506D48E5D9A2A1A812001B343D87149620C

Filesize
320KB

MD5
927027fcbc2b36d1ab3cfe1e17b2712c

SHA1
c5ec14abbd2bef22cc4225bfa4b12ab648f1b7d5

SHA256
ab3cfe32e031bc8022e8b49a7eda319b71efc394b0149c300e2d6d16683f66cb

SHA512
45959fcec29a4bc76fecd54378996388f91cf6596548f37c29dff69ca8d4604dce971bc99436faa4916d3adad5b6ab1dc38b5f0ae3451bae6f05abaad4af01d7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pzaexue0.default-release\cache2\entries\D105AB5F954C0907C9073BF810F90A3C36C6D3E5

Filesize
1.3MB

MD5
8eceb69f50aa110fdbfe2e79d8a716dc

SHA1
1e3cd087c6c2219eb63c4eee95117110457f5a71

SHA256
dc09b4253ecc24e8ba6c10142437c28951048d72e57869d6c8d9f86962e47697

SHA512
2b1aea1d75e04c607b561e053420a10d2541d90320830fceb22159c8773b3b961e472f2f9024d94357e3c21c39b5c3d124fcc72478ec1167cae385d14b9ddc63

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pzaexue0.default-release\cache2\entries\D2764A516583A378D0BA2325F933EF3C538EF129

Filesize
90KB

MD5
3424378c15ff4f765ff7d3ee6ddbbf8b

SHA1
4a6b5f569340a94cc3ad95b8962a00b55eff82fa

SHA256
9ef07381f4f19689b355616cbf8d10c0deeb4211a4d90362ac563820abea0a20

SHA512
699adc8b70b8d13c8a4d42d1234f3af6d28f5abfcb06f106f00d2a7989353aed4ee1572028beeb43f5bc583db34ae89ee72df38ab36ea72f2220a673c6db7e7d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pzaexue0.default-release\cache2\entries\E44D8EA2BB95FA202605B58E615B3400B72A14D2

Filesize
72KB

MD5
8d208b618808042f9bba276b58efae3e

SHA1
dd13320a9911c577a076f6f09081d4840c77cb46

SHA256
ca9b49f95668d65db027e89b528bdd76e0e65831c84ab9f40e4d4ef977a5e7cb

SHA512
e919443fd0f45e08e4b9d05a778ea21e4470f3aa644e834eeb815ce1c653f7482882f34a307ade9cc672775332262be3d7c11c85f41ea12e73013a07bc33acdb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pzaexue0.default-release\cache2\entries\F54E7030F181831909BFCE5EACACBD3D867BDC0E

Filesize
142KB

MD5
4b6303599801992b68a6ce953cab5588

SHA1
623a30643d0d128ec588db840ff4c7f2eca17247

SHA256
efd66f8da8859d941f1c08cba70420cd9cddc98e15aea0d1365bdb67058623fe

SHA512
830e0b170799169cabbb991cd02f1373da1f6ca7e1d7181a51eefeb9ce22311fe0a8c363ffd31b384ccf218a41ae985a5529e34f751cac31996de3cd3fb25efe

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzaexue0.default-release\AlternateServices.bin

Filesize
7KB

MD5
926205d16bac46baee50624b7e132ccd

SHA1
8a8f8e9b2c42974fc0955bd4be48a3734944870a

SHA256
47429dcd4e8e17406dc28075992b9ee30bd76ab2984784f47b87c5bcdb661ea2

SHA512
173c3d5c233b141e15cb6322002170cd0f99a0133214fdc1d39b617a7168ebea47df602bd94e0271f02a6f319fba1b2c5260dc3ceca47808c814d6b72fea5cab

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzaexue0.default-release\AlternateServices.bin

Filesize
12KB

MD5
3dcd24d130048dd45aa0bf1158d4d9bc

SHA1
f95160b64a0412fb55ecf098c2355ee34804df91

SHA256
895788110bf397aa02759523064704daab93ddd309ccbe4bf78c290bd6a96c0d

SHA512
7009776a85bfa5cfda5ef9424869e11b62c6d00a6491ec5446c05c8187a03507e10fd332a2da9167bd9b91376db4a78358f4000c6b24d131e25b640d66771085

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzaexue0.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
9a2fafc3cc5e54cf3f17ae764be53398

SHA1
c4cbfadd7df0381c94ccc563cf4aaa5ee5b84db3

SHA256
70f1ccb343df0578741efe5388c12d561eff7eb5f75122990793bf3dde5a7493

SHA512
3d9698622217e8c5969573db1d96270b331cba45afbb355dbb6bbda67f746f8b88547d29374ed4330b7a7916750fc56e16aecaf487211c1006a68bdf99370d1b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzaexue0.default-release\datareporting\glean\db\data.safe.tmp

Filesize
19KB

MD5
8762a8c02cb3110bd7d1fff2a6e8a40e

SHA1
32ba0c92a3d0d1efc411187ed82b149291c713fc

SHA256
c0fbee97e8a9c479cfa465a2d254a2340e32552810172cbd4e6f2ce2954560e1

SHA512
68ebd2d8c6532b3c7a7c29df450c7c7c893036fb41070318a19d3c24ee2d031944d89f314baa0813a1f81b8e77aba4f3c5d953dbf1d009443d6ba8cc2623c389

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzaexue0.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
b9024a0cd758ff5eefda9fee6a716972

SHA1
6fbf9b61050a40ef38db6a42af8fcec43d08927e

SHA256
e0b3a10ddacde593712d26622d2853c7b219653620a5c485e385c69e7a013531

SHA512
1eb16a10b60de024e6669e4a86ffcb2d1fa5a6ba7a4f9c1d26ff1c005c83a1cba0c45096df09968f065a1138707e340a13370f8fa4a00ad47ffabe9857e709c0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzaexue0.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
5a654ea2101e583129040d8b55d41a27

SHA1
805cd2b68e755fca2b6b104f0dac8981ac1f49d9

SHA256
9206995c977edeffc952df996d48f7517d1812237dbef695cec8cb32cf61962e

SHA512
23e49c299365b950f922a31639aee89747cf010a73c8c0c3588a3374b9081baae3fb01688b23a1d64efe6a0c49f4ad28fa753809b0c7f0573aeda59c13187d45

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzaexue0.default-release\datareporting\glean\pending_pings\3d9682a0-0259-4892-a6df-bf1342b6bd66

Filesize
671B

MD5
10a8365688980d2d0b3a8e5727ab14de

SHA1
45d37eef1bf29016ec1727bb8cb298f4122a1e1a

SHA256
6aebc45e2f3ca5ea9f3c4b1a95fca41150846af01fc082b1ab9f3cfd542f4f69

SHA512
bbfe6a18908572dda251987d766f092c4530114961042e687d08b8230b91a9e5a38541c840a743d3afa6ee015303ad495f8c25ddf6b6103be9135d919017fa8c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzaexue0.default-release\datareporting\glean\pending_pings\ec96cde2-838c-4f5a-969b-57eb82b0a498

Filesize
982B

MD5
2fd0586dd7df9f42478540febd31bc8c

SHA1
a6a8dc91aafa6b1f4f9477bdf1a3b103c3b0e275

SHA256
0d458fb7c494b8b7c76e5a56273e4cc2d3c15c9b224e5c866ec2f115a62c4a5f

SHA512
f96f9c32567319799bb93434abed1ace241256514d92f3df8cfcd8c286a0cedd2afbd5d86e35e47fa8f96becf5ac6f08bc06c046197b9547a58f183a06d6c6ec

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzaexue0.default-release\datareporting\glean\pending_pings\f5b2fef2-0d4e-4f65-ad60-bc7668eae259

Filesize
26KB

MD5
15550955d55e0509aac82435e14c79b9

SHA1
7acbaf6d6f38f57c480a02a4ef25880a2b10f772

SHA256
8144c5d357a4133e5d113fd5497ded6bfbc8d63029152895050cee2eef54d901

SHA512
3e4c7e964f4ea648f54ba01303ea8fbdd3cfbec2e839a5fe0283aab841492e0b7b435c34304e615975465116af5f7a9d0bbe6cca5a16bb47786705b78ee073dd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzaexue0.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzaexue0.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzaexue0.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzaexue0.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzaexue0.default-release\prefs-1.js

Filesize
12KB

MD5
0ff6bb3ec2d050891ca4121a8ec5099a

SHA1
9f39064eab4fa39c300587839136891ef329ab6d

SHA256
4e07ad88ef8e8aa31ac4a1a362301970c5242d58b4b615b8f5bed0eb548611a1

SHA512
7ab923c225cd021f2778f7f00fd05bfb7996bc993beac51c6c0ff8d2cbe8015348c9d0c088f261219876878c80b574af7896e2d01657d461285ff60398d118d1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzaexue0.default-release\prefs-1.js

Filesize
11KB

MD5
ddb82660fec06d705e08aa4a3d424f8c

SHA1
3d6baaba60bc2f5acee052ebfb61ac01d04f3fdb

SHA256
823affa08099258e7f52ce4db6387fd2b55c90566fcef570e91ada41676a3ca7

SHA512
5426c9a39da5adf67cd20458c2549d0ea1f1059a33ea720db19af4ab1571aed1cbd4b9bf7693b84a0b124a1a1545a90043565ad722399e907e7ff25f4bf24ed2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzaexue0.default-release\prefs.js

Filesize
12KB

MD5
f0953912e58236e84906360c373c8b7e

SHA1
df541a4f3cb720d5c7abef1f63c941687f0f0387

SHA256
c715cce451fbb100c4a391f01dd6a4d3cfece7ee164ad3bc99828508ad85fe44

SHA512
8d6e5c2ef1afac6818f54d9d1eb644e3cbdc7dc1d16e8059d6ac7d91e5a3817ca20734a48c9b0342949d849eb8645d92f8a83e3cacb2f4584f1819891530fdaf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzaexue0.default-release\sessionCheckpoints.json

Filesize
193B

MD5
2ad4fe43dc84c6adbdfd90aaba12703f

SHA1
28a6c7eff625a2da72b932aa00a63c31234f0e7f

SHA256
ecb4133a183cb6c533a1c4ded26b663e2232af77db1a379f9bd68840127c7933

SHA512
2ee947dcf3eb05258c7a8c45cb60082a697dbe6d683152fe7117d20f7d3eb2beaaf5656154b379193cdc763d7f2f3b114cf61b4dd0f8a65326e662165ccf89cc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzaexue0.default-release\sessionstore-backups\recovery.baklz4

Filesize
5KB

MD5
073720eaa4965b0a39f36f2c626ecb10

SHA1
9dadf1561a4856211830a08b15754ae3ba72445f

SHA256
ea04af6a41b010a698f6696f81a1d36a5a5f17e8127c04805ab17f5012f912ec

SHA512
6a9e797ae204bf8915e897bca778f01ee49c772985011bb190f075fb756477e9e3b44c52f47e468e3426aa84e173175bb65a6cdd59f4da15ab1cdeb2814c7414

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzaexue0.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
856c4a316c94a0db42d069ac71c219d3

SHA1
d32f59664054491da4b8eb2b245f1ac608ea5a28

SHA256
a15f5873190cac6a6b969b411dbf1642fe679a689bd90840d6f36b3f4869405f

SHA512
b0f70c5825e0108e901572593ca0ac20c02ebebcc5086026aa700596dc6b344cdf21e6f3397340d7812478c731c154d8590097f7fbe88d79414f7506324ccb52

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzaexue0.default-release\sessionstore-backups\recovery.baklz4

Filesize
8KB

MD5
8a1d01dc5985b42b6da1c121e7690a5a

SHA1
69b3fbc87db12dfe35a8cf31d0bb23e9c1183d60

SHA256
45dc39ffbb56bd0d9e619a5fb1b20efaadbdd0c4d64928875de308869dd30327

SHA512
54616abdacab8b51f46cb9e89d01de784993e5d446ebdf30dc2426f8e2d619371d72317f63c4021737bc3a609332081d6df1b6f56ae5c7f946bfd19c72a86c60

Download Submit
memory/4232-5-0x00007FFFC9E80000-0x00007FFFCA942000-memory.dmp

Filesize
10.8MB

Download
memory/4232-2-0x00007FFFC9E80000-0x00007FFFCA942000-memory.dmp

Filesize
10.8MB

Download
memory/4232-1-0x000001E585430000-0x000001E58546C000-memory.dmp

Filesize
240KB

Download
memory/4232-3-0x00007FFFC9E80000-0x00007FFFCA942000-memory.dmp

Filesize
10.8MB

Download
memory/4232-4-0x00007FFFC9E80000-0x00007FFFCA942000-memory.dmp

Filesize
10.8MB

Download
memory/4232-0-0x00007FFFC9E83000-0x00007FFFC9E85000-memory.dmp

Filesize
8KB

Download