Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
17/03/2023, 10:10
Static task
static1
Behavioral task
behavioral1
Sample
©Contract_Agreement_Koerber-supplychain_6CMOSK71.htm
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
©Contract_Agreement_Koerber-supplychain_6CMOSK71.htm
Resource
win10v2004-20230220-en
General
-
Target
©Contract_Agreement_Koerber-supplychain_6CMOSK71.htm
-
Size
655B
-
MD5
839cd7b10ca755e709b36bf885e8d449
-
SHA1
0af8c1a4634d13220e3774d12ef19a3225eafc84
-
SHA256
c1918edb8d2bf99eb71a219e53741cc028561230a1b8d1e1d28ab729f0f64f64
-
SHA512
ac7b8582d166f7ea726b2db1ed782d80643352aa2720639f05fa25aa072942fd520f524779f04b00e9851f6913753d259288844b7854bf0569fde83e721d2f18
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "385812814" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3438213883" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000010d3bb75b0ea114e9ca1233a5a090b7b00000000020000000000106600000001000020000000191efbc9348226b9c517cb28468afb4faa5c9e2e8511eb46d525893e9752de07000000000e80000000020000200000001293b0ea0559ef148f5320bb654dd5b88984755b55763688e30d4b418137863b20000000e16c66d58d0b317cfc12e8934b6e8a7b6e37018c5f21659ab00903d44e7f482240000000aab35c42f363bdd1ee97fec469e5bc3b2eed6942ad143f67910c7cae92c77ffff458833bb5e3c8c54026311c91a61f90229d6b9a73f9933da308a8d8b0500eba iexplore.exe Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3427899544" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31021240" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 902a71ceb858d901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31021240" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{F777FEEA-C4AB-11ED-8FFF-660D1B6B73D3} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3427745254" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000010d3bb75b0ea114e9ca1233a5a090b7b000000000200000000001066000000010000200000006927bc0133f552e1d3427272dfe7b77059b61bd212d7e881d62387052aab1135000000000e8000000002000020000000c3d47c7cd421eff20272da5bb60ce75f5a29c2b40ca266e534f31154d947667220000000817a1a6ecb1d50720c8e50bfa9bacb7ff7e40d5057f38e181a634e165b23dcaf40000000ab2896a8f4652cccc1065d26dcc2a877d442236560fb7cfb5ee8ff9d38e6bd124fbd36e30d97cb777cefac46eb6c606926e406822a05e07b1a8e23e2c58722fb iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31021240" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c08860ceb858d901 iexplore.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings firefox.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3380 firefox.exe Token: SeDebugPrivilege 3380 firefox.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 3768 iexplore.exe 3380 firefox.exe 3380 firefox.exe 3380 firefox.exe 3380 firefox.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 3380 firefox.exe 3380 firefox.exe 3380 firefox.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 3768 iexplore.exe 3768 iexplore.exe 704 IEXPLORE.EXE 704 IEXPLORE.EXE 704 IEXPLORE.EXE 704 IEXPLORE.EXE 3380 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3768 wrote to memory of 704 3768 iexplore.exe 87 PID 3768 wrote to memory of 704 3768 iexplore.exe 87 PID 3768 wrote to memory of 704 3768 iexplore.exe 87 PID 2596 wrote to memory of 3380 2596 firefox.exe 100 PID 2596 wrote to memory of 3380 2596 firefox.exe 100 PID 2596 wrote to memory of 3380 2596 firefox.exe 100 PID 2596 wrote to memory of 3380 2596 firefox.exe 100 PID 2596 wrote to memory of 3380 2596 firefox.exe 100 PID 2596 wrote to memory of 3380 2596 firefox.exe 100 PID 2596 wrote to memory of 3380 2596 firefox.exe 100 PID 2596 wrote to memory of 3380 2596 firefox.exe 100 PID 2596 wrote to memory of 3380 2596 firefox.exe 100 PID 2596 wrote to memory of 3380 2596 firefox.exe 100 PID 2596 wrote to memory of 3380 2596 firefox.exe 100 PID 3380 wrote to memory of 3556 3380 firefox.exe 102 PID 3380 wrote to memory of 3556 3380 firefox.exe 102 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 PID 3380 wrote to memory of 1456 3380 firefox.exe 103 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\©Contract_Agreement_Koerber-supplychain_6CMOSK71.htm1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3768 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:704
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3380.0.2031574917\1763239089" -parentBuildID 20221007134813 -prefsHandle 1852 -prefMapHandle 1840 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ec285a8f-ab82-4c28-a8ee-cbb5a09a96a9} 3380 "\\.\pipe\gecko-crash-server-pipe.3380" 1932 1b6252fbc58 gpu3⤵PID:3556
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3380.1.1506961772\23851391" -parentBuildID 20221007134813 -prefsHandle 2320 -prefMapHandle 2316 -prefsLen 20926 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7844d8a7-197d-40a6-8d69-5d2236ffbdb5} 3380 "\\.\pipe\gecko-crash-server-pipe.3380" 2332 1b618372b58 socket3⤵PID:1456
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3380.2.1366421191\1467720077" -childID 1 -isForBrowser -prefsHandle 3032 -prefMapHandle 2912 -prefsLen 21074 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ea8da15c-e2b0-4ada-b511-b981794c1f97} 3380 "\\.\pipe\gecko-crash-server-pipe.3380" 3020 1b628ee8d58 tab3⤵PID:4224
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3380.3.1771927867\1998413497" -childID 2 -isForBrowser -prefsHandle 3884 -prefMapHandle 1304 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5ee2623e-1e0d-49fd-923f-e6b900efae70} 3380 "\\.\pipe\gecko-crash-server-pipe.3380" 3892 1b618371f58 tab3⤵PID:1968
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3380.4.2035771138\384303409" -childID 3 -isForBrowser -prefsHandle 4024 -prefMapHandle 3900 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {417b0853-6749-43dd-883a-cc3fa42b6b1c} 3380 "\\.\pipe\gecko-crash-server-pipe.3380" 4044 1b62862ae58 tab3⤵PID:4984
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3380.5.1739421822\41902771" -childID 4 -isForBrowser -prefsHandle 4956 -prefMapHandle 4968 -prefsLen 26738 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d854860c-bc49-458d-945f-414f1793c6bd} 3380 "\\.\pipe\gecko-crash-server-pipe.3380" 5000 1b62b6dce58 tab3⤵PID:5560
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3380.6.1681392840\2081905642" -childID 5 -isForBrowser -prefsHandle 5220 -prefMapHandle 5180 -prefsLen 26913 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c69b3fea-e3e3-421d-b9ca-f449b49e4c28} 3380 "\\.\pipe\gecko-crash-server-pipe.3380" 5204 1b62c614058 tab3⤵PID:5788
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3380.7.1692212846\813007262" -childID 6 -isForBrowser -prefsHandle 5332 -prefMapHandle 5336 -prefsLen 26913 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d3f9ed82-7dbc-44aa-a52a-b72b4bace946} 3380 "\\.\pipe\gecko-crash-server-pipe.3380" 5324 1b62c614358 tab3⤵PID:5796
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3380.8.1680592394\1382105652" -childID 7 -isForBrowser -prefsHandle 5524 -prefMapHandle 5528 -prefsLen 26913 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a7a2f780-89be-43c5-b2c1-38f64f15a2f3} 3380 "\\.\pipe\gecko-crash-server-pipe.3380" 5512 1b62c614658 tab3⤵PID:5812
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3380.9.734588361\159171033" -childID 8 -isForBrowser -prefsHandle 5772 -prefMapHandle 4056 -prefsLen 26930 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {13a628fb-e7cb-4b96-94e4-fc842047a99c} 3380 "\\.\pipe\gecko-crash-server-pipe.3380" 5116 1b618366e58 tab3⤵PID:5308
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\activity-stream.discovery_stream.json.tmp
Filesize146KB
MD5b7ec0f6c1f2d860c7cf1954d5b7e9fd6
SHA1cb250a453f73911c829710aba3e5366cd0fde231
SHA256eedf7bbe0460498f9fdaa0de55303472d273bd222fa870e517f975cba4fece07
SHA5122afcb87c8ee679c9878ec6ffcabec13ff54df522f1acfda2b28561934fc20623d44a055949ffa2e0120d9420f1b5005c051fb08ccde20da263ae617e73b80853
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\cache2\entries\184C843EA0B8CD10730CA2564A233632E40FEF45
Filesize14KB
MD53e2348be4e006bed2236efb7fb2daf64
SHA1e30894bff4757f7d5b0f7fabe1c2e6a16943c3a9
SHA256d4a597ad6c4e2596a0efa5d8883c4de210f0df09faa1ac234cfef82b0a1f647a
SHA512d47f54a7e83a4c126559b61736e3c9dd1b9c1100f9d3318ea2120b55698ff848878ee95eeed15b839a3d496070e96b01fe0341b6c29612254d1482c4cd6185f1
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\cache2\entries\D5594A2648EECD01993B5C42919BA64ADBF56052
Filesize14KB
MD52b131c9fc683f312a567c416e23fd843
SHA122eb91a5fbb0abe0a4f97b4eea434ca8f81e8f81
SHA2565eb9f039b65aa7d3e9ad074dcf5929898198b4c489e177cb89512991927d34ac
SHA512949f738600f3c9b2d68b5df0d8229ef790c717e348f237ec48a4eacc19c4eff8090cd1e657947f7bcbd62a659e1839de9168d8b72477d3285613f931664fe425
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
Filesize
6KB
MD5edb1472a4c9d7280fcfd08b6af096eb5
SHA13cc6a7f0a8182a8f5e37d1241147d555b05f1eb6
SHA256ba1be9a98259f82fbf67263e47445047c7160f2c1f51065cdcc2456eba42e59d
SHA512fe750bb2ab34426c1d688ccb6c9a2fa73c191db75db8e4878f705408561590010b2212e48ebb5c8b0e4d250c1ffe6d5cd91edc49c7e0fe976a6e5ae6102945ad
-
Filesize
6KB
MD55c8460a5ac1158aeccf6a31b52b3cf5f
SHA15fffb176e9b7d9e5d0368bde52300076d9fe3d3d
SHA2564428276f87d0de655702c5d1a592ca0275dfbdac93f63cd66c72b11ab9d6d802
SHA51268deca24193a9070f34b291926ce80de7dfaf58340f1f4a36982fc7f3048d43201d088ad3b2272fffc86207aeead8a036422157ffd1dc192a4d850be538fbd16
-
Filesize
6KB
MD59eed0f5f5f2a8c9e69d1b7360dd0e166
SHA1e26802f846adad0d3fd4780c229bd44a57241364
SHA2563c87a4fc456e02b0ac5be204cc15cde4058c64499ad77f535bcae087e1a4ed6e
SHA5129b0eb8ef2c684a237fc68b3841d262ce88f772b8eb3ea7a16c4462a09efbf9aa4c1b87288f5825df06ad3fc61038c3fd752257215d0ebb3f7f564260640e8cff
-
Filesize
7KB
MD564ed6ac8b6b798aa64c8f97697d44b24
SHA15df04b8b42115da6ee1a2ae569db02459c8fa53e
SHA25601ee6749d67cfead66d41f74a829bdd391b5af0e07e4f53db25cfd44e895ad8d
SHA51214c04ffaa4fe2b3d41d987eaafe700d6d3d98f3aeba538b1bfa87597b154fc8d614fbb5d360c1bee767f23202f5e9fe063c2ab6cedc8342e09d1d22ec77ea4af
-
Filesize
8KB
MD51a07ce7b2be645d625eda03f0093cdf3
SHA1f9e6976cb312bd0af0780743a389227f1a4bc69b
SHA25675099304c52c9b369da53879e56772c21c109d98c365db2d559534d56e265734
SHA51250a823a1c63c919450d39dd996fcb305751beda1c143958ade5b93eb0328f3f2b4bdc1f48902e7e415cb962fb76617e4ad35e0eda1ca75d79f94b3dfd699565d
-
Filesize
10KB
MD50147becdfeb61fcf83686b353012b5b0
SHA1077b7d08d209423822da5682d4362f223b373283
SHA2562b5b0260648610ab46ff2f3ffb9ce40f5c89b8ee629d5319f101c94dad735a29
SHA5124c4a1a3e64a05f7f4f7444630608b57dd8e280f6e1e6ccd1f64248e616f82b515d40fd2a369f410e2c7a989d8c89558fe2af7849f79ec91468fc67b73dc160c0
-
Filesize
6KB
MD5f73e52d124620d05267ba934f3b312d3
SHA134121aa291d9f88b3e8e3a2fa37cb1c06cac2d30
SHA256fc898a91ae8ce9d241c586f5dee2e60450dcdc5a31f1a7015d6dc2f4fefe4ac7
SHA5124ef67626a2ba584817d707c71ddf7e7ce75a780921c3fcdfa8a03de0de9303c4b548ce3c3b493f1c4876d511271978bcd3cdbc2d1003b23c2459847180045d46
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\sessionstore-backups\recovery.jsonlz4
Filesize2KB
MD5718e3cd583ea22471c383e08b7525378
SHA1be63e9ace4559c7c2309a0e7ce749b0d89d43814
SHA25636a87cbfaf46203a1848294a05e4de4eceda9e7af58e3dcf1926834a969a99af
SHA512a11b401a6f86d4f748858c359c746ab41382a21fee0cf3a9c2a56017526cf555db3090bb36d5638075f31870e95199003d4b7c1cef3343f46b0c35497595dea3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\sessionstore-backups\recovery.jsonlz4
Filesize1KB
MD522c0430ed4af11a1967256d8e9a38556
SHA1f2a23341f73084c0df315457d8153f3278620bc9
SHA2565f09b45194da337ec7871aaecf123e499e822ee49026bc270768975291bab267
SHA5125befe1bf18ecd8606e16c10eaf3ea95243147188ea8a1b560ec9fc5575d7351460c2ed22c055439fa0bfb52108b04d8142ba2acc987dbadc1d66e261578efa01
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize1.4MB
MD5259f812aa753c120f2c643661b3edfee
SHA19af86fa48de1f63a1337e12478deb6a9dd4b3af4
SHA256612cd440ec3a0f3bab99f5cb30e0442f15ac0a5ecd968bcf9cf099f7b0380137
SHA512a10428c7c9d96ad89853b57e7e26e01c09e57b094cd5d26eaea3e4d118f4e62d11bf709eb7ff000f27dae1d9dffe75cb2e0c83b475e2b46810ed0e274dfbc6c4