Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
3testestest...0).exe
windows10-2004-x64
1testestest...1).exe
windows10-2004-x64
1testestest...2).exe
windows10-2004-x64
1testestest...3).exe
windows10-2004-x64
1testestest...4).exe
windows10-2004-x64
1testestest...5).exe
windows10-2004-x64
1testestest...6).exe
windows10-2004-x64
1testestest...7).exe
windows10-2004-x64
1testestest...8).exe
windows10-2004-x64
1testestest...9).exe
windows10-2004-x64
1testestest...2).exe
windows10-2004-x64
1testestest...0).exe
windows10-2004-x64
1testestest...1).exe
windows10-2004-x64
1testestest...2).exe
windows10-2004-x64
1testestest...3).exe
windows10-2004-x64
1testestest...4).exe
windows10-2004-x64
1testestest...5).exe
windows10-2004-x64
1testestest...6).exe
windows10-2004-x64
1testestest...7).exe
windows10-2004-x64
1testestest...8).exe
windows10-2004-x64
1testestest...9).exe
windows10-2004-x64
1testestest...3).exe
windows10-2004-x64
1testestest...0).exe
windows10-2004-x64
1testestest...1).exe
windows10-2004-x64
1testestest...4).exe
windows10-2004-x64
1testestest...5).exe
windows10-2004-x64
1testestest...6).exe
windows10-2004-x64
1testestest...7).exe
windows10-2004-x64
1testestest...8).exe
windows10-2004-x64
1testestest...9).exe
windows10-2004-x64
1testestest...py.exe
windows10-2004-x64
1testestest...ge.exe
windows10-2004-x64
1Analysis
-
max time kernel
117s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29/03/2024, 01:48
Static task
static1
Behavioral task
behavioral1
Sample
testestestestetw/triage - Copy (10).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
testestestestetw/triage - Copy (11).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
testestestestetw/triage - Copy (12).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral4
Sample
testestestestetw/triage - Copy (13).exe
Resource
win10v2004-20240319-en
Behavioral task
behavioral5
Sample
testestestestetw/triage - Copy (14).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral6
Sample
testestestestetw/triage - Copy (15).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
testestestestetw/triage - Copy (16).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral8
Sample
testestestestetw/triage - Copy (17).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
testestestestetw/triage - Copy (18).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral10
Sample
testestestestetw/triage - Copy (19).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
testestestestetw/triage - Copy (2).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral12
Sample
testestestestetw/triage - Copy (20).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
testestestestetw/triage - Copy (21).exe
Resource
win10v2004-20240319-en
Behavioral task
behavioral14
Sample
testestestestetw/triage - Copy (22).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
testestestestetw/triage - Copy (23).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral16
Sample
testestestestetw/triage - Copy (24).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
testestestestetw/triage - Copy (25).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral18
Sample
testestestestetw/triage - Copy (26).exe
Resource
win10v2004-20240319-en
Behavioral task
behavioral19
Sample
testestestestetw/triage - Copy (27).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral20
Sample
testestestestetw/triage - Copy (28).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
testestestestetw/triage - Copy (29).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral22
Sample
testestestestetw/triage - Copy (3).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
testestestestetw/triage - Copy (30).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral24
Sample
testestestestetw/triage - Copy (31).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
testestestestetw/triage - Copy (4).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral26
Sample
testestestestetw/triage - Copy (5).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
testestestestetw/triage - Copy (6).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral28
Sample
testestestestetw/triage - Copy (7).exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral29
Sample
testestestestetw/triage - Copy (8).exe
Resource
win10v2004-20240319-en
Behavioral task
behavioral30
Sample
testestestestetw/triage - Copy (9).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
testestestestetw/triage - Copy.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral32
Sample
testestestestetw/triage.exe
Resource
win10v2004-20240226-en
General
-
Target
testestestestetw/triage - Copy (15).exe
-
Size
1.2MB
-
MD5
08b8eb8dd9681bfd0050fa7e547e1fd9
-
SHA1
f810b716884668bbc554aae7914dd19f1c30c265
-
SHA256
e8fec48d4400319a802dcc42081e768ef0bf8ec965e65d95ec4502ea3c35ac6b
-
SHA512
d0fb222a0b356abce4f8489e953db9c9330e2446007eb002a7c7db3022f931fb22d5686da5749ea03504cffb241e21768512c9c6d20156fac32c81b0070c878f
-
SSDEEP
24576:bdofGAmSIQ177wZ+A7MjiiRDXU/Sat5RgsLSmIOHsU5zMmX1xYwncqKvGqU/:bdofGbSIQ177wZvYjiiRDXASat5RgsLn
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2460 triage - Copy (15).exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2844 firefox.exe Token: SeDebugPrivilege 2844 firefox.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 2460 triage - Copy (15).exe 2844 firefox.exe 2844 firefox.exe 2844 firefox.exe 2844 firefox.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 2460 triage - Copy (15).exe 2844 firefox.exe 2844 firefox.exe 2844 firefox.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2844 firefox.exe 2844 firefox.exe 2844 firefox.exe 2844 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4292 wrote to memory of 2844 4292 firefox.exe 91 PID 4292 wrote to memory of 2844 4292 firefox.exe 91 PID 4292 wrote to memory of 2844 4292 firefox.exe 91 PID 4292 wrote to memory of 2844 4292 firefox.exe 91 PID 4292 wrote to memory of 2844 4292 firefox.exe 91 PID 4292 wrote to memory of 2844 4292 firefox.exe 91 PID 4292 wrote to memory of 2844 4292 firefox.exe 91 PID 4292 wrote to memory of 2844 4292 firefox.exe 91 PID 4292 wrote to memory of 2844 4292 firefox.exe 91 PID 4292 wrote to memory of 2844 4292 firefox.exe 91 PID 4292 wrote to memory of 2844 4292 firefox.exe 91 PID 2844 wrote to memory of 4452 2844 firefox.exe 92 PID 2844 wrote to memory of 4452 2844 firefox.exe 92 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 1388 2844 firefox.exe 93 PID 2844 wrote to memory of 2336 2844 firefox.exe 95 PID 2844 wrote to memory of 2336 2844 firefox.exe 95 PID 2844 wrote to memory of 2336 2844 firefox.exe 95 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\testestestestetw\triage - Copy (15).exe"C:\Users\Admin\AppData\Local\Temp\testestestestetw\triage - Copy (15).exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2460
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2844.0.695047832\1179044101" -parentBuildID 20221007134813 -prefsHandle 1900 -prefMapHandle 1892 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {aa1223f6-f3dd-4ee1-9a91-eb048f17cd82} 2844 "\\.\pipe\gecko-crash-server-pipe.2844" 1980 22552ff5758 gpu3⤵PID:4452
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2844.1.1182187296\146213774" -parentBuildID 20221007134813 -prefsHandle 2368 -prefMapHandle 2364 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a4046e9-bf30-4abc-926a-2a689b516732} 2844 "\\.\pipe\gecko-crash-server-pipe.2844" 2380 22552efbd58 socket3⤵PID:1388
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2844.2.1578219889\1614316724" -childID 1 -isForBrowser -prefsHandle 2876 -prefMapHandle 3188 -prefsLen 20823 -prefMapSize 233444 -jsInitHandle 1384 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ccefb809-f692-4597-85c7-005f65f83683} 2844 "\\.\pipe\gecko-crash-server-pipe.2844" 3436 22556e8ce58 tab3⤵PID:2336
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2844.3.1460563724\1349866349" -childID 2 -isForBrowser -prefsHandle 3588 -prefMapHandle 3584 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1384 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9570c855-99fc-40a1-86d0-9e30c4236b65} 2844 "\\.\pipe\gecko-crash-server-pipe.2844" 2904 22555831258 tab3⤵PID:4388
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2844.4.1631475544\1477619611" -childID 3 -isForBrowser -prefsHandle 4360 -prefMapHandle 4356 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1384 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {88d99ba4-a568-44b1-870a-55b1a8c1256f} 2844 "\\.\pipe\gecko-crash-server-pipe.2844" 4368 22558d09f58 tab3⤵PID:960
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2844.5.1288502435\2011457323" -childID 4 -isForBrowser -prefsHandle 5064 -prefMapHandle 5032 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1384 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {96840abd-5f4f-4979-ab17-a2d927944572} 2844 "\\.\pipe\gecko-crash-server-pipe.2844" 4964 22558d07858 tab3⤵PID:1920
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2844.6.881346220\411725018" -childID 5 -isForBrowser -prefsHandle 5196 -prefMapHandle 5200 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1384 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {71b65cf9-3ee8-483e-a555-8581e091acc5} 2844 "\\.\pipe\gecko-crash-server-pipe.2844" 5188 2255916ac58 tab3⤵PID:2112
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2844.7.226542590\3974645" -childID 6 -isForBrowser -prefsHandle 5388 -prefMapHandle 5392 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1384 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {beba68ed-c523-4f61-9358-aaeab23656d1} 2844 "\\.\pipe\gecko-crash-server-pipe.2844" 5380 22559935258 tab3⤵PID:2668
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2844.8.1160727201\1979021403" -parentBuildID 20221007134813 -prefsHandle 2896 -prefMapHandle 5740 -prefsLen 26206 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {285ef9c6-9b0c-405c-9151-ca196755d6e1} 2844 "\\.\pipe\gecko-crash-server-pipe.2844" 3104 2255a716b58 rdd3⤵PID:5560
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2844.9.745043678\1641021574" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 3272 -prefMapHandle 5780 -prefsLen 26206 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {58ac2a0c-60c9-46ed-b865-9cc6d2623422} 2844 "\\.\pipe\gecko-crash-server-pipe.2844" 5888 2255a745658 utility3⤵PID:5588
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2844.10.265776572\543270212" -childID 7 -isForBrowser -prefsHandle 6116 -prefMapHandle 6112 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1384 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {751b46a7-83d4-4fb8-89ec-e5e199ab720c} 2844 "\\.\pipe\gecko-crash-server-pipe.2844" 6124 2255aa7b958 tab3⤵PID:5720
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2844.11.1818675357\1553448448" -childID 8 -isForBrowser -prefsHandle 6292 -prefMapHandle 6300 -prefsLen 26381 -prefMapSize 233444 -jsInitHandle 1384 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fc501878-626a-44d5-8485-4ea83b13cbf2} 2844 "\\.\pipe\gecko-crash-server-pipe.2844" 6220 2255aa54a58 tab3⤵PID:6080
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2844.12.246232310\1315987654" -childID 9 -isForBrowser -prefsHandle 6324 -prefMapHandle 6456 -prefsLen 26381 -prefMapSize 233444 -jsInitHandle 1384 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ddb586dd-e6aa-4a8a-add0-1ef101660298} 2844 "\\.\pipe\gecko-crash-server-pipe.2844" 6496 2255ad34f58 tab3⤵PID:6124
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2844.13.1654359806\905677855" -childID 10 -isForBrowser -prefsHandle 10496 -prefMapHandle 10500 -prefsLen 26460 -prefMapSize 233444 -jsInitHandle 1384 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8c76451c-cbc9-4325-8ccc-69ed98bd3c4d} 2844 "\\.\pipe\gecko-crash-server-pipe.2844" 10484 2255a743e58 tab3⤵PID:5908
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2844.14.1754382347\1098460058" -childID 11 -isForBrowser -prefsHandle 10272 -prefMapHandle 10268 -prefsLen 26460 -prefMapSize 233444 -jsInitHandle 1384 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bdfd936b-e388-42f8-8a87-96ffd69bb670} 2844 "\\.\pipe\gecko-crash-server-pipe.2844" 10308 2255aa79858 tab3⤵PID:3364
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2844.15.1478030632\710932214" -childID 12 -isForBrowser -prefsHandle 6440 -prefMapHandle 6452 -prefsLen 27463 -prefMapSize 233444 -jsInitHandle 1384 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {36f08566-4dd2-414a-8f8a-72ee9e50e566} 2844 "\\.\pipe\gecko-crash-server-pipe.2844" 6508 2255b0f9258 tab3⤵PID:4964
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD58d850d69d83aba33b304518d9e1925e8
SHA1e9f0de27679b5c1f8b2ed587faa1f5c26a25bdc5
SHA2561652fa84e14262021ff43fbb3adb1576e54b4caa9946fcce863b523616c0ac8d
SHA512c064f4665006480ca427c11340b37e1e6770f7ba8cd7bf9dd06a70801ed8bd331862875467ac8572c399905334c3c456f0d0af05b68c5d5fb64ed3d91241fa1a
-
Filesize
8KB
MD56d940fd1bbb0b2d5520b8bb8d60b3a6a
SHA14d88614abd322e6428a9fca7a14d91ea241c9956
SHA256ef40a1e3b3029f5d0912d5e8afb87cee20d44039823fded2c17b8cd3a065b04f
SHA5128b35a0faf5a72255621f52f876ccf7b127de4b2c9182c191b3809c7526793fff94a751f3de76259400941867c43dc6999b80fdf02f806c5f1887a104c5b5c314
-
Filesize
9KB
MD504b8f6962f15c5c9982e4636ec80df4c
SHA1cc472001831d27a228f3fbf9d2f62467d1d9249f
SHA256a1202d01441bedb3b84f79be7bd799673360a056c8a3ac1949bb2bce91adc3e2
SHA51296c00202805ac87759705baef95e44bc3e4d74e70193bdd60e444d4a2a87c461e8c738d9e40d83fafc075d15df5b721604520a92201b34c30515bf0e7eb7148f
-
Filesize
30KB
MD5ee6dfc57f0f1c2af632e131866b6bf81
SHA166669324932784cb8c02fa5a05a65b67e6e0ce52
SHA25643f9a209119dcbfdb47f51cd72588b0857549d548bf3d7056016b6f28d3ebcdb
SHA512d1b72dd1f02e465e537de4b5cc503825807dc0e64bfb333d87ecc6aaaa30ed5a6412d80159e634ec6d4006d2fc1293765cdc04f3817d74c64bc431ce0351fa73
-
Filesize
8KB
MD5da4424f463a32b38f6530092355c3c9d
SHA1e087da8d1899591900c2b1a51445fb3ccf02cfb4
SHA256d71c2ee4f761d126c85caf5e2e0952f5319c7c59b73735737d91f67e2753fa57
SHA512044e64ecc396e05b44876cdcd8efaf10eaedd53c767be65cdd474a6afaa322d404d496d177796edd434d25ada312b99a24a93b43ef6eae1399b6805917badeb8
-
Filesize
9KB
MD5370f1e36372f2bbc780fc8cddf207642
SHA1293af49ec3ee576adc136844f6b173fe2cabcd15
SHA2563bb54fd8a5ea6c2f396639e146b70a00a083909b4c4ad236a74b4309d838c523
SHA5120f4389a38b0740d86136ca4e85d10ea56b2acbec91840567f46fc068edd102d6207fa4645755eead284faaea0d9f9456b04687d3f045d714f73b8f1f2d437133
-
Filesize
8KB
MD5278a457a03d5fb6b874ffe7b0dd200f3
SHA1b30a2d3bbcb9a647822fe3cc01616d6acc3c0877
SHA256bc84e397057afc6205658264b2e6aba4d3f4320913b1d00eab0a9fdc18defbbc
SHA51243bfec5a0576a9556b291d15aa1e76d90d4b99cdd7b8153bbb52ebb660a28ffce616a721b9f29918dffefe1718540b257e01777f1da5df0afd791512dad5a465
-
Filesize
9KB
MD52864e5a0adb1344594aca87a8b7399f9
SHA16f04470ad4567ee5c965d20042cfaf7d2e952fcd
SHA2563a4805dfe2e96e9a3f359c1210111573812e3e038f0db374bdeb72ee6a57336e
SHA5123fa3565b27a210dd09ebf847de70b226fa6ec05efc43249ba0b8652defdd70468b50ef2f61bd445f23f0dedb134ebd339a85e475971173896239dfd8bfab33fa
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0etkwu5l.default-release\cache2\entries\52D6DE9CB6806448C8C808EA8977B9006B2E8A5D
Filesize10KB
MD5544a7f381d4bf9507e8ce64f1940c4e7
SHA100fda142a9355f7ef0e5d4fce798428c160c2c33
SHA256aaf7ad1e72ad077b53dcce595e561654ad7781814edd848ba6ea0c543c869b94
SHA5125e804a03d7e200a8aecbf1cbba0c7db175f04a60d76d47c1d194a7e567f8b11aebbfed7aa4f9d4f04005c3088c90998dfff42a556d08c7611192450b362c7acb
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0etkwu5l.default-release\cache2\entries\E8F82FF507585AF8655F245209766BE49794B690
Filesize49KB
MD5287a81d32719b6529ac8e20693757506
SHA1d98bf537617241fa564a4ef6f16773e9f1147ce1
SHA256214d4f9b10aeb3553a5d4650104df351b4f5de7b66b3a420098275ac29d1ec2b
SHA512873fa09b0811d2c1497582044862fa2a36261f55492fdfcc8bbdc1dc372334c120feeea56a567217fc4b2db904f0fc7bb210ddebb76d9981cebd82ef15a94f68
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\datareporting\glean\db\data.safe.bin
Filesize9KB
MD5b646c9e2f376bc7ade755619a918159a
SHA115905496781b931cf45052add0baf26b719b3268
SHA256db9f3d7203a4b143d49250bfffb017f1a03e2c300d31f101048e98e0ea9f8f1c
SHA5121e70daf8e98efa865187ab257c80a63fe1e8dcec5b1ae6e2de241ed961bcaa85ab36ccd36d12440d0b2d201fcdc0ee81d6240635641299eb3452ca7ced01ae51
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\datareporting\glean\pending_pings\000152e7-c81f-4317-a706-9083499e6e37
Filesize734B
MD5ae97aaf08378d9625b613fe859a0defd
SHA11a6a8a591eb599c5ba0be6e33cd2f32a1a2d0777
SHA2563990228d1a384cd56b818b2af791f7ceaed6e306738940a001ac32308cf33d44
SHA512f638fe1d3d8e813abdeffc33f94592b9de4b3ee576a3a0ef1bec8a081dddfc3d6cf13e4189e71a2777a449c1a68037ed15ab80ca8185b7f73225398474721a11
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
Filesize
6KB
MD582b71c2aa3b1d0948ca435b40f8c5989
SHA182f5a341681f9d4e74ea8fb3346dc7a052782d9b
SHA2562528389f704cf8498442a6c5c35565f97333bb605cf517d45fd72f4c4c92f89b
SHA512acbb10c783a1ea222d54243daeaabe3f00049f66e92ef5c3942de5d61457c738c164097275d182a56b003013e136f25d5a80c0e5905a54f757695bb30a485f25
-
Filesize
6KB
MD5911d03f43e0d2e5655440e2d217c8330
SHA139ec4482a612164a023fed0965d5fd217ef425a2
SHA2563928804c99451d78f3770ab805725717655c9e0ccfde14813af1f69dfbbd4185
SHA512e8862e132fae081d69b5c0bd1b3c020531f475aec98b57747cca0c013de6a232f20271cab46ec17f4c384c5c0fe88d3d9e721ea67d83dbb07f6a5158a5982348
-
Filesize
6KB
MD588a2430c26a9631e4286e13b2bbdf834
SHA1266b3f0bd2d15c1ab432dc023ecab9d195eeba2b
SHA256c6be266fcd499d14c60e3fcb81177fea835b8c0fa187e0094f98afd24f0dd153
SHA5121bf506be7219d97ac59be889554a8b954a269404004579a4742cb573dc5303c19239e7a6dd188cbe69f6fc456f398718220dab336b71fdb64ffdd69b0394614b
-
Filesize
6KB
MD583c5bf8862a3bb9e60488319921ebad2
SHA1c3d9211c44b1f55116648eee7ec493e2e8f102c1
SHA25617c70c0cf9a91205b8620a54f20d9d524c9d5307afabf2ae4377520a89f1742c
SHA5125ee705ee1772f9688050ee16203215dd3717e4df1a10a2f5bbff3255066addb8c1feacc4753de49e9719a8e4df74f922f27e038e6724317453d0df9fec6f0f25
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\sessionstore-backups\recovery.jsonlz4
Filesize1KB
MD55162a17fcc5fd8deb72e5668801c11c6
SHA1fc9ea2883f566570db1215ca9e196e2d89d19a1c
SHA256cb57f512443518285ef8284308049adf3cb9026be0d2b8d2e8d343ff140c0949
SHA512e62d9b85ea4efd77239ca2af8cc9113e17242a695dce1a6d216e88d879f0bcb463843d2bdb4b7285374fcf1f1b07026b997000b822f7010f167237a4c3c13efa
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\sessionstore-backups\recovery.jsonlz4
Filesize10KB
MD5f7f612d77058afba9aa66ff96940b56a
SHA162df3e9228f1d25828038499833ea5aaf4ef1a10
SHA25672cef48fa0db6ca9da1cff9472f23762c7e570502913a0e0eb6bf7e3ab9448af
SHA512862718f8c144f31d28cd95603af68616526501a29190a2db779b4ecdd24db4ef18cbe789a9c35b9f2c4b5afd4e0a827f4d7411d54bf0ed825429cef33e8365f6
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\sessionstore-backups\recovery.jsonlz4
Filesize9KB
MD5f16b806cfbadfa2d9c3f82c7f05ed3a1
SHA1b77f69e3cf37c54358689759994c9535af73a876
SHA2566c4d592e64492cc714e5bf97711f5d55f67da706f1119a79303238a5fce27d8a
SHA5125dc017218ab038b1f05dd1d8bd89489ed1bb322663729925b987396bb3ebafeee380fe4c98771f1f0a4d374845e10ef11d9040f1c854b1c83aadc4067718cc66
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD5c33d9d668598369cec77b8d4264b220e
SHA1747a2a2059c8bf884309662af0f43c54f811f896
SHA25630c624d7b8b982faa6b71f69b3704c276d7e6c61608e984f0ac599b83a4c0d20
SHA5123f46b622f3939177b69dc84dfb45db4a9a2eecea2b27da5209f170c6d3206420e75fa1979332b766ec925cd4ff6c071a918f14930ee5a9092ce3e407c773d5dd
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\sessionstore-backups\recovery.jsonlz4
Filesize10KB
MD5c6c51e38a87d14ab03d3994ab3272394
SHA1a246cc606eb379d7b187d8fb0a026319510f1464
SHA25611fa09ad0ba2fe9585e25365db80384b4cf28fd912d0ec35f46606bb562d7daa
SHA512656123fd8287bdfecf681cbfaab5a4229b1b98c03f46a5c7ecc8d4cd4b7bfc9d40a994e33d30fb9f2306a0a653c94c88e340b4fdbbea3c0b3b52801bed2301dd
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\storage\default\https+++www.googletagmanager.com^partitionKey=%28https%2Cletsdefend.io%29\cache\morgue\158\{e889b04d-7ff1-48e5-8409-f696bc2e1b9e}.final
Filesize35KB
MD52a53a3a03b4b72f48f060c70d1d78076
SHA14e92fe01aad8debb1c5262b80657e2c75f9cbb40
SHA256671aa96eec6a596a3e9a87346c3bfa27e6ca779ae3af0f3c117b988b04cd6a32
SHA512255e886ae977ed5fd9cc8edb59ed00a98265e4a56bc9404b4be8d5cd77170aeea3d19d81cec8c44d7ae87a41523f5501087f6cd4837048edd7e5d479c596d2e4