Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
19/07/2024, 14:49
Static task
static1
Behavioral task
behavioral1
Sample
37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe
Resource
win10v2004-20240709-en
General
-
Target
37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe
-
Size
1.2MB
-
MD5
7db296a5f3818d7d11d994f2a26cc6c3
-
SHA1
7e56f88358d914b90ee037145b14c622a52dd47b
-
SHA256
37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473
-
SHA512
fb498212823d9c1b13d1179ff37bbf6fd1fe671206f3021f5418fe47814ac6ef99149cef4434c46fa438f0a73a1c73304e41bf3629c1438a7176354b0086d065
-
SSDEEP
24576:qqDEvCTbMWu7rQYlBQcBiT6rprG8aLo2Sbly7TWEPje:qTvC/MTQYxsWR7aLo2dW
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings firefox.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 840 firefox.exe Token: SeDebugPrivilege 840 firefox.exe Token: SeDebugPrivilege 840 firefox.exe Token: SeDebugPrivilege 840 firefox.exe Token: SeDebugPrivilege 840 firefox.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 840 firefox.exe 840 firefox.exe 840 firefox.exe 840 firefox.exe 840 firefox.exe 840 firefox.exe 840 firefox.exe 840 firefox.exe 840 firefox.exe 840 firefox.exe 840 firefox.exe 840 firefox.exe 840 firefox.exe 840 firefox.exe 840 firefox.exe 840 firefox.exe 840 firefox.exe 840 firefox.exe 840 firefox.exe 840 firefox.exe 840 firefox.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 840 firefox.exe 840 firefox.exe 840 firefox.exe 840 firefox.exe 840 firefox.exe 840 firefox.exe 840 firefox.exe 840 firefox.exe 840 firefox.exe 840 firefox.exe 840 firefox.exe 840 firefox.exe 840 firefox.exe 840 firefox.exe 840 firefox.exe 840 firefox.exe 840 firefox.exe 840 firefox.exe 840 firefox.exe 840 firefox.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 840 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4276 wrote to memory of 1668 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 89 PID 4276 wrote to memory of 1668 4276 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe 89 PID 1668 wrote to memory of 840 1668 firefox.exe 92 PID 1668 wrote to memory of 840 1668 firefox.exe 92 PID 1668 wrote to memory of 840 1668 firefox.exe 92 PID 1668 wrote to memory of 840 1668 firefox.exe 92 PID 1668 wrote to memory of 840 1668 firefox.exe 92 PID 1668 wrote to memory of 840 1668 firefox.exe 92 PID 1668 wrote to memory of 840 1668 firefox.exe 92 PID 1668 wrote to memory of 840 1668 firefox.exe 92 PID 1668 wrote to memory of 840 1668 firefox.exe 92 PID 1668 wrote to memory of 840 1668 firefox.exe 92 PID 1668 wrote to memory of 840 1668 firefox.exe 92 PID 840 wrote to memory of 1248 840 firefox.exe 94 PID 840 wrote to memory of 1248 840 firefox.exe 94 PID 840 wrote to memory of 1248 840 firefox.exe 94 PID 840 wrote to memory of 1248 840 firefox.exe 94 PID 840 wrote to memory of 1248 840 firefox.exe 94 PID 840 wrote to memory of 1248 840 firefox.exe 94 PID 840 wrote to memory of 1248 840 firefox.exe 94 PID 840 wrote to memory of 1248 840 firefox.exe 94 PID 840 wrote to memory of 1248 840 firefox.exe 94 PID 840 wrote to memory of 1248 840 firefox.exe 94 PID 840 wrote to memory of 1248 840 firefox.exe 94 PID 840 wrote to memory of 1248 840 firefox.exe 94 PID 840 wrote to memory of 1248 840 firefox.exe 94 PID 840 wrote to memory of 1248 840 firefox.exe 94 PID 840 wrote to memory of 1248 840 firefox.exe 94 PID 840 wrote to memory of 1248 840 firefox.exe 94 PID 840 wrote to memory of 1248 840 firefox.exe 94 PID 840 wrote to memory of 1248 840 firefox.exe 94 PID 840 wrote to memory of 1248 840 firefox.exe 94 PID 840 wrote to memory of 1248 840 firefox.exe 94 PID 840 wrote to memory of 1248 840 firefox.exe 94 PID 840 wrote to memory of 1248 840 firefox.exe 94 PID 840 wrote to memory of 1248 840 firefox.exe 94 PID 840 wrote to memory of 1248 840 firefox.exe 94 PID 840 wrote to memory of 1248 840 firefox.exe 94 PID 840 wrote to memory of 1248 840 firefox.exe 94 PID 840 wrote to memory of 1248 840 firefox.exe 94 PID 840 wrote to memory of 1248 840 firefox.exe 94 PID 840 wrote to memory of 1248 840 firefox.exe 94 PID 840 wrote to memory of 1248 840 firefox.exe 94 PID 840 wrote to memory of 1248 840 firefox.exe 94 PID 840 wrote to memory of 1248 840 firefox.exe 94 PID 840 wrote to memory of 1248 840 firefox.exe 94 PID 840 wrote to memory of 1248 840 firefox.exe 94 PID 840 wrote to memory of 1248 840 firefox.exe 94 PID 840 wrote to memory of 1248 840 firefox.exe 94 PID 840 wrote to memory of 1248 840 firefox.exe 94 PID 840 wrote to memory of 1248 840 firefox.exe 94 PID 840 wrote to memory of 1248 840 firefox.exe 94 PID 840 wrote to memory of 1248 840 firefox.exe 94 PID 840 wrote to memory of 1248 840 firefox.exe 94 PID 840 wrote to memory of 1248 840 firefox.exe 94 PID 840 wrote to memory of 1248 840 firefox.exe 94 PID 840 wrote to memory of 1248 840 firefox.exe 94 PID 840 wrote to memory of 1248 840 firefox.exe 94 PID 840 wrote to memory of 3228 840 firefox.exe 95 PID 840 wrote to memory of 3228 840 firefox.exe 95 PID 840 wrote to memory of 3228 840 firefox.exe 95 PID 840 wrote to memory of 3228 840 firefox.exe 95 PID 840 wrote to memory of 3228 840 firefox.exe 95 PID 840 wrote to memory of 3228 840 firefox.exe 95 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe"C:\Users\Admin\AppData\Local\Temp\37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account2⤵
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1980 -parentBuildID 20240401114208 -prefsHandle 1908 -prefMapHandle 1900 -prefsLen 25755 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a8afc292-a5de-4a67-8d74-dc30c493f5dc} 840 "\\.\pipe\gecko-crash-server-pipe.840" gpu4⤵PID:1248
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2420 -parentBuildID 20240401114208 -prefsHandle 2412 -prefMapHandle 2400 -prefsLen 26675 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7bb2192b-44b9-4c59-a1e4-8464b6071662} 840 "\\.\pipe\gecko-crash-server-pipe.840" socket4⤵PID:3228
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3084 -childID 1 -isForBrowser -prefsHandle 1440 -prefMapHandle 1436 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0a520560-527b-4834-b994-b333bb919cd8} 840 "\\.\pipe\gecko-crash-server-pipe.840" tab4⤵PID:1256
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3968 -childID 2 -isForBrowser -prefsHandle 3960 -prefMapHandle 3952 -prefsLen 31165 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4432a2fb-3a9b-4001-9b9c-c15e1171a36f} 840 "\\.\pipe\gecko-crash-server-pipe.840" tab4⤵PID:4216
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4796 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4768 -prefMapHandle 4764 -prefsLen 31165 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4064de41-aec5-4159-98cf-75b954b8e6c8} 840 "\\.\pipe\gecko-crash-server-pipe.840" utility4⤵
- Checks processor information in registry
PID:3016
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5236 -childID 3 -isForBrowser -prefsHandle 5228 -prefMapHandle 5216 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d231f23-ff9b-4f95-8c92-201d8273ab41} 840 "\\.\pipe\gecko-crash-server-pipe.840" tab4⤵PID:5664
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5396 -childID 4 -isForBrowser -prefsHandle 5356 -prefMapHandle 5252 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {73b2a09d-b748-4e46-89a6-23b89107fba4} 840 "\\.\pipe\gecko-crash-server-pipe.840" tab4⤵PID:5676
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5560 -childID 5 -isForBrowser -prefsHandle 5568 -prefMapHandle 5572 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c81c79b8-df01-4525-a363-2aae88a784bc} 840 "\\.\pipe\gecko-crash-server-pipe.840" tab4⤵PID:5688
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ehv06adt.default-release\activity-stream.discovery_stream.json.tmp
Filesize25KB
MD52d98af7ee492759e8a3da3055e22cf3c
SHA188655b01f4b24608a68ed5bf25a0657ffdbda1c5
SHA2567a272b578b719d4c996e7cca5889776404e4344c506440982b55702cf47d6366
SHA5121c744c8cac57205fd4bc60ae14f7323059251197a651f645f028973a4b9987b420ec01f767e9a859e1185579fa87b692611c9bef7f1b1391e655e5c9ba0d0abb
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ehv06adt.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D
Filesize13KB
MD5819876eb818728f1808de2a48d121065
SHA1539172fef5cb709f5dd69051e5b427c9587d12b3
SHA256f5d086177ae4bd3c5dcc88a692469e4d09501f6af0628d8baa2d731f83a5b651
SHA512c23dc534421338f624ed667b0e4feb844cde463be07cee9504c24735c53d015f256e42fb818a227988a6465407db7339106031c1d303767b60b5369bcd7ed15f
-
Filesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
Filesize
13.8MB
MD50a8747a2ac9ac08ae9508f36c6d75692
SHA1b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA25632d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA51259521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\AlternateServices.bin
Filesize17KB
MD516aeff1e07b5a882bce95ac7d0ba8677
SHA1352c7eefba254284644f649a7cd78f17a266f525
SHA256588b4c9a3ce14029e6c8b57dc4ccbd69c1552b53a9c5a5918fc1995fdc916e46
SHA5124f883badb53e47e2d14e987b847b4a4fd5e342bd4f1332c20e907c798e22f812a66e76c4fb037e710358016a1bccbb3a5144f41e5b7d4a53265ac866b54c738d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\AlternateServices.bin
Filesize8KB
MD51a62ccc1d0e79967694ce1eabd44619a
SHA199ac738f5b553974de2f408c1426bd98a7b42236
SHA2562dcdecd2d787c6af485d25e15b1d9c5864c00e79c816ab19b28b445213885f8d
SHA512dba4240ad163c1ef51530d485779cb9ef133ea2946994436fc84378938a7930a45f0fc86c33745ea77b6f89f78a3cac6f78835860cf6d859330a5d11b242ecd9
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\AlternateServices.bin
Filesize12KB
MD52a9aa42784a01ba8ea71ad3632bcb002
SHA114f85f3a3991beca96cce92b36b77d1c854193c6
SHA256f44b0faac32354193acbae92f95a23bfdf7f00989cbc1c93746bd1f16df031df
SHA51225fa8c3906e2dfd44990d105b514fb0c3c5c47ca95d487292efaa0d9a2f1eeded3017dde0803530041d8e2733f2f53f0237fe4e2d979fd82fcb3b428f3902fac
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\datareporting\glean\db\data.safe.tmp
Filesize5KB
MD5d771cc8d19e365ae6f71b104dcc1225c
SHA17329322699ce206ea9b2c9b6f5245645c6e05294
SHA25644ac8a121f8ecd6b6b112a2e8fdc568cee619ac2fe3a64eb99c0dd5f6b449f4c
SHA5124aebf3beb7f5f02fd1d9e033ac48e0835962eb41da331bda48496f5c3fdf71a94895cc40619251c5f5ef5b3bd8a4fd8926bef3958a5cce42c4ba43274fe984e1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\datareporting\glean\db\data.safe.tmp
Filesize16KB
MD583c83e1191795c7542e6af4c15552c22
SHA1e97088edc22eb9b17528f672d2b37874778cfbf6
SHA2565c962b07723e72ac1569fd3ee4c775c85752839ebc7ec5e80b301ed831b48384
SHA51224c09399fcb923b7344533184685518c59bc6902427143b3757442b8aaca1acb9179434aa4361da034aea6eff1e183d892be16c162d7761bd409985c88373219
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\datareporting\glean\pending_pings\60153189-70b3-40f0-a1e1-8b479fcab8dc
Filesize671B
MD52d1516a3e3eb1dcc0d4cafeabe7e9062
SHA19db38feb184aaf44bc62583501e9d5fdc3094ed9
SHA256e97780f5c44ae0491920c148caffd6f7a820dfad1085fa14a6ba0c60fa3cae74
SHA512b66fb8539fdf2495796a05c94aad3fe803495b49ecbf86b79b29796721039ab6e884fe65aa8964075be5fb265fc9174414b2bb4c2e169e6d150cc47ddf5c4d22
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\datareporting\glean\pending_pings\cd91c76a-a182-42dd-b824-43f4c6698a3f
Filesize27KB
MD5934f78972c0e1edaa472771503b64415
SHA1776e33ef6dca42e1fca4d5a480f92046fdb17eb3
SHA2562d68bb0ef7dafaa3e28c1670498aae7a88259bfff02013be9e0119258426f678
SHA51235b2d85b90914eccbcb770370dfdcdc1c529c60fe1e094217d21647bf39893b4ba840149d0f57e8a5518473cc21c634153babac70fe43616935ad94ca3924996
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\datareporting\glean\pending_pings\ffbebe69-1ed6-47d9-b3eb-4be82b155a83
Filesize982B
MD5dd383115e77ebada9600b2a14836cde4
SHA14ec155b4c2a33f5e7958b0f29fbf29edc2158fa3
SHA2561a1e286e34d11e50eba9b8438abdba25559c5ca44e4c407201822fedecfee434
SHA5129a34e613929bdc3cf484992af65694b5528a68b91b277ad2dfb2310bb55e12d9dbf9cd2e657a1c879a2b460cb20f649bc6240b9e5c657699663a372f4d0f6c38
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Filesize1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Filesize116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Filesize372B
MD5bf957ad58b55f64219ab3f793e374316
SHA1a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA51279c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Filesize17.8MB
MD5daf7ef3acccab478aaa7d6dc1c60f865
SHA1f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA5125840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
-
Filesize
11KB
MD55267e1ebfea5777a0a1ccd53eab21b2d
SHA1421f526ac463fce1f8fbb398c926252ac8071573
SHA2568b8b9bc0a8c4ecefed6520e1fd327a11e34f77e8e7255d5940f8b78ad36db4f8
SHA512d467dab88cbbf840c43557aa5b971e2b7df910dcb6aebfaf496ea12a5f143c09c1f1b9e7d19a110efa6c7b6031dab7930d912134235039465cf475bfcb247f1f
-
Filesize
12KB
MD517f21ead54703a1170ba1341e34e9afc
SHA1f415b89a311115968ec8be782217a5e8f0d52cd8
SHA256a9ede3f803d37586c7bcf969b4ed380857bf88d9c30dcad4b312b2d2e61923b3
SHA5129448bbba8c3101efc45c66052b78c092b10cf4cf5f6e2ce623a861454d1678f678e4b3f7af9cf1ffac17a322ff51fd66fe7bb195974fba03fee68e5abc0dfd02
-
Filesize
16KB
MD57d74fa6001b01c51a94f8e4e4dc1609e
SHA1fc5c92f62e23f83aaaf8c519179f3c5af415ab39
SHA25623455514957d549e6129fefa807224ac5ca32cbd1f85cd1a0e7836d74e19bdf4
SHA51223d78aca485209cd03beb4278ad0623e13c5f7bb780473c4ee7283ecc6004d4aa68ea3f22061e847038fdc994cae5938058ec07c59d306d26cef49428243fbd6
-
Filesize
8KB
MD58d20a4dc42321b2485af2bf12ee7d41e
SHA1f035ff75092bd6c8b9346e9f881dbe1150c816be
SHA256e5f32fb8242ecf19aa33aaaa957be17ab6c328857477416d4795230ac13f6a9c
SHA5127116611aab51b12ef6d5c17f16cca54d706dd0421b644f92b16932f8cacca178b9b2c140f15012250f4902204da76cfcf4794beb6e4024af785eab9431597674