Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
23/07/2024, 04:22
Static task
static1
Behavioral task
behavioral1
Sample
e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
Resource
win10v2004-20240709-en
General
-
Target
e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
-
Size
1.2MB
-
MD5
f4fa19f492290864259da9c9c458381c
-
SHA1
32f8b0b09a119e37ed8528a96e123a74c4d5e028
-
SHA256
e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911
-
SHA512
0d56b36d9641cde1ce89c1cc4d3fb82ff1b97a2351d1c43417f0b66448817480ef781186249f3324bf6ec81f6f2ccf8e4222fd09605f59c9e69dc97c3fb23327
-
SSDEEP
24576:JqDEvCTbMWu7rQYlBQcBiT6rprG8aLR2Sbly7TWEPje:JTvC/MTQYxsWR7aLR2dW
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel firefox.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_Classes\Local Settings firefox.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2288 firefox.exe Token: SeDebugPrivilege 2288 firefox.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2288 firefox.exe 2288 firefox.exe 2288 firefox.exe 2288 firefox.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2288 firefox.exe 2288 firefox.exe 2288 firefox.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2484 wrote to memory of 2548 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 30 PID 2484 wrote to memory of 2548 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 30 PID 2484 wrote to memory of 2548 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 30 PID 2484 wrote to memory of 2548 2484 e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe 30 PID 2548 wrote to memory of 2288 2548 firefox.exe 31 PID 2548 wrote to memory of 2288 2548 firefox.exe 31 PID 2548 wrote to memory of 2288 2548 firefox.exe 31 PID 2548 wrote to memory of 2288 2548 firefox.exe 31 PID 2548 wrote to memory of 2288 2548 firefox.exe 31 PID 2548 wrote to memory of 2288 2548 firefox.exe 31 PID 2548 wrote to memory of 2288 2548 firefox.exe 31 PID 2548 wrote to memory of 2288 2548 firefox.exe 31 PID 2548 wrote to memory of 2288 2548 firefox.exe 31 PID 2548 wrote to memory of 2288 2548 firefox.exe 31 PID 2548 wrote to memory of 2288 2548 firefox.exe 31 PID 2548 wrote to memory of 2288 2548 firefox.exe 31 PID 2288 wrote to memory of 2724 2288 firefox.exe 32 PID 2288 wrote to memory of 2724 2288 firefox.exe 32 PID 2288 wrote to memory of 2724 2288 firefox.exe 32 PID 2288 wrote to memory of 2728 2288 firefox.exe 33 PID 2288 wrote to memory of 2728 2288 firefox.exe 33 PID 2288 wrote to memory of 2728 2288 firefox.exe 33 PID 2288 wrote to memory of 2728 2288 firefox.exe 33 PID 2288 wrote to memory of 2728 2288 firefox.exe 33 PID 2288 wrote to memory of 2728 2288 firefox.exe 33 PID 2288 wrote to memory of 2728 2288 firefox.exe 33 PID 2288 wrote to memory of 2728 2288 firefox.exe 33 PID 2288 wrote to memory of 2728 2288 firefox.exe 33 PID 2288 wrote to memory of 2728 2288 firefox.exe 33 PID 2288 wrote to memory of 2728 2288 firefox.exe 33 PID 2288 wrote to memory of 2728 2288 firefox.exe 33 PID 2288 wrote to memory of 2728 2288 firefox.exe 33 PID 2288 wrote to memory of 2728 2288 firefox.exe 33 PID 2288 wrote to memory of 2728 2288 firefox.exe 33 PID 2288 wrote to memory of 2728 2288 firefox.exe 33 PID 2288 wrote to memory of 2728 2288 firefox.exe 33 PID 2288 wrote to memory of 2728 2288 firefox.exe 33 PID 2288 wrote to memory of 2728 2288 firefox.exe 33 PID 2288 wrote to memory of 2728 2288 firefox.exe 33 PID 2288 wrote to memory of 2728 2288 firefox.exe 33 PID 2288 wrote to memory of 2728 2288 firefox.exe 33 PID 2288 wrote to memory of 2728 2288 firefox.exe 33 PID 2288 wrote to memory of 2728 2288 firefox.exe 33 PID 2288 wrote to memory of 2728 2288 firefox.exe 33 PID 2288 wrote to memory of 2728 2288 firefox.exe 33 PID 2288 wrote to memory of 2728 2288 firefox.exe 33 PID 2288 wrote to memory of 2728 2288 firefox.exe 33 PID 2288 wrote to memory of 2728 2288 firefox.exe 33 PID 2288 wrote to memory of 2728 2288 firefox.exe 33 PID 2288 wrote to memory of 2728 2288 firefox.exe 33 PID 2288 wrote to memory of 2728 2288 firefox.exe 33 PID 2288 wrote to memory of 2728 2288 firefox.exe 33 PID 2288 wrote to memory of 2728 2288 firefox.exe 33 PID 2288 wrote to memory of 2728 2288 firefox.exe 33 PID 2288 wrote to memory of 2728 2288 firefox.exe 33 PID 2288 wrote to memory of 2728 2288 firefox.exe 33 PID 2288 wrote to memory of 2728 2288 firefox.exe 33 PID 2288 wrote to memory of 2728 2288 firefox.exe 33 PID 2288 wrote to memory of 2728 2288 firefox.exe 33 PID 2288 wrote to memory of 2728 2288 firefox.exe 33 PID 2288 wrote to memory of 2728 2288 firefox.exe 33 PID 2288 wrote to memory of 2728 2288 firefox.exe 33 PID 2288 wrote to memory of 2728 2288 firefox.exe 33 PID 2288 wrote to memory of 2268 2288 firefox.exe 34 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe"C:\Users\Admin\AppData\Local\Temp\e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account2⤵
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2288.0.726658667\276609377" -parentBuildID 20221007134813 -prefsHandle 1208 -prefMapHandle 1200 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e8018c20-e7fd-4935-933b-e01029df8516} 2288 "\\.\pipe\gecko-crash-server-pipe.2288" 1272 edd8b58 gpu4⤵PID:2724
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2288.1.1504917321\1755860144" -parentBuildID 20221007134813 -prefsHandle 1476 -prefMapHandle 1472 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b98388c-107d-43b1-bfe0-688507b496f9} 2288 "\\.\pipe\gecko-crash-server-pipe.2288" 1488 f70158 socket4⤵PID:2728
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2288.2.887401277\59660928" -childID 1 -isForBrowser -prefsHandle 2100 -prefMapHandle 2096 -prefsLen 21811 -prefMapSize 233444 -jsInitHandle 876 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3d4bf412-edc0-4cee-ab8e-a72cabaf12de} 2288 "\\.\pipe\gecko-crash-server-pipe.2288" 2112 1a3b3d58 tab4⤵PID:2268
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2288.3.1009640416\764664575" -childID 2 -isForBrowser -prefsHandle 2952 -prefMapHandle 2948 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 876 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {223d9cb3-1556-4947-a97c-cf15e633e78a} 2288 "\\.\pipe\gecko-crash-server-pipe.2288" 2964 1ce47558 tab4⤵PID:284
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2288.4.1013491865\1845260878" -childID 3 -isForBrowser -prefsHandle 3800 -prefMapHandle 3792 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 876 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {11748b92-0562-4158-bb2e-83de7b17020e} 2288 "\\.\pipe\gecko-crash-server-pipe.2288" 3816 1f0cfb58 tab4⤵PID:2820
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2288.5.1263086896\1533032436" -childID 4 -isForBrowser -prefsHandle 3940 -prefMapHandle 3944 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 876 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d23d08c1-9efe-41bc-887e-b496c4f167cf} 2288 "\\.\pipe\gecko-crash-server-pipe.2288" 3936 1f1a2858 tab4⤵PID:2816
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2288.6.1863380655\154813592" -childID 5 -isForBrowser -prefsHandle 4104 -prefMapHandle 4108 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 876 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f2ffc2e6-cedb-4378-8c6f-cb8743a83d82} 2288 "\\.\pipe\gecko-crash-server-pipe.2288" 4080 1f51c758 tab4⤵PID:2708
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nyws1jjf.default-release\activity-stream.discovery_stream.json.tmp
Filesize26KB
MD52f340ccff0ed8b6bc872868a9a010bd5
SHA1ab533b5e523f50ecdd4821f78424c1e6a4684a09
SHA2564313ca51c1761ed3cd98f0dd6e58fd08b56a2c425b2b75f3188d09801ca17454
SHA5127c3529d0ebfcd890183cbe6db9425658c6d29503ef222aa476323427368abc74e7bf182ae86297f20403e27b63519eb4f0595479ea1b9dd9d1cf2968f820b41f
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nyws1jjf.default-release\datareporting\glean\db\data.safe.bin
Filesize2KB
MD5bec09b944c137e25aff59933d147f81f
SHA118db5a6db3fd07c0160423bb780298ffeeb5d311
SHA256e49381cc973e27bebe7bceaaa88db0658ec21ff3afa14851bc91a2694b53fc4b
SHA5120f006b8528daae02230606a2d2e6a49d2eb471fc377f803676c6e139b8d941da598774df74fef5f1155b0fd64310d14fa8904cfa0610c94f739b3390ebaa3da7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nyws1jjf.default-release\datareporting\glean\pending_pings\27550cdb-aeb6-4d0c-9b6c-b304a3d14d1e
Filesize745B
MD5f4e9e30bd2976758bb776ab2388bcc35
SHA1fce369476fd84a2b4fb2e9c7956d7331b9d1a932
SHA256d8da73a9306de439ff2484ab3da44a7998a1471936f53877cbcf814659d6cc9a
SHA512dd1a975be4c0f56e5517bfdb68abc38d1063cf3d79e598ec2f87ccd7aa33dfdfa11fbcbc2a8e7074242a528e45a444f58351459d0c17a0e1fb372aa9b21f1b3f
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nyws1jjf.default-release\datareporting\glean\pending_pings\9f543f5f-1f04-4028-8c49-1fdd3b0cce26
Filesize10KB
MD5035f12bfc760c2623bfd770a7a700098
SHA140899d101d325a867729ded1d8f98b69b70d53f1
SHA2563c4f27c45e101d52c60cc434718fdc1960fc119e969638bab2aae71027b9f526
SHA51295e1cf81d663b620221a93f452235bc1c77756697ad705e3dd66a251b96da4f4be8388df26236bde83d6b9d00f88ac81a7d9e5d6fa2e19704beabf629ece89b6
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nyws1jjf.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nyws1jjf.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nyws1jjf.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nyws1jjf.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nyws1jjf.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nyws1jjf.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nyws1jjf.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
Filesize
7KB
MD5338dbe232dda8dca2b38893fc7311b16
SHA1c5b2a49cbc8229c88efca86cba58c96d92a7a331
SHA2563b10408ad41ea42dc3171985af66748fd88d979fdbdcc8e444e72fc7db4d6585
SHA512626fab720ea1b1118774b494eed41de9cd2aa751e11d66189bbb490c84982340d20a8f5e5b4741c0b4ac935dfdd429dcdbadf47179f0e14d6ffb1fb8fadc9c75
-
Filesize
7KB
MD59958f3776e04bb6582e622ce6c0dc7dc
SHA1ef58f2c9694349ba3f1fb3ce884f5b4135e668fd
SHA256c21d3484032677b64c9b7d4447c020b4cd5a27851af6c41460facd9df27631ac
SHA5126a994cb714a5a6d12edd6d750211521d30bd96a783e53c21c833be963c7a8248d8ddb825fba9ece5a4775ce9ea51f973915e6a44b5fd641f7d09e9d3c02dd453
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nyws1jjf.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD5378450578a9db746eed47edb0e801196
SHA1b955badd2315e633e7648fe8cbed1c5b4e1af986
SHA256f5676bedb2b195fe1263fcce756df7ff00e01bf2c3f538e85dd9db79a41cce3f
SHA512a978934ef84277afe269dc91c84235a1d0a9a7233acaa31d5cf4525b9da0e0f8734d3017055ae28befb753d31ebb605198804bc642a275b9d478f58d3c4f583a