Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
25/08/2024, 22:42
Static task
static1
Behavioral task
behavioral1
Sample
c4d8ceca57eca8abda4e05a78bfaab5c520595cc4d306d70b1c16575997eee86.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
c4d8ceca57eca8abda4e05a78bfaab5c520595cc4d306d70b1c16575997eee86.exe
Resource
win11-20240802-en
General
-
Target
c4d8ceca57eca8abda4e05a78bfaab5c520595cc4d306d70b1c16575997eee86.exe
-
Size
896KB
-
MD5
895e203a2b0491b4aaf67903e1c5d671
-
SHA1
ec65e79e969f39f911569fbdfe88d69b6407d721
-
SHA256
c4d8ceca57eca8abda4e05a78bfaab5c520595cc4d306d70b1c16575997eee86
-
SHA512
4db7e4de5f4f1acc1ccf6ab4bd9f09a2a550eb5e10ff3e916d9b99aa5984246a6d7aa0b717d70ad1a2fe774edde227ac609339ab2b9956bc22589899162ba924
-
SSDEEP
12288:eqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgarTf:eqDEvCTbMWu7rQYlBQcBiT6rprG8avf
Malware Config
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c4d8ceca57eca8abda4e05a78bfaab5c520595cc4d306d70b1c16575997eee86.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1968 c4d8ceca57eca8abda4e05a78bfaab5c520595cc4d306d70b1c16575997eee86.exe 1968 c4d8ceca57eca8abda4e05a78bfaab5c520595cc4d306d70b1c16575997eee86.exe 2312 msedge.exe 2312 msedge.exe 2040 msedge.exe 2040 msedge.exe 4720 msedge.exe 4720 msedge.exe 2388 identity_helper.exe 2388 identity_helper.exe 6856 msedge.exe 6856 msedge.exe 6856 msedge.exe 6856 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2772 firefox.exe Token: SeDebugPrivilege 2772 firefox.exe Token: SeDebugPrivilege 2772 firefox.exe Token: SeDebugPrivilege 2772 firefox.exe Token: SeDebugPrivilege 2772 firefox.exe -
Suspicious use of FindShellTrayWindow 49 IoCs
pid Process 1968 c4d8ceca57eca8abda4e05a78bfaab5c520595cc4d306d70b1c16575997eee86.exe 1968 c4d8ceca57eca8abda4e05a78bfaab5c520595cc4d306d70b1c16575997eee86.exe 1968 c4d8ceca57eca8abda4e05a78bfaab5c520595cc4d306d70b1c16575997eee86.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2772 firefox.exe 2772 firefox.exe 2772 firefox.exe 2772 firefox.exe 2772 firefox.exe 2772 firefox.exe 2772 firefox.exe 2772 firefox.exe 2772 firefox.exe 2772 firefox.exe 2772 firefox.exe 2772 firefox.exe 2772 firefox.exe 2772 firefox.exe 2772 firefox.exe 2772 firefox.exe 2772 firefox.exe 2772 firefox.exe 2772 firefox.exe 2772 firefox.exe 2772 firefox.exe -
Suspicious use of SendNotifyMessage 15 IoCs
pid Process 1968 c4d8ceca57eca8abda4e05a78bfaab5c520595cc4d306d70b1c16575997eee86.exe 1968 c4d8ceca57eca8abda4e05a78bfaab5c520595cc4d306d70b1c16575997eee86.exe 1968 c4d8ceca57eca8abda4e05a78bfaab5c520595cc4d306d70b1c16575997eee86.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2772 firefox.exe 2772 firefox.exe 2772 firefox.exe 2772 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1968 wrote to memory of 2040 1968 c4d8ceca57eca8abda4e05a78bfaab5c520595cc4d306d70b1c16575997eee86.exe 81 PID 1968 wrote to memory of 2040 1968 c4d8ceca57eca8abda4e05a78bfaab5c520595cc4d306d70b1c16575997eee86.exe 81 PID 1968 wrote to memory of 980 1968 c4d8ceca57eca8abda4e05a78bfaab5c520595cc4d306d70b1c16575997eee86.exe 84 PID 1968 wrote to memory of 980 1968 c4d8ceca57eca8abda4e05a78bfaab5c520595cc4d306d70b1c16575997eee86.exe 84 PID 2040 wrote to memory of 3380 2040 msedge.exe 85 PID 2040 wrote to memory of 3380 2040 msedge.exe 85 PID 980 wrote to memory of 2772 980 firefox.exe 86 PID 980 wrote to memory of 2772 980 firefox.exe 86 PID 980 wrote to memory of 2772 980 firefox.exe 86 PID 980 wrote to memory of 2772 980 firefox.exe 86 PID 980 wrote to memory of 2772 980 firefox.exe 86 PID 980 wrote to memory of 2772 980 firefox.exe 86 PID 980 wrote to memory of 2772 980 firefox.exe 86 PID 980 wrote to memory of 2772 980 firefox.exe 86 PID 980 wrote to memory of 2772 980 firefox.exe 86 PID 980 wrote to memory of 2772 980 firefox.exe 86 PID 980 wrote to memory of 2772 980 firefox.exe 86 PID 2772 wrote to memory of 2904 2772 firefox.exe 87 PID 2772 wrote to memory of 2904 2772 firefox.exe 87 PID 2772 wrote to memory of 2904 2772 firefox.exe 87 PID 2772 wrote to memory of 2904 2772 firefox.exe 87 PID 2772 wrote to memory of 2904 2772 firefox.exe 87 PID 2772 wrote to memory of 2904 2772 firefox.exe 87 PID 2772 wrote to memory of 2904 2772 firefox.exe 87 PID 2772 wrote to memory of 2904 2772 firefox.exe 87 PID 2772 wrote to memory of 2904 2772 firefox.exe 87 PID 2772 wrote to memory of 2904 2772 firefox.exe 87 PID 2772 wrote to memory of 2904 2772 firefox.exe 87 PID 2772 wrote to memory of 2904 2772 firefox.exe 87 PID 2772 wrote to memory of 2904 2772 firefox.exe 87 PID 2772 wrote to memory of 2904 2772 firefox.exe 87 PID 2772 wrote to memory of 2904 2772 firefox.exe 87 PID 2772 wrote to memory of 2904 2772 firefox.exe 87 PID 2772 wrote to memory of 2904 2772 firefox.exe 87 PID 2772 wrote to memory of 2904 2772 firefox.exe 87 PID 2772 wrote to memory of 2904 2772 firefox.exe 87 PID 2772 wrote to memory of 2904 2772 firefox.exe 87 PID 2772 wrote to memory of 2904 2772 firefox.exe 87 PID 2772 wrote to memory of 2904 2772 firefox.exe 87 PID 2772 wrote to memory of 2904 2772 firefox.exe 87 PID 2772 wrote to memory of 2904 2772 firefox.exe 87 PID 2772 wrote to memory of 2904 2772 firefox.exe 87 PID 2772 wrote to memory of 2904 2772 firefox.exe 87 PID 2772 wrote to memory of 2904 2772 firefox.exe 87 PID 2772 wrote to memory of 2904 2772 firefox.exe 87 PID 2772 wrote to memory of 2904 2772 firefox.exe 87 PID 2772 wrote to memory of 2904 2772 firefox.exe 87 PID 2772 wrote to memory of 2904 2772 firefox.exe 87 PID 2772 wrote to memory of 2904 2772 firefox.exe 87 PID 2772 wrote to memory of 2904 2772 firefox.exe 87 PID 2772 wrote to memory of 2904 2772 firefox.exe 87 PID 2772 wrote to memory of 2904 2772 firefox.exe 87 PID 2772 wrote to memory of 2904 2772 firefox.exe 87 PID 2772 wrote to memory of 2904 2772 firefox.exe 87 PID 2772 wrote to memory of 2904 2772 firefox.exe 87 PID 2772 wrote to memory of 2904 2772 firefox.exe 87 PID 2772 wrote to memory of 2904 2772 firefox.exe 87 PID 2772 wrote to memory of 2904 2772 firefox.exe 87 PID 2772 wrote to memory of 2904 2772 firefox.exe 87 PID 2772 wrote to memory of 2904 2772 firefox.exe 87 PID 2772 wrote to memory of 2904 2772 firefox.exe 87 PID 2772 wrote to memory of 2904 2772 firefox.exe 87 PID 2040 wrote to memory of 3960 2040 msedge.exe 88 PID 2040 wrote to memory of 3960 2040 msedge.exe 88 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4d8ceca57eca8abda4e05a78bfaab5c520595cc4d306d70b1c16575997eee86.exe"C:\Users\Admin\AppData\Local\Temp\c4d8ceca57eca8abda4e05a78bfaab5c520595cc4d306d70b1c16575997eee86.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffff74d3cb8,0x7ffff74d3cc8,0x7ffff74d3cd83⤵PID:3380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,16328793110000758119,6145838316927244267,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1832 /prefetch:23⤵PID:3960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1868,16328793110000758119,6145838316927244267,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:2312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1868,16328793110000758119,6145838316927244267,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2584 /prefetch:83⤵PID:2476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,16328793110000758119,6145838316927244267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:13⤵PID:4996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,16328793110000758119,6145838316927244267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:13⤵PID:1904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1868,16328793110000758119,6145838316927244267,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3764 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:4720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,16328793110000758119,6145838316927244267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1968 /prefetch:13⤵PID:4184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,16328793110000758119,6145838316927244267,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:13⤵PID:2256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,16328793110000758119,6145838316927244267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:13⤵PID:5204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,16328793110000758119,6145838316927244267,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:13⤵PID:5200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1868,16328793110000758119,6145838316927244267,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:2388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,16328793110000758119,6145838316927244267,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4736 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:6856
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd2⤵
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1952 -parentBuildID 20240401114208 -prefsHandle 1856 -prefMapHandle 1848 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4304420f-fd9f-4d51-b2bb-bfae35494cca} 2772 "\\.\pipe\gecko-crash-server-pipe.2772" gpu4⤵PID:2904
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2384 -prefMapHandle 2380 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b325643e-c879-4161-bee8-faf1e656d027} 2772 "\\.\pipe\gecko-crash-server-pipe.2772" socket4⤵PID:2136
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3192 -childID 1 -isForBrowser -prefsHandle 3004 -prefMapHandle 3032 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 992 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cdf089e2-bf20-4601-a77b-901f8f6e63de} 2772 "\\.\pipe\gecko-crash-server-pipe.2772" tab4⤵PID:908
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2992 -childID 2 -isForBrowser -prefsHandle 3676 -prefMapHandle 3672 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 992 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {44470310-3c7e-492a-a134-a75d9f9cacf7} 2772 "\\.\pipe\gecko-crash-server-pipe.2772" tab4⤵PID:2840
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4232 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4224 -prefMapHandle 4032 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2be125d5-35ed-4baa-b0ec-067245238cb6} 2772 "\\.\pipe\gecko-crash-server-pipe.2772" utility4⤵
- Checks processor information in registry
PID:2360
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5508 -childID 3 -isForBrowser -prefsHandle 4292 -prefMapHandle 4368 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 992 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c9d8d4f1-a1ef-4bc7-afff-cefd746165f4} 2772 "\\.\pipe\gecko-crash-server-pipe.2772" tab4⤵PID:2580
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5636 -childID 4 -isForBrowser -prefsHandle 5720 -prefMapHandle 5572 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 992 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {971251c0-020c-4d52-aeef-a6fc88ba4cfd} 2772 "\\.\pipe\gecko-crash-server-pipe.2772" tab4⤵PID:1720
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5920 -childID 5 -isForBrowser -prefsHandle 5840 -prefMapHandle 5848 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 992 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {be0ea996-a4ab-470b-b3a8-56e9570b06c5} 2772 "\\.\pipe\gecko-crash-server-pipe.2772" tab4⤵PID:2132
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5660 -childID 6 -isForBrowser -prefsHandle 5664 -prefMapHandle 5668 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 992 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {94cc4859-9a12-41a7-b9b6-1d65624aa0db} 2772 "\\.\pipe\gecko-crash-server-pipe.2772" tab4⤵PID:5132
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1944
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1112
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a8276eab0f8f0c0bb325b5b8c329f64f
SHA18ce681e4056936ca8ccd6f487e7cd7cccbae538b
SHA256847f60e288d327496b72dbe1e7aa1470a99bf27c0a07548b6a386a6188cd72da
SHA51242f91bf90e92220d0731fa4279cc5773d5e9057a9587f311bee0b3f7f266ddceca367bd0ee7f1438c3606598553a2372316258c05e506315e4e11760c8f13918
-
Filesize
152B
MD5058032c530b52781582253cb245aa731
SHA17ca26280e1bfefe40e53e64345a0d795b5303fab
SHA2561c3a7192c514ef0d2a8cf9115cfb44137ca98ec6daa4f68595e2be695c7ed67e
SHA51277fa3cdcd53255e7213bb99980049e11d6a2160f8130c84bd16b35ba9e821a4e51716371526ec799a5b4927234af99e0958283d78c0799777ab4dfda031f874f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize336B
MD56d9f5b267a01d6c508d898b816d4294f
SHA1d7fff7736f8eaca3b670ef0ee0e31d9152bbf712
SHA25670ada56425a9ba9c3a0f741a2eb4c427008dd38bc3889b627ef838790e23ef95
SHA512cc60ce6882fc43add36b849213af3ca07cf315a014a0cc32a891e6fee98cad81b50485f6f5df1d6ab284a7102e80757c9d3e4e39e0d43e41caf74cd3d2fd7d90
-
Filesize
1KB
MD5934c0d4ee628dee1e687a0e0490f1eaf
SHA14bfb96b199b61f880a44aeb0a740ee8177304b40
SHA256560a9cf5b23838e1e7a68e3fb85f05a381b14f031780ec02f68307c10b5f0f19
SHA5121dcc2d4c384b4c89212ee496d720a90f5e8c273ca1890ab3b9a2efe46ee3f331a95bc8758c2b472c317dcc976b7d58a13bb66ba0d018080107d3f8289043a203
-
Filesize
1KB
MD5763976fb12de51c27faf87e7006ee948
SHA10d63a0a87c318480b8fb89a1d8e17e61a23ed1a3
SHA256977e2a77353918222c39c5c6fd1062d11147ccd94f2413703a0e007c255deba7
SHA51221c62f7acf5847cee4f73021b5287391fea23387d63662328a04958097cadb0e16b0c68f272e086798891712bad0ed4a05a0185243a858fb0b63f2a838451ae5
-
Filesize
5KB
MD5e96fcfcfdb15bb21283359db6ba9c198
SHA12dd4bb02f2236b9071ca61caa0096f5a5d951056
SHA256cf5a5efdc89fd6eade4b96da6bd7371cfe4cf214c097474b2f224aa7171cc3d3
SHA512a0e4e6e98add2c04868c489bab8216a8f60b97f42da62ec06c56b88ff167a1e9e3a8e9259a44f72d39731413e95c216c6e1db3af2808c6155dde9dac11a5d996
-
Filesize
6KB
MD5644160ed473d991e1f1a2c502f17bcdb
SHA1db7f643d252c4b9798c0e364f172cbdbce2a9df9
SHA25692321dca3cb4a6bea312e40e2404e820783349744af66581a2a6e87c6855ce2a
SHA51208656ba5f85c097c97984c65026d3b49c186399b31e245fe85154cd12e5a5ef7bc09f5796d1c9e55f2cd534841885f40eecebbd4880776e217534f7053fb304b
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
11KB
MD537f4f1e126ffe28e421bfc04c40ce3e1
SHA18554a48d53c26021a5c2194e07606b60f42b92fc
SHA256536ac20250951d0d9c2a1ea728c05dd8466ca1f55cb973b214950c8214709a03
SHA51264917dfaa506e23fb13097a08e4b94b809937e0469a33548bd4ce298d01644784ef3d48a98c70245488daa82cc08a71c28611a7272c148a69020de4d0514be6a
-
Filesize
10KB
MD50e50dd0a84a7ff1a870cca60783403f5
SHA1f050ae2727929962871896e4d0eaf8ac4770296e
SHA256103a9799502f03dd6234981120a4979429f2c59b574720d1b7c7feb100f198b4
SHA5120d6065ab27f464d2619164e7fc9997f404a4936770df443ff0b39846a786a5b6b536aff1adad07fa33aa2cb49686c9050f95e50b78d4bb0e87eff0531c06f435
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zgr882s2.default-release\activity-stream.discovery_stream.json
Filesize45KB
MD5b4d77c68ac70af6624bf8920a57573bc
SHA1b1bd7dad1256df8e326ab457da0f409cec06f7e1
SHA256624fc8b2458708441daed3759af597d8a9c4ea86661bf390dce9f112e90e926b
SHA5121bfdef2b06cf4d475816b313d9aa7da44da6f215699666d40401156eb42c756bb152a083d41fa7361d13d21bcb4bb5489b23b152bdc8b50e008b4f585e100009
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zgr882s2.default-release\cache2\entries\58EFA56DB4BFFECB0EDA547894BC9A057159E22F
Filesize13KB
MD59ea91e9c50699cd91dc9b09f4f9962ae
SHA1d99211de418974785e7b3e44e4b0acc44dc5b86a
SHA2568e09d2fb0884d009952cdb2e02b0c2b6ebe2e345d77538825016ca0f686c3926
SHA5128665051d70556ec493653a55d7d1ff950794c417654166f615cc5fc664945659e2d91137bfe8969d0259750e24d779a60a5a52bc188182da202d40647eeb32f2
-
Filesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
Filesize
13.8MB
MD50a8747a2ac9ac08ae9508f36c6d75692
SHA1b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA25632d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA51259521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\AlternateServices.bin
Filesize10KB
MD55add2212e7568d273eb5c9e73cd883f2
SHA11f50fccb416e9aadfff23b11909750f6f80d01a6
SHA256cb7aa6f2f6e8585330cff66c675b8494b9275fe7928a4e3695998a831eb63f4a
SHA51231805326a9f0dd66eb776e58705cd76399ef0b0272904af057e40fe07263f8dd43070c56c90bb6faffead713faf0a14e7e1ccee5249522bd2a31c0b96b90ed03
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\db\data.safe.tmp
Filesize5KB
MD5b72b25de829447f3ebf5e9844b47311a
SHA180a76a59421148e54986d392cac700688e4cef40
SHA256e2b69c23c44b81d43a5d5d69148504a1dbcb8c2f6b1aa9c971f7d14230f2fd02
SHA512c6ba0cc2e208cd8ce819d5408729ec457728bee60a03fc2d79e66b293155fba25ee426cb84b9de70f77ab49178a6951e8be73d4da11de8b0cd0982fcad8f8c65
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\db\data.safe.tmp
Filesize6KB
MD5fa4fc74dcf3a28416c821e42eb7e1ac2
SHA1b37d8ad714518c330fc45b49fbc9e4dd9abe4cad
SHA256e7088adfafe0f791de9a3808fd2c72d435020daf93c121a9e9adf070d80a5b11
SHA5127079faf47caecf0a1b06920d151d3b38a98cd6fe8fd41393dd9817312c5511d0abfca9b2dd38535f8bace118f693f3ef53eef9212fe14a509681421aabef485e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\db\data.safe.tmp
Filesize15KB
MD5496a2503a913db0bc4f607d290f1b269
SHA10516048f7ee6cdf37bd07280f44ea99c3e8b1dfd
SHA25654e0190ca89ab55355d2c208436ab36a3f85f4e122b2946004931521b71e8826
SHA51228ac0359eb51e06388cca5b7a3ecefdef972a591400315f60d7e544cf0c940e964745ef6a48f43edf2143a3fb088b2832fd2c68d063d8558d11cc8017fd2c47f
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\db\data.safe.tmp
Filesize15KB
MD50b78fb9af2701808ca2e65795e19b509
SHA175e736140334d6ab80edf199a08d940281a8dbfd
SHA256878bf82f2511b06c7c127393473b4385f7d0e0f7693eb5ff212af7803751a559
SHA5126315620b657917ed1db1f3c8e64e63e22343fd64a7d125b5e9c37b1ca54a127e22b03053bb0a97a0689250f2c870cdacaeba4087a44c615895b19d09efdac142
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\pending_pings\25760a07-cc24-4148-8047-a3f82538c0a3
Filesize671B
MD5a37ed3956298831779d3573b7a713a7c
SHA1047150ef7195c8118696e82c349cd145a148e900
SHA256567ed899c869c1731ade913e9bb307a8bc629d9d5696f6592e206ec1244e9af2
SHA512d9f6fad26cbfa2d46c42a78990f0345bafe0c1343f4dcb9885b46777ba1b024740273a717697b8bdd34b65b1c43c6a5005091e4c6c065b2318b1cb1ce520d30e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\pending_pings\a7b9b9b8-6376-4fee-bfd0-393ee2e0e5a6
Filesize25KB
MD5b33a583cd184a9b0df9630d88212afcc
SHA1b1bd155bca5af33f093be15f79a2b456e140b72a
SHA256626c6fa8412a74e2c144d7bac75f95820f77c99b63fd019b040e143cc967dd0a
SHA512863be38872c93796600d8e9d267fb06d915fd30003c088b2c9bb8f57b830a38694618c524f37f2aaa5d63392fcd0ba521db791b57e048093f37b6c02252ba970
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\pending_pings\ba39ae29-199b-4d41-b792-9570d78ced11
Filesize982B
MD5779523fdfaaf0093dbc1e30def8ff15e
SHA1fa379de9a18d2fb6711b58eb998caa7443ee1344
SHA256d96ac81cb2853a130524a666ef33fa3dd4e8cf50e1f05be4571fd968f65c62fb
SHA5129672f9053d8ae5c8b5be7a7fbae92a2536c520dd707fda510c271d28272f95e71321a9e1e70e9fd716ed64adc2372837f729c4be9fc2d65c8063c2777f78af44
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Filesize1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Filesize116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Filesize372B
MD5bf957ad58b55f64219ab3f793e374316
SHA1a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA51279c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Filesize17.8MB
MD5daf7ef3acccab478aaa7d6dc1c60f865
SHA1f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA5125840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
-
Filesize
11KB
MD5fb4a8669d5e6767668a904774272f18f
SHA1a43f07594188ba2c4c95743ca5681e63f2d2d99c
SHA25678f0f203edc51a0a4506f7870d9377dcff35003c9772cf299237a0467d35afa8
SHA512a948b69be6b581347896d1e22bd2383f759675c16d1ede9076100c33df9728f596a3b84f1a17374ae5d72d2c8c72144f54b36920dad799f3e50ad41e83665c24
-
Filesize
16KB
MD51cb1e532b62bcf5cbcf69115441b0456
SHA1ac4bbada59c4683d7a3325318dc58fda3eccfde6
SHA256257450b0cc037ef7dfd1ac2f2a09a1359fad2871e57b571a07593677fd8f8dbb
SHA512881c807dc781f5f6034c1cb27b104b338dd26c05ab754f1d0c501a3a519de24fb89fa23d64596178f5fc0baea885dced5ac87242a012dc2e816018f992a6f17f
-
Filesize
12KB
MD5bddb2c8e9d2abb9252c1b3431bee9467
SHA1e5c10ef7128114ff484b795ae92f9c577d3918c1
SHA256fe52cd059a8f45162f343a9c1e7e4d8207872d5d4a3ce5f2551b435bffd219dd
SHA512d5b6225411e51a0d7338ed51bb31d70ac65f526e828376c719b412b5185e64cb1eb143fae5eb575b20405bcdc30e75e165513ea497cd947beb93004c8e02cdb2
-
Filesize
10KB
MD5fcdd8e8a331fb2fb0897c4cfdcc43e85
SHA10a049975da7db4b9795b7c25eae0bc10cf86480a
SHA25695499ae3e58f42aff4bdafd07af6e75fd1fc0566d74694b92e159527509f97c9
SHA5124174abd504e15b43012ffb78aa0bdf1540400a2ac4583848b8b72974759513411fab9b7a6ba2528187ba5e7204e03f17f9dbe62e38e8e305846b73332d8d6ea2