Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
29s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
18/08/2024, 19:54
Static task
static1
Behavioral task
behavioral1
Sample
rama.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
rama.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
rama.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
rama.exe
Resource
win11-20240802-en
General
-
Target
rama.exe
-
Size
1.8MB
-
MD5
6e5042ff1ec6df9aee18f4eea7864524
-
SHA1
19e4eaaec31c8512b191138a439b6c4c7ba73d18
-
SHA256
420a1ba2737e39704e52e1ea0c2494d8c232f10e2b40971923959da4708b3b0c
-
SHA512
ac5c8537bfd0a509ab49911cdf180778e9e47f9f9fb600933b2ba03f939f9bc9834db5a106840382ee648b289cddaf69b55cf969f51b9f89c49c678f1edc202c
-
SSDEEP
49152:2M3rvEOaXgE3YC8ZtDYYuyVcBUpxOePEEmeweNX9:24E9QiYC2DYscuEEmdu
Malware Config
Extracted
amadey
4.41
c7817d
http://31.41.244.10
-
install_dir
0e8d0864aa
-
install_file
svoutse.exe
-
strings_key
5481b88a6ef75bcf21333988a4e47048
-
url_paths
/Dem7kTu/index.php
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ rama.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ svoutse.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rama.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rama.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svoutse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion svoutse.exe -
Executes dropped EXE 2 IoCs
pid Process 1820 svoutse.exe 2332 a96907737a.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Wine rama.exe Key opened \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Wine svoutse.exe -
Loads dropped DLL 3 IoCs
pid Process 1320 rama.exe 1820 svoutse.exe 1820 svoutse.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\a96907737a.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000008001\\a96907737a.exe" svoutse.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1320 rama.exe 1820 svoutse.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\svoutse.job rama.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svoutse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a96907737a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rama.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel firefox.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1320 rama.exe 1820 svoutse.exe 2104 chrome.exe 2104 chrome.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeDebugPrivilege 1760 firefox.exe Token: SeDebugPrivilege 1760 firefox.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe -
Suspicious use of FindShellTrayWindow 39 IoCs
pid Process 1320 rama.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 1760 firefox.exe 2104 chrome.exe 1760 firefox.exe 2104 chrome.exe 2104 chrome.exe 1760 firefox.exe 2104 chrome.exe 1760 firefox.exe -
Suspicious use of SendNotifyMessage 35 IoCs
pid Process 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 1760 firefox.exe 2104 chrome.exe 1760 firefox.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 1760 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1320 wrote to memory of 1820 1320 rama.exe 30 PID 1320 wrote to memory of 1820 1320 rama.exe 30 PID 1320 wrote to memory of 1820 1320 rama.exe 30 PID 1320 wrote to memory of 1820 1320 rama.exe 30 PID 1820 wrote to memory of 2332 1820 svoutse.exe 33 PID 1820 wrote to memory of 2332 1820 svoutse.exe 33 PID 1820 wrote to memory of 2332 1820 svoutse.exe 33 PID 1820 wrote to memory of 2332 1820 svoutse.exe 33 PID 2332 wrote to memory of 1672 2332 a96907737a.exe 34 PID 2332 wrote to memory of 1672 2332 a96907737a.exe 34 PID 2332 wrote to memory of 1672 2332 a96907737a.exe 34 PID 2332 wrote to memory of 1672 2332 a96907737a.exe 34 PID 1672 wrote to memory of 2104 1672 cmd.exe 36 PID 1672 wrote to memory of 2104 1672 cmd.exe 36 PID 1672 wrote to memory of 2104 1672 cmd.exe 36 PID 1672 wrote to memory of 2396 1672 cmd.exe 37 PID 1672 wrote to memory of 2396 1672 cmd.exe 37 PID 1672 wrote to memory of 2396 1672 cmd.exe 37 PID 2396 wrote to memory of 1760 2396 firefox.exe 38 PID 2396 wrote to memory of 1760 2396 firefox.exe 38 PID 2396 wrote to memory of 1760 2396 firefox.exe 38 PID 2396 wrote to memory of 1760 2396 firefox.exe 38 PID 2396 wrote to memory of 1760 2396 firefox.exe 38 PID 2396 wrote to memory of 1760 2396 firefox.exe 38 PID 2396 wrote to memory of 1760 2396 firefox.exe 38 PID 2396 wrote to memory of 1760 2396 firefox.exe 38 PID 2396 wrote to memory of 1760 2396 firefox.exe 38 PID 2396 wrote to memory of 1760 2396 firefox.exe 38 PID 2396 wrote to memory of 1760 2396 firefox.exe 38 PID 2396 wrote to memory of 1760 2396 firefox.exe 38 PID 2104 wrote to memory of 1712 2104 chrome.exe 39 PID 2104 wrote to memory of 1712 2104 chrome.exe 39 PID 2104 wrote to memory of 1712 2104 chrome.exe 39 PID 1760 wrote to memory of 2996 1760 firefox.exe 40 PID 1760 wrote to memory of 2996 1760 firefox.exe 40 PID 1760 wrote to memory of 2996 1760 firefox.exe 40 PID 1760 wrote to memory of 1496 1760 firefox.exe 42 PID 1760 wrote to memory of 1496 1760 firefox.exe 42 PID 1760 wrote to memory of 1496 1760 firefox.exe 42 PID 1760 wrote to memory of 1496 1760 firefox.exe 42 PID 1760 wrote to memory of 1496 1760 firefox.exe 42 PID 1760 wrote to memory of 1496 1760 firefox.exe 42 PID 1760 wrote to memory of 1496 1760 firefox.exe 42 PID 1760 wrote to memory of 1496 1760 firefox.exe 42 PID 1760 wrote to memory of 1496 1760 firefox.exe 42 PID 1760 wrote to memory of 1496 1760 firefox.exe 42 PID 1760 wrote to memory of 1496 1760 firefox.exe 42 PID 1760 wrote to memory of 1496 1760 firefox.exe 42 PID 1760 wrote to memory of 1496 1760 firefox.exe 42 PID 1760 wrote to memory of 1496 1760 firefox.exe 42 PID 1760 wrote to memory of 1496 1760 firefox.exe 42 PID 1760 wrote to memory of 1496 1760 firefox.exe 42 PID 1760 wrote to memory of 1496 1760 firefox.exe 42 PID 1760 wrote to memory of 1496 1760 firefox.exe 42 PID 1760 wrote to memory of 1496 1760 firefox.exe 42 PID 1760 wrote to memory of 1496 1760 firefox.exe 42 PID 1760 wrote to memory of 1496 1760 firefox.exe 42 PID 1760 wrote to memory of 1496 1760 firefox.exe 42 PID 1760 wrote to memory of 1496 1760 firefox.exe 42 PID 1760 wrote to memory of 1496 1760 firefox.exe 42 PID 1760 wrote to memory of 1496 1760 firefox.exe 42 PID 1760 wrote to memory of 1496 1760 firefox.exe 42 PID 1760 wrote to memory of 1496 1760 firefox.exe 42 PID 1760 wrote to memory of 1496 1760 firefox.exe 42 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\rama.exe"C:\Users\Admin\AppData\Local\Temp\rama.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\1000008001\a96907737a.exe"C:\Users\Admin\AppData\Local\Temp\1000008001\a96907737a.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\E560.tmp\E561.tmp\E562.bat C:\Users\Admin\AppData\Local\Temp\1000008001\a96907737a.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password"5⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7219758,0x7fef7219768,0x7fef72197786⤵PID:1712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1168 --field-trial-handle=1368,i,13793652152911531255,11638423389261553988,131072 /prefetch:26⤵PID:2452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1400 --field-trial-handle=1368,i,13793652152911531255,11638423389261553988,131072 /prefetch:86⤵PID:2052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1480 --field-trial-handle=1368,i,13793652152911531255,11638423389261553988,131072 /prefetch:86⤵PID:3044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2308 --field-trial-handle=1368,i,13793652152911531255,11638423389261553988,131072 /prefetch:16⤵PID:1612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2316 --field-trial-handle=1368,i,13793652152911531255,11638423389261553988,131072 /prefetch:16⤵PID:2356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2092 --field-trial-handle=1368,i,13793652152911531255,11638423389261553988,131072 /prefetch:26⤵PID:3508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3468 --field-trial-handle=1368,i,13793652152911531255,11638423389261553988,131072 /prefetch:16⤵PID:3680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3432 --field-trial-handle=1368,i,13793652152911531255,11638423389261553988,131072 /prefetch:86⤵PID:4016
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" "https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password"5⤵
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password6⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1760.0.232382003\694153471" -parentBuildID 20221007134813 -prefsHandle 1216 -prefMapHandle 1208 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {30d52747-dfe0-4ca7-ab28-bca4999a797d} 1760 "\\.\pipe\gecko-crash-server-pipe.1760" 1308 45d6258 gpu7⤵PID:2996
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1760.1.133539589\280012840" -parentBuildID 20221007134813 -prefsHandle 1492 -prefMapHandle 1488 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {98ec20c6-da15-4c89-bd0a-52830773ff77} 1760 "\\.\pipe\gecko-crash-server-pipe.1760" 1516 e72458 socket7⤵PID:1496
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1760.2.2103892038\375904984" -childID 1 -isForBrowser -prefsHandle 1980 -prefMapHandle 2000 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b6f51a1c-557e-4caa-ace4-c2a2ccbcf8c2} 1760 "\\.\pipe\gecko-crash-server-pipe.1760" 2120 19ec2258 tab7⤵PID:2056
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1760.3.1733338217\1841646821" -childID 2 -isForBrowser -prefsHandle 2700 -prefMapHandle 2696 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {99bc1cb8-8387-4e08-8ffc-609bc45e130d} 1760 "\\.\pipe\gecko-crash-server-pipe.1760" 2720 e64558 tab7⤵PID:832
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1760.4.1416664302\455355594" -childID 3 -isForBrowser -prefsHandle 3812 -prefMapHandle 3796 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b83790e3-d1c1-4cc0-9514-0b25e4857308} 1760 "\\.\pipe\gecko-crash-server-pipe.1760" 3824 e30158 tab7⤵PID:3652
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1760.5.364760197\1930996262" -childID 4 -isForBrowser -prefsHandle 3940 -prefMapHandle 3944 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b5d6b4b1-ca7c-4cda-a0e7-4a8fc2e1c26b} 1760 "\\.\pipe\gecko-crash-server-pipe.1760" 3928 2121fc58 tab7⤵PID:3664
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1760.6.1485311932\1115290780" -childID 5 -isForBrowser -prefsHandle 4120 -prefMapHandle 4124 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6af0cb2-2419-4663-a925-6e552580899c} 1760 "\\.\pipe\gecko-crash-server-pipe.1760" 4108 2127bc58 tab7⤵PID:3732
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1760.7.1997410984\972613396" -childID 6 -isForBrowser -prefsHandle 4380 -prefMapHandle 4376 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a56b2457-2ee0-48e0-a6ef-ee5fcfff3cc7} 1760 "\\.\pipe\gecko-crash-server-pipe.1760" 4392 232dc158 tab7⤵PID:3312
-
-
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2620
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
1KB
MD5af8cded2352b22dd6326cb0be5f6b39a
SHA1da39026671ffd6f81002ed8c6b0dcb6378cbfa7b
SHA256c2c0e8b539ba05668bc0243135564a54733319dea8387c2e22a743c879d2a823
SHA51205beb6fdfbe7bd5a4bdf44084586d71d63607af69a046ffc7e0d1019461985bd889d39f2c00590772e91cc1426a13a2a02df1b798f4c9e488d436eff30199cb7
-
Filesize
6KB
MD5bd7df784128a5c9478661a3089ef177a
SHA1f70a0392bff75eda862aa15282b5754b51251662
SHA256cca377ce089e7db5d4cf92acaf14e7a7b9e53c6952ec45ad25de96a36b5be180
SHA512a60b09c384872e870ce3c95bdbbcb0282faa1c5d784b4956cf57db530338ab44a99440c5d7493101ec9054b6731b0d2e620028e096c1e10516af82085cf466e1
-
Filesize
6KB
MD5fea1d8c068e76f1a28af3a750dbf7cce
SHA16f33e3559312cb1aac71dbe70cdbe209fd377e06
SHA256ef04c215a29ee64b6f9e2c5c38a5339fdc01d34544d1a9e5486d66c6951d1a6b
SHA51251c1f84770e4306ffa7bdada8ab5d9c4aaa8d6422917108b2d4dba65ab01bd1f65367467b3fe917d3f9af5e954155cdead5358a53317059af9c021f092e65bc3
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\activity-stream.discovery_stream.json.tmp
Filesize38KB
MD50fc4637fec756c8ddf881bd4a7dd3fa4
SHA1453cf3da2a544ab546fdc88248c09708ad7040c8
SHA25668b06d4c1ce9eb0b0ce51f197c0732574bcaa174ee8d3f888608c6eb41326b59
SHA51218e401c7b9acefa9fa1e6f9c1a40e46c7084121a58165a33b57f6c2039563dc17afdf23bc5028d76f41858df16f202381e1413a5ddd582cc7609455e7b9657fb
-
Filesize
1.8MB
MD56e5042ff1ec6df9aee18f4eea7864524
SHA119e4eaaec31c8512b191138a439b6c4c7ba73d18
SHA256420a1ba2737e39704e52e1ea0c2494d8c232f10e2b40971923959da4708b3b0c
SHA512ac5c8537bfd0a509ab49911cdf180778e9e47f9f9fb600933b2ba03f939f9bc9834db5a106840382ee648b289cddaf69b55cf969f51b9f89c49c678f1edc202c
-
Filesize
89KB
MD5cc86773e8d2f2c3ade17e0b062aecddb
SHA15e7790ca0b918b8e74e4e85af0c08f81cb4ade0f
SHA25651f4ab5d835ea80224cd5ceec0fcd7cbae80ffc1216b3da35c498cf4b01224cd
SHA5129f5bc37e717063dd0758bbcd77789038aed67b191a0ff23ee6f408a08c9b9992f298643108ed148eacbaaf9322b65acc82f3737e3da664f7a44b96796a1b4350
-
Filesize
2KB
MD54ac6a9d9e192f54598f8b67cf299ea5e
SHA1c3c63fc731603f581ab71bab7651a4d5112b04e6
SHA256f1179bc15a8c644c353af64d6c6c3f13fd2d48eed2fb0b709a167185d2ed806e
SHA5123ff1226c147403aa5afdc515f260849196dec92166273206256ce8437a98dc1dd3b2cf913861e7537ccf36d6bc53537bd49b600e9adb1671f4bdb3d6e3da23a5
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\datareporting\glean\db\data.safe.bin
Filesize2KB
MD5bd154da8f8b68fb93d7151152926da5c
SHA18e05d3e684c8d9101b5364c84f840a2ff87007c7
SHA25610acff73c70673d87b3eefc4f6f79b56112ae2b87e1f2b7534579c43a7be8e0d
SHA5127464afa1ffe45431a143e3ad217885240fa8e6647ee48d1c2c268a9ad87805c10c3bf6f1643a73271c4b963f895cc7fa5f7f828acb3e7859eb4bc0fddb295fa7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\datareporting\glean\pending_pings\162cc495-b3a0-457a-a4da-f1bd8b1713c7
Filesize745B
MD5135e7778e893000a749026e84cca8060
SHA13d34cc6c40cc2575a80d369c4e928730de17abb0
SHA25647167974b7a34c17caf0c696ae639a03408ac2d653c280a13c2e501564465517
SHA51241eee69b7ac661241d9f84cd4da850e3d2fe18ef10c344e2ed46d264d354268eb4a310e8e8e26d1e9d0e765d55c0f0f17f7548b8d88cba3a9684623fb8e9640b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\datareporting\glean\pending_pings\e4b2ff55-694e-4cad-8b57-bac5325f43e0
Filesize10KB
MD5e84660e88979fb22550b88a1cf3711db
SHA1066c421f349cb0628934b9b88c14c983a92fb916
SHA256b6a46d44b339f54f16d4f9ab45f70e57adc62b62b5949277fa190fd2a071f27e
SHA512cdd6364c0213afaa2ee23d4ef9edb4e7ad3431f7ace17b6575a368f814953d3d3af8c6cda82353c6b73b628e5b3cdfdd45bcc35bcce2d5fc205d3c703503ec92
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
Filesize
6KB
MD572098c6cb4fa721a2c262a364b0e4426
SHA1fd94f24823c3ed49f9371cc9d55406c15a274a54
SHA2565f46ee321c39200645722dd7d5de738ab6d69e022132aaa955423c82d69323da
SHA51261c5d889abe84f98025d78eca0a7bb17bba46ff9770cf3b18c176e256de9a90c7e79df50d49b93f8a462fd3c7c6ab7c8c9314dc2e2d8455e332ad0486bae089b
-
Filesize
6KB
MD5bbeb32be9c05f01134665a9329dbf49f
SHA1f35961666c6bd3801ddf87c7b225b4c161b824dc
SHA256b7740ae02e43157d314575d1c6777ab3ccf07f22464aedc1d171d700d7c17124
SHA5124a314e2320cede3cf8ccd01204399598318fcfd443acfab0378e432f135bc2f4e69ef6b77a4eb3708090c555f10b290544e3623ef5338ce65f7117034b21e118
-
Filesize
7KB
MD5d98170fea5f7bbe00e65379d31e439d5
SHA1049b78dd697239b71a21270deb2c97d6ef490baa
SHA25602a3aac06e6952dafaf5c48488bda3346bec4f6785994ff5973d224b0be7a8fd
SHA51242e825d2474b03d8d0c4801cfcea4fdec06b6ebd755b31290eeccafb12ca18e2993e31c06debfc0d1cd4128973eafa04d94b0a36af293ebe783bcf2a6d3b33e8
-
Filesize
6KB
MD580186056555106a0722c8731e7b08d64
SHA1507be64f64b7739fb91df41d23d0df47d9e9ca9f
SHA256c02370e823b9ac6ddbccf4685e84f04bade54d90baa110c6994e7d77ed08d2e6
SHA512f6fb0cabe210b40bafaa0d6a9bcfd24485be26c8527393ea3efb61739376b301b5be79306ffbcd6d2ca6fa8ec9e4fdfcde08b00ab8133e36a749c5cf98016a95
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD56bfbe10ef3feccbcbea782c77352e3f7
SHA15d3c69fce4b59422fc9651c45a054cf94e9f66a2
SHA2561ba1a6f281e17e55a37117518b0d730aa895b032d3ae0e9cf652e578640913b6
SHA512787c65c7ddd10d51d4f4a7ef5f4983f1c471ccb7a777ffabd268b598e29d9fa8d291032f31b47cae5cb5efde7cbb03f5322ba185bbd9cdee5f0d181b0ee7ac5c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD5b73411a9e764dafb0d4643f8fd26c42f
SHA1d1f3901e6a264407b424fa79f7582fa5e06626bb
SHA256b550226f75cc2cc0a57f78cb4fcee0185eb427a68d23f311f88e98e26594480c
SHA51205acb35590038bc56fe78dd6efa792a1b5b97d0cda843f155d22be176076ed34d7af2122c5bca86f412b49558538173a082b71987281e326bf4b100f8376d874
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize184KB
MD5b35168e22d4587ca37d0174f4eb27c8c
SHA1a07075038391d0b93092e1618497a7799dcb5e18
SHA25683cde2e7574cc3209d39b0db964fcfcc28f52e077021ab0604b3f52710f8ccc1
SHA512277cd4696f5a1db9a14ee880b423932a0c00a1f7f9944560942dcc8a6ea930e84e0bb42962ef3c7b27c192e041ba86eebc945ea32dded85a34dcf5a57358a79e