Analysis
-
max time kernel
112s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11-09-2024 09:09
Static task
static1
Behavioral task
behavioral1
Sample
be78f72a1d60ea77948a7f42855ef3c0N.exe
Resource
win7-20240903-en
General
-
Target
be78f72a1d60ea77948a7f42855ef3c0N.exe
-
Size
1.8MB
-
MD5
be78f72a1d60ea77948a7f42855ef3c0
-
SHA1
549f7c062fdc74ec8d7a544fd66c69fa8769171c
-
SHA256
0b5f4f1dbf0a3a1793f41bfb16c533bcc7cc656772b4cadd77a3e04f6e312325
-
SHA512
cbbba53b749d189facb32f853b73fb3d63eb6edc6e7aa31f16feaef75859bf48b059cd72bed6704696b657452c04d88a448153027a0a8471ce83ed8a2d397da1
-
SSDEEP
24576:PzJM9zdzVE0jYFcjMG3QkCTi8MTkyDo1cqfNs7yzW2PrsM9V7FD5rLVCCYT:P6zdBJscjMeQY8MTFDotfKNc5N53K
Malware Config
Extracted
amadey
4.41
c7817d
http://31.41.244.10
-
install_dir
0e8d0864aa
-
install_file
svoutse.exe
-
strings_key
5481b88a6ef75bcf21333988a4e47048
-
url_paths
/Dem7kTu/index.php
Extracted
stealc
rave
http://185.215.113.103
-
url_path
/e2b1563c6670f193.php
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
Processes:
d9736386bd.exebe78f72a1d60ea77948a7f42855ef3c0N.exesvoutse.exeb6c929dfe6.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ d9736386bd.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ be78f72a1d60ea77948a7f42855ef3c0N.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ svoutse.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ b6c929dfe6.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
d9736386bd.exebe78f72a1d60ea77948a7f42855ef3c0N.exesvoutse.exeb6c929dfe6.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion d9736386bd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion be78f72a1d60ea77948a7f42855ef3c0N.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion be78f72a1d60ea77948a7f42855ef3c0N.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svoutse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion svoutse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion b6c929dfe6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion b6c929dfe6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion d9736386bd.exe -
Executes dropped EXE 3 IoCs
Processes:
svoutse.exeb6c929dfe6.exed9736386bd.exepid process 2756 svoutse.exe 2664 b6c929dfe6.exe 2900 d9736386bd.exe -
Identifies Wine through registry keys 2 TTPs 4 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
d9736386bd.exebe78f72a1d60ea77948a7f42855ef3c0N.exesvoutse.exeb6c929dfe6.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine d9736386bd.exe Key opened \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine be78f72a1d60ea77948a7f42855ef3c0N.exe Key opened \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine svoutse.exe Key opened \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine b6c929dfe6.exe -
Loads dropped DLL 5 IoCs
Processes:
be78f72a1d60ea77948a7f42855ef3c0N.exesvoutse.exepid process 2532 be78f72a1d60ea77948a7f42855ef3c0N.exe 2756 svoutse.exe 2756 svoutse.exe 2756 svoutse.exe 2756 svoutse.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
svoutse.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\d9736386bd.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000030001\\d9736386bd.exe" svoutse.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
be78f72a1d60ea77948a7f42855ef3c0N.exesvoutse.exeb6c929dfe6.exed9736386bd.exepid process 2532 be78f72a1d60ea77948a7f42855ef3c0N.exe 2756 svoutse.exe 2664 b6c929dfe6.exe 2900 d9736386bd.exe -
Drops file in Windows directory 1 IoCs
Processes:
be78f72a1d60ea77948a7f42855ef3c0N.exedescription ioc process File created C:\Windows\Tasks\svoutse.job be78f72a1d60ea77948a7f42855ef3c0N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
be78f72a1d60ea77948a7f42855ef3c0N.exesvoutse.exeb6c929dfe6.exepowershell.exed9736386bd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language be78f72a1d60ea77948a7f42855ef3c0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svoutse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b6c929dfe6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d9736386bd.exe -
Checks processor information in registry 2 TTPs 12 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exefirefox.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe -
Modifies registry class 1 IoCs
Processes:
firefox.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
be78f72a1d60ea77948a7f42855ef3c0N.exesvoutse.exeb6c929dfe6.exed9736386bd.exepowershell.exepid process 2532 be78f72a1d60ea77948a7f42855ef3c0N.exe 2756 svoutse.exe 2664 b6c929dfe6.exe 2900 d9736386bd.exe 1564 powershell.exe 1564 powershell.exe 1564 powershell.exe 1564 powershell.exe 1564 powershell.exe 1564 powershell.exe 1564 powershell.exe 1564 powershell.exe 1564 powershell.exe 1564 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1564 powershell.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
be78f72a1d60ea77948a7f42855ef3c0N.exefirefox.exepid process 2532 be78f72a1d60ea77948a7f42855ef3c0N.exe 848 firefox.exe 848 firefox.exe 848 firefox.exe 848 firefox.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
firefox.exepid process 848 firefox.exe 848 firefox.exe 848 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
be78f72a1d60ea77948a7f42855ef3c0N.exesvoutse.exepowershell.exefirefox.exefirefox.exedescription pid process target process PID 2532 wrote to memory of 2756 2532 be78f72a1d60ea77948a7f42855ef3c0N.exe svoutse.exe PID 2532 wrote to memory of 2756 2532 be78f72a1d60ea77948a7f42855ef3c0N.exe svoutse.exe PID 2532 wrote to memory of 2756 2532 be78f72a1d60ea77948a7f42855ef3c0N.exe svoutse.exe PID 2532 wrote to memory of 2756 2532 be78f72a1d60ea77948a7f42855ef3c0N.exe svoutse.exe PID 2756 wrote to memory of 2664 2756 svoutse.exe b6c929dfe6.exe PID 2756 wrote to memory of 2664 2756 svoutse.exe b6c929dfe6.exe PID 2756 wrote to memory of 2664 2756 svoutse.exe b6c929dfe6.exe PID 2756 wrote to memory of 2664 2756 svoutse.exe b6c929dfe6.exe PID 2756 wrote to memory of 2900 2756 svoutse.exe d9736386bd.exe PID 2756 wrote to memory of 2900 2756 svoutse.exe d9736386bd.exe PID 2756 wrote to memory of 2900 2756 svoutse.exe d9736386bd.exe PID 2756 wrote to memory of 2900 2756 svoutse.exe d9736386bd.exe PID 2756 wrote to memory of 1564 2756 svoutse.exe powershell.exe PID 2756 wrote to memory of 1564 2756 svoutse.exe powershell.exe PID 2756 wrote to memory of 1564 2756 svoutse.exe powershell.exe PID 2756 wrote to memory of 1564 2756 svoutse.exe powershell.exe PID 1564 wrote to memory of 808 1564 powershell.exe firefox.exe PID 1564 wrote to memory of 808 1564 powershell.exe firefox.exe PID 1564 wrote to memory of 808 1564 powershell.exe firefox.exe PID 1564 wrote to memory of 808 1564 powershell.exe firefox.exe PID 1564 wrote to memory of 848 1564 powershell.exe firefox.exe PID 1564 wrote to memory of 848 1564 powershell.exe firefox.exe PID 1564 wrote to memory of 848 1564 powershell.exe firefox.exe PID 1564 wrote to memory of 848 1564 powershell.exe firefox.exe PID 808 wrote to memory of 2572 808 firefox.exe firefox.exe PID 808 wrote to memory of 2572 808 firefox.exe firefox.exe PID 808 wrote to memory of 2572 808 firefox.exe firefox.exe PID 808 wrote to memory of 2572 808 firefox.exe firefox.exe PID 808 wrote to memory of 2572 808 firefox.exe firefox.exe PID 808 wrote to memory of 2572 808 firefox.exe firefox.exe PID 808 wrote to memory of 2572 808 firefox.exe firefox.exe PID 808 wrote to memory of 2572 808 firefox.exe firefox.exe PID 808 wrote to memory of 2572 808 firefox.exe firefox.exe PID 808 wrote to memory of 2572 808 firefox.exe firefox.exe PID 808 wrote to memory of 2572 808 firefox.exe firefox.exe PID 808 wrote to memory of 2572 808 firefox.exe firefox.exe PID 848 wrote to memory of 1404 848 firefox.exe firefox.exe PID 848 wrote to memory of 1404 848 firefox.exe firefox.exe PID 848 wrote to memory of 1404 848 firefox.exe firefox.exe PID 848 wrote to memory of 1752 848 firefox.exe firefox.exe PID 848 wrote to memory of 1752 848 firefox.exe firefox.exe PID 848 wrote to memory of 1752 848 firefox.exe firefox.exe PID 848 wrote to memory of 1752 848 firefox.exe firefox.exe PID 848 wrote to memory of 1752 848 firefox.exe firefox.exe PID 848 wrote to memory of 1752 848 firefox.exe firefox.exe PID 848 wrote to memory of 1752 848 firefox.exe firefox.exe PID 848 wrote to memory of 1752 848 firefox.exe firefox.exe PID 848 wrote to memory of 1752 848 firefox.exe firefox.exe PID 848 wrote to memory of 1752 848 firefox.exe firefox.exe PID 848 wrote to memory of 1752 848 firefox.exe firefox.exe PID 848 wrote to memory of 1752 848 firefox.exe firefox.exe PID 848 wrote to memory of 1752 848 firefox.exe firefox.exe PID 848 wrote to memory of 1752 848 firefox.exe firefox.exe PID 848 wrote to memory of 1752 848 firefox.exe firefox.exe PID 848 wrote to memory of 1752 848 firefox.exe firefox.exe PID 848 wrote to memory of 1752 848 firefox.exe firefox.exe PID 848 wrote to memory of 1752 848 firefox.exe firefox.exe PID 848 wrote to memory of 1752 848 firefox.exe firefox.exe PID 848 wrote to memory of 1752 848 firefox.exe firefox.exe PID 848 wrote to memory of 1752 848 firefox.exe firefox.exe PID 848 wrote to memory of 1752 848 firefox.exe firefox.exe PID 848 wrote to memory of 1752 848 firefox.exe firefox.exe PID 848 wrote to memory of 1752 848 firefox.exe firefox.exe PID 848 wrote to memory of 1752 848 firefox.exe firefox.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\be78f72a1d60ea77948a7f42855ef3c0N.exe"C:\Users\Admin\AppData\Local\Temp\be78f72a1d60ea77948a7f42855ef3c0N.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Roaming\1000026000\b6c929dfe6.exe"C:\Users\Admin\AppData\Roaming\1000026000\b6c929dfe6.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\1000030001\d9736386bd.exe"C:\Users\Admin\AppData\Local\Temp\1000030001\d9736386bd.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2900 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account4⤵
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account5⤵
- Checks processor information in registry
PID:2572 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd4⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="848.0.2078002829\2097327821" -parentBuildID 20221007134813 -prefsHandle 1216 -prefMapHandle 1208 -prefsLen 20769 -prefMapSize 233414 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ebdef71b-3d70-47a9-bee3-f46e3255f671} 848 "\\.\pipe\gecko-crash-server-pipe.848" 1292 120d5b58 gpu5⤵PID:1404
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="848.1.1485926050\638850840" -parentBuildID 20221007134813 -prefsHandle 1484 -prefMapHandle 1480 -prefsLen 21630 -prefMapSize 233414 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c34da12-c10b-4b5a-b6a1-4868f2e65b88} 848 "\\.\pipe\gecko-crash-server-pipe.848" 1496 e74558 socket5⤵PID:1752
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="848.2.1779720031\2040582800" -childID 1 -isForBrowser -prefsHandle 2080 -prefMapHandle 2076 -prefsLen 21668 -prefMapSize 233414 -jsInitHandle 824 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c0892d43-7717-46b6-9b68-d7c05418cd38} 848 "\\.\pipe\gecko-crash-server-pipe.848" 2092 19d94c58 tab5⤵PID:1612
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="848.3.153809325\1182967402" -childID 2 -isForBrowser -prefsHandle 2876 -prefMapHandle 2872 -prefsLen 26138 -prefMapSize 233414 -jsInitHandle 824 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b0520239-1461-4b97-a6f4-a14652e57415} 848 "\\.\pipe\gecko-crash-server-pipe.848" 2888 1c6a2558 tab5⤵PID:1644
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="848.4.1926757468\1238999506" -childID 3 -isForBrowser -prefsHandle 3704 -prefMapHandle 3700 -prefsLen 26273 -prefMapSize 233414 -jsInitHandle 824 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {360c707a-1855-4f8a-8caa-ccbe2d21580a} 848 "\\.\pipe\gecko-crash-server-pipe.848" 3716 1cea2658 tab5⤵PID:2996
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="848.5.234357403\1311322637" -childID 4 -isForBrowser -prefsHandle 3832 -prefMapHandle 3836 -prefsLen 26273 -prefMapSize 233414 -jsInitHandle 824 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e9ba8601-83ab-4d48-9ea6-c6e759498623} 848 "\\.\pipe\gecko-crash-server-pipe.848" 3824 1e203b58 tab5⤵PID:1980
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="848.6.831638863\563841209" -childID 5 -isForBrowser -prefsHandle 4000 -prefMapHandle 4004 -prefsLen 26273 -prefMapSize 233414 -jsInitHandle 824 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f3341e14-ace3-45c4-b5dd-f3e425816f4d} 848 "\\.\pipe\gecko-crash-server-pipe.848" 3988 1e206e58 tab5⤵PID:2840
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="848.7.1661584109\391365625" -childID 6 -isForBrowser -prefsHandle 4400 -prefMapHandle 4388 -prefsLen 26372 -prefMapSize 233414 -jsInitHandle 824 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {88111f5e-3bba-4a17-80da-7f7f03c11d4e} 848 "\\.\pipe\gecko-crash-server-pipe.848" 4412 218c9b58 tab5⤵PID:3272
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="848.8.1263012408\180278821" -childID 7 -isForBrowser -prefsHandle 4524 -prefMapHandle 4528 -prefsLen 26372 -prefMapSize 233414 -jsInitHandle 824 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6e53436c-67a5-47e4-9e91-c47e65211724} 848 "\\.\pipe\gecko-crash-server-pipe.848" 4512 21c78258 tab5⤵PID:3280
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\activity-stream.discovery_stream.json.tmp
Filesize28KB
MD5d5f150486a9e0ec09edfed27b8bf9e5b
SHA19ff5512beef2c74a8f90dc3af76c68d7d126afd3
SHA256502f92fb504823be8f5a23a5f29fbfb7a0af2707b4f5725f6df4dfa9ea6f7980
SHA512ae709179bab25846b67bff79d2acc995128b989e53ab0af5d6f8ebefceb51dadb3147a6572b60c51fae769ece6c0cd8292381ad3c185479e2cdd4236f595423e
-
Filesize
2KB
MD5e05e8f072b373beafe27cc11d85f947c
SHA11d6daeb98893e8122b8b69287ebd9d43f3c6138e
SHA256717c09427fa5754ba92f92961545534048d0a76528c2e95c4d5ec6cef47c612f
SHA512b3e34162e5ee43bb01f289eebc45fd3ea3e07f30be40dcf6635606540f912fe5c84d301e9f78e97dfe3ffe53e72547e50f3bcd7d4ebe5ab8da451a1989c469a0
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
Filesize
1.7MB
MD52436f5bc4146385648a72a27897ab578
SHA1daf603434b49d4bf2866a3f53069845f05130fcb
SHA256aee2dcc810b97f1bd7809146f7f33887e806561329c0b6288ecb1d315e4f6740
SHA512e32cede58485391ee8621b939f28e7234095391ad67f944929b8475528f8a08f801d3997138c0935f40d17ec3e703d0d499e7427bcc570102636e1ea8cff2a92
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\datareporting\glean\db\data.safe.bin
Filesize2KB
MD58f0ab99a461219c1849fadeb726566f3
SHA1c05c318ce30ca395116614154b58ff16c7d705e7
SHA2568221e3a0120803eb3a217bfc709c033152cc60c5c1216281d41fef55afa51e9a
SHA512feebfe8f2603dff4eea139222501aa34011629d14a5ebfd4b28284102ca61a6d5d399b540f2684881cd180b342886376c08ca91621a6f625ffb0947a85069392
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\datareporting\glean\pending_pings\73c7fbd5-1315-4ff9-837d-55c528ef99d4
Filesize11KB
MD5ff17d2a5bed6abe4e15f67f3638de22f
SHA1c0d8d783a4b2c36da28a736869882b226fb7da1a
SHA256cb0a28bd21d874bd3f3defdcbe2cc0d54e42178f47b126f173f200b77b7b800a
SHA5129ee4b3ddf7b381479acfb22ecefe0cbef6371e39f9c48b4743fbd94712461dc42c7d188d38f4fbbefbccb61c911a6c0a0937ffa1c43914e48f4a21b634a28423
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\datareporting\glean\pending_pings\9e1f0e18-43f9-449f-b22a-afde2fc62198
Filesize745B
MD5d940803ef13814ea1e6b281e3a36ffa3
SHA17a95e6ada78c3e29ecae0960c35a8005e8bf7a53
SHA256c6ae5958d948fd6f2fc436ae845879096362b2febf4e3bf639dc948cd4fbcdf9
SHA51217f9c8e61cf54724c192d8980725614e310929e3dcf494151cd3440d2b5d7281fdb8b029f7925959546849146670ff1e65a77cd4d34c6cc23719bb5e5808ace2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
Filesize
6KB
MD5101fb54e0ec85dab240bff27fca9cf65
SHA1a9af29dc51abcfdf7875162bb1dc845e08905af8
SHA2565a6835c14f4752453c62811b8e3b584bf35fa0f13a89a746e1f56b34a3ea2f52
SHA5122cc6b7662e4a36657806465410381a02d09b0984f839265bd3b86f65eef40ba19e2367245731bdac65ca0f62389e60e272b2e810c8c271f12a12f6d3eb2e93a6
-
Filesize
7KB
MD5391aa717adc573f884394e78b4ca6418
SHA1e4fdd9e1d5af8f4e0e272c0ee5ee1214276360b1
SHA256ed0dd5f4192e2fdb4873914d0de06e69b8b6f206855cd2e1a726c656c457c797
SHA5127a11bcdb28e5131783accfbf1366c3d1c15f3b195184137a0fd8334288815210384855728c3069dc472d2868c6187eb363cf41f7f14ceac8f2e37c22e0af386c
-
Filesize
6KB
MD5bb32e20b707fb0565d11334e471b4da3
SHA1f55484c7471564e22eac54d3fe0527a010c24f39
SHA25661b0af3cd64553a538821edd7dd16a9cd1bc3cfa1f63ba272550e653613535f6
SHA512f56d9f43b8b25ccdcc6e59c70b72841777fce7c0f61eada662ca4efc81bbda4c16793ca0253049003ecf0608bd8aed42e28eedad7562c2f94129386393633359
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\sessionstore-backups\recovery.jsonlz4
Filesize5KB
MD5eb9b608393446abbeb1ee3a5d16d4990
SHA10c9b6bd44419d844df2d50e602300e04233e6f40
SHA256c5ecf571e7ee871952e112f54c6d1e49a52bd6472e6bfa4ae589a23aa1c00d61
SHA512c8077aba8ce8635be6abd6022755c3668750f3953f81b68d87b15139cfe5b8edd41d865d29c04be4ad55290b9eb27d11dfbac6c3ba2c0998120d8e3b055c385f
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\sessionstore-backups\recovery.jsonlz4
Filesize1KB
MD5d965c873742f2df2541d02e5ee5e5333
SHA178d8bb1c59c7665c8e5641fb423b431ec7d4bb9e
SHA25616fed6e78bdc4304c23753909213a744d7974d06179c9849642a36dddcd0492a
SHA512586b4d3d0e061ffd021779ca525245a2c60817ca10551c021d9c4f201c66979f8d5561fdb83939ceb990a2fb921ec506acb1a34b5869a481e7f73932ac6db9a2
-
Filesize
1.8MB
MD5be78f72a1d60ea77948a7f42855ef3c0
SHA1549f7c062fdc74ec8d7a544fd66c69fa8769171c
SHA2560b5f4f1dbf0a3a1793f41bfb16c533bcc7cc656772b4cadd77a3e04f6e312325
SHA512cbbba53b749d189facb32f853b73fb3d63eb6edc6e7aa31f16feaef75859bf48b059cd72bed6704696b657452c04d88a448153027a0a8471ce83ed8a2d397da1