quasar | 6cffbcd23aeb7ea8c813cda4dad413b9c24d983c0fa6da03931b690b04502411

Resubmissions

21-01-2025 15:41

250121-s4qhga1pak 10

21-01-2025 15:31

250121-sygy5szrcy 10

Analysis

max time kernel
192s
max time network
194s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
21-01-2025 15:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

emmasBackdoor.exe
Size

2.9MB
MD5

0266f80fe6efd3e3e4bd0363d17bcbde
SHA1

b144914eb53d2e35e410be64d2db052d06d680df
SHA256

6cffbcd23aeb7ea8c813cda4dad413b9c24d983c0fa6da03931b690b04502411
SHA512

21174624b988b26d16ba96c57b65a0dd0c0fa02d5396ca29c5cc11851f7546a528e1343f3216b224f3deebb1e749ac1dfd02fc5485bf4a0dd5b6d0983c496ac8
SSDEEP

49152:EwREDDMVBq77B4L8lXQn/zJNGJ7YTpZIn+lD2GgWinoaDFO/82:EwRE8q77B44+zJNN1aHNo2O/82

Score

10^/10

quasar emmassub discovery evasion execution spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

EmmasSub

rath3r.xyz:4782

Mutex

7126373e-e872-4f94-bbbb-42e88d57137b

Attributes

encryption_key
4DC093FC202D016F95DCEE92AAF2874F56ACC3F2
install_name
Windows.WARP.JITService.exe
log_directory
Logs
reconnect_delay
3000
startup_key
MicrosoftUpdateTaskMachineCore
subdirectory
ice

Signatures

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	powershell.exe

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral1/files/0x001900000002abc2-646.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
3932	emmasBackdoor.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\EmmasBackdoor\Client.exe	emmasBackdoor.tmp
File created	C:\Program Files (x86)\EmmasBackdoor\unins000.dat	emmasBackdoor.tmp
File created	C:\Program Files (x86)\EmmasBackdoor\is-523C3.tmp	emmasBackdoor.tmp
File created	C:\Program Files (x86)\EmmasBackdoor\is-O2UVU.tmp	emmasBackdoor.tmp
File opened for modification	C:\Program Files (x86)\EmmasBackdoor\unins000.dat	emmasBackdoor.tmp

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2792	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	emmasBackdoor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	emmasBackdoor.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 50 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\EmmasBackdoorFile.myp\shell\open\command	emmasBackdoor.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\Client.exe\SupportedTypes\.myp	emmasBackdoor.tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Applications\Client.exe\SupportedTypes	emmasBackdoor.tmp
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.myp\OpenWithProgids	emmasBackdoor.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\EmmasBackdoorFile.myp\shell\open\command\ = "\"C:\\Program Files (x86)\\EmmasBackdoor\\Client.exe\" \"%1\""	emmasBackdoor.tmp
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\EmmasBackdoorFile.myp	emmasBackdoor.tmp
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "6"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.myp\OpenWithProgids	emmasBackdoor.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications	emmasBackdoor.tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\EmmasBackdoorFile.myp\DefaultIcon\ = "C:\\Program Files (x86)\\EmmasBackdoor\\Client.exe,0"	emmasBackdoor.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\EmmasBackdoorFile.myp\shell\open\command	emmasBackdoor.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\Client.exe	emmasBackdoor.tmp
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.myp	emmasBackdoor.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.myp\OpenWithProgids\EmmasBackdoorFile.myp	emmasBackdoor.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\EmmasBackdoorFile.myp	emmasBackdoor.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\EmmasBackdoorFile.myp\shell	emmasBackdoor.tmp
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\EmmasBackdoorFile.myp\ = "EmmasBackdoor File"	emmasBackdoor.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\EmmasBackdoorFile.myp\DefaultIcon	emmasBackdoor.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\EmmasBackdoorFile.myp\shell\open	emmasBackdoor.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\Client.exe\SupportedTypes	emmasBackdoor.tmp

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2792	powershell.exe
2792	powershell.exe
3932	emmasBackdoor.tmp
3932	emmasBackdoor.tmp

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2792	powershell.exe
Token: SeDebugPrivilege	2516	firefox.exe
Token: SeDebugPrivilege	2516	firefox.exe
Token: SeDebugPrivilege	2516	firefox.exe
Token: SeDebugPrivilege	2516	firefox.exe
Token: SeDebugPrivilege	2516	firefox.exe
Token: SeDebugPrivilege	2516	firefox.exe
Token: SeDebugPrivilege	2516	firefox.exe
Token: SeDebugPrivilege	2516	firefox.exe
Token: SeDebugPrivilege	2516	firefox.exe
Token: SeDebugPrivilege	2516	firefox.exe
Token: SeDebugPrivilege	2516	firefox.exe
Token: SeDebugPrivilege	2516	firefox.exe
Token: SeDebugPrivilege	2516	firefox.exe
Token: SeDebugPrivilege	2516	firefox.exe
Token: SeDebugPrivilege	2516	firefox.exe
Token: SeDebugPrivilege	2516	firefox.exe
Token: SeDebugPrivilege	2516	firefox.exe
Token: SeDebugPrivilege	2516	firefox.exe
Token: SeDebugPrivilege	2516	firefox.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
3932	emmasBackdoor.tmp
2516	firefox.exe
2516	firefox.exe
2516	firefox.exe
2516	firefox.exe
2516	firefox.exe
2516	firefox.exe
2516	firefox.exe
2516	firefox.exe
2516	firefox.exe
2516	firefox.exe
2516	firefox.exe
2516	firefox.exe
2516	firefox.exe
2516	firefox.exe
2516	firefox.exe
2516	firefox.exe
2516	firefox.exe
2516	firefox.exe
2516	firefox.exe
2516	firefox.exe
2516	firefox.exe
2516	firefox.exe
2516	firefox.exe
2516	firefox.exe
2516	firefox.exe
2516	firefox.exe
2516	firefox.exe
2516	firefox.exe
2516	firefox.exe
2516	firefox.exe
2516	firefox.exe
2516	firefox.exe
2516	firefox.exe
2516	firefox.exe
2516	firefox.exe
2516	firefox.exe
2516	firefox.exe
2516	firefox.exe
2516	firefox.exe
2516	firefox.exe
2516	firefox.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
2516	firefox.exe
2516	firefox.exe
2516	firefox.exe
2516	firefox.exe
2516	firefox.exe
2516	firefox.exe
2516	firefox.exe
2516	firefox.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2516	firefox.exe
2516	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 688 wrote to memory of 3932	688	emmasBackdoor.exe	77
PID 688 wrote to memory of 3932	688	emmasBackdoor.exe	77
PID 688 wrote to memory of 3932	688	emmasBackdoor.exe	77
PID 3932 wrote to memory of 2792	3932	emmasBackdoor.tmp	78
PID 3932 wrote to memory of 2792	3932	emmasBackdoor.tmp	78
PID 3932 wrote to memory of 2792	3932	emmasBackdoor.tmp	78
PID 3292 wrote to memory of 2516	3292	firefox.exe	87
PID 3292 wrote to memory of 2516	3292	firefox.exe	87
PID 3292 wrote to memory of 2516	3292	firefox.exe	87
PID 3292 wrote to memory of 2516	3292	firefox.exe	87
PID 3292 wrote to memory of 2516	3292	firefox.exe	87
PID 3292 wrote to memory of 2516	3292	firefox.exe	87
PID 3292 wrote to memory of 2516	3292	firefox.exe	87
PID 3292 wrote to memory of 2516	3292	firefox.exe	87
PID 3292 wrote to memory of 2516	3292	firefox.exe	87
PID 3292 wrote to memory of 2516	3292	firefox.exe	87
PID 3292 wrote to memory of 2516	3292	firefox.exe	87
PID 2516 wrote to memory of 1848	2516	firefox.exe	88
PID 2516 wrote to memory of 1848	2516	firefox.exe	88
PID 2516 wrote to memory of 1848	2516	firefox.exe	88
PID 2516 wrote to memory of 1848	2516	firefox.exe	88
PID 2516 wrote to memory of 1848	2516	firefox.exe	88
PID 2516 wrote to memory of 1848	2516	firefox.exe	88
PID 2516 wrote to memory of 1848	2516	firefox.exe	88
PID 2516 wrote to memory of 1848	2516	firefox.exe	88
PID 2516 wrote to memory of 1848	2516	firefox.exe	88
PID 2516 wrote to memory of 1848	2516	firefox.exe	88
PID 2516 wrote to memory of 1848	2516	firefox.exe	88
PID 2516 wrote to memory of 1848	2516	firefox.exe	88
PID 2516 wrote to memory of 1848	2516	firefox.exe	88
PID 2516 wrote to memory of 1848	2516	firefox.exe	88
PID 2516 wrote to memory of 1848	2516	firefox.exe	88
PID 2516 wrote to memory of 1848	2516	firefox.exe	88
PID 2516 wrote to memory of 1848	2516	firefox.exe	88
PID 2516 wrote to memory of 1848	2516	firefox.exe	88
PID 2516 wrote to memory of 1848	2516	firefox.exe	88
PID 2516 wrote to memory of 1848	2516	firefox.exe	88
PID 2516 wrote to memory of 1848	2516	firefox.exe	88
PID 2516 wrote to memory of 1848	2516	firefox.exe	88
PID 2516 wrote to memory of 1848	2516	firefox.exe	88
PID 2516 wrote to memory of 1848	2516	firefox.exe	88
PID 2516 wrote to memory of 1848	2516	firefox.exe	88
PID 2516 wrote to memory of 1848	2516	firefox.exe	88
PID 2516 wrote to memory of 1848	2516	firefox.exe	88
PID 2516 wrote to memory of 1848	2516	firefox.exe	88
PID 2516 wrote to memory of 1848	2516	firefox.exe	88
PID 2516 wrote to memory of 1848	2516	firefox.exe	88
PID 2516 wrote to memory of 1848	2516	firefox.exe	88
PID 2516 wrote to memory of 1848	2516	firefox.exe	88
PID 2516 wrote to memory of 1848	2516	firefox.exe	88
PID 2516 wrote to memory of 1848	2516	firefox.exe	88
PID 2516 wrote to memory of 1848	2516	firefox.exe	88
PID 2516 wrote to memory of 1848	2516	firefox.exe	88
PID 2516 wrote to memory of 1848	2516	firefox.exe	88
PID 2516 wrote to memory of 1848	2516	firefox.exe	88
PID 2516 wrote to memory of 1848	2516	firefox.exe	88
PID 2516 wrote to memory of 1848	2516	firefox.exe	88
PID 2516 wrote to memory of 1848	2516	firefox.exe	88
PID 2516 wrote to memory of 1848	2516	firefox.exe	88
PID 2516 wrote to memory of 1848	2516	firefox.exe	88
PID 2516 wrote to memory of 1848	2516	firefox.exe	88
PID 2516 wrote to memory of 1848	2516	firefox.exe	88
PID 2516 wrote to memory of 1692	2516	firefox.exe	89
PID 2516 wrote to memory of 1692	2516	firefox.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\emmasBackdoor.exe
"C:\Users\Admin\AppData\Local\Temp\emmasBackdoor.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:688
- C:\Users\Admin\AppData\Local\Temp\is-9EVQS.tmp\emmasBackdoor.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-9EVQS.tmp\emmasBackdoor.tmp" /SL5="$502F0,1909968,965632,C:\Users\Admin\AppData\Local\Temp\emmasBackdoor.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3932
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\is-PQ356.tmp\disable_defender.ps1"
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2792

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2840

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3292
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1964 -parentBuildID 20240401114208 -prefsHandle 1880 -prefMapHandle 1656 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {71bb52ac-be32-4805-b29c-0aa918d2a147} 2516 "\\.\pipe\gecko-crash-server-pipe.2516" gpu
    3⤵
    PID:1848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2364 -parentBuildID 20240401114208 -prefsHandle 2356 -prefMapHandle 2352 -prefsLen 23714 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {202944e0-6682-47ae-979d-4840d7c833cb} 2516 "\\.\pipe\gecko-crash-server-pipe.2516" socket
    3⤵
    PID:1692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2904 -childID 1 -isForBrowser -prefsHandle 3016 -prefMapHandle 2960 -prefsLen 23855 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4fcf6f95-40c5-47df-8060-892215428edc} 2516 "\\.\pipe\gecko-crash-server-pipe.2516" tab
    3⤵
    PID:2452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3660 -childID 2 -isForBrowser -prefsHandle 3652 -prefMapHandle 3648 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0fd62495-5ff1-4a83-8735-c6b392633463} 2516 "\\.\pipe\gecko-crash-server-pipe.2516" tab
    3⤵
    PID:1784
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4476 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4456 -prefMapHandle 4508 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {57ff7141-142f-4ef6-8d49-fe733bb50e69} 2516 "\\.\pipe\gecko-crash-server-pipe.2516" utility
    3⤵
    - Checks processor information in registry
    PID:1992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5380 -childID 3 -isForBrowser -prefsHandle 5392 -prefMapHandle 3644 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a6b988cb-9edb-4eaa-98d3-4a9640e76ffe} 2516 "\\.\pipe\gecko-crash-server-pipe.2516" tab
    3⤵
    PID:1280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5532 -childID 4 -isForBrowser -prefsHandle 5540 -prefMapHandle 5544 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8afc7313-e2d4-4d21-b159-5d13cc9ed75d} 2516 "\\.\pipe\gecko-crash-server-pipe.2516" tab
    3⤵
    PID:4164
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5804 -childID 5 -isForBrowser -prefsHandle 5724 -prefMapHandle 5728 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a5e2bb04-d250-47a0-96a5-f8595f1c022c} 2516 "\\.\pipe\gecko-crash-server-pipe.2516" tab
    3⤵
    PID:1612
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6276 -childID 6 -isForBrowser -prefsHandle 6236 -prefMapHandle 6260 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b4a398d-6bf7-46d7-b8f0-249e9b0b7bca} 2516 "\\.\pipe\gecko-crash-server-pipe.2516" tab
    3⤵
    PID:1412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6284 -childID 7 -isForBrowser -prefsHandle 5416 -prefMapHandle 4940 -prefsLen 28044 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c52e6b77-a6b1-4e91-8a32-fe33097e0eca} 2516 "\\.\pipe\gecko-crash-server-pipe.2516" tab
    3⤵
    PID:1660

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\EmmasBackdoor\Client.exe

Filesize
3.1MB

MD5
66ebe604ddf4d6ab60a183f515536528

SHA1
278782873ae0a5cac94add051edfc12e223be55c

SHA256
37e733731381c02941e4a8da30350cf968532d08012b6bb91e525241e8ee2c86

SHA512
756de51b5f6116640736f7dd37faf6172db79c8eaf8da17ba1e3d788d5c0179a01746f7d30044ca5c535c1b3d938bfde3e5d810b7fe50815030be8a5288c2bf9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\74uts9gp.default-release\activity-stream.discovery_stream.json

Filesize
21KB

MD5
30e4228396022e2c99b320ceb81418ae

SHA1
9a677eee71b0cd9cf2ed271d199bac9db4a31aba

SHA256
d1302e1ad2924282b1bc53d06db6f5d006def8db6330e93b9159f8799df4be0e

SHA512
c161da9c8472ca2eff42ccae208b266933437555e6700731461d8ca066da30a3d8c68a3c3b73b9b6f4efdd07cccc00a8643df83cb8ce977f6214c8bf2a369a21

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\74uts9gp.default-release\cache2\entries\3681DE6CF4C74C0B0E917662C23300D474070D04

Filesize
61KB

MD5
1e4ecfdc937d5ccaf329ed1087c9d510

SHA1
cc0ab01076abd5037cace8715e7646e2bce18ffd

SHA256
b9fa344dd5a4c17f78df3dc422d5596ae3ef9d035411b754ce6d8722d5b3270e

SHA512
eb4985a43730f0cbe7a928a708b5d26b6e546296cc62a116df66f9760a322d386917f57cbe1485187f3f6bee8e50175cedfceffb8c1a5b171cecf28f7c2c6acd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\74uts9gp.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cmgzxiz4.qoi.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9EVQS.tmp\emmasBackdoor.tmp

Filesize
3.3MB

MD5
95c49a50069cf27284ac7b186df5aae0

SHA1
4120193848e7726aac277f9ea6e4b3670342ed03

SHA256
9f62b6f4c234ded050162b55a9c6de0c604578dee34462b96615e48169a485bb

SHA512
f6d3fd7454943aac838cd81e17c35787747185e0736823424453ffbf375da1e921dba0a5ce88a05f7a71e2ac367d47ee8fbabbd529f48997b99f1a3afa5370cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PQ356.tmp\disable_defender.ps1

Filesize
544B

MD5
3568227fbb730d48fa31d13e87f9a370

SHA1
83ac8fbb2b9c35337f372977fe3323f63060c5ff

SHA256
a06e1c77a4ab2a13f90dc2f86bbb4cb662f2bd10b1f805b1b7745af4c2ad3698

SHA512
2b8863dbdc4c980eac867e600ca008261d046a99bf40cfc02a350ec45a04e3a7b958b21219ad0a26b339336f779ba167aa84c45dbe4d9d9ada004c4515ba6d17

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\74uts9gp.default-release\AlternateServices.bin

Filesize
7KB

MD5
061822cfed11705240a2f94db0aeedd9

SHA1
aa563773f9c78617231a4a207bef5fe1e5c17ef6

SHA256
4330b243e660a8d968974f145419106ce171fb17bdbb205755a7b77e0d5ba6ab

SHA512
8ff1e6a8d38f032d09922fcc98b2050534bc13cdbe4eee3b2bf5d50853fbc60e45876ccece89c24f57157a4564f8ea5ba2de178203d934731bf0591c672d98f1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\74uts9gp.default-release\AlternateServices.bin

Filesize
12KB

MD5
862bf5f303b269de9d298474f7b40c50

SHA1
14b2c13c98f9e7053beab60a97972b0c721344a8

SHA256
e529933e8e768952da7a6812b7f2f857ce7cdc41e259d747f9f406282c3933c3

SHA512
904153f26de1f1ab1f0a5017dd477b6d513d1158825815838c91877d642c34690458dfd47bdb1e9babef2d2a91bf8be7d04606f4f70ed9a27e28e0cfcfa4e94d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\74uts9gp.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
7e1104cde1fb67e39075a2eb44f92ca8

SHA1
71c86fa23402c02865da7b76b01ad72ac31151c1

SHA256
ab282f203ff0077001640e08890edcf9376137c1bebeb4322bf4c06b2ad02615

SHA512
16dcb6d7ed4eb925519328fba15453369b72471f951a3c66713acc9702f07bec4eedcdcd19be91c7942428894a565c0d11ae9881a356f19b01c08d358d50a57a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\74uts9gp.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
b0f83daa9cd942ffc3f2dcf75bd6834a

SHA1
3ec2b872079b2a7fc8fa56c0c904e86ac7a95962

SHA256
8044512ad8cd01c42828a7f9bfba70234e89261ddafe0e5bc1a11aceae435102

SHA512
3a559bb5cb2100e5a431a6d0338a0e90e90ebe6b0015432dfa47d882729c24a6b099b5b905afc901eb8f08db5c166b84fcfd8b29a5bfdfcc22a7cb472017101f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\74uts9gp.default-release\datareporting\glean\pending_pings\1bd1c699-fc63-48d6-80e1-5ad9cfe82c9f

Filesize
982B

MD5
e7c685636eddc5f9916e1fca355e93ad

SHA1
ed309af8ab5470b6080f83816c162296ed09275c

SHA256
b45f4491f1494ceef5ea382f564d498c3044bb349d35d4fbcfc822058040709c

SHA512
2797a0ed89dc03deb79c2901a68ccdaf05c70d507616820ea61f794f6becc16eddce400641e2b184afaaff258881286097e5b9a10de556da14e339cf780f0a66

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\74uts9gp.default-release\datareporting\glean\pending_pings\5617b575-da6b-4bf0-8c22-550aeda39c3a

Filesize
24KB

MD5
561e7316b0821852c6d1ad80733b9ed1

SHA1
cd23273bca558d8b9389a49a51d8dadeb94a7153

SHA256
0432565bfe9ae935d6479308d96540097da234ad2e6b2034864fa0febeba9c2b

SHA512
63836a2598b4bacae233d73118ee429627b02ec89e064621e8730019b98958f7733e72dfb52c8267cce48fa052884c1148fb822276e7a73bcfa7b94c93af3171

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\74uts9gp.default-release\datareporting\glean\pending_pings\8c4dd9f6-f0f6-41cf-aaf6-75f4370d5e66

Filesize
671B

MD5
6e4f42b7e758333273b85b0873e6b0e8

SHA1
fd6e2ab29dd962aadd063afab75a1f24543331ff

SHA256
59b5cec139aa0d5e21c698c5d905e51ffaf78497f503bf93cd92c9df409a48f8

SHA512
caa5ca5921ff94578a45b0146d91aacf494ca03a4ddde956f69870f8cdf79a6d028b514037666b64c99e6240e2b840af6ae278bbab6f29ce4c52680bdd778dbb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\74uts9gp.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\74uts9gp.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\74uts9gp.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\74uts9gp.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\74uts9gp.default-release\prefs-1.js

Filesize
10KB

MD5
fe0a39813b69f77c1f6e0c34f4db3b79

SHA1
9d44e9e39fae0064982c34ec349e766659dc44be

SHA256
62c82b9c964211dccba1e4c6c4347e364eb78befb8daeb0c439ef404286ae7d3

SHA512
321cb32a863d56d98861de7eb8bf725d4ee9b0ece3120426dd38a3adcfcfdbe1df57e17301e09e0902dfe8bac2240064e1b8126509bf943a242764a8540fff9b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\74uts9gp.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
7368e47b7c07a46a0325dcc321d3fb11

SHA1
63fe0bee4e2b616d9505cb36aecd9f5b91ecc468

SHA256
1b7cb678b4e97a42946dcd7c5961dc302ba092b6ce78d040c31f1fc0a183c150

SHA512
c39736ea2eca24d353304632b2f507d5d545408e46cf1188b53c10a847e796d5aa9f1c2ae3208329c974ec35207aee7b1f03bb9f5af6f8c7604e6f019f3efe64

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\74uts9gp.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
a62ec3f1c318604db10aa8fd79b2f1eb

SHA1
5914f8e86e8341c83cdb81d52dff8b5de2ce0cea

SHA256
4d4f7a66a7647e45bfa4d637bed6a027ffc53af3375b861018fe7f0230dce21a

SHA512
0cb21d85b2dd15829bb742e1924d694107c305c34dd12fd6ebbe1e977f62e2fbf541569b0d89a5925deddbf7d4567257548f3245febd79c9965cc37608eb9adb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\74uts9gp.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
d16a98f13824baec7982666c52bdcc6d

SHA1
5da3ca21f0f65ec84210adb4a39c08e2f4c614f1

SHA256
004a176bdf4d7ec84fbc96452701fcad34a90e106982ea8669d29da64c1ec838

SHA512
ec5be6e25a3691c10abd624d2cf9310a33731430d3008a1145859d74a0d6ea7b0e8df8fe3a00d31f5ff673b720549bd774f5336b715e7b8e10f031a3b8032eb0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\74uts9gp.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
726f0bfb060ecd7474103b6e24e54392

SHA1
63cdc684dc7dbcb54657c76bf59166f2e5518a5d

SHA256
77511a105f3dad1f0479c64a30c1a099ca93407f40ec7253440ec6b8a5054a82

SHA512
c1b7c0e2d6ef2ee4bfafa6f77049e69c0a6b2fe8489cba07d8bfe207ca496eb35884475a445a4172037f352d18c97eb4942ec9f4e81a84a50afe34ebe4006e6e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\74uts9gp.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
064517ae13491d0fc93ccf85940881af

SHA1
a7fb00a4ee5c57fb220a2e0b6fb23d7c8b30e8bd

SHA256
9d36ed17175eff561daf17004110a01a2ff79a81a14c804ea4748cdfd6f79daa

SHA512
85aab1cd2af8ee1b74310e33d39b1fe1905bfd88e66137554c7e17deff193987548615852ca925573468a58c235bedb1530aa6a365dc9c6b439e5938c3ad4503

Download Submit
memory/688-67-0x00000000008C0000-0x00000000009BA000-memory.dmp

Filesize
1000KB

Download
memory/688-2-0x00000000008C1000-0x0000000000969000-memory.dmp

Filesize
672KB

Download
memory/688-63-0x00000000008C0000-0x00000000009BA000-memory.dmp

Filesize
1000KB

Download
memory/688-1-0x00000000008C0000-0x00000000009BA000-memory.dmp

Filesize
1000KB

Download
memory/2792-25-0x0000000006280000-0x00000000062CC000-memory.dmp

Filesize
304KB

Download
memory/2792-39-0x0000000007BD0000-0x000000000824A000-memory.dmp

Filesize
6.5MB

Download
memory/2792-52-0x0000000000940000-0x00000000009A9000-memory.dmp

Filesize
420KB

Download
memory/2792-9-0x0000000000940000-0x00000000009A9000-memory.dmp

Filesize
420KB

Download
memory/2792-10-0x0000000002A50000-0x0000000002A86000-memory.dmp

Filesize
216KB

Download
memory/2792-49-0x0000000008800000-0x0000000008DA6000-memory.dmp

Filesize
5.6MB

Download
memory/2792-48-0x0000000007910000-0x0000000007932000-memory.dmp

Filesize
136KB

Download
memory/2792-47-0x00000000078E0000-0x00000000078E8000-memory.dmp

Filesize
32KB

Download
memory/2792-46-0x00000000078C0000-0x00000000078DA000-memory.dmp

Filesize
104KB

Download
memory/2792-45-0x00000000077E0000-0x00000000077F5000-memory.dmp

Filesize
84KB

Download
memory/2792-44-0x00000000077D0000-0x00000000077DE000-memory.dmp

Filesize
56KB

Download
memory/2792-43-0x0000000007790000-0x00000000077A1000-memory.dmp

Filesize
68KB

Download
memory/2792-42-0x0000000007820000-0x00000000078B6000-memory.dmp

Filesize
600KB

Download
memory/2792-41-0x00000000075F0000-0x00000000075FA000-memory.dmp

Filesize
40KB

Download
memory/2792-40-0x0000000007590000-0x00000000075AA000-memory.dmp

Filesize
104KB

Download
memory/2792-11-0x0000000005430000-0x0000000005A5A000-memory.dmp

Filesize
6.2MB

Download
memory/2792-38-0x0000000007450000-0x00000000074F4000-memory.dmp

Filesize
656KB

Download
memory/2792-37-0x0000000006830000-0x000000000684E000-memory.dmp

Filesize
120KB

Download
memory/2792-28-0x000000006FEA0000-0x000000006FEEC000-memory.dmp

Filesize
304KB

Download
memory/2792-27-0x0000000007410000-0x0000000007444000-memory.dmp

Filesize
208KB

Download
memory/2792-24-0x0000000006240000-0x000000000625E000-memory.dmp

Filesize
120KB

Download
memory/2792-23-0x0000000005D70000-0x00000000060C7000-memory.dmp

Filesize
3.3MB

Download
memory/2792-14-0x0000000005D00000-0x0000000005D66000-memory.dmp

Filesize
408KB

Download
memory/2792-13-0x0000000005A60000-0x0000000005AC6000-memory.dmp

Filesize
408KB

Download
memory/2792-12-0x0000000005380000-0x00000000053A2000-memory.dmp

Filesize
136KB

Download
memory/3932-53-0x0000000000950000-0x0000000000951000-memory.dmp

Filesize
4KB

Download
memory/3932-66-0x0000000000C90000-0x0000000000FE9000-memory.dmp

Filesize
3.3MB

Download
memory/3932-64-0x0000000000C90000-0x0000000000FE9000-memory.dmp

Filesize
3.3MB

Download
memory/3932-6-0x0000000000950000-0x0000000000951000-memory.dmp

Filesize
4KB

Download