Analysis
- max time kernel
135s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
01/06/2024, 08:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
IDMan.exe
Resource
win7-20240221-en
windows7-x64
14 signatures
150 seconds
General
- Target IDMan.exe
- Size 5.7MB
- Sample240601-kh45qsgd77
- SHA256 4844e0e0de7ef5b004bc051d9a3a59b3ccb1e05abadb8e35a43314a1d5ce1d27
- MD5 c63282dcd9262fe365d0047b60bede8c
- SHA1 8c3db4811962cc0b88a00ff07cc3f87a3e81d390
- SHA512 10e05559633d26f52b1d9481321b6585c93578fbffa0bbad426791f8148edbd67d02b2f166c74154192c7b11b426f00c7ee7b372ef5578512b81e4fb4737fff3
- SSDEEP 98304:wnNfMJBeiJ9a3N8rP4j18frP3wbzWFimaI7dlo:gOBeiJ9adygbzWFimaI7dl
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation IDMan.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects IDMan.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} IDMan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" IDMan.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" IDMan.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects IDMan.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} IDMan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" IDMan.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" IDMan.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm" IDMan.exe Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy IDMan.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" IDMan.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3" IDMan.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe" IDMan.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" IDMan.exe Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop IDMan.exe Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006} IDMan.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" IDMan.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243" IDMan.exe Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A} IDMan.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "IDMan.exe" IDMan.exe Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel IDMan.exe Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Software\Microsoft\Internet Explorer\Low Rights IDMan.exe Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4} IDMan.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "IDMan.exe" IDMan.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3" IDMan.exe Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote IDMan.exe Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM IDMan.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3" IDMan.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" IDMan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" IDMan.exe - Modifies registry class 13 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} IDMan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" IDMan.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32 IDMan.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1" IDMan.exe Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings firefox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID IDMan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" IDMan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter" IDMan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan" IDMan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User" IDMan.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter IDMan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IDMan.exe" IDMan.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} IDMan.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeRestorePrivilege 1532 IDMan.exe Token: SeDebugPrivilege 3332 firefox.exe Token: SeDebugPrivilege 3332 firefox.exe Token: SeDebugPrivilege 3332 firefox.exe Token: SeDebugPrivilege 3332 firefox.exe Token: SeDebugPrivilege 3332 firefox.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 3332 firefox.exe 3332 firefox.exe 3332 firefox.exe 3332 firefox.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 3332 firefox.exe 3332 firefox.exe 3332 firefox.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1532 IDMan.exe 1532 IDMan.exe 1532 IDMan.exe 3332 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1532 wrote to memory of 3932 1532 IDMan.exe 90 PID 1532 wrote to memory of 3932 1532 IDMan.exe 90 PID 1532 wrote to memory of 3932 1532 IDMan.exe 90 PID 1532 wrote to memory of 3824 1532 IDMan.exe 93 PID 1532 wrote to memory of 3824 1532 IDMan.exe 93 PID 3824 wrote to memory of 3332 3824 firefox.exe 94 PID 3824 wrote to memory of 3332 3824 firefox.exe 94 PID 3824 wrote to memory of 3332 3824 firefox.exe 94 PID 3824 wrote to memory of 3332 3824 firefox.exe 94 PID 3824 wrote to memory of 3332 3824 firefox.exe 94 PID 3824 wrote to memory of 3332 3824 firefox.exe 94 PID 3824 wrote to memory of 3332 3824 firefox.exe 94 PID 3824 wrote to memory of 3332 3824 firefox.exe 94 PID 3824 wrote to memory of 3332 3824 firefox.exe 94 PID 3824 wrote to memory of 3332 3824 firefox.exe 94 PID 3824 wrote to memory of 3332 3824 firefox.exe 94 PID 3332 wrote to memory of 3636 3332 firefox.exe 95 PID 3332 wrote to memory of 3636 3332 firefox.exe 95 PID 3332 wrote to memory of 3636 3332 firefox.exe 95 PID 3332 wrote to memory of 3636 3332 firefox.exe 95 PID 3332 wrote to memory of 3636 3332 firefox.exe 95 PID 3332 wrote to memory of 3636 3332 firefox.exe 95 PID 3332 wrote to memory of 3636 3332 firefox.exe 95 PID 3332 wrote to memory of 3636 3332 firefox.exe 95 PID 3332 wrote to memory of 3636 3332 firefox.exe 95 PID 3332 wrote to memory of 3636 3332 firefox.exe 95 PID 3332 wrote to memory of 3636 3332 firefox.exe 95 PID 3332 wrote to memory of 3636 3332 firefox.exe 95 PID 3332 wrote to memory of 3636 3332 firefox.exe 95 PID 3332 wrote to memory of 3636 3332 firefox.exe 95 PID 3332 wrote to memory of 3636 3332 firefox.exe 95 PID 3332 wrote to memory of 3636 3332 firefox.exe 95 PID 3332 wrote to memory of 3636 3332 firefox.exe 95 PID 3332 wrote to memory of 3636 3332 firefox.exe 95 PID 3332 wrote to memory of 3636 3332 firefox.exe 95 PID 3332 wrote to memory of 3636 3332 firefox.exe 95 PID 3332 wrote to memory of 3636 3332 firefox.exe 95 PID 3332 wrote to memory of 3636 3332 firefox.exe 95 PID 3332 wrote to memory of 3636 3332 firefox.exe 95 PID 3332 wrote to memory of 3636 3332 firefox.exe 95 PID 3332 wrote to memory of 3636 3332 firefox.exe 95 PID 3332 wrote to memory of 3636 3332 firefox.exe 95 PID 3332 wrote to memory of 3636 3332 firefox.exe 95 PID 3332 wrote to memory of 3636 3332 firefox.exe 95 PID 3332 wrote to memory of 3636 3332 firefox.exe 95 PID 3332 wrote to memory of 3636 3332 firefox.exe 95 PID 3332 wrote to memory of 3636 3332 firefox.exe 95 PID 3332 wrote to memory of 3636 3332 firefox.exe 95 PID 3332 wrote to memory of 3636 3332 firefox.exe 95 PID 3332 wrote to memory of 3636 3332 firefox.exe 95 PID 3332 wrote to memory of 3636 3332 firefox.exe 95 PID 3332 wrote to memory of 3636 3332 firefox.exe 95 PID 3332 wrote to memory of 3636 3332 firefox.exe 95 PID 3332 wrote to memory of 3636 3332 firefox.exe 95 PID 3332 wrote to memory of 3636 3332 firefox.exe 95 PID 3332 wrote to memory of 3636 3332 firefox.exe 95 PID 3332 wrote to memory of 3636 3332 firefox.exe 95 PID 3332 wrote to memory of 3636 3332 firefox.exe 95 PID 3332 wrote to memory of 3636 3332 firefox.exe 95 PID 3332 wrote to memory of 1272 3332 firefox.exe 96 PID 3332 wrote to memory of 1272 3332 firefox.exe 96 PID 3332 wrote to memory of 1272 3332 firefox.exe 96 PID 3332 wrote to memory of 1272 3332 firefox.exe 96 PID 3332 wrote to memory of 1272 3332 firefox.exe 96 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\IDMan.exe"C:\Users\Admin\AppData\Local\Temp\IDMan.exe"1⤵
- Checks computer location settings
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵PID:3932
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html2⤵
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3332.0.1197807800\1177232055" -parentBuildID 20230214051806 -prefsHandle 1756 -prefMapHandle 1748 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dfd11cdd-c83b-4d11-b586-b1f28ce16374} 3332 "\\.\pipe\gecko-crash-server-pipe.3332" 1848 1ffbfe10858 gpu4⤵PID:3636
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3332.1.541741509\2057518554" -parentBuildID 20230214051806 -prefsHandle 2432 -prefMapHandle 2428 -prefsLen 22927 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {692619f3-0a9c-4a14-b742-d794dbdba636} 3332 "\\.\pipe\gecko-crash-server-pipe.3332" 2444 1ffb2f89358 socket4⤵PID:1272
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3332.2.944060827\438116020" -childID 1 -isForBrowser -prefsHandle 2832 -prefMapHandle 1368 -prefsLen 23030 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {67cd3e05-8099-4f08-a299-a569aa3eedb2} 3332 "\\.\pipe\gecko-crash-server-pipe.3332" 3012 1ffc2c4b458 tab4⤵PID:3396
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3332.3.2141257195\1130376380" -childID 2 -isForBrowser -prefsHandle 4120 -prefMapHandle 4116 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {619f59d8-fb6e-45b7-84e7-f76234df9d41} 3332 "\\.\pipe\gecko-crash-server-pipe.3332" 4144 1ffc4658b58 tab4⤵PID:2000
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3332.4.131481822\523551577" -childID 3 -isForBrowser -prefsHandle 4968 -prefMapHandle 4964 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c7337d1-152c-4167-8c79-4b1b5882969a} 3332 "\\.\pipe\gecko-crash-server-pipe.3332" 4972 1ffc6598758 tab4⤵PID:3060
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3332.5.285317382\574015761" -childID 4 -isForBrowser -prefsHandle 3076 -prefMapHandle 3060 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f0a21e55-d0db-46dc-8300-57be89bdc39e} 3332 "\\.\pipe\gecko-crash-server-pipe.3332" 3116 1ffc4650158 tab4⤵PID:2448
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3332.6.921914734\1680966437" -childID 5 -isForBrowser -prefsHandle 5336 -prefMapHandle 5280 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7043d0c2-dd18-4f42-87b5-2df062d58f87} 3332 "\\.\pipe\gecko-crash-server-pipe.3332" 5364 1ffc719c958 tab4⤵PID:3428
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3332.7.1973568853\997662188" -childID 6 -isForBrowser -prefsHandle 5320 -prefMapHandle 5324 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5778ee69-b2cc-4eda-bdb5-cfd1cc2f2f17} 3332 "\\.\pipe\gecko-crash-server-pipe.3332" 5496 1ffc719a258 tab4⤵PID:4060
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ntkangc5.default-release\activity-stream.discovery_stream.json.tmp
- Size 30KB
- SHA256 328dce10b5dd01eb2dc2035b81648507f8f599875833de692b442697a6833527
- MD5 cc77168e54a711c8dd5eec14aef29b90
- SHA1 5ae423de92ab585f55e320a3358d1c806d030c11
- SHA512 f67c8e21e1586fc1ba820b15c90fff1e98fc6418b606b7aa58db09646225e63d3b002359936e15f0dc4f2286cdc202e174a7bab609ff0c2d696b8eb66964ff05
- SSDEEP 384:r3dz/EjjQDXc9hcqqGRGoSGAQaKozgQGCf7aaDPBjLXQg2ipOphfksXYSyauqbp3:r3dLEPPso6QNOgQBf7F1wn8hSydZXWJl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ntkangc5.default-release\cache2\entries\F4EFE37A30D0F14C6AC03FF7949A51CBC2EBC649
- Size 13KB
- SHA256 3ea3bc507423e8c52a5feb87d71cc082623c4acec8837f7224cc2aea6cff7ea2
- MD5 3f2f6345aae047232217edfda38c50c3
- SHA1 03f4e6c63f9d40055d5bab5086cd74037ed7d6d4
- SHA512 57a875bf14798baf222e7b9886891a0d5eac9a126190fb72abc05a9a23d9b3e4c955d285290090b2c9a26649e6fda0844c88fe24654597b11f349252e2ad2b33
- SSDEEP 384:Hlxu9fiGLm4pUUuL6eFuFmn/4OgQ2TdlqGPUcP+AWRMAClLeBLeo:SBi8mCUUVewUn/4dlqkD+hRMFEAo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 442KB
- SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
- MD5 85430baed3398695717b0263807cf97c
- SHA1 fffbee923cea216f50fce5d54219a188a5100f41
- SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
- SSDEEP 12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
- Size 8.0MB
- SHA256 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
- MD5 a01c5ecd6108350ae23d2cddf0e77c17
- SHA1 c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
- SHA512 b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
- SSDEEP 196608:945hXmP7/cvflwtf0FzVC/5lHevzc8XZbivwEiw3cFTx7z4zV:9tP7/cvflof0FzVgKRF9zw3c9x4zV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
- Size 997KB
- SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
- MD5 fe3355639648c417e8307c6d051e3e37
- SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
- SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
- SSDEEP 12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
- Size 116B
- SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
- MD5 3d33cdc0b3d281e67dd52e14435dd04f
- SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
- SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
- Size 479B
- SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
- MD5 49ddb419d96dceb9069018535fb2e2fc
- SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
- SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
- Size 372B
- SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
- MD5 8be33af717bb1b67fbd61c3f4b807e9e
- SHA1 7cf17656d174d951957ff36810e874a134dd49e0
- SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
- Size 11.8MB
- SHA256 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
- MD5 33bf7b0439480effb9fb212efce87b13
- SHA1 cee50f2745edc6dc291887b6075ca64d716f495a
- SHA512 d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
- SSDEEP 196608:lP4/vkvbdjMq4ytbko4qIUcXkhrVp1HSTDsoTn90lcGeFaxJI3qLaLhFT7Uc:lPcvyiXSWxRU/OpZXJFee3qGhFMc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
- Size 1KB
- SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
- MD5 688bed3676d2104e7f17ae1cd2c59404
- SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
- SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
- Size 1KB
- SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
- MD5 937326fead5fd401f6cca9118bd9ade9
- SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
- SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\prefs-1.js
- Size 8KB
- SHA256 e9bb4e1c814cad37c2cd59e595182087422298dfa2e9929fe25c6946136623f4
- MD5 fdd379f7b5ad7493ba4aae6d1a266fbd
- SHA1 be3c3dd19254d06a49082dee7e211bcb755f6db1
- SHA512 ffe2aa8b82749e77a426607d0cbf531816d5a3debf3026d88b385caea9492a21c04edc4987d64d9217c8c63deac8726440e93cd9deec4b57109dc720994b099f
- SSDEEP 192:8HnGRZfACBH0XbJj3IYjAiWBw8Hc9mASo:5M5IYUjwn7f
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\prefs-1.js
- Size 7KB
- SHA256 e3d10da480d32c3934032d7e1b4f1afd117a68ec62f03fb4fb887665865deaf1
- MD5 0b08546696f110f1fd9cd715058120cb
- SHA1 88373e892716db792fd2a0fedddfc487c4e229ab
- SHA512 a6f83431349eee945d236cc36f14ab33ccdec9b884bfe27adb786bba9a0e69a52755d89343b48901c52be3733f29a14d67dcdc35be705a2c61db5e19997f4b1b
- SSDEEP 96:xHEHVnUTU7qGqZfAC1LHzSC0XlnBOjKj3I2HjURaBw8Hc92tSo:qVnGRZfACBH0XbJj3IYjAaBw8Hc9OSo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\sessionstore-backups\recovery.jsonlz4
- Size 3KB
- SHA256 d3d5c64b0ab8d005c11bfa13a81e25ca33e5a634e1524f3a5792485f2d6eba33
- MD5 8908452f98fb1b2fbb0e73ab46993298
- SHA1 091c6a93d5a9a20ef49243c193458e29fb97f82b
- SHA512 e95a3f3848fb229eb1033571e8482bd5612929a8cb5b7e0c2ee4c0e2d664daaf5d80b9e43d95c62f975a87e594809bd0f054e7405bb907a2b81185a704741ec4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\sessionstore-backups\recovery.jsonlz4
- Size 3KB
- SHA256 041901b3c4c03acf5fa0f2b36abc0525ceb13aad8251ae1d90352781f974e72a
- MD5 11ef140d6624bfd151c8d2fb390d6b8d
- SHA1 669199c4611b7bbceaa247d075f2fde7c128174d
- SHA512 ad8a857e55b64d99bdeeba056304463ab51f684059bae1255527fa55a9c5cd148b0c7bddbe7b317107d9e17ad9e5939b86f0cd6ea46a54e02e8db616e8173f3f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\sessionstore-backups\recovery.jsonlz4
- Size 3KB
- SHA256 1dd865534a38679334c9d8d35b85ec8ccfef23b346c4e0573819c128b0fbcbae
- MD5 d1b6300e9bc1e70dfcf080efb97be8a0
- SHA1 59092fd330dc841fcf953ad8d4a211189890e367
- SHA512 c9b5e7a1b903b376b094d77115bfc9c16ac7e8a2923b411b96165531faf235bffdb5a2e8abd637e7f0ac665d7ec24ddf15771cf58d8f0289cc6a5d1150c62c34
- MD5 SHA1 SHA512